BVwG - BVwG W291 2272970-1

BVwG - BVwG_W291_2272970-1
Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 4(1) GDPR Article 5(1)(a) GDPR Article 6(1)(a) GDPR
Decided:	13.08.2025
Published:
Parties:	Der Standard
National Case Number/Name:	BVwG_W291_2272970-1
European Case Law Identifier:
Appeal from:
Appeal to:	Unknown
Original Language(s):	German
Original Source:	BVwG (in German)
Initial Contributor:	ap

The Court held that the “Pay or Okay” model implemented by an online newspaper lacked granular consent and therefore violated Article 6(1)(a) GDPR.

English Summary

Facts

Der Standard (the controller) is an Austrian daily newspaper. The website implemented a pop-up window, which gave the data subject the option of consenting to the use of cookies for web analysis and advertising, or to pay a monthly subscription and access the website without advertising (also known as “Pay or Okay”). A data subject chose the option of accepting cookies, as they did not want to take out a paid subscription, but also regularly deleted their cookie history because they did not want to be tracked.

The data subject brought a complaint to the DPA on 13 August 2021, arguing that they had been forced to consent to extensive processing of their data or take a paid subscription. The data subject was represented by noyb. Furthermore, the blanket consent to all data processing does not comply with the GDPR. The controller argued that data processing for advertising purposes was necessary for the provision of its services. In addition, the “Pay or Okay” model was permissible, according to a previous decision of the DPA. Finally, the uniform consent to several data processing operations was permissible under the GDPR.

In its decision on 29 March 2023, the DPA stated that the “Pay or Okay” model followed by the controller violated Article 5(1)(a) GDPR and Article 6(1)(a) GDPR, as it lacked granularity. This meant that the data subject could not choose which processing activities to consent to, and was forced to consent to all processing activities (or pay a subscription fee). In addition, the DPA ordered the controller to delete the data subject’s personal data if it was still processed within a month of the decision. However, the DPA dismissed the data subject’s request to issue a processing ban.

The controller appealed the decision to the Federal Administrative Court, contesting the decision that there was a violation and the order to delete the data. The data subject also appealed the decision, contesting the decision to dismiss the request to issue a processing ban.

Holding

The Court first stated that personal data was processed when the data subject visited the controller’s website, in agreement with the reasoning of the DPA. Recording the preferences of the data subject’s consent through a TC string falls under the definition of personal data according to Article 4(1) GDPR and CJEU case law.

The Court then stated that the data processing under the “Pay or Okay” model does not fall under the definition of media privilege. The GDPR allows for derogations in its provisions in cases where it is necessary to reconcile the right to data protection and the right to freedom of expression and information. However, processing personal data through cookies could not be considered processing for journalistic purposes, as it does not in itself contribute to a debate of general interest. According to the Court, this was the case even if the processing finances the working framework for journalists. Finally, the Court agreed with the reasoning of the DPA that the controller could not argue that the processing was exclusively for journalistic purposes, as it was also not fully aware of the data transferred to social media platforms or its use.

In terms of the granularity of consent and the “Pay or Okay” model, the Court first noted that the DPA is not bound by previous legal opinions. The Court found a violation of Article 6(1)(a) GDPR, as consent was not granular; the data subject did not have the option of consenting to a specific processing purpose, but instead could only give a blanket consent to the controller’s processing. This is supported by EDPB Guidelines, which state that in consent or pay models data subject should be able to choose which individual purposes they wish to consent to, rather than only having the option to consent to a bundle of all processing purposes. The Court dismissed the controller’s argument that the purposes of optimising the website and advertising were closely connected. Therefore, the data subject’s consent was not valid. The Court saw no need to consider the other legal bases under Article 6(1) GDPR, as the controller cannot retroactively invoke another legal basis when consent is not valid.

Finally, the Court upheld the decision of the DPA in rejecting a processing ban. The Court noted that the data subject does not have the subjective right to a specific remedy, and that the DPA had correctly rejected the request to issue a processing ban.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Business figures (GZen):
W291 227297O-1/30E
W291 2272971-1/32E
(please quote with all entries)
Headquarters Vienna
Erdbergstraße 192 - 196, 1030 Vienna
Tel: +43 1 601 49 - 0
Fax:+ 43 1 711 23-889 15 41
wow'.bvwg.gv.at
I M N A M E N T H E R E P U B L I C !
The Federal Administrative Court, represented by Judge Is Chairwoman and
the expert lay judges and Is assessors on the
appeal of 1 represented by noyb - European Center for Digital Rights,
2. STANDARD Verlagsgesellschaft m.b.H., 3. STANDARD Medien AG and 4. velcom GmbH, all
represented by Baker McKenzie Rechtsanwälte LLP & Co KG, against the decision of the
data protection authority of 29.03.2023, no. D124.4574, 2023-0.174.027, after holding oral
hearings on 08.07.2025 and 24.07.2025:
A)
I. The first appellant's complaint is upheld, item 3 of the contested decision, insofar
as it concerns the rejection of the application to prohibit the relevant processing
operations, is annulled without substitution and the data protection authority is
ordered to continue the proceedings in this regard, refraining from the used reason
for rejection.
1. The appeal of the second, third and fourth appellants regarding item 1 of
the contested decision is dismissed as unfounded.
2. The appeal of the second, third and fourth appellants regarding item 2 of
the contested decision is upheld and item 2 of the contested decision is annulled
without substitution.
B)
2 -
The appeal regarding A) II. 1. is admissible pursuant to Art. 133 para. 4 B-VG.
Otherwise, the appeal is not admissible.
3
iEhn s ch e s r ande
I. Course of proceedings:
1. By decision dated 29.03.2023, the data protection authority partially upheld the first
complainant's data protection complaint and found that the second, third and fourth
complainants had violated the principle of lawfulness pursuant to Art. 5 para. 1 lit. a in
conjunction with Art. 6 para. 1 GDPR and thus also violated the first complainant's right to
confidentiality pursuant to Section 1 (1) FADP by unlawfully processing personal data of the
first complainant when visiting the website www.standard.at (hereinafter: the website
subject of the proceedings) at least on August 12, 2021 (point 1.).
The second, third and fourth complainants were instructed to check the database within a
period of four weeks to determine whether more detailed cookie values and browser data
are still being processed at the current time and to delete them if necessary (point 2.).
The applications to prohibit the relevant processing operations and to impose a fine were
rejected (point 3.).
2. The second, third and fourth appellants lodged an appeal against points 1. and 2. of the
decision in question in a statement dated 04.05.2023.
3. In a statement dated 05.05.2023, the first complainant lodged an appeal against point 3
of the decision subject to the proceedings insofar as it relates to the rejection of the
application to prohibit the relevant processing operations.
4. In a letter dated 09.05.2023, the data protection authority submitted the complaints and
the related administrative documents to the Federal Administrative Court and issued a
statement in each case.
5. On the basis of the decision of the Business Distribution Committee, the cases in
question were removed from the then competent court division and reassigned to the now
competent court division (W291) on 12.05.2025.
6. Due to the filing of an application to set a deadline, the Federal Administrative Court was
ordered by procedural order of the Administrative Court on 19.05.2025 to issue the decision
within three months and to issue a copy of the decision,
842523- 15- 3/25
4
copy of the decision and a copy of the proof of service of the decision on the party making
the application to the Administrative Court or to state why there has been no breach of the
obligation to issue a decision.
7. The Federal Administrative Court held oral hearings on 08.07.2025 and 24.07.2025.
II. The Federal Administrative Court considered:
1. Findings:
1.1. Cookies can be used to collect information generated by a website and stored via an
Internet user's browser. It is a small file or text information (usually less than one Kbyte) that
is placed by a website on the hard disk of an Internet user's computer or mobile device via
their browser. A cookie allows the website to "remember" the user's actions or preferences.
Most web browsers support cool'ies, but users can set their browsers to reject cookies. You
can also delete cookies at any time. Websites use cookies to identify users, remember their
customers' preferences and allow users to complete tasks without having to re-enter
information when they move to another page or revisit the site later. Cookies can also be
used to collect information for targeted advertising and marketing based on online
behavior. For example, companies use software to track user behavior and create personal
profiles that allow them to show users advertising t a i l o r e d to their previous searches.
1.2. The second, third and fourth complainants operate the website in question.
On the website at issue in the proceedings, visitors can access journalistic articles, but also
create user accounts and interact with the online content provided, for example by posting
comments on articles or replicating comments made by other users.
The website in question recorded around 3.1 million unique users in the 4th quarter of 2021
in terms of desktop and mobile users and had a 46.55% share of internet users. The website
in question was therefore the sixth most visited website in Austria.
5 --
1.3. If no website information is already stored on the user's device, a pop-up window
("cookie banner", "cookie wall" or "pay wall") appears (at least) when the website in
question is accessed for the first time. There, users have the option of either consenting to
the use of cookies for web analysis and digital advertising measures ("CONSENT") or taking
out a paid "PUR subscription" ("SUBSCRIBE NOW"), through which the same content can be
consumed free of advertising by paying a monthly fee (EUR 8.00 at the time the complaint
was filed with the data protection authority).
The cookie banner was designed as follows on August 12, 2021 (hereinafter also referred to
as the time of the proceedings):
Welcome b".i 131:flü I'/1Nl1rXRl3
By clicking once on the "AGREE" button, consent can be given to all data processing
operations in question here, whereby users are immediately redirected to the desired
article or content. By clicking on
"SUBSCRIBE NOW" opens a page on which a so-called PUR subscription (paid subscription)
can subsequently be concluded in a multi-stage process (including: creating an account,
entering payment information).
842523- 15- 4/25
6
It is noted that the cookie banner now contains the phrase "personalized advertising
measures" instead of "digital advertising measures". However, the type and manner of
advertising has not changed regardless of the new name.
1.4. The privacy policy of the second, third and fourth respondents in the version valid at
the time of the proceedings was as follows (in the original without emphasis):
II. Processing activities of our customer data
A. STANDARD website and STANDARD user account
Data categories: When you use our website, we generally process your IP address, (if available) your
STANDARD user account, the name and version of your web browser, cookies identifying your web
browser, which determine which pages you visit on our website and when exactly (URL, date, time),
and the website you visited before accessing our website. Your web browser transmits all this data to
us when you visit our website.
Purposes: In addition to the processing activities listed in the cookie statement, we carry out the
following data processing activities on our website. The processing activities listed are based on our
legitimate interest in data security as the legal basis.
• Logging of the use of the system
• Authorization process
• Evaluation of server logs for problem analysis
C. Online subscription "PUR"
As an online medium, we are not exempt from the need for a financing option. Until now, we have only
used advertising as a financing model. However, as we know how important the issue of data
protection is to our readers, we have created a product that works without advertising and without any
data tracking. derStandard.at/PUR. All scripts from third-party providers, all social media plug-ins and
all data processing that is not absolutely necessary for technical reasons for the operation of the
website have been removed from this version of our website (see attachments to the cookie
declaration). However, as a PUR customer, you can of course also deactivate this content as required.
STANDARD cookie declaration
In this cookie statement, we inform you about our processing activities on our website. You can see at a
glance which cookies we place on our website for which purposes and which third-party cookies we allow.
In our privacy policy, you will also find information on the data processing in
our different product categories.
Area of application and contact
7
This cookie statement applies to STANDARD Verlagsgesellschaft m. b. H., STANDARD Medien AG and
velcom GmbH (the "STANDAPD Group").
I. Dealing with cookies
As an online medium, we carry out various data processing activities on our website. In addition to our
own processing activities, we rely on integrating third-party content into our website. We do this on
the one hand for editorial reasons, and on the other hand we use the opportunity to make our website
available to third parties as an advertising space for commercial reasons.
We naturally process your data on the basis of the statutory provisions (GDPR, DSG and TKG 2003).
Before we place cookies on our website, we ask for your consent. You can also express your consent
simply by continuing to use our website after you have read our cookie information.
Cookies are text files that can be stored on a website visitor's computer if the visitor's browser settings
allow this. Information can be written to these text files which can be read again at a later date. A
cookie is linked to a specific domain and contains information that can only be read again later from
this domain.
Third parties can also be given the opportunity to write cookies on our website. This is technically
possible if the website you access (in this case derStandard.at) integrates functionalities into this
website that are operated under the domain of the third party (see point V.)
All common browsers allow you to control the setting of cookies and to set their storage duration. This
means that the setting of cookies on your device can generally be prevented and the storage period of
cookies can be shortened. If you want to control cookies on your computer, you can also select your
browser settings so that you receive a notification when a website wants to store cookies. You can find
more detailed information on this in your browser's help menu or at http://www.aboutcookies.org.
You can revoke your consent to the use of third-party cookies in the Privacy Manager at the bottom of
this page. You can revoke your consent to the use of cookies by the STANDARD by clicking on the
button below. Please note that you will then only be able to use the website to a limited extent. If you
wish to withdraw your consent, please click on the button below and then go to the homepage.
REVOKE CONSENT
You can remove cookies that have already been set either directly by deleting them manually in the
corresponding folder on your hard disk or by deleting them using the corresponding function of your
browser. If you require assistance with revoking your consent to the use of cookies, please contact
widerruf@derstandard.at.
Various cookies of all types are used on the STANDARD Verlagsgesellschaft m.b.H. website, as well as
comparable technologies (such as "1oco/shared objects"). A list of all cookies processed by the
derStandard.at website and its subdomains can be found in the appendix.
You are of course free to allow the use of our cookies or to deactivate them. However, if you decide to
deactivate them, you will unfortunately not be able to use all the functions of our website.
842523- 15- 5/25
As an online medium, we are not exempt from the need for a financing option. So far, we have only
used advertising as a financing model. However, since we know how important the issue of data
protection is to our readers, we have created a product that works without advertising and without
any data tracking: derStandard.at/PUR. All scripts from third-party providers, all social media plug-ins
and all data processing that is not absolutely necessary for technical reasons for the operation of the
website have been removed from this version of our website (see appendix "Processing activities of
third parties"). As a PUR customer, you can, of course, also deactivate this content as required.
II. Processed data categories
When you use our website, we generally process your IP address, (if available) your STANDARD user
account, the name and version of your web browser, your web browser-identifying cookies, which
pages you visit on our website and when exactly (URL, date, time) and the website you visited before
accessing our website. Your web browser transmits all this data to us when you visit our website.
In detail, this is the following data:
• Your IP address: This is used to determine the country from which you are visiting us in o r d e r
t o be able to offer regionally different content, and also for statistical analysis of visitors by
country.
• URL: We use the URL you have called up to evaluate how often a particular article has been called
up.
• Timestamp: The time at which the URL is accessed (date and time) is used to limit statistical
evaluations to specific time periods.
• Referrer URL: This is the URL of the page from which you came to the current page by clicking on
a link. We use this for statistical analysis in order to measure which (external) pages link to one of
our pages.
• User agent string: This represents the name and version of the browser used and is used to
optimize the presentation and user-friendliness of our website.
• All cookies that are processed by derStandard.at (see cookie appendix).
• Server log files: Data that your browser automatically transmits to us is stored in so-called
server log files. These are Browser type, browser version, operating system used, referrer URL,
host name of the accessing computer, date and time of the server request, your IP address,
contents of the cookies from derStandard.at.
We process the data provided exclusively for the purposes listed below. This data i s not merged with other
data sources.
In addition to the data that is collected when you use our website, we also process data that you
provide to us yourself by filling out contact forms or by registering on our website. You can find more
information on these processing activities in our privacy policy.
III. Legal basis of the processing
In data protection, a distinction is made between cookies that require your consent before they can be
stored on your end device and cookies that may be stored without your consent in accordance with the
Telecommunications Act, as these are absolutely necessary for us to be able to provide our service to
you. The majority of our cookies are those for which no consent is required.
9 --
consent is required. Of course, we only set the other cookies after we have obtained your consent.
The legal basis for the use of cookies is therefore either your consent or the exception provided for in
the Telecommunications Act.
You can find a detailed overview in the Cookie Annex.
IV. Our processing activities on our website
In addition to the processing activities listed in the privacy policy, we carry out the following data
processing activities on our website.
This data is processed by the following recipients. by our IT service providers in accordance with the
commitment to our mandate and companies of the STANDARD Group.
A. Functional cookies
Cookies are generally used to enable additional functions on a website. Functional cookies can, for
example, facilitate navigation on our website, ensure that the website can be used again from the
point at which you previously left it, or they can be used to save your settings when you visit our
website again. We process your data on the basis of the Telecommunications Act. Functional cookies
are necessary for the use of our website. You can find a current overview of our functional cookies in
our cookie appendix.
B. Analysis cookies
We use web analysis services to enable us to analyze your use of our website. We process your data on
the basis of your consent.
The following data processing is profiling. You can object to this processing at any time using the opt-
out options provided in the cookie appendix.
• MGUID/BIG: We carry out web analyses via our MGUlD cookie in order to get to know our
users better. The STANDARD strives to ensure smooth operation, good response times on the
web, good support for our readers' devices and, last but not least, the ongoing attractiveness
of our content. Our tools for this are internal counting, evaluation and diagnostic systems.
This data processing is profiling. You can object to this processing at any time by using the
opt-out option provided in the cookie attachment.
• Google Analytics: We also use Google (Google LLC, 1600 Amphitheatre Parkway Mountain
View, CA 94043, USA) as a web analytics service provider. We only use Google Analytics with
activated IP anonymization. This means that the IP address does not allow any conclusions to
be drawn about you as a user. Google holds a Privacy Shield certification and thus guarantees
a level of data protection in line with the European Union. In the case of Google Analytics, the
information generated by the Cool'ies used is transferred to Google's servers in the USA and
stored there. Google uses this information to evaluate the website usage of our users for us.
This data processing is profiling. You can object to this processing at any time by using the
opt-out option provided in the cookie attachment. Find out more in Google's privacy policy.
• ÖI/VA-Webono/yse: We use the ÖWA web analysis to measure the reach of the use of our
online offers. The aim is to collect comparable and objective data to assess the performance
of online offers and advertising agencies. This counting and testing by a third party (ÖWA)
guarantees independently collected, verified and therefore comparable data.
6/25842523
10 --
and therefore comparable data. We also use the opportunity to get to know our users better
by means of ÖWA surveys on our website. IP addresses are not stored in the process and are
only processed in anonymized form. You can object to this processing at any time by using the
opt-out option provided in the cookie attachment. Find out more in the ÖWA privacy policy.
• Hotjar.' We use Hotjar to better understand the needs of our users and to optimize the offer
on this website. Hotjar's technology gives us a better understanding of our users' experiences
(e.g. how much time our users spend on which pages or which links they click on). This helps
us to tailor our offering to our users' feedback. Hotjar works with cookies and other
technologies to collect information about your end devices (screen size, device type, browser
used). Your IP address is only processed in anonymized form. Hotjar stores this information in
a pseudonymized user profile. The information is not used by Hotjar or by us to identify
individual users or merged with other data about individual users. This data processing is
profiling. You can object to this processing at any time by using the opt-out option provided in
the cookie attachment. Find out more in Hotjar's privacy policy.
A current overview of our analysis cookies and your revocation options can be found in our cookie
appendix.
C. Advertising cookies
For commercial reasons, we use the option of making our website available to third parties as an
advertising space. We process your data on the basis of your consent.
The following data processing is profiling. You can object to this processing at any time by using the opt-
out options provided in the cookie attachment.
• Google Adwords.' We use Google (Google LLC, 1600 Amphitheatre Parkway Mountain View,
CA94043, USA) as our advertising service provider. Google holds a Privacy Shield certification
and thus guarantees a level of data protection in line with that of the European Union. In the
case of Google Adwords, the information generated by the cookies used is transferred to
Google's servers in the USA and stored there. This information enables us to determine
whether a user has reached our website via a Google search. This data processing is profiling.
You can object to this processing at any time by using the opt-out option provided in the
cookie appendix. Find out more in Google's privacy policy.
• Nugg.Ad: We use predictive behavioral targeting to make it possible to control online
advertising according to socio-demographic criteria and product interests. Predictive
behavioral targeting is a process in which data from the surfing behavior of our users is
combined with information from surveys of a small number of users. The completed
questionnaires are not stored in any connection with the person completing them, but are
used to create so-called lookalike profiles. There is no re-identification of natural persons, but
an extrapolation using probabilities. The lookalike profiles are stored on your end device in
cookies set by Nugg.Ad on our behalf. When advertising is delivered on our website, certain
properties stored in the cookie on your device can be targeted. This data processing is profiling.
You can object to this processing at any time by using the opt-out option provided in the
cookie attachment. Find out more in Nugg.Ad's privacy policy.
• Adition: We use Adition as a service provider for the delivery of advertising on derStandard.at.
Adition can also be used to place ads 'across our entire website.
11 --
We also carry out frequency capping via our service provider Adition. This controls the
frequency with which the Nugg.ad survey is displayed and the frequency with which the
advertisements are displayed. Find out more in Adition's privacy policy.
A current overview of our advertising cookies and your revocation options can be found in our cookie
appendix.
V. Processing activities of third parties on our website
B. Social media plug-ins
We integrate all common social media platforms into our website to offer you the opportunity to s h a r e
our editorial content on social networks.
The social media plug-ins, which are located at the beginning and end of an article text, only call up
the corresponding function when clicked and only then establish a connection with the respective social
media platform. We would like to point out that, as the website operator, we have no knowledge of
the full content of the transmitted data or its use by the respective social media platform. If you click
on social media plug-ins while you are logged into your social media account, you can link the content
of our pages to your social media account. This allows the social media platform to associate your visit
to our pages with your account. If you do not want this to happen, please log out of your social media
account.
A current overview of our social media plug-ins can be found in our appendix
"Processing activities of third parties".
Appendix - Cookies processed by derStandard.at and its subdomains
B. Categories according to cookie type
In practice, the division of cookies into the following three categories has become established:
functional cookies, analysis cookies and advertising cookies. The presentation of processing
activities on our website therefore also follows this logic.
The European Data Protection Board (formerly the "Article 29 Data Protection Working Party")
has also made a categorization according to different purposes, which you can also see in the
presentation of our cookies. The following categories are provided for.
• User input cookies: These are session cookies that are used to track user input on the website.
Your consent is not required for these cookies.
• Authentication cookies: These cookies are used to identify the user as soon as they log in to
the website so that the user can access their content. Your consent is not required for these
cookies as long as it is not a permanent login.
• Security cookies. These cookies are used to increase data security on the website and in
particular to protect the login system from misuse. Your consent is not required for these
cookies.
842523- 15- 7/25
12 --
• Multimedia player cookies,' These cookies store technical data that enable videos or audio
to be played on the website. Your consent is not required for these cookies.
Load balancing cookies: These cookies enable the distribution of web server requests across
multiple servers to ensure optimal utilization of the \/website Bonn. Your consent is not
required for these cookies.
UI customization cookies: These cookies store the user's preferred settings, such as
language or search settings, for which your consent is not required.
" Social plug-in cookies: Social network cookies are divided into cookies that enable the
sharing of content on the one hand and store the behavior of users on the other. For the
latter, your consent is not required as long as only the data of those users who are logged into
the social network is processed. A//e 'other social plug-in cookies require the respective
website to obtain your consent.
• Advertising cookies: Third-party advertising on a website, which is made possible by the
integration of third-party content, requires your consent to be obtained by the respective
advertiser (see point VI).
• Analysis cookies: These cookies enable the website operator to analyze the use of its
website and thereby improve it (see point V). We obtain your consent for the use of these
cookies.
1.5. The first complainant worked at noyb from June 2021 to August 2021. To access the
websites of the second, third and fourth complainants at the time of the proceedings, he used a
laptop provided by his former training position at noyb, which he also used for private purposes.
The laptop was secured with the first complainant's personal password and no other persons
used it.
persons used it. To visit the website in question, the first complainant used the IP address
to which several devices were attached. He clicked on the "AGREE" button
when he was presented with a choice on the
website, he was given the choice of agreeing to the data processing described in the "cookie
wall" or taking out a paid subscription. The cookies listed under point 1.6. were then set on his
terminal device. The first complainant clicked on the "AGREE" button, as he did not wish to take
out a paid subscription or enter into any obligations. The first complainant deleted his cookie
history regularly (at least once a week or every few days) in August 2021. He wants to keep his
browser "clean". He does not want to be "tracked" "in the online context". In his opinion, this is
a necessary step in between to clean his browser.
13-
The first complainant already used the website of the second, third and fourth
complainants for the purpose of following current (political) events before the time
of the proceedings in question and still uses it occasionally to this day.
The complaint was prepared jointly by the first complainant and his representative
during his time at noyb as part of a project.
1.6. In connection with the first complainant's interaction with the website subject
of the proceedings at the time of the proceedings, the following relevant cookies were
placed on the first complainant's terminal device, among others:
Cookie name Value
("value") or application
MCUID
MCUID Description
Google Analytics cookie,
used to distinguish users.
Google provides hilsr as the
lowest annual storage
period of 2 years.
The storage period is
explained by interest in
being able to carry out
annual comparisons of the
to be able
to carry out web analysis.
Google Analytics cookie,
used to distinguish users.
Contains a
a unique identifier that is
used to recognize the end
device at following
to recognize it.
This allows, for example, a history
of the addresses called up
842623 8/E2
during a visit or another
visit within the lifetime of
the cookie. cookie,
can be reconstructed.
The cookie "IDE does not go
to Google and is used for ad
preferences
websites. It is stored in
browsers under the
doubIecIlck.net
stored. Other Google
products such as YouTube
may also use these cookies
more relevant
advertising.
Google
reCAPTCHA
google nid
We use the following on our
website "Google
(Invisible) reCAPTCHA",
a service provided by
Google LLC, 1600
Amphitheatre
Parkway, Mountain View, CA
94043, USA (hereinafter
referred to as: "Google"
Google (Invisible)
reCAPTCHA processes
information about your
user behavior
on our website.
Google uses the cookie
like the to
advertise Google
products such as the
Google
15 --
search customized
customize. The NID cookie
contains a unique ID that
Google uses to store your
preferred settings and
other information.
The content of the "HAR file" submitted in the administrative proceedings is used as
the basis for the findings of fact. The "HAR file" cited contains a complete list of all
cookies set and applications used as well as the transactions.
During the visit, data of the first complainant was transmitted to various domains, such as
doubIecIick.net (Google) or facebook.com (Facebook).
The first complainant's browser data was as follows, at least on August 12, 2021:
1.7. The website in question used a so-called TC string at the time of the proceedings.
User preferences are encoded and stored in a string consisting of a combination of letters and
characters k n o w n as a TC string.
1.8.If users took out the paid subscription mentioned under point 1.3. at the time of the
proceedings, no cookies were set for advertising, profiling or analysis purposes.
1.9. The legal representation of the first appellant (noyb) is a non-profit association duly
established under Austrian law, whose statutory objectives are in the public interest and which
is active in the field of the protection of the rights and freedoms of data subjects with regard to
the protection of their personal data.
8A2523
16
1.10. Point 2 of the contested decision reads as follows:
"With regard to objection point D) [ordering the deletion of the data collected], the
respondents [only the second, third and fourth respondents] are instructed to review their
database within a period of four weeks to determine whether the cookie values (value) and
browser data mentioned in statement of facts C.B. [here: point 1.6.] are still being processed
at the current time and, if this is affirmed, to delete this data immediately upon other
execution."
1.11. The cookie values (value) and browser data mentioned in point 1.6. were deleted
due to the passage of time.
1.22. According to the informed representative, website optimization was also carried
out on the website in question.
Even before the introduction of the display of personalized advertising on the
website subject of the proceedings, a web analysis was carried out on this website.
1.13. The consent wall of krone.at shows that separate consent is possible in this
regard with regard to "advertising (consent required)" and "web analysis and
website optimization" as well as "loading external resources [sic!] {including social
embeds)".
2. Evaluation of evidence:
2.1. The general findings on cookies and how they work can be found in the Opinion of
Advocate General Maciej Szpunar in Case C-673/17, Planet49 GmbH, para. 36 et seq. The
data protection authority has already based its findings on these without objection.
2.2. The findings that the second, third and fourth complainants operate the website
in question result from the administrative act that is undisputed in this respect (see,
for example, opinion of 13.12.2021 para. 7 f). The findings on the retrievable content on
the website in question are derived from the administrative act, which is also
undisputed in this respect, as well as from a review of the website in question
The findings on the number of users are
derived from the administrative act, which is also undisputed in this respect.
The findings on the number of users result from a search by the recognizing senate
on the website of the ÖWA ("Austrian Web
analysis"; https://oewa.at/studie/planungsausweisung/, accessed on 24.07.2025; see
17 -2.3. The findings regarding consent to data processing and the conclusion of a PUR
subscription are based on the undisputed administrative record in this respect (see, for
example, DSB hearing document of 03.02.2023 p. 5; data protection complaint p. 13; see
also statement of 13.12.2021; see the unobjectionable and undisputed graphics in the
contested decision point C.3 regarding the multi-stage process of concluding a PUR
subscription) and the data protection complaint (Annex ./2 and data protection complaint p.
5).) and regarding the cookie banner at the time in question in the data protection complaint
(Annex ./2 and data protection complaint p. 5) and the DPA hearing document of
03.02.2023 p. 6. The finding that the cookie banner now contains "personalized advertising
measures" instead of "digital advertising measures" results from OZ 27 zz 2272970-1 and OZ
29 zz 2272971-1. The fact that the type and manner of advertising has not changed
regardless of the new name is evident from the statements made to the data protection
authority (DSB hearing document of 03.02.2023 p. 6).
2.4. The finding regarding the data protection declaration of the second, third and fourth
complainants in the aforementioned version is based on the undisputed content of the file.
It could be taken from the data protection complaint, Annex ./3.
2.5. The finding that the first complainant worked at noyb from June 2021 to August 2021 is
based on a screenshot of his Linkedln profile available in the file (see enclosure ./3 of the
decision complaint para. 49 of the second, third and fourth complainants and the statement
of 13.12.2021; see also DSB hearing transcript p. 4). The fact that the first complainant used a
laptop provided by his training center noyb to access the website in question at the time of
the proceedings, that this was secured with a personal password and that no other persons
used it, is clear from his unobjectionable statements (see, for example, DSB hearing
document of 03.02.2023 pp. 3, 5, see also VH on 08.07.2025 p. 7 and statement of the first
complainant 21.07.2025 para. 51). The fact that he visited the website that is the subject of
the proceedings with the specified IP address is shown, among other things, by the
submissions of the second, third and fourth complainants (decision complaint of the second,
third and fourth complainants, para. 46 with reference to the data protection complaint of
the first complainant, enclosure ./7, HAR file). It is also clear from the statements made at
the hearing before the Federal Administrative Court that several devices were attached to
the IP address (see VH on 08.07.2025 p. 17). The fact that the first complainant clicked on
"EINVERSTANDEN" when the "cookie wall" appeared is clear from his unobjectionable
statements in this regard (see, for example, DSB hearing transcript of 03.02.2023 p. 5). The
fact that the specified cookies on the
842523- 15- 10/25
-10-The fact that the first complainant's terminal device was set is evident from his data
protection complaint (in particular from its enclosure ./7, HAR file). The finding that the first
complainant clicked on the "AGREED" button because he did not want to conclude a
subscription subject to payment and did not want to enter into any obligations is based on
his unobjectionable statements to the data protection authority (DSB hearing transcript
03.02.2023 p. 3 f). The finding that the first complainant regularly (at least once a week)
deleted his cookie history in August 2021 and his motivation for doing so is based on the
information he provided to the data protection authority (see DPA hearing document p. 5).
The finding that the first complainant had already used the website of the second, third and
fourth complainants prior to the time of the proceedings in question is based on his
consistent and therefore unobjectionable statements to the data protection authority and
the adjudicating senate (see DSB hearing document of 03.02.2023 p. 3 and VH of
08.07.2025 p. 4). The fact that he has used the website occasionally to date is evident from
his unobjectionable statements at the appeal hearing (VH of 08.07.2025 p. 4). In this regard,
the first complainant was able to cite specific political events in which he has an interest.
The joint preparation could be established on the basis of the information provided by the
first complainant in this regard (VH of 08.07.2025 p. 4).
2.6. The findings under point 1.6. are based on the "HAR file" in conjunction with the
statements in the unobjectionable contested decision.
2.7. The finding that the website in question used a TC string at the time of the
proceedings is based on the statement of the second appellant's informed representative at
the oral hearing on 08.07.2025 (p. 16).
For a more detailed understanding of what a so-called TC string is, the court relied on the
unconditional and explanatory statements of the ECJ in its judgment of 07.03.2024, C-
604/22, IAB Europe, para. 25.
2.8. The findings under point 1.8. correspond to the unconditional findings of the data
protection authority.
2.9. The findings under point 1.9. are derived from the articles of association of the legal
representation of the first complainant (also available at under
19
https://noyb.eu/sites/default/files/2020-03/NOYB Statute DE EN 0.pdf, retrieved on
24.07.2025, see also VH of 24.07.2025 enclosure ./12), a current excerpt from the Austrian
register of associations (OZ 27 zz 2272970-1 and OZ 29 zz 2272971-1) and their relevant
unconditional statements in the course of the appeal hearing (VH of 24.07.2025 p. 25).
2.10. The findings under point 1.10. were taken from the contested decision (p. 2).
2.11. The finding under point 1.11 that the cookie values (value) and browser data
mentioned in point 1.6. were deleted is based on the information provided by the second,
third and fourth complainants (see, for example, VH of 24.07.2025 p. 29), according to which
this data had already been deleted some time ago due to the passage of time. The data
protection authority, which issued the corresponding order to the second, third and fourth
complainants (item 2. of the contested decision), expressly did not dispute in the oral
hearing of 24.07.2025 (p. 29) that this data had been deleted and was therefore able to make
the finding under item 1.11.
2.12. The findings under point 1.12., according to which a website optimization was carried
out on the website subject of the proceedings and a web analysis was already carried out on
the website subject of the proceedings before the introduction of the display of
personalized advertising on this website, result from the unobjectionable information
provided by the representative of the second complainant in the course of the complaint
hearing on 24.07.2025 (p. 7 f).
2.13. The finding under 1.13. is based on the unobjectionable screenshots submitted by the
second, third and fourth complainants.
3. Legal assessment:
3.1. Legal bases in excerpts:
Recital 26 GDPR:
[...j In order to determine whether a natural person is identifiable, account should be taken of all the means
reasonably likely to be used by the controller or another person to identify the natural person directly or
indirectly, such as singling out. In determining whether means are reasonably likely to be used to identify the
natural person, account should be taken of all objective factors, such as the cost of identification and the time
required, taking into account the technology available at the time of processing and technological
developments. [...]
842523- 15- 11/25
20 --
Recital 30 GDPR:
Natural persons may be assigned online identifiers such as IP addresses and cookie identifiers that provide his or
her device or software applications and tools or protocols, or other ififiers such as radio frequency
identifiers. This can leave traces that can be used, especially in combination with unique identifiers and other
information received by the server, to profile and identify natural persons.
Recital 32 GDPR:
Consent should be given by an unequivocal affirmative act which signifies freely given, specific, informed
and unambiguous indication of the data subject's agreement to the processing of personal data relating to him
or her, for example by a written statement, which may also be given electronically, or by an oral statement.
This could be done, for example, by ticking a box when visiting a website, by selecting technical settings for
information society services or by another statement or behavior with which the data subject clearly signals
their consent to the intended processing of their personal data in the respective context. Silence, already
checked boxes or inactivity of the data subject should therefore not constitute consent. Consent should
relate to all processing operations carried out for the same purpose or purposes. If the processing serves several
purposes, consent should be given for all these processing purposes. Where the data subject is requested
to give consent by electronic means, the request must be made in a clear and concise manner and
without undue interruption of the service for which consent is given.
42 Recital GDPR:
Where processing is based on the data subject's consent, the controller should be able to demonstrate that the
data subject has given consent to the processing operation. In particular, where a written declaration is
made in another matter, safeguards should ensure that the data subject knows that he or she is giving consent
and to what extent. In accordance with Council Directive 93/13/EEC, a declaration of consent pre-formulated by
the controller should be provided in an intelligible and easily accessible form, using clear and plain language,
and should not contain unfair terms. In order to give their informed consent, the data subject should at least
know who the controller is and for what purposes their personal data is to be processed. It should only be
assumed that they have given their consent voluntarily if they have a genuine or free choice and are
therefore able to refuse or withdraw their consent without suffering any disadvantages.
43rd recital GDPR:
In order to ensure that consent is freely given, it should not provide a valid legal basis in specific cases where
there is a clear imbalance between the data subject and the controller, in particular where the controller is a
public authority and it is therefore unlikely, in view of all the circumstances in the specific case, that consent
was given freely. Consent is not deemed to have been given voluntarily if consent cannot be given
separately for different processing operations of personal data, although this is appropriate in the
individual case, or if the performance of a contract, including the provision of a service, is dependent on
consent, although this consent is not necessary for performance.
-21
153rd recital GDPR..:
The laws of the Member States should reconcile the rules on freedom of expression and information, including
of journalists, scientists, artists and/or writers, with the right to the protection of personal data under this
Regulation. Derogations and exemptions from certain provisions of this Regulation should apply to the
processing of personal data solely for journalistic purposes or for scientific, artistic or literary purposes, where
necessary to reconcile the right to the protection of personal data with the right to freedom of expression and
information as guaranteed by Article 11 of the Charter. This should apply in particular to the processing of
personal data in the audiovisual sector and in news and press archives. Member States should therefore
adopt legislative measures regulating the derogations and exceptions necessary for the purpose of balancing
these fundamental rights. Member States should adopt such derogations and exceptions with regard to the
general principles, the rights of the data subject, the controller and the processor, the transfer of personal
data to third countries or international organizations, the independent supervisory authorities, cooperation
and consistency and specific data processing situations. If these derogations or exceptions differ from one
Member State to another, the law of the Member State to which the controller is subject should be applied. In
order to take into account the importance of freedom of expression in a democratic society, concepts such
as journalism that relate to this freedom need to be interpreted broadly.
Art. 4 GDPR - Definitions:
1. "personal data" means any information relating to an identified or identifiable natural person (hereinafter
"data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular
by reference to an identifier such as a name, an identification number, location data, an online identifier
or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or
social identity of that natural person;
2. "processing" means any operation or set of operations which is performed on personal data or on sets of
personal data, whether or not by automated means, such as collection, recording, organization, structuring,
storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or
otherwise making available, alignment or combination, restriction, erasure or destruction; (...)
'..'
11) "Consent" of the data subject means any freely given, specific, informed and unambiguous indication
of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies
agreement to the processing of personal data relating to him or her;
Art. 5 GDPR - Principles for the processing of personal data:
(1) Personal data must
842523- 15- 12/25
a) processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness
and transparency");
b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible
with those purposes; further processing for archiving purposes in the public interest, scientific or historical
research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes
in accordance with Article 89(1) ("purpose limitation");
c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are
processed ("data minimization");
d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that
personal data that are inaccurate, having regard to the purposes for which they are processed, are erased
or rectified without delay ("accuracy");
e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes
for which the personal data are processed; personal data may be stored for longer periods insofar as the
personal data are processed solely for archiving purposes in the public interest, scientific or historical
research purposes or statistical purposes in accordance with Article 89(1), subject to the implementation of
appropriate technical and organizational measures required by this Regulation to safeguard the rights
and freedoms of the data subject ('storage limitation');
f) processed in a manner that ensures appropriate security of the personal data, including protection
against unauthorized or unlawful processing and against accidental loss, destruction or damage, using
appropriate technical and organizational measures ("integrity and confidentiality"); (...)
Art. 6 para. 1 GDPR - Lawfulness of the processing:
(1) Processing is only lawful if at least one of the following conditions is met:
a) The data subject has given consent to the processing of personal data concerning him or her for one or
more specific purposes;
b) processing is necessary for the performance of a contract to which the data subject is party or in order to take
steps at the request of the data subject prior to entering into a contract
c) processing is necessary for compliance with a legal obligation to which the controller is subject;
d) processing is necessary in order to protect the vital interests of the data subject or of another natural
person
e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of
official authority vested in the controller
f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a
third party, except where such interests are overridden by the interests or fundamental rights and freedoms of
the data subject which require protection of personal data, in particular where the data subject is a child.
23 --
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the
performance of their tasks.
Art. 57 GDPR - Tasks:
(1) Without prejudice to other tasks set out in this Regulation, each supervisory authority on its territory
shall
a) monitor and enforce the application of this Regulation;
f) deal with complaints lodged by a data subject or by a body, organization or association pursuant to Article 80,
investigate the subject matter of the complaint to an appropriate extent and inform the complainant on the
progress and the outcome of the investigation within a reasonable period, in particular if further
investigation or coordination with another supervisory authority is necessary;
Art. 58 GDPR - Powers:
(2) Each supervisory authority shall have all of the following remedial powers that allow it to
a) to warn a controller or processor that intended processing operations are likely to infringe this Regulation
b) to warn a controller or processor where processing operations have infringed this Regulation
c) to order the controller or processor to comply with the data subject's requests to exercise his or her rights
under this Regulation
d) instruct the controller or processor to bring processing operations into compliance with this Regulation,
where appropriate, in a specified manner and within a specified period,
e) instruct the controller to notify the data subject of a personal data breach accordingly,
f) to impose a temporary or definitive restriction on processing, including a ban,
g) order the rectification or erasure of personal data or the restriction of processing in accordance with
Articles 16, 17 and 18 and the notification of such measures to recipients to whom the personal data have been
disclosed in accordance with Article 17(2) and Article 19
h) revoke a certification or instruct the certification body to revoke a certification granted in accordance with
Articles 42 and 43, or instruct the certification body not to grant certification if the conditions for certification
are not or are no longer met,
i) impose a fine in accordance with Article 83, in addition to or instead of the measures referred to in this
paragraph, depending on the circumstances of the individual case,
j) order the suspension of the transfer of data to a recipient in a third country or to an international
organization.
842523- 15- 13/25
24 --
(...)
3.2. In his submission of 13.08.2021 initiating the proceedings, the first complainant
complained that he had not been able to access the journalistic content of the second, third
and fourth complainants without disadvantage during the period in question, as he had
been forced either to consent to extensive processing of his data for advertising purposes or
to take out a paid subscription. This "pay-or-OI'ay" solution would have forced him, in the
absence of an adequate alternative, to consent to data processing that he did not like. The
blanket consent to all data processing would not have met the requirements of the GDPR.
The data processing sought by the second, third and fourth complainants was not necessary
for the service in question (offering journalistic content) and there was no choice for the
first complainant.
3.3. The outermost framework for the power of review [of the Administrative Court] is the
"matter" of the contested decision (see VwGH 06.10.2023, Ra 2022/11/0129 or also VwGH
16.3.2016, Ra 2015/04/0042). According to the case law of the Administrative Court, the
"subject matter" of the administrative appeal proceedings before the Administrative Court
is (only) the matter that formed the content of the decision of the respondent authority
(see VwGH 06.05.2020, Ra 2019/08/0114; VwGH 9.9.2015, Ro 2015/03/0032, mwN), i.e. the
matter that was decided by the authority being challenged (see VwGH 24.08.2023, Ra
2022/22/0093; VwGH 08.02.2022, Ro 2021/04/0033; VwGH Ra 2015/04/0042).
Point I of the contested decision refers to 12.08.2021, which is why this date is decisive for
the Federal Administrative Court's power of review.
3.4.1. The adjudicating senate has no doubt as to the fundamental applicability of the GDPR
to the facts of the case in question: According to Art. 4(1) GDPR, "personal data" means any
information relating to an identified or identifiable natural person. A natural person is
considered identifiable if, among other things, they can be identified directly or indirectly, in
particular by reference to an identifier such as a name, an identification number, location
data or an online identifier. According to the ECJ, the term "personal data" is to be
understood extremely broadly (see ECJ 20.12.2017, C-434/16 - still on the Data Protection
Directive, but the case law is transferable to the GDPR: see ECJ 07.03.2024, C-604/22 para.
33).
25-
The use of the phrase "all information" in the definition of the term "personal data" in this provision
"personal data" in this provision expresses the aim of the Union legislator to give this term a
"broad meaning", which potentially includes all types of information of both an objective
and subjective nature in the form of opinions or assessments, provided that it is information
"about" the person in question (see ECJ 07.03.2024, C-604/22 para. 36 mwN).
In the contested decision, the data protection authority unobjectionably states that the IP
address used in combination with the cookies set and the browser data is personal data.
In addition, it should be borne in mind that TC strings were used on the website in question in
August 2021 and reference is made in this regard (in extracts) to the judgment of the ECJ of
07.03.2024, C-604/22:
"43 However, even if a TC-string itself did not contain elements enabling the direct
identification of the data subject, this would not alter the fact that it contains, on the one
hand, the individual preferences of a particular user with regard to his consent to the
processing of personal data relating to him, that is to say, information 'relating to a ...
natural person ... ', within the meaning of Art. 4 No. 1 GDPR.
44 On the other hand, it is also clear that the information contained in a TC string, when
associated with an identifier such as, in particular, the IP address of such a user's device, can
be used to create a profile of that user and actually identify the exact person to whom that
information relates.
45 Insofar as the combination of a character string consisting of a combination of letters
and characters, such as the TC-string, with additional data, in particular the IP address of a
user's device or other identifiers, enables the identification of this user, it must be assumed
that the TC-string contains information about an identifiable user and thus constitutes
personal data within the meaning of Art. 4 para. 1 GDPR, which is confirmed by the 30th
recital of the GDPR, which expressly refers to such a case."
A TC string was used on the website in question at the time of the proceedings. There is also
additional data that enables the user to be identified, namely the IP address and other
identifiers, such as browser data
842523- 15- 14/25
26 --
and cookie identifiers. Consequently, a TC string constitutes personal data within the
meaning of Art 4(1) GDPR (see ECJ 07.03.2024, C-604/22, in particular para. 45 and 50). At
this point, it should also be noted that the second, third and fourth complainants had or
processed both the IP address with which the first complainant accessed the website in
question and the TC string and the other cookie identifiers and browser data at their
disposal at the time of the proceedings (see ECJ 07.03.2024, C-604/22, in particular
paragraphs 46 - 49 and 69).
The objection of the second, third and fourth complainants, according to which the first
complainant does not have standing, cannot be accepted for the reasons stated above:
Irrespective of the question of whether cookies were already stored on the first
complainant's terminal device when he accessed the website at issue in the proceedings,
the setting of cookies in question was (also) aimed at analyzing online behavior and playing
out personalized advertising accordingly. According to recital 26, the question of whether a
natural person is identifiable should take into account any means likely to be used by the
controller or another person, in their reasonable judgment, to identify the person directly or
indirectly, such as singling out. As explained above, the second, third and fourth
complainants not only used TC strings, but also had the IP address and Cool'ie identifiers. As
can be seen from recital 30, natural persons may be associated with online identifiers such
as IP addresses, cookie identifiers and browser data provided by their device or software
applications and tools or logs, or other identifiers such as radio frequency identifiers. This
can leave traces that can be used, in particular in combination with unique identifiers and
other information received by the server, to create profiles of the natural person and
identify them. Objectively, "traces are left behind" (such as cookies, IP address and browser
data), which can be used in combination to create a "profile of the natural person".
The fact that the terminal device used by the first complainant was a laptop provided to him
by his training center and that the IP address was used by several devices should not obscure
the fact that the data collected by cookies (inl'Iusive IP address) can be attributed to him and
that he can thus be identified. It should be noted at this point that only the first
complainant used the laptop, with the he the
27 --
used to access the website in question and which was protected with a personal password
(see point 1.5.).
In summary, it can be stated that the adjudicating senate, in accordance with the
statements of the data protection authority set out in the grounds of the contested
decision, assumes that personal data is processed when the first complainant visits the
website in question. The second, third and fourth complainants I'onnten the erI'ennenden
Senate with their arguments in this regard against the background of the facts at hand
(including the setting of cookies in the browser of the first complainant, recording of
preferences regarding consent by TC-String; cf. see also recital 30 GDPR; ECJ 01.10.2019, C-
673/17, para. 45, 67; ECJ 07.03.2024, C-604/22 para. 50) that no personal reference to the
first complainant c o u l d be established with regard to the data processing in question.
Since the second, third and fourth appellants decided at the time of the proceedings which
companies could set cookies via their online portal, they also acted as controllers within the
meaning of Art. 4(7) GDPR. Art. 4 no. 7 GDPR. This point is also not in dispute for the
adjudicating senate.
3.4.2. On the submissions of the second, third and fourth respondents regarding media
privilege:
There is no doubt that the second, third and fourth complainants operate as a journalistic
group of companies and are to be regarded as media owners isd. MedienG are to be
regarded as media owners. Nevertheless, the media privilege isd. Art. 85 GDPR and Section
9 DSG do not apply to the facts of the case. Recital 153 states that in the law of the Member
States, the provisions on freedom of expression and information, including of journalists,
scientists, artists and/or writers, should be brought into line with the right to the protection
of personal data under this Regulation. Derogations and exemptions from certain provisions
of this Regulation should apply to the processing of personal data solely for journalistic
purposes or for scientific, artistic or literary purposes, where necessary to reconcile the right
to the protection of personal data with the right to freedom of expression and information
as guaranteed by Article 11 of the Charter. In order to respect the importance of the right to
freedom of expression in a democratic society
842523- ă 5- 4 5/25
28 --
In order to take this freedom into account, terms such as journalism, which refer to this
freedom, must be interpreted broadly. The processing of personal data serves journalistic
purposes if it aims to convey information and ideas on issues of public interest
(Thiele/Wagner, Praxisl'ommentar zum Datenschutzgesetz [DSG]2§ 9 Rz 25 [as of 1.2.2022,
rdb.at] mwN). With reference to the case law of the ECtHR, the ECJ emphasized in its ruling
of 14.02.2019, C-345/17, criteria that must be taken into account when weighing up the
existence of "journalistic purposes". These include in particular
(i) the contribution to a debate of general interest, (ii) the degree of notoriety of the person
concerned, (iii) the subject matter of the reporting, (iv) the previous conduct of the person
concerned, (v) the content, form and impact of the publication,
(vi) the manner and circumstances in which the information was obtained and (vii) its
accuracy (see CJEU, 14.02.2019, C-345/17 [Buivids]; Jahnel, Kommentar zur Datenschutz-
Grundverordnung Art. 85 GDPR Rz 8 ff [as of 1.12.2020, rdb.at]).
In view of these explanations and the Itriterien I'ann elaborated by the ECJ and the ECtHR,
the processing of personal data by means of cookies in question cannot be qualified as
processing for "journalistic purposes", even if this finances the working framework available
to journalists and there is an indirect link between the data and journalistic work. The data
processing in question per se does not contribute to a debate of general interest or similar,
but serves exclusively to generate advertising revenue or brand recognition regarding social
media plug-ins. With regard to the social media plug-ins, the explanations of the data
protection authority must be followed, according to which these do not exclusively pursue
journalistic purposes, but also result in the transmission of personal data to Google or
Facebook, among others. The privacy policy states that social plug-ins store the behavior of
users on the Internet. In addition, the data protection declaration points out that the
second, third and fourth complainants have no knowledge of the full content of the
transmitted data and its use by the respective social media platform. The argumentation of
the data protection authority is convincing, according to which, if the second, third and
fourth complainants themselves admit that the content and purpose of the transmitted data
is partly unclear, it cannot be argued at the same time that this data is processed exclusively
for journalistic purposes.
For the sake of completeness, it should also be mentioned at this point that the
Constitutional Court (03.10.2024, E 3502/2024) refused to deal with the complaint in a
similar case. In this regard, it stated that there were no concerns
29 --
with regard to Art. 10 ECHR if the Federal Administrative Court assumes in the present case
that the use of Cool'ies on the website of the complaining party is not for "journalistic
purposes" within the meaning of Section 9 (1) of the Data Protection Act, Federal Law
Gazette I 165/1999, as amended by Federal Law Gazette I 62/2024 or Art. 85 GDPR (see ECJ
16.12.2008, C-73/07, Satakunnan Markkinapörssi and Satamedia).
3.4.3. The second, third and fourth complainants' submissions regarding the first
complainant's abusive filing of a complaint and the abusive conduct of his legal
representation:
According to Art. 80 (1) GDPR, a data subject has the right to mandate a body, organization
or non-profit association, duly constituted under the law of a Member State, whose
statutory objectives are in the public interest and which is active in the field of the
protection of the rights and freedoms of data subjects with regard to the protection of their
personal data, to lodge a complaint on their behalf, to exercise on their behalf the rights
referred to in Articles 77, 78 and 79 and to claim the right to compensation under Article 82,
where this is provided for by the law of the Member States.
The aforementioned criteria undisputedly apply to the legal representation of the first
complainant (see point 1.9.). The Federal Administrative Court (as previously for the data
protection authority) also has no doubts about a valid power of attorney in the proceedings
at first instance. The fact that a person - such as the first complainant in the present
proceedings - may not be represented by a relevantly active non-profit association because
he was (at least) an employee or member of this association at the time the complaint was
lodged cannot be imputed to the above provision.
The fact that Austria has provided for the right to bring an association action (Art. 80 (2)
GDPR) in this context cannot mean that employees/members of such an association cannot
individually file data protection complaints in the event of suspected data protection
violations in the course of their personal activities. Rather, the right to lodge a complaint
pursuant to Art. 80 (2) GDPR would also go much further because it is
would be "independent of a mandate from the data subject".
At this point, it should also be pointed out that the aim of the GDPR, as can be seen from its
Art. 1 and recitals 1 and 10, is, among other things, to ensure a high level of protection of
the fundamental rights and freedoms of natural persons - in particular their right to privacy
enshrined in Art. 8 para. 1 of the Charter of Fundamental Rights of the European Union and
Art. 16 para. 1 TFEU.
842523- 15- 16/25
- 30 -in particular their right to privacy enshrined in Art. 8 (1) of the Charter of Fundamental
Rights of the European Union and Art. 16 (1) TFEU - when processing personal data (see, for
example, CJEU 07.03.2024, C-604/22 para. 53).
To deny the first complainant's right to appeal would mean depriving him of effective legal
protection and the high level of protection of his fundamental rights and freedoms granted
by the Union legal order. For these considerations, the affirmation of an abuse of rights
must be carried out extremely cautiously and restrictively. The Senate hearing the case sees
an abuse of rights in the present case. The mere fact that the first complainant was (at least)
an employee or member of the association representing him at the time the complaint was
lodged cannot mean that he could not assert the rights granted to him by the GDPR. The
fact that there may have been extensive preparatory activities by the first complainant's legal
representation in the course of filing the complaint, as the second, third and fourth
complainants state, is due to the complex, also technical, circumstances associated with the
present case, and no abusive conduct on the part of the first complainant and his legal
representation can be identified from this either.
Nothing to the contrary arises from the ECJ rulings cited by the second, third and fourth
appellants (reference to ECJ 09.01.2025, C-416/23 para. 56; ECJ 26.02.2019, C-116/16 and C-
117/16 para. 97).
Case C-416/23 dealt (among other things) with the question of the more detailed conditions
under which supervisory authorities may make use of Art. 57 (4) GDPR (in the case of
manifestly unfounded or excessive requests, either charging a reasonable fee or refusing to
act on the request). Among other things, the ECJ demanded that a supervisory authority
provide proof of the data subject's intention to abuse the data in order to be authorized to
take action in accordance with Art. 57 para. 4 GDPR. The ECJ also stated that the question of
intent to abuse - i.e. another purpose that is related to the data subject's desire to protect
their rights under the GDPR - must be assessed on a case-by-case basis. Irrespective of the
clearly different factual constellation in the present case and the applicable legal provisions
(there: Art. 57 para. 4 GDPR, here: Art. 80 GDPR), it should be noted that it can be inferred
from the explanations why the adjudicating senate does not see an abuse of rights by the
first complainant and his legal representation and reference is made to these.
31
From the joined Cases. C-116/16 and C-117/16, there is nothing to be gained for the
position of the second, third and fourth complainants on a case-by-case basis. First of all, it
should be noted that a data protection matter was not the subject of the proceedings there.
Assuming that the statements made there can also be applied to data protection cases,
which can be assumed on the basis of the general statements of the ECJ (loc. cit. para. 70 -
73), it is nevertheless not apparent in the present case that the first complainant had the
intention of obtaining an advantage provided for under EU law by arbitrarily creating the
relevant conditions. The Senate does not see that the first complainant fraudulently or
abusively invoked Union law. As can be seen from the findings, the first complainant
accessed the website in question not only at the time in question, but also before and after,
for the purpose of following current (political) events, which leads to the conclusion that the
first complainant did not I'ughly and arbitrarily bring about the creation of a possible
infringement of the GDPR (and thereby fraudulently or abusively benefited from advantages
provided for in Union law), but that he is actually a user of this website. At the same time, his
personal data (point 3.4.1.) have been processed. The first complainant has convincingly
conveyed the impression of a person who attaches particular importance to the protection
of his personal data, both through his written submissions and through his oral submissions
to the data protection authority and the Federal Administrative Court - this is concluded by
the adjudicating senate in particular from the fact that he regularly checks his cookie history,
that he regularly deleted his cookie history - and has a real interest in the outcome of this
case, even after his employment with noyb has ended, especially since he also clearly stated
during the proceedings that he does not wish to take out a paid subscription. It is also
understandable for the adjudicating senate that the first complainant considers his rights to
have been infringed (see recital 142, first sentence). In view of these circumstances, an
arbitrary creation of the relevant conditions cannot be recognized. With regard to the more
detailed preparatory acts in the course of filing the data protection complaint, reference is
made to the explanations above.
In summary, it can be stated that the actions of the first complainant and his legal
representation are legally unquestionable against this background.
3.5 The rejection of the appeal against the decision of the second,
third and fourth complainants
842523- 15- 17/25
32
3.5.1. In their joint complaint, the second, third and fourth complainants argue, among
other things, that advertising in the strict sense and advertising space analyses are
inextricably linked and that data processing in this regard is necessary for the provision of
their online offering. In this sense, users of the website in question had the option to pay for
a subscription without advertising, to receive a free version of the online offer including
advertising by consenting to the processing of their personal data or to leave the website
accessed again. According to the previous legal opinion of the data protection authority,
such a procedure was permissible. Uniform consent to the various data processing
operations was appropriate in view of recital 43 and therefore permissible.
3.5.2. Insofar as the second, third and fourth complainants point out that the data
protection authority determined in 2018 and 2019 that the "pay or okay" model used by
them was permissible, it should be noted that the data protection authority is not bound by
a specific legal opinion that it has held in the past. It is clear from the established case law of
the VwGH that only the ruling of an administrative decision is binding and not the reasoning
(see VwGH 09.11.2023, Ra 2021/08/0087; VwGH 01.03.2018, Ra 2017/16/0102; VwGH
30.06.2016, 2013/07/0262).
As explained at the beginning, the second, third and fourth complainants are the controllers
within the meaning of Art. 4(7) GDPR. Art. 4(7) GDPR, who process the personal data at
issue here isd. Art. 4 no. 1 GDPR of the first complainant. Granularity is one of the key
elements with regard to the voluntary nature of data processing. In this case, there is
already a lack of granularity, meaning that consent within the meaning of Art. 6 para. 1 lit. a
GDPR must be denied:
Art. 4(11) GDPR defines "consent" of the data subject as any freely given, specific, informed
and unambiguous indication of the data subject's wishes by which he or she, by a statement
or by a clear affirmative action, signifies agreement t o the processing of personal data
relating to him or her.
Art. 6 para. 1 lit. a GDPR reads (emphasis not in original):
"(1) Processing is lawful only if at least one of the following conditions is met:
33 --
(a) the data subject has given consent to the processing of personal data relating to him or her for one or
more specific purposes;"
It can be inferred from recital 32 that consent should relate to all processing operations
carried out for the same purpose or purposes. If the processing serves several purposes,
consent should be given for all these processing purposes.
Recital 43 states that consent is not deemed to be freely given if consent cannot be given
separately for different processing operations of personal data, although this is appropriate
in the individual case, or if the performance of a contract, including the provision of a
service, is conditional on consent, although this consent is not necessary for performance.
The second, third and fourth complainants argued in their complaint that joint consent was
permissible on the basis of recital 43. The following must be countered: In the present case,
the first complainant only gave individual consent for the use of Cool'ies for web analysis
and digital advertising measures. The consent serves several processing purposes
listed in its privacy policy (see point 1.4.). For example, it is clear from the privacy policy
under "Analysis cookies" that these also have the purpose of optimizing your own website (e.g.:
"We use web analysis services to enable an analysis of your use of our website."). "We carry
out web analyses via our MGUlD cookie in order to get to know our users better. The
STANDARD endeavors to ensure smooth operation, good response times on the web, good
performance of our readers' devices and, not least, the ongoing attractiveness of our
content." "Google uses this information to evaluate the website usage of our users for us."
"We use Hotjar to better understand the needs of our users and to optimize the offer on this
website. With the help of Hotjar's technology, we get a better understanding of our users'
experiences (e.g. how much time our users spend on which pages or which links they click on).
This helps us to tailor our offer to the feedback of our users.""Analysis cookies: These cookies
enable the website operator to analyze the use of its website and thus improve it'). It is also
clear from the statements made by the second complainant's informed representative at
the hearing on 24.07.2025 that those responsible also optimized their website (see point
1.12.). The argument that individual consent would be "appropriate" in the present case
cannot be accepted by the adjudicating senate. Already from
842523- 15- 18/25
34 --
The classification of "functional cookies", "analysis cookies" and "advertising cookies" in the
data protection declaration makes it clear that different purposes are pursued with the data
processing.
I'n fact, the first complainant was not free to choose which purpose he wanted to consent
to, but could only consent to a bundle of processing purposes (see EDPB Guideline 05/2020
on consent under Regulation 2016/679, 04.05.2020, paragraph 42). The EDPB Guideline on
Consent states that where the controller has aggregated different purposes for processing
and has not attempted to obtain separate consents for each purpose, there is a lack of
freedom. This granularity is closely related to the requirement that consent must be given
for the specific case. If several purposes are pursued with the data processing, the solution
for compliance with the conditions for valid consent lies in granularity, i.e. in the separation
of these purposes and obtaining consent for each purpose (see EDPB Guideline 05/2020,
paragraph 44). In addition, Art. 6 para. 1 lit. a GDPR confirms that the data subject's consent
must be given for "one or more specified" purposes and that a data subject must have a
choice in relation to each of these purposes (EDPB Guideline 05/2020, para. 55). The
explanations in the Guideline also lead to the conclusion that this was not a case of granular
consent, as there were no separate consents for the different purposes. The first
complainant was not free to choose which purposes he wanted to consent to. The controller
did not attempt to obtain separate consent for each purpose.
EDPB Opinion 08/2024 on "Effectiveness of consent in the context of 'consent or pay' models
of large online platforms" states that if the data subject is presented with a "consent or pay"
model, they should be free to choose which individual purposes they wish to consent to,
rather than only having the option to consent to a bundle of all processing purposes. The
granularity is closely linked to the requirement that consent must be given for a specific
purpose. Furthermore, the opinion states that the granularity of consent in relation to
behavioral advertising by large online platforms deserves particular attention, as the
complex dynamics prevailing there pose considerable challenges. In this context, the EDPB
Opinion pointed out that online platforms involved in behavioral advertising use technically
advanced infrastructures that are often part of a digital ecosystem where multiple data sets
from different sources are likely to be aggregated, analyzed and possibly auctioned in real
time.
35 --
Given these different dynamics, it is not data protection compliant for controllers to offer
data subjects only the possibility of blanket consent for a number of different purposes such
as content personalization, advertising personalization, service development or
improvement, and audience measurement. In this sense, the EDPB recalls that data subjects
should be free to choose which purpose they accept, rather than being confronted with a
single request for consent that combines all purposes. In this context, the focus should be
on the distinction between the purposes related to the functionality of the service on the
one hand and behavioral advertising purposes and related processing operations on the
other (EDPB Opinion 08/2024, para. 139 f).
The statements in this EDPB opinion also lead to the conclusion that there is a lack of
granularity. Those responsible for behavioural advertising have only offered the first
complainant the option of blanket consent and a single attempt at consent for a number of
different purposes, such as the personalization of advertising but also the development or
improvement of services. It should be noted that this position - as can be inferred - is
generally, but not exclusively, aimed at large online platforms. The considerations may
generally prove useful for the application of the concept of consent in "consent or pay"
models (EDPB Opinion 08/2024, para. 31).
The argument of the second, third and fourth complainants, according to which
personalized advertising on the market is now almost exclusively sought after by advertisers
and must therefore necessarily be associated with advertising analysis, is not a legal argument
isd GDPR. "Advertising" as an underlying objective in the background cannot be considered a
common purpose. In this regard, it should be borne in mind that the data processing also
served to optimize the website, as shown. The data protection authority based its decision
on the fact that consent for the purpose of displaying (personalized) advertising and
measuring the success of advertising would be appropriate and possible, but that consent
for further processing operations (in particular cool'ies for website optimization and social
media plug-ins) would not. Furthermore, the assumption that it would be reasonable or
appropriate for the consent to also include further processing operations is also contrary to
the principle of data minimization under Art. 5 para. 1 lit. c GDPR (see also statement of the
first complainant of 15.09.2023 para. 17f). It should also be borne in mind that it is not
obvious to the user that this should be a single purpose; in this regard, reference is again
made to the cookie categorization in the
842523- 15- 19/25
36 --
Data protection declaration. If, for example, a data subject is not sufficiently informed about
all circumstances relating to the processing of personal data, including the purpose of the
processing and the recipients of the data, this precludes the granting of "informed" consent,
which leads to the unlawfulness of this processing (Bergauer/Gosch, Datenschutzrecht, p.
126). However, even if, contrary to the above statements, a (single) purpose could be
assumed - the second, third and fourth complainants put forward the purpose of generating
advertising revenue (see, for example, notice complaint para. 5, 40)
- the first complainant would not be sufficiently informed about the purposes of the
processing.
In this context, with regard to the krone.at consent wall submitted by the second, third and
fourth complainants, it is noted that separate consent is required in this regard with regard
to "advertising (consent required)",
"Web analysis and website optimization" and "Loading external resources [you!] (including
social embeds)" is possible in each case.
The data protection authority also agrees that a procedure in which no attempt is even
made to comply with the requirements regarding granularity and in which a
"blanket consent" is compared to a paid subscription option cannot be an appropriate
balance of fundamental rights under Art. 8 EU GDPR (protection of personal data) and Art.
16 EU GDPR (freedom to conduct a business). The mere fact that there is an economic
interest cannot mean that it is appropriate, according to recital 43, not to obtain separate
consents for different processing operations. It is noted that both the advertising cookies
and the analysis cookies carry out profiling according to the privacy policy.
It can also be inferred from the ECJ decision "Planet49 GmbH" (ECJ 01.10.2019, C-673/17,
para. 58) that an expression of will (i.e. consent to data processing) must be given for the
I'onI'reten case, which is why the expression of will must relate to the data processing in
question, which was not the case in the facts of the case in question with various processing
operations and purposes (see also Jahnel, Kommentar zur Datenschutz-Grundverordnung
Art. 4 Z 11 DSGVO Rz 11 [as of 1.12.2020, rdb.at]). According to Buchner/K'ühling, the
purpose for consent must also be as precise as possible in order to ensure that personal data
is not processed for unforeseen purposes (see Buchner/K'ühling in Kühling/Buchner D-SGVO,
BDSG I¢ommentar4Art 7 Rz 61 [2024]).
37 --
In addition, the processing purposes also differ significantly according to the resolution of
the (German) Conference of Independent Federal and State Data Protection Supervisory
Authorities of 22.03.2023. Users do not have the opportunity to select the individual
purposes for which consent is to be obtained themselves and aI'tively. A very close
connection between web analysis, which includes the optimization of the website, and
personalized or digital advertising measures cannot be identified. In this regard, it should be
noted that web analysis also took place in the past before personalized advertising measures
were used (see point 1.12.). It is conceivable that a user would consent to data processing in
order to optimize a website that they regularly visit, but would reject data processing for
personalized or digital advertising measures. The view of the second, third and fourth
complainants, according to which there is a "very close connection" and bundling can be
considered (see, for example, statement 12.09.2023), cannot be followed. Therefore, the
blanket overall consent for various purposes must be regarded as not having been
effectively granted.
It is noted that the second, third and fourth complainants regarding the social media plug-
ins have relied exclusively on the media privilege and not on consent with regard to the data
processing in question (see, for example, statement 07.07.2025 para. 68 and VH 24.07.2025
p. 4). As can be seen from the reasoning in 3.4.2, the statements of the second, third and
fourth appellants on media privilege were not followed. The granularity of consent must
also be denied with regard to social media plug-ins.
3.5.3. Since there was no legally valid consent to the data processing operations of the
second, third and fourth complainants due to the lack of granularity, this already results in
the invalidity of the consent of the first complainant at the time of the proceedings.
In this context, the statements of the second, third and fourth complainants that they are
not responsible for data processing by means of social media plugins are also not convincing
and reference is made in this regard to the judgment of the ECJ of 29.07.2019, C-40/17, in
particular para. 64 et seq.
It should also be noted that the setting or reading of cookies pursuant to Art. 5 para. 3
of the Directive 2002/58/EC, implemented in § 165 para. 3 TKG
2021,
842523- 15- 20/25
38 --
requires valid consent (cf. ECJ 01.10.2019, C-673/17, in particular para. 46 and 49).
The consent of the first complainant was, as stated, invalid and the subsequent data
processing was therefore unlawful. A more detailed examination of the other permissions
under Art. 6 para. 1 GDPR was therefore not necessary.
In this regard, reference is also made to the ED5A Guidelines 05/2020 para. 123 on consent,
according to which the controller cannot retroactively invoke another legal basis under Art.
6 GDPR. Due to the obligation to specify the legal basis on which the controller relies at the
time the personal data is collected, controllers must have decided which legal basis applies
prior to collection.
3.5.4. Result concerning the complaints of the second, third and
fourth complainants:
For the reasons stated under point 3.5, the data protection authority therefore rightly
found that the second, third and fourth complainants violated the principle of lawfulness
pursuant to Art. 5 para. 1 lit. a in conjunction with Art. 6 para. 1 GDPR and thus also violated
the first complainant's right to confidentiality pursuant to Section 1 (1) FADP by unlawfully
processing personal data of the first complainant when he visited the website in question on
August 12, 2021 (see point 1 of the contested decision).
Against this background, the data protection authority has also lawfully - subject to the
statements under point 3.6. - made use of its power to remedy under Art. 58 GDPR (see
statement under point 1.10; point 2. of the contested decision). The factual and legal
situation relevant for the Federal Administrative Court is determined - in the absence of any
other legal provision - by the time of the administrative court decision (see e.g. VwGH
24.03.2015, Ro 2014/09/0066). However, as can be seen from the statement under point
1.11., the cookie values (value) and browser data mentioned in point 1.6. were deleted.
Since the data had already been deleted at the time of the administrative court's decision,
point 2.) of the contested decision was to be deleted without replacement. The deletion
order was aimed at eliminating the existing results of the unlawful data processing (see
VwGH 14.12.2021, Ro 2021/04/0007, point 4.5.).
3.5.5. On the suggestion of a request for a preliminary ruling:
39 --
In various statements, the parties have suggested that the ECJ be asked to clarify specific
legal questions (regarding abusive behavior and the effectiveness of consent under data
protection law in the course of a "pay or okay" model).
First of all, it should be noted that the Federal Administrative Court is entitled, but not
obliged, to submit a request for a preliminary ruling to the CJEU (see Schima in
Jaeger/Stöger [eds], EUV/AEUV Art 267 TFEU Rz 84 and Rz 84/2 [as at 1.3.2020, rdb.at] with
reference to CJEU 05. 10. 2010, C-173/09, Elchinov, Rz 28 mwN).
With regard to the (here: denied) abusive conduct of the first complainant and his
representative put forward by the second, third and fourth complainants, it is recalled that
the existence of such conduct must be assessed on a case-by-case basis. The case law of the
ECJ cited by the second, third and fourth complainants (reference to ECJ 09.01.2025, C-
416/23 para. 56; ECJ 26.02.2019, C-116/16 and C-117/16 para.
97) does not. Following a case-by-case examination in the present case, the adjudicating
senate came to the conclusion that there was no abuse of rights on the part of the first
complainant and his legal representation, and reference is made to the comments in this
regard.
With regard to the question of the effectiveness of consent under data protection law in the
context of the "pay or okay" model of the second, third and fourth complainants, the Senate
relied in particular on the recitals of the GDPR, EDPB Guidelines 05/2020, EDPB Opinion
08/2024 and the statements of the CJEU in the judgment of 01.In this context, it is recalled
that the EDPB ensures the uniform application of the GDPR pursuant to Art. 70 para. 1 first
sentence GDPR (see in particular Art. 70 para. 1 lit. e GDPR). In addition, the present
decision is largely based on the lack of granularity of consent under data protection law,
which was not addressed in the parties' suggestions regarding a request for a preliminary
ruling, although the parties were aware that the data protection authority had already relied
on the lack of granularity in its decision and that this was already the central aspect in the
decision. The questions referred by the parties are therefore not relevant to the decision in
this case (see VwGH 10.12.2024, Ro 2021/04/0022 Rz 80 mwN).
3.6 Allowance of the first appellant's administrative complaint
842523- 5- 24/25
40
The first appellant's appeal against the decision is only directed against points of the decision
3. the decision in question, insofar as it concerns the rejection of the application for the
imposition of a processing ban.
If the data protection authority has rejected an application and an appeal is lodged against
this, the appeal proceedings before the administrative court only concern the question of
the legality of this rejection. The administrative court alone must examine whether the
content of the application was rightly refused (see, for example, VwGH 4.5.2023, Ra
2020/11/0227, mwN). With a merit-based decision on the application, however, the
administrative court exceeds the "matter" of the appeal proceedings (see VwGH
07.03.2024; Ra 2023/14/0456, mwN.).
In item 3 of the contested decision, the data protection authority rejected the application of
the first complainant and the reasoning in this regard only contains statements that cannot
be understood as a meritorious dispute with the complainant's submission on his application
to order the remedial measure of the processing ban. With this decision, the data protection
authority ruled on the inadmissibility of the first complainant's application for the
imposition of a processing ban due to the lack of a subjective right or the first complainant's
right to choose. On this basis, it cannot be said that the data protection authority merely
made an error of expression and wanted to or would have agreed on the content of the first
complainant's application. Rather, this decision undoubtedly expresses the will of the data
protection authority to make a substantive decision in the absence of a subjective right or a
power of choice of the first complainant with regard to a remedial measure pursuant to Art.
58 para. 2 GDPR concerning the processing ban requested by him, so that a reinterpretation
of this clear official will is not permissible.
In its decision, the data protection authority only very briefly explained why it did not
impose a processing ban. This could not be derived from the wording of Art. 58 para. 2 lit. f
GDPR, nor from the case law of the ECJ from 2020. The latter held that a supervisory
authority is obliged to take appropriate remedial measures in the event of an identified
breach. However, the specific selection of remedial powers is the responsibility of the
supervisory authority. However, if, according to the ECJ, the selection of remedial powers is
a matter for the supervisory authority, then conversely there can be no subjective legal claim
to the exercise of a completely conI'rete remedial power.
41
With regard to the (here only relevant) question of whether the data protection authority
was right to reject the first complainant's application, the following must be stated:
In summary, the first complainant counters the rejection of his application for the
imposition of a processing ban by the data protection authority by arguing that the decision
of the data protection authority regarding the order of deletion only offers inadequate legal
protection against possible future data processing in the circumstances of the specific case.
There is an imminent risk of repetition in this case. Even if a subjective claim to the
imposition of a processing ban is therefore denied, the data protection authority must
impose such a ban in the specific case.
These statements by the first complainant lead to the success of his complaint.
In its decision of 26.09.2024, C-768/21, the ECJ stated the following in excerpts:
"37 In this respect, it should be noted that the GDPR gives the supervisory authority
discretion as to how it remedies the identified inadequacy, as Art. 58 (2) GDPR gives the
supervisory authority the power to take various remedial measures. The Court of Justice
has already ruled that it is for the supervisory authority to choose the appropriate and
necessary means, taking into account the circumstances of the specific case, and that
it is obliged to exercise all due care in fulfilling its task of 'ensuring full compliance with
the GDPR' (see, to that effect, judgment of July 16, 2020, Facebook Ireland and Schrems,
C-311/18, EU:C.'2020:559, para. 112).
38 However, this discretion is limited by the need to ensure a consistent and high level
of protection of personal data through a clearly enforceable legal framework, as set out
in recitals 7 and 10 of the GDPR.
y...j
41 Thus, it cannot be inferred either from Article 58(2) GDPR or from Article 83 of
that regulation that the supervisory authority would be obliged to take a remedial
measure, in particular to impose a fine, in every case where it finds a personal data
breach, since its obligation in such circumstances is to react in an appropriate
manner to remedy the inadequacy found. Therefore, as the Advocate General
stated in point 81 of his Opinion, the complainant whose rights have been infringed has
no subjective right to have the supervisory authority impose a fine on the controller.
842523- 15- 22/25
42
42 On the other hand, the supervisory authority is obliged to intervene if the adoption of one
or more of the remedies provided for in Art. 58(2) GDPR is appropriate, necessary and
proportionate, taking into account all the circumstances of the specific case, to remedy
the inadequacy found and to ensure full compliance with this Regulation.
44 The interpretation that the supervisory authority is not always obliged to take a
corrective measure under Article 58(2) GDPR if it identifies a personal data breach is
confirmed by the objectives pursued by Article 58(2) and Article 83 of that regulation.
49 Since decisions of a supervisory authority 'on a complaint are subject to a full
review of their substance by a court (judgment of December 7, 2023, SCHUFA Holding
[Restschuldbefreiung], C-26/22 and C-64/22, EU.'C:2023:958, para. 70), it is for the
referring court to ascertain whether the HBDI dealt with the complaint in question
with all due care and, when adopting the decision at issue in the main proceedings, did
not exceed the limits of the discretion conferred on it by Article 58(2) GDPR. 58(2)
GDPR (see, by analogy, judgment of 7 December 2023, SCHUFA Holding
[Restschuldbefreiungj, C-26/22 and C-64/22, EU:C:2023:958, paragraphs 68 and 69 and
the case-law cited).
50 In the light of the foregoing, the answer to the question referred is that Article 57(1)(a)
and (f), Article 58(2) and Article 77(1) GDPR must be interpreted as meaning that,
where a personal data breach is established, the supervisory authority is not required
to take remedial action under Article 58(2), in particular to impose a fine, if such action
is not appropriate, necessary or proportionate to remedy the inadequacy found and to
ensure full compliance with that regulation."
It follows from this judgment of the ECJ (in line with the view of the data protection
authority) t h a t the granting of discretion to the supervisory authority does not express a
subjective right of the first complainant to a (specific) remedial measure pursuant to Art. 58
(2) GDPR by the supervisory authority.
Since Art. 58 para. 2 GDPR does not grant the first complainant, whose data protection
rights have been violated, a subjective right to a (specific) remedy, such as an order for a
processing ban pursuant to Art. 58 para. 2 lit. f GDPR, by the data protection authority, he is
also entitled to a right of application in this regard. An application (as in the present case)
that is nevertheless submitted would therefore - as the data protection authority correctly
43
recognized - would have to be rejected for lack of legitimacy to file an application (see again
VwGH 24.02.2022, Ra 2020/05/0231).
However, it follows from Art. 57(1)(a) and (f), Art. 58(2) and Art. 77(1) GDPR and the
judgments of the ECJ of 26/09/2024, C-768/21, and of 07/12/2023, C-26/22 and C-64/22,
that a request for a specific corrective measure by a person whose data protection rights
have been violated may not be rejected solely on the grounds of the lack of a subjective
right or or a right to choose) without a substantive examination - in line with the
aforementioned ECJ rulings - having been carried out as to whether the taking of a (further)
remedy provided for in Art. 58 (2) GDPR is suitable, necessary and proportionate, taking into
account all the circumstances of the specific case, in order to remedy the inadequacy
identified and to ensure full compliance with this Regulation, whereby the data protection
authority must deal with it with all due care and, when adopting its decision in this regard,
must comply with the limits of the discretion granted to it by Art. 58 (2) GDPR. According to
the ECJ in its ruling in case C-768/21, the data protection authority is only under no
obligation to take remedial action as a supervisory authority in the event of a breach of
personal data protection pursuant to Art. 58 para. 2 GDPR if such intervention is not
appropriate, necessary or proportionate to remedy the inadequacy identified and to ensure
full compliance with this regulation.
The supervisory authority is therefore obliged under the EU law provisions of Art. 57 (1) (a)
and (f), Art. 58 (2) and Art. 77 (1) GDPR to (already) carry out a substantive examination in
the sense described above when assessing (the admissibility of) a data protection complaint
or (as in the present case) a request for a specific remedial measure, which is then subject to
full substantive review by a court (cf. the ECJ's statements in Case C-768/21, para. 49,
according to which decisions of a supervisory authority on a complaint are subject to a full
substantive review by a court and it is up to the court to examine whether the supervisory
authority has dealt with the complaint in question with all due care and has complied with
the limits of the discretion granted to it by Art. 58 para. 2 GDPR when issuing the decision).
In the present case, the data protection authority did not make such a substantive
assessment in its decision on the first complainant's application in the sense of the Union
842523- 15- 23/25
44
in terms of the aforementioned Union law and the case law of the ECJ cited above, but
rejected it without making a decision on the merits. Although the data protection authority
took a remedial measure in accordance with Art. 58 GDPR by ordering the deletion of the
first complainant's personal data, it did not deal with the content of the measure requested
by the first complainant (and according to his statements, the only appropriate or effective
measure) of prohibiting the processing,
Against this background, it is in any case not possible to conclude that the data protection
authority dealt with the application in question and the requested processing ban with all
due care in accordance with the ECJ's requirements. The data protection authority ordered
a different measure, whereby it did not disclose the reasons why it considered the deletion
order to be more appropriate. However, the data protection authority would have had to
examine, in the sense of a substantive dispute, taking into account the arguments of the first
complainant, whether the deletion measure it ordered was sufficient to remedy the
violation of the case law of the ECJ, or whether
— as the first complainant points out - another (additional) measure is necessary, and had to
explain the result of its examination in a comprehensible manner in its decision. Thus, the
data protection authority did not exercise its discretion with regard to the question of
ordering a ban on processing in the context of the contested decision in question and, as a
result, refused to examine the content of the first complainant's application for a specific
remedial measure.
According to the above, however, such a refusal to examine the content on the grounds of
the non-existence of a subjeI'tive right is precluded by the Union law provisions of Art. 57
para. 1 lit. a and f, Art. 58 para. 2 and Art. 77 para. 1 GDPR. However, on the basis of the
current legal situation, these can only be complied with in such a way that such a
justification for the rejection of an application for the imposition of a specific corrective
measure - and thus to this extent also a rejection due to a lack of legitimacy of the
application or a subjective right (cf. point) above) - can be excluded.
— is refrained from (see, for example, on a subsequent application for international
protection VwGH 19.10.2021, Ro 2019/14/0006, see in particular para. 82).
The lack of substantive examination and exercise of discretion by the supervisory authority
cannot be remedied or made up for by the Federal Administrative Court in the present case
either, especially since, according to the settled case law of the Administrative Court, an
administrative court cannot rely on
45-
The Federal Administrative Court may only decide on the legality of the rejection decision
on the basis of a complaint lodged against a rejection, but not on the merits of the
application itself. There is therefore no room for the first complainant's request that the
Federal Administrative Court prohibit the co-participating party from processing the first
complainant's personal data when visiting the website in question without effective consent
pursuant to Art. 6 para. 1 lit. a GDPR in accordance with Art. 58 para. 2 lit. f GDPR.
It is noted that the files were combined for a joint decision in the oral hearing due to their
factual and legal connection pursuant to Section 39 para. 2 AVG in conjunction with Section
17 VwGVG.
An oral pronouncement at the end of the hearing was not possible due to the need to deal
more closely with the extensive new evidence presented at the hearing.
Re B) Decision on the admissibility of the appeal:
Admissibility of the appeal on points A) II. 1:
The appeal is admissible pursuant to Art. 133 para. 4 B-VG because the decision depends on
the resolution of a legal issue of fundamental importance.
To date, the Administrative Court has not dealt with the so-called granularity of consent
under data protection law in its case law. For example, the Supreme Court has not yet
clarified whether and under what more detailed conditions a single consent ("general
consent") can be effectively granted for several data processing or data processing
operations in order to meet the requirements of Art. 6 para. 1 lit. a GDPR. Which criteria are
decisive for the more detailed handling of the appropriateness mentioned in recital 43
("although this is appropriate in the individual case") is currently also unclear.
Furthermore, there are guidelines in the case law of the Administrative Court of Justice on the
basis of which criteria the purpose of data processing must be determined.
It is also currently unclear how the extremely brief statements of the ECJ in its ruling of
04.07.2023, C-252/21, para. 150 are to be understood.
842523- 15- 24/25
- 46 -The legal questions raised are of fundamental importance beyond the I'onI'reten individual
case, especially since a large number of other controllers rely on the facts of Art. 6 para. 1
lit. a GDPR for a wide variety of data processing operations and - as has been explained - the
substantive requirements regarding the effectiveness of consent under data protection law
in accordance with leg. cit. have not been clarified by the supreme court.
On the other points of the ruling:
The appeal is not admissible pursuant to Art. 133 para. 4 B-VG because the decision does
not depend on the resolution of a legal issue of fundamental importance. There are also no
other indications that the legal issue to be resolved is of fundamental importance.
R ech tsmi t e I be I ehr un g:
An appeal against this decision may be lodged with the Constitutional Court and/or an
ordinary appeal or, if an appeal is not allowed, an extraordinary appeal to the Administrative
Court within six weeks of notification. A lawyer is required to draft and submit a complaint
or an appeal.
Anyone who considers their rights to have been violated by the decision in a
constitutionally guaranteed right or due to the application of an unlawful general standard
is entitled to lodge a complaint with the Constitutional Court. An appeal is admissible if the
decision depends on the resolution of a legal issue of fundamental importance.
An appeal must be lodged with the Constitutional Court. An appeal must be lodged with the
Federal Administrative Court. Unless otherwise stipulated by law, a filing fee of € 340 is
payable.
If you are unable to cover the costs of proceedings before the Constitutional Court and/or
the Administrative Court without impairing the necessary maintenance and the intended
legal action or legal defense does not appear to be obviously wanton or futile, you must be
granted legal aid.
The application for legal aid must be submitted to the Federal Administrative Court within
six weeks of service of this decision in cases of ordinary appeal, and to the Constitutional
Court and/or Administrative Court in all other cases.
-47An appeal to the Constitutional Court and/or an appeal to the Administrative Court is no longer
admissible if it has been expressly waived after the pronouncement or service of the ruling or
decision. The waiver of the right to appeal to the Constitutional Court must be submitted to the
Federal Administrative Court until the copy of the decision or order is served, after is
served the
of the decision or order to the Constitutional Court in writing or to declare it for the record.
The waiver of the right of appeal must be notified to the Federal Administrative Court in
writing or declared for the record. If the waiver was not submitted by or in the presence of a
professional party representative, it may b e revoked in writing or for the record within three
days.
FEDERAL ADMINISTRATIVE COURT
Court Division W291, on 13.08.2025
842523