Tag: Austria

Austria: Deletion does not necessarily mean destruction

12. February 2019

Article 17 of the General Data Protection Regulation (GDPR) stipulates the data subject the right to erasure, also called right to be forgotten. The Austrian Data Protection Authority decided that the right to erasure not necessarily mean destruction of the stored data. According to the Authority anonymization may be sufficient.

The decision is based on a complaint of an Austrian who request his former insurance company to delete all stored data. The insurance company deleted his e-mail address and phone number as well as insurance offers and stopped all advertising. However, Name and address of the data subject were anonymized and the insurance company told the data subject that the data would be destructed in March 2019.

The Austrian Data Protection Authority proved the company right. According to Art. 4 Nr. 2 GDPR the company can choose whether it deletes or destructs the stored data, it only had to “be ensured that neither the person responsible himself nor a third party can restore a personal reference without disproportionate effort”, explained the Authority.

Austrian DPA dismisses complaint concerning validity of Cookie Consent Solution

14. January 2019

The Austrian Data Privacy Authority (“DPA”) decided on a complaint, lodged by an individual, concerning the compliance of the cookie consent solution of an Austrian newspaper with the General Data Protection Regulation (“GDPR”).

The complainant argued that the consent was not given voluntarily, since the website was no longer accessible after the revocation of consent to marketing cookies. Further use of the website required payment. Therefore, according to the complainant, provision of the service depends on consent to the processing of personal data.

The Austrian newspaper grants users free access to the content of the website, provided that they agree to the use of cookies for advertising purposes. If this consent is revoked, the website will no longer be usable and the window for giving consent will reappear. Alternatively, in the same window, users can choose to subscribe to a paid subscription. For currently 6 euros per month users get access to the entire content of the site, without data tracking.

The DPA explained that consent is only given involuntarily if a disadvantage is to be expected if consent is not given. Referring to Article 29 Working Party’s Guidelines on Consent, the DPA stated that such a disadvantage arises when there is a risk of deception, intimidation, coercion or significant adverse consequences. Yet there is no such disadvantage here. In fact, after giving consent, the user of the website even gains an advantage because he gets full access to the newspaper’s services. Furthermore, if the user does not wish to give his consent, he can still use another online newspaper.

With its decision, the Austrian DPA set a welcome signal for other online newspapers that finance themselves through advertising revenues.

New Data Protection Act in Austria

31. August 2017

In regards to the General Data Protection Regulation (GDPR), coming into force on 25th May 2018, the Austrian Parliament has passed the new Data Protection Act.

The GDPR is directly applicable which means that the GDPR will regulate the data protection within the European Union, without the need for any transposing act of the member states. Nevertheless the GDPR contains a certain amount of opening clauses. Opening clauses enable the countries to complete the law. Moreover, in some cases, the member states are obliged to provide specifications. Because of this reasons the member states have to revise the existing Data Protection Law. The first country with renewed law was Germany and now Austria follows.

The first draft of the new act was published on 12th May 2017. After evaluating the results of the consultation the new Data Protection Act was published in the federal law gazette on 31st July 2017.

It is noticeable that the Austrian parliament has been reticent with deviations from the GDPR which benefits the harmonization of data protection within the European Union.