OGH on Data Protection Clauses in GTCs

Jun 30, 2023 Benn-Ibler Rechtsanwälte

The Austrian Supreme Court (Oberster Gerichtshof, hereinafter OGH) has declared several data protection clauses in a pay TV providers’ general terms and conditions to be invalid.

Data transmission for address matching

In an email, the defendant had stated:

‘Your data is being forwarded to the Austrian Post for the purpose of address matching (based on legitimate interest under Art. 6 I f GDPR). Should there be any changes, your data will be updated. If you do not agree to this, you can refuse your permission here by 20 May 2020.’

This is not a mere statement of knowledge, but a contractual clause. The defendant in fact is granting the possibility of refusal and at the same time assuming consent if the consumer does not object. This clause is ineffective because it is entirely unknown which of the consumer’s data will be forwarded to the Austrian Post. Also, consumers cannot obtain sufficient insight into their rights and obligations based on the ‘legitimate interest’ declared by quoting Art 6(1)(f) of the GDPR. Therefore, the clause is non-transparent.

Data protection information

In a longer section there was a statement on how and for how long a customer's personal data would be processed and stored and to whom the data would be transmitted. Customers are led to understand that these statements mean that data processing to the extent described therein is lawful, which is why the clause has legal effects and is not purely informational in character. However, this clause is also non-transparent for the following reasons:

• With regard to the data retention period, a reference to the ‘statutory retention periods’ (in particular according to Austrian Commercial Code, UGB, and the Austrian Federal Fiscal Code, BAO, is not sufficient. Furthermore, this only refers to ‘personal data’ without specifying which data is at issue.
• The fact that ‘data’ are transferred to ‘third parties who have a contractual relationship with the subscriber (e.g. IPTV providers and service providers who provide services on behalf of the defendant’ leaves the consumer in the dark as to which specific data are the subject of the transfer and to whom these data are transferred.

OGH 6 Ob 222/22y (17.05.2023)