Court case W287 2271595-1 – Court Ruling (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A data subject brought a complaint to the DPA in April 2022. The data subject requested an address publisher and direct marketing company (the controller) to delete all their personal data and no longer process it in the future, referring to both Article 17 GDPR and Article 21 GDPR. The controller deleted data at the request of the data subject, however later notified them that the data had been re-collected in an response to an information request by the data subject. The data was also transferred to direct marketing companies and address publishers. The DPA upheld the complaint in March 2023, and stated that the controller processed the data unlawfully by reusing it for direct marketing purposes. According to the DPA, the data subject made a clear wish of wanting to prevent their data being processed for marketing purposes, and therefore the controller had violated Article 5(1)(a) GDPR and 5(2) GDPR in conjunction with Article 21(2) GDPR. The DPA saw no need to determine whether the data subject had carried out a request for erasure or a request for erasure and objection; according to the DPA, the request clearly showed the will of the data subject. The controller appealed the decision to the Federal Administrative Court in April 2023. It argued that it had complied with the data subject’s deletion request; by completely deleting the data, it also deleted the data subject’s request to delete it. Therefore, re-collecting the data was a possibility. According to the controller, if the data subject had not requested to completely delete the data, it would have simply “blocked” the data from future processing. Furthermore, the data subject’s data was re-collected due to research performed by the controller. It is important to note here that the controller did not inform the data subject of the distinction between blocking the use of data for future marketing purposes and deleting the data (and potentially re-collecting it). The Court first stated that in order for
GDPR Articles Cited
A data subject brought a complaint to the DPA in April 2022. The data subject requested an address publisher and direct marketing company (the controller) to delete all their personal data and no longer process it in the future, referring to both Article 17 GDPR and Article 21 GDPR. The controller deleted data at the request of the data subject, however later notified them that the data had been re-collected in an response to an information request by the data subject. The data was also transferred to direct marketing companies and address publishers. The DPA upheld the complaint in March 2023, and stated that the controller processed the data unlawfully by reusing it for direct marketing purposes. According to the DPA, the data subject made a clear wish of wanting to prevent their data being processed for marketing purposes, and therefore the controller had violated Article 5(1)(a) GDPR and 5(2) GDPR in conjunction with Article 21(2) GDPR. The DPA saw no need to determine whether the data subject had carried out a request for erasure or a request for erasure and objection; according to the DPA, the request clearly showed the will of the data subject. The controller appealed the decision to the Federal Administrative Court in April 2023. It argued that it had complied with the data subject’s deletion request; by completely deleting the data, it also deleted the data subject’s request to delete it. Therefore, re-collecting the data was a possibility. According to the controller, if the data subject had not requested to completely delete the data, it would have simply “blocked” the data from future processing. Furthermore, the data subject’s data was re-collected due to research performed by the controller. It is important to note here that the controller did not inform the data subject of the distinction between blocking the use of data for future marketing purposes and deleting the data (and potentially re-collecting it). The Court first stated that in order for
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W287 2271595-1 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W287 2271595-1 - Austria (2025). Retrieved from cookiefines.eu
Last updated: