GZ: D124.5046 Desk officer:
2024-0.759.531
Data Protection Complaint (Article 77(1) GDPR, Article 24(1) DSG)
Possibly.
This is an automated translation that has been selectively post-edited. “BG” refers to opponent
(Beschwerdegegner in German) and “BP” refers to complainant (beschwerdeführende Partei in
German).
DECISION
The Austrian Data Protection Authority decides on the complaint of (complainant),
represented by NOYB – European Center for Digital Rights, Goldschlagstraße 172/4/3/2, 1140 Vienna,
ZVR: 1354838270 of 10 August 2021 against (opponent),
represented by DORDA Rechtsanwälte GmbH, for A) the Right to Erasure and the Obligation to
Communicate in connection with the Erasure of the personal data, B) the application for an injunction
against the defendant to terminate the unlawful processing and C) of the request of 30 June 2021 in
December 2022, find an alleged infringement of the Right to Confidentiality as follows:
1) The complaint is dismissed regarding points A) and B).
2) The complaint is rejected regarding point C).
3) The Austrian Data Protection Authority orders toe opponent to modify within
three weeks, so that the cookie “_pk_id” is not used before the respective user provides consent.
Legal bases: Article 3(2), Article 4 (11) and (7), Article 51(1), Article 12(3), Article 17, Article 57(1)(f),
Article 58(2) and Article 77(1) of Regulation (EU) 2016/679 (General Data Protection Regulation,
GDPR), OJ 2016 L 119, p. 1; Paragraphs 18 (1) and 24 (1), (2), (5), (4) and (5) of the Datenschutzgesetz
(Law on data protection; ‘the DSG’), BGBl. I No 165/1999 idgF.
—2—
REASONS
A. Arguments of the parties and course of the procedure
A.1. By document of 10 August 2021, the complainant (hereinafter: BP) states, in summary, as follows:
BP has the defendant’s website (hereinafter: BG) visit on 9 April 2021. The website
displays a cookie banner. Cookies were placed, in part with a unique user identification number (‘unique
ID’). A summary of all HTTP requests and -replies is attached. All processing activities for which BG
wishes to establish a legal basis under the banners cookie are referred to as “relevant processing
activities”. Several offences were committed because of the design of the banners cookie. There is no
reason to presume the existence of valid consent. It is requested that BG be ordered to cease all
relevant processing activities and to erase all relevant personal data. The GDPR would allow the
competent supervisory authority to issue an order going beyond BP’s personal data. The contribution
was accompanied by several annexes.
A.2. By observations of 8 November 2021, BG submitted, in summary, the following:
BG sees no reason to make substantial changes to the design of the Banner cookie. On the contrary,
it complies with both market standards and the relevant guidelines of the European Data Protection
Authorities. Before interaction with the banner, only cookies that are technically necessary are placed.
A “new” button does not necessarily have to be displayed from the first layer. The permissibility of such
a variant has also been confirmed by public authorities. In the context of an overall assessment, BG’s
presentation should, in any event, be described as transparent and lawful. The two buttons
(‘configuration’, ‘accept alles’) and their text would be clearly identifiable as such. The difference in
colouring is important in order to clearly show the difference in functionality between the two buttons to
the user. In addition, the User concerned could change its cookie preferences at any time with some
clicks.
However, the technical implementation gave rise to a configuration error, since BG did not deactivate
the legitimate interest function. BP therefore considered that BG was relying on a legitimate interest
which did not exist. The misunderstanding had already been resolved before the complaint was lodged
and the error was corrected. There is no longer, in BG’s systems, any data or information making it
possible to establish a link with BP. Several annexes were attached to that opinion.
A.3. By opinion of 9 July 2017, In December 2021, BP submitted, in summary, the following:
Since BG had already shared those observations with BP before the complaint was lodged, reference
is made to the observations made in the application initiating proceedings.
A.4. On 9 May 2022, the data protection authority informed the other supervisory authorities of the
present complaint. The conditions for a procedure under Article 56 and Article 60 et seq. of the GDPR
—3—
were not to be excluded because BG’s activity was directed. The supervisory authorities of Italy and
Germany declared themselves to be the supervisory authority concerned within the meaning of Article
4 (22) of the GDPR.
A.5. By letter of 30. In addition, BP stated, in essence, the following:
BP asks the Court to declare, on the basis of Article 24(2) (5) of the DSG in conjunction with Article 1
of the DSG, that BG infringed the exhaustively numbered rules for each ‘infringement’. In the event of
unlawful data processing which is no longer ongoing, in breach of Article 1 of the DSG, read in
conjunction with Article 5 of the GDPR, those are past facts. The infringement was successful and the
data subjects’ personal data were transmitted to countless third parties. The unlawful acts at issue are
therefore not capable of being eliminated within the meaning of Article 24(6) of the DSG.
A.6. By observations of 21 February 2023, BG submitted, in summary, that the cookie banner had been
adapted in the meantime. However, the ‘banner of withdrawal’ required by BP is not implemented, since
there is an easy possibility on BG’s website to change cookie preferences.
A.7. In its observations of 9 March 2023, BP argued, in summary, that the ‘Type K’ offences had not
been remedied (consent is not as easy to revoke as to grant) and ‘type I’ (incorrect classification of
cookies). Books tracking would be used.
A.8. By observations of 26 September 2024, BG submitted, in summary, that, by notifying the complaint,
BG had inspected its systems on the basis of BP’s data. No data were found. BG also informed its
partners of the erasure of the data. The contribution was accompanied by several annexes.
A.9. By observations of 17 October 2024, BP essentially reiterated its earlier arguments. She also drew
attention to the use of cookies requiring consent (e.g. _pk_id).
B. Subject-matter of the complaint
B.1. Article 58 of the GDPR does not contain an express legal basis for determining independently the
possible unlawfulness of a processing operation relevant to data protection law (see VwGH of 1
September 2022, Ra 2022/04/0066). Consequently, in accordance with Article 58(6) of the GDPR, read
in conjunction with Article 24(2) (5), read in conjunction with Article 1 of the DSG, the mere finding of
an infringement of a right protected by data protection law presupposes a request by the data subject.
As regards the subject-matter of the action in the present case, those considerations mean as follows:
B.2. By document of 10 August 2021, BP did not submit an application within the meaning of Article
24(2) (5) of the DSG. Initially, no connection with Article 24(2) (5) of the DSG – or, more generally, with
DSG – was identified in subsequent notices.
—4—
It is only by written pleading of 30 June. In December 2022, BP made an additional application for a
declaration that, in accordance with Article 24(2) (5) of the DSG, read in conjunction with Article 1 of
the DSG, BG had infringed the rules relating to each ‘type of infringement finally numbered’, which,
ultimately, resulted in an infringement of the right to secrecy. It follows that the finding of an infringement
which occurred in the past must be denied.
However, as a preliminary point, it is necessary to examine, in that context, whether the application
submitted was made on 30. December 2022 is not already time-barred.
B.3. The subject matter of the complaint is, moreover, BP’s request that BG be ordered to order (A) to
erase BP’s personal data and to inform the recipients thereof, and (B) to terminate the ‘relevant
processing activities’.
By ‘relevant processing activities’, BP refers to all processing activities for which BG wished to establish
a legal basis for the use of its banners cookie on 9 April 2021.
C. Factual findings
C.1. A cookie is a way of collecting information generated by a website and saved by an internet user’s
browser. It is a small piece of data or text file, usually less than one Kbyte in size, that a website asks
an internet user’s browser to store on the local hard disk of the user’s computer or mobile device.
A cookie allows the site to ‘move closer’ to the user’s actions or preferences. Most web browsers
support cookies, but users can recruit their browsers to reject them. You can also delete cookies at any
time.
Websites use cookies for the purposes of identifying users, remembering their custom preferences and
allowing users to complete tasks without having to re-enter information when browsing from one page
to another or when visiting the site later.
Cookies can also be used to collect information for online behaviour target advertising and marketing.
For example, companies use software to monitor user behaviour and create personal profiles to show
users ads adapted to their previous searches.
Assessment of evidence C.1.: The considerations relating to the functioning of cookies are to be found
in the Opinion of the Advocate General in Case C-673/17, point 36 et seq., with further references. As
this is a technical, case-by-case and general description of the potential functions of cookies, these
explanations had to be included at factual level, not in the legal assessment.
C.2. BG is the operator of the website It decides under what conditions cookies are
placed or read during the consultation of that website.
—5—
Assessment of evidence C.2.: The findings made are based on an ex officio search carried out by the
data protection authority on the website most recently consulted on 3 February 2025.
C.3. BP visited at least on 9 April 2021. On 9 April 2021 Cookie Banner was designed
as follows:
Assessment of evidence C.3.: The findings made are based on BP’s contribution of 10 August 2021
and are not disputed. The screenshot is based on annexes “banner.png” and “page.html” produced by
BP. From the perspective of the Data Protection Authority, there is no reason to assume
to call into question BP’s arguments. By virtue of the mere fact that legal representation:
BP is not in a position to conclude on several claims of the same nature
the fact that BP did not visit the website.
C.4. Following the visit to the website on 9 April 2021, at least the following cookies
were placed and read on BP’s terminal equipment, with a unique and random value (random number):
—6—
The content of the aforementioned annex ‘cookies.json’ (JSON file) will serve as a basis for the findings
of fact.
Assessment of evidence C.4.: The findings made are based on BP’s contribution of 10 August 2021
and on the annex ‘cookies.json’ produced with BP. A JSON file is an archiving format for HTTP
transactions. The JSON file has been verified by the Data Protection Authority. BP’s arguments are
consistent with the archives data contained therein. The JSON file produced (or its content) is known
to the parties.
Inaddition, the findings made are based on an ex officio search at
https://policies.google.com/technologies/cookies?hl=de#managing-cookies (
consulted on 3 February 2025.
C.5. At this stage, BG does not store any cookie values that were placed and read following the visit to
on 9 April 2021 in BP’s terminal equipment. Moreover, BG does not currently retain
the IP address of BP’s terminal equipment, which, following the same visit, was stored, at least in the
short term, in its logos.
BG informed its partners (
) of the de-listing.
Assessment of evidence C.5: The findings made are based on BG’s observations of 26 September
2024. Following an express request from the DPA, BG stated that it had carried out a search of its
internal systems. BG also demonstrated that the recipients of the transmission of the data were
informed of the erasure. The corresponding supporting documents have been attached. There is
nothing to cast doubt on BG’s argument, especially since it was fully cooperative during the investigation
procedure and adapted the Banner cookies – although BP may not be fully satisfied. Nor has BP
disputed BG’s arguments in that regard.
C.6. BG adapted her Banner cookies on At present, the BG cookie is as follows:
—7—
—8—
At the end of the website is the ‘Cookie configurations’ link. If that link is selected, the
menu represented appears (level 2).
When viewing the website with an empty browsing valve, before any interaction with
the banner cookie (figure 2), the following cookies shall be placed:
—9—
Figure 4
The cookie ‘_pk_id’ is part of the Matomo analytics tool and contains a ‘unique visitor ID’ to identify new
and recurrent visitors and establish a visitor profile including a summary of their interactions on the
website, including the number of visits and the time stamp of the first and last visit. It also covers
interactions related to e-commerce orders, objectives and conversions, as well as allocation during
different meetings.
Assessment of evidence C.6.: The findings relating to the Banner cookie are based on an ex officio
search at the last time consulted on 3 February 2025. The finding that BG adapted
the Banner cookies is further apparent from the Act and is not contested. The conclusions relating to
the pk_id are based on an ex officio search at https://matomo.org/faq/general/faq_146/#_pk_id, the last
time consulted on 3 February 2025.
D. Legal arguments:
General
D.1. The competence of the Authority
Processing operations in respect of a situation may also comply with the provisions of Directive
2002/58/EC. (data protection Directive) or TKG 2021, which are also subject to the GDPR. While the
placing or reading of cookies must be assessed in accordance with the requirements of Article 5(3) of
the Data Protection Directive, the resulting data processing falls within the scope of the GDPR (see
EDPB Guidelines 01/2020 on the processing of personal data in the context of connected vehicles and
mobility applications, version 2.0, paragraph 15, and paragraph 53).
This is also consistent with the legal opinion of the Court in Fashion ID. That case-law also assumes
that, as a result of the implementation of a social plugin on a website (which falls within the scope of
the Data Protection Directive), the transmission of the data of the website visitor to Facebook Ireland
— 10 —
Limited and the resulting processing of data fall within the scope of (then) Directive 95/46 (see the
judgment of 29 July 2019 in Case C-40/17, paragraph 26 and, in particular, paragraph 85).
The data protection authority is therefore competent for the present complaint, as data transmission (at
least IP addresses and cookie values) took place following the installation or selection of cookies (see
finding of facts C.4) and the application of the GDPR is not excluded.
From the perspective of the data protection authority, there is also no justification for acting under Article
57(4) of the GDPR:
The mere fact that BP’s legal representation lodged several similar complaints with the Authority is not
sufficient to conclude that the handling of that complaint should be refused (see also, in that regard, the
judgment of the BVwG of 12 May 2023, GZ: W245 2252208-1).
D.2. Processing of personal data
In Google Analytics, the Data Protection Authority has already stated that cookies which contain a
unique and random value (random number) and which are placed for the purpose of individualising and
detaching persons meet the definition in Article 4 (1) of the GDPR. In particular, it can never be excluded
that the cookie values and the IP address of a person’s terminal equipment may be combined with
additional information at any location in the processing chain, for example when the data subject
registers on a website with his or her email address or clear name (see decision of 22 April 2022, GZ:
2022-0.298.191, available on the website www.dsb.gv.at; that legal position confirms, inter alia, the
judgment of the BVwG of 12 May 2023, GZ: W245 2252208-1; as regards the reference to persons
‘Google Analytics Cookies’, the decision of the EDPS against the European Parliament of 5 January
2022, GZ: 2020-1013, P. 13.
Those considerations can be applied to the present case, given that, following the visit to the website
on 9 April 2021, cookies with unique and uncertain values were placed and deleted in
BP’s terminal equipment (see findings of fact C.4). Subsequently, the cookie values and IP address of
BP’s terminal equipment were transmitted, for example, to the servers of the respective suppliers (e.g.
Google).
The material scope of the GDPR is therefore also fulfilled.
Point 1
D.3. The right to erasure and the obligation to notify (point A)
As found, BG does not currently store the information that can be considered as personal data of BP –
i.e. the IP address and cookie values of BP’s terminal equipment.
— 11 —
Moreover, according to the case-law of the BVwG, there is no subjective right to a declaration that the
rights of the data subjects – in the present case: the right to annulment – at least belatedly – was
respected (see the judgment of the BVwG of 31 January 2020, GZ: W258 2226305-1 and the other
evidence cited therein).
It is therefore not appropriate, at least at the time of the decision, to consider that there has been an
infringement of Article 17 (read in conjunction with Article 19) of the GDPR.
D.4. The application for an injunction against BG to put an end to the unlawful acts (Section B)
BP also applied for an order requiring BG to put an end to the unlawful treatment.
Under Article 77(1) of the GDPR, ‘without prejudice to any other administrative or judicial remedy, every
data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the
Member State of his or her habitual residence, place of work or place of the alleged infringement if the
data subject considers that the processing of personal data relating to him or her infringes this
Regulation’.
It follows from the wording of Article 77(1) of the GDPR that any requests made in the context of a
complaint procedure must – in so far as they are admissible – relate to the person of the complainant
(‘ personal data concerning him or her’).
As I have already explained, BG does not currently retain BP’s data which are the subject of the action,
so that it is also not possible to make use of a power to repair relating to BP’s personal data.
Inview of the exhaustive nature of the corrective powers provided for in Article 58(2) of the GDPR (see
again the judgment of the VwGH of 1 September 2022, Ra 2022/04/0066) and the wording of Article
77(1) of the GDPR and Article 24(1) of the DSG (infringed and not: ‘has committed infringements’ or ‘is
likely to violate’; English version of the GDPR: ‘infringes’, French version of the GDPR: norcan an
injunction be issuedin appeal proceedings for the processing of pro futuro data (that is to say, in the
event that BP returns to the website in the future).
There is therefore also no need to examine the substance of BP’s abstract infringements concerning
the Banner cookie. Irrespective of that, however, account must be taken of the fact that BG adapted
the Banner cookies (see findings of fact C.6.).
Finally, in so far as BP claims that a competent supervisory authority may also adopt an order ‘going
beyond BP’s personal data’, it must be objected that such a ‘popular complaint’ (that is to say, a
complaint which does not concern BP) is inadmissible (see DSB’s decision of 26 November 2018, GZ:
DSB-D216.697/0011-DSB/2018).
— 12 —
If that were not the case, the possibility for Member States, provided for in Article 80(2) of the GDPR,
to provide for a right of complaint for data protection organisations, which exists independently of a
specific data subject’s mandate, would leave no room. At present, however, the Austrian legislature has
not made use of that possibility.
Point 2
D.5. BP’s request of 30 April 2016 December 2022 for the purpose of establishing an alleged breach of
the right to confidentiality (point C of the complaint)
Under Article 24(4) of the DSG, the right to examine a complaint is extinguished where the complainant
has not lodged it within one year of the date on which he or she became aware of the event adversely
affecting him or her and, at the latest, within three years of the date on which that event occurred. Under
the last sentence of Article 24(4) of the DSG, late complaints must be rejected.
Article 24(4) of the DSG refers to an event adversely affecting the person concerned as triggering the
time-limit. In the present case, the visit to the website of 9 April 2021 – and the related
data processing – are taken into account as such.
Submission of the additional application of 30 June 2017 Consequently, after more than one year from
the date of knowledge of the adverse event (internet visit), BP’s right to have its request processed had
already lapsed at the time of the amendment, with the result that the action on that point had to be
dismissed under Article 24(4) of the DSG.
In that context, it should be noted that, according to the settled case-law of the VwGH, deficiencies in
a presentation which do not undermine its completeness, but rather its chances of success, are not
capable of being the subject of a regularisation mandate (see, instead of many, the decision of the
VwGH of 20 April 2022, Ro 2018/06/0001).
It does not follow from either the GDPR or the DSG that, where an infringement of, for example, Article
17 of the GDPR is invoked, a request to the data protection authority that an infringement committed in
the past be established, for example, must necessarily be accompanied by a request to the data
protection authority. That is to say: The subject matter of the complaint can also only be an infringement
of Article 17 of the GDPR and there is no need to plead at the same time an infringement of Article 1(1)
DSG or Article 6(1) of the GDPR.
Thus, also in the present case, the initial application of 10 August 2021 brought a full action with clear
claims, which was therefore not accessible to an order of regularisation.
It was therefore necessary to adjudicate in accordance with the appeal.
— 13 —
Point 3
D.6. On the use of cookies before any interaction with the Banner cookie
(a) Use of cookies not technically necessary
The use of cookies (and the related processing of personal data) which are not strictly necessary for
the use of a website requires prior consent (see the order of the VwGH of 31 October 2023, VwGH Ro
2020/04/0024; see also Article 29-WP Opinion 04/2012 on Cookie Consent Exemption, WP 194,
00879/12/EN, p. 9 et seq.
According to the case-law of the Bundesverwaltungsgericht (Federal Administrative Court), Article 5(3)
of Directive 2002/58/EC is idgF. nor is (I in Article 165(3) of the TKG 2021) to be interpreted as meaning
‘economic necessity’ (see the judgment of the BVwG of 12 March 2019, GZ: W214 2223400-1).
It must not be forgotten that the competence of the data protection authority relates to the processing
of data after cookies have been installed or read (see Section D.1.).
However, the Court has already held that, in the interaction between Directive 2002/58/EC idgF and
the GDPR, it can be considered that there is lawful processing of data within the meaning of the GDPR
only if the conditions for lawful processing under Directive 2002/58/EC are also met (see the judgment
of the Court of Justice of 17 June 2021 in Case C-597/19, paragraph 97 et seq. and, in particular,
paragraph 118 and the case-law cited).
As a preliminary issue of the lawfulness of data processing within the meaning of Article 6(1) of the
GDPR, it must therefore be ascertained whether there is valid consent within the meaning of Directive
2002/58/EC (idem). If the answer is in the negative, this ultimately also leads to unlawful data
processing under the GDPR.
(b) The cookies placed on before any interaction with the Banner cookie
As has been found, the cookie ‘_pk_id’ contains a ‘unique visitor ID’ in order to identify new and
recurrent visitors and to establish a visitor profile including a summary of their interactions on the
website, including the number of visits and the time stamp of the first and last visits. It also covers
interactions related to e-commerce orders, objectives and conversions, as well as allocation during
different meetings.
In view of the above, it should be noted that, from a technical point of view, this cookies is not strictly
necessary to provide an information society service explicitly requested by the subscriber or user; on
the contrary, the aim is to identify the user’s behaviour.
— 14 —
That conclusion is also consistent with the view taken by legal writers that the exception ‘provision of
an information society service expressly requested’ in Article 165(3) of the TKG 2021 (and the related
expression ‘strictly necessary’) must be interpreted restrictively (see Riesz in Riesz/ Schilchegger
(Hrsg), TKG (2016), Article 96 (48)).
It follows that this cookie cannot be used until (valid) consent is given.
Recipient of the order for provision of services and time limit
D.7. Result
As has been established, BG is the operator of the website at issue and decides which
cookies are to be used (and, therefore, what data processing is carried out; see the findings of fact
C.2.).
It follows that BG must be classified as a data controller under data protection law under Article 4 (7) of
the GDPR, since it determines the purposes and means of the data processing. The service contract
was therefore also to be entrusted to BG.
From the perspective of the data protection authority, a period of three weeks is reasonable to make
the adjustments.
It was therefore necessary to adjudicate in accordance with the appeal.