OGH - 6Ob127/20z
| OGH - 6Ob127/20z | |
|---|---|
 | |
| Court: | OGH (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 4(1) GDPR Article 15(1) GDPR Article 79 GDPR § 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO) § 228 Austrian Civil Procedure Act (Zivilprozessordnung - ZPO) |
| Decided: | 18.02.2021 |
| Published: | 01.04.2021 |
| Parties: | unknown (claimant) Österreichische Post AG (defendant) |
| National Case Number/Name: | 6Ob127/20z |
| European Case Law Identifier: | ECLI:AT:OGH0002:2021:0060OB00127.20Z.0218.000 |
| Appeal from: | OLG Linz 2 R 35/20k-19 |
| Appeal to: | Not appealed |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (RIS) (in German) |
| Initial Contributor: | n/a |
The Austrian Supreme Court held that a court must not issue a declaratory judgement that a controller has to provide access to certain data under Article 15 GDPR to a data subject if the controller had already fulfilled the data subject's requests for access and erasure and refrained from further processing the data subject's data.
English Summary
Facts
The controller (defendant) ist the biggest logistics and postal service provider in Austria. Its main business activities include the transport of letters, advertising mail, print media, and parcels. Furthermore, the defendant also conducts business as an address publisher under § 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO) and sells personal data for third-party marketing purposes.
On 14.01.2019 the data subject (claimant) sent an access request under Article 15 GDPR to the controller on which the controller replied to on 14.02.2019. Besides data like name and phone number the controller stated to process certain "marketing classifications" under § 151(6) GewO. These "marketing classifications" are calculated based on certain sociodemographic circumstances (e.g. age, place of residence, level of education) and express a statistic probabilty of the data subject belonging to a certain deomographic group (e.g. "do-it-yourselfer", "night owl", "affinity for investments").
The data subject was not content with the controller's reply and filed a lawsuit for the provison of access under Article 15 and erasure under Article 17 GDPR. Furthermore, the data subject requested a declaratory judgment that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR in the case of further access requests by the data subject.
The first instance court (Regional Court Wels - LG Wels) rejected the lawsuit, holding that the controller had already fulfilled the data subject's requests. Following an appeal by the data subject, the second instance court (Higher Regional Court Libz - OLG Linz) partially overturned this decision and held that the data subject had indeed a legal interest in the claimed declaratory judgment. Hence, it held that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR in the case of further access requests by the data subject
Dispute
In the course of the procedures before the LG Wels, the OLG Linz and the Austrian Supreme Court (Oberster Gerichtshof - OGH), several legal questions arose:
- Can a data subject file a lawsuit under Article 79 GDPR in cases of an alleged violation of Article 15 GDPR or can such violation only be subject to a complaint before a DPA under Article 77 GDPR?
- Do "marketing classifications" under § 151(6) GewO qualify as personal data under Article 4(1) GDPR as they only express a statistic probability?
- Does a data subject have a legal interest - as required under § 228 Austrian Civil Procedure Code (Zivilprozessordnung - ZPO) - in a declaratory judgment that a controller is under the legal obligation to provide access under Article 15 GDPR in the case of further access requests by the data subject?
Holding
The OGH overturned the decision of the OLG and restored the decision of the first instance court. It held that
- a lawsuit under Article 79 GDPR regarding the alleged violation of Article 15 GDPR is indeed feasible. Article 79 GDPR is not limited to certain data subject rights such as erasure under Article 17 GDPR. This is in line with the OGH's previous case-law.
- "marketing classifications" under § 151(6) GewO qualify as personal data. The term "information" in Article 4(1) GDPR is not limited to statements about verifiable characteristics or factual circumstances with regard to the data subject but also evaluations and assessments about him or her. Hence, also a statistic probabilty that is assigned to a certain data subject qualifies as personal data. This is in line with case-law by the Austrian Administraive Court (W 258 2217446-1 on the presumed "affinity for a political party).
- a data subject does not have a legal interest in a declaratory judgment that a controller is under the legal obligation to provide access under Article 15 GDPR in the case of further access requests by the data subject.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
