[24] With Decision from 19 July 2023 to 6 Ob 134/23h the Supreme Court withdrew that reference for a preliminary ruling in respect of Questions 1 and 3.
To I. (Continuation of proceedings)
[25] The decisions of the ECJ on 23 June 2021 on 6 Ob 56/21k references for a preliminary ruling made (C-446/21, Maximilian Schrems against Meta Platforms Ireland) and on 18 February 2021 to 6 Ob 159/20f references for a preliminary ruling made (C-154/21, RW against Austrian Post) are available.
[26] The proceedings must therefore be continued.
On II. (Revisions by the parties)
[27] The revisions of both parts of the dispute are admissible (see partial judgment 6 Ob 56/21k Rz 111). That of the plaintiff is partly justified, which the defendant is not authorized.
A. On the plaintiff's revision
1. As regards points 5 and 7 of the application – General
[28] With Item 5 of the claim, the plaintiff seeks a declaration that his consent to the defendant's terms of use in the versions of 19 April 2018 and 31 July 2019 (in eventu: only in the version of 19 April 2018), including the data and cookie guidelines, is not an effective consent to the processing of personal data in accordance with Article 6 paragraph 1 in conjunction with Article 7 GDPR; Furthermore, he requests this statement with regard to future clauses of the same meaning.
[29] With Item 7 of the claim, it seeks a declaration that there is no effective consent of the plaintiff to the processing of its personal data, as described in three sub-items of the defendant's data policy.
[30] The Lower instances rejected both pleas due to lack of declaratory capacity (the first court also due to lack of interest in declaratory judgment) within the meaning of § 228 ZPO.
2. On the requirements of § 228 ZPO
[31] According to § 228 ZPO, an action may be brought to establish the existence or non-existence of a legal relationship or right if the plaintiff has a legal interest in having the legal relationship or right established as soon as possible.
[32] § 228 ZPO presupposes an object capable of being determined and the legal interest of the plaintiff in the immediate determination.
2.1. Capacity to determine
[33] 2.1.1. A – ascertainable according to § 228 ZPO – Legal relationship is a specific, legally regulated relationship between persons or between a person and an object, given and specified by the facts presented (RS0039053; RS0039223; RS0038988). Even in the case of an undisputed legal relationship, the determination of the resulting individual rights, powers and liabilities are sought (cf 6 Ob 288/98s). Individual legal relationships that are the result of a more extensive legal relationship or individual legal consequences of such legal relationships, such as individual claims or claims derived from them (RS0038986 [T2]; RS0039053 [T5]; RS0039223 [T4]; 4 Ob 14/24y Rz 12).
[34] In this sense, the determination of the existence of warranty or damages claims is ascertainable (see only 6 Ob 288/98s). The question of whether a legal relationship between two parties to a dispute should be interpreted as meaning that the deposit with the notary constitutes payment (7 Ob 270/99b). The request to establish the (non-)existence of a legal relationship consisting of two purchase offers was also assessed as capable of being established. In doing so, the Supreme Court differentiated between this request and the (non-determinative) request for a declaration of invalidity of contractual declarations (4 Ob 14/24y Rz 15, 17). The declarability was also affirmed for an action for a declaration that, for the loss of earnings (undisputedly) due from medical malpractice, there was a contractual agreement for a certain Assessment of its amount. The decisive factor was that the request was aimed at determining certain legal consequences derived from a universal legal relationship (6 Ob 147/22v Rz 13).
[35] 2.1.2. In contrast to legal relationships, Legal acts Statements and statements intended to make something known to another person, which have legal consequences (Frauenberger Pillar in Carnival/Konecny³ § 228 ZPO Rz 40). A legal act cannot be the subject of a request for a declaration under § 228 ZPO because it is not a right or legal relationship, but only a preliminary question for its existence (RS0038804; 7 Ob 210/22s Rz 36; cf 4 Ob 14/24y Rz 13). The legal characteristics of legal acts are also not ascertainable, but only a resulting right or legal relationship (RS0039087 [T8] = RS0039036 [T17]).
[36] In this sense, the effectiveness or ineffectiveness of contract terminations (1 Ob 98/21z; 1 Ob 1615/95) or a declaration of resignation (4 Ob 573/94).
[37] 2.1.3. Even in declaratory actions, the law or legal relationship to be determined must be described precisely and beyond doubt in terms of content and scope. The need for the Certainty of the claim does not arise here, as in the case of the performance judgment, from the consideration that it must be suitable for enforcement, but from the purpose and function of the declaratory action and its final effect (RS0037437). Since the plaintiff must request the non-existence of a very specific right or legal relationship in a negative declaratory action, this must be precisely designated and thus also legally qualified (RS0037437 [T6]).
2.2. Determination interest
[38] 2.2.1. The process-economic purpose of the declaratory action is to clarify the legal situation where there is a need recognized by the legal system to clarify contentious legal relationships (RS0037422 [T1]). It requires a concrete, current reason which makes a court decision necessary to prevent a real and serious threat to the plaintiff's legal situation (RS0039215; cf RS0039071). The determination of mere „legal situations“ is not sufficient for this (RS0037422 [T3, T8]). On the other hand, a dispute over the interpretation of a treaty, specifically the powers of a contracting party stipulated therein, gives rise to its interest in making a determination (RS0102433).
[39] A legal interest in a declaratory action must be affirmed, even despite the possibility of an action for performance, if the request for a declaratory action is likely to clarify once and for all the legal relationships between the parties and to sever a future claim for performance or if, according to future proceedings, the final effect of the declaratory judgment clarifying the preliminary question is abbreviated (RS0038908). The sentence that the declaratory action must not be admitted if the action for performance can be brought applies only if the claim for performance also exhausts the claim for declaratory action, that is to say, if further legal consequences arising from the determination of the legal relationship or claim in question other than those drawn by the claim for performance do not come into consideration (RS0039021).
[40] No strict standard must be applied to the need for clarification of a right or legal relationship (RS0038908 [T12]).
3. As regards point 5 of the application
[41] 3.1. By point 5 of his claim, the plaintiff seeks a declaration that the consent he has given is „not effective consent … within the meaning of Article 6 paragraph 1 in conjunction with Article 7 of the GDPR“. The aim is to establish a legal characteristic of the plaintiff's contractual declaration, specifically that it is ineffective compared to a certain legal standard of review – Art. 6 para. 1 in conjunction with Art. 7 GDPR –. On the other hand, the request is not for the determination of the non-existence of a legal relationship or of specific rights or claims derived from it resulting from the alleged invalidity (cf RS0039053 [T5]; RS0039223 [T4]) directed.
[42] This proves to be the correct Assessment of the lower courts, which denied the declarability of the claim submitted under point 5 according to § 228 ZPO.
[43] 3.2. In so far as the plaintiff, in his appeal, wants the request for action to be understood as not aimed at establishing the legal qualification of his contractual declaration, but at establishing the resulting (non-)existence of a legal relationship over data processing, this does not correspond to the request made. In his appeal against the judgment of the First Court, the plaintiff also did not claim that he would have interpreted the claim point 5 differently if it had been discussed by the First Court in accordance with §§ 182, 182a ZPO. Therefore, point 5 of the application for a declaration of judgment, submitted by the applicant, was to be used as the basis for the assessment.
[44] Since point 5 of the claim, neither in the version of the main claim nor in the version of the contingent claim (point 5.1.), meets the requirements of § 228 ZPO for declaratory actions, the dismissal of points 5 and 5.1. of the claim had to be confirmed.
[45] 3.3. The applicant's revision is therefore, as regards Item 5 of the claim not authorized.
4. As regards point 7 of the application
[46] 4.1. By point 7 of the application, the applicant seeks a declaration that there is no effective consent to the further specified processing of such personal data of the applicant, which the defendant received in the manner described in the application –essentially from third parties–.
[47] 4.2. Like the request point 5, the request for action point 7 is not based on the finding of the non-existence of a legal relationship or the non-existence of concrete rights or claims derived from the legal relationship of the parties resulting from the alleged invalidity (cf RS0039053 [T5]; RS0039223 [T4]) directed. The plaintiff does not seek a declaration that the defendant is not entitled to carry out the data processing cited or that it should refrain from doing so. Rather, it seeks to clarify the existence of one of several possible legal bases for certain data processing carried out by the defendant. This request is not aimed at establishing a right or legal relationship.
[48] Therefore, the Capacity to determine to deny the finding sought under point 7 of the application for action according to § 228 ZPO.
[49] It has already been stated that the plaintiff did not complain about the failure to discuss the matter within the meaning of §§ 182, 182a ZPO.
[50] 4.3. The applicant's revision is therefore also in respect of Item 7 of the claim not authorized.
5. As regards point 6 of the application
5.1. Submission and course of proceedings
[51] By point 6 of the application, the plaintiff against the defendant the prohibition of processing his personal data for personalized advertising, aggregation and analysis of data for advertising purposes.
[52] In summary, he argued that the defendant avoided clarifying the legal event on which it relied (among other things) for these processes. There is no effective consent of the plaintiff. The defendant violates the principles of Article 5, paragraph 1, lit a to e GDPR in the context of data processing for personalized advertising by processing sensitive data of the plaintiff without his consent and thus against good faith (lit a); By reusing tracking data for advertising purposes, it violates the principle of earmarking (lit b), by collecting data far beyond the necessary limits, it violates the principle of data minimization (lit c); it violates the principle of Accuracy (lit d) and processes personal data contrary to lit e leg cit without further storage limitations. There is neither a need for the data processing objected to in point 6 to fulfil the contract within the meaning of Art. 6 para. 1 lit b GDPR, nor is there any legitimate interest of the defendant within the meaning of Art. 6 para. 1 lit f GDPR.
[53] The defendant countered that it legally processes the plaintiff's personal data in accordance with Article 6 paragraph 1 lit b GDPR, since personalized advertising is an essential, contractually agreed component of the F* service. Furthermore, the justification of Article 6 paragraph 1 lit f GDPR is met because the processing of personal data to provide measurements and analyses to advertisers has a legitimate economic interest that does not affect the privacy of users.
[54] In the revision procedure, the parties essentially repeat the arguments already put forward in the first instance proceedings.
5.2. On the legality of processing
5.2.1. Regarding Art. 6 para. 1 lit b GDPR
[55] 5.2.1.1. For processing of personal data to be considered necessary for the performance of a contract within the meaning of Article 6 paragraph 1 lit b GDPR, it must be objectively essential in order to achieve a purpose that is a necessary component of the intended for the person concerned Contractual performance is. The controller must therefore be able to demonstrate to what extent the main subject matter of the contract could not be fulfilled without the processing in question (ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 98).
[56] The fact, if any, that such processing is mentioned in the contract or is merely useful for its performance is irrelevant in itself. The decisive factor for the application of the justification referred to in Article 6 paragraph 1 lit b GDPR is that the processing of personal data by the controller is essential for the proper performance of the contract concluded between him and the data subject and that, therefore, no practical and less intrusive alternatives exist (C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 99).
[57] In the case of a contract comprising several services or several independent elements of a service that can be provided independently of each other, the applicability of Article 6 paragraph 1 lit b GDPR must be assessed separately for each of these services (C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 100).
[58] Asked whether an undertaking such as the defendant in the present proceedings, which operates an advertising-financed digital social network and offers, among other things, the personalisation of the content and advertising in its conditions of use, could rely on the justification of the need to fulfil the contract in accordance with (also) Article 6 paragraph 1 lit b GDPR, if, for these purposes, it collects data (among others) from third-party websites and apps via interfaces integrated into them, such as „F* business tools“, or via Cookies or similar storage technologies used on the Internet user's computer or mobile device, links it to the user's F*.com account and uses it (see C-252/21, Meta Platforms ua against Federal Cartel Office, para. 35 question 3), the ECJ commented on the justification of data processing to personalise the content in light of the justification element of Article 6 paragraph 1 lit b GDPR as follows:
[59] After the execution in the judgment Meta Platforms ua against Federal Cartel Office Personalization of the content is of benefit to the user in that, among other things, it makes it possible for him to be shown content that largely corresponds to his interests. Nevertheless, the personalisation of the content –subject to review by the referring court– does not appear necessary to offer the user the services of the online social network. These services could, where appropriate, be provided to him in the form of an equivalent alternative that was not linked to such personalization, so that it was not objectively essential to achieve a purpose that was a necessary component of the services (cf C-252/21 Rz 102).
[60] 5.2.1.2. Point 6 of the application does not object per se to any personalisation of the content displayed to the applicant in the F* network, but specifically to the personalisation of advertising.
[61] This is not objectively essential in order to achieve that contractual purpose which is a necessary component of the contractual service intended for the data subject: because the specific review of the present case shows that the personalisation of advertising by means of personal user data is a service which the defendant provides to advertisers in order to thereby generate revenue itself. The playing of personalised advertising is therefore not „a necessary part of the contractual service intended for the data subject“, but part of the defendant's financing concept. It enables the defendant to offer its services to users without demanding any consideration in cash from them. It follows that the processing of personal data for the purpose of personalising advertising, as complained of in point 6 of the application, enables the defendant's identified financing model. This benefits users in that the defendant does not demand any monetary remuneration from them for their service. However, this does not concern the contractual service intended for those concerned, which is to be relied upon according to the case law presented, but rather the structure of the consideration to be provided by the users. However, this type of financing and thus the personalization of advertising using the user's personal data is not necessary for the provision of the services of the online social network.
[62] The aggregation and analysis of personal data for advertising purposes is also not part of the contractual service intended for the plaintiff. Rather, this constitutes the provision of services by the defendants to their advertising customers.
[63] 5.2.1.3. Since the processing of the plaintiff's personal data referred to in point 6 of the application is not part of the provision of the defendant's contractual services intended for the person concerned – i.e. the plaintiff –, it is not part of the permissibility of Article 6 paragraph 1 lit b GDPR recorded.
5.2.2. Regarding Art. 6 para. 1 lit f GDPR
[64] As regards the permissibility of Article 6 paragraph 1 lit f of the GDPR, the ECJ has made it clear that, even if the services of an online social network such as the one to be assessed here are free of charge, the user of that network cannot reasonably expect the operator of that social network to process his personal data without his consent for the purpose of personalising advertising. In these circumstances, it must be held that the interests and fundamental rights of such a user outweigh the interest of that operator in such personalisation of the advertising with which he finances his activity, so that the processing he carries out for such purposes cannot fall within Article 6 paragraph 1 lit f GDPR (ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 117).
[65] The defendant may therefore also refer to the admissibility of Article 6 paragraph 1 lit f not use GDPR for the processing of the plaintiff's personal data cited in point 6 of the claim.
5.2.3. Interim result
[66] The grounds for justification in Article 6 paragraph 1 lit b and lit f GDPR cannot, as stated, be relied upon for the processing of the plaintiff's personal data complained of in point 6 of the application.
[67] The person liable to prove, among other things, the legality of the processing has other grounds for justification (see only ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, para. 95) Defendants not supported. In the absence of any of the alleged grounds for justification, the processing of the plaintiff's personal data, which is contested in point 6 of the application, was not carried out lawfully within the meaning of Article 5 paragraph 1 lit a of the GDPR.
[68] The further alleged violations of Article 5 paragraph 1 GDPR must therefore no longer be addressed.
[69] 5.2.4. Insofar as in the judgment of the ECJ given in the present proceedings on 4 October 2024 C-446/21, Maximilian Schrems against Meta Platforms Ireland, it is noted that since November 6, 2023, the F* service has only been free for those users who have agreed that their personal data would be collected and used to address personalized advertising to them, with users having the option of purchasing a paid subscription to access a version of these services without targeted advertising (para. 11), these are circumstances which lie after the date of the conclusion of the oral dispute hearing at first instance (§ 193 ZPO). These are therefore not part of the facts to be assessed in the present proceedings (RS0036969).
5.3. On the claim for injunctive relief
[70] 5.3.1. The right to cease and desist is specified by two elements: an obligation to cease and desist and the risk that this obligation to cease and desist will be violated (RS0037660 [T7]). This can be pronounced as a first ascent risk or as a repetition risk (cf RS0037661). The risk of repetition is supported by the assumption that the person who has violated a certain legal obligation will be inclined to do so again. He must therefore present those special circumstances which make a repetition of his action seem completely impossible or at least extremely unlikely (cf RS0080065). If the defendant disputes his obligation to cease and desist in the trial, this must be considered as an indication of the existence of a risk of repetition (RS0012055 [T3]).
[71] Any grounds for justification and resulting limitations on the injunction need not be included in the judgment of an injunction decision; rather, those grounds already exist by law and must be reviewed by the court, where appropriate, on the occasion of an execution (RS0114017; 6 Ob 16/21b Rz 27).
[72] 5.3.2. In the present case, it is clear from the findings that the defendant carries out the processing of the plaintiff's personal data complained of in point 6 of the application. Thus, it is established that the defendant uses data that the plaintiff provides to it and data that it receives about him as a result of his actions to show him personalized advertising. It has already been stated that the grounds of justification relied on by the defendant for this purpose are not met. The defendant is therefore materially bound to cease and desist. The likelihood of repetition also exists because of the infringement found and the legal position adopted by the defendant in the proceedings.
[73] 5.4. In result the plaintiff's appeal turns out to be Item 6 of the claim as justified.
6. As regards point 8 of the application
6.1. Submission and course of proceedings
[74] Point 8 of the application seeks to prohibit the defendant from „using the plaintiff's data regarding the visit or use of third-party sites (in particular through the use of 'social plugins' and similar techniques)“, provided that technical data are not processed solely for the purpose of displaying website elements and provided that the plaintiff has not consented to a specific processing operation in a manner described in more detail.
[75] The plaintiff In summary, the defendant uses Cookies and social plugins (also: social plugins) to obtain data about which websites he visits on the Internet and at which times. In doing so, it violates the principles of earmarking, data minimization and good faith data processing enshrined in Article 5 of the GDPR because no clear purpose is specified for data collection, the data is stored beyond the required extent and time, and such data collection is not lawful. It could not rely on any justification of Article 6 paragraph 1 GDPR. The plaintiff did not consent to the use of his personal data, which were collected via cookies, social plugins and similar technologies.
[76] In order to obtain data from social plugins, the defendant must also be regarded as a controller within the meaning of the GDPR, in addition to the operator of a website that integrates plugins. She is also the data protection controller responsible for processing the data collected through social plugins and similar techniques. It did not explain on what supposed legal basis it processed social plugins and the data obtained through social plugins.
[77] The defendant wrongly assumes that the plaintiff consented to the setting of Cookies by continuing to use the F* service after the cookie banner had been displayed. He did not accept the setting of Cookies and, in addition to the GDPR, refers to § 96 para. 3 TKG 2003 (see now § 165 TKG 2021). After the decision C-673/17, Planet 49, the ECJ has a duty of consent for the use of all technically unnecessary cookies, for which the display of the cookie banner is not sufficient. When so-called „datr cookies“ are used, data processing takes the form of tracking browsing behavior even if the plaintiff is not logged into the F* service. This goes beyond the purpose of providing personalized and customized F* products. The plaintiff does not demand that the use of Cookies be stopped, but rather that consent be obtained or that processing for unlawful purposes be stopped.
[78] The defendant objected to point 8 of the application as being indeterminate because it contained unverifiable conditions. It relies on consent for the processing of personal data received from cookies, social plugins and pixels only to the extent that the processing aims to personalise advertising. Since the plaintiff has not given consent, it is not processing the plaintiff's data from these sources for this purpose. For other purposes, for which it processes personal data from cookies, social plugins and pixels –to provide and personalise its services and improve F* products, as well as to promote protection, integrity and security–, it relies on the need to fulfil the contract as its legal basis.
[79] The plaintiff clearly does not oppose the placement of Cookies by the defendant, but only the processing of his personal data obtained from cookies, social plugins and pixels. However, for „certain processing activities related to data from cookies, social plugins and pixels“, the defendant only processes data as a processor for „websites, applications, advertisers and other business partners“ that submit the data as part of F* business tools. According to the terms of use for F* business tools, advertisers who send personal data, including data „from“ cookies, social plugins and pixels, to the defendant for the purpose of measurements and analysis services are data protection controllers, while the defendant is only their processor. Since the claim was based on alleged obligations of the defendants as controllers, it was therefore too broad and should be dismissed. Furthermore, fulfillment is impossible because the functioning of the Internet depends on cookies.
[80] In his revision The applicant relies essentially on the arguments already put forward in the first instance proceedings.
6.2. Interpretation of the request
[81] 6.2.1. A request must always be understood as it was meant by the party in the context of the actual presentation (RS0041254 [T20]). Not only the wording of the request but also the recognizable legal protection objective of the action must be taken into account (6 Ob 35/15p; RS0039010 [T3]; RS0041254 [T36]).
[82] 6.2.2. In the present case, the injunction formulated by the applicant, when the wording is considered in isolation, is open to interpretation insofar as the wording „the use of the data regarding of visiting or using third-party sites“ the nature of the requested omission does not have the certainty required for the execution proceedings according to § 7 EO (cf RS0000878 [T1]; RS0000466 [T2]) arises. However, the summary of the claim formulated in point 8 and the plaintiff's arguments submitted in response to it clearly shows the applicant's objective of legal protection: he opposes any processing of his personal data that accrues to the defendant in the course of the plaintiff's visit and/or use of third-party websites, in particular through the use of social plugins and similar techniques, unless one of the two exceptions formulated by him – processing of technical data solely for the purpose of displaying website elements or qualified consent – is met.
[83] This meaning must be used as a basis for examining the legitimacy of the request.
6.3. Qualification as responsible
[84] 6.3.1. The defendant takes the position that it should not be qualified as a controller for certain –although not specifically described– processing of the data received by it in the manner referred to in point 8 of the application. This is not true:
[85] 6.3.2. The ECJ had in the decision C-40/17, Fashion ID, on the process of integrating social plugins from the provider of the F* service into the websites operated by any company, which is also the case in this case (see the representation of the actual process in C-40/17, Fashion ID, para. 26) with regard to the qualification of the actors involved as data protection controllers.
[86] That this decision was still taken on Directive 95/46/EC (Data Protection Directive), which was repealed with effect from 25 May 2018 and replaced by the GDPR (see ECJ C-40/17, Fashion ID, paragraph 3), does not preclude the validity of the clarifications made by the ECJ regarding the position of controller for the present dispute because the definition of „controller[s]“ according to Article 2 lit d of Directive 95/46/EC corresponds to the definition of „controller“ in Article 4 Z 7 GDPR.
[87] The ECJ stated that the concept of „controller“ is broadly defined in order to ensure effective and comprehensive protection of the data subject (paragraph 65 et seq.). The ECJ qualified the process of inflow of personal data of visitors to the third website to the (here) defendant, triggered by the integration of a social plugin of the (here) defendant into the website of a third website operator, as processing of personal data, specifically the collection and disclosure of personal data, for which the provider of the social plugin (which is the defendant in the present proceedings) and the website provider jointly decide on the purposes and means of processing personal data (paragraphs 76, 82). On the other hand, the further processing of the personal data thus collected (according to the facts to be assessed there) takes place in such a way that the provider of the third-party website no longer decides on its purposes and means, but only the defendant (here) (para. 76).
[88] 6.3.3. The fact that the defendant in the present case processes the personal data collected by means of social plugins and similar technologies as a controller within the meaning of Article 4 Z 7 of the GDPR –i.e. decides on the purposes and means of processing – follows from the findings according to which the plaintiff's personal data obtained via cookies, social plugins and comparable technologies on third-party websites are stored by it and for the purposes of personalization identified, the improvement of F* products, „to promote protection, integrity and security“ and to offer events to the plaintiff.
[89] The defendant must therefore be regarded as a controller within the meaning of Article 4, paragraph 7 of the GDPR with regard to the collection, transmission and further processing of the plaintiff's personal data obtained by means of its social plugins and similar technologies in the course of the plaintiff's visits or activities to third-party websites.
[90] Whether the defendant subsequently processes the data obtained by it in the manner described (even as a controller) in individual cases on behalf of another controller, i.e. as a processor within the meaning of Article 4 Z 8 GDPR, is irrelevant for the justification of the request for injunctive relief due to the defendants' identified violations of their obligation to cease and desist (in this regard immediately).
6.4. On the legality of the processing referred to in point 8 of the application
[91] 6.4.1. As already explained, claims for injunctive relief are characterized by the existence of an obligation to cease and desist and the risk that this obligation to cease and desist will be contravened (cf RS0037660 [T7]), whereby a breach of the obligation to refrain from action indicates the risk of repetition (cf RS0080065).
[92] In order to assess the legitimacy of the claim raised in point 8, it must therefore be examined whether the defendant is entitled to carry out the data processing contested in point 8 of the claim or whether it is therefore obliged to refrain from doing so.
[93] 6.4.2. The defendant derives the legitimacy of the data processing described in point 8 of the application from Article 6 paragraph 1 lit b GDPR. However, this fact cannot justify the processing to be examined here in the present case because –as explained below– it is necessary to fulfil a permissioned fact required here in accordance with Art 9 para 2 GDPR missing.
[94] 6.4.2.1. In addition to the general authorization provisions of Article 6 paragraph 1 of the GDPR, additional clauses apply to the admissibility of the processing of special categories of personal data. The personal data of special categories pursuant to Article 9 GDPR include, among other things, data showing racial and ethnic origin, political opinions or religious beliefs, as well as health data and data on the sex life or sexual orientation of a natural person (ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 67).
[95] The decisive factor for the application of Article 9 paragraph 1 of the GDPR in the case of processing of personal data by the operator of an online social network is whether that data enables the disclosure of information falling within one of the categories referred to in that provision. If this is the case, such processing of personal data is prohibited subject to the exceptions provided for in Article 9 paragraph 2 GDPR (ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 68; C-446/21, Maximilian Schrems against Meta Platforms Ireland, Rz 72). This prohibition in principle provided for in Article 9 paragraph 1 of the GDPR applies regardless of whether the information disclosed by the processing in question is correct or not and whether the controller acts with the aim of obtaining information falling under one of the specific categories referred to in that provision (ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 69; C-446/21, Maximilian Schrems against Meta Platforms Ireland, Rz 73).
[96] The ECJ also assumes that in certain cases the processing of data via access to the websites or apps in question may reveal such information without users having to enter information there by registering or placing online orders (ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 72).
[97] In summary, Article 9 paragraph 1 of the GDPR must therefore be interpreted as meaning that, in the event that a user of an online social network visits websites or apps relating to one or more of the categories referred to in that provision and, where appropriate, enters data there by registering or placing online orders, the processing of personal data by the operator of that online social network, which consists in the fact that this operator collects the data resulting from the access to these websites and apps, as well as the data entered by the user, via integrated interfaces, Cookies or similar storage technologies, links the entirety of this data to the respective user account of the social network and uses this data, which must be regarded as a „processing of special categories of personal data“ within the meaning of this provision, which, subject to the exceptions provided for in Article 9 paragraph 2 of the GDPR, is generally prohibited if this data processing allows the disclosure of information falling into one of these categories, regardless of whether this information concerns a user of that network or another natural person (ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 73).
[98] 6.4.2.2. In the present case It is common ground that the defendant's social plugins are also integrated into the websites of political parties, medical websites or homosexual websites visited by the plaintiff, that the defendant has access to the plaintiff's personal data obtained via cookies, social plugins and comparable technologies on third-party websites – and therefore also to those on the websites of political parties, on websites on health topics and on websites that specifically address a homosexual audience, obtained personal data of the plaintiff – processed and used, among other things, to personalize their service. Accordingly, the decision of the ECJ also C-252/21 addressed link to the user account. Furthermore, it is common ground that data processing does not distinguish between „simple“ and „sensitive“ personal data in that it does not extract whether data is sensitive or not.
[99] It follows from these findings that the defendant did not act with the aim of obtaining or filtering out the plaintiff's personal data falling into the specific categories referred to in Article 9 paragraph 1 of the GDPR. However, at the legal level, it does not follow, as the defendant argues, that Article 9 GDPR is inapplicable to this – indiscriminate but sensitive data objectively comprehensive – processing. Rather, the entire processing operation at issue here must be assessed as „processing of special categories of personal data“ (cf ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 73).
[100] 6.4.3. Article 9 paragraph 2 of the GDPR does not provide for a justification corresponding to the permissibility of the necessity for the performance of the contract (Article 6 paragraph 1 lit b GDPR) for the processing of special categories of personal data.
[101] The data processing to be examined in relation to point 8 of the application could therefore not be justified by that alone, even if the conditions of Article 6 paragraph 1 lit b GDPR were met.
[102] Therefore, as long as one of the permissible conditions of Article 9 paragraph 2 GDPR is not met, the existence of the requirements of Article 6 paragraph 1 lit b GDPR is not relevant for assessing the legitimacy of point 8 of the application and can be left aside. Only if the conditions for an offense under Article 9 paragraph 2 GDPR are met must the general processing requirements of Article 6 paragraph 1 GDPR also be taken into account (see RS0132791).
[103] 6.4.4. With regard to the in Art 9 para 2 GDPR standardized reasons for justification are not disputed that the plaintiff has not given consent to the processing of those data that the defendant describes in its terms of use as „data with special protection“ and under which it, among other things, provides personal data about political opinions, health data and data on a person's sexual orientation (in the diction of its terms of use „your political opinion, in whom you 'are interested' are or your health“) counts.
[104] There is therefore no consent of the plaintiff to the processing of his personal data of the specific categories referred to in Article 9 paragraph 1 GDPR within the meaning of the justification element of Article 9 paragraph 2 lit a GDPR before.
[105] 6.4.5. Also the ground for justification of art. 9, para. 2 lit e GDPR is not fulfilled. Accordingly, the general prohibition of any processing of special categories of personal data established in Article 9 paragraph 1 GDPR does not apply if the processing relates to personal data that „the data subject has obviously made public“.
[106] 6.4.5.1. These – as well as all exceptions to the principle of prohibiting the processing of special categories of personal data (ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, para. 76) – Standard requires an examination of whether the data subject intended to make the personal data in question expressly and by means of a clearly corroborating act accessible to the general public (ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 77).
[107] The access to websites or apps relating to one or more of the categories referred to in Article 9 paragraph 1 of the GDPR is not sufficient to make public the data concerning that access, which the operator of the online social network collects via Cookies or similar storage technologies, within the meaning of Article 9 paragraph 2 lit e GDPR (see ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 78 f, 84).
[108] With regard to actions consisting in entering data on these websites or in these apps and pressing buttons included therein – such as „Like“ or „Share“ or buttons that allow the user to access a website or app using the login credentials provided with their F* user account, are linked to his telephone number or email address –, the ECJ points out that these actions involve an interaction between the user and the website or app in question and, where appropriate, the website of the online social network, whereby the public may take different forms of this interaction, since the user may make individual settings in this respect (ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 81). If the users concerned do indeed have such a choice, if they enter data of their own free will on a website or in an app or press buttons embedded in it, they can only be considered to be making data concerning them manifestly public within the meaning of Article 9 paragraph 2 lit e GDPR if they have clearly expressed their decision by making individual settings with full knowledge of the facts, that this data should be made accessible to an unlimited number of people (ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 82).
[109] If such individual settings are not offered, it must be assumed, on the other hand, that when users voluntarily enter data on a website or in an app or press buttons embedded therein, they have only obviously made that data public if, on the basis of explicit information provided on that website or in that app, they have expressly consented to it before such entry or press that the data can be viewed by any person who has access to this website or app (ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 83).
[110] 6.4.5.2. According to the facts established, the applicant's actions by which, when accessing websites related to specific categories of personal data, he would have expressed his desire to make public the personal data resulting from visits to such websites in the manner required by the ECJ through individual attitudes do not exist. According to the findings, such actions are also not a prerequisite for that the defendant also indiscriminately collects „sensitive“ personal data of the plaintiff and processes them in other ways by integrating its social plugins into the websites of third parties.
[111] 6.4.5.3. If the data subject has obviously made data on his or her sexual orientation public – which cannot be ruled out when expressing his or her own sexual orientation in a publicly accessible panel discussion, the recording of which was later to be published as a podcast and on a YouTube channel (see C-446/21, Maximilian Schrems against Meta Platforms Ireland, Rz 78 f) – this does indeed mean that these data can be processed in derogation from the prohibition pursuant to Article 9 paragraph 1 GDPR and in accordance with the requirements arising from the other provisions of the GDPR (C-446/21, Maximilian Schrems against Meta Platforms Ireland, Rz 80).
[112] However, this fact alone does not entitle other to process personal data relating to that person's sexual orientation (C-446/21, Maximilian Schrems against Meta Platforms Ireland, Rz 88, cf. Rz 82).
[113] 6.4.5.4. In the present case, it is common ground that the list of defendants concerning the plaintiff's activities outside F* includes, among other things, apps or websites of two dating platforms aimed at a homosexual audience, as well as the website of a political party.
[114] In the processing –which already includes the storage that took place here – of the information that the plaintiff accessed websites or apps from such dating platforms, there is a processing of personal data of the plaintiff, which, in the sense of the ECJ case law presented, are „different“ personal data on the applicant's sex life or sexual orientation than his „mere“ sexual orientation. Therefore, the fact that the plaintiff communicated his homosexuality to the public did not entitle the defendant to store and, at most, further process the plaintiff's personal data, which provide information that he visited dating platforms (targeted at homosexual people).
[115] This constitutes processing of personal data of specific categories of the plaintiff, which is not covered by the justification of Article 9 paragraph 2 lit e GDPR.
[116] Furthermore, the ground for justification in Article 9 paragraph 2 lit e GDPR does not cover the storage of the personal date via the applicant's access to the website of a political party.
[117] 6.4.6. The defendant has not invoked any other legal offense under Article 9 paragraph 2 of the GDPR.
[118] 6.4.7. Since the data processing to be assessed under point 8 of the application must, according to the case-law of the ECJ, be qualified as – processing special categories of personal data„in its entirety “ without differentiating personal data processed according to the individual „simple“ or – sensitive„personal data with regard to their qualification (cf ECJ C-252/21, Meta Platforms ua against Federal Cartel Office, para. 73), the fact that, in any event, with regard to part of the applicant's personal data covered by Article 9 GDPR, there is no justification under Article 9 paragraph 2 GDPR covering the processing means that the entire processing must be regarded as inadmissible. The ECJ expressly rejects the splitting of the entire process into individual processing processes and different data categories in such an overall process (C-252/21, Meta Platforms ua against Federal Cartel Office, Rz 73).
[119] 6.4.8. As a result, the Item 8 of the claim described data processing from the considerations set out as inadmissible.
[120] 6.4.9.1. The fact that the defendant did not process the personal data of the plaintiff obtained through the use of social plugins and comparable techniques due to the plaintiff's visit to third-party sites for the purpose of personalizing advertising does not preclude the validity of the alleged injunction because the processing was established for other purposes.
[121] 6.4.9.2. Due to the violations of the obligation to cease and desist arising from the facts of the case, the injunction cannot be successfully countered if it is true that the defendant, with regard to individual processing of the plaintiff's personal data, which it collected in the manner described in point 8 of the application (therefore as a controller within the meaning of Article 4, paragraph 8 of the GDPR), subsequently worked as a processor within the meaning of Art. 4 Z 9 GDPR.
[122] There is also no need to restrict the injunction in this regard, because any grounds for justification and resulting restrictions on the injunction already exist by law and may have to be reviewed by the court on the occasion of an execution (RS0114017; 6 Ob 16/21b Rz 27).
[123] 6.4.10. The breach of the obligation to cease and desist and the legal position of the defendants in the proceedings give rise to the Risk of recurrence. The claim for injunctive relief made in respect of point 8 of the application is therefore correct (for the wording of the injunction, see below).
[124] 6.4.11. That the plaintiff has ordered the processing of technical data solely for the purpose of displaying website elements from his injunction exception, lies within the freedom granted to him by virtue of the principle of disposition to determine the scope of his substantive application himself (see only Fucik in Carnival/Konecny, Civil Procedure Acts³ § 405 ZPO Rz 1).
[125] 6.4.12. The second exception to the injunction, which should clearly be understood as an alternative, should apply after the application for judgment if the plaintiff „without any doubt, freely, informed and clearly consented in advance to a specific processing operation ('opt-in'; e.g. by clicking on a 'social plugin')“.
[126] The motion for judgment thus clearly refers to the requirements for effective consent pursuant to Article 4, paragraph 11, Article 6, paragraph 1, letter a of the GDPR. Thus, Article 4 Z 11 GDPR defines consent of the data subject as any expression of will „voluntarily, for the specific case, in an informed manner and unequivocally made in the form of a declaration or other unambiguous confirmatory act by which the data subject indicates that he or she agrees to the processing of personal data concerning him or her“. consent must also be obtained before the controller begins processing the personal data for which consent is required (Kastelitz/Hötzendorfer/Tschohl, The DatKomm [39. Lfg 2020] Art 6 GDPR Rz 31; Buchner/Kühling in Cooling/Buchner, General Data Protection Regulation/BDSG4 [2024] Art 7 Rz 30).
[127] It is not understandable that these conditions should be unverifiable, as the defendant believes.
[128] 6.4.13. In so far as the defendant submitted that point 8 of the request for action should be dismissed because the functioning of the Internet depends on Cookies and it is therefore impossible to comply with the request, it must be made clear that the plaintiff is not opposed per se to the use of cookies, but to the processing of his personal data obtained in a certain way from visits to websites of third-party providers without the existence of qualified consent.
6.5. On the version of the request for injunctive relief
[129] 6.5.1. The court may give the judgment a clear and distinct version that differs from the request if the latter essentially coincides with the request (RS0039357). The request for action must be understood as it is intended by the plaintiff in connection with the statement of claim; the court must correctly define a request that has only been formulated incorrectly by mistake (RS0037440). What matters is which statement of the court the plaintiff desires in connection with the factual argument (RS0041165 [T3]). In this respect, the court is generally not only entitled but even obliged to clarify the matter; this applies in particular where the enforceability of the judgment would otherwise be jeopardised (RS0041254 [T17]; cf RS0039357 [T24]). A clearer official version of the judgment may also be made in the appeal proceedings by the Supreme Court (RS0039357 [T6]).
[130] 6.5.2. As already stated, the plaintiff is opposed to any processing of his personal data that accrues to the defendant in the course of the plaintiff's visit and/or use of third-party websites, in particular through the use of social plugins and similar techniques, unless one of the two exceptions formulated by him – processing of technical data solely for the purpose of displaying website elements or qualified consent – is met.
[131] In the present case, the request for action must be clarified, in accordance with the applicant's objective of legal protection, by instructing the defendant to refrain from using the applicant's personal data obtained from the applicant's visit and/or use of third-party websites, in particular through the use of „social plugins“ and similar techniques, unless the two exceptions indicated are met.
[132] This clarifies the imprecise wording that relied on data „regarding“ the visit and use of third-party sites. The references to the „other execution“ and the future direction of the injunction (cf only 4 Ob 4/22z Rz 28) can be omitted without any change in content. The two exceptions to the injunction formulated by the plaintiff must be combined by the word „or“ instead of „and“ because it is clear from his arguments that he wants two independent constellations – the transmission of data purely for certain technical reasons on the one hand, and qualified consent on the other – to be exempt from the obligation to refrain from doing so.
[133] 6.6. In result The plaintiff's revision of point 8 of the claim is justified in the sense of the clearly clarified injunction evident from the judgment.
7. As regards point 9 of the application
7.1. Submission and course of proceedings
[134] Point 9 of the application seeks to prohibit the defendant from processing personal data of the plaintiff which the defendant has received from third parties for its own purposes, unless the plaintiff has consented to a specific processing operation in a manner described in more detail.
[135] The plaintiff submitted, after the permitted amendment to the claim, that the defendant obtained personal data of the plaintiff from other users as well as from external data providers and advertising partners. There is no legal basis for this because the plaintiff has not given consent, the processing is not necessary for the performance of the contract and there are no overriding legitimate interests of the defendants in obtaining personal data from third parties. The defendant's unauthorized use of the plaintiff's data stored by other users on the F* service is unlawful.
[136] The defendant took the position that it legally processes personal data received from third parties for the purposes stated in its data policy. In the absence of the plaintiff's consent, it does not process such data for the purpose of personalizing advertising. For all other processing, it relies on Article 6, paragraph 1, letter b of the GDPR. The plaintiff's arguments regarding point 9 of the claim are unclear, and the claim should be dismissed due to vagueness. Nevertheless, it is argued that the plaintiff cannot limit the rights of other F* users to freedom of expression and information; he cannot require the defendant, who is to be qualified as a host provider, to actively monitor the information posted by other users about the plaintiff. It was therefore impossible to comply with the requested omission.
[137] The Court of Appeal assessed the processing as lawful under Art. 6 para. 1 lit b GDPR.
[138] In his revision The plaintiff claims that the request covers, in particular, data that the defendant receives from third parties without the plaintiff's knowledge, as well as data that it receives from other users about the plaintiff, for example by uploading contact details or photos of the plaintiff. „For its own purposes“ concerns „in this context“ any purpose other than the original purpose, which, for example, consisted of sharing a photo with an F* friend. The request already includes the mere collection, storage and other processing of data for the defendants' own purposes. There was a violation of the principles of earmarking and data minimization.
7.2. Certainty of injunctions
[139] 7.2.1. A further version may be given to prohibit circumvention (RS0037607; RS0037733). However, an injunction must describe the prohibited conduct so clearly that it can serve as a guideline for the defendant's future conduct. Unspecified, general terms do not meet this requirement. What is owed must be determined in a manner distinctive to the court and the parties (RS0119807). Accordingly, it is permissible to state the specific act of injury and to extend the prohibition to similar interventions, or to describe the inadmissible behavior in a generalizing manner and to clarify it by „in particular“ enumerated individual prohibitions. But the saying must always Core of the act of injury capture (RS0119807 [T5]; cf RS0037733; 1 Ob 100/24y Rz 22; 8 Ob 137/21m mwN). The demarcation criteria must be specified in such a way that there is no shift of the legal dispute into the enforcement proceedings (RS0000878 [T7]).
[140] 7.2.2. In the present case, the plaintiff describes the data processing which he requests to be omitted from point 9 by reference to its purpose, namely processing „for the defendant's own purposes“. The application does not contain any further specification, whether by naming the specific acts of injury combined with the request to extend the prohibition to similar interventions, or by a generalizing description of the inadmissible conduct, including clarification by „in particular“ enumerated individual prohibitions.
[141] The purpose of the individual processing of personal data obtained from third parties carried out by the defendant, and therefore the purpose of each processing, depends on the interpretation of the contractual relationship existing between the parties with regard to each processing in question. If the injunction were to be issued as requested without further specification, this would result in litigation over numerous, shifted previously undefined questions of contract interpretation into enforcement proceedings.
[142] The vagueness of the request – which the defendant has complained about – cannot be remedied by means of a clearer version of the judgment by the court (cf RS0039357) because, with regard to point 9 of the request, it is not merely necessary to clarify what is meant, but to determine the content of what is requested, which is not the task of the court of discernment, but of the plaintiff.
[143] 7.3. For this reason, the plaintiff's appeal against the dismissal of Item 9 of the claim is not justified.
B. On the appeal of the defendants
1. Submission and course of proceedings
[144] 1.1. The plaintiff submitted on point 11 of the request that the defendant had given an incomplete reply to his requests for information. Regarding his last request in 2019, she referred him exclusively to various tools. These did not provide complete information –as he could see, among other things, by comparing it with information previously provided–. Specifically, the defendant referred him to the „Access to your information tool“ and the „Download your information tool“. He tried to use these links to obtain all information provided for under Article 15 GDPR. He had to open 54 links that pointed to more branched links. It already took him several hours to open and load the links. Ultimately, he still does not have all the information owed under Article 15 GDPR. Regardless of the incompleteness of the information, it cannot be assumed that the request for information has been fulfilled in accordance with the law due to its form and presentation. The person responsible had to prepare the information in order to enable those concerned to have an overview within a reasonable time and with reasonable effort.
[145] The defendant submitted that after the GDPR came into force, the applicant's previously submitted request for information could not be successful. After the plaintiff subsequently submitted a new request for information in 2019, she argued that the claim was not justified. It shall provide the claimant „with all the information required under Art. 15 GDPR“. Even if the plaintiff „now finally“ wanted to enforce a „valid“ request for information under the GDPR, he would not have the claim formulated in his request for judgment. Art. 15 GDPR is more limited in its scope than the plaintiff wishes. There is no right to „complete information“. The plaintiff has, to the extent relevant to his claims, only a right to confirmation as to whether or not personal data are being processed and, if so, access to the personal data and the following information: processing purposes, categories of personal data in question; recipients or categories of recipients to whom the personal data have been disclosed, in particular recipients in third countries or international organizations; if the personal data had not been collected from the data subject, all available information about the origin of the data. In addition, the applicable disputes the restrictions on the right to information under Article 15 paragraph 4 and Article 12 paragraph 5 GDPR, as well as the possibility granted to Member States by Article 23 GDPR to provide for exceptions. The defendant did not specify which provisions of national law, which at most fall under Article 23 GDPR, she had in mind. It submitted that it provides its users „all the information required under Art 15 GDPR through a variety of in-product tools“ accessible through the „access to your data tool“. These included the „Activity Log“ and the „Your Advertising Preferences Tool“ along with „other immediate in-product access points such as the 'Info' section of a * user's profile and 'Your Photos'“. The „access to your data tool“, the „activity log“ and the „your advertising preferences tool“ together formed the „core tools“. The tools provided comprehensive access to data and information in compliance with Art. 15 GDPR.
[146] With regard to information on Data and categories of personal data the defendant relies on „a variety of core product tools“. „This information“ is linked to „access to your data tool“, which allows users to see which categories of personal data the defendant stores from him and allows them to view the information directly. For example, let the „activity log“ be a history of a user's activities on F*.
[147] To the processing purposes and „Categories of recipients“ – „Recipient“ does not address the defendant – submitted that the defendant's data policy provides the plaintiff with information about the processing purposes and the categories of recipients, this „in particular“ in three cited sections of the data policy. The „legal basis information“ offers the plaintiff additional – uses not specified in the submissions –.
[148] To origin of the data, she argued that her data policy was in the section „What information do we collect?“ outlining how and where information would be collected. The origin of the data received by the defendant will be explained, including „concerning data from content and information provided by users, from networks and connections, from users' use of products, information about transactions carried out through defendants' products, about things done by others and information they provide, device information and information from partners“. In addition, the „your advertising preferences tool“ provides information about advertisers who have uploaded a list of personal data. This „access to your data tool“ reveals which information is provided to the defendant by third parties for advertising purposes.
[149] In summary, the defendant complies with its obligations under Article 15 GDPR. In addition, users could contact F* separately if they wanted to receive information about specific data points.
[150] 1.2. The First Court assessed the claim as justified.
[151] 1.3. The Court of Appeal found the defendant guilty, by way of a confirmation of condition, of providing the plaintiff with information in writing and free of charge about all of the plaintiff's personal data processed by the plaintiff, specifying the purposes for which the personal data had been or would still be disclosed, and – insofar as the personal data were not collected from the plaintiff party– about the origin.
[152] It assessed the findings that the plaintiff's request for information made in 2019 referred to relevant online tools of the defendant, with which the defendant provided only part of the personal data it processed about the plaintiff, as meaning that the plaintiff's claim for information under Article 15 paragraph 1, second half of the GDPR does not meet and is therefore still valid. The defendant's legal challenge also did not start from the established facts in essential respects.
[153] 1.4. The revision The defendant claims, in summary, that the Court of Appeal fails to recognize that Article 15 paragraph 1 of the GDPR does not require information about all processed personal data of a data subject. It had fulfilled its obligation to provide information by means of the information provided in its data policy. The Court of Appeal misinterpreted the findings made, failed to mention third-party rights, neglected the excessive nature of the plaintiff's request for information, disregarded statutory reservations under Irish law, wrongly failed to satisfy a summary, failed to note that the request for information was for the plaintiff „just a game“, exceeded the required scope of the right to information with regard to the purposes, recipients or categories of recipients and origin of the data, failed to recognize, that the plaintiff was in fact demanding information about the logic involved within the meaning of Art. 15 para. 1 lit h GDPR and had exceeded the original request in one respect by confirming the proviso.
2. On the right to information pursuant to Article 15 paragraph 1 GDPR
2.1. General and purpose of the right of access
[154] 2.1.1. If personal data concerning a person is processed –which is established in the present case–, that person has a right to information about that personal data and the further information listed in letters a to g of this provision from the controller under Article 15 paragraph 1 GDPR. The right to information must be considered as a uniform claim (Ehmann in Ehmann/Selmayr, GDPR³ [2024] Art. 15 Rz 6 with reference to C-487/21, Austrian Data Protection Authority and CRIF, para. 30 ff).
[155] 2.1.2. Article 15 paragraph 1 of the GDPR represents one of the provisions intended to ensure the transparency of the way in which personal data are processed with regard to the data subject (ECJ C-579/21, Pankki, Rz 53).
[156] In accordance with the principle of transparency, referred to in recital 58 of the GDPR and expressly enshrined in Article 12 paragraph 1 of the GDPR, information intended for the data subject must be communicated in a precise, transparent, understandable and easily accessible form in clear and simple language (see ECJ C-203/22, Dun & Bradstreet Austria, Rz 49; C-579/21, Pankki, Rz 51; C-487/21, Austrian Data Protection Authority and CRIF, Rz 49). The ECJ has expressly made it clear that this must also be observed when applying Article 15 GDPR (ECJ C-579/21, Pankki, Rz 51; cf C-203/22, Dun & Bradstreet Austria, Rz 48 f).
[157] The right to information under Article 15 GDPR must enable the data subject to verify whether data concerning him or her is correct and whether it is processed in a permissible manner (ECJ C-203/22, Dun & Bradstreet Austria, Rz 53). It is necessary, in particular, to enable the data subject, where appropriate, to exercise his or her right to rectification, his or her right to erasure („right to be forgotten“) and his or her right to restriction of the processing to which he or she is entitled under Articles 16, 17 and 18 of the GDPR, and to exercise their right to object to the processing of their personal data provided for in Article 21 GDPR or, in the event of damage, their right to seek judicial redress provided for in Articles 79 and 82 GDPR (ECJ C-203/22, Dun & Bradstreet Austria, Rz 54; C-487/21, Austrian Data Protection Authority and CRIF, Rz 35; C-154/21, RW against Austrian Post, Rz 38).
[158] According to the 60th recital to the GDPR, the principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purposes, whereby the controller should provide all further information necessary to ensure fair and transparent processing, taking into account the specific circumstances and framework under which the personal data are processed (ECJ C-487/21, Austrian Data Protection Authority and CRIF, Rz 36).
2.2. Scope of the right of access
[159] 2.2.1. The right to information in Article 15 paragraph 1 GDPR refers to personal data, i.e. refers to the legal definition of Article 4 paragraph 1 GDPR (cf ECJ C-579/21, Pankki, Rz 40). The use of the phrase „all information“ in determining the term „personal data“ in this provision reflects the objective of the Union legislature to give this term a broad meaning (ECJ C-579/21, Pankki, Rz 42). Therefore, the broad definition of the term „personal data“ covers not only the data collected and stored by the controller, but also all information about an identified or identifiable person resulting from the processing of personal data (ECJ C-579/21, Pankki, Rz 42; C-487/21, Austrian Data Protection Authority and CRIF, Rz 26).
[160] 2.2.2. Article 15 paragraphs 1 and 2 of the GDPR standardise the content of the right to information, namely the information as to whether personal data is being processed at all, the specifically processed data and the corresponding additional information, also called metadata or annex information, such as the processing purposes, recipients and origin (see Haidinger in Knyrim, The DatKomm [79. Lfg 2024] Art 15 Rz 3).
[161] The data subject shall always have the right to information about all to request personal data and the associated information unless there is a reason for exclusion provided for in the GDPR (Ehmann in Ehmann/Selmayr, GDPR³ [2024] Art. 15 Rz 52). The note contained in the last sentence of recital 63 GDPR that controllers who processed large amounts of information about the data subject should be able to request that the data subject specify to which information or processing operations his request for information refers does not change this (baker in Cooling/Buchner, General Data Protection Regulation/BDSG4 [2024] Art 15 Rz 30; cf Ehmann in Ehmann/Selmayr, GDPR³ [2024] Art. 15 Rz 53 f). Even if a person requesting information does not comply with the request for clarification, this does not justify a refusal to provide information (Ehmann in Ehmann/Selmayr, GDPR³ [2024] Art. 15 para. 53); the data subject is free to request information about all available data and meta-information (baker in Cooling/Buchner, General Data Protection Regulation/BDSG4 [2024] Art 15 Rz 30).
[162] The ECJ has a duty to be complete (cf baker in Cooling/Buchner, General Data Protection Regulation/ BDSG4 [2024] Art. 15 para. 30) confirmed by expressly claiming it with regard to the right to receive a copy of the personal data subject to processing, in accordance with Art. 15 para. 3 GDPR, which „does not grant a different right than provided for in its para. 1“ (ECJ C-312/23, Addiko Bank, Rz 26; C-307/22, FT against DW, Rz 72; C-487/21, Austrian Data Protection Authority and CRIF, Rz 32).
[163] 2.2.3. In addition to providing information about the processed data, Article 15 paragraph 1 GDPR grants the data subject the right to the following information:
a) the processing purposes;
b) the categories of personal data that are processed;
c) the recipients or categories of recipients to whom the personal data have been or are still being disclosed, in particular recipients in third countries or international organisations;
d) if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining that duration;
e) the existence of a right to rectify or delete personal data concerning them or to restrict processing by the controller or a right to object to such processing;
f) the existence of a right of appeal to a supervisory authority;
g) if the personal data are not collected from the data subject, all available information about the origin of the data;
h) the existence of automated decision-making, including profiling, in accordance with Article 22 paragraphs 1 and 4 and – at least in these cases – meaningful information on the logic involved and the scope and intended effects of such processing for the data subject.
[164] 2.2.4. In view of the fact that the data subject is not obliged to justify the request for information about the data, the ECJ made it clear that it does not preclude a claim for information if the data subject thereby purpose pursued as the one addressed in the first sentence of recital 63 to the GDPR, to take note of the processing and to verify its legality (ECJ C-307/22, FT against DW, Rz 43; cf 6 Ob 233/23t Rz 28).
2.3. Application of these principles to the present case
[165] In the present case, the Assessment of the lower courts that the defendant did not provide the plaintiff with complete information about the personal data it processed is correct.
[166] This follows from the fact that, following the findings in its tools to which it referred the plaintiff in order to fulfil its last request for information, the defendant „[provides] only part of the data it processes about the plaintiff, namely only that which it considers relevant and interesting for the user“.
[167] This incompleteness has not been remedied in the course of the present proceedings. The defendant did not claim to have provided the plaintiff with information during or during the proceedings by which it would have fulfilled its obligation to provide information.
[168] All that can be seen from your procedural submissions is that if the plaintiff wishes to obtain the information cited in Article 15 paragraph 1 of the GDPR, he must consult a variety of sources which have not been conclusively listed by the defendant. Rather, their procedural submissions regarding the tools that should enable users to obtain the information covered by the right to information in Article 15 paragraph 1 of the GDPR are –as can be seen from the above reproduction– only exemplary. Even taking into account the fact that the claim does not expressly refer to all the annex information cited in Article 15 paragraph 1 of the GDPR, it cannot be inferred from the defendants' procedural submissions that their list of sources of information claims to be exhaustive with regard to individual aspects.
[169] The question of whether the information due under Article 15 GDPR can be fully fulfilled by referring the person concerned to having to download certain general or individually relevant information himself does not need to be addressed, because in a merely exemplary list of information sources, no transmission in the „precise[s], transparent[s] required by the ECJ is required understandable[s] and easily accessible[s] form“ (cf ECJ C-203/22, Dun & Bradstreet Austria, Rz 49) can be seen.
[170] The Court of Appeal's Assessment that, in the absence of information corresponding to a type 15 GDPR, the plaintiff's claim for information asserted here is justified is therefore correct.
[171] However, the objections raised by the defendant in the appeal are not justified:
2.4. Objections by the defendants
[172] 2.4.1. The defendant doubts that the data processed „about the plaintiff“ that it did not provide to him were personal data of the plaintiff. This legal view cannot be reconciled with Art. 4 Z 1 GDPR.
[173] According to Article 4 Z 1 GDPR, the expression „personal data“ means all information relating to an identified or identifiable natural person; an identifiable natural person is a natural person who, directly or indirectly, in particular by means of an assignment to an identifier such as a name, to an identification number, to location data, to an online identifier or to one or more special characteristics, expresses the physical, physiological, genetic, psychological, economic, cultural or social identity of this natural person can be identified.
[174] That, according to the case law of the ECJ, a broad understanding of the term must be assumed, which covers not only the data collected and stored by the controller, but also all information about an identified or identifiable person resulting from the processing of personal data (cf C-579/21, Pankki, Rz 42; C-487/21, Austrian Data Protection Authority and CRIF, para. 26), has already been explained.
[175] The findings made by the first court regarding the extent of the data made available –or considered by it to be irrelevant to the user– relate, both in terms of wording and context, to the data processed by the defendant „via the plaintiff“ and, in law, to the plaintiff's personal data.
[176] 2.4.2. In its appeal, the defendant complains about the disregard of the restrictions pursuant to Article 15, paragraph 4 of the GDPR by the Court of Appeal and lacks reference to restrictions on the right to information imposed in national Irish and Austrian law pursuant to Article 23 of the GDPR, as well as to Article 12, paragraph 5 of the GDPR. The Court of Appeal was wrong to fail to „substantively examine or discuss missing data“ „to determine whether an exception or restriction applies to any 'missing' data points“. That this is the case is – according to the appeal – implied by the facts established „“.
[177] 2.4.2.1. The defendant does not disclose which provisions of Irish or Austrian national law it has in mind, even in the appeal proceedings.
[178] 2.4.2.2. Insofar as it does not intend to disclose the user behaviour of the plaintiff (click behaviour), which led to the temporary blocking of the function „Why Am I Seeing This Ad“ for the plaintiff, on the grounds that this affects the rights of third parties, namely the rights of other users, to use the F* service in a secure manner, this argument does not find any coverage in the established facts, so that there is nothing to be gained from it for the defendant. It is found that in order to ensure the security „of the data“, the defendant considers it necessary to prevent excessive clicking on certain functions. That the disclosure of reasons for which the function „Why Am I Seeing This Ad“ was temporarily blocked for the plaintiff would affect the rights and freedoms of other users with regard to the security of use of the F* service follows from the facts established, which must be assumed when the legal complaint is carried out (see only RS0043312), but not.
[179] The fact that the defendant describes as „excessive“ the clicking behavior of the plaintiff, who after the findings had „quickly and repeatedly“ clicked on the function „Why Am I Seeing This Ad“, does not make the plaintiff's request for information „excessive“ within the meaning of Article 12 paragraph 5 GDPR.
[180] 2.4.2.3. The obstruction of the infringement of third-party rights and freedoms referred to in recital 63, sentence 5, of the GDPR and in Article 15, paragraph 4 of the GDPR (specific to the right to copy data) (see ECJ C-579/21, Pankki, para. 77 f) may make it necessary to carry out a corresponding balancing of interests with regard to individual pieces of information (cf ECJ C-579/21, Pankki, para. 80) to verify whether an information provided is complete within the meaning of Article 15 of the GDPR despite the lack of specific individual information. However, in the present case, where complete information is not available simply because the defender did not make available to the plaintiff all the personal data it had processed about him, but only allowed him access to the personal data it considered relevant, the merely general reference to the rights and freedoms of third parties is irrelevant.
[181] 2.4.3. Insofar as the defendant objects that the lower courts were wrong not to examine whether a „supposedly missing date“ gave the plaintiff „otherwise“, for example within the framework of the tools made available, it ignores the finding that the defendant, with the help of its tools, provided the plaintiff with only part and not all of the data it processed about him.
[182] 2.4.4. Finally, the revision of the ECJ decision still issued on the Data Protection Directive 95/46/EC C-141/12, 372/12, YS, deduce that the plaintiff's claim for information does not lawful purpose persecution. It should be clarified that it does not preclude a claim for information if –which is not certain in the present case anyway– the person concerned is pursuing a purpose other than that referred to in the first sentence of recital 63 in the preamble to the GDPR to take note of the processing and to verify its legality (ECJ C-307/22, FT against DW, Rz 43; cf 6 Ob 233/23t Rz 28). There is nothing to be gained from the defendant's legal position in the cited decision of the ECJ, which had as its subject the sought-after access to a draft decision of an authority.
[183] 2.4.5. The fundamental objections raised by the defendant in the appeal proceedings against her conviction to provide information therefore do not catch on.
2.5. Requested information about metadata
[184] The appeal objects that the Court of Appeal obliges the defendant in several respects – concerning processing purposes, recipients and origin of personal data – in a GDPR above Article 15 paragraph 1 additional scope to provide information.
[185] This is not the case –as explained below–.
2.5.1. Information on processing purposes
[186] 2.5.1.1. According to Article 15 paragraph 1 lit a GDPR, the scope of the data subject's right to information includes information about the processing purposes. The fact that the defendant was obliged to provide the plaintiff with information about the plaintiff's personal data that it had processed, specifying the purposes of processing, therefore corresponds to the legal situation.
[187] 2.5.1.2. In truth, the appeal does not seek to show that the scope of the information awarded to the plaintiff differs from Art. 15 para. 1 lit a GDPR with regard to information on the processing purposes, but rather to show that the defendant has already fulfilled the plaintiff's right to information with the sources of information made available to its users.
[188] 2.5.1.3. It has already been explained that the mere exemplary enumeration of information sources is not sufficient to fulfil the right to information and also applies with regard to information about the processing purposes.
[189] In so far as the defendant submits in its revision that the information on the processing purposes is found, firstly, in its data policy, secondly in the „Legal Basis Information“ and thirdly in its „User Training Modules“ –for which, again by way of example, it contains the „Privacy Basis“ pages, the „Privacy Check Tool“, the „Control Center“, the „Ad Preferences Tool“, the Tool „About F* Ads“, the „Activities outside of F* Tool“ and the Function „Why do I see this ad?“ mentions –, this enumeration is not even congruent with its submission made in the first instance for information on the processing purposes. To demonstrate that the defendant has provided the information owed in „precise, transparent, understandable and easily accessible form“ (see ECJ C-203/22, Dun & Bradstreet Austria, Rz 49) have already given, the appeal is therefore unsuitable for information about processing purposes.
2.5.2. Information about the recipients
[190] 2.5.2.1. As far as the defendant objects, not to provide information about recipient to be obliged because Article 15 paragraph 1 of the GDPR allows the possibility of disclosing only the „categories of recipients“, this question was raised by the ECJ in its judgment C-154/21, RW against Austrian Post, clarified.
[191] Accordingly, Article 15 paragraph 1 lit c of the GDPR must be interpreted as meaning that the right of the data subject to obtain information about the personal data concerning him or her, as provided for in that provision, requires that, where that data has been or is still being disclosed to recipients, the controller is obliged to inform the data subject of the identity of the recipients, unless it is not possible to identify the recipients, or that the controller proves that the requests for information from the data subject are manifestly unfounded or excessive within the meaning of Article 12 paragraph 5 of the GDPR; in this case, the controller may only inform the data subject of the categories of recipients concerned (C-154/21, RW against Austrian Post, Rz 51).
[192] The controller's right to indicate, at his or her own discretion, either specific recipients or only categories of recipients does not therefore arise from Article 15 paragraph 1 lit c GDPR.
[193] The obligation to provide information expressed by the Court of Appeal therefore does not exceed the material content of Article 15, paragraph 1 of the GDPR insofar as it seeks information about recipients and not optionally about „recipients or categories of recipients“. The fact that the right to information about „recipients“ relates to identifiable recipients is already clear from the ECJ's interpretation of this concept of law. The defendant, who already pointed out in the proceedings at first instance the restrictions on the obligation to provide information resulting from Article 12 paragraph 5 GDPR, has not demonstrated that the application would be manifestly unfounded or excessive under the second sentence of Article 12 paragraph 5 GDPR.
[194] 2.5.2.2. At this point, it is already necessary to comment on the appeal claim that the Court of Appeal, in the course of its confirmation of the conditions, exceeded the original request for judgment made by the plaintiff.
[195] The request for action is to be understood as it is intended in conjunction with the plaintiff's narrative of the action. The court must correctly formulate a request for action that has only been formulated incorrectly by mistake. A formulation amended in this context does not exceed the request within the meaning of § 405 ZPO (RS0037440; RS0041207 [T1]).
[196] The minor change in wording made by the Court of Appeal was intended to eliminate unclear words or sequences of words that do not have exequible content and to align the wording of the obligation to provide information more closely with the wording of Article 15 GDPR. By rephrasing the request for information „of the exact recipients“ to the effect that the „recipients to whom the personal data have been disclosed or are still being disclosed“ (cf. Art. 15 para. 1 lit c GDPR) must be notified, the Court of Appeal, in the context of the claim made by the plaintiff, which referred to Article 15 GDPR and which, with regard to information about the recipients of the plaintiff's personal data, does not contain any restriction on the data passed on in the past.
[197] Regarding the defendant's concern that information about recipients to whom the data would be transmitted in the future would not be possible due to a lack of knowledge of how the plaintiff would use the service „from a compliance perspective“, it should be noted that the obligation to provide information about specific recipients (instead of categories of recipients) does not exist in any case if specific recipients are not yet known (cf C-154/21, RW against Austrian Post, Rz 48).
2.5.3. Information about the origin
[198] 2.5.3.1. If the personal data have not been collected from the data subject, the data subject has a right to all available information about the origin of the data.
[199] The obligation imposed on the defendant by the Court of Appeal therefore does not go beyond Article 15 GDPR, even with regard to information about the origin of the plaintiff's personal data.
[200] 2.5.3.2. In its revision, the defendant takes the position that it has already complied with this obligation.
[201] One of the requirements for information in „precise, transparent, understandable and easily accessible form“ (cf ECJ C-203/22, Dun & Bradstreet Austria, para. 49) However, no corresponding information about the origin of the plaintiff's personal data obtained from third parties was provided.
[202] In addition to the lack of completeness of the information already pointed out, which means that the plaintiff's claim for information remains unfulfilled, it is common ground that the list of third parties who submitted information about the plaintiff to the defendant, downloadable with the help of the „activities outside F* tools“, did not contain any information about which specific personal data of the plaintiff the third parties cited therein transmitted to the defendant.
[203] In view of the purpose of the right of access under Article 15 GDPR to enable the data subject to verify the admissibility of the processing of personal data concerning him (see ECJ C-487/21, Austrian Data Protection Authority and CRIF, para. 34), the mere information about the identity of those persons who provided the defendant with personal data of the plaintiff is insufficient. For it is obvious that the legality of a particular third party's transmission of data to the defendant depends largely on what data it was.
[204] For these reasons, the defendant's legal position that it has already fulfilled its obligation to provide information about the origin of the plaintiff's personal data, which it did not collect from the plaintiff, does not apply.
2.5.4. Information about the logic used
[205] The revision of Article 15 paragraph 1 lit h GDPR is therefore pointless, because the request for action is not aimed at providing information on the existence of automated decision-making, including profiling, in accordance with Article 22 paragraphs 1 and 4 of the GDPR and – at least in these cases– meaningful information on the logic involved and the scope and intended effects of such processing for the data subject.
C. Outcome
[206] Taking into account the partial judgment of 23 June 2021 (6 Ob 56/21k) legally assessed claims prove to be the Revision of the plaintiff as regards points 1 to 5, including the contingent claims made in relation to points 4.1. and 5.1., as well as points 7 and 9 of the claim as not justified, but as regards points 6 and 8 of the claim as justified.
[207] The Revision of the defendant is not entirely justified (points 11 and 12 of the application).
Regarding III. (Cost reservation)
[208] The decision on the costs of the proceedings of all three instances was to be left to the court of first instance, since the court of first instance reserved the decision on costs until the final settlement. The Supreme Court is also bound by this (RS0129336).
Appunta · Stampa · Cita: 'Doc 100765' · pdf