BVwG - W256 2227693-1
From GDPRhub
| BVwG - W256 2227693-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 4(4) GDPR Article 5(1)(a) GDPR Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 6(4) GDPR Article 7 GDPR Article 13 GDPR Article 17 GDPR Article 21 GDPR Article 22 GDPR Article 58 GDPR Article 58(2)(f) GDPR Article 133(4) B-VG |
| Decided: | 28.09.2023 |
| Published: | 18.10.2023 |
| Parties: | DSB (DPA) operator of a customer loyalty program (controller) |
| National Case Number/Name: | W256 2227693-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2023:W256.2227693.1.00 |
| Appeal from: | DSB (Austria) DSB-D213.895/0003-DSB/2019 |
| Appeal to: | Appealed - Confirmed VwGH (Austria) Ro 2023/04/0045 |
| Original Language(s): | German |
| Original Source: | RIS (in German) |
| Initial Contributor: | Marc-Michael Haupt |
A court held that the declaration of consent of the website and the flyer for profiling in a customer loyalty program did not comply with the requirements under Article 6(1)(f) GDPR, since data subjects were not expected to be aware of profiling.
English Summary
Facts
On 05.09.2019, the Austrian DPA (DSB) notified the controller of a customer loyalty program that they were initiating an ex officio investigation. The controller responded by answering the provided questionnaire and submitting further documents.
On 23.10.2019, the DPA ruled that the investigation was justified and that the declaration of consent for profiling using certain registration methods (website, app, partner company store, flyer) did not comply with the requirements of Article 4(11) GDPR and Article 7 GDPR, nor were they provided in an intelligible way. If a contract covers several aspects, the declaration of consent must be clearly distinguishable.
Regarding the website and flyer, the following was found:
The website says 'Enjoy your personal benefits' without providing clear information that 'personal benefits' involves profiling. In an embedded box, the relevant points were merely referred to. Information regarding profiling was only accessible by scrolling down further.
Concerning the flyer, the following information was provided under the signature field: 'This signature only applies to the declaration of consent and is voluntary. Your registration [...] is also valid without a signature.' Thus, it conveyed the impression that a signature was required to confirm the registration.
Consequently, the controller was required to amend the declaration and to cease using any obtained consents for the purpose of profiling prior to 01.05.2020.
The controller lodged a complaint. In addition to other information, the controller stated that the data processing was in accordance with Article 6(1)(a) GDPR, and that they had a legitimate interest under Article 6(1)(f) GDPR.
The DPA ruled a preliminary decision on the complaint, thereby changing the ruling that the website and flyer did not meet the requirements under Article 6(1)(a) GDPR, and thus, the processing of personal data, collected in that cases, was forbidden. The other methods ensured that the consent was clearly separated from the rest of the registration process.
The controller then filed a request for referral to the court, arguing that the DPA had exceeded their corrective powers by prohibiting the processing of the data. Furthermore, the data processing for profiling would be used to manage customer memberships under Article 6(1)(b) GDPR. Following their view, processing under Article 6(4) GDPR was applicable. Additionally, the controller denied the DPA's view that a violation of the principle of good faith would foreclose a weighing of interests under Article 6(1)(f) GDPR.
The court quashed the preliminary decision as the DPA had not examined the other grounds of justification for data processing under Article 6(1) GDPR in their initial decision.
The DPA then lodged an appeal to the Austrian Supreme Administrative Court (Verwaltungsgerichtshof), which overturned the court's ruling (VwGH 08.02.2022, Ro 2021/04/0033). It was the court's responsibility to examine the potential legal bases, rather than overturning the DPA's decision. Therefore, the case was returned to the court.
In the meantime, the controller complied with the preliminary decision by deleting the affected personal data in 2021 and changing their registration process in 2020.
Holding
First, the court found that they had to formally rule on whether the DPA's decision was lawful at the time it was ruled. It is not to be considered that the controller complied with the administrative decision and fulfilled the required steps (VwGH 28.04.2022, Ra 2022/06/0056).
Second, the court held that the controller did not comply with the transparency requirements regarding the layout of their declaration of consent under Article 7(2) GDPR in both cases (website, flyer).
Third, the court ruled that they could not agree with DPA's view, that an invalid declaration of consent always constitutes unlawful data processing and that a review of other grounds of justification would not be necessary (CLEU in 'Meta Platforms and Others' (C-252/21) ECLI:EU:C:2023:537). Further on, the Supreme Administrative Court ruled that both, the DPA and the court are required to examine the presence of other grounds (VwGH 08.02.2022, Ro 2021/04/0033).
Fourth, the court held that the controller could not base their appeal on Article 6(4) GDPR as the data processing did not satisfy the grounds of justification, nor were other grounds apparent.
Inter alia, following the CLEU's preliminary ruling in 'Meta Platforms and Others' (C-252/21) ECLI:EU:C:2023:537, three cumulative requirements must be met for data processing under Article 6(1)(f) GDPR: (1) The controller or a third party must have a legitimate interest, (2) which requires the processing of that personal data, (3) and 'the fundamental rights and freedoms of the data subject' must not outweigh those interests.
There were no doubts about the controller's legitimate interest in processing the personal data in question for targeted marketing purposes, as this was both necessary and reasonable. However, the data subject should have been notified about profiling. The wording 'only if the member consents' did not constitute such a notification, and therefore the data subjects were not to be expected that their personal data was used for profiling purposes. Furthermore, the controller explicitly excluded it in their general terms and conditions. Hence, the data subject's right to secrecy overrode the controller's legitimate interest.
In summary, the court dismissed the controller's complaint.
Last, the court held that an appeal to the Supreme Administrative Court was admissible under Article 133(4) B-VG, as no prevailing case law concerning the implementation of a declaration of consent existed. Hence, the decision relied on a legal question of fundamental importance.
Comment
On 29.09.2025, the Supreme Administrative Court rejected the appeal, since no legal question of fundamental importance was raised (VwGH 29.09.2025, Ro 2023/04/0045).
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Decision Date
September 28, 2023
Legal Norm
Federal Constitutional Law (B-VG) Art. 133 para. 4
GDPR Art. 13
GDPR Art. 17
GDPR Art. 21
GDPR Art. 22
GDPR Art. 4 no. 4
GDPR Art. 5 para. 1 lit. a
GDPR Art. 58
GDPR Art. 58 para. 2 lit. f
GDPR Art. 6 para. 1 lit. a
GDPR Art. 6 para. 1 lit. f
GDPR Art. 6 para. 4
GDPR Art. 7
Federal Constitutional Law (B-VG) Art. 133 today; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019 to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019, last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 133 valid from Article 133 of the Federal Constitutional Law (B-VG) valid from 25 May 2018 to 31 December 2018, last amended by Federal Law Gazette I No. 22/2018; Article 133 valid from 1 August 2014 to 24 May 2018, last amended by Federal Law Gazette I No. 164/2013; Article 133 valid from 1 January 2014 to 31 July 2014, last amended by Federal Law Gazette I No. 51/2012; Article 133 valid from 1 January 2004 to 31 December 2013, last amended by Federal Law Gazette I No. 100/2003; Article 133 valid from 1 January 1975 to 31 December 2003, last amended by Federal Law Gazette No. 444/1974 B-VG Art. 133 valid from December 25, 1946 to December 31, 1974, last amended by Federal Law Gazette No. 211/1946; B-VG Art. 133 valid from December 19, 1945 to December 24, 1946, last amended by State Law Gazette No. 4/1945; B-VG Art. 133 valid from January 3, 1930 to June 30, 1934
Judgment
W256 2227693-1/44E
IN THE NAME OF THE REPUBLIC!
The Federal Administrative Court, composed of Judge Caroline Kimm as presiding judge and lay judges Dr. Claudia Rosenmayr-Klemenz and Mag. Adriana Mandl, as assessors, on the appeal of XXXX GmbH, represented by CMS Reich-Rohrwig Hainz Rechtsanwälte GmbH, against the decision of the Data Protection Authority of October 23, 2019, file number: DSB-D213.895/0003-DSB/2019, based on the application for review by XXXX GmbH, after conducting an oral hearing, has ruled as follows: The Federal Administrative Court, composed of Judge Mag. Caroline Kimm as presiding judge and the expert lay judges Dr. Claudia Rosenmayr-Klemenz and Mag. Adriana Mandl, as assessors, ruled on the appeal of römisch 40 GmbH, represented by CMS Reich-Rohrwig Hainz Rechtsanwälte GmbH, against the decision of the Data Protection Authority of October 23, 2019, file number DSB-D213.895/0003-DSB/2019, based on the referral application of römisch 40 GmbH, after conducting an oral hearing, as follows:
A) The appeal is dismissed with the proviso that points 2 and 3 of the preliminary decision on the appeal shall read as follows:
"2) The automated processing of the participation and purchase data of those who participated in the "XXXX" event using the "website" method at www. 1) The automated processing of participation and purchase data of individuals registered with "Römer 40" using the website www.römer 40.at (version of October 23, 2019) and the registration brochure "Flyer" is prohibited for the purpose of creating profiles of their purchasing behavior.
2) The appellant is prohibited from implementing point 2 of the ruling within a period of six months from the date the decision becomes legally binding.
3) The appellant is granted a period of six months from the date the decision becomes legally binding to implement point 2. B) The appeal is admissible pursuant to Article 133, paragraph 4 of the Federal Constitutional Law (B-VG).
Text
Reasons for the Decision:
I. Procedural History:
By letter dated September 5, 2019, the respondent authority informed the appellant that it was initiating an ex officio review procedure against her and requested the appellant to answer a list of questions.
The appellant complied with this request by letters dated September 16, 2019, and October 7, 2019, simultaneously submitting various documents.
By decision dated October 23, 2019, file number DSB-D213.895/0003-DSB/2019 (hereinafter: initial decision), the respondent authority decided in The official review proceedings against the complainant are as follows:
"1. The official review proceedings were justified, and it is determined that the request for consent to the processing of personal data from the data subjects registered at "XXXX" for profiling purposes by XXXX GmbH, with the wording "1. The official review proceedings were justified, and it is determined that the request for consent to the processing of personal data from the data subjects registered at "40" for profiling purposes by XXXX GmbH, with the wording
"Declaration of Consent: I declare [...] that XXXX GmbH and the XXXX partners where I have used my XXXX card may (1) combine and analyze my participation and purchase data in order to send me relevant and personalized information about the XXXX program tailored to my interests and to adapt offers for collecting and redeeming XXXX to my needs (so-called "profiling" [...]), in order to (2) send me advertising with to send me personalized offers about products and services of the operator and the XXXX partners [...], and (3) that my personal data obtained in this way will be deleted upon revocation of my consent, at the latest after the end of my membership. [...].“ “Declaration of Consent: I declare [...] that römisch 40 GmbH and the römisch 40 partners with whom I have used my römisch 40 card may (1) combine and analyze my participation and purchase data in order to send me relevant and personalized information about the römisch 40 program tailored to my interests and to adapt offers for collecting and redeeming römisch 40 to my needs (so-called “profiling” [...]), in order to (2) send me advertising with personalized offers about products and services of the operator and the römisch 40 partners [...], and (3) that my personal data obtained in this way will be deleted upon revocation of my consent, at the latest after the end of my membership. [...].“
``` using the following methods:
i) Website www.XXXX.at
ii) XXXX App
ii) Roman 40 App
iii) XXXX in a partner branch
iii) Roman 40 in a partner branch
iv) Registration brochure (“flyer”)
does not comply with the requirements for consent pursuant to Article 4(11) GDPR and Article 7 GDPR, and therefore the processing of personal data of data subjects registered at “XXXX” for profiling purposes by XXXX GmbH is inadmissible due to the lack of valid consent.
Does not comply with the requirements for consent pursuant to Article 4(11) GDPR and Article 7 GDPR, and therefore the processing of personal data of data subjects registered at “XXXX” for profiling purposes by Roman 40 GmbH is inadmissible due to the lack of valid consent. 2. XXXX GmbH is ordered to amend the request for consent mentioned in point 1 within three months, failing which enforcement proceedings will be initiated, using the methods specified in point 1 i) to iv) in accordance with Article 4, point 11, and Article 7 of the GDPR. 2. Römische 40 GmbH is ordered to amend the request for consent mentioned in point 1 within three months, failing which enforcement proceedings will be initiated, using the methods specified in point 1 i) to iv) in accordance with Article 4, point 11, and Article 7 of the GDPR.
3. XXXX GmbH is prohibited from using the consents obtained pursuant to point 1 for profiling purposes from May 1, 2020. This does not apply if valid consent is obtained from the data subjects within the same period, in compliance with the requirements for consent pursuant to point 2. 3. The company Römer 40 GmbH is prohibited and ordered to cease using the consents obtained pursuant to point 1 for profiling purposes as of May 1, 2020. This does not apply if valid consent is obtained from the data subjects within the same period, in compliance with the requirements for consent pursuant to point 2.
Römer 40 GmbH is prohibited from using the consents obtained pursuant to point 1 for profiling purposes as of May 1, 2020. Legal basis: Art. 4 No. 4 and No. 11, Art. 5 para. 1 lit. a, Art. 6 para. 1 lit. a, Art. 7 para. 1 and para. 2, Art. 12 para. 1, Art. 13 para. 1 lit. c, Art. 57 para. 1 lit. a and lit. h, Art. 58 para. 1 lit. b and para. 2 lit. d and lit. f [...] GDPR [...] Legal basis: Article 4, point 4 and point 11, Article 5, paragraph 1, letter a, Article 6, paragraph 1, letter a, Article 7, paragraph 1 and paragraph 2, Article 12, paragraph 1, Article 13, paragraph 1, letter c, Article 57, paragraph 1, letters a and h, Article 58, paragraph 1, letter b and paragraph 2, Letters d and f, [...] GDPR [...]
The respondent authority noted, among other things, that the complainant operates XXXX. XXXX is a cross-company and cross-industry customer loyalty program. Various companies participate in it. The complainant, as the operator, concludes a contract with these companies. Customers who purchase products in the branches of participating partners can register as members of XXXX. Members can present their XXXX card with each purchase, which is scanned by the respective partner before payment. Members collect points within the customer loyalty program. These points can be used, among other things, to obtain discounts. In point 3 of its privacy policy, the complainant indicates that it processes member master data and purchase data as detailed below. In point 4.4. The privacy policy states under the heading “automation-supported processing and analysis (profiling for target group selection, [...])” that only if the member consents will the operator, as the sole controller, further use and analyze the member's master data and purchase data processed by the operator and its partners for the automated personalization of advertising and marketing measures, thereby obtaining new marketing profiling data.According to section 4.4.5, the legal basis for processing is consent pursuant to Art. 6 para. 1 lit. a GDPR. Section 4.4.6 states that consent is voluntary and can be withdrawn at any time. The respondent authority noted, among other things, that the complainant operates the "Roman 40" program. This "Roman 40" is a cross-company and cross-industry customer loyalty program. Various companies participate in it. The complainant, as the operator, concludes a contract with these companies. Customers who purchase products in the branches of participating partners can register as members of the "Roman 40." Members can present their "Roman 40" card with each purchase, which is scanned by the respective partner before payment. Members collect points within the customer loyalty program. These points can be used, among other things, to obtain discounts. In section 3 of its privacy policy, the complainant indicates that it processes member master data and purchase data as detailed therein. In section 4.4 of the privacy policy, under the heading "Automated Processing and Analysis (Profiling for Target Group Selection, [...])," it is stated that the operator, as the sole controller, will only use and analyze the member's master data and purchase data processed by the operator and its partners for the automated personalization of advertising and marketing measures, thereby generating new marketing profiling data, if the member consents. According to section 4.4.5, the legal basis for this processing is consent pursuant to Article 6, paragraph 1, letter a, of the GDPR. Section 4.4.6 states that consent is voluntary and can be withdrawn at any time.
Furthermore, the respondent authority determined that the consent for profiling in question, as described in section 4.4 of the privacy policy, is obtained using the methods outlined in points 1 i) to iv). Essentially, in all methods, albeit in different forms, the data subject is first informed of the privacy policy. Subsequently, with regard to the online versions, under the heading "Enjoy your personal benefits," the data subject is asked for their consent to the profiling described in section 4.4 of the privacy policy, as outlined in the ruling. The subject of the review is now whether this request for consent complies with the requirements stipulated in the GDPR. If this is denied, it must then be examined what impact this has on the permissibility of processing personal data for profiling purposes and whether, in the event of inadmissibility, a prohibition of data processing should be issued. The data protection authority has already ruled in a similar case that consent must comply with the requirements of Article 4(11) and Article 7 of the GDPR and, in particular, must be given in an intelligible form. The present consent does not meet these requirements in any of the four registration methods. Regarding the methods used here, namely the flyer and the website, the respondent authority stated that, when registering for XXXX using the website www.XXXX.at, the data subject initially receives no visible information in the section entitled "Enjoy your personal benefits" that "personal benefit" refers to the processing of personal data for profiling purposes. The box embedded in this section also initially only refers to the terms and conditions and the privacy policy ("I agree, in accordance with points 5.5 and 5.6 of the terms and conditions [as well as points 4.4 and 4.5 of the privacy policy], that…"). Only after scrolling down the box is the processing of personal data for profiling mentioned; the information on profiling is therefore not available in an "easily accessible" or "clear and concise" form. Furthermore, it should be noted that, based on general experience, a data subject would not associate the readily visible options "Yes" and "No," which merely refer generally to receiving or not receiving "exclusive benefits and promotions," with profiling. Therefore, this does not constitute "clear and simple language" and thus does not represent legally valid consent. The European legislator has established explicit requirements for a request for consent in Article 7 of the GDPR, which must be met in addition to and independently of the terms and conditions and the privacy policy. If a contract (such as the registration for XXXX in this case) addresses several aspects, the request for consent must be clearly distinguishable. Regarding the registration brochure ("flyer"), the registration form includes a "Signature" field at the end. Below the "Signature" field is the statement: "This signature applies only to the declaration of consent and is voluntary. Your registration for XXXX is also valid without a signature." The "declaration of consent" itself, however, is placed above the "signature" field. Based on this, it must be noted that the registration form generally refers to registration for XXXX. Since the "XXXX" field is located at the end of the registration form, the impression is given that it is the signature confirming registration for XXXX. However, common sense dictates that an average user registering for XXXX (and thus entering into a contract) would expect this to be a signature confirming registration – and not a declaration of consent to profiling under data protection law. The note placed below, stating that this signature only applies to the declaration of consent, does not alter this conclusion: Firstly, it is shifted to the left, so that it is located below the "date" field and not directly below the "signature" field. Furthermore, the respondent authority determined that the consent to profiling in question, according to point 4.4, is not valid. The data protection declaration is obtained through the methods described in point 1 i) to iv). Essentially, in all methods, albeit in different forms, the data subject is first informed of the data protection declaration and then, with regard to the online versions, under the heading "Enjoy your personal benefits," the data subject is asked for their consent to the profiling described in point 4.4 of the data protection declaration, as detailed in the ruling. The subject of the review is now whether this request for consent complies with the requirements stipulated in the GDPR. If this is denied, it must then be examined what impact this has on the permissibility of processing personal data for the purpose of profiling and whether, in the event of impermissibility, a prohibition of data processing should be issued. The data protection authority has already ruled in a similar case that consent must comply with the requirements of Article 4, point 11, and Article 7 of the GDPR and, in particular, must be given in an intelligible form. The present consent does not meet these requirements in any of the four registration methods. Regarding the methods used here, namely the flyer and the website, the respondent authority stated that, when registering for the Roman 40 program using the website www.romas40.at, the data subject initially receives no visible information under the section entitled "Enjoy your personal benefits" that "personal benefit" refers to the processing of personal data for profiling purposes. The box embedded in this section also initially only refers to the terms and conditions and the privacy policy ("I agree, in accordance with points 5.5 and 5.6 of the terms and conditions [as well as points 4.4 and 4.5 of the privacy policy], that…"). Only after scrolling down the box is the processing of personal data for profiling mentioned; the information on profiling is therefore not available in an "easily accessible" or "clear and concise" form. Furthermore, it should be noted that, based on general experience, a data subject would not associate the readily visible options "Yes" and "No," which merely refer generally to receiving or not receiving "exclusive benefits and promotions," with profiling. Therefore, this does not constitute "clear and simple language" and thus does not represent legally valid consent. The European legislator has established explicit requirements for a request for consent in Article 7 of the GDPR, which must be met in addition to and independently of the terms and conditions and the privacy policy. If a contract (such as the registration for Roman 40 in this case) addresses several aspects, the request for consent must be clearly distinguishable. Regarding the registration brochure ("flyer"), the registration form includes a "Signature" field at the end. Below the "Signature" field is the statement: "This signature applies only to the declaration of consent and is voluntary. Your registration for Roman 40 is also valid without a signature." The "declaration of consent" itself, however, is located above the "signature" field. Based on this, it must be noted that the registration form generally refers to registration for the Roman 40 service. Since the "Roman 40" field is located at the end of the registration form, it gives the impression that this is the signature confirming registration for the Roman 40 service. However, common sense dictates that an average user registering for the Roman 40 service (and thus entering into a contract) would expect this signature to confirm registration – and not to provide consent for data processing related to profiling. The note placed below, stating that this signature only applies to the declaration of consent, does not alter this conclusion: Firstly, it is shifted to the left, so that it is located below the "date" field and not directly below the "signature" field.
Consent cannot therefore be used as a legal basis pursuant to Article 6(1)(a) GDPR. The complainant never relied on legitimate interests within the meaning of Article 6(1)(f) GDPR as a legal basis for processing for profiling purposes, and it should be noted that such a balancing of interests would, in any case, be unfavorable to the controller. According to Recital 47, first sentence, GDPR, the “reasonable expectations” of the data subjects must be taken into account in such a balancing of interests, and an average user cannot expect to give “consent to profiling.” Finally, the Article 29 Working Party also points out in its guidelines that it is not permissible to retrospectively choose legitimate interests as the basis for justifying processing if problems have arisen with the validity of the consent. Controllers must instead decide in advance which legal basis is applicable to processing. Since neither consent pursuant to Article 6(1)(a) GDPR nor any other legal basis for the processing could be considered, the court found in point 1 that the processing of personal data of the person registered at “XXXX” for profiling purposes was unlawful due to the lack of valid consent. As a violation had thus been established and there was therefore no legal basis for the processing in question, the remedial measures in question had to be granted. However, the complainant was free to obtain new declarations of consent to ensure lawful data processing. Regarding point 3, the respondent authority stated that, pursuant to Article 58(2)(f) GDPR, it could impose “a temporary or permanent restriction of processing, including a prohibition” on the controller. Since, in the present case, there is no legal basis for processing the personal data of the data subjects participating in “XXXX” for the purpose of profiling, a corresponding prohibition had to be imposed on the controller. No other legal basis within the meaning of Article 6(1) GDPR is applicable. The prohibition imposed pursuant to Article 58(2)(f) GDPR relates only to processing for profiling based on those declarations of consent that have been obtained to date using the methods mentioned in point 1 (i) to (iv), and not to declarations of consent lawfully obtained in the future. The controller is therefore free to obtain lawful consent from the data subjects using a declaration of consent pursuant to point 2, which complies with the requirements of Article 4(11) GDPR and Article 7 GDPR, and to lawfully process their data for the purpose of profiling from now on. Therefore, consent cannot be used as a legal basis under Article 6(1)(a) GDPR. The complainant never relied on legitimate interests within the meaning of Article 6(1)(f) GDPR as a legal basis for processing for profiling purposes, and it should be noted that such a balancing of interests would, in any case, be unfavorable to the controller. According to Recital 47, first sentence, GDPR, the "reasonable expectations" of the data subjects must be taken into account in such a balancing of interests, and an average user cannot expect to give "consent to profiling." Finally, the Article 29 Working Party also points out in its guidelines that it is not permissible to retrospectively choose legitimate interests as the basis for justifying processing if problems have arisen with the validity of the consent. Controllers must instead decide in advance which legal basis is applicable to processing. Since neither consent under Article 6(1)(a) GDPR nor any other legal basis could serve as a basis for the processing, the court ruled in point 1 that the processing of personal data of the person registered at "Roman numeral 40" for profiling purposes was unlawful due to the lack of valid consent. As a violation had thus been established and there was therefore no legal basis for the processing in question, the remedial measures in question had to be granted. However, the complainant was free to obtain new declarations of consent to ensure lawful data processing. Regarding point 3, the respondent authority stated that, pursuant to Article 58(2)(f) GDPR, it could impose "a temporary or permanent restriction of processing, including a prohibition" on the controller. Since, in the present case, there is no legal basis for processing the personal data of the data subjects participating in "Roman 40" for the purpose of profiling, a corresponding prohibition had to be imposed on the controller. No other legal basis within the meaning of Article 6(1) GDPR is applicable. The prohibition imposed pursuant to Article 58(2)(f) GDPR applies only to processing for profiling based on consent declarations obtained to date using the methods mentioned in point 1 (i) to (iv), and not to consent declarations lawfully obtained in the future. The controller is therefore free to obtain lawful consent from the data subjects using a consent declaration as described in point 2, which complies with the requirements of Article 4(11) and Article 7 GDPR, and to lawfully process their data for profiling purposes from now on.
The controller is therefore free to obtain lawful consent from the data subjects using a consent declaration as described in point 2, which complies with the requirements of Article 4(11) and Article 7 GDPR, and to lawfully process their data for profiling purposes from now on.
The controller is free to obtain lawful consent from the data subjects using a consent declaration as described in point 2, which complies with the requirements of Article 4(11) and Article 7 GDPR, and to lawfully process their data for profiling purposes from now on. The appellant appealed this decision to the Federal Administrative Court. In her appeal, she stated – insofar as relevant here – that she operates a customer loyalty program based on the needs of Austrian citizens. The fact that 3.5 million members of XXXX use their cards over 800,000 times a day demonstrates the program's significant popularity. Any natural person aged 16 or older with their primary residence in the EEA/Switzerland can participate in XXXX. Participation entitles the holder to collect points (XXXX) at each partner company – depending on the purchase – and redeem them for benefits (discounts). Regardless of this right, participants have the option to consent to profiling and, in this case, will receive personalized information and offers. Consent to profiling can be revoked at any time. Customers of XXXX are asked during registration whether they consent to profiling. The method for obtaining consent varies depending on the type of registration. Registration can be completed online via the internet on the XXXX website, via a mobile app and tablet computer at the retail outlets of XXXX's partners, or by submitting a completed registration form, which is part of a registration brochure. For online registrations, the customer must decide whether or not to consent to profiling by clicking a box (either "yes" or "no"). For offline registrations, the customer must sign a consent form if they wish to consent to profiling. The respondent authority wrongly assumed that the consents obtained in the four registration processes were unlawful. The online registration processes are essentially structured the same way. The data subject must enter their personal information (name, address, date of birth, etc.). Furthermore, they are asked to 1) give their consent to the terms and conditions; 2) confirm that they have read and understood the privacy policy; 3) give a declaration regarding profiling ("yes" or "no"). The registration process cannot be completed without submitting the corresponding declarations. The purposes of data processing – including profiling – are already highlighted in bold in the Terms and Conditions. In particular, the word "profiling" is highlighted in bold several times. The purposes of data processing – such as profiling – are also highlighted in bold in the Privacy Policy. Regarding consent to the Terms and Conditions and confirmation of the Privacy Policy, the data subject must actively click a checkbox that is not pre-selected. In all three registration forms, the data subject has the opportunity to read the Terms and Conditions and the Privacy Policy in their entirety before submitting their declaration. For the declaration regarding profiling, the data subject has two alternative, non-pre-selected checkboxes available. The declaration of consent for profiling begins with a reference to specific provisions in the Terms and Conditions (sections 5.5 and 5.6) and the Privacy Policy (sections 4.4 and 4.5) and explicitly contains the word "profiling." As stated above, the Terms and Conditions and the Privacy Policy also explicitly contain this word in bold in the referenced provisions. The text placed directly next to the checkbox for consent to profiling reads: “YES, I consent to the processing of my data in accordance with the consent declaration below and would therefore like to benefit from exclusive advantages and promotions.” The text placed directly next to the checkbox for refusal of profiling reads: “NO, I do not consent to the processing of my data in accordance with the consent declaration below and would therefore not like to benefit from exclusive advantages and promotions.” When registering via the website, the declarations described above are not obtained screen by screen, but are obtained sequentially on a single screen.The individual can choose the order in which they submit their declarations. While the profiling consent form is located in a scroll box, an overview of the entered personal information and a reference to the submitted declarations can be found at the bottom of the screen, directly above the "Register now" button. The last line, in bold, reads "Profiling: Consent given" or "Profiling: Consent not given" if a corresponding declaration has been submitted. If no declaration has been submitted, the text reads: "Profiling: Please select an answer regarding profiling to continue with registration." Next to this is a pencil icon. Clicking this icon automatically scrolls the user directly to the consent form. Registration can only be completed (by clicking the "Register now" button) after a declaration ("yes" or "no") regarding profiling has been submitted. The following information is immediately apparent to the data subject in connection with the declaration of consent (without having to scroll): “In accordance with points 5.5 and 5.6 of the General Terms and Conditions (as well as points 4.4 and 4.5 of the Privacy Policy), I agree that XXXX GmbH and the XXXX, where I have used my XXXX card, may (l) combine and analyze my participation and purchase data in order to provide me with relevant offers tailored to my interests.” This information makes it immediately clear to the data subject that their participation and purchase data will be combined and analyzed based on their consent to profiling. Furthermore, it should be emphasized that registration via the website is optimized for display on mobile phones compared to display on a conventional computer (web version). The respondent authority failed to establish that the display of the last line of the registration process when registering on the website depends on the version used (web version (PC) / mobile version (mobile phone)). In the mobile version predominantly used by the data subjects, the "Register now" button is placed even closer to the last line, "Profiling: Consent given" or "Profiling: Consent not given," thus drawing the data subject's attention even more intensely to the granted or denied consent to profiling. This finding is relevant because the respondent authority bases its legal assessment of the invalidity of the consent declaration on the fact that an average consumer pays attention to the reference to "exclusive benefits and promotions" and not to the last line of the registration process. Furthermore, the respondent authority overlooks the fact that directly next to the checkboxes ("Yes" "No") for profiling, there is an explicit reference to the "consent declaration below," which explicitly states the purpose of the processing. This information is located directly below the reference and is concise and to the point. It is therefore immediately clear to the data subject which data processing activities, namely the merging and analysis of participation and purchase data, would take place based on the consent. The authority's view that the text "Exclusive Benefits and Promotions" was emphasized and the information on "profiling" was treated as secondary is therefore incorrect. Even in the context of physical registration via flyer, the registration form contains several clear references to profiling, particularly in the terms and conditions printed in full. The request for consent is made on the last page of the registration brochure. This page contains three main sections: Terms and Conditions, Data Privacy Statement, and Declaration of Consent. By completing and submitting the registration form, the participant agrees to the terms and conditions. The declaration of consent consists of the clearly visible word "Declaration of Consent," followed by the text of the consent. Below the declaration of consent is a mandatory field for the date, marked with an asterisk. To the right of this is the optional "Signature" field. Directly below this field is the text stating that the signature applies only to the declaration of consent and is voluntary, and that registration for XXXX is valid even without a signature. Even considering this information, the respondent authority's assertion that the customer assumes the signature is for registration cannot be accepted. Furthermore, the signature field is not marked with an asterisk. Had the respondent authority made complete findings in accordance with the documents, it would have concluded in its legal assessment that the consents obtained in the online registration processes and regarding the flyer met the requirements of Article 4(11) in conjunction with Article 7 GDPR. Moreover, the legal basis for processing is not only consent pursuant to Article 6(1)(a) GDPR, but also the appellant's legitimate interest pursuant to Article 6(1)(f) GDPR. The merging of various data and selection criteria with the aim of aligning advertising measures as closely as possible with the actual interests of the data subjects serves the legitimate interests of both parties. In this way, the data subject is not bothered with unnecessary advertising. Furthermore, the data processing could also be based on Article 6(4) GDPR and the possibility of further processing. The reasoning behind the decision relied solely on the examination of the legal basis of consent. Other legal bases were not examined. The respondent authority failed to consider the interests of the appellant and those of the data subjects in any way, nor did it make any findings in this regard. Finally, the respondent authority also set the performance deadlines stipulated in points 2 and 3 of the decision too short, and this was not explained in any detail. As proof that the deadline was too short, the appellant requested the examination of two witnesses in an oral hearing. The appellant appealed this decision to the Federal Administrative Court. In her appeal, she stated – insofar as relevant here – that she operates a customer loyalty program based on the needs of Austrian citizens. The 3.5 million members of the Roman 40 program, who use their cards over 800,000 times a day, demonstrate the program's strong appeal. Any individual aged 16 or older with their primary residence in the EEA/Switzerland can participate in the Roman 40 program. Participation grants the right to collect points (Roman 40) at each partner company, depending on the amount spent, and redeem them for benefits (discounts). Regardless of this right, participants have the option to consent to profiling, in which case they will receive personalized information and offers. Consent to profiling can be withdrawn at any time. Roman 40 customers are asked during registration whether they consent to profiling. The method for obtaining this consent varies depending on the registration method. Registration can be completed online via the website of the Roman 40, via a mobile app and tablet computer at the retail outlets of the Roman 40 partners, or by submitting a completed registration form, which is part of a registration brochure. For online registrations, the customer must decide whether or not to consent to profiling by clicking a box (either "yes" or "no"). For offline registrations, the customer must sign a consent form if they wish to consent to profiling. The authority in question wrongly assumed that the consents obtained in the four registration processes were unlawful. The online registration processes are essentially structured the same way. The data subject must enter their personal information (name, address, date of birth, etc.). Furthermore, they are asked to: 1) agree to the terms and conditions; 2) confirm that they have read and understood the privacy policy; 3) declare their consent to profiling ("yes" or "no"). The registration process cannot be completed without submitting the corresponding declarations. The purposes of data processing – including profiling – are already highlighted in bold in the Terms and Conditions. In particular, the word "profiling" is highlighted in bold several times. The purposes of data processing – such as profiling – are also highlighted in bold in the Privacy Policy. Regarding consent to the Terms and Conditions and confirmation of the Privacy Policy, the data subject must actively click a checkbox that is not pre-selected. In all three registration forms, the data subject has the opportunity to read the Terms and Conditions and the Privacy Policy in their entirety before submitting their declaration. For the declaration regarding profiling, the data subject has two alternative, non-pre-selected checkboxes available. The declaration of consent for profiling begins with a reference to specific provisions in the Terms and Conditions (sections 5.5 and 5.6) and the Privacy Policy (sections 4.4 and 4.5) and explicitly contains the word "profiling." As stated above, the Terms and Conditions and the Privacy Policy also explicitly contain this word in bold in the referenced provisions. The text placed directly next to the checkbox for consent to profiling reads: “YES, I consent to the processing of my data in accordance with the consent declaration below and would therefore like to benefit from exclusive advantages and promotions.” The text placed directly next to the checkbox for refusal of profiling reads: “NO, I do not consent to the processing of my data in accordance with the consent declaration below and would therefore not like to benefit from exclusive advantages and promotions.” When registering via the website, the declarations described above are not obtained screen by screen, but are obtained sequentially on a single screen.The individual can choose the order in which they submit their declarations. While the profiling consent form is located in a scroll box, an overview of the entered personal information and a reference to the submitted declarations can be found at the bottom of the screen, directly above the "Register now" button. The last line, in bold, reads "Profiling: Consent given" or "Profiling: Consent not given" if a corresponding declaration has been submitted. If no declaration has been submitted, the text reads: "Profiling: Please select an answer regarding profiling to continue with registration." Next to this is a pencil icon. Clicking this icon automatically scrolls the user directly to the consent form. Registration can only be completed (by clicking the "Register now" button) after a declaration ("yes" or "no") regarding profiling has been submitted. The following information is immediately apparent to the data subject in connection with the declaration of consent (without having to scroll): “In accordance with points 5.5 and 5.6 of the General Terms and Conditions (as well as points 4.4 and 4.5 of the Privacy Policy), I agree that römisch 40 GmbH and the businesses where I have used my römisch 40 card may (l) combine and analyze my participation and purchase data in order to provide me with relevant offers tailored to my interests.” This information makes it immediately clear to the data subject that their participation and purchase data will be combined and analyzed based on their consent to profiling. Furthermore, it should be emphasized that registration via the website is optimized for display on mobile phones compared to display on a conventional computer (web version). The respondent authority failed to establish that the display of the last line of the registration process when registering on the website depends on the version used (web version (PC) / mobile version (mobile phone)). In the mobile version predominantly used by the data subjects, the "Register now" button is placed even closer to the last line, "Profiling: Consent given" or "Profiling: Consent not given," thus drawing the data subject's attention even more intensely to the granted or denied consent to profiling. This finding is relevant because the respondent authority bases its legal assessment of the invalidity of the consent declaration on the fact that an average consumer pays attention to the reference to "exclusive benefits and promotions" and not to the last line of the registration process. Furthermore, the respondent authority overlooks the fact that directly next to the checkboxes ("Yes" "No") for profiling, there is an explicit reference to the "consent declaration below," which explicitly states the purpose of the processing. This information is located directly below the reference and is concise and to the point. It is therefore immediately clear to the data subject which data processing activities, namely the merging and analysis of participation and purchase data, would take place based on the consent. The authority's view that the text "Exclusive Benefits and Promotions" was emphasized and the information on "profiling" was treated as secondary is therefore incorrect. Even in the case of physical registration via flyer, the registration form contains several clear references to profiling, particularly in the terms and conditions, which are printed in full. The request for consent is made on the last page of the registration brochure. This page contains three main sections: Terms and Conditions, Data Privacy Statement, and Declaration of Consent. By completing and submitting the registration form, the participant agrees to the terms and conditions. The declaration of consent consists of the clearly visible word "Declaration of Consent," followed by the text of the consent. Below the declaration of consent is a mandatory field for the date, marked with an asterisk. To the right of this is the optional "Signature" field. Directly below this field is the text stating that the signature applies only to the declaration of consent and is voluntary, and that registration for Roman 40 is also valid without a signature. Even considering this information, the respondent authority's assertion that the customer assumes the signature is for registration cannot be accepted. Furthermore, the signature field is not marked with an asterisk. Had the respondent authority made complete findings in accordance with the documents, it would have concluded in its legal assessment that the consents obtained in the online registration processes and regarding the flyer comply with the requirements of Article 4, point 11, in conjunction with Article 7 of the GDPR. Moreover, the legal basis for processing is not only consent under Article 6, paragraph 1, letter a, of the GDPR, but also the appellant's legitimate interest under Article 6, paragraph 1, letter f, of the GDPR. The merging of various data and selection criteria with the aim of aligning advertising measures as closely as possible with the actual interests of the data subjects serves the legitimate interests of both parties. In this way, the data subject is not bothered with unnecessary advertising. Furthermore, the data processing could also be based on Article 6, paragraph 4, of the GDPR and the possibility of further processing. The reasoning behind the decision relies solely on the examination of the legal basis of consent. Other legal bases were not considered. The respondent authority failed to address the interests of the appellant and those of the data subjects in any way, nor did it make any findings in this regard. Finally, the respondent authority also set the performance deadlines stipulated in points 2 and 3 of the decision too short, and this is not explained in any detail. As proof that the deadline was too short, the examination of two witnesses in an oral hearing is requested.
The respondent authority failed to consider the interests of the appellant and the data subjects in any way, nor did it make any findings in this regard. In its preliminary decision on the appeal dated December 11, 2019, file number DSB-D062.297/0001-DSB/2019, the respondent authority partially upheld the appellant's appeal and amended the ruling to read as follows:
"1. The official review was justified, and it is determined that
a) the request for consent to the processing of personal data of the data subjects registered at "XXXX" for profiling purposes by the appellant, worded as follows: [...]
using the methods i) website XXXX and ii) registration brochure ("flyer"), does not meet the requirements for consent pursuant to Article 4(11) GDPR and Article 7 GDPR, and that using the methods i) website 40 and ii) registration brochure ("flyer"), the appellant's request for consent to the processing of personal data of the data subjects registered at "[R] 40" for profiling purposes does not meet the requirements for consent pursuant to Article 4(11) GDPR and Article 7 GDPR." ii) The registration brochure (“flyer”) does not comply with the requirements for consent pursuant to Article 4(11) and Article 7 of the GDPR, and that
b) for the processing of personal data of the data subjects registered at XXXX for profiling purposes by XXXX GmbH, in addition to the consent obtained using the methods i) website XXXX and ii) registration brochure (“flyer”), no other legal basis under Article 6 of the GDPR applies, and the processing has therefore been unlawful. b) for the processing of personal data of the data subjects registered at 40 for profiling purposes by 40 GmbH, in addition to the consent obtained using the methods i) website 40 and ii) registration brochure (“flyer”), no other legal basis under Article 6 of the GDPR applies, and the processing has therefore been unlawful.
`` ] ... 2) XXXX GmbH is prohibited from processing the personal data of the data subjects registered at “XXXX” for profiling purposes to the extent specified in point 1. 2) römisch 40 GmbH is prohibited from processing the personal data of the data subjects registered at “roman 40” for profiling purposes to the extent specified in point 1.
3) The complainant is granted a period of six months to implement point 2.
Legal basis: [...] Art. 4, points 4 and 11, Art. 5, paragraph 1, letter a. Article 6(1)(a), Article 7, Article 12(1), Article 13(1)(c), Article 57(1)(a), (d) and (h), Article 58(1)(b) and (d) and (2)(d) and (f) [..] GDPR [..]“Legal bases: [..] Article 4, point 4 and point 11, Article 5, paragraph 1, point a, Article 6, paragraph 1, point a, Article 7, Article 12, paragraph 1, Article 13, paragraph 1, point c, Article 57, paragraph 1, points a, points d and h, Article 58, paragraph 1, points b and d, and paragraph 2, points d and f, [..] GDPR [...]
The respondent authority explained that the complaint showed that the registration process for the methods "XXXX App" and "XXXX" was a screen-by-screen registration process, thus ensuring that the request for consent was clearly distinct from the rest of the registration process.This means that the data subject's full attention is focused on the current registration step. Therefore, a sufficient level of transparency and thus sufficient consent can be assumed, which is why the ruling had to be adjusted accordingly. However, as already stated in the initial decision, consent obtained via the website and flyer methods still does not meet the requirements for transparent and clearly visible consent, and therefore cannot be used as a valid legal basis for processing pursuant to Article 6(1)(a) GDPR. The complainant has relied solely on this legal basis throughout the entire proceedings, which is why other legal bases, now being invoked for the first time by the complainant, cannot even be considered. The GDPR is designed in such a way that the supervisory authority must review the processing operations based on the record of processing activities, and the complainant cites consent as the sole legal basis for the processing in question. Apart from that, it is not the task of the supervisory authority under Article 57 GDPR to invoke an alternative legal basis for processing for a controller, nor is such a task even within the authority of a supervisory authority. Rather, it is the responsibility of the controller to demonstrate compliance with the principles of the GDPR, as made clear in Article 5(2) GDPR. However, even if the complainant's arguments were accepted, it should be noted that a balancing of interests would be unfavorable to the complainant, and further processing would be inadmissible. The Article 29 Working Party explicitly points out that it is not permissible to retrospectively invoke legitimate interests as the basis for justifying processing if problems arise with the validity of consent. The controller must decide in advance on which legal basis they base their processing. The complainant based their entire concept for processing personal data on the legal basis of consent and did not refer to additional legal bases or further processing under Article 6(4) GDPR. The legal basis of Article 6(1)(f) GDPR and Article 6(4) GDPR is therefore not applicable because it would contradict the principles of good faith and transparency for a controller to subsequently rely on another legal basis after consent has proven invalid. Apart from these (already sufficient) reasons, a balancing of interests would also not favor the complainant. The complainant processes numerous data points, specifically the time period, date, time, and location (including address), as well as the specific products, purchase amounts, and payment methods used. As the complainant itself states, it uses all this data to create automated profiles of the data subjects for processing and analysis. These profiles indicate which products the data subject purchases from which partner company and the likelihood of future purchases. Moreover, the complainant collects further information – as can also be seen from a sample disclosure submitted by the complainant – including information on the date, time, operating system, browser, and geolocation (including X and Y coordinates) on which a data subject opened (or did not open) specific electronic advertising. The respondent authority is of the opinion that, based on this data and the profiling carried out, a precise picture of the economic and social situation as well as a precise picture of the location whereabouts of the respective data subject is created, and that this cannot, in any case, be considered a harmless intrusion into privacy. However, the respondent authority does not find a violation of Article 22 GDPR, nor does it believe that such a violation exists. Article 6(4) GDPR does not constitute an independent legal basis, but rather requires a valid legal basis under paragraph 1 GDPR. Since the legal basis invoked under paragraph 1 already fails, further processing for other purposes is also not possible. Since, in the present case, there is no legal basis for the processing in question under Article 6(4) GDPR, a corresponding prohibition must be imposed. However, point 2 of the contested decision, namely the instruction to amend the declarations of consent, must be set aside accordingly: The respondent authority agrees with the appellant's view that it must be free to either completely refrain from profiling or to base the profiling on a different legal basis from now on. The prohibition is not to be implemented immediately; rather, given the amount of data processed, the technical and organizational effort, and the complexity of the matter, a period of six months must be granted. In its reasoning, the respondent authority stated that the appellant's submissions show that the registration process for the methods "Roman 40 App" and "Roman 40" is a screen-by-screen registration process, thus ensuring that the request for consent is clearly distinct from the rest of the registration process. This means that the data subject's full attention is focused on the current registration step. Therefore, a sufficient level of transparency and thus sufficient consent can be assumed, which is why the ruling had to be adjusted accordingly. However, as already stated in the initial decision, consent obtained via the website and flyer methods still does not meet the requirements for transparent and clearly visible consent, and therefore cannot be used as a valid legal basis for processing pursuant to Article 6(1)(a) of the GDPR. The complainant has relied solely on this legal basis throughout the entire proceedings, which is why other legal bases, now being invoked for the first time by the complainant, cannot even be considered. The GDPR is designed in such a way that the supervisory authority must review the processing operations based on the record of processing activities, and the complainant cites consent as the sole legal basis for the processing in question. Apart from that, it is not the task of the supervisory authority under Article 57 GDPR to invoke an alternative legal basis for processing for a controller, nor is such a task even within the authority of a supervisory authority. Rather, it is the responsibility of the controller to demonstrate compliance with the principles of the GDPR, as Article 5(2) GDPR makes clear. However, even if the complainant's arguments were accepted, it should be noted that a balancing of interests would be unfavorable to the complainant, and further processing would be inadmissible. The Article 29 Working Party explicitly points out that it is not permissible to retrospectively choose legitimate interests as the basis for justifying processing if problems arise with the validity of consent. The controller must decide in advance on which legal basis they base their processing. The complainant based their entire concept for processing personal data on the legal basis of consent and did not refer to additional legal bases or further processing under Article 6(4) GDPR. The legal basis of Article 6(1)(f) and Article 6(4) of the GDPR is therefore not applicable because it would contradict the principles of good faith and transparency for a controller to subsequently rely on another legal basis after consent has proven invalid. Apart from these (already sufficient) reasons, a balancing of interests would also not favor the complainant. The complainant processes numerous data points, specifically the time period, date, time, and location (including address), as well as the specific products, purchase amounts, and payment methods used. As the complainant itself states, it uses all this data to create automated profiles of the data subjects for processing and analysis. These profiles indicate which products the data subject purchases from which partner companies and the likelihood of future purchases. Moreover, the complainant collects further information – as can also be seen from a sample disclosure submitted by the complainant – including information on the date, time, operating system, browser, and geolocation (including the Roman numeral and Y coordinates) on which a data subject opened (or did not open) specific electronic advertising. The respondent authority is of the opinion that, based on this data and the profiling carried out, a precise picture of the economic and social situation as well as a precise picture of the geographical whereabouts of the respective data subject is created, and that this cannot, in any case, be considered a harmless intrusion into privacy. However, the respondent authority does not find a violation of Article 22 GDPR, nor does it believe that such a violation is even possible. Article 6, paragraph 4, GDPR does not constitute an independent legal basis, but rather requires a valid legal basis under paragraph 1, GDPR. Since the legal basis invoked under paragraph 1 already fails, further processing for other purposes is also not possible. Since, in the present case, there is no legal basis for the processing in question under Article 6(4) GDPR, a corresponding prohibition must be imposed. However, point 2 of the contested decision, namely the instruction to amend the declarations of consent, must be set aside accordingly: The respondent authority agrees with the appellant's view that it must be free to either completely refrain from profiling or to base the profiling on a different legal basis from now on. The prohibition is not to be implemented immediately; rather, given the amount of data processed, the technical and organizational effort, and the complexity of the matter, a period of six months must be granted.
By letter dated December 27, 2019, the complainant submitted a request for a preliminary ruling. In it, the complainant argued—insofar as relevant here—that the respondent authority had amended the operative part of the contested decision and thereby exceeded its powers of review. The preliminary decision on the appeal, concerning the finding that no other legal basis under Article 6 GDPR existed for processing for profiling purposes, went beyond the scope of the appeal proceedings. Likewise, the prohibition of data processing in point 2 of the preliminary decision on the appeal was not part of the operative part of the original decision. While a prohibition had been ordered there, it referred to the declarations of consent. The prohibition of data processing thus constituted a new instruction. The respondent authority had therefore also exceeded its powers of review in this respect. Moreover, the consents obtained were—as already stated in the appeal—legally valid. Furthermore, the respondent authority's assertion of the "blocking effect" of the consent could not be accepted for further reasons. A legal basis for processing does not cease to exist simply because consent is additionally obtained. Furthermore, the respondent authority overlooks the fact that, according to points 4.1 and 4.2 of the privacy policy, the participation and purchase data used for profiling are processed on the legal basis of Article 6(1)(b) GDPR (performance of a contract) for managing membership and processing the customer loyalty program. Contrary to the respondent authority's view, Article 6(4) GDPR is therefore indeed applicable to the further processing of this data. The respondent authority's view that a violation of the principle of good faith precludes a balancing of interests under Article 6(1)(f) GDPR from the outset is also untenable. Regarding the now-extended performance period in point 3 of the ruling, it should be noted that the respondent authority did not specify when the period began. Therefore, if an instruction is issued at all, its commencement, in addition to the performance period, must be set as the date the decision becomes legally binding. By letter dated December 27, 2019, the appellant submitted a request for a preliminary ruling. In it, the appellant argued – insofar as relevant here – that the respondent authority had amended the operative part of the contested decision and thus exceeded its power of review. The preliminary decision on the appeal, concerning the finding that no other legal basis under Article 6 GDPR was applicable for processing for profiling purposes, went beyond the scope of the appeal proceedings. Likewise, the prohibition of data processing in point 2 of the preliminary decision on the appeal was not part of the operative part of the original decision. While a prohibition had been ordered there, it referred to the declarations of consent. The prohibition of data processing thus constituted a new instruction. The respondent authority had also exceeded its power of review in this respect. Moreover, the consents obtained – as already stated in the appeal – were legally valid. However, the "blocking effect" of consent, as argued by the respondent authority, cannot be accepted for further reasons. A legal basis for processing does not cease to exist simply because consent is obtained in addition. Ultimately, the respondent authority also overlooks the fact that, according to points 4.1 and 4.2 of the privacy policy, the participation and purchase data used for profiling are processed on the legal basis of Article 6(1)(b) GDPR (performance of a contract) for managing membership and processing the customer loyalty program. Contrary to the respondent authority's view, Article 6(4) GDPR is therefore indeed applicable to the further processing of this data. Furthermore, the respondent authority's view that a violation of the principle of good faith precludes a balancing of interests under Article 6(1)(f) GDPR from the outset cannot be accepted. With regard to the now extended performance deadline in point 3 of the ruling, it should be noted that the respondent authority did not specify when the deadline would begin. Therefore, if an instruction is issued at all, its commencement, namely the date the decision becomes legally binding, must be specified in addition to the performance deadline itself.
