Court case W214 2254151-1 – Court Ruling (Austria, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The data subject is the owner of an apartment. The controller managed the building where the data subject's apartment was located. The building heating was provided by a company (K-Company). Additionally, each apartment had an individual contract with another provider (I-Company). Also, the controller concluded an agreement with I-Company according to which I-Company prepared the consumption invoices, using for that purpose data provided by the controller. The building's apartments were equipped with meters capable to send consumption data regarding water (cold and hot) & heating to I-Company. The apartments’ owners received the individual statements of water (cold and hot) & heating. Remote meter (radio-based) monitored the consumption. The data subject's meter was not calibrated since 2018 and the data subject refused I-Company access to the apartment. Consequently, the data subject received consumption statement based on extrapolated values. The data subject requested, under Article 16 GDPR, the controller to rectify their data regarding the extrapolated consumption. The controller claimed that they didn’t prepare the consumption invoices and that the data could not be rectified by them. In response, the data subject lodged a complaint with the Austrian DPA (DSB). The DPA examined the case and found the controller didn’t transmit incorrect data used for billing the data subject. Moreover, it was the I-Company who prepared the individual invoices. Hence, the controller was unable to rectify the data. Additionally, for the DPA the controller was not a controller under Article 4(7) GDPR, as they didn’t determine the means and purposes of data processing. The data subject initiated the appeal proceedings before the Federal Administrative Court (Bundesverwaltungsgericht). The court dismissed the appeal. The court found that the Controller was a data controller for the processing at hand. It was apparent that the controller determined the means and purposes of
GDPR Articles Cited
National Law Articles
The data subject is the owner of an apartment. The controller managed the building where the data subject's apartment was located. The building heating was provided by a company (K-Company). Additionally, each apartment had an individual contract with another provider (I-Company). Also, the controller concluded an agreement with I-Company according to which I-Company prepared the consumption invoices, using for that purpose data provided by the controller. The building's apartments were equipped with meters capable to send consumption data regarding water (cold and hot) & heating to I-Company. The apartments’ owners received the individual statements of water (cold and hot) & heating. Remote meter (radio-based) monitored the consumption. The data subject's meter was not calibrated since 2018 and the data subject refused I-Company access to the apartment. Consequently, the data subject received consumption statement based on extrapolated values. The data subject requested, under Article 16 GDPR, the controller to rectify their data regarding the extrapolated consumption. The controller claimed that they didn’t prepare the consumption invoices and that the data could not be rectified by them. In response, the data subject lodged a complaint with the Austrian DPA (DSB). The DPA examined the case and found the controller didn’t transmit incorrect data used for billing the data subject. Moreover, it was the I-Company who prepared the individual invoices. Hence, the controller was unable to rectify the data. Additionally, for the DPA the controller was not a controller under Article 4(7) GDPR, as they didn’t determine the means and purposes of data processing. The data subject initiated the appeal proceedings before the Federal Administrative Court (Bundesverwaltungsgericht). The court dismissed the appeal. The court found that the Controller was a data controller for the processing at hand. It was apparent that the controller determined the means and purposes of
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W214 2254151-1 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W214 2254151-1 - Austria (2024). Retrieved from cookiefines.eu
Last updated: