Difference between revisions of "OGH - 6Ob127/20z"

From GDPRhub
Line 64: Line 64:
 
On 14.01.2019 the data subject (claimant) sent an access request under Article 15 GDPR to the controller on which the controller replied to on 14.02.2019. Besides data like name and phone number the controller stated to process certain "marketing classifications" under § 151(6) GewO. These "marketing classifications" are calculated based on certain sociodemographic circumstances (e.g. age, place of residence, level of education) and express a statistic probabilty of the data subject belonging to a certain deomographic group (e.g. "do-it-yourselfer", "night owl", "affinity for investments").
 
On 14.01.2019 the data subject (claimant) sent an access request under Article 15 GDPR to the controller on which the controller replied to on 14.02.2019. Besides data like name and phone number the controller stated to process certain "marketing classifications" under § 151(6) GewO. These "marketing classifications" are calculated based on certain sociodemographic circumstances (e.g. age, place of residence, level of education) and express a statistic probabilty of the data subject belonging to a certain deomographic group (e.g. "do-it-yourselfer", "night owl", "affinity for investments").
  
The data subject was not content with the controller's reply and filed a lawsuit for the provison of access under Article 15 and erasure under Article 17 GDPR. Furthermore, the data subject requested a declaratory judgment that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR <u>in the case of further access requests by the data subject.</u>
+
The data subject was not content with the controller's reply and filed a lawsuit for the provison of access under Article 15 and erasure under Article 17 GDPR in connection with Article 21 GDPR. Furthermore, the data subject requested a declaratory judgment that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR <u>in the case of further access requests by the data subject.</u>
  
 
The first instance court (Regional Court Wels - LG Wels) rejected the lawsuit, holding that the controller had already fulfilled the data subject's requests. Following an appeal by the data subject, the second instance court (Higher Regional Court Libz - OLG Linz) partially overturned this decision and held that the data subject had indeed a legal interest in the claimed declaratory judgment. Hence, it held that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR in the case of further access requests by the data subject  
 
The first instance court (Regional Court Wels - LG Wels) rejected the lawsuit, holding that the controller had already fulfilled the data subject's requests. Following an appeal by the data subject, the second instance court (Higher Regional Court Libz - OLG Linz) partially overturned this decision and held that the data subject had indeed a legal interest in the claimed declaratory judgment. Hence, it held that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR in the case of further access requests by the data subject  
Line 70: Line 70:
 
In the course of the procedures before the LG Wels, the OLG Linz and the Austrian Supreme Court (Oberster Gerichtshof - OGH), several legal questions arose:
 
In the course of the procedures before the LG Wels, the OLG Linz and the Austrian Supreme Court (Oberster Gerichtshof - OGH), several legal questions arose:
  
* Can a data subject file a lawsuit under Article 79 GDPR in cases of an alleged violation of Article 15 GDPR or can such violation only be subject to a complaint before a DPA under Article 77 GDPR?
+
*Can a data subject file a lawsuit under Article 79 GDPR in cases of an alleged violation of Article 15 GDPR or can such violation only be subject to a complaint before a DPA under Article 77 GDPR?
* Do "marketing classifications" under § 151(6) GewO qualify as personal data under Article 4(1) GDPR as they only express a statistic probability?
+
*Do "marketing classifications" under § 151(6) GewO qualify as personal data under Article 4(1) GDPR as they only express a statistic probability?
* Does a data subject have a legal interest - as required under § 228 Austrian Civil Procedure Code (Zivilprozessordnung - ZPO) - in a declaratory judgment that a controller is under the legal obligation to provide access under Article 15 GDPR in the case of further access requests by the data subject?
+
*Does the data subject have a legal interest - as required under § 228 Austrian Civil Procedure Code (Zivilprozessordnung - ZPO) - in a declaratory judgment that the controller is under the legal obligation to provide access under Article 15 GDPR in the case of further access requests by the data subject?
  
 
===Holding===
 
===Holding===
 
The OGH overturned the decision of the OLG and restored the decision of the first instance court. It held that  
 
The OGH overturned the decision of the OLG and restored the decision of the first instance court. It held that  
  
* a lawsuit under Article 79 GDPR regarding the alleged violation of Article 15 GDPR is indeed feasible. Article 79 GDPR is not limited to certain data subject rights such as erasure under Article 17 GDPR. This is in line with the OGH's previous case-law.  
+
*a lawsuit under Article 79 GDPR regarding the alleged violation of Article 15 GDPR is indeed feasible. Article 79 GDPR is not limited to certain data subject rights such as erasure under Article 17 GDPR. This is in line with the OGH's previous case-law.
* "marketing classifications" under § 151(6) GewO qualify as personal data. The term "information" in Article 4(1) GDPR is not limited to statements about verifiable characteristics or factual circumstances with regard to the data subject but also evaluations and assessments about him or her. Hence, also a statistic probabilty that is assigned to a certain data subject qualifies as personal data. This is in line with case-law by the Austrian Administraive Court ([[BVwG - W258 2217446-1|W 258 2217446-1]] on the presumed "affinity for a political party).  
+
*"marketing classifications" under § 151(6) GewO qualify as personal data. The term "information" in Article 4(1) GDPR is not limited to statements about verifiable characteristics or factual circumstances with regard to the data subject but also includes evaluations and assessments him or her. Hence, also a statistic probabilty that is assigned to a certain data subject qualifies as personal data. This is in line with case-law by the Austrian Administraive Court ([[BVwG - W258 2217446-1|W 258 2217446-1]] on the presumed "affinity for a political party).
* a data subject does not have a legal interest in a declaratory judgment that a controller is under the legal obligation to provide access under Article 15 GDPR in the case of further access requests by the data subject.  
+
*a data subject does not have a legal interest in a declaratory judgment that the controller is under the legal obligation to provide access under Article 15 GDPR in the case of further access requests by the data subject. The controller had already fulfilled the data subject's access request and declared to accept the data subject's objection under Article 21 GDPR by refraining from any further processing of his or her data. Therefore, further access request are not to be expected and the data subject has no legal interest in the requested declaratory judgment.
  
 
==Comment==
 
==Comment==

Revision as of 13:48, 8 April 2021

OGH - 6Ob127/20z
Courts logo1.png
Court: OGH (Austria)
Jurisdiction: Austria
Relevant Law: Article 4(1) GDPR
Article 15(1) GDPR
Article 79 GDPR
§ 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO)
§ 228 Austrian Civil Procedure Act (Zivilprozessordnung - ZPO)
Decided: 18.02.2021
Published: 01.04.2021
Parties: unknown (claimant)
Österreichische Post AG (defendant)
National Case Number/Name: 6Ob127/20z
European Case Law Identifier: ECLI:AT:OGH0002:2021:0060OB00127.20Z.0218.000
Appeal from: OLG Linz
2 R 35/20k-19
Appeal to: Not appealed
Original Language(s): German
Original Source: Rechtsinformationssystem des Bundes (RIS) (in German)
Initial Contributor: n/a

The Austrian Supreme Court held that a court must not issue a declaratory judgement that a controller has to provide access to certain data under Article 15 GDPR to a data subject if the controller had already fulfilled the data subject's requests for access and erasure and refrained from further processing the data subject's data.

English Summary

Facts

The controller (defendant) ist the biggest logistics and postal service provider in Austria. Its main business activities include the transport of letters, advertising mail, print media, and parcels. Furthermore, the defendant also conducts business as an address publisher under § 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO) and sells personal data for third-party marketing purposes.

On 14.01.2019 the data subject (claimant) sent an access request under Article 15 GDPR to the controller on which the controller replied to on 14.02.2019. Besides data like name and phone number the controller stated to process certain "marketing classifications" under § 151(6) GewO. These "marketing classifications" are calculated based on certain sociodemographic circumstances (e.g. age, place of residence, level of education) and express a statistic probabilty of the data subject belonging to a certain deomographic group (e.g. "do-it-yourselfer", "night owl", "affinity for investments").

The data subject was not content with the controller's reply and filed a lawsuit for the provison of access under Article 15 and erasure under Article 17 GDPR in connection with Article 21 GDPR. Furthermore, the data subject requested a declaratory judgment that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR in the case of further access requests by the data subject.

The first instance court (Regional Court Wels - LG Wels) rejected the lawsuit, holding that the controller had already fulfilled the data subject's requests. Following an appeal by the data subject, the second instance court (Higher Regional Court Libz - OLG Linz) partially overturned this decision and held that the data subject had indeed a legal interest in the claimed declaratory judgment. Hence, it held that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR in the case of further access requests by the data subject

Dispute

In the course of the procedures before the LG Wels, the OLG Linz and the Austrian Supreme Court (Oberster Gerichtshof - OGH), several legal questions arose:

  • Can a data subject file a lawsuit under Article 79 GDPR in cases of an alleged violation of Article 15 GDPR or can such violation only be subject to a complaint before a DPA under Article 77 GDPR?
  • Do "marketing classifications" under § 151(6) GewO qualify as personal data under Article 4(1) GDPR as they only express a statistic probability?
  • Does the data subject have a legal interest - as required under § 228 Austrian Civil Procedure Code (Zivilprozessordnung - ZPO) - in a declaratory judgment that the controller is under the legal obligation to provide access under Article 15 GDPR in the case of further access requests by the data subject?

Holding

The OGH overturned the decision of the OLG and restored the decision of the first instance court. It held that

  • a lawsuit under Article 79 GDPR regarding the alleged violation of Article 15 GDPR is indeed feasible. Article 79 GDPR is not limited to certain data subject rights such as erasure under Article 17 GDPR. This is in line with the OGH's previous case-law.
  • "marketing classifications" under § 151(6) GewO qualify as personal data. The term "information" in Article 4(1) GDPR is not limited to statements about verifiable characteristics or factual circumstances with regard to the data subject but also includes evaluations and assessments him or her. Hence, also a statistic probabilty that is assigned to a certain data subject qualifies as personal data. This is in line with case-law by the Austrian Administraive Court (W 258 2217446-1 on the presumed "affinity for a political party).
  • a data subject does not have a legal interest in a declaratory judgment that the controller is under the legal obligation to provide access under Article 15 GDPR in the case of further access requests by the data subject. The controller had already fulfilled the data subject's access request and declared to accept the data subject's objection under Article 21 GDPR by refraining from any further processing of his or her data. Therefore, further access request are not to be expected and the data subject has no legal interest in the requested declaratory judgment.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.