Enforcing jurisdiction
Austria · Geography does not establish applicable law.
Confirmed applicable legislation
Privacy topics

Court case W287 2271595-1 – Court Ruling (Austria, 2025)

Court Ruling
DPA BVwG9 April 2025Austria
final
Court Ruling

Privacy enforcement record

This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.

An Austrian court ruled that a marketing company reused a person's data without permission after they requested it be deleted. This decision highlights the importance of respecting individuals' wishes regarding their personal information. Companies must ensure they understand the difference between deleting data and simply blocking its use.

What happened

The marketing company re-collected personal data after a user requested its deletion.

Who was affected

The individual whose personal data was re-collected by the marketing company.

What the authority found

The court found that the marketing company unlawfully processed the individual's data by reusing it for marketing purposes, violating GDPR rules.

Why this matters

This ruling emphasizes that companies must strictly adhere to deletion requests and cannot simply ignore them. It serves as a reminder for businesses to have clear processes for handling personal data.

Recorded legal citations
Automatically processed
Art. 17 GDPR
Art. 5(1)(a) GDPR
Art. 5(2) GDPR
Art. 21(2) GDPR
View original scraped data
Art. 5(1)(a) GDPR
Art. 5(2) GDPR
Art. 17(GDPR)
Art. 21(2) GDPR

Original imported citations before automated processing; the processing history does not establish independent verification.

Decision AuthorityBVwG

Source checks

Linked-source text retrieved.

Automated check recorded — 20 March 2026.

Processing notes: articles corrected, national law identified.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

A data subject brought a complaint to the DPA in April 2022. The data subject requested an address publisher and direct marketing company (the controller) to delete all their personal data and no longer process it in the future, referring to both Article 17 GDPR and Article 21 GDPR. The controller deleted data at the request of the data subject, however later notified them that the data had been re-collected in an response to an information request by the data subject. The data was also transferred to direct marketing companies and address publishers. The DPA upheld the complaint in March 2023, and stated that the controller processed the data unlawfully by reusing it for direct marketing purposes. According to the DPA, the data subject made a clear wish of wanting to prevent their data being processed for marketing purposes, and therefore the controller had violated Article 5(1)(a) GDPR and 5(2) GDPR in conjunction with Article 21(2) GDPR. The DPA saw no need to determine whether the data subject had carried out a request for erasure or a request for erasure and objection; according to the DPA, the request clearly showed the will of the data subject. The controller appealed the decision to the Federal Administrative Court in April 2023. It argued that it had complied with the data subject’s deletion request; by completely deleting the data, it also deleted the data subject’s request to delete it. Therefore, re-collecting the data was a possibility. According to the controller, if the data subject had not requested to completely delete the data, it would have simply “blocked” the data from future processing. Furthermore, the data subject’s data was re-collected due to research performed by the controller. It is important to note here that the controller did not inform the data subject of the distinction between blocking the use of data for future marketing purposes and deleting the data (and potentially re-collecting it). The Court first stated that in order for

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Related Cases (0)

No other cases found for Court case W287 2271595-1 in AT

This is the only recorded case for this entity in this jurisdiction.

Details

Ruling Date

9 April 2025

Authority

DPA BVwG

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. Court case W287 2271595-1 - Austria (2025). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: