DSB (Austria) - 2021-0.432.224
From GDPRhub
| DSB (Austria) - 2021-0.432.224 | |
|---|---|
 | |
| Authority: | DSB (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 4(11) GDPR Article 6(1)(a) GDPR Article 6(1)(f) GDPR § 1(1) DSG |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | 03.08.2018 |
| Decided: | 16.08.2021 |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | 2021-0.432.224 |
| European Case Law Identifier: | ECLI:AT:DSB:2021:2021.0.432.224 |
| Appeal: | n/a |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (RIS) (in DE) |
| Initial Contributor: | Heiko Hanusch |
The Austrian DPA held that, according to the circumstances of this case, a controller did not violate Articles 4(11), 6(1)(a) and 7 GDPR by using a pre-ticked box, because the purpose of this box was to give the data subject the opportunity to object against the processing under Article 21 GDPR and not to obtain its consent.
English Summary
Facts
The controller is active in the field of address trading and direct marketing. It offers its customers the service to store (within a pre-determined period of time) incoming mails at one of its offices, which is close to the customer's residential or company address. The data subject ordered this service on-site by filling in a form at a touch-pad terminal which asked for his name, address and date of birth. The form also contained a note that the data can be transferred to third parties for the purpose of direct marketing and that the customer can forbid this transfer by unticking the pre-ticked box below. The text on the side of the pre-ticked box said "I do not object to the transfer of data".
Afterwards the data subject lodged a complaint with the Austrian DPA (DSB) arguing that the controller violated Articles 4(11), 6(1)(a) and 7 GDPR because the box was pre-ticked and, therefore, the consent to the processing was not given freely. The controller argued that it processes this data under Article 6(1)(f) GDPR and the purpose of the box is not to obtain consent from its customers but rather to give them the opportunity to object against the processing according to Article 21 GDPR. It further stated that it did not transfer any information of the data subject to a third party since the data subject objected against the transfer.
Holding
The DSB rejected the complaint because it did not find any violation of the GDPR by the controller. The DSB found that no transfer to third parties took place and that the controller did not violate Articles 4(11), 6(1)(a) and 7 GDPR, because the purpose of the pre-ticked box was to give the data subject the possibility to object against the transfer and not obtain its consent.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
GZ: 2021-0.432.224 from August 16, 2021 (case number: DSB-D205.235)
[Note editor: Names and companies, legal forms and product names,
Addresses (incl. URLs, IP and email addresses), file numbers (and the like), etc., as well as
their initials and abbreviations may be abbreviated for reasons of pseudonymization
and/or changed. Obvious spelling, grammar and punctuation errors
have been corrected.]
NOTICE
S P R U C H
The DPA decides on Gustav A***'s privacy complaints
(Appellant) of August 3, 2018 and June 25, 2019 (ha. received on June 27
2019) against N*** AG (respondent) for alleged infringement of the law
secrecy as follows:
- The complaints are dismissed.
Legal bases: Art. 4 Z 11, Art. 7, Art. 51 (1), Art. 57 (1) lit. f and Art. 77 (1).
of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ.
No. L 119 of 4.5.2016 p. 1; §§ 1, 18 para. 1 as well as 24 para. 1 and para. 5 of the
Data Protection Act (DSG), Federal Law Gazette I No. 165/1999 as amended.
REASON
A. Submissions of the parties and course of the proceedings
1. The complainant raised with his procedural submission of 3 August
2018 (ho. received on the same day) a complaint under Art. 77 GDPR because of the
"Unlawful obtaining of consent to data transfer (violation of Art. 7
GDPR)” and requested a declaration that his rights had been violated. The procedure was
led under the GZ: D123.289.
To justify this, he explained that when setting up a leave* subject (basically)
the customer's consent to the transfer of address data to third parties is obtained and
this transfer the transmission to companies for direct marketing purposes and
Address publishers would include. The consent is part of the contract and
not clearly separated from other matters. It is essential here that in
the appropriate box is already ticked for approval. Should one
Passing on of the data is not desired, the customer must actively cross this
remove. This is also evident from the consent text, which states: “You are
entitled to prohibit the transmission to third parties for marketing purposes at any time and without giving reasons. If so, uncheck the box below
the cross or judge …”.
In addition, the complainant described that the contract processing at the counter via
an electronic terminal will be processed. The screen size of this terminal is
relatively small and will also be in this terminal the consent text with the
preselected cross is displayed. This will also make it more difficult to read the consent text
from the actual text of the contract. The customer's signature is successful
also on this terminal. Due to the small font size of contract and
In the case of a consent text, it is particularly difficult for people with visual impairments to read the text
to read correctly and could thereby the actual intention of the already set cross
be misunderstood, because only its removal requires the consent, with which the
Customer may decide contrary to his own motivation. Last include the
Consent to data transfer including data of possible co-users of the *folder.
2. Within the framework of the statement issued by the data protection authority on
August 20, 2018, the Respondent initially stated for clarification that the
Complainant on the occasion of the conclusion of a "holiday * subject agreement" of
have objected to the data transfer that is the subject of the complaint and
Respondent therefore does not receive any personal data of the complainant
use for marketing purposes.
With regard to the question of legally effective consent, the Respondent submitted that
that the form does not require active consent to the transfer of data to third parties
and there is no breach of data protection law in the procedure complained of. For one, act
the Respondent is the holder of a trade license
Address publisher and direct marketing company according to § 151 GewO. On the other hand
every person who applies for a leave* subject, the one provided in accordance with the GewO
Information is given and the possibility is given of an otherwise permissible
To prohibit the use of data for third-party marketing purposes. So be the complainant
a prohibition not only immediately upon application to the office of
Respondent, but also later at any time and over several
contact possibilities were possible. Furthermore, § 151 GewO derogates as lex specialis
provisions of the GDPR and is not an active action/consent in this regard
intended.
The information is provided via touch pad in the accepting office
customer friendly. The fact that the information text is directly above the signature field serves the purpose
higher attention of the person concerned. All employees are instructed to
To support people who indicate that they would have difficulty reading or understanding the text. So be it for the complainant – so how
Any other customer – also been able to sign the application form before
printed out for you to read and only then to sign it. Also on one
Sufficient font size is respected, this amounts to both on the touch pad and
also on the physical form 10 **, which is “the most possible under data protection law
'Reference size' of 8 ** exceeded."
In the present case, the Respondent assumes that the
Complainant read the information provided and he is correct
would have understood that by unticking the pre-ticked box he immediately
could have prohibited the use of data for marketing purposes. Even if he dies
Insufficient data information on the touch pad before his signature
perceived, the complainant still had a printout of the
signed form on paper and have it there or at any later time
point in time can prohibit the use of the data.
On the question of whether the requested "consent" was sufficiently separated from the text of the contract
the Respondent reiterated its view that this is not a
consent within the meaning of Art. 7 GDPR, but a (clearly defined by paragraph)
Information that is not part of the subject matter of the contract. If the
Complained information only after the signature of the customer and thus outside of the
Contractual text would be provided, the Respondent fears that this from the
affected customers would no longer be read or perceived.
With regard to the disputed rights of third parties, the Respondent
objected that the complainant's authority to represent under civil law only
with regard to the present contract and he also the data use of
have forbidden other recipients of the holiday*folder for marketing purposes.
3. The Respondent's statement was sent to the Complainant upon completion
the data protection authority of March 24, 2021, GZ: DSB-D123.289/0002-DSB/2018, to
brought to his knowledge and at the same time given him the opportunity to comment on this
to take, which the complainant left unused.
4. As part of the filing of June 25 (starting another appeals process).
2019 (ha. arrived June 27, 2019), revised July 25, 2019, reiterated the
Appellant essentially his submissions of August 3, 2018 in the context of
Complaints procedure GZ: D123.289, with the difference that the copy of the complaint
enclosed "holiday * subject agreement" was dated June 24, 2019 in this case. This
Procedure was logged for GZ: D205.235.,5. As part of the subsequent, essentially the submission of August 20, 2018
repeated statement of the Respondent of September 5, 2019
this also in this case the data due to an objection made by the
complainant had not been passed on. There is therefore a lack of
Complaint legitimacy.
6. The two complaints procedures D123.289 and D205.235 were set up in accordance with Section 39 (2) AVG
connected to the joint decision on GZ: D205.235 and the parties to the procedure
Completion of June 17, 2021 upon presentation of the investigation results, party hearing
granted.
7. After the extension of the deadline, the Respondent filed a submission dated July 22nd
2021 stipulates that the complainant's data will not be passed on to third parties for marketing purposes
had been passed on. The complainant has the right to object
in both cases already exercised in the Respondent's branch. the
The information texts at issue in the proceedings from the years 2018 and 2019 are up to date
no longer in use.
8. The complainant made no further statement.
B. Subject of Complaint
Based on the submissions of the complainant, it is clear that the subject of the complaint
the question is whether the Respondent thereby infringes the Complainant's right
Breached confidentiality by using the contract form to set up a
Holiday*fold processed data of the complainant for marketing purposes.
C. Findings of Facts
1. The respondent is a tradesman in the field of address publishing and
Direct marketing company according to § 151 GewO.
Among other things, the Respondent offers its customers the opportunity
to, (within a predetermined period of time) arriving shipments at the
responsible office of the residential or company address. The establishment of a
Such *fachs "holiday" can be ordered both online and on site in a branch.
If the order or the setting up of the *box takes place in a branch of the Respondent
location, a touch pad terminal provided there will be used for this purpose.
Evidence assessment: The findings made are based on the relevant
matching information from the parties to the proceedings in their submissions of the 3rd and 20th
August 2018 and an official search by the data protection authority. The complainant commissioned the facility in the office of his place of residence
a *fold "vacation" using the aforementioned touch pad terminal and was
between the Respondent and the Appellant on August 3, 2018
following agreement concluded (formatting not reproduced in 1:1):
*fold vacation
day month year day month year
Valid from: 13 06 2018 Valid until: 19 08 2018
Recipient: Price: EUR …
Mr A*** Gustav
Mister
woman
Previous address:
S***strasse 2-4/35
2***L***
The leave compartment is to be set up at:
N***stelle 2*** F***gasse 7
2***L***
The incoming shipments are ex
Picked up 08/20/2018.
phone email
The following are to be kept ready:
Letters and parcels (excl. RSa and RSb letters, parcel M with
Shipment tracking)
Newspapers, information, mail
amounts of money
I am responsible for any holiday specialist co-users listed at the end of the
Commissioned and authorized vacation subject.
The General Terms and Conditions for Holidays of N*** AG apply in the currently valid version,
available under n**at/* terms and conditions.
Information about data usage: your personal data (salutation, title,
First name, last name, date of birth, address) can be passed on to third parties by N*** AG
according to § 151 of the trade regulations for marketing purposes.
You are entitled at any time and without giving reasons to the transmission to
To prohibit third parties for marketing purposes. In this case, remove im
tick the box below or submit your objection
www.n**at/ kontakt, telephone 0******** or by writing to das
N***Customer Service, Z*gasse 34, 1*** W***.
I do not object to data transfer., v2.0
Identity of client verified Acquired on
Type of ID: Austrian driver's license Remarks of the N***:
Badge No.: Day Month Year
03 08 2018
Date of issue:
Displayed:
signature of the employee
Date Signature (company signature)
Form number: 8********
Evidence assessment: This finding is based on the procedural input from
August 3, 2018, particularly on the copy provided herein of a printout of between
agreement concluded between the parties to the proceedings, which the complainant – according to
according to his own statements - following his signing via touch pad terminal
was handed over and its authenticity by the Respondent to no one
timing was in doubt.
3. As part of placing the order or setting up the * compartment using the touch pad
Terminals the complainant - when calling up the relevant page - (also) about
the use of data in connection with the "Vacation" *subject to be set up
informed (formatting not reproduced in 1:1):
Information about data usage: your personal data (salutation, title, first name, last name,
date of birth, address) can be passed on to third parties by N*** AG in accordance with Section 151
Trade regulations for marketing purposes.
You are entitled at any time and without giving reasons to the transmission to third parties
prohibit marketing purposes. In this case, uncheck the box below
or address your objection to www.n**at/ kontakt, telephone 0******** or by means of
Write to N***Customer Service, Z*gasse 34, 1*** W***.
I do not object to data transfer.
The checkbox (shown above) with the note "I object to data transfer
not.” was pre-ticked here.
By clicking on the checkbox and thereby removing the cross, the
Data transfer for marketing purposes is prohibited.
Evidence assessment: The findings on the information provided and on the design of the
The forms are based on the corresponding information from the
Parties to the proceedings in the context of their submissions of August 3rd and 20th, 2018.,In particular, that the described and from the above figure(s) can be seen
checkbox is (basically) pre-ticked when calling up the relevant page
on the one hand from the relevant submissions of the complainant in the context of his
Complaint of August 3, 2018, which the respondent in her submission of
August 20, 2018 also confirmed insofar as she herself submits that the complainant
"Promptly consent to the use of the data by removing the pre-ticked box
marketing purposes."
On the other hand, this is clearly evident from the (obvious from the figure above) about
the (information) text of the checkbox that is the subject of the proceedings, according to which the
Transmission of personal data to third parties for marketing purposes is prohibited
could and the person concerned, among other things, “in this case the cross from the
[should remove] the following boxes.”
4. In the present case, by clicking on the checkbox and thereby
If you uncheck the box, the data transfer for marketing purposes is prohibited and has been
the ones collected in connection with setting up the "Holiday" *subject
personal data will not be passed on to third parties for marketing purposes.
Evidence assessment: On the one hand, this statement results from the above illustration of the
signed text of the contract, from which it is clear that in the described
Checkbox is not ticked and the complainant has the actual transmission
his personal data neither in his submission of August 3, 2018 nor to a
actually asserted at a later point in time. Second, the finding is based on
Information provided by the Respondent in its statement of August 20, 2018,
according to which the complainant "on the occasion of the completion of his holiday * professional
[have] objected to the agreement to the data transfer that is the subject of the complaint and
N*** AG therefore does not [use] any personal data for marketing purposes."
5. With the following agreement dated June 24, 2019, the complainant commissioned im
The following year again the establishment of a * subject "Holiday" using the
already mentioned touch pad terminals (formatting not reproduced in 1:1):
*fold vacation
day month year day month year
Valid from: 13 06 2018 Valid until: 19 08 2018
Recipient: Price: EUR ...., Mr. A*** Gustav, born *3. *1. 19**
Mrs. A*** Louise
Mr A*** Franz
Previous address:
S***strasse 2-4/35
2***L***
The leave* compartment is to be set up at:
N***stelle 2*** F***gasse 7
2***L***
The incoming shipments are ex
Picked up 07/15/2019.
phone email
The following are to be kept ready:
Letters and parcels (excl. RSa and RSb letters, parcel M with
Shipment tracking)
Newspapers, information, mail
amounts of money
I am responsible for any holiday specialist co-users listed at the end of the
Commissioned and authorized vacation subject.
The General Terms and Conditions for Holidays of N*** AG apply in the currently valid version,
available under n**at/* terms and conditions.
Information about data usage: your personal data (salutation, title,
First name, last name, date of birth, address) can be passed on to third parties by N*** AG
according to § 151 of the trade regulations for marketing purposes.
You are entitled at any time and without giving reasons to the transmission to
To prohibit third parties for marketing purposes. In that case tick that
check the boxes below or address your objection
www.n**at/ kontakt, telephone 0******** or by writing to das
N***Customer Service, Z*gasse 34, 1*** W***.
I do not agree to the transfer of data.
X
Identity of customer proven by: Acquired on: v2.0
Type of ID: Austrian driver's license Notes from the N***:
Badge No.: 2*********** Day Month Year
Date of issue: 1*.6. 20** 24 06 2019
Issued: bra *
signature of the employee
Date: Signature (company signature) Form number: 8********
Evidence assessment: This finding is based on the procedural input from
June 27, 2019, particularly on the copy provided herein of an expression of between
agreement concluded between the parties to the proceedings, which the complainant – according to
according to his own statements - following his signing via touch pad terminal
was handed over and its authenticity by the Respondent to no one
timing was in doubt.
6. As part of the order placement or setting up the * compartment using the touch pad
Terminals, the complainant - when calling up the relevant page - (also) about the use of data in connection with the "holiday" *folder to be set up
informed (formatting not reproduced in 1:1):
I have been commissioned to conclude the holiday compartment for any stated holiday compartment co-users and
authorized.
The General Terms and Conditions for Holidays of N*** AG apply in the currently valid version, available
e.g. at www.n**.at/ terms and conditions.
Information about data usage: your personal data (salutation, title, first name, last name,
date of birth, address) can be passed on to third parties by N*** AG in accordance with Section 151 of the Trade Regulations
be sent for marketing purposes.
You are entitled at any time and without giving reasons to the transmission to third parties
prohibit marketing purposes. If so, tick the box below or
address your objection to www.n**at/ kontakt , phone 0******** or by writing to the
N***Customer Service, Z*gasse 34, 1*** W***.
I do not agree to the transfer of data.
X
The checkbox (shown above) that says "I do not agree with data sharing
I agree.” was (initially) empty.
By clicking on the checkbox and setting a cross as a result, the
Data transfer for marketing purposes is prohibited.
Evidence assessment: The findings on the information provided and on the design of the
The forms are based on the corresponding information from the
parties to the proceedings.
7. In the present case, the complainant clicked on the checkbox
Data transfer for marketing purposes is prohibited and its related to
the personal data collected when setting up the "holiday" compartment is not passed on to third parties
forwarded for marketing purposes.
Evidence assessment: On the one hand, this statement results from the above illustration of the
signed text of the contract and the complainant has the actual transmission
his personal data neither in his submission of June 27, 2019 nor to a
actually asserted at a later point in time. Second, the finding is based on
Information provided by the Respondent in its statement of September 5, 2019,
according to which the complainant on the occasion of the conclusion of his holiday * compartment agreement
objected to the data transfer that is the subject of the complaint.
8. The agreements on the “*fold holiday” were as follows
Information letter enclosed (formatting not reproduced 1:1, in part
as far as relevant to the procedure): information on the use of data in accordance with data protection
Basic Regulation (GDPR):
N*** AG (address: N*** customer service, Z***gasse 34, 1***, W*** I E-
Mail:
kunden-service@n**.com I Tel. 0******) processes your data for the following purposes:
allocation of shipments
Your data will be used for logistics purposes, because without this data, the desired
Delivery of shipments is not possible. Even after the end of the contract, name and
Address of all persons continue to be processed to deliver shipments. The data storage
after the end of the contract takes place in the legitimate interest of N*** AG
To be able to deliver shipments automatically and thus quickly and cost-effectively.
The legal basis for this use of data is the contract with you and Article 6 Paragraph 1 Letter b
and f GDPR.
marketing
N*** AG has a legitimate interest in advertising its services and products.
Therefore, your data (salutation, title, first name, last name, date of birth,
address) used to provide you with information about the products and services of
to be sent to N*** AG. In addition, your data (salutation, title, first name, last name,
date of birth, address) for marketing purposes of third parties (activities as
address publishers and direct marketing companies). If you agree to the use of your data
If you have not objected to third-party marketing purposes, this data can be used by companies
Direct marketing purposes are transmitted. You are at any time and without giving a reason
entitled to prohibit the use of the data for marketing purposes. In this case
address your objection to www.n**at/ kontakt, telephone 0******** or by letter
to N***Customer Service, Z***gasse 34, 1***, W***.
The legal basis for marketing use is Article 6 Paragraph 1 Letter f GDPR in conjunction with
Recital 47 and Section 151 GewO.
Duration of data storage
Your contract for the vacation compartment will be stored for up to 3 years after the end of the contract, if
you have objected to the use of data for marketing purposes by third parties, otherwise as long as
Your data will be used for marketing purposes, i.e. until you object to the
marketing use. Everyone's name and address will be saved as long as they are relevant to the
delivery of shipments are required.
Your rights
If you wish, we will provide you with information about your personal data at any time,
that we process. In addition, you also have a right to data portability in some cases,
Restriction of processing, correction or deletion of your personal data
as well as a right to object to the processing. Besides, you have one
Opportunity to lodge a complaint with the Austrian data protection authority.
D. In legal terms it follows that:
1.) The complainant brought in his the proceedings to GZ: D123.289 constitutive
Filing dated August 3, 2018, that he filed a complaint about the "illegitimate solicitation
a consent to the transfer of data" and he supported his arguments in
Essentially, that the Respondent in the context of setting up a
Holiday*fold for consent to the transfer of personal data to third parties
for marketing purposes by ticking a checkbox and thus against Art. 7
GDPR violates.
2.) The data protection authority has already stated that the rights of data subjects in
Chapter III GDPR (Art. 12 to 23) are listed exhaustively, a data subject in
However, as part of a complaints procedure, any provision of the GDPR can be relied on if this results in a possible violation of the right to confidentiality
according to § 1 paragraph 1 DSG (cf. DSB from September 13, 2018, DSB-D123.070/0005-
DSB/2018, according to which a breach of Art. 32 DSGVO by the person responsible leads to a
violation of § 1 para. 1 DSG).
3.) In principle, it is possible that a data subject has the right to
Confidentiality is violated that the request for consent to processing under
Use of a method that does not meet the requirements for consent
Art. 4 Z 11 GDPR and Art. 7 Para. 2 GDPR.
4.) Against this background and in view of the fact that according to stRsp of the VwGH
Party declarations (also attaching [Walter/Kolonovits/Muzak/Stöger Rz 152]) in the
Procedures are to be interpreted exclusively according to their objective explanatory value (cf. also
VwGH November 6, 2006, 2006/09/0094; m.w.N.) and what is decisive is how the declaration (cf.
Administrative Court of July 28, 2000, 94/09/0308 and others) taking into account the concrete legal
Regulation, the purpose of the procedure and the situation in the files must be understood objectively (VwGH
1994-01-24, 93/10/0192; 6 Nov 2001, 97/18/0160; January 19, 2011,
2009/08/0058; cf. also VfSlg 17.082/2003), with regard to the submission of August 3, 2018
to proceed from a complaint because of the violation of the right to secrecy.
5.) The complainant also complained in the context of the complaints procedure
to the GZ: D205.235 introductory submission of July 25, 2019, the impermissible obtaining of a
Consent or, as a result, unlawful processing of his personal data
data and concluded therefrom a violation of the right to secrecy.
6.) Against the background of the essentially identical complaint and
Facts of the case, the procedural connection proved to be objective within the meaning of § 39 para. 2 AVG
expedient for reasons of process economy.
7.) With regard to the complaint, it should be noted at the outset that Art. 77 (1) GDPR as
also § 24 para. 1 DSG expressly stipulates that the right to collect a
A complaint to the supervisory authority only exists if the data subject
Is of the opinion that the processing of the personal data concerning you is against the
DSGVO or § 1 or Art. 2 of the first main part DSG violates. The wording of the law
therefore requires actual processing of the data subject's personal data.
8.) As can be seen from the findings, were objectively true
undisputed personal data of the complainant (in particular
and surname, date of birth, address) as part of the conclusion of the "*fold vacation" contract
recorded and consequently also within the meaning of Art. 4 Z 2 DSGVO for the purpose of fulfilling the contract by the
Respondent processed. However, this did not come to pass for the complainant
Point in time complained. 9.) Contrary to the complainant's view, however, there was neither a
Obtaining a data protection consent, nor a (further) processing
Marketing purposes of third parties:
10.) Both from the wording of the agreement of the *subject "Vacation" from 2018 ("I
do not object to the transfer of data.”) and from 2019 (“I am with a
I do not agree to the transfer of data.") it becomes apparent that clicking on the "checkbox"
no affirmative declaration of intent to data processing within the meaning of Art. 4 Z 11 DSGVO
express, but rather a rejection in the form of an objection in accordance with Article 21 leg.
cit. should allow. Incidentally, this also emerges from the findings
underlying information letter from the Respondent, from which it is clear
it becomes clear that the data processing for marketing purposes of third parties on the
Legal basis "legitimate interests" (Art. 6 Para. 1 lit. f GDPR) and from which
the complainant, according to his own statements, also became aware of it.
11.) In the present case, the complainant has just clicked on the
(pre-ticked) checkbox effective objection and is therefore not dated
Complainant complained about disclosure or other processing of his
personal data for marketing purposes.
12.) Thus, according to the verdict, it was to be decided.
