VwGH - Ra 2024/04/0424

VwGH - Ra 2024/04/0424

Court:	VwGH (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 7(3) GDPR
Decided:	16.01.2025
Published:	11.02.2025
Parties:
National Case Number/Name:	Ra 2024/04/0424
European Case Law Identifier:
Appeal from:	BVwG (Austria) W 108 2284491-1
Appeal to:	Not appealed
Original Language(s):	German
Original Source:	ris (in German)
Initial Contributor:	tjk

The Supreme Administrative Court confirmed that the first layer of a website’s cookie banner must provide the option to close the cookie banner without giving consent. This option must be visually equivalent to the option to consent.

English Summary

Facts

Complaint to the DPA

The data subject visited a website operated by a media company (the controller). Upon opening the website a cookie banner showed up. This cookie banner was designed in such a way that a reject button was “hidden” in a second layer. The cookie banner’s first layer presented only an option to accept the cookies or to manage the options. The cookie manage option was presented as a link. When the data subject clicked on the accept button, they also agreed to pre-ticked options, visible only within the cookie management link. The reject button was a part of the second layer of the cookie banner (within the cookie management link).

The data subject lodged a complaint with the Austrian DPA (DSB), claiming the controller violated, inter alia, Article 5(1)(a) GDPR and Article 6(1)(a) GDPR. The data subject was represented by noyb. The controller argued to the DPA that the website provided access to online newspaper articles. Because of that, the processing activities were carried for journalistic purposes and the DPA was not competent to hear the case.

The DPA eventually issued a decision, ordering the controller to modify the cookie banner so that its first layer offered an option to close the cookie banner without giving consent. This option had to be visually equivalent to the accept button. The DPA rejected the applications of the data subject regarding the deletion of its data, an order to stop unlawful processing and establishing the violation of data confidentiality (“Recht auf Geheimhaltung”) following from Section 1 of the Austrian Data Protection Act (Datenschutzgesetz - DSG).

Appeal to the Federal Administrative Court

The controller appealed the DPA’s order to introduce an equivalent reject option in the first layer of its cookie banner to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG).

The Federal Administrative Court dismissed the appeal by the controller. That court held, that the controller’s processing activities didn’t fall within the scope of journalistic purposes. The court emphasised that the controller placed the cookies and processed the collected data for analytical and advertising purposes. Regarding the need for an equivalent reject option in cookie banners the court upheld the interpretation of the DPA that the first layer of the cookie banner needs to contain a visually equivalent option to reject cookies.

Appeal to the Supreme Administrative Court

The controller appealed the BVwG's decision. In this appeal, the controller stated, that there is a lack of case law on the media privilege and on the design of cookie banners. The controller argued, that the Supreme Administrative Court (Verwaltungsgerichtshof - VwGH) had not yet dealt with this in substance and that thus clarification by it was required.

Holding

Regarding the design of the cookie banner the court found that Article 7(3) GDPR requires an individual case-by-case examination whether refusing consent is as simple as granting it.

The court held that an appeal can only be justified in cases of a blatant misassessment of the individual case-related circumstances by the first instance court. The court did not find this in the present case, stating that the reasoning of the first instance court was detailed and comprehensible.

Regarding the media privilege the court held, that the appeal did not indicate which specific legal question the court would have to answer in this context.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Subject

The Administrative Court, through the presiding Senate President Dr. Pollak, the Court Councilor Mag. Hainz-Sator and the Court Councilor Dr. Pürgy as judges, with the participation of the secretary Mag. Kovacs, on the appeal by o GmbH & Co KG in W, represented by Dr. Peter Zöchbauer, lawyer in 1040 Vienna, Karlsgasse 15/3, against the decision of the Federal Administrative Court of July 31, 2024, Zl. W108 2284491-1/15E, concerning a data protection matter (authority concerned before the Administrative Court: Data Protection Authority; other party: Federal Minister of Justice), has made the following decision:

Ruling

The appeal is dismissed.

The appellant must reimburse the federal government for expenses in the amount of EUR 553.20 within two weeks, otherwise enforcement will take place.

Reasoning

1 1. By decision of December 14, 2023, the authority concerned - on the occasion of a data protection complaint procedure initiated at the request of a data subject - instructed the appellant ex officio in accordance with Article 58(2)(d) GDPR to

"amend the data protection request for consent (the cookie banner) on the website www.[...].at (see fact finding C.6.) within a period of ten weeks in such a way that on the first level of the cookie banner, in addition to the 'Accept' option, there is a visually equivalent option to be able to close the cookie banner without giving consent."

2 The applications of the person concerned were legally rejected and are not the subject of these proceedings.

3 2. In the contested decision, the Administrative Court dismissed the appeal by the appellant against the service contract awarded to her. The Administrative Court declared the appeal inadmissible.

4 In its reasoning, the Administrative Court summarized the findings that the cookie banner that appears when the appellant’s website is accessed is designed in such a way that the options “Show purposes” and “Accept” appear on the first level. By clicking on the “Show purposes” link, the user is taken to the “second level” of the cookie banner, which is designed in such a way that they can choose between the banners “Allow all,” “Confirm selection,” and “Reject all.” A “floating icon” with which a user can return to the cookie settings and revoke their consent and/or exercise an objection is not currently implemented on the appellant’s website. In order to be able to access the cookie settings again and revoke consent and/or exercise an objection, the user must click on a link with the text “Cookie settings and revocation” in the “footer” at the bottom of the page. After clicking on the “Cookie settings and revocation” link, the user is taken to the second level of the cookie banner, where consent can be revoked by clicking on the “Reject all” button.

5 In its legal assessment, the Administrative Court essentially stated that, contrary to the appellant’s statements, the media privilege of Section 9 Para. 1 DSG does not apply. According to the case law of the ECJ, personal data is processed for journalistic purposes if the sole aim of the processing is to disseminate information, opinions or ideas to the public. The processing of personal data serves journalistic purposes if it aims to convey information and ideas on issues of public interest (reference to ECJ 16.12.2008, C-73/07, Satakunnan Markkinapörssi and Satamedia, para. 61, and ECJ 14.2.2019, C-345/17, Buivids, para. 53). The case law of the ECHR has developed the following relevant criteria, which must be taken into account for qualification as journalistic activity: contribution to a debate of general interest, level of fame of the person concerned, subject matter of the reporting, previous conduct of the person concerned, content, form and impact of the publication, manner and circumstances in which the information was obtained, accuracy. Against the background of these statements, it becomes clear that the setting of cookies, particularly for analysis, marketing and advertising purposes, is in any case not a journalistic activity within the meaning of Section 9(1) of the Data Protection Act, especially since this activity is not aimed at conveying information and ideas on issues of public interest; there is therefore no "substantive" activity by the press or media. Since the media privilege does not apply in the present case, the authority concerned was responsible for dealing with the data protection complaint brought by the co-participant.

6 The appellant does not (any longer) object to the existence of processing of personal data. Nor is it disputed that the appellant should be qualified as the controller within the meaning of Art. 4(7) of the GDPR for data processing as a result of setting or reading cookies on its website.

7 According to Article 58(2)(d) of the GDPR, each supervisory authority has all remedial powers which enable it to instruct the controller or processor to bring processing operations into compliance with this Regulation, where appropriate, in a specific manner and within a specific period of time. The authority concerned is also permitted to make ex officio use of its powers set out in Article 58(2) of the GDPR in a complaint procedure pursuant to Article 77 of the GDPR.

8 In order to assess how the cookie banner and the interaction options are to be understood, the figure of an averagely informed, attentive and circumspect consumer should be used. According to Article 7(3) of the GDPR, the withdrawal of consent must be as easy as the granting of consent. Therefore, not giving consent, as the counterpart to revocation, must also be as easy as giving consent. In the present case, only one click is required to give consent, whereas not giving consent requires at least two clicks, which means that such equivalence does not exist, especially since an objective justification for the different treatment of the options has neither been put forward nor is it apparent. The different visual design (green "Accept" button and merely a "Show purposes" link) also means that the options cannot be viewed as being of equal value. This is not changed by the fact that (now) the body text of the cookie banner on the first level of the cookie banner explains how all cookies can be rejected. Invoking an "industry standard" when designing the cookie banner does not eliminate the illegality of the current design. The EDPB also recommends that the draft European Commission initiative for a voluntary commitment by companies to simplify consumers' use of cookies and personalised advertising options should explicitly state that individuals should have the possibility to reject all non-essential cookies at the first level of the banner or, at least, that it should be made clear that where an 'Accept' (or 'Accept all') button is present at one level, a 'Reject' (or 'Reject all') button should be displayed at the same level, as this is an essential element for the validity of the consent. Regarding the option shown of clicking on the link "Cookie settings and revocation" at the end of the page (in the "footer"), which is clearly visible and accessible from any page, which takes you to the second level of the cookie banner and there you can immediately click on "Reject all" and thus revoke your consent, it should be noted that when you visit the website www.[...].at, you can initially only interact with the first level of the cookie banner and a selection must be made before the user can access the entire website, so that the revocation option in the footer of the website is in any case only a "downstream" option for refusal and therefore not an equivalent option to being able to close the cookie banner without giving consent and to granting consent.

9 Against this background, the service mandate of the authority concerned cannot be criticized.

10 3. The extraordinary appeal filed against this decision - after the rejection and assignment of an appeal submitted by the appellant to the Constitutional Court by decision of the Constitutional Court of October 3, 2024, E 3502/2024-5 - is directed against this decision.

11 The authority concerned filed a response to the appeal.

12 4. According to Article 133, Paragraph 4 of the Federal Constitution, an appeal against a decision of the administrative court is admissible if it depends on the solution of a legal question that is of fundamental importance, in particular because the decision deviates from the case law of the Administrative Court, such case law is lacking, or the legal question to be resolved is not answered uniformly in the previous case law of the Administrative Court.

13 According to Section 34 Paragraph 1 VwGG, appeals which are not suitable for consideration because the requirements of Article 133 Paragraph 4 B-VG are not met must be dismissed by order without further proceedings.

14 According to Section 34 Paragraph 1a VwGG, when assessing the admissibility of an appeal pursuant to Article 133 Paragraph 4 B-VG, the Administrative Court is not bound by the ruling of the Administrative Court pursuant to Section 25a Paragraph 1 VwGG. The Administrative Court must review the admissibility of an extraordinary appeal pursuant to Article 133 Paragraph 4 B-VG within the framework of the reasons put forward for this in the appeal (Section 28 Paragraph 3 VwGG).

15 4.1. In its justification for admissibility, the appeal argues that there is a lack of case law on the media privilege. The Administrative Court has not yet dealt with this in substance. The fact that the legal situation is not clear is also evident from the repeal of Section 9(1) DSG by the Constitutional Court, although the present facts occurred before the repeal came into force. Clarifying case law from the Administrative Court is required for this purpose.

16 The mere lack of case law from the Administrative Court does not automatically lead to the admissibility of an appeal. Rather, the justification for the admissibility of the appeal requires an explanation of the specific legal question that the Administrative Court has not yet answered (cf. VwGH 2.4.2024, Ro 2021/04/0018, with further references). The present appeal does not correspond to this. It merely states that there is no case law of the Administrative Court regarding the media privilege. The appeal does not indicate which specific legal question the Administrative Court would have to answer in this context.

17 4.2. There is also a lack of case law on the question of the design of declarations of consent in connection with cookie banners. There are a multitude of design options and cookie banners are used in connection with a large number of websites. Clarification by the Administrative Court is therefore required.

18 Based on the relevant provision of Art. 7(3) GDPR - which does not require further interpretation - that revocation must be as simple as granting consent to the processing of personal data relevant to data protection law, it must be examined in each case on the basis of the circumstances relevant to the individual case whether this legally clear provision is complied with. A legal assessment made in an individual case can only justify the admissibility of an appeal if this is necessary for reasons of legal certainty due to a blatant misassessment of the individual case-related circumstances by the administrative court (see, for example, VwGH 25.6.2024, Ra 2021/04/0098, VwGH 24.5.2022, Ra 2020/04/0008). In the present case, this cannot be said in view of the detailed and comprehensible reasoning of the administrative court in the contested decision.

19 The appeal does not raise any legal questions that are of fundamental importance within the meaning of Article 133 Paragraph 4 of the Federal Constitutional Law. The appeal was therefore dismissed.

20 The ruling on reimbursement of expenses is based on Sections 47 ff of the Administrative Court Act (VwGG) in conjunction with the Administrative Court Expenses Reimbursement Ordinance 2014.

Vienna, 16 January 2025