In its ruling of August 31, 2021, file number W256 2227693-1/10E, the Federal Administrative Court upheld the appellant's appeal and set aside the preliminary decision on the appeal in its entirety without substitution. The respondent authority had limited the scope of its review in its initial decision solely to the verification of the declarations of consent as the legal basis for the data processing at issue. No review of other legal bases potentially applicable under Article 6 GDPR had taken place. This was also clearly not the subject of the review and investigation conducted ex officio. In issuing its decision, the respondent authority invoked its powers under Article 58(2)(d) and (f) GDPR. These remedial powers would each require a (established) violation of the GDPR. However, the authority in question failed to recognize that the assessment of the lawfulness of data processing is its sole responsibility and that it is not bound by any claim to legality on the part of the controller in this assessment. The principle of lawfulness, which governs the authorization or obligation to process data, is not necessarily linked to the principles of transparency and fair dealing, which govern the manner of processing. A different interpretation would mean that every violation of the manner of processing would render the data processing unlawful, and that even in the case of authorized or even potentially mandatory data processing, erasure would be mandatory. However, such an unconditional obligation to erase data cannot be derived from the GDPR. Moreover, it is clear from the wording of Article 6(1) GDPR that the lawfulness of data processing can be based not only on one, but potentially on several equally valid legal bases. The assertion by the respondent authority that, in the case of invalid consent, recourse to other legal bases for processing under Article 6 GDPR is generally precluded if the data subject has not been informed beforehand, cannot be inferred from the guidelines of the Article 29 Working Party. Rather, those guidelines pertain to the situation of withdrawing consent. Recital 47 of the GDPR also does not suggest that the absence of consent renders any balancing of interests with the controller's potential legitimate interests in the processing unnecessary. Therefore, the respondent authority's view that an invalid consent, in conjunction with a lack of information to the data subject about other legal bases, inevitably leads to unlawful data processing and makes a review of other possible legal bases superfluous, cannot be accepted. Focusing solely on the legal basis of consent cannot, in itself, establish a violation of the principle of lawfulness and thus cannot justify a remedy based on that principle. The preliminary decision on the appeal should therefore be set aside in its entirety. In its ruling of August 31, 2021, file number W256 2227693-1/10E, the Federal Administrative Court upheld the appellant's appeal and set aside the preliminary decision in its entirety without substitution. The respondent authority had limited the scope of its review in its initial decision solely to the verification of the declarations of consent as the legal basis for the data processing at issue. No examination of other legal bases potentially applicable under Article 6 of the GDPR had taken place. This was also clearly not the subject of the review and investigation procedure conducted ex officio. In issuing its decision, the respondent authority invoked its powers under Article 58(2), letters d and f of the GDPR. These powers of redress each require that a (established) violation of the GDPR has occurred. The authority in question, however, failed to recognize that the assessment of the lawfulness of data processing is its sole responsibility and that it is not bound by any legal entitlement of the data controller in this assessment. The principle of lawfulness, which governs the authorization or obligation to process data, is not necessarily linked to the principles of transparency and fair dealing, which govern the manner of processing. A different interpretation would mean that any violation of the manner of processing would render the data processing unlawful, and that even in the case of authorized or even potentially mandatory data processing, deletion would be mandatory. Such an unconditional obligation to delete data cannot be derived from the GDPR. Moreover, it is clear from the wording of Article 6(1) of the GDPR that the lawfulness of data processing can be based not only on one, but potentially on several equally valid legal bases. The assertion by the respondent authority that, in the case of invalid consent, recourse to other legal bases for processing under Article 6 of the GDPR is generally precluded if the data subject has not been informed beforehand, cannot be inferred from the guidelines of the Article 29 Working Party. Rather, those guidelines refer to the situation of withdrawing consent. Recital 47 of the GDPR also does not suggest that the absence of consent renders any balancing of interests with the controller's potential legitimate interests in the processing unnecessary. Therefore, the respondent authority's view that an invalid declaration of consent, in conjunction with a lack of information to the data subject about other legal bases, inevitably leads to unlawful data processing and makes a review of other possible legal bases superfluous, cannot be accepted. Focusing solely on the legal basis of consent cannot, in itself, establish a violation of the principle of lawfulness and thus cannot justify a remedy based on that principle. The preliminary decision on the appeal should therefore be overturned without replacement.
The respondent authority filed an official appeal with the Administrative Court, which overturned the decision of the Federal Administrative Court of August 31, 2021, file number W256 2227693-1/10E, insofar as it had quashed points 2 and 3 of the preliminary decision on the appeal without substitution, due to the illegality of their content. However, the appeal was dismissed as unfounded with regard to the quashing of point 1 of the preliminary decision on the appeal. In its reasoning, the Administrative Court held – insofar as relevant here with regard to points 2 and 3 of the preliminary decision on the appeal – that the relevant content of point 2 of the preliminary decision on the appeal was the prohibition of the processing of personal data of the data subjects involved in and registered with XXXX for the purpose of profiling. The "matter" of the appeal proceedings is therefore the review of the lawfulness of the exercise of the right to remedy granted by Article 58(2)(f) GDPR and, consequently, the question of whether the data processing in question by the complainant was lawful within the meaning of Article 6 GDPR. The fact that the legal assessment by the respondent authority in the administrative proceedings may have been insufficient because it only examined one of several possible justifications has no bearing on the scope of the "matter." The Administrative Court's review of the lawfulness of the data processing in question based on the grounds for processing under Article 6(1) GDPR is not limited by any potentially incorrect legal assessment by the respondent authority. The Administrative Court's legal opinion that reviewing the lawfulness of the data processing in question based on further grounds for processing under Article 6(1) GDPR would exceed the scope of the appeal is therefore not to be followed. The Administrative Court will therefore have to discuss the existence of any justifications with the appellant in the continued proceedings during an oral hearing. The respondent authority filed an official appeal with the Administrative Court of Justice, which overturned the decision of the Federal Administrative Court of August 31, 2021, file no. W256 2227693-1/10E, insofar as it had quashed points 2 and 3 of the preliminary decision on the appeal without substitution, due to the illegality of their content. However, the appeal was dismissed as unfounded with regard to the quashing of point 1 of the preliminary decision on the appeal without substitution. In its reasoning, the Administrative Court of Justice held – insofar as relevant here with regard to points 2 and 3 of the preliminary decision on the appeal – that the relevant content of point 2 of the preliminary decision on the appeal was the prohibition of the processing of personal data of the data subjects involved in the Roman numeral 40 and registered therein for the purpose of profiling. The "subject matter" of the appeal proceedings is therefore the review of the lawfulness of the exercise of the right to remedy granted by Article 58(2)(f) GDPR and, consequently, the question of whether the data processing in question by the complainant was lawful within the meaning of Article 6 GDPR. The fact that the legal assessment by the respondent authority in the administrative proceedings may have been insufficient because it only examined one of several possible justifications has no bearing on the scope of the "subject matter." The Administrative Court's review of the lawfulness of the data processing in question based on the grounds for processing under Article 6(1) GDPR is not limited by any potentially incorrect legal assessment by the respondent authority. The Administrative Court's legal opinion that reviewing the lawfulness of the data processing in question based on further grounds for processing under Article 6(1) GDPR would exceed the scope of the appeal is therefore not to be followed. The Administrative Court will therefore have to discuss the existence of any potential justifications with the appellant in the continued proceedings during an oral hearing.
In her written submission of March 18, 2022, the appellant reiterated that the respondent authority had exceeded its power of review by issuing the instruction in point 2 of the preliminary decision on the appeal, and that the preliminary decision on the appeal should therefore be overturned in this respect. The Administrative Court of Justice had not addressed this issue, and therefore the Administrative Court was not bound by any legal opinion on this matter.
In her written submission of March 16, 2023, the appellant stated, in response to a telephone inquiry from the Federal Administrative Court, that she had requested the examination of the two witnesses in the appeal to prove the unreasonableness of the performance deadline set in point 3 of the original decision. The appellant argued that the examination of these witnesses on this issue of evidence was unnecessary insofar as it concerned the assessment of the appropriateness of the performance deadline in point 3 of the preliminary decision on the appeal for the action (omission) ordered in point 2 of the preliminary decision on the appeal.
In a letter dated March 28, 2023, the respondent authority stated during the hearing of the parties that it could not accept the appellant's argument that there had been an overstepping of the bounds of the matter with regard to the instructions given. The Administrative Court had already clarified the "matter" of the appeal proceedings, stating that the lawfulness of the exercise of the remedial powers under the GDPR (specifically Article 58(2)(f) GDPR) and the related question of the lawfulness of the data processing had to be examined. Since the prohibition under Article 58(2)(f) GDPR was the subject of both the initial decision and the preliminary decision on the appeal, no overstepping of the bounds could be identified here either. There can be no question of an exchange of the remedial powers exercised. In accordance with the nature of a preliminary decision on an appeal, this does not constitute an unlawful exceeding of the scope of the appeal proceedings, but rather an adjustment of the ruling for the sake of clarity. It will now be the task of the Federal Administrative Court to examine the "matter" and decide on its merits. In its letter of March 28, 2023, the respondent authority stated during the hearing of the parties that it could not accept the appellant's argument that the instructions given had exceeded the scope of the "matter." The Administrative Court had already clarified the "matter" of the appeal proceedings, stating that the lawfulness of the exercise of the remedial powers under the GDPR (specifically Article 58, paragraph 2, letter f, GDPR) and the related question of the lawfulness of the data processing had to be examined. Since the prohibition under Article 58, paragraph 2, letter f, GDPR was the subject of both the initial decision and the preliminary decision on the appeal, no overstepping of the bounds can be identified here either. In any case, there can be no question of an exchange of the remedial powers exercised. In accordance with the nature of a preliminary decision on an appeal, this does not constitute an unlawful overstepping of the scope of the appeal proceedings, but rather an adjustment of the ruling for the sake of clarity. It will now be the task of the Federal Administrative Court to examine the matter and render a substantive decision.
In her statements of April 11, 2023, May 3, 2023, and May 8, 2023, the appellant essentially reiterated her previous arguments. She further stated that since February 3, 2020, it has no longer been possible to register at XXXX using the registration brochure. Registration using the registration brochure is also no longer permitted. The complainant also changed the registration process on the website, and the amended version has been live since March 5, 2020. Since then, registration has only been possible via the amended registration process. A return to the old registration process is not planned. The content of the consent declaration for profiling for personalized advertising was amended again on March 24, 2020, and June 8, 2020. The complainant deleted all data collected from the data subjects named in the preliminary decision on the appeal in 2021, including data collected based on the consent declaration. The complainant does not process any data relating to these individuals for the purpose of profiling for personalized advertising; in such cases, processing is limited. Furthermore, it should be noted that the respondent authority made no findings in this case regarding which data was actually processed by the complainant, which is why the conditions for referring the case back to the respondent authority are met. In its statements of April 11, 2023, May 3, 2023, and May 8, 2023, the complainant essentially reiterated its previous arguments. It further stated that since February 3, 2020, it had no longer been possible to register for Roman 40 using a registration brochure. Registration via a brochure was no longer planned. The complainant had also changed the registration process on the website, and the revised version had been live since March 5, 2020. Since then, registration had only been possible via the revised registration process. A return to the old registration process was not planned. The content of the consent declaration for profiling for personalized advertising had been amended again on March 24, 2020, and June 8, 2020. The appellant stated that, among other things, it deleted all data collected from the data subjects named in the preliminary decision on the appeal in 2021 based on their consent. The appellant does not process any data relating to these individuals for profiling purposes related to personalized advertising; in such cases, processing is limited. Furthermore, it should be noted that the respondent authority made no findings in this case regarding which data the appellant actually processed, thus justifying a referral back to the respondent authority.
The respondent authority was granted the opportunity to be heard.
On May 11, 2023, the Federal Administrative Court held an oral hearing in the presence of the appellant, her legal representative, and representatives of the respondent authority. Among other things, the legal bases for processing asserted by the appellant were discussed. The respondent authority further stated that it had indeed made findings regarding the specific data processing based on the documents submitted by the appellant. The appellant elaborated that, in particular, it had discontinued using the registration brochure and redesigned its website accordingly, based on the preliminary decision on the appeal. The appellant also clarified that, in the present case, the participation and purchase data—as also stated in the declaration of consent—had been processed for profiling purposes, and that profiles such as XXXX preference had been created and stored. The respondent authority did not determine precisely which data was processed for each individual member, nor based on which purchases, and this cannot be determined due to the deletion. The authority understands "restricted processing" to mean that, in this case, it is determined whether a member has made a certain minimum number of purchases at, for example, XXXX within a specific period. However, it does not ascertain which specific products were purchased or what purchases the member made at other partner companies, nor does it consider other information that the complainant could derive from the member's data available to it, namely data that the complainant processes for other purposes, such as collecting and redeeming XXXX. The complainant cannot rule out the possibility that not all data processing activities on October 23, 2019, which were classified as "profiling," were also restricted in this way. Such data processing did not reach an intensity that would have required consent because, for example, no social or economic aspects were collected. The data processing was limited to the selection of target groups according to specific criteria, such as those for regular customers. For example, no criteria such as a member's financial resources or membership in a social group were considered. Under the currently implemented "restricted processing," no profiles are created or stored for use in advertising campaigns. The Federal Administrative Court held an oral hearing on May 11, 2023, in the presence of the appellant, her legal representative, and representatives of the respondent authority. Among other things, the legal bases for processing asserted by the appellant were discussed. The respondent authority further stated that it had indeed made findings regarding the specific data processing based on the documents submitted by the appellant. The appellant elaborated that, in particular, it had discontinued using the registration brochure and redesigned its website accordingly, specifically as a result of the preliminary decision on the appeal. The complainant also clarified that, in the present case, the participation and purchase data – as also stated in the declaration of consent – had been processed for profiling purposes, and that profiles such as preferences for Roman numeral 40 had been created and stored. However, the respondent authority had not determined precisely which data had been processed for each individual member, nor based on which purchases, and this could no longer be determined due to the deletion of the data. The complainant understood "limited processing" to mean that, in this case, it was indeed determined whether a member had made a certain minimum number of purchases at, for example, Roman numeral 40 within a specific period. However, it was not determined which specific products had been purchased, nor which purchases the member had made at other partner companies. Furthermore, other information that the complainant could derive from the member's available data – namely, data that the complainant processed for other purposes, such as collecting and redeeming Roman numeral 40 – was not taken into account. The complainant could not rule out the possibility that not all data processing activities carried out on October 23, 2019, which were labeled as "profiling," had also been limited in this way. Such data processing did not reach an intensity that would have required consent because, for example, no social or economic aspects were collected. The data processing was limited to the selection of target groups according to specific criteria, such as for a regular customer. For example, no criteria such as a member's financial resources or membership in a social group of customers were calculated. With the currently implemented "limited processing," no profiles are created or stored for use in advertising campaigns.
In its statement of May 25, 2023, the complainant submitted various pieces of evidence regarding the deletion of the previous data processing activities, including those at issue here, and the fact that no further such processing would occur in the future.
(In its statement of May 25, 2023) This was noted by the respondent authority during the hearing.
II. The Federal Administrative Court considered the following:
1. Findings:
The appellant operates a cross-company and cross-industry customer loyalty program under the name "XXXX". Customers of participating retailers can register as members, collect points based on their purchases, and subsequently redeem these points for various "exclusive" benefits or discounts. The appellant operates a cross-company and cross-industry customer loyalty program under the name "40". Customers of participating retailers can register as members, collect points based on their purchases, and subsequently redeem these points for various "exclusive" benefits or discounts.
... The complainant, as the operator of XXXX, is responsible for managing memberships, processing the customer loyalty program, advertising products, goods, and services, and providing the XXXX service. The complainant, as the operator of Roman 40, is responsible for managing memberships, processing the customer loyalty program, advertising products, goods, and services, and providing the Roman 40 service.
Regarding the situation on October 23, 2019:
For participation in XXXX and, consequently, for managing memberships, the complainant collected member participation data, in particular via the registration forms completed by the member. According to the privacy policy, this data included the following: For participation in Roman 40 and, consequently, for managing memberships, the complainant collected member participation data, in particular via the registration forms completed by the member. According to the privacy policy, the following data was collected:
"Member Master Data":
Personal data (customer number, salutation, gender, first/last name, date of birth; optional: title prefix/suffix)
- Address and contact details (address; optional: telephone number, email address) with geolocation (X-coordinate, Y-coordinate, address district number, geocoding quality)
- Permitted contact method (telephone, email, mail)
- Permissibility of profiling (yes/no) and modification date profiling
- Data on the available XXXX (total, previous month, current month)
"Participation Data": - Data on the available Roman numerals (total, previous month, current month), "Participation Data":
- Member Master Data [see above]
- Analytical Customer Number
- Customer Status and Customer Status Information
- Access Number
- Creation and Registration Date
- Registration Channel
- Point of Sale and point of sale at registration
- IP address at registration (for online registration)
- Partner at registration (XXXX Partner ID) - Partner at registration (Roman numeral 40 Partner ID)
- Number of XXXX cards - Number of Roman numeral 40 cards
- Date of change: Permission for mail, email, and telephone contact
- IP address: Permission for email contact
- Status: Geolocation and date of address verification
- Agreement to the Terms and Conditions
- Date of last Terms and Conditions amendment
- Permission for master data access by the respective XXXX Partner - Permission for master data access by the respective Roman numeral 40 Partner
- Form ID for registration via paper form and digitization date
- Available card types (plastic card, iOS, Android, Print@Home)
In addition, the complainant was provided with the data (so-called purchase data) generated by the member using the XXXX card during a transaction with an XXXX Partner for the purpose of processing the program. The complainant received the following data (according to the privacy policy): Additionally, the complainant received data (so-called purchase data) generated during a transaction using the Roman 40 card at a Roman 40 partner for the purpose of processing the program. This data was transmitted to the complainant by the partner and recorded by the complainant (according to the privacy policy):
- Data generated during purchases in retail outlets and through other sales channels (e.g., online shop) (location/time of purchase, checkout, purchased goods/services, purchase frequency, product category, discounts and promotions used, voucher ID, Roman 40 points granted and redeemed, and price paid)
- Transaction ID Date, Partner, Point of Sale, POS Number, Sales (XXXX) Collected/Redeemed, Non-Discountable Sales, POS ID, Promotion ID, VAT - Transaction ID, Date, Partner, Point of Sale, POS Number, Sales (Roman numeral 40), Non-Discountable Sales, POS ID, Promotion ID, VAT
- Payment Method (cash or card).
Only if the member had given their consent during registration were these participation and purchase data automatically combined and analyzed by the complainant, thereby creating member profiles of their purchasing behavior (such as, according to a sample report submitted by the complainant: XXXX preference) for the purpose of personalized advertising (so-called marketing profiling data). This consent could be revoked at any time and was not mandatory for the conclusion of the contract.
Only if the member had given their consent during registration were these participation and purchase data automatically combined and analyzed by the complainant, thereby creating member profiles of their purchasing behavior (such as, according to a sample report submitted by the complainant: Roman numeral 40 preference) for the purpose of personalized advertising (so-called marketing profiling data). This consent could be revoked at any time and was not mandatory for the conclusion of the contract.
... Registration for the program was open to any natural person who had reached the age of 16 and had their primary residence in the EEA/Switzerland and was possible (insofar as relevant to these proceedings) using a physical registration form ("flyers") or online on the website.
The consent obtained via "flyers" was carried out by making a registration brochure ("flyer") available in the branches of the XXXX partner companies. When paying at the checkout in these branches, this registration brochure was handed to customers who were not yet registered with XXXX but were interested in participating. This registration brochure contained general information about the complainant's business model described above, followed by the complainant's terms and conditions. It also included information about the privacy policy and how to find it. The consent obtained via "flyers" was carried out by making a registration brochure ("flyer") available in the branches of the partner companies. When paying at the checkout in such branches, this registration brochure was handed to customers who were not yet registered with Roman 40 but were interested in participating. This brochure contained general information about the complainant's business model described above, followed by the complainant's terms and conditions. It also included information about the privacy policy and how to find it.
In section 4 of the terms and conditions, the customer was informed about the scope of services offered by the complainant. Among other things, the customer was informed that when using XXXX, they would collect XXXX points when purchasing a product or service from an XXXX partner, which they could redeem at the XXXX partner locations to receive various special offers (4.4.1). Section 4.3.1 further explained that members would receive information about the specific benefits offered by the respective XXXX partners, and that the complainant would also inform customers regularly by mail or email – by email if the member had opted for this option. In section 5.4 of the terms and conditions, the customer was informed that their personal data would be used for membership administration, processing of the customer loyalty program, advertising (without profiling), and personalized advertising with profiling. Section 5.5. The terms and conditions (identical to section 4.4 of the privacy policy) read in part as follows: “[..] 5.5.1. Only if the member consents will the operator, as the sole controller, use and analyze the member's master data and purchase data processed by the operator and its XXXX partners for the automated personalization of advertising and marketing measures [...] and thus obtain new marketing profiling data. The member's consent to the processing of their data in accordance with this subsection is not mandatory for the conclusion or performance of the contract. [...] 5.5.3. This type of data processing constitutes profiling as defined in Article 4(4) GDPR. Profiles are created about the member, which allow conclusions to be drawn about the likelihood of future purchases, target group selections are made, and aggregated evaluations are carried out for assortment planning, shelf and store optimization, and individualized advertising and marketing measures are developed. The member receives information from the operator via mail, email, SMS, MMS, push notifications, messages via the app, or messenger on their [device/platform]. 5.5.4. The member also agrees that, within the scope of electronic advertising, the operator may collect information on whether the member opens the advertisement, clicks on the links contained therein, how much time the member spends on it, which device they use, which operating system and browser they use, their location, which IP address was assigned to them, and whether they use social networks and potentially share the content of the advertisement with third parties there. 5.5.5. The legal basis for the processing of personal data according to this sub-section is Article 6 Paragraph 1 Letter a GDPR (consent). Consent is given on the participation form in the stores of the XXXX partners, on the website XXXX.at, or in the XXXX app. 5.5.6. Consent is voluntary, and the member also has the right to withdraw consent at any time. If the member does not give consent or withdraws it, their personal data will no longer be processed and analyzed automatically. (no profiling [...]) and the member will no longer receive (profiled) newsletters and advertising from the operator. The member can still participate in XXXX and collect and redeem XXXX. The lawfulness of the data processing carried out on the basis of the consent until its revocation is not affected by the revocation.” In point 4 of the terms and conditions, the customer was informed about the scope of services of the complainant. Among other things, the customer was informed that when using the Roman numeral 40, they collect Roman numeral 40 when purchasing a product or service from a Roman numeral 40 partner, which they can redeem at the Roman numeral 40 partner and receive various special offers (4.4.1). In point 4.3.1, it was explained in more detail that the member receives information about the respective benefits from the respective Roman numeral 40 partners, but the complainant will also inform customers about this at regular intervals by mail or email – by email if the member has opted for this option. In point 5.4. The customer was informed in the terms and conditions that their personal data would be used for membership administration, customer loyalty program processing, advertising (without profiling), and personalized advertising with profiling. (See section 5.5.) The terms and conditions (identical to section 4.4 of the privacy policy) read in part as follows: “[..] 5.5.1. Only if the member consents will the operator, as the sole controller, use and analyze the member's master data and purchase data processed by the operator and its 40 partners for the automated personalization of advertising and marketing measures [...] and thus obtain new marketing profiling data. The member's consent to the processing of their data in accordance with this subsection is not mandatory for the conclusion or performance of the contract. [...] 5.5.3. This type of data processing constitutes profiling as defined in Article 4, paragraph 4 of the GDPR. Profiles are created about the member, which allow conclusions to be drawn about the probability of future purchases, target group selections are made, and aggregated evaluations are carried out for assortment, shelf and store optimization, and individualized advertising and marketing measures are developed. The member receives information from the operator via mail, email, SMS, MMS, push notifications, messages via the app, or Messenger messages tailored to the member's shopping behavior, including special offers and promotions of products and competitions from the operator and its Roman 40 partners. 5.5.4. The member also agrees that, as part of electronic advertising, the operator may collect information about whether the member opens the advertisement, clicks on the links contained therein, how much time the member spends on it, which device they use, which operating system and browser they use, their location, which IP address was assigned to them, and whether they use social networks and potentially share the content of the advertisement with third parties there. 5.5.5. The legal basis for processing personal data according to this sub-section is Article 6, paragraph 1, letter a, GDPR (consent). Consent is given on the participation form in the stores of the Roman 40 partners, on the website römika40.at, or in the Roman 40 app. 5.5.6. Consent is voluntary, and the member also has the right to withdraw consent at any time. If the member does not give consent or withdraws it, their Personal data will no longer be processed and analyzed automatically (no profiling [...]) and the member will no longer receive (profiled) newsletters and advertising from the operator. The member can still participate in the Roman 40 program and collect and redeem Roman 40 points. The lawfulness of the data processing carried out based on consent prior to its withdrawal remains unaffected by the withdrawal.
Points 3 and 4 of the privacy policy contained a detailed list of the categories of data processed by the complainant and the purposes for which such processing takes place. In particular, point 4.3.1 explained that, for advertising purposes (without profiling), the member's participant data (including name and address) is used in more detail on the basis of Article 6(1)(f) GDPR. Points 3 and 4 of the privacy policy contained a detailed list of the categories of data processed by the complainant and the purposes for which such processing takes place. In particular, point 4.3.1 explained that... The member was informed that, for advertising purposes (without profiling), the member's detailed data (including name, address) will be used on the basis of Article 6, paragraph one, lit. GDPR.
At the end of the registration brochure was a detachable registration form, which, if registering, had to be handed in at the cashier.
The registration form again included a reference to the terms and conditions and the privacy policy, stating that by submitting the registration, the customer agreed to the terms and conditions.
Following this, the customer's personal data was collected (title, first name, last name, date of birth, street address including house number/staircase/apartment number, postal code, city, and country). A title could be provided if applicable. A mobile phone number and an email address could also be provided, if desired ("for personal benefits and communication").
Below this, the customer agreed that legally relevant declarations could be sent to the provided email address. Specifically, this notice was placed below the email address field. The word "Email," printed in bold red, and the subsequent text (printed in black, not bold) were preceded by a white circle for a checkmark. Below this was the consent form described in section 5.5 of the Terms and Conditions and section 4.4 of the Privacy Policy.
The word "Consent Form" was printed in bold black. The subsequent text of the consent form was also printed in black, not bold. Unlike the email address field, there was no checkmark here; instead, the customer could sign.
The signature field was located on the right at the bottom of the registration form, slightly separated from the consent form. To the left of it, at the same level, was the mandatory "Date" field required for registration. The signature field was not marked with an asterisk ("Mandatory Field").
Below these two fields was the following text: “This signature applies only to the declaration of consent and is voluntary. Your registration for XXXX is also valid without a signature.” This text was not printed in bold. Below these two fields was the following text: “This signature applies only to the declaration of consent and is voluntary. Your registration for Roman 40 is also valid without a signature.” This text was not printed in bold.
``` In essence, this was as follows:
"[Circle] Email [in red]: [...]
Declaration of Consent: In accordance with sections 5.5 and 5.6 of the Terms and Conditions (as well as sections 4.4 and 4.5 of the Privacy Policy), I hereby consent to XXXX GmbH and the XXXX partners with whom I have used my XXXX card (1) combining and analyzing my participation and purchase data in order to provide me with relevant and personalized information about the XXXX program tailored to my interests and to adapt offers for collecting and redeeming XXXX points to my needs (so-called "profiling" [...]), (2) sending me advertising with personalized offers for products and services of the operator and the XXXX partners via mail, email, SMS, MMS, push notifications, messages via apps and messengers, and (3) that my personal data obtained in this way will be deleted upon revocation of my consent, at the latest after the termination of my membership." My consent is not absolutely necessary for the conclusion of the contract and I can revoke it at any time with effect for the future by contacting XXXX by post, email to XXXX or by telephone at XXXX.” Declaration of Consent: In accordance with sections 5.5 and 5.6 of the General Terms and Conditions (as well as sections 4.4 and 4.5 of the Privacy Policy), I hereby consent to römisch 40 GmbH and the römisch 40 partners where I have used my römisch 40 card (1) combining and analyzing my participation and purchase data in order to provide me with relevant and personalized information about the römisch 40 program tailored to my interests and to adapt offers for collecting and redeeming römisch 40 points to my needs (so-called "profiling" [...]), (2) sending me advertising with personalized offers for products and services of the operator and the römisch 40 partners by mail, email, SMS, MMS, push notifications, messages via apps and messengers, and (3) that my personal data obtained in this way will be deleted upon revocation of my consent, at the latest after the termination of my membership. My consent is not mandatory for concluding the contract and I can revoke it at any time with effect for the future by contacting [Company Name] by mail, email, or telephone.
Date* Signature
[][][][][][][] [ ] [][][][][][]
Day Month Year
This signature applies only to the declaration of consent and is voluntary. Your registration for [Company Name] is also valid without a signature.
The online consent process on the website was conducted as follows: In the first step ("Register now"), the individual had to indicate whether or not they possessed a card ("Yes" or "No"). In the second step, the individual's personal data was requested, namely title, first name, last name, date of birth, street address including house number/staircase/apartment number, postal code, city, country, and email address. In a third step, the person was first presented with the terms and conditions in a scrollable field and required to confirm their acceptance by clicking a box (marked as mandatory). Subsequently, under the heading "Data protection is important to us," the privacy policy was presented in a scrollable field, and confirmation of this was also required by clicking a box (marked as mandatory). In a fourth step, under the heading "Enjoy your personal benefits," the person was given the option to select either "Yes, I agree to the processing of my data in accordance with the consent declaration below and would like to benefit from exclusive benefits and promotions" or "No, I do not agree to the processing of my data in accordance with the consent declaration below and would like to benefit from exclusive benefits and promotions" by clicking a corresponding white button. Following this, the person was presented with the (identical and already reproduced in the flyer) consent form in a scrollable field. The following text was immediately visible: "In accordance with points 5.5 and 5.6 of the Terms and Conditions (as well as points 4.4 and 4.5 of the Privacy Policy), I agree that XXXX GmbH and the XXXX partners where I have used my XXXX card may (l) combine and analyze my participation and purchase data in order to provide me with relevant and personalized offers tailored to my interests." As a final step, under the heading "Check your entry," the person was shown in a table whether their entry was complete. The entries for title, date of birth, address, telephone number, access number, Terms and Conditions, Privacy Policy, and profiling were listed one below the other, each with explanatory notes. A pencil icon was located at the end of each line. For example, if the date of birth was incomplete, the message "Your date of birth is incomplete" appeared to the right of the birthdate field. If the terms and conditions were not accepted, the message "Please accept the terms and conditions" appeared to the right. If no answer was selected for profiling, the message "Please select an answer for profiling to continue with registration" appeared to the right. Clicking the respective pencil icon at the end of the line automatically redirected the user to the corresponding input field on the website. Obtaining consent online on the website was carried out as follows: In the first step ("Register now"), the user had to indicate whether or not they possessed a card ("Yes" or "No"). In the second step, the user's personal data was requested, namely title, first name, last name, date of birth, street address including house number/staircase/apartment number, postal code, city and country, and email address. In a third step, the person was first presented with the terms and conditions in a scrollable field and required to confirm their acceptance by clicking a box (marked as mandatory). Subsequently, under the heading "Data protection is important to us," the privacy policy was presented in a scrollable field, and confirmation of this was also required by clicking a box (marked as mandatory). In a fourth step, under the heading "Enjoy your personal benefits," the person was given the option to select either "Yes, I agree to the processing of my data in accordance with the consent declaration below and would like to benefit from exclusive benefits and promotions" or "No, I do not agree to the processing of my data in accordance with the consent declaration below and would like to benefit from exclusive benefits and promotions" by clicking a corresponding white button. Following this, the person was presented with the (identical and already reproduced in the flyer) consent form in a scrollable field. The following text was immediately visible: "In accordance with points 5.5 and 5.6 of the Terms and Conditions (as well as points 4.4 and 4.5 of the Privacy Policy), I agree that römisch 40 GmbH and the römisch 40 partners where I have used my römisch 40 card may (l) combine and analyze my participation and purchase data in order to provide me with relevant and personalized offers tailored to my interests." As a final step, under the heading "Check your entry," the person was shown in a table whether their entry was complete. The entries for title, date of birth, address, telephone number, access number, Terms and Conditions, Privacy Policy, and profiling were listed one below the other, each with explanatory notes. A pencil icon was located at the end of each line. For example, if the date of birth was incomplete, the message "Your date of birth is incomplete" appeared to the right of the birthdate field. If the terms and conditions were not accepted, the message "Please accept the terms and conditions" appeared to the right. If no answer was selected for profiling, the message "Please select an answer for profiling to continue with registration" appeared to the right. Clicking the respective pencil icon at the end of the line automatically redirected the user to the corresponding input field on the website.
By clicking the gray "Register Now" button located in the lower right corner, the registration process could be completed. The appearance of this final registration step depended on the version used (web version (PC)/mobile version (mobile phone)). In the mobile version, the last line, "Register Now," was closer to the last line, "Profiling: Consent given or consent denied."
``` The process for obtaining consent declarations in the PC version was essentially as follows:
"Data privacy is important to us.
Here you will find the privacy policy of XXXX. Here you will find the privacy policy of Roman 40.
[Field with privacy policy to scroll down]
[Field to click] Yes, I have read and understood the privacy policy.*
Enjoy your personal benefits
O YES, I consent to the processing of my data in accordance with the consent declaration below and would like to benefit from exclusive benefits and promotions.
O NO, I do not consent to the processing of my data in accordance with the consent declaration below and would like to benefit from exclusive benefits and promotions.
[Field with the following text to scroll down]:
I agree, in accordance with sections 5.5 and 5.6 of the Terms and Conditions (as well as sections 4.4 and 4.5 of the Privacy Policy), that XXXX GmbH and the XXXX, where I have used my XXXX card, may process my data. I declare I hereby consent, in accordance with sections 5.5 and 5.6 of the Terms and Conditions (as well as sections 4.4 and 4.5 of the Privacy Policy), to the following processing of my data:
(1) combining and analyzing my participation and purchase data in order to provide me with relevant and personalized information about the XXXX program and to tailor offers for collecting and redeeming XXXX points to my needs (so-called "profiling" [...]), in order to
(2) sending me advertising with personalized offers for products and services of the operator and the XXXX partners by mail, email, SMS, MMS, (1) to send me push notifications, messages via apps and messengers, and (2) to send me advertising with personalized offers for products and services of the operator and its partners by mail, email, SMS, MMS, push notifications, messages via apps and messengers, and
(3) that my personal data obtained in this way will be deleted upon revocation of my consent, at the latest after the end of my membership. My consent is not mandatory for the conclusion of the contract and I can revoke it at any time with effect for the future by contacting XXXX by mail, email to XXXX.at or by telephone (XXXX).
(3) that my personal data obtained in this way will be deleted upon revocation of my consent, at the latest after the end of my membership. My consent is not mandatory for the conclusion of the contract and I can revoke it at any time with effect for the future by contacting XXXX by mail, email to XXXX.at or by telephone (XXXX).
... *Required field*
Regarding the current situation:
The complainant deleted the profiles created in 2021 regarding the purchasing behavior of individuals registered on "XXXX" using the "Website" www.XXXX.at (version of October 23, 2019) and the registration brochure "Flyer," based on the automated processing of participation and purchase data. Furthermore, no such profiles are (or are no longer) being automatically created for these individuals using profiling. The complainant deleted the profiles created in 2021 regarding the purchasing behavior of individuals registered on "Roman numeral 40" using the "Website" www.roman40.at (version of October 23, 2019) and the registration brochure "Flyer," based on the automated processing of participation and purchase data. Furthermore, no such profiles are (or are no longer) being automatically created for these individuals using profiling.
* * ... Furthermore, the registration form "Flyer" has not been in use since March 3, 2020. The registration option on the website, as amended on October 23, 2019, has also been discontinued or adapted since March 5, 2020.
II. The Federal Administrative Court considered the following:
1. Evaluation of Evidence:
The above-described procedural history and facts are derived from the administrative and court files and are undisputed.
That the appellant processed the participation and purchase data of those attending "XXXX" for the purpose of the present data processing using the "website" www. The fact that the complainant automatically merged the participation and purchase data of individuals registered on the website www.romas40.at and via the registration brochure "Flyer" and created profiles of their purchasing behavior, such as preferences, is evident from the documents submitted by the complainant, in particular the declaration of consent, the privacy policy, the terms and conditions, and the sample information. The complainant does not dispute this during the oral proceedings, but rather argues that it did not calculate any criteria such as a member's financial strength or their membership in a social group of customers from this data. The fact that the complainant automatically merged the participation and purchase data of individuals registered on "Roman 40" using the website www.romas40.at and the registration brochure "Flyer" for the purpose of the present data processing, and created profiles of their purchasing behavior, such as preferences, is evident from the documents submitted by the complainant, in particular the declaration of consent, the privacy policy, the terms and conditions, and the sample information. The appellant did not dispute this during the oral proceedings, but rather argued that she had not calculated any criteria from this data, such as a member's financial strength or their affiliation with a particular social group of customers.
The fact that the appellant has already deleted the profiles created for these individuals and no longer creates or stores such profiles for them is evident from the appellant's undisputed submissions during the proceedings before the Federal Administrative Court. It is also evident from this that the registration brochure and the registration option on the website, as amended on October 23, 2019, are no longer in use.
These submissions also confirm that the registration brochure and the registration option on the website, as amended on October 23, 2019, are no longer in use. 3. Legal Assessment:
The relevant provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, hereinafter referred to as GDPR, are as follows:
"Article 4 Definitions
For the purposes of this Regulation, the Definition:
[..]
4. ‘Profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;
[..]
Article 5 Principles relating to the processing of personal data Article 5, Principles relating to the processing of personal data
(1) Personal data must be
a) processed lawfully, fairly, and in a transparent manner in relation to the data subject (‘lawfulness, fairness, and transparency’);
[..]
Article 6 Lawfulness of processing Article 6, Lawfulness of processing
(1) Processing shall be lawful only if at least one of the following conditions is met:
a) The data subject has given consent to the processing of his or her personal data for one or more specific purposes;
[..]
f) Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
[..] [...]
(4) Where processing for a purpose other than that for which the personal data were collected is not based on the data subject’s consent or on Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller, in order to determine whether processing for a different purpose is compatible with that for which the personal data were originally collected, shall take into account, inter alia,
a)
any link between the purposes for which the personal data were collected and the purposes of the intended further processing,
b)
the context in which the personal data were collected, in particular with regard to the relationship between the data subjects and the controller,
c)
the nature of the personal data, in particular whether special categories of personal data are processed pursuant to Article 9 or whether personal data relating to criminal convictions and offences are processed pursuant to Article 10,
d)
the possible consequences of the intended Further processing for the data subjects,
e)
the existence of appropriate safeguards, which may include encryption or pseudonymization.
[]
Article 7 Conditions for Consent
(1) Where processing is based on consent, the controller must be able to demonstrate that the data subject has consented to the processing of their personal data.
(2) Where the data subject’s consent is given by means of a written declaration which also concerns other matters, the request for consent must be presented in an intelligible and easily accessible form, using clear and plain language, and must be clearly distinguishable from the other matters. Parts of the declaration are not binding if they constitute an infringement of this Regulation.
(3) The data subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The data subject must be informed of this before giving consent. Withdrawing consent must be as easy as giving it.
(2) (4) When assessing whether consent was freely given, utmost account must be taken of whether, among other things, the performance of a contract, including the provision of a service, is conditional upon consent to the processing of personal data that is not necessary for the performance of that contract.
Article 13 Information to be provided where personal data are collected from the data subject
(1) Where personal data are collected from the data subject, the controller shall, at the time when personal data are collected from the data subject, provide the data subject with the following information:
a)
the name and contact details of the controller and, where applicable, of the controller’s representative;
b)
where applicable, the contact details of the data protection officer;
c)
the purposes for which the personal data are to be processed and the legal basis for the processing;
d)
where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;
(2) In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following further information at the time the data are collected, which is necessary to ensure fair and transparent processing:
[..]
(f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
[..]
Article 17 Right to erasure [..] Article 17, Right to erasure [..]
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
(a)
The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
b)
The data subject withdraws their consent on which the processing was based according to Article 6(1)(a) or Article 9(2)(a), and there is no other legal basis for the processing.
[]
Article 21 Right to object
(1) The data subject shall have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the purpose of establishing, exercising or defending legal claims.
[] (2) Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
[..]
Article 22 Automated individual decision-making, including profiling
(1) The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
[..] (2) Paragraph 1 shall not apply if the decision
a) is necessary for entering into, or performing, a contract between the data subject and the controller,
b) is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, or
c) is made with the data subject’s explicit consent.
[...]
Article 58
(1) Each supervisory authority shall have all of the following investigative powers, which shall enable it to:
[..]
b) conduct investigations in the form of data protection audits,
[..]
(2) Each supervisory authority shall have all of the following corrective powers, which shall enable it to:
a) warn a controller or processor that intended processing operations are likely to infringe this Regulation,
b) issue a warning to a controller or processor where processing operations have infringed this Regulation,
c) order the controller or processor to comply with requests from the data subject to exercise the rights granted to him or her under this Regulation,
d) order the controller or processor to bring processing operations into compliance with this Regulation, where appropriate, in a specific manner and within a specified timeframe,
e) order the controller to provide appropriate redress to the data subject affected by a personal data breach. notify,
f) to impose a temporary or permanent restriction of processing, including a prohibition,
g) to order the rectification or erasure of personal data or the restriction of processing in accordance with Articles 16, 17 and 18 and to inform the recipients to whom such personal data have been disclosed in accordance with Article 17(2) and Article 19 of such measures,
h) to revoke a certification or to instruct the certification body to revoke a certification issued in accordance with Articles 42 and 43, or to instruct the certification body not to issue a certification if the conditions for certification are not or are no longer met,
[..].“
The following follows from this in legal terms:
Regarding the subject matter of the proceedings:
The Administrative Court, in its ruling of February 8, 2022, Ro 2021/04/0033-8, upheld the decision of the Federal Administrative Court of August 31, 2022. In 2021, W256 2227693-1/10E, the Administrative Court upheld the remedial action without substitution regarding the findings stated in point 1 of the preliminary decision on the appeal, but overturned the remedial action without substitution regarding the instruction and deadline stated in points 2 and 3 of the preliminary decision on the appeal.
The continued proceedings are therefore limited to the subject matter of the reversal by the Administrative Court – namely, points 2 and 3 of the preliminary decision on the appeal.
Specifically, the Administrative Court stated that the "matter" of the (continued) proceedings concerns the review of the lawfulness of the exercise of the right to remedy granted by Article 58(2)(f) GDPR (as set out in points 2 and 3 of the preliminary decision on the appeal) and, consequently, the question of whether the data processing in question by the appellant was lawful within the meaning of Article 6 GDPR. The subject of this case is the review of the lawfulness of the exercise of the right to remedy granted by Article 58(2)(f) GDPR (as set out in points 2 and 3 of the preliminary decision on the appeal), and, relatedly, the question of whether the data processing in question by the complainant was lawful within the meaning of Article 6 GDPR.
In point 2 of the preliminary decision on the appeal, the complainant was prohibited (in modification of point 3 of the original decision) from processing personal data of the data subjects registered at "XXXX" for profiling purposes (to the extent of the findings in point 1), and in point 3, the complainant was granted a period of six months to comply with this prohibition. In its reasoning, the respondent authority stated (in accordance with point 1) that, in the absence of a legal basis, such a prohibition had to be imposed. The prohibition, however, only applies to previous profiling processing based on consent obtained using methods i) website and ii) registration form (flyer). In point 2 of the preliminary decision on the appeal, the appellant was prohibited (modifying point 3 of the original decision) from processing personal data of the data subjects registered at "Roman numeral 40" for profiling purposes (to the extent of the findings in point 1), and point 3 granted the appellant a period of six months to comply. In its reasoning, the respondent authority stated (in accordance with point 1) that, in the absence of a legal basis, such a prohibition had to be imposed. However, the prohibition only applies to previous profiling processing based on consent obtained using methods i) website and ii) registration form (flyer).
The appellant now argues that this amendment to the original decision should be considered an overstepping of the bounds of the proceedings. While the respondent authority, in its reasoning for point 3 of the original decision, relied on its power to remedy the situation under Article 58(2)(f) GDPR, it did not elaborate on this point in the decision itself. Furthermore, it did not prohibit data processing for profiling purposes (as in point 2 of the preliminary decision on the appeal), but rather prohibited the use of the consent declarations in question. Such an instruction, however, cannot be based on Article 58(2)(f) GDPR, and moreover constitutes a completely different instruction than that in point 2 of the preliminary decision on the appeal. The appellant now argues that this amendment to the original decision should be considered an overstepping of the bounds of the proceedings. Although the respondent authority, in its reasoning for point 3 of the initial decision, relied on its power to remedy the situation under Article 58(2)(f) of the GDPR, it did not elaborate on this point in the decision itself. Furthermore, it did not prohibit data processing for profiling purposes (as it did in point 2 of the preliminary decision on the appeal), but rather prohibited the use of the consent declarations in question. Such an instruction, however, cannot be based on Article 58(2)(f) of the GDPR, and moreover constitutes a completely different instruction than the one in point 2 of the preliminary decision on the appeal.
It is established case law of the Administrative Court that, pursuant to Section 14 of the Administrative Court Procedure Act (VwGVG), the preliminary decision on the appeal—just like the decision of the Administrative Court pursuant to Sections 28 and 31 of the VwGVG—is a decision on the appeal, which, unless a request for a referral is filed, also concludes the appeal definitively. It follows from this that the scope of the proceedings at this stage cannot be limited differently than in the proceedings before the administrative court itself. Section 14 of the Administrative Court Procedure Act (VwGVG) also expressly refers to Section 27 VwGVG, which defines the permissible scope of review for the administrative court. Regarding the merits of the proceedings before the Administrative Court and the outermost scope of its power of review, the Administrative Court has repeatedly stated that this is limited to the matter that formed the content of the operative part of the original decision (see VwGH 6 May 2020, Ra 2019/08/0114; VwGH 8 May 2018, Ro 2018/08/0011). It is established case law of the Administrative Court that the preliminary decision on the appeal pursuant to Section 14 of the Administrative Court Procedure Act (VwGVG) – just like the decision of the Administrative Court pursuant to Sections 28 and 31 of the VwGVG – is a decision on the appeal, which, unless a request for referral is filed, also concludes the appeal definitively. It follows from this that the scope of the proceedings at this stage cannot be limited differently than in the proceedings before the Administrative Court itself. Section 14 of the Administrative Court Procedure Act (VwGVG) also expressly refers to Section 27 of the VwGVG, which defines the permissible scope of review for the Administrative Court. Regarding the subject matter of the proceedings before the Administrative Court and the outermost limits of its power of review, the Administrative Court has repeatedly stated that this is limited to the matter that formed the basis of the operative part of the original decision (see VwGH 6 May 2020, Ra 2019/08/0114; VwGH 8 May 2018, Ro 2018/08/0011).
``` The appellant's argument can be upheld insofar as the wording of the first sentence of point 3 of the initial decision ("XXXX GmbH is prohibited and XXXX GmbH is instructed to cease using the consents obtained pursuant to point 1 for profiling purposes as of May 1, 2020.") can initially be understood as the respondent authority intending to prohibit the use of the declarations of consent detailed in point 1 (including the use of methods XXXX). However, the second sentence further states that this (the prohibition on using the consents) does not apply if valid declarations of consent are obtained from the data subjects ("This does not apply if valid consent is obtained from the data subjects within the same period, in compliance with the requirements for consent pursuant to point 2."). It is unclear why the use of prohibited declarations of consent should be permitted after obtaining other, adapted declarations of consent, and this renders the decision as a whole ambiguous. The reference in sentence 2 suggests that the authority in question did not actually intend to prohibit the use of the consent declarations, but rather the processing of data based on them. Considering these concerns and the reasoning of the original decision, there is no doubt that point 3 of the original decision is also intended to prohibit the processing of data based on the invalid consent declarations for profiling purposes (regarding the use of reasoning to interpret an unclear ruling, see, e.g., Austrian Administrative Court [VwGH] 16 January 2019, Ra 2018/02/0300; 12 March 2020, Ra 2019/01/0484, each with further references). The ruling refers exclusively to a prohibition on data processing based on Article 58(2)(f) GDPR and makes no mention whatsoever of a prohibition on the use of consent declarations (“Since, in the present case, there is no legal basis for the processing of personal data of the data subjects participating in “XXXX” for the purpose of profiling – as explained above – a corresponding prohibition had to be imposed on the controller. [...] The prohibition imposed pursuant to Article 58(2)(f) GDPR relates only to processing for profiling based on those declarations of consent that were obtained to date using the methods mentioned in point 1 (i) to (iv), and not to declarations of consent lawfully obtained in the future. The controller is therefore free [...] to obtain lawful consent from the data subjects and to process their data lawfully for the purpose of profiling from now on.” (Emphasis added by the Federal Administrative Court)). The appellant's argument can be upheld insofar as the wording of the first sentence of point 3 of the initial decision ("Roman 40 GmbH is prohibited and Roman 40 GmbH is instructed to cease using the consents obtained pursuant to point 1 for profiling purposes from May 1, 2020.") can initially be understood as meaning that the respondent authority intended to prohibit the use of the declarations of consent detailed in point 1 (including the use of methods Roman 40). However, the second sentence further states that this (the prohibition on using the consents) does not apply if valid declarations of consent are obtained from the data subjects ("This does not apply if valid consent is obtained from the data subjects within the same period, in compliance with the requirements for consent pursuant to point 2."). It is unclear why the use of prohibited consent declarations should be permitted after obtaining other, adapted consent declarations, and this renders the ruling as a whole ambiguous. The reference in sentence 2 suggests that the respondent authority did not actually intend to prohibit the use of the consent declarations, but rather the data processing based on them. Considering these concerns and the reasoning of the original decision, there is no doubt that point 3 of the original decision also aims to prohibit data processing for profiling purposes based on the invalid consent declarations (for the use of reasoning to interpret an ambiguous ruling, see, for example, the Austrian Administrative Court decisions of January 16, 2019, Ra 2018/02/0300; and March 12, 2020, Ra 2019/01/0484, each with further references). The ruling refers exclusively to a prohibition on data processing based on Article 58(2)(f) of the GDPR and makes no mention whatsoever of a prohibition on the use of consent declarations (“Since, in the present case, there is no legal basis for the processing of personal data of the data subjects participating in ‘Roman 40’ for the purpose of profiling – as explained above – a corresponding prohibition had to be imposed on the controller. [...] The prohibition imposed pursuant to Article 58(2)(f) of the GDPR applies only to processing for profiling based on those declarations of consent that have been obtained to date using the methods referred to in point 1 (i) to (iv), and not to declarations of consent lawfully obtained in the future. The controller is therefore free [...] to obtain lawful consent from the data subjects and to process their data lawfully for the purpose of profiling from now on.” (Emphasis added by the Federal Administrative Court)).
Since point 3 of the initial decision – like point 2 of the preliminary decision on the appeal, which is ultimately undisputed – is based on a prohibition of data processing for profiling purposes with regard to those individuals who have given their consent via the flyer or website, the appellant's concerns cannot be upheld in their entirety. There is no other evidence to suggest that the respondent authority exceeded its powers of review in the present case, nor have any been presented. There are no grounds, nor have any been raised, that the authority in question exceeded its powers of inspection in the present case.
For the sake of completeness, it must be noted that the prohibition stated in point 2 of the preliminary decision on the appeal refers to (previous) data processing for profiling, specifically – as is evident from the reference to point 1 of the preliminary decision on the appeal – to the creation of profiles derived from participation and purchase data, which allow conclusions to be drawn about the future purchasing behavior of members registered via flyers and the website (see the declaration of consent reproduced in point 1, point 1: “In accordance with points 5.5 and 5.6 of the General Terms and Conditions (as well as points 4.4 and 4.5 of the Privacy Policy), I agree that XXXX GmbH and the XXXX partners where I have used my XXXX card may (1) combine and analyze my participation and purchase data in order to provide me with relevant and personalized information about the XXXX program tailored to my interests and to adapt offers for collecting and redeeming XXXX to my needs”; point 4.4.3 of the then applicable Data protection declaration: “This type of data processing constitutes profiling pursuant to Article 4(4) GDPR. Profiles are created about the member which allow conclusions to be drawn about the likelihood of future purchases, [...]”; see also the reasoning in the preliminary decision on the complaint, page 24: “[…] the complainant [...] uses [...] all this data to create profiles about the data subjects for automated processing and analysis, which indicate which products the data subject buys from which XXXX partner company and with what probability future purchases will be made.”). For the sake of completeness, it must be noted that the prohibition stated in point 2 of the preliminary decision on the appeal refers to (previous) data processing for profiling, specifically – as is evident from the reference to point 1 of the preliminary decision on the appeal – to the creation of profiles derived from participation and purchase data, which allow conclusions to be drawn about the future purchasing behavior of members registered via flyers and the website (see the declaration of consent reproduced in point 1, point 1: “In accordance with points 5.5 and 5.6 of the General Terms and Conditions (as well as points 4.4 and 4.5 of the Privacy Policy), I agree that römisch 40 GmbH and the römisch 40 partners where I have used my römisch 40 card may (1) combine and analyze my participation and purchase data in order to provide me with relevant and personalized information about the römisch 40 program tailored to my interests and to adapt offers for collecting and redeeming römisch 40 to my needs”; point 4.4.3 of the then-applicable privacy policy: “This type of data processing constitutes profiling within the meaning of Article 4, paragraph 4, GDPR. Profiles are created about the member that allow conclusions to be drawn about the likelihood of future purchases, [...]”; see also the reasoning in the preliminary decision on the complaint, page 24: “[…] the complainant [...] uses [...] all this data to create profiles of the data subjects for automated processing and analysis, indicating which products the data subject purchases from which partner company and the likelihood of future purchases.”).
This is consistent with the original decision, the relevant point 3 of which also refers to point 1 and the declarations of consent reproduced verbatim in point 1 of the preliminary decision on the complaint.
No other data processing activities covered by the prohibition for profiling can be derived from this, and none of these have emerged in the proceedings (including before the respondent authority).
[…] The statements made by the respondent authority, made for the first time solely in the grounds for the preliminary decision on the appeal, that it "is of the opinion that [...] a precise picture of the economic and social situation as well as a precise picture of the respective person's residences is being created," are not only not found in any way in the original decision, but are also ultimately not covered by point 3 of the preliminary decision on the appeal. Therefore, any discussion of the (above-described) scope of review by the respondent authority within the framework of a preliminary decision on an appeal and any potential exceeding of the scope is unnecessary.
Should the respondent authority have concerns in this regard, it would have to conduct its own review procedure, including appropriate investigations. The mere fact that – as the respondent authority stated, among other things, with regard to point 5.5.4. The fact that data is collected regarding "the date, time, operating system, browser, and geolocation (including X and Y coordinates) of a data subject who opened (or did not open) specific electronic advertisements" is not, in itself, sufficient grounds for concluding that such profiles are being created. Should the respondent authority have concerns in this regard, it would have to conduct its own review process, including appropriate investigations. The mere fact that data is collected regarding "the date, time, operating system, browser, and geolocation (including Roman numeral X and Y coordinates) of a data subject who opened (or did not open) specific electronic advertisements" is not, in itself, sufficient grounds for concluding that such profiles are being created.
This is as stated by the respondent authority, among others, with regard to point 5.5.4 of the terms and conditions and a sample statement submitted by the complainant. Regarding the facts and the legal situation:
It is undisputed that the appellant has since complied with the prohibition issued in the preliminary decision on the appeal (and explained in more detail above) by deleting the profiles already created and by refraining from creating any further such profiles with respect to the persons registered via flyers and the website, and has therefore fully complied with points 2 and 3 of the preliminary decision on the appeal.
This is because the appellant has, after receiving the preliminary decision on the appeal, deleted the profiles already created and refrained from creating any further such profiles with respect to the persons registered via flyers and the website. It should be noted that the Administrative Court must consider the factual and legal situation at the time of its decision (see Leeb in Hengstschläger/Leeb, AVG § 28 VwGVG, para. 50 (as of February 15, 2017, rdb.at) with further references), and this also applies – as in the present case – to ex officio proceedings (VwGH November 16, 2015, Ra 2015/12/0044). 2015/12/0044).
However, according to the established case law of the Administrative Court, this does not apply to changes in circumstances that consist of establishing the state of affairs required by an administrative decision; such changes do not constitute a change in the relevant facts that the Administrative Court must consider (see, among others, Administrative Court decision of April 28, 2022, Ra 2022/06/0056; Leeb in Hengstschläger/Leeb, loc. cit., para. 52). The implementation of such a decision can therefore neither render the pending appeal moot nor determine the decision of the appellate court in a specific way; rather, the situation is to be viewed as if nothing had happened since the issuance of the contested decision. In such a case, the only remaining option for the Administrative Court to review is the legality of the decision (see again Leeb in Hengstschläger/Leeb, loc. cit., para. 52). However, according to the established case law of the Administrative Court, this does not apply to changes in circumstances that consist of establishing the state of affairs required by a decision; such changes do not constitute a change in the relevant facts that the Administrative Court must consider (see, among others, VwGH 28.04.2022, Ra 2022/06/0056; Leeb in Hengstschläger/Leeb, loc. cit., para. 52). The implementation of such a decision can therefore neither render the pending appeal moot nor determine the decision of the appellate court in a specific way; rather, the situation is to be viewed as if nothing had happened since the issuance of the contested decision. In such a case, the only remaining option for the Administrative Court is to review the legality of the decision (see again Leeb in Hengstschläger/Leeb, loc. cit., para. 52).
Accordingly, restoring a state of affairs corresponding to a decision does play a role in any enforcement or administrative penalty proceedings; however, it does not lead to the annulment of the original decision (see Austrian Administrative Court [VwGH] 20 October 2005, 2005/07/0112).
`` `` `` `` `` `` therefore does play a role in any enforcement or administrative penalty proceedings; however, it does not lead to the annulment of the original decision (see Austrian Administrative Court [VwGH] 20 October 2005, 2005/07/0112). This is not altered by the provision of Section 24 Paragraph 6 of the Data Protection Act (DSG), because this provision – modeled on Section 33 Paragraph 1 of the Administrative Court Act (VwGG) as an addition to the procedural instruments of Section 13 Paragraph 7 of the General Administrative Procedure Act (AVG) (withdrawal of the application) – makes no statement regarding the application-free procedure relevant here (see the explanatory notes to the largely identical Section 31 Paragraph 8 of the Data Protection Act 2000 as amended by the 2010 amendment to the Data Protection Act (472 BlgNR 24. GP 13), according to which the data protection authority may, after appropriate notification, informally discontinue the proceedings if an applicant lacks interest in pursuing their legal claim, which has since been satisfied by the respondent). This is not altered by the provision of Section 24, Paragraph 6, of the Data Protection Act (DSG), because this supplement to the procedural instruments of Section 13, Paragraph 7, of the General Administrative Procedure Act (AVG) (withdrawal of the application), modeled on Section 33, Paragraph 1, of the Administrative Court Act (VwGG), makes no statement regarding the application-free procedure relevant here (see the explanatory notes to the largely identical Section 31, Paragraph 8, of the Data Protection Act 2000 as amended by the 2010 amendment to the Data Protection Act (472 BlgNR 24th legislative period 13), according to which the data protection authority may, after appropriate notification, informally discontinue the proceedings if an applicant lacks interest in pursuing their legal claim which has since been satisfied by the respondent).
On the legality of the power to remedy
As the Administrative Court has already recognized in its ruling of February 8, 2022, Ro 2021/04/0033-8, the power to remedy stipulated in Article 58(2)(f) GDPR requires that a violation of the GDPR has occurred.
In the present case, the respondent authority based its measure, set out in point 2 of the preliminary decision on the appeal, on a violation of Article 6 GDPR. There is neither valid consent pursuant to Article 6(1)(a) GDPR nor any other legal basis under Article 6 GDPR for the data processing in question for profiling purposes. In the present case, the respondent authority based its measure in point 2 of the preliminary decision on a violation of Article 6 GDPR. There is neither valid consent pursuant to Article 6(1)(a) GDPR nor any other legal basis under Article 6 GDPR for the data processing in question for profiling purposes.
It is undisputed that the complainant – if consent had been given – combined purchase and participation data at the time the decision was issued and created profiles of registered members from this data, which allowed conclusions to be drawn about their future purchasing behavior. To this end, the company provided its members with pre-printed declarations of consent during registration – insofar as this is relevant here – via flyers and its website.
For consent to be valid and to legitimize data processing under Article 6 GDPR, various formal requirements must be met. For consent to be valid and to legitimize data processing under Article 6 of the GDPR, various formal requirements must be met.
Article 7(2), first sentence, of the GDPR requires the data controller, in particular, to ensure that a written declaration of consent is presented transparently if the declaration also concerns other matters. In such cases, the request must be made "in an intelligible and easily accessible form" and "using clear and plain language" so that it can be clearly distinguished from other matters. The regulation thus stipulates that consent, if given in writing together with other declarations, must be clearly highlighted. Furthermore, Article 7(2), first sentence, requires not only transparency in terms of design but also in terms of content. To comply with this requirement, a written consent clause must not only be positioned so that the data subject cannot overlook it, for example, by using a specific distance from the rest of the text, a frame, or boldface. Furthermore, the data controller must also clearly and simply explain to the data subject the "whether" and "how" of giving consent (see Kühling/Buchner in Kühling/Buchner, Datenschutz-Grundverordnung, BDSG3 [2020], Art. 7 para. 25). Article 7, paragraph 2, first sentence of the GDPR requires the controller, in particular, to ensure that a written declaration of consent is presented transparently if the declaration also concerns other matters. In this case, the request must be made "in an intelligible and easily accessible form" and "in clear and plain language" so that it can be clearly distinguished from other matters. The provision thus stipulates that consent, if given in writing together with other declarations, must be clearly highlighted. Moreover, Article 7, paragraph 2, first sentence requires not only transparency in terms of design but also in terms of content. To comply with the regulation, a written consent clause must not only be positioned so that the data subject cannot overlook it, for example, by maintaining a clear distance from the surrounding text, by framing it, or by using boldface. Furthermore, it must also clearly and simply explain to the data subject, in a clear and straightforward manner, both the "whether" and "how" of giving consent (see Kühling/Buchner in Kühling/Buchner, General Data Protection Regulation, BDSG3 [2020], Article 7, para. 25).
A document is considered to have a different legal status if it contains information that goes beyond the pure text of the consent and is therefore likely to overshadow the consent itself. This creates the risk that the data subject will not actively acknowledge their consent to the processing of their data, and that it will be overlooked, for example, when confirming the terms and conditions. The consent text must be formatted in such a way that it is clearly legible and recognizable and stands out from the rest of the declaration (see Heckmann/Paschke in Ehmann/Selmayr, Datenschutzgrundverordnung² [2018] Art. 7, para. 78f). A document constitutes a different matter if it contains information that goes beyond the pure consent text and is therefore likely to overshadow the consent. This creates the risk that the data subject will not actively acknowledge the consent to the processing of their data and that it will be overlooked, for example, when confirming the terms and conditions. The consent text must therefore be formatted in such a way that it is clearly legible and recognizable and stands out from the rest of the declaration (see Heckmann/Paschke in Ehmann/Selmayr, Datenschutzgrundverordnung² [2018] Art. 7, para. 78f).
... Closely related to the transparency of content, it must also be noted that, according to the definition in Article 4(11) GDPR, consent must be given with full knowledge of the facts ("an informed and unambiguous indication of the data subject's wishes"). The data subject must be able to assess the consequences of giving consent for them; in particular, they must be able to clearly and unambiguously understand the circumstances of the data processing and the scope of the consent. The information must therefore be presented in such a way that it is understandable even to an average consumer without specific legal training (Buchner, Art. 7, para. 59f). This is intended to prevent data subjects from being overwhelmed by the language or misled by appealing but irrelevant formulations (see Heckmann/Paschke in Ehmann/Selmayr, Datenschutzgrundverordnung² [2018] Art. 7, para. 82). Closely related to substantive transparency, it must also be noted that, according to the definition in Article 4, point 11, GDPR, consent must also be given with full knowledge of the facts ("informed and unambiguous indication of the data subject's wishes"). The data subject must be able to assess the consequences of giving consent for them; in particular, they must be able to clearly and unambiguously understand the circumstances of the data processing and the scope of the consent. The information must therefore be presented in such a way that it is understandable even to an average consumer without special legal training (Buchner, Article 7, paras. 59f). This is intended to prevent data subjects from being overwhelmed by the language or misled by appealing but irrelevant formulations (see Heckmann/Paschke in Ehmann/Selmayr, Datenschutzgrundverordnung² [2018] Article 7, para. 82).
As already explained, the data protection consent declaration in question was not obtained separately by the complainant for either the flyer or the website, but rather together with the registration for XXXX and the required confirmation of its terms and conditions and privacy policy.
In both cases, the complainant failed to meet the transparent requirements for the written consent declaration as stipulated in Article 7(2), first sentence, of the GDPR. The complainant failed to meet the transparent requirements for the written declaration of consent stipulated in Article 7, paragraph 2, first sentence of the GDPR in both cases.
The respondent authority correctly pointed out, with regard to the flyer, that the complainant placed the signature field at the end of the form, thereby creating the overall impression that it was actually a signature for participation in the customer program. This impression is reinforced by the fact that the field is located directly next to the date field, which is designated as mandatory for registration. Regarding the (larger) distance from the consent text, the respondent authority is also correct in asserting that this reinforces the impression that it could be a signature for the program. The accompanying note stating that this signature applies only to the declaration of consent does not change this, as it is not in any way highlighted from the rest of the text and therefore not particularly noticeable. Furthermore, it is positioned to the left, below the mandatory "Date" field, and not directly below the signature field. The fact that the "Signature" field is not marked with an asterisk as a mandatory field does not negate this impression, because – as the respondent authority correctly stated – an average consumer would not assume that a signature field placed at the end of a registration form is mandatory, but rather that the signature serves to confirm registration for XXXX. The respondent authority already correctly pointed out, with regard to the flyer, that the appellant placed the signature field at the end of the form, thereby conveying the overall impression that it is actually a signature for participation in the customer program. This impression is further reinforced by the fact that the field is placed directly next to the date field, which is designated as mandatory for registration. Regarding the (greater) distance from the consent text, the respondent authority is also correct in asserting that this reinforces the impression that it could be a signature for the program. The fact that the note placed below states that this signature applies only to the declaration of consent does not change this, because it is in no way highlighted from the rest of the text and therefore not particularly noticeable. Furthermore, it is also positioned to the left, below the mandatory "Date" field and not directly below the signature field. The fact that the "Signature" field is not marked with an asterisk as a mandatory field does not dispel this impression either, because – as correctly stated by the respondent authority – an average consumer would not assume that a signature field – which is placed at the end of a registration form – is mandatory, but rather that the signature serves to confirm the registration for Roman 40.
Overall, the respondent authority is correct in asserting that, due to the visual design of the consent form during the physical registration process, a customer would not have actively perceived that they were actually signing a consent form for data profiling. Therefore, the consent obtained via flyer does not meet the criteria of Article 7(2), first sentence, GDPR, as the respondent authority explained.
The same applies to the website. Here, too, the authority in question correctly stated that an average consumer would not assume, based on the bold heading of the consent form "Enjoy your exclusive benefits," that this actually concerns obtaining consent for profiling. The subsequent consent text ("Yes," "No") also provides no indication of this, but rather makes the receipt or non-receipt of "exclusive" benefits dependent on the submission or non-submission of data processing in accordance with the "declaration of consent below." This wording (also suggested by the heading) is not only misleading because, according to the complainant's own business model, even those who do not consent to data matching are supposed to receive "exclusive" benefits upon registration. Rather, it also results in individuals being misled into submitting a declaration of consent without being aware of the actual consequences. The fact that the data subject is ultimately informed about the data matching in question, according to the "declaration of consent below," does not change anything, because they first have to scroll down the text and the information about profiling is only visible then and, moreover, is not highlighted in bold compared to the heading. Ultimately, the respondent authority is correct in asserting that it must be clear "at a first level" (based on the heading) what the consent actually relates to. Therefore, the appellant's argument that the data subject is informed about profiling in the terms and conditions and the privacy policy, and that this information is highlighted in bold, is also invalid.
Ultimately, the respondent authority's argument that the data subject is informed about profiling in bold in the terms and conditions and the privacy policy is also unfounded. Insofar as the complainant points out that the data subject is explicitly reminded in the overview table, before completing their registration, of the requirement to give consent to profiling, and is redirected back to this page by clicking a pencil icon, it must be noted that this again primarily draws the data subject's attention to receiving benefits and thus creates the (misleading) impression that receiving "exclusive" benefits depends on giving consent. This impression is further reinforced by the statement in the overview table that the registration process can only be completed after submitting a declaration regarding profiling (which is not otherwise designated as a mandatory field).
Therefore, the respondent authority is correct in its assessment that the consent obtained via the website does not meet the criteria of Article 7(2), first sentence, GDPR.
The respondent authority is correct in its assessment that the consent obtained via the website does not meet the criteria of Article 7(2), first sentence, GDPR. According to the explicit wording of Article 7(2), last sentence, of the GDPR, parts of a consent declaration are not binding if they constitute an infringement of this Regulation.
Since the consent requests reviewed here, using the "flyer" and website methods – as explained above – do not comply with the requirements of Article 4(11) and Article 7(2) of the GDPR, they are invalid consent declarations.
Since the consent requests reviewed here, using the "flyer" and website methods – as explained above – do not comply with the requirements of Article 4(11) and Article 7(2) of the GDPR, they are invalid consent declarations. The requirements of Article 6(1)(a) GDPR (consent) are therefore not met.
The complainant argued in the proceedings that the data processing in question could also be based (alternatively) on Article 6(1)(f) GDPR or Article 6(4) GDPR.
The complainant argued in the proceedings that the data processing in question could also be based (alternatively) on Article 6(1)(f) GDPR or Article 6(4) GDPR. The view of the respondent authority that an invalid declaration of consent in any case results in unlawful data processing and renders a review of other legal bases unnecessary cannot be followed – as already explained in more detail in the judgment of 31 August 2021 (see also ECJ 4 July 2023, C-252/21, ECLI:EU:C:2023:537, para. 92).
The Court of Justice of the European Union (CJEU) held that an invalid declaration of consent in any case results in unlawful data processing and renders a review of other legal bases unnecessary. In its ruling of February 8, 2022, Ro 2021/04/0033-8, the Administrative Court has already clarified that the purpose of the proceedings is to review the lawfulness of the data processing in question within the meaning of Article 6 of the GDPR, and that the respondent authority or the reviewing court must therefore examine the existence of any (further) legal justifications.
The Administrative Court has also already clarified in its ruling of February 8, 2022, Ro 2021/04/0033-8, that the purpose of the proceedings is to review the lawfulness of the data processing in question within the meaning of Article 6 of the GDPR, and that the respondent authority or the reviewing court must therefore examine the existence of any (further) legal justifications. Since the GDPR does not establish any specific admissibility requirements regarding the data processing of "profiling" at issue here, no restriction of the scope of application of Article 6 GDPR is apparent in this respect either. Article 22 GDPR does not regulate the admissibility of profiling per se, but rather the use of certain results of such data processing. Whether and how personal data may be processed automatically for the purpose of personality assessment is therefore not determined by Article 22 GDPR, but – as is evident from Recital 72 of the GDPR – by the general rules of the GDPR concerning the principles and lawfulness of data processing (see Buchner in Kühling/Buchner, Datenschutz-Grundverordnung, BDSG3 [2020], Article 22, para. 11). Since the GDPR does not establish any specific admissibility requirements regarding the data processing of "profiling" at issue here, no restriction of the scope of application of Article 6 GDPR is apparent in this respect either. Article 22 of the GDPR does not regulate the permissibility of profiling per se, but rather the use of certain results of such data processing. Whether and how personal data may be processed automatically for the purpose of personality assessment is therefore not determined by Article 22 of the GDPR, but—as is clear from Recital 72 of the GDPR—by the general rules of the GDPR concerning the principles and lawfulness of data processing (see Buchner in Kühling/Buchner, Datenschutz-Grundverordnung, BDSG3 [2020], Article 22, para. 11).
Furthermore, it is also clear from Article 21(1) and (2) of the GDPR that the European legislator intended to consider other legal bases for profiling, in particular the legal basis of Article 6(1)(f) of the GDPR. Furthermore, Article 21, paragraphs 1 and 2 of the GDPR clearly indicate that the European legislator intended to consider other legal bases for profiling, including, but not limited to, the legal basis for processing under Article 6, paragraph 1, letter f of the GDPR.
According to Article 6(1)(f) of the GDPR, the processing of personal data is only lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
According to Article 6(1), letter f of the GDPR, the processing of personal data is only lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Thus, according to this provision, the processing of personal data is permissible under three cumulative conditions: firstly, the controller or a third party must pursue a legitimate interest; secondly, the processing of the personal data must be necessary for the purposes of the legitimate interest; and thirdly, the interests or fundamental rights and freedoms of the data subject whose data are to be protected must not override those interests (see, inter alia, Austrian Administrative Court [VwGH] Ro 2020/04/0037, para. 52; European Court of Justice [ECJ] 4 July 2023, C-252/21, ECLI:EU:C:2023:537, para. 106). The interests of the person whose data is to be protected do not outweigh the interests of the data subject (see, among others, VwGH Ro 2020/04/0037, para. 52; ECJ 4.7.2023, C-252/21, ECLI:EU:C:2023:537, para. 106).
In its judgment of 4 July 2023, the CJEU expressly held that such processing can only be considered necessary for the purposes of the legitimate interests pursued by the controller or a third party if the controller in question has informed the users from whom the data were collected of the legitimate interest pursued by the data processing, if this processing is limited to what is strictly necessary to achieve that legitimate interest, and if, after weighing the competing interests and taking into account all relevant circumstances, it is clear that the interests or fundamental rights and freedoms of those users do not override the legitimate interest of the controller or a third party (CJEU 4 July 2023, C-252/21, ECLI:EU:C:2023:537, para. 126).
CJEU 4 July 2023, C-252/21, ECLI:EU:C:2023:537, para. 126. Furthermore, Recital 47 of the GDPR states that the interests and fundamental rights of the data subject may override the interests of the controller, particularly where personal data are processed in situations where a data subject cannot reasonably expect such processing.
As the investigation has revealed, the data processing in question serves the purpose of personalized advertising. According to Recital 47, the processing of personal data for direct marketing purposes can, in principle, be considered processing carried out in the legitimate interests of the controller (see CJEU 4 July 2023, C-252/21, ECLI:EU:C:2023:537, para. 115). In the present case, it is also significant that the data subject affected by the data processing in question is already a customer of the complainant as a result of their registration for XXXX. An existing customer relationship also establishes a legitimate interest in contacting the customer with direct marketing (see Ehmann in Simitis/Hornung/Spiecker [eds.], Datenschutzrecht [2019], Appendix 3 to Art. 6, para. 26). As the investigation has revealed, the data processing in question serves the purpose of personalized advertising. According to Recital 47, the processing of personal data for the purpose of direct marketing can, in principle, be considered processing carried out in the legitimate interest of the controller (see ECJ 4.7.2023, C-252/21, ECLI:EU:C:2023:537, para. 115). Furthermore, it is significant in the present case that the data subject affected by the data processing in question is already a customer of the complainant as a result of their registration with Roman 40. An existing customer relationship also establishes a legitimate interest in contacting the customer with direct marketing (see Ehmann in Simitis/Hornung/Spiecker [eds.], Datenschutzrecht [2019], Appendix 3 to Article 6, para. 26).
Regarding the requirement of necessity, it should be noted that the data required for addressing (name and physical or electronic address) must be considered necessary for the purpose of direct marketing. In the case of existing customers or members, the necessity may also extend to certain basic characteristics (age, gender) as well as past transactions and inferred preferences and interests, particularly if this data is used as a selection criterion for more targeted advertising (see Ehmann in Simitis/Hornung/Spiecker [eds.], Datenschutzrecht [2019], Appendix 3 to Article 6, paras. 29 and 40). Regarding the requirement of necessity, it should be noted that the data required for addressing (name and physical or electronic address) must be considered necessary for the purpose of direct marketing. In the case of existing customers or members, the necessity may also extend to certain basic characteristics (age, gender), as well as past transactions and inferred preferences and interests, particularly if this data is used as a selection criterion for more targeted advertising (see Ehmann in Simitis/Hornung/Spiecker [eds.], Datenschutzrecht [2019], Appendix 3 to Article 6, paras. 29 and 40).
[The text abruptly ends here, so the translation stops as well.] In the present case, as established, the participation data (name, address, etc.) was automatically linked with the member's purchase data (shopping location, product, etc.) in such a way that a preference regarding the member's purchasing behavior (e.g., XXXX preference) could be derived and thus targeted with advertising. This (participation) data was disclosed to the complainant, on the one hand, during registration, including by the member themselves, and on the other hand, this (purchase) data was transmitted to the complainant by the respective partner, among other things, for the purpose of processing the customer loyalty program. In the present case, there are no grounds to doubt the lawfulness of the complainant's processing of this data. Likewise, as stated above, there are no concerns that such data is necessary and appropriate for achieving the present purpose of personalized advertising. The fact that the complainant – as stated by the respondent authority in its preliminary decision on the appeal – based the data processing in question on data "on which date, at what time, with which operating system, with which browser, in which geolocation (including the X and Y coordinates), a data subject opened (or did not open) certain electronic advertisements" has not emerged – as already explained above – throughout the entire proceedings. In the present case, as established, the participation data (name, address, etc.) were automatically linked with the member's purchase data (place of purchase, product, etc.) in such a way that a preference regarding the member's purchasing behavior (e.g., Roman numeral 40 preference) could be derived and thus targeted advertising could be addressed to them. This (participation) data was disclosed to the complainant, on the one hand, during registration, including by the member themselves, and on the other hand, this (purchase) data was transmitted to the complainant by the respective partner, among other things, for the purpose of processing the customer loyalty program. In the present case, there are no grounds to doubt the lawfulness of the data processing by the complainant. Likewise, as stated above, there are no concerns that such data are necessary and appropriate for achieving the present purpose of personalized advertising. The fact that the complainant—as stated by the respondent authority in its preliminary decision on the appeal—based the data processing on "the date, time, operating system, browser, and geolocation (including the Roman numeral and Y coordinates) at which a data subject opened (or did not open) specific electronic advertising" has not emerged during the entire proceedings, as already explained above.
Furthermore, the complainant was informed during registration that this data would be used, among other things, for the purpose of personalized advertising and thus, among other things, in the complainant's legitimate interest through profiling.
Moreover, the complainant was informed by the complainant during the registration process that this data would be used, among other things, for the purpose of conducting personalized advertising and thus, among other things, in the complainant's interest in this regard.
Furthermore, the complainant was informed by the complainant during registration that this data would be used, among other things, for the purpose of conducting personalized advertising and thus, among other things, in the complainant's interest in this matter. The complainant relied solely on Article 6(1)(a) GDPR and further stated in its terms and conditions that such data processing would only be carried out "if the member consents." However, this implied to the data subject that the data subject had control over the implementation of such data processing. Since, as already explained, the data subjects in this case did not perceive any consent to the profiling in question, either on the flyer or on the website, they had to assume, given the wording "only if the member consents," that such data processing would not take place. The complainant relied solely on Article 6(1)(a) GDPR and further stated in its terms and conditions that such data processing would only be carried out "if the member consents." However, this implied to the data subject that the data subject had control over the implementation of such data processing. Since, in the present case, the individuals concerned did not perceive any consent to the profiling in question, either on the flyer or on the website – as already explained – they had to assume, given the wording "only if the member consents," that such data processing would not take place.
It is acknowledged that participants in XXXX are explicitly interested in needs-based benefits and therefore generally expect to receive information about them. However, the fact that their data is automatically linked by the complainant to create a profile of their personal shopping preferences cannot be considered part of such an expectation. Rather, this would have required a corresponding notification from the complainant (cf. Art. 13 para. 2 lit. f GDPR and Dix in Simitis/Hornung/Spiecker [eds.], Datenschutzrecht [2019], Art. 13, para. 16; Bäcker in Kühling/Buchner, Datenschutz-Grundverordnung, BDSG3 [2020], Art. 13, para. 52 with reference to the wording "at least"). It is acknowledged that participants in the Roman numeral 40 are explicitly interested in needs-based benefits and therefore generally expect to receive information about them. However, the fact that their data is automatically linked by the complainant to create a profile of their personal shopping preferences cannot be covered by such an expectation. Rather, this would have required a corresponding notification from the complainant (see Article 13, paragraph 2, letter f, GDPR and Dix in Simitis/Hornung/Spiecker [eds.], Datenschutzrecht [2019], Article 13, para. 16; Bäcker in Kühling/Buchner, Datenschutz-Grundverordnung, BDSG3 [2020], Article 13, para. 52 with reference to the wording "at least").
In the present case, such notification did not occur due to the complainant's contrary information, which stated that the data processing in question would only be carried out "if the member consents."
Since the data subjects not only did not expect data processing in the present form of profiling, but had even explicitly excluded such processing in light of the complainant's statements in its terms and conditions, the data subjects' interest in confidentiality outweighs the complainant's legitimate interests when considered as a whole. Article 6(1)(f) GDPR is therefore not applicable.
Since the data subjects not only did not expect data processing in the present form of profiling, but had even explicitly excluded such processing in light of the complainant's statements in its terms and conditions, the data subjects' interest in confidentiality outweighs the complainant's legitimate interests when considered as a whole. Article 6(1)(f) GDPR is therefore not applicable.
The same applies, however, to the provision of Article 6(4) GDPR, also invoked by the complainant, and the possibility of a change of purpose granted therein.
According to this provision, the controller may, pursuant to the second part of paragraph 4, examine whether a change of purpose is compatible with the purpose for which the personal data were originally collected. In doing so, the controller must consider various criteria specified in points (a) to (e), including, pursuant to point (b), the context in which the personal data were collected, in particular with regard to the relationship between the data subjects and the controller. According to Recital 50, the decisive factor is "the context in which the data were collected, in particular the reasonable expectations of the data subject, based on their relationship with the controller, regarding the further use of this data […]". According to this provision, the controller may, pursuant to the second part of paragraph 4, assess whether a change of purpose is compatible with the purpose for which the personal data were originally collected. In doing so, the controller must consider various criteria specified in points a to e, including, according to point b, the context in which the personal data were collected, in particular with regard to the relationship between the data subjects and the controller. Recital 50 states that the decisive factor is "the context in which the data were collected, in particular the reasonable expectations of the data subject, based on their relationship with the controller, regarding the further use of this data […]".
Accordingly, the actions of the controller and the resulting expectations of the data subject are crucial for this criterion. Purpose compatibility cannot be assumed if the data subject could not reasonably expect that the controller would further process their personal data for a different purpose. Before any further processing, the controller must inform the data subject at least about the purposes and any change of purpose. Such information also includes profiling measures. These can only be considered compatible if they were foreseeable for the data subject at the time of data collection. Data subjects cannot reasonably expect profiling that was not previously known; it does not correspond to their reasonable expectations (see Albrecht in Simitis/Hornung/Spiecker [eds.], Datenschutzrecht [2019], Art. 6 para. 4, paras. 43 et seq., in particular paras. 47 and 51). Accordingly, the actions of the controller and the data subject's resulting expectations are crucial for this criterion. Purpose compatibility cannot be assumed if the data subject could not reasonably expect that the controller would further process their personal data for a different purpose. In such cases, the controller must inform the data subject about the purposes and any change of purpose before any further processing. This information also includes profiling measures. Such measures can only be considered compatible if they were foreseeable for the data subject at the time the data was collected. Data subjects cannot reasonably expect profiling that was not previously known; it does not correspond to their reasonable expectations (see Albrecht in Simitis/Hornung/Spiecker [eds.], Datenschutzrecht [2019], Article 6, paragraph 4, paras. 43 et seq., in particular paras. 47 and 51).
As already explained with regard to Article 6(1)(f) GDPR, the information provided by the complainant does not meet these requirements. Accordingly, the appellant could not rely on Article 6(4) GDPR. The information provided by the appellant does not meet these requirements – as already explained with regard to Article 6(1), letter f, GDPR. Therefore, the appellant could not rely on Article 6(4) GDPR.
No other applicable legal bases are apparent, nor have any been presented.
The decision was therefore rendered accordingly, whereby – as also noted by the appellant – point 2 of the preliminary decision on the appeal had to be adapted in light of the elimination of point 1, and point 3 of the preliminary decision on the appeal had to be adapted accordingly due to the lack of a commencement date for the performance period.
B) Admissibility of the appeal on points of law:
Pursuant to Section 25a(1) of the Administrative Court Act (VwGG), the Administrative Court must state in the operative part of its judgment or decision whether the appeal on points of law is admissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG). The ruling must be briefly reasoned. Pursuant to Section 25a, paragraph 1, of the Administrative Court Act (VwGG), the Administrative Court must state in the operative part of its judgment or decision whether an appeal on points of law is admissible under Article 133, paragraph 4, of the Federal Constitutional Law (B-VG). The ruling must be briefly reasoned.
The appeal on points of law is admissible under Article 133, paragraph 4, of the Federal Constitutional Law (B-VG) because the decision depends on the resolution of a legal question of fundamental importance. Specifically, there is no supreme court case law on the drafting of a consent declaration under the GDPR. The appeal on points of law is admissible under Article 133, paragraph 4, of the Federal Constitutional Law (B-VG) because the decision depends on the resolution of a legal question of fundamental importance. Specifically, there is no supreme court case law on the drafting of a consent declaration under the GDPR.
