OGH - 6Ob127/20z: Difference between revisions
(→Facts) |
No edit summary |
||
(5 intermediate revisions by 2 users not shown) | |||
Line 43: | Line 43: | ||
|Party_Link_5= | |Party_Link_5= | ||
|Appeal_From_Body=OLG Linz | |Appeal_From_Body=OLG Linz (Austria) | ||
|Appeal_From_Case_Number_Name=2 R 35/20k-19 | |Appeal_From_Case_Number_Name=2 R 35/20k-19 | ||
|Appeal_From_Status= | |Appeal_From_Status= | ||
Line 56: | Line 56: | ||
}} | }} | ||
The Austrian Supreme Court held that | The Austrian Supreme Court held that a declaratory judgment on the controller's obligation to provide access to certain data in case of further access requests by the same data subject is not feasible if the controller had already fulfilled the data subject's requests under Article 15 and 21 GDPR. | ||
==English Summary== | ==English Summary== | ||
===Facts=== | ===Facts=== | ||
The controller (defendant) | The controller (defendant) is the biggest logistics and postal service provider in Austria. Its main business activities include the transport of letters, advertising mail, print media, and parcels. Furthermore, the defendant also conducts business as an address publisher under § 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO) and sells personal data for third-party marketing purposes. | ||
On 14.01.2019 the data subject (claimant) sent an access request under Article 15 GDPR to the controller on which the controller replied to on 14.02.2019. Besides data | On 14.01.2019 the data subject (claimant) sent an access request under Article 15 GDPR to the controller on which the controller replied to on 14.02.2019. Besides data such as name and phone number the controller stated to process certain "marketing classifications" under § 151(6) GewO. These "marketing classifications" are calculated based on a a variety of socio-demographic circumstances (e.g. age, place of residence, level of education) and express a statistic probability of the data subject belonging to a certain demographic group (e.g. "do-it-yourselfer", "night owl", "person with affinity for investments"). | ||
The data subject was not content with the controller's reply and filed a lawsuit for the | The data subject was not content with the controller's reply and filed a lawsuit for the provision of access under Article 15 and erasure under Article 17 GDPR in connection with Article 21 GDPR. Furthermore, the data subject requested a declaratory judgment that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR <u>in the case of further access requests by the data subject.</u> | ||
The first instance court rejected the | The first instance court (Regional Court Wels - LG Wels) rejected the lawsuit, holding that the controller had already fulfilled the data subject's requests. Following an appeal by the data subject, the second instance court (Higher Regional Court Linz - OLG Linz) partially overturned this decision and held that the data subject had indeed a legal interest in the claimed declaratory judgment. Consequently, it held that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR in the case of further access requests by the data subject | ||
===Dispute=== | |||
In the course of the procedures before the LG Wels, the OLG Linz and the Austrian Supreme Court (Oberster Gerichtshof - OGH), several legal questions arose: | |||
*Can a data subject file a lawsuit under Article 79 GDPR in cases of an alleged violation of Article 15 GDPR or can such violation only be subject to a complaint before a DPA under Article 77 GDPR? | |||
*Do "marketing classifications" under § 151(6) GewO qualify as personal data under Article 4(1) GDPR although they only express a statistic probability? | |||
*Does the data subject have a legal interest - as required under § 228 Austrian Civil Procedure Code (Zivilprozessordnung - ZPO) - in a declaratory judgment that the controller is under the legal obligation to provide access under Article 15 GDPR in the case of further access requests by the data subject? | |||
===Holding=== | |||
The OGH overturned the decision of the OLG and restored the decision of the first instance court. It held that | |||
*a lawsuit under Article 79 GDPR regarding the alleged violation of Article 15 GDPR is indeed feasible. Article 79 GDPR is not limited to certain data subject rights such as erasure under Article 17 GDPR. This is in line with the OGH's previous case-law. | |||
*"marketing classifications" under § 151(6) GewO qualify as personal data. The term "information" in Article 4(1) GDPR is not limited to statements about verifiable characteristics or factual circumstances with regard to the data subject but also includes evaluations and assessments him or her. Hence, also a statistic probability that is assigned to a certain data subject qualifies as personal data. This is in line with case-law by the Austrian Administrative Court ([[BVwG - W258 2217446-1|W 258 2217446-1]] on the presumed "affinity for a political party"). | |||
*the data subject does not have a legal interest in a declaratory judgment that the controller is under the legal obligation to provide access under Article 15 GDPR in the case of further access requests by the data subject. The controller had already fulfilled the data subject's access request and declared to comply with the data subject's objection under Article 21 GDPR by refraining from any further processing of his or her data. Therefore, further access request are not to be expected and the data subject has no legal interest in the requested declaratory judgment. | |||
The Austrian | |||
==Comment== | ==Comment== | ||
Line 88: | Line 91: | ||
<pre> | <pre> | ||
ON BEHALF OF THE REPUBLIC | |||
The Supreme Court, as a court of appeal, has | |||
by the President of the Senate, Dr Schramm, as Chairman and the Court Councillors, Dr Gitschthaler, Dr Kodek, Dr Nowotny and the Court Councillor, Dr Faber, as further Judges in the case of the plaintiff, Dr L*****, represented by Dr Johannes Kirschner, Rechtsanwalt in Wels, against the defendant, Ö***** Aktiengesellschaft, *****, represented by Wolf | |||
Theiss Rechtsanwälte GmbH & Co KG, Vienna, on the grounds of | |||
on the appeal of the defendant against the judgment of the Linz Higher Regional Court (Oberlandesgericht) as the court of appeal of 10 April 2020, GZ 2 R 35/20k-19, by which the judgment of the | |||
Landesgericht Wels (Regional Court of Wels) of 27 December 2019, GZ 2 Cg 72/19v-15, was amended in part, in a closed session: | |||
The appeal is allowed. | |||
The contested decision is annulled | |||
that the judgment of the court of first instance be restored. | |||
The plaintiff is obliged to pay to the defendant the | |||
EUR 488.46 (including EUR 45.74 VAT and EUR 214 cash expenses) within 14 days. | |||
D e s c r i p t i o n s : | |||
[1] The Respondent is the nation's leading | |||
Logistics and postal service provider, whose | |||
The defendant's main business activities include the transport of letters, advertising mail, print media and parcels. In addition, the defendant has a trade licence as an "address publisher and direct marketing company" within the meaning of § 151 GewO, i.e. it is entitled to "ascertain personal data from publicly accessible information, by questioning the persons concerned, from third-party customer and prospect file systems or as marketing file systems of other address publishers and direct marketing companies". Address publishers and direct marketing companies are allowed to use collected marketing information and | |||
also attribute marketing classifications to specific persons by name on the basis of marketing analysis procedures and use these marketing groups for marketing purposes and transmit them to third parties under certain conditions. | |||
[2] At the request of the plaintiff, a | |||
lawyer, dated 14 January 2019, the defendant provided him with information on the personal data processed in relation to his person in a letter dated 14 February 2019. According to this, the following data was stored about the plaintiff: | |||
Telephone number, academic, bio-affinity, night owl, do-it-yourselfer, investment-affinity, life stage (shop), | |||
Distance selling affinity, parcel frequency, parcel recency; number of parcels per year; number of weeks/year getting parcels; mail order buyers; number of parcels in the period 6 to 12 months ago. The marketing data about the plaintiff cited in this disclosure letter had been collected by the defendant on the legal basis of the defendant's business licence. The affinities mentioned (did) merely represent the allocation of a certain person to a marketing group on the basis of the attribution of certain marketing classifications by means of a marketing analysis procedure. The actual meaningfulness of, for example, the attribute | |||
"Investment affinity" therefore did not mean that data on the financial conduct of a certain person was collected and evaluated, but merely that this person was assigned to a marketing group on the basis of certain socio-demographic circumstances (age, place of residence, level of education, etc.), with regard to which the existence of the attribute (investment affinity) was assumed with a certain probability. This means that the attribute could have been weak or even not pronounced at all, the person concerned could even have been investment-averse and yet the assignment to the marketing group as such was statically correct. In the | |||
In its letter of information, the defendant also informed the plaintiff that his data had not been passed on to third parties for marketing purposes; in the attachment to the letter, however, a passing on of the plaintiff's forwarding data to N***** GmbH was indicated. It is not established that the plaintiff's personal data were transmitted or passed on to third parties. | |||
[3] The letter of information did not contain any information on the plaintiff's stored email addresses, although it is not established in this context that the plaintiff's email address l*****@gmail.com originates from a source other than the postal account he himself created with the defendant, to which the plaintiff had registered on 1 December 2017 using this email address, and that the processing of the email address would not be necessary in order to communicate with the plaintiff on the part of the defendant. The fact that the plaintiff was entitled to have the (private) email address deleted was communicated to him in the information letter of 14 February 2019 with reference to the data protection statement and by citing several communication channels. The plaintiff had and has the possibility to delete his account with the defendant himself at any time by logging in there and confirming the button "Delete registration" in the "Settings" area. This would also have deleted the email address. The deletion was not requested by the defendant out of court. | |||
[4] The Court of Appeal - in partial amendment of the decision of the court of first instance, which had granted the entire claim for declaratory judgment, data deletion and | |||
The court had rejected the plaintiff's request for information in the first instance - and had ruled vis-à-vis the defendant that, in the event of any requests for information on data relating to bioaffinity, nocturnality, etc., the defendant would be obliged to provide the plaintiff with the information requested in the first instance, | |||
Do-it-yourself property, academic property, | |||
phase of life, investment and distance trading affinity and childlessness of the plaintiff information in the sense of the | |||
Data Protection Act (Article 15(1)(a) to (g) of the GDPR). In addition, the Court of Appeal ruled that the ordinary appeal was admissible; there was a lack of case law of the Supreme Court on the admissibility of the corporate processing and utilisation of personal data under the | |||
Basic Data Protection Regulation (GDPR). | |||
[5] In the matter itself - as far as this is relevant for the | |||
The Court of Appeal expressly affirmed, albeit only in the reasons for the decision, the admissibility of the legal action, as the plaintiff was not seeking damages, but rather based his claim on the violation of his personal right to data protection due to the denial of the right to information and on claims for removal. The claims made by the defendant pursuant to | |||
According to the plaintiff, the data collected under section 151 of the GewO are personal, as Article 4(1) of the GDPR is not limited to sensitive or private information, but covers all types of information, both objective and subjective, in the form of opinions or assessments, provided that it is information about the person in question. It follows from this that, pursuant to section 1(3)(1) of the FADP in conjunction with Article 15 of the GDPR, in the event of future (further) enquiries by the plaintiff, there is a right to information about any data collected and stored pursuant to section 151(6) of the GewO, which means that the (modified) request for a declaratory judgement is justified; pursuant to section 151(6) of the GewO, the plaintiff has a right to information about any data collected and stored pursuant to section 151(6) of the GewO. | |||
Section 228 of the ZPO states that the (non-)existence of a | |||
legal (relationship) ascertainable. | |||
[6] The defendant's appeal is admissible; it is also justified. | |||
[7] 1 The defendant also denies in the | |||
The Commission questions the admissibility of the legal remedy in the appeal proceedings and takes the view that Art 79 GDPR does not provide for a judicial remedy for "pure" requests for information. In doing so, it overlooks the fact that a meritorious settlement of such an objection by the Supreme Court would not constitute a binding decision within the meaning of § 42 of the Data Protection Act. | |||
Paragraph 3 of the JN even if the | |||
Court of Appeal - as here - (only) expressly denied the existence of a procedural impediment in the reasons for its decision; procedural impediments can no longer be perceived at higher instance if a binding decision of the Court of Appeal concerning them is opposed (RS0043800; on the affirmation of the admissibility of the legal remedy 10 ObS 267/00p; 1 Ob 88/12s ecolex 2012/346 [Wilhelm]), irrespective of whether the nullity had been asserted in an appeal or had been considered by the Court of Appeal ex officio. | |||
(8 Ob 54/03d). | |||
[8] However, in order to clarify the legal situation, the discerning senate considered: | |||
[9] 1.1 Under the legal situation prior to the entry into force of the GDPR, the right to information pursuant to Section 32 of the GDPR 2000 was always enforceable before the data protection authority in Austria, which is why it is now also disputed whether the right to information is covered by Article 79(1) of the GDPR (cf. the references in Leupold/Schrems in Knyrim, DatKomm Art 79 DSGVO Rz 13 FN 29). | |||
[10] According to the purpose of the provision, the | |||
However, it is precisely the exercise of the right of access that clarifies whether or not data processing is taking place, which is why, with regard to the intended effectuation of law enforcement, it cannot be assumed that the European legislator wanted to weaken the legal protection of data subjects in such a way that the right of access should not be covered by Art 79 (1) of the GDPR (Leupold/Schrems loc. cit.; similarly Bergt in Kühling/Buchner, DS-GVO Art 79 Rz 6). Also according to Jahnel | |||
(On the interplay between the administrative law route and the civil law route and the interfaces with constitutional law and European law, in | |||
Nunner-Krautgasser/Garber/Klauser, Rechtsdurchsetzung im Datenschutz nach der DSGVO und dem DSG 2018, 67 [71]), a data subject may directly assert claims before the civil courts on the basis of Art 79 GDPR in the event of infringements of rights which he or she has under the GDPR, in particular also claims for information. | |||
[11] The wording of Article 79(1) of the GDPR generally refers to the "rights conferred by this Regulation". Von Lewinski (in Eßer/Kramker/von Lewinski, DSGVO-BDSG6 Art 79 DSGVO Rz 2) therefore states that this provision is directed at the enforcement of a right to cease and desist, but also extends to other (ancillary) claims such as the enforcement of (performance) claims for information. | |||
[12] However, Martini (in Paal/Pauly, DSGVO-BDSG² Art 79 DSGVO Rz 22a) expresses doubts, but elsewhere (Rz 12) also refers to the dual system of legal protection before the courts and the supervisory authority. Kreße (in Sydow, DSGVO² Art 79) also mentions the right to information in margin no. 7, differentiated in | |||
Rec 16 f then, however, whether information on whether data are processed at all (Art 15(1)(1) GDPR) or whether information on specific processed data is requested (Art 15(1)(2) GDPR). | |||
1.2 The competent panel of experts has already ruled in | |||
the decisions 6 Ob 131/18k (ecolex 2019/151 [Zemann] = iFamZ 2019/78 [Deixler-Hübner] = jusIT 2019/29 [Thiele; | |||
Jahnel, 123] = RZ 2019/11 [Spenling] = MR 2019, 190 | |||
[Walter]) and 6 Ob 91/19d (VbR 2019/87 [Schmidl, | |||
VbR 2020, 160] = jusIT 2019/55 [Jahnel/Thiele]) dealt in detail with the system of dual legal protection under the GDPR and affirmed it in principle. If, however, according to the decision 6 Ob 131/18k, the two-track system applies in any case to the claim for erasure, it would be difficult to justify why this should not be the case for the right of access. | |||
The right to information should be different, especially since it is also a right under private law (cf. Leupold/Schrems in Knyrim, DatKomm Art 79 DSGVO Rz 2). Also Bergt (in Kühling/Buchner, DS-GVO Art 79 | |||
marginal no. 13) believes that the assertion of claims for information, injunctive relief or damages against persons responsible or principals is admissible in court parallel to the complaint to the supervisory authority. | |||
[13] 1.3 Recently, the Senate has also | |||
Admissibility of an action for the provision of a copy under Art 15(3) GDPR affirmed (6 Ob 138/20t). | |||
[14] 1.4 The Court of Appeal thus correctly assumed the admissibility of legal action for the assertion of data protection claims. | |||
The claim for information was assumed to be valid. | |||
[15] 2 Art. 4 No. 1 GDPR defines | |||
"personal data" as any information relating to an identified or identifiable natural person. The term is to be understood broadly (Hödl in Knyrim, DatKomm Art 4 DSGVO Rz 9; Eßer in Eßer/Kramer/von Lewinski, DSGVO-BDSG6 Art 4 DSGVO Rz 7). | |||
[16] 2.1 Therefore, even inner states such as | |||
Opinions, motives, desires, beliefs and | |||
Value judgements as well as statistical probability statements, which do not merely represent forecast or planning values, but provide subjective and/or objective assessments of an identified or identifiable person, have a personal reference (Hödl loc. cit.; Klar/Kühling in Kühling/ Buchner, DS-GVO Art 4 No. 1 Rz 10; also personal | |||
Ernst in Paal/Pauly, DSGVO-BDSG² Art 4 DSGVO Rz 14). Thus, the concept of | |||
"Information" not only statements about verifiable characteristics or factual circumstances of the data subject, but also assessments and judgements about him or her, such as "X is a reliable employee" (Klabunde in Ehmann/Selmayer, DS-GVO² Art 4 Rz 9; cf. also Gola in | |||
Gola, DSGVO² Art 4 Rz 13). In this sense, data with | |||
The data are also related to a person if they are incorrect (Reimer in Sydow, DSGVO² Art 4 Rz 41); the truth content is irrelevant for the consideration (Klabunde loc. cit.). Probability information is personal, regardless of whether it relates to facts in the past, present or future (Ernst loc. cit.). | |||
[17] Aggregated or statistical data, on the other hand, are not personal if they no longer permit any conclusions to be drawn about an individual person, which can be determined in individual cases on the basis of the selected group size, the | |||
levels of aggregation or the level of aggregation shown in the statistics. | |||
characteristics (Eßer in Eßer/Kramer/von Lewinski, DSGVO-BDSG6 Art 4 DSGVO Rz 31; Klar/Kühling in Kühling/Buchner, DSGVO-BDSG³ Art 4 Nr 1 DSGVO Rz 15). It therefore depends on whether a collective statement is made about a group of persons or whether an individual is identified as a member of a group of persons, for example, when classifying data stored for advertising purposes, if residents of a street are assigned to a certain group of buyers or purchasing power class based on the population structure (Gola in Gola, DSGVO² Art 4 Rz 8); on the other hand, a statement that the sickness rate of the employees of company A has increased by X % would be different if the company employs a large number of employees (Klar/Kühling loc. cit.). | |||
[18] Knyrim (Zur Zulässigkeit des Adresshandels der Ö***** AG, ecolex 2019, 715), which the court of first instance had agreed with, takes the view that the probability data determined by the postal service do not represent statements about specific persons, but rather anonymous, abstract averages of marketing groups that are merely "attributed" to a person. The criterion of information about a specific person was therefore already lacking, which was why it was "questionable" whether the probability data in question could be classified as personal data and therefore fell under the GDPR. The discerning senate is unable to agree with this: | |||
[19] 2.2 In the sense of 2.1. above | |||
The opinions expressed in this report are subject to the | |||
information falls under the regime of the GDPR, since it is directly associated with the plaintiff and contains statements about his or her preferences and attitudes, for example; whether the assessments are actually accurate, however, is irrelevant. Even the fact that the data are (only) calculated using statistical probabilities does not change the existence of personal data. The "affinities" contain a probability statement about certain interests and preferences of the plaintiff. This is not contradicted by the decision of the Court of Justice of the European Union. | |||
(ECJ) (Cases C-141/12 and C-372/12) . | |||
[ECLI:EU:C:2014:2081]), on which the defendant relies in its appeal, it is expressly stated there that the data used in the analysis of the residence permit are indeed personal data. | |||
[20] Incidentally, the same conclusion was reached as recently as | |||
Most recently, the Federal Administrative Court (W 258 2217446-1) in the proceedings concerning a decision of the | |||
Data protection authority, which also has the "special[n] | |||
Categories of personal data in the context of the | |||
Pursuit of the trade of 'Address publishers and | |||
The subject matter of this case was "direct marketing companies" in the absence of the consent of the data subjects". The | |||
The Federal Administrative Court held (para. 3.2.3) that the linking of party affinity with an individual person fulfilled the content element of personal information; thus, even if the actual political opinion of the person concerned is not known, party affinity contains a direct statement about the specific person, namely how likely he or she is to be interested in advertisements from a specific political party; this | |||
statement , even if it is based on the | |||
method of determination is subject to a statistical range of variation, is not entirely random, but is derived from correlations obtained from opinion polls and election results; it is a statistically based assessment of the person in relation to their interest in advertising for a particular political party. | |||
[21] 2.3 Pursuant to Section 151(1) GewO, on which the defendant relies, the provisions of the GDPR and the FADP are to be applied to the use of personal data for marketing purposes of third parties by traders authorised to exercise the trade of address publishers and direct marketers, unless otherwise provided below. Pursuant to section 151(6) of the GewO, traders may use marketing information and classifications collected for marketing purposes pursuant to subsection (1) and attributed to specific persons by name on the basis of marketing analysis procedures only for marketing purposes and, in particular, transmit them to third parties only if the third parties unobjectionably declare that they will use these analysis results exclusively for marketing purposes. § 151 | |||
Paras 8 and 9 GewO contain provisions on the | |||
Right of cancellation and the so-called "Robinson list". | |||
[22] 2.3.1 The content of § 151 para 6 GewO consists of | |||
in that the use of marketing information and classifications (which were determined as a result of statistical evaluations and have no claim to accuracy per se), which are attributed to specific persons by name on the basis of marketing analysis procedures, is tied to the exclusive purpose of marketing. Furthermore, data collected for this purpose may only be transferred to third parties if they unobjectionably declare that they will use these analysis results exclusively with the intention of using them for marketing; this can only be done by contract (Riesz in Ennöckl/Raschauer/Wessely, GewO § 151 Rz 28). According to section 151(6) GewO, in order to prevent misuse, analysis results may thus only be used within a very narrow legal corset, namely only charged by an address publisher and direct marketing company registered for this purpose in the trade register and only passed on against submission of a declaration of no objection that they will be used exclusively for marketing purposes (Knyrim, ecolex 2019, 715). | |||
[23] 2.3.2 § 151 para 6 GewO empowers | |||
address publishers and direct marketing companies to transmit the data collected or determined by them to third parties in order to be able to use these data in a commercially reasonable manner. However, the provision does not refer to data transmitted by third parties to traders pursuant to para 1, because these data are not collected by address publishers and direct marketing companies. | |||
Direct marketing companies - as required by para 6 - for | |||
marketing purposes were "collected"; consequently, a circumvention of data transfers with the interposition of an address publisher and direct marketing company is not possible without the consent of the data subject (Riesz in Ennöckl/ | |||
Raschauer/Wessely, GewO § 151 Rz 29; in more detail | |||
Mayer-Schönberger, Warum Ermitteln nicht Erheben ist: Datenschutz und Direktmarketing, ecolex 2004, 417). | |||
[24] 2.3.3 On this basis, the view that the data to be assessed here is marketing information and classifications within the meaning of section 151(6) of the GewO is not objectionable. However, section 151(6) GewO only regulates the use of this data, but does not change the fact that it is personal data covered by the GDPR (cf. | |||
Gruber/Paliege-Barfuß, GewO7 § 151 Note 3 third paragraph). The defendant's opinion - based on Knyrim, ecolex 2019, 715 - that the marketing information and classifications referred to in section 151(6) of the GewO are not personal data within the meaning of Article 4(1) of the GDPR cannot be shared - also against the background of the state of opinion on Article 4(1) of the GDPR described above - especially since the national legislator is not entitled to restrict the scope of application of the GDPR in such a way. In this sense, the Federal Administrative Court (W 258 2217446-1 [Recital 3.2.4.3]) also stated that the defendant's argumentation overlooked the fact that the term "personal data" is not a term of the Regulation. | |||
Data" in Article 4 (1) (1) of the GDPR, i.e. a European law norm that is directly applicable in the | |||
In the absence of a corresponding opening clause, the term was to be interpreted autonomously under European law and its definition or interpretation could not be based on the legal provisions of the Member States, in this case § 151 GewO. | |||
[25] Ultimately, however, nothing can be gained from this for the plaintiff's point of view. The appeal asserts that the defendant had both | |||
The plaintiff's request for information and deletion of the data was fulfilled. In particular, since the plaintiff has a valid objection to the further processing of the data, it is not allowed to process any further data, so that the plaintiff lacks a legal interest in the requested and requested deletion of the data. | |||
The Court of Appeal's finding is lacking. | |||
[26] 3.1 In fact, the Court of Appeal did not deal in detail with the legal interest of the plaintiff required under § 228 ZPO in declaratory actions. However, this requirement has its reason in the fact that the decision is preventive and merely declarative (i.e. neither directly changing the legal situation nor compulsorily enforceable) and declaratory judgements can only have a meaningful preventive effect if there is a current reason for such a preventive clarification (Frauenberger- Pfeiler in Fasching/Konecny³ III/1 § 228 ZPO Rz 75). The lack of legal interest in the determination is also to be perceived in the appeal proceedings and ex officio (RS0039123). | |||
[27] 3.2 The subject matter of a | |||
The legal relationship asserted in the action for a declaratory judgment must have a direct legal effect on the legal position of the plaintiff, i.e. it must be suitable for putting an end to the impairment of the legal sphere by the opponent and avoiding further litigation in the future; this preventive effect can | |||
declaratory action and declaratory judgement can only be satisfied if there is a current reason for such a preventive clarification in the first place (RS0039071). | |||
The determination of mere "legal situations" is not sufficient for this (RS0037422 [T8]). Even the mere possibility that there may be a dispute about the legal relationship in the future is not sufficient. | |||
The fact that this could be the case is not yet | |||
Interest in a declaratory judgement (e.g. not the desire to obtain immediate certainty about a liability that will only be fulfilled in the future under certain circumstances). | |||
[Frauenberger- Pfeiler in Fasching/Konecny³ III/1 § 228 ZPO margin no. 87]). The action for a declaratory judgement rather requires a concrete, current cause, which makes an immediate court decision necessary to prevent a not merely alleged, but actual and serious endangerment of the plaintiff's legal position (RS0039215). A legal interest in an immediate determination can generally only be affirmed if a worsening of the legal position of the plaintiff would have to be feared in case of a referral to a court action that would only be possible later (RS0039215 [T8]). | |||
[28] An interest in an action for a declaratory judgement is to be affirmed if the request for a declaratory judgement is suitable to clarify the legal relationship of the parties once and for all and to cut off a future claim for performance (RS0038908). These conditions are fulfilled, for example, if a contracting party disputes out of court a claim asserted by the other party, which is not yet due, or the legal relationship, because a judgement establishing the disputed claim will regularly induce the debtor to perform when due and thus make an action for performance unnecessary (RS0038908 [T14]). In principle, however, the possibility of an action for performance in the case of the same | |||
The legal protection effect is the declaratory action (RS0038849; RS0038817). A claim for a declaratory judgement on the liability for damages resulting from a violation of rights is also excluded if it is established that further damages from the damaging event cannot occur (RS0039071 [T6]). In the case of a continuing obligation, on the other hand, the legal interest in an immediate determination of its existence is to be affirmed because only individual claims arising from it can be asserted with the action for performance (RS0038809). | |||
[29] Whether or not, notwithstanding a decision taken by the defendant in the course of the | |||
It is only possible to assess the continued existence of a legal interest of the plaintiff in an immediate determination of the requested content according to the special circumstances of the individual case (RS0039224). If the defendant has already clarified the actual legal situation in the statement of defence and the plaintiff has contributed to the initially incorrect statement by the defendant, the opinion that the interest in a declaratory judgement had already ceased to exist before the conclusion of the oral hearing does not constitute a | |||
Misjudgement (6 Ob 37/13d). | |||
[30] 3.3 According to the findings of the lower courts, the defendant complied with the plaintiff's request for information; furthermore, the Court of Appeal - uncontested by the plaintiff in the appeal proceedings - stated that the defendant had also complied with the request for cancellation. | |||
And finally, the defendant already stated in the proceedings at first instance that it would interpret the claim as an objection to the data processing and would not process any further data. | |||
[31] In this factual situation, it is indeed not recognisable what the legal interest in the finding ultimately formulated by the Court of Appeal should be: The plaintiff's request for information was fulfilled, further requests for information are currently not to be expected due to the opposition. If the plaintiff's appeal response refers to a "repeatedly unlawful conduct" of the defendant, this is not covered by the established facts. | |||
[32] 4 However, the result was that the dismissal of the | |||
Restore the first judgement. | |||
[33] The decision on the costs of the | |||
The appeal procedure is based on §§ 41, 50 ZPO. | |||
Supreme Court, | |||
Vienna, 18 February 2021 | |||
Dr S c h r a m m | |||
For the correctness of the copy, the head of the business department: | |||
</pre> | </pre> |
Latest revision as of 13:57, 20 September 2021
OGH - 6Ob127/20z | |
---|---|
Court: | OGH (Austria) |
Jurisdiction: | Austria |
Relevant Law: | Article 4(1) GDPR Article 15(1) GDPR Article 79 GDPR § 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO) § 228 Austrian Civil Procedure Act (Zivilprozessordnung - ZPO) |
Decided: | 18.02.2021 |
Published: | 01.04.2021 |
Parties: | unknown (claimant) Österreichische Post AG (defendant) |
National Case Number/Name: | 6Ob127/20z |
European Case Law Identifier: | ECLI:AT:OGH0002:2021:0060OB00127.20Z.0218.000 |
Appeal from: | OLG Linz (Austria) 2 R 35/20k-19 |
Appeal to: | Not appealed |
Original Language(s): | German |
Original Source: | Rechtsinformationssystem des Bundes (RIS) (in German) |
Initial Contributor: | n/a |
The Austrian Supreme Court held that a declaratory judgment on the controller's obligation to provide access to certain data in case of further access requests by the same data subject is not feasible if the controller had already fulfilled the data subject's requests under Article 15 and 21 GDPR.
English Summary
Facts
The controller (defendant) is the biggest logistics and postal service provider in Austria. Its main business activities include the transport of letters, advertising mail, print media, and parcels. Furthermore, the defendant also conducts business as an address publisher under § 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO) and sells personal data for third-party marketing purposes.
On 14.01.2019 the data subject (claimant) sent an access request under Article 15 GDPR to the controller on which the controller replied to on 14.02.2019. Besides data such as name and phone number the controller stated to process certain "marketing classifications" under § 151(6) GewO. These "marketing classifications" are calculated based on a a variety of socio-demographic circumstances (e.g. age, place of residence, level of education) and express a statistic probability of the data subject belonging to a certain demographic group (e.g. "do-it-yourselfer", "night owl", "person with affinity for investments").
The data subject was not content with the controller's reply and filed a lawsuit for the provision of access under Article 15 and erasure under Article 17 GDPR in connection with Article 21 GDPR. Furthermore, the data subject requested a declaratory judgment that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR in the case of further access requests by the data subject.
The first instance court (Regional Court Wels - LG Wels) rejected the lawsuit, holding that the controller had already fulfilled the data subject's requests. Following an appeal by the data subject, the second instance court (Higher Regional Court Linz - OLG Linz) partially overturned this decision and held that the data subject had indeed a legal interest in the claimed declaratory judgment. Consequently, it held that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR in the case of further access requests by the data subject
Dispute
In the course of the procedures before the LG Wels, the OLG Linz and the Austrian Supreme Court (Oberster Gerichtshof - OGH), several legal questions arose:
- Can a data subject file a lawsuit under Article 79 GDPR in cases of an alleged violation of Article 15 GDPR or can such violation only be subject to a complaint before a DPA under Article 77 GDPR?
- Do "marketing classifications" under § 151(6) GewO qualify as personal data under Article 4(1) GDPR although they only express a statistic probability?
- Does the data subject have a legal interest - as required under § 228 Austrian Civil Procedure Code (Zivilprozessordnung - ZPO) - in a declaratory judgment that the controller is under the legal obligation to provide access under Article 15 GDPR in the case of further access requests by the data subject?
Holding
The OGH overturned the decision of the OLG and restored the decision of the first instance court. It held that
- a lawsuit under Article 79 GDPR regarding the alleged violation of Article 15 GDPR is indeed feasible. Article 79 GDPR is not limited to certain data subject rights such as erasure under Article 17 GDPR. This is in line with the OGH's previous case-law.
- "marketing classifications" under § 151(6) GewO qualify as personal data. The term "information" in Article 4(1) GDPR is not limited to statements about verifiable characteristics or factual circumstances with regard to the data subject but also includes evaluations and assessments him or her. Hence, also a statistic probability that is assigned to a certain data subject qualifies as personal data. This is in line with case-law by the Austrian Administrative Court (W 258 2217446-1 on the presumed "affinity for a political party").
- the data subject does not have a legal interest in a declaratory judgment that the controller is under the legal obligation to provide access under Article 15 GDPR in the case of further access requests by the data subject. The controller had already fulfilled the data subject's access request and declared to comply with the data subject's objection under Article 21 GDPR by refraining from any further processing of his or her data. Therefore, further access request are not to be expected and the data subject has no legal interest in the requested declaratory judgment.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
ON BEHALF OF THE REPUBLIC The Supreme Court, as a court of appeal, has by the President of the Senate, Dr Schramm, as Chairman and the Court Councillors, Dr Gitschthaler, Dr Kodek, Dr Nowotny and the Court Councillor, Dr Faber, as further Judges in the case of the plaintiff, Dr L*****, represented by Dr Johannes Kirschner, Rechtsanwalt in Wels, against the defendant, Ö***** Aktiengesellschaft, *****, represented by Wolf Theiss Rechtsanwälte GmbH & Co KG, Vienna, on the grounds of on the appeal of the defendant against the judgment of the Linz Higher Regional Court (Oberlandesgericht) as the court of appeal of 10 April 2020, GZ 2 R 35/20k-19, by which the judgment of the Landesgericht Wels (Regional Court of Wels) of 27 December 2019, GZ 2 Cg 72/19v-15, was amended in part, in a closed session: The appeal is allowed. The contested decision is annulled that the judgment of the court of first instance be restored. The plaintiff is obliged to pay to the defendant the EUR 488.46 (including EUR 45.74 VAT and EUR 214 cash expenses) within 14 days. D e s c r i p t i o n s : [1] The Respondent is the nation's leading Logistics and postal service provider, whose The defendant's main business activities include the transport of letters, advertising mail, print media and parcels. In addition, the defendant has a trade licence as an "address publisher and direct marketing company" within the meaning of § 151 GewO, i.e. it is entitled to "ascertain personal data from publicly accessible information, by questioning the persons concerned, from third-party customer and prospect file systems or as marketing file systems of other address publishers and direct marketing companies". Address publishers and direct marketing companies are allowed to use collected marketing information and also attribute marketing classifications to specific persons by name on the basis of marketing analysis procedures and use these marketing groups for marketing purposes and transmit them to third parties under certain conditions. [2] At the request of the plaintiff, a lawyer, dated 14 January 2019, the defendant provided him with information on the personal data processed in relation to his person in a letter dated 14 February 2019. According to this, the following data was stored about the plaintiff: Telephone number, academic, bio-affinity, night owl, do-it-yourselfer, investment-affinity, life stage (shop), Distance selling affinity, parcel frequency, parcel recency; number of parcels per year; number of weeks/year getting parcels; mail order buyers; number of parcels in the period 6 to 12 months ago. The marketing data about the plaintiff cited in this disclosure letter had been collected by the defendant on the legal basis of the defendant's business licence. The affinities mentioned (did) merely represent the allocation of a certain person to a marketing group on the basis of the attribution of certain marketing classifications by means of a marketing analysis procedure. The actual meaningfulness of, for example, the attribute "Investment affinity" therefore did not mean that data on the financial conduct of a certain person was collected and evaluated, but merely that this person was assigned to a marketing group on the basis of certain socio-demographic circumstances (age, place of residence, level of education, etc.), with regard to which the existence of the attribute (investment affinity) was assumed with a certain probability. This means that the attribute could have been weak or even not pronounced at all, the person concerned could even have been investment-averse and yet the assignment to the marketing group as such was statically correct. In the In its letter of information, the defendant also informed the plaintiff that his data had not been passed on to third parties for marketing purposes; in the attachment to the letter, however, a passing on of the plaintiff's forwarding data to N***** GmbH was indicated. It is not established that the plaintiff's personal data were transmitted or passed on to third parties. [3] The letter of information did not contain any information on the plaintiff's stored email addresses, although it is not established in this context that the plaintiff's email address l*****@gmail.com originates from a source other than the postal account he himself created with the defendant, to which the plaintiff had registered on 1 December 2017 using this email address, and that the processing of the email address would not be necessary in order to communicate with the plaintiff on the part of the defendant. The fact that the plaintiff was entitled to have the (private) email address deleted was communicated to him in the information letter of 14 February 2019 with reference to the data protection statement and by citing several communication channels. The plaintiff had and has the possibility to delete his account with the defendant himself at any time by logging in there and confirming the button "Delete registration" in the "Settings" area. This would also have deleted the email address. The deletion was not requested by the defendant out of court. [4] The Court of Appeal - in partial amendment of the decision of the court of first instance, which had granted the entire claim for declaratory judgment, data deletion and The court had rejected the plaintiff's request for information in the first instance - and had ruled vis-à-vis the defendant that, in the event of any requests for information on data relating to bioaffinity, nocturnality, etc., the defendant would be obliged to provide the plaintiff with the information requested in the first instance, Do-it-yourself property, academic property, phase of life, investment and distance trading affinity and childlessness of the plaintiff information in the sense of the Data Protection Act (Article 15(1)(a) to (g) of the GDPR). In addition, the Court of Appeal ruled that the ordinary appeal was admissible; there was a lack of case law of the Supreme Court on the admissibility of the corporate processing and utilisation of personal data under the Basic Data Protection Regulation (GDPR). [5] In the matter itself - as far as this is relevant for the The Court of Appeal expressly affirmed, albeit only in the reasons for the decision, the admissibility of the legal action, as the plaintiff was not seeking damages, but rather based his claim on the violation of his personal right to data protection due to the denial of the right to information and on claims for removal. The claims made by the defendant pursuant to According to the plaintiff, the data collected under section 151 of the GewO are personal, as Article 4(1) of the GDPR is not limited to sensitive or private information, but covers all types of information, both objective and subjective, in the form of opinions or assessments, provided that it is information about the person in question. It follows from this that, pursuant to section 1(3)(1) of the FADP in conjunction with Article 15 of the GDPR, in the event of future (further) enquiries by the plaintiff, there is a right to information about any data collected and stored pursuant to section 151(6) of the GewO, which means that the (modified) request for a declaratory judgement is justified; pursuant to section 151(6) of the GewO, the plaintiff has a right to information about any data collected and stored pursuant to section 151(6) of the GewO. Section 228 of the ZPO states that the (non-)existence of a legal (relationship) ascertainable. [6] The defendant's appeal is admissible; it is also justified. [7] 1 The defendant also denies in the The Commission questions the admissibility of the legal remedy in the appeal proceedings and takes the view that Art 79 GDPR does not provide for a judicial remedy for "pure" requests for information. In doing so, it overlooks the fact that a meritorious settlement of such an objection by the Supreme Court would not constitute a binding decision within the meaning of § 42 of the Data Protection Act. Paragraph 3 of the JN even if the Court of Appeal - as here - (only) expressly denied the existence of a procedural impediment in the reasons for its decision; procedural impediments can no longer be perceived at higher instance if a binding decision of the Court of Appeal concerning them is opposed (RS0043800; on the affirmation of the admissibility of the legal remedy 10 ObS 267/00p; 1 Ob 88/12s ecolex 2012/346 [Wilhelm]), irrespective of whether the nullity had been asserted in an appeal or had been considered by the Court of Appeal ex officio. (8 Ob 54/03d). [8] However, in order to clarify the legal situation, the discerning senate considered: [9] 1.1 Under the legal situation prior to the entry into force of the GDPR, the right to information pursuant to Section 32 of the GDPR 2000 was always enforceable before the data protection authority in Austria, which is why it is now also disputed whether the right to information is covered by Article 79(1) of the GDPR (cf. the references in Leupold/Schrems in Knyrim, DatKomm Art 79 DSGVO Rz 13 FN 29). [10] According to the purpose of the provision, the However, it is precisely the exercise of the right of access that clarifies whether or not data processing is taking place, which is why, with regard to the intended effectuation of law enforcement, it cannot be assumed that the European legislator wanted to weaken the legal protection of data subjects in such a way that the right of access should not be covered by Art 79 (1) of the GDPR (Leupold/Schrems loc. cit.; similarly Bergt in Kühling/Buchner, DS-GVO Art 79 Rz 6). Also according to Jahnel (On the interplay between the administrative law route and the civil law route and the interfaces with constitutional law and European law, in Nunner-Krautgasser/Garber/Klauser, Rechtsdurchsetzung im Datenschutz nach der DSGVO und dem DSG 2018, 67 [71]), a data subject may directly assert claims before the civil courts on the basis of Art 79 GDPR in the event of infringements of rights which he or she has under the GDPR, in particular also claims for information. [11] The wording of Article 79(1) of the GDPR generally refers to the "rights conferred by this Regulation". Von Lewinski (in Eßer/Kramker/von Lewinski, DSGVO-BDSG6 Art 79 DSGVO Rz 2) therefore states that this provision is directed at the enforcement of a right to cease and desist, but also extends to other (ancillary) claims such as the enforcement of (performance) claims for information. [12] However, Martini (in Paal/Pauly, DSGVO-BDSG² Art 79 DSGVO Rz 22a) expresses doubts, but elsewhere (Rz 12) also refers to the dual system of legal protection before the courts and the supervisory authority. Kreße (in Sydow, DSGVO² Art 79) also mentions the right to information in margin no. 7, differentiated in Rec 16 f then, however, whether information on whether data are processed at all (Art 15(1)(1) GDPR) or whether information on specific processed data is requested (Art 15(1)(2) GDPR). 1.2 The competent panel of experts has already ruled in the decisions 6 Ob 131/18k (ecolex 2019/151 [Zemann] = iFamZ 2019/78 [Deixler-Hübner] = jusIT 2019/29 [Thiele; Jahnel, 123] = RZ 2019/11 [Spenling] = MR 2019, 190 [Walter]) and 6 Ob 91/19d (VbR 2019/87 [Schmidl, VbR 2020, 160] = jusIT 2019/55 [Jahnel/Thiele]) dealt in detail with the system of dual legal protection under the GDPR and affirmed it in principle. If, however, according to the decision 6 Ob 131/18k, the two-track system applies in any case to the claim for erasure, it would be difficult to justify why this should not be the case for the right of access. The right to information should be different, especially since it is also a right under private law (cf. Leupold/Schrems in Knyrim, DatKomm Art 79 DSGVO Rz 2). Also Bergt (in Kühling/Buchner, DS-GVO Art 79 marginal no. 13) believes that the assertion of claims for information, injunctive relief or damages against persons responsible or principals is admissible in court parallel to the complaint to the supervisory authority. [13] 1.3 Recently, the Senate has also Admissibility of an action for the provision of a copy under Art 15(3) GDPR affirmed (6 Ob 138/20t). [14] 1.4 The Court of Appeal thus correctly assumed the admissibility of legal action for the assertion of data protection claims. The claim for information was assumed to be valid. [15] 2 Art. 4 No. 1 GDPR defines "personal data" as any information relating to an identified or identifiable natural person. The term is to be understood broadly (Hödl in Knyrim, DatKomm Art 4 DSGVO Rz 9; Eßer in Eßer/Kramer/von Lewinski, DSGVO-BDSG6 Art 4 DSGVO Rz 7). [16] 2.1 Therefore, even inner states such as Opinions, motives, desires, beliefs and Value judgements as well as statistical probability statements, which do not merely represent forecast or planning values, but provide subjective and/or objective assessments of an identified or identifiable person, have a personal reference (Hödl loc. cit.; Klar/Kühling in Kühling/ Buchner, DS-GVO Art 4 No. 1 Rz 10; also personal Ernst in Paal/Pauly, DSGVO-BDSG² Art 4 DSGVO Rz 14). Thus, the concept of "Information" not only statements about verifiable characteristics or factual circumstances of the data subject, but also assessments and judgements about him or her, such as "X is a reliable employee" (Klabunde in Ehmann/Selmayer, DS-GVO² Art 4 Rz 9; cf. also Gola in Gola, DSGVO² Art 4 Rz 13). In this sense, data with The data are also related to a person if they are incorrect (Reimer in Sydow, DSGVO² Art 4 Rz 41); the truth content is irrelevant for the consideration (Klabunde loc. cit.). Probability information is personal, regardless of whether it relates to facts in the past, present or future (Ernst loc. cit.). [17] Aggregated or statistical data, on the other hand, are not personal if they no longer permit any conclusions to be drawn about an individual person, which can be determined in individual cases on the basis of the selected group size, the levels of aggregation or the level of aggregation shown in the statistics. characteristics (Eßer in Eßer/Kramer/von Lewinski, DSGVO-BDSG6 Art 4 DSGVO Rz 31; Klar/Kühling in Kühling/Buchner, DSGVO-BDSG³ Art 4 Nr 1 DSGVO Rz 15). It therefore depends on whether a collective statement is made about a group of persons or whether an individual is identified as a member of a group of persons, for example, when classifying data stored for advertising purposes, if residents of a street are assigned to a certain group of buyers or purchasing power class based on the population structure (Gola in Gola, DSGVO² Art 4 Rz 8); on the other hand, a statement that the sickness rate of the employees of company A has increased by X % would be different if the company employs a large number of employees (Klar/Kühling loc. cit.). [18] Knyrim (Zur Zulässigkeit des Adresshandels der Ö***** AG, ecolex 2019, 715), which the court of first instance had agreed with, takes the view that the probability data determined by the postal service do not represent statements about specific persons, but rather anonymous, abstract averages of marketing groups that are merely "attributed" to a person. The criterion of information about a specific person was therefore already lacking, which was why it was "questionable" whether the probability data in question could be classified as personal data and therefore fell under the GDPR. The discerning senate is unable to agree with this: [19] 2.2 In the sense of 2.1. above The opinions expressed in this report are subject to the information falls under the regime of the GDPR, since it is directly associated with the plaintiff and contains statements about his or her preferences and attitudes, for example; whether the assessments are actually accurate, however, is irrelevant. Even the fact that the data are (only) calculated using statistical probabilities does not change the existence of personal data. The "affinities" contain a probability statement about certain interests and preferences of the plaintiff. This is not contradicted by the decision of the Court of Justice of the European Union. (ECJ) (Cases C-141/12 and C-372/12) . [ECLI:EU:C:2014:2081]), on which the defendant relies in its appeal, it is expressly stated there that the data used in the analysis of the residence permit are indeed personal data. [20] Incidentally, the same conclusion was reached as recently as Most recently, the Federal Administrative Court (W 258 2217446-1) in the proceedings concerning a decision of the Data protection authority, which also has the "special[n] Categories of personal data in the context of the Pursuit of the trade of 'Address publishers and The subject matter of this case was "direct marketing companies" in the absence of the consent of the data subjects". The The Federal Administrative Court held (para. 3.2.3) that the linking of party affinity with an individual person fulfilled the content element of personal information; thus, even if the actual political opinion of the person concerned is not known, party affinity contains a direct statement about the specific person, namely how likely he or she is to be interested in advertisements from a specific political party; this statement , even if it is based on the method of determination is subject to a statistical range of variation, is not entirely random, but is derived from correlations obtained from opinion polls and election results; it is a statistically based assessment of the person in relation to their interest in advertising for a particular political party. [21] 2.3 Pursuant to Section 151(1) GewO, on which the defendant relies, the provisions of the GDPR and the FADP are to be applied to the use of personal data for marketing purposes of third parties by traders authorised to exercise the trade of address publishers and direct marketers, unless otherwise provided below. Pursuant to section 151(6) of the GewO, traders may use marketing information and classifications collected for marketing purposes pursuant to subsection (1) and attributed to specific persons by name on the basis of marketing analysis procedures only for marketing purposes and, in particular, transmit them to third parties only if the third parties unobjectionably declare that they will use these analysis results exclusively for marketing purposes. § 151 Paras 8 and 9 GewO contain provisions on the Right of cancellation and the so-called "Robinson list". [22] 2.3.1 The content of § 151 para 6 GewO consists of in that the use of marketing information and classifications (which were determined as a result of statistical evaluations and have no claim to accuracy per se), which are attributed to specific persons by name on the basis of marketing analysis procedures, is tied to the exclusive purpose of marketing. Furthermore, data collected for this purpose may only be transferred to third parties if they unobjectionably declare that they will use these analysis results exclusively with the intention of using them for marketing; this can only be done by contract (Riesz in Ennöckl/Raschauer/Wessely, GewO § 151 Rz 28). According to section 151(6) GewO, in order to prevent misuse, analysis results may thus only be used within a very narrow legal corset, namely only charged by an address publisher and direct marketing company registered for this purpose in the trade register and only passed on against submission of a declaration of no objection that they will be used exclusively for marketing purposes (Knyrim, ecolex 2019, 715). [23] 2.3.2 § 151 para 6 GewO empowers address publishers and direct marketing companies to transmit the data collected