DSB (Austria) - 2025-0.587.686
From GDPRhub
| DSB - 2025-0.587.686 | |
|---|---|
 | |
| Authority: | DSB (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 4 GDPR Article 6 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 19.03.2025 |
| Decided: | 24.07.2024 |
| Published: | 20.02.2026 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 2025-0.587.686 |
| European Case Law Identifier: | ECLI:AT:DSB:2025:2025.0.587.686 |
| Appeal: | Unknown |
| Original Language(s): | German |
| Original Source: | RIS (in DE) |
| Initial Contributor: | xz |
The DPA held that a real estate company unlawfully processed a data subject’s personal data by contacting him despite his explicit statement in an online advertisement that real estate agents were not welcome. Reliance on legitimate interests under GDPR failed because the data subject’s clear objection outweighed the controller’s commercial interests.
English Summary
Facts
The data subject published an online advertisement offering a property for sale on a public marketplace website. The advertisement contained his name and telephone number and included, prominently at the beginning of the description, the statement “Makler sind nicht erwünscht!” (“No real estate agents!”).
Despite this explicit notice, a real estate company (the controller) used the contact details contained in the advertisement to call the data subject in order to discuss a potential acquisition of the property. The data subject subsequently lodged a complaint with the Austrian Data Protection Authority (DSB), alleging a violation of his right to confidentiality.
Holding
The DSB upheld the complaint and held that the controller unlawfully processed the data subject’s personal data. The authority found that the use of the data subject’s name and telephone number to initiate contact constituted processing under Article 4 GDPR and that the controller acted as a controller.
As no consent or other legal basis applied, the only possible justification was legitimate interests under Article 6(1)(f) GDPR. While the controller’s commercial interest in brokering or acquiring property qualified as a legitimate interest, and contacting the seller was in principle suitable for that purpose, the decisive factor was the balancing of interests.Because the data subject had explicitly and clearly stated that he did not wish to be contacted by brokers, he could not reasonably expect such contact. His interests and fundamental rights therefore outweighed the controller’s commercial interests.
Accordingly, the DSB held that the controller lacked a lawful basis for the processing and violated the data subject’s right to confidentiality.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Text
File No.: 2025-0.587.686 dated July 24, 2025 (Case No.: DSB-D124.0686/25)
[Note from Editor: Names and companies, legal forms and product names, addresses (including URLs, IP and email addresses), file numbers (and the like), statistical data, etc., as well as their initials and abbreviations may be abbreviated and/or altered for pseudonymization purposes.] Obvious spelling, grammar, and punctuation errors have been corrected.
DECISION
RULING
The Data Protection Authority decides on the data protection complaint filed by Mag. Nuredin A*** (complainant) on March 19, 2025, against N*** Real GmbH (respondent) for violation of the right to confidentiality as follows:
– The complaint is granted, and it is determined that the respondent violated the complainant's right to confidentiality by using the complainant's personal data for contact purposes against his express wishes.
``` Legal basis: Article 4(1), (2) and (7), Article 5(1), Article 6(1)(f), Article 51(1), Article 57(1)(f) and Article 77(1) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of 4.5.2016, p. 1; Sections 1(1) and (2), 18(1) and 24(1) and (5) of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999 as amended. Legal basis: Article 4(1), (2) and (7), Article 5(1), Article 6(1), letter f, Article 51(1), Article 57(1), letter f, and Article 77(1) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of 4.5.2016, Session 1; Sections 1, paragraphs 1 and 2, 18, paragraph 1, and 24, paragraphs 1 and 5, of the Data Protection Act (DSG), Federal Law Gazette Part 1, No. 165 of 1999, as amended.
REASONING
A. Submissions of the Parties and Procedural History
1. In his initial submission of March 19, 2025, the complainant alleged a violation of his right to confidentiality by the respondent.
The violation arose from unsolicited contact by the respondent. He had published an advertisement for a property. The advertisement clearly stated at the beginning: "No real estate agents, please!" Nevertheless, on March 19, 2025, the respondent, claiming to be a real estate agent, called him and pressured him.
2. In submissions dated May 15, 2025, and July 3, 2025, the respondent argued as follows:
She stated that she would take into account any notifications that real estate agents were not welcome. The advertisement had been placed on a public portal with a request for contact and a telephone number, and a corresponding notation had been missing.
3. In a submission dated June 13, 2025, the appellant submitted an image of the advertisement.
B. Subject of the Appeal
The subject of the appeal is whether the respondent violated the appellant's right to confidentiality by using the appellant's personal data for contact purposes against his express wishes.
C. Findings of Fact
1. The respondent is a company registered in the Austrian Commercial Register under FN *4*2*9*o, with its registered office in **** Vienna. The company's business purpose is real estate brokerage and real estate acquisition.
2. In February 2025, the complainant published an advertisement for a plot of land/property on a public virtual marketplace (www.web***markt.at). The advertisement included the complainant's telephone number and a request for contact.
Right at the beginning of the advertisement, in the property description, the complainant included the following notice, which was clearly visible to anyone reading the advertisement: "Real estate agents are not welcome!"
3. The respondent (or its employees) used the complainant's data visible in the advertisement, including in particular his name and telephone number, to contact him by telephone on March 19, 2025, regarding the advertisement.
Assessment of Evidence: The findings are based on the parties' consistent written submissions and on the screenshot submitted by the appellant, the authenticity and accuracy of which were never disputed by the respondent. Furthermore, they are based on an official inquiry in the commercial register for company number *4*2*9*o, last accessed by the Data Protection Authority on July 23, 2025.
D. Legally, this results in:
D1. Applicable Legal Provisions
Pursuant to Section 1 Paragraph 1 of the Data Protection Act (DSG), every person has the right to the confidentiality of their personal data, particularly with regard to respect for their private and family life, insofar as there is a legitimate interest in doing so. The existence of such an interest is precluded if data, due to its general availability or because it cannot be traced back to the data subject, is not subject to a claim of confidentiality. According to Section 1, Paragraph 1 of the Data Protection Act (DSG), every person, particularly with regard to respect for their private and family life, has the right to the confidentiality of their personal data, insofar as there is a legitimate interest in doing so. The existence of such an interest is precluded if data, due to its general availability or because it cannot be traced back to the data subject, is not subject to a claim of confidentiality.
According to Section 1, Paragraph 2 of the DSG, restrictions on the right to confidentiality, insofar as the use of personal data is not in the vital interest of the data subject or with their consent, are only permissible to protect overriding legitimate interests of another party, and in the case of interventions by a state authority, only on the basis of laws. Even in the case of permissible restrictions, the interference with the fundamental right may only be carried out in the least intrusive manner that achieves the objective. According to Section 1, Paragraph 2, of the GDPR, restrictions on the right to confidentiality, insofar as the use of personal data is not in the vital interest of the data subject or with his or her consent, are only permissible to safeguard overriding legitimate interests of another, and in the case of interference by a state authority only on the basis of laws. Even in the case of permissible restrictions, the interference with the fundamental right must always be carried out in the least intrusive manner necessary to achieve the objective.
The GDPR, and in particular the principles enshrined therein, must be used to interpret the right to confidentiality (see the decision of the Austrian Data Protection Authority of October 31, 2018, file number DSB-D123.076/0003-DSB/2018).
According to Article 4(1) GDPR, “personal data” means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. According to Article 4(1) of the GDPR, "personal data" means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Personal data means any information relating to an identified or identifiable natural person. According to Article 4(2) of the GDPR, "processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
According to Article 4(2) of the GDPR, "processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Personal data must always be processed lawfully, fairly and in a transparent manner in relation to the data subject, in accordance with Article 5(1)(a) GDPR (“lawfulness, fairness and transparency”).
Data processing must be adequate, relevant, and limited to what is necessary for the purposes for which it is processed (“data minimization”) in accordance with Article 5(1)(c) GDPR.
The controller is responsible for compliance with Article 5(1) GDPR and must be able to demonstrate compliance (“accountability”) in accordance with Article 5(2) GDPR.
Processing is only lawful if at least one of the conditions listed in Article 6(1)(a) to (f) GDPR is met. For example, according to point f of the GDPR, processing is lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Processing is only lawful if at least one of the conditions set out in Article 6(1), points a to f, of the GDPR is met. For example, according to point f of the GDPR, processing is lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
D2. Regarding the present complaint
As can be seen from the findings, the complainant's first and last name and telephone number were published in the online advertisement at issue in these proceedings. The respondent used this information to contact the complainant by telephone.
All of this information is indisputably personal data of the complainant. Since the respondent collected and used this data, the complainant's personal data was also processed within the meaning of the GDPR (see Article 4, paragraphs 1 and 2, GDPR), and the respondent is indisputably the data controller (Article 4, paragraph 7, GDPR). All of this information is indisputably personal data of the complainant. Since the respondent collected and used this data, the complainant's personal data was also processed within the meaning of the GDPR (see Article 4, paragraphs 1 and 2, GDPR), and the respondent is indisputably the data controller (Article 4, paragraph 7, GDPR).
... In the absence of consent, vital interests (Section 1, Paragraph 2 of the German Data Protection Act (DSG)), or other justifications provided for in the GDPR, the only possible legal basis for the publication in question is Article 6, Paragraph 1, Letter f of the GDPR ("legitimate interests").
In the absence of consent, vital interests (Section 1, Paragraph 2 of the DSG), or other justifications provided for in the GDPR, the only possible legal basis for the publication in question is Article 6, Paragraph 1, Letter f of the GDPR ("legitimate interests"). Data processing based on legitimate interests is permissible under three cumulative conditions: i) the controller or the third party(ies) pursues a legitimate interest; ii) the processing of personal data is necessary for the purposes of the legitimate interest; and iii) the fundamental rights and freedoms of the data subject do not override the legitimate interest pursued (cf., with regard to the comparable legal situation under Directive 95/46/EC, the judgment of the CJEU of 11 December 2019, C-708/18 [TK], paragraph 40 with further references). Regarding the fundamental rights and freedoms of the data subject concerning the legitimate interest pursued, compare the comparable legal situation under Directive 95/46/EC with the judgment of the CJEU of 11 December 2019, C-708/18 [TK], paragraph 40 (with further references).
i. Legitimate Interest
In this respect, the CJEU held that, in the absence of a definition of this term in the GDPR, a broad range of interests are generally considered legitimate. As is also evident from Recital 47 of the GDPR, the EU legislator did not require that a controller's interest be legally defined for the processing of personal data carried out by that controller to be lawful (see judgment of the CJEU of 4 October 2024, Case C-621/22, paragraphs 38-39). In this regard, the CJEU held that, in the absence of a definition of this term in the GDPR, a wide range of interests are generally considered legitimate. As is also evident from Recital 47 of the GDPR, the EU legislator did not require that a controller's interest be legally defined for the processing of personal data carried out by that controller to be lawful (see judgment of the CJEU of 4 October 2024, Case C-621/22, paragraphs 38-39).
``` The respondent is a company whose business purpose includes the purchase and sale of real estate. The contact was made precisely for this purpose. Consequently, the respondent pursued economic interests which, in the opinion of the data protection authority, can be considered legitimate interests.
ii. Necessity of Processing
According to the CJEU, the requirement of necessity for data processing must be examined together with the so-called "principle of data minimization" (cf. Article 5(1)(c) GDPR under the new legal framework) (cf. CJEU judgment of 11 December 2019, C-708/18 [TK], paragraph 48 with further references).
According to the CJEU, the requirement of necessity for data processing must be examined together with the so-called "principle of data minimization" (cf. Article 5(1)(c) GDPR under the new legal framework; cf. CJEU judgment of 11 December 2019, C-708/18 [TK], paragraph 48 with further references). In principle, the use of the complainant's personal data was suitable for achieving the respondent's legitimate interest—the potential purchase of a property—and no less intrusive, equally effective means are apparent.
iii. No overriding fundamental rights of the data subject
According to the CJEU, this requirement necessitates a balancing of the respective opposing rights and interests, which in turn depends on the specific circumstances of each individual case.
``` Furthermore, as is clear from Recital 47 of the GDPR, the interests and fundamental rights of the data subject may override the interests of the controller, particularly where personal data are processed in situations where a data subject would not reasonably expect such processing (see judgment of the CJEU of 4 July 2023, C-252/21, paragraphs 110-112).
Moreover, as is clear from Recital 47 of the GDPR, the interests and fundamental rights of the data subject may override the interests of the controller, particularly where personal data are processed in situations where a data subject would not reasonably expect such processing (see judgment of the CJEU of 4 July 2023, C-252/21, paragraphs 110-112). As can be seen from the findings, the complainant included a clearly visible notice in the advertisement stating that he did not wish to be contacted by real estate agents. Therefore, the complainant could not reasonably expect that his personal data would be used contrary to this express wish.
Thus, the complainant's interests outweighed the interests of the respondent.
iv. Conclusion
In conclusion, the respondent violated the complainant's right to confidentiality by using his personal data without a legally valid reason for interference.
The complaint was therefore to be granted pursuant to Section 24 Paragraph 5 of the Data Protection Act (DSG), and a violation of rights was to be established.
The decision was therefore rendered accordingly.