or determined by them to third parties in order to be able to use these data in a commercially reasonable manner. However, the provision does not refer to data transmitted by third parties to traders pursuant to para 1, because these data are not collected by address publishers and direct marketing companies. Direct marketing companies - as required by para 6 - for marketing purposes were "collected"; consequently, a circumvention of data transfers with the interposition of an address publisher and direct marketing company is not possible without the consent of the data subject (Riesz in Ennöckl/ Raschauer/Wessely, GewO § 151 Rz 29; in more detail Mayer-Schönberger, Warum Ermitteln nicht Erheben ist: Datenschutz und Direktmarketing, ecolex 2004, 417). [24] 2.3.3 On this basis, the view that the data to be assessed here is marketing information and classifications within the meaning of section 151(6) of the GewO is not objectionable. However, section 151(6) GewO only regulates the use of this data, but does not change the fact that it is personal data covered by the GDPR (cf. Gruber/Paliege-Barfuß, GewO7 § 151 Note 3 third paragraph). The defendant's opinion - based on Knyrim, ecolex 2019, 715 - that the marketing information and classifications referred to in section 151(6) of the GewO are not personal data within the meaning of Article 4(1) of the GDPR cannot be shared - also against the background of the state of opinion on Article 4(1) of the GDPR described above - especially since the national legislator is not entitled to restrict the scope of application of the GDPR in such a way. In this sense, the Federal Administrative Court (W 258 2217446-1 [Recital 3.2.4.3]) also stated that the defendant's argumentation overlooked the fact that the term "personal data" is not a term of the Regulation. Data" in Article 4 (1) (1) of the GDPR, i.e. a European law norm that is directly applicable in the In the absence of a corresponding opening clause, the term was to be interpreted autonomously under European law and its definition or interpretation could not be based on the legal provisions of the Member States, in this case § 151 GewO. [25] Ultimately, however, nothing can be gained from this for the plaintiff's point of view. The appeal asserts that the defendant had both The plaintiff's request for information and deletion of the data was fulfilled. In particular, since the plaintiff has a valid objection to the further processing of the data, it is not allowed to process any further data, so that the plaintiff lacks a legal interest in the requested and requested deletion of the data. The Court of Appeal's finding is lacking. [26] 3.1 In fact, the Court of Appeal did not deal in detail with the legal interest of the plaintiff required under § 228 ZPO in declaratory actions. However, this requirement has its reason in the fact that the decision is preventive and merely declarative (i.e. neither directly changing the legal situation nor compulsorily enforceable) and declaratory judgements can only have a meaningful preventive effect if there is a current reason for such a preventive clarification (Frauenberger- Pfeiler in Fasching/Konecny³ III/1 § 228 ZPO Rz 75). The lack of legal interest in the determination is also to be perceived in the appeal proceedings and ex officio (RS0039123). [27] 3.2 The subject matter of a The legal relationship asserted in the action for a declaratory judgment must have a direct legal effect on the legal position of the plaintiff, i.e. it must be suitable for putting an end to the impairment of the legal sphere by the opponent and avoiding further litigation in the future; this preventive effect can declaratory action and declaratory judgement can only be satisfied if there is a current reason for such a preventive clarification in the first place (RS0039071). The determination of mere "legal situations" is not sufficient for this (RS0037422 [T8]). Even the mere possibility that there may be a dispute about the legal relationship in the future is not sufficient. The fact that this could be the case is not yet Interest in a declaratory judgement (e.g. not the desire to obtain immediate certainty about a liability that will only be fulfilled in the future under certain circumstances). [Frauenberger- Pfeiler in Fasching/Konecny³ III/1 § 228 ZPO margin no. 87]). The action for a declaratory judgement rather requires a concrete, current cause, which makes an immediate court decision necessary to prevent a not merely alleged, but actual and serious endangerment of the plaintiff's legal position (RS0039215). A legal interest in an immediate determination can generally only be affirmed if a worsening of the legal position of the plaintiff would have to be feared in case of a referral to a court action that would only be possible later (RS0039215 [T8]). [28] An interest in an action for a declaratory judgement is to be affirmed if the request for a declaratory judgement is suitable to clarify the legal relationship of the parties once and for all and to cut off a future claim for performance (RS0038908). These conditions are fulfilled, for example, if a contracting party disputes out of court a claim asserted by the other party, which is not yet due, or the legal relationship, because a judgement establishing the disputed claim will regularly induce the debtor to perform when due and thus make an action for performance unnecessary (RS0038908 [T14]). In principle, however, the possibility of an action for performance in the case of the same The legal protection effect is the declaratory action (RS0038849; RS0038817). A claim for a declaratory judgement on the liability for damages resulting from a violation of rights is also excluded if it is established that further damages from the damaging event cannot occur (RS0039071 [T6]). In the case of a continuing obligation, on the other hand, the legal interest in an immediate determination of its existence is to be affirmed because only individual claims arising from it can be asserted with the action for performance (RS0038809). [29] Whether or not, notwithstanding a decision taken by the defendant in the course of the It is only possible to assess the continued existence of a legal interest of the plaintiff in an immediate determination of the requested content according to the special circumstances of the individual case (RS0039224). If the defendant has already clarified the actual legal situation in the statement of defence and the plaintiff has contributed to the initially incorrect statement by the defendant, the opinion that the interest in a declaratory judgement had already ceased to exist before the conclusion of the oral hearing does not constitute a Misjudgement (6 Ob 37/13d). [30] 3.3 According to the findings of the lower courts, the defendant complied with the plaintiff's request for information; furthermore, the Court of Appeal - uncontested by the plaintiff in the appeal proceedings - stated that the defendant had also complied with the request for cancellation. And finally, the defendant already stated in the proceedings at first instance that it would interpret the claim as an objection to the data processing and would not process any further data. [31] In this factual situation, it is indeed not recognisable what the legal interest in the finding ultimately formulated by the Court of Appeal should be: The plaintiff's request for information was fulfilled, further requests for information are currently not to be expected due to the opposition. If the plaintiff's appeal response refers to a "repeatedly unlawful conduct" of the defendant, this is not covered by the established facts. [32] 4 However, the result was that the dismissal of the Restore the first judgement. [33] The decision on the costs of the The appeal procedure is based on §§ 41, 50 ZPO. Supreme Court, Vienna, 18 February 2021 Dr S c h r a m m For the correctness of the copy, the head of the business department: