OGH on the Purpose of Data Protection Laws

Jun 28, 2024 Benn-Ibler Rechtsanwälte

The Austrian Supreme Court (Oberster Gerichtshof, hereinafter OGH) has clarified that the protective purpose of the Data Protection Act does not extend to the right to claim damages from the responsible party for a justified refusal to pay an insurance benefit.

In the case at hand, the plaintiff, a tenant in the defendant’s building, had claimed damages for an alleged breach of data protection law after his full-coverage motor insurance policy refused to cover the repair of his car. After having consumed a considerable amount of alcohol, the plaintiff had caused an accident in his car park, which was recorded by the defendant’s CCTV system. In his accident report to the insurer, the plaintiff claimed that he had pressed the accelerator pedal instead of the brake pedal because of a cat that had suddenly appeared in front of the car.

After the insurance company had issued a provisional coverage note, an employee of the insurance company discovered the CCTV cameras on site and contacted the defendant, who then provided the insurer with the CCTV recording. As a result, the insurer refused to cover the repair costs of approximately EUR 18,000. A settlement was reached in the ensuing coverage dispute between the plaintiff and the insurer.

The plaintiff then sued the defendant for payment of the repair costs.

The claim was dismissed by the first instance court and the court of appeal. The OGH upheld this decision and dismissed the appeal as well.

According to Art. 82 of the General Data Protection Regulation (GDPR), any person is entitled to compensation in the event of a breach of the GDPR. Art. 29 of the Data Protection Act (DPA) substantiates this right and provides that the general provisions of civil law apply to this claim for damages. In the case at hand, the OGH stated that the damages claimed are not covered by the protective purpose of the data protection provisions. The claim therefore fails for lack of being linked to unlawfulness. The plaintiff cannot claim compensation for a justified refusal of insurance benefits due to an (alleged) breach of data protection. The requirement of effectiveness under EU law does not lead to a different result either, as this would be tantamount to compensation for attempting to fraudulently obtain insurance benefits.

OGH 6 Ob 70/24y (15 May 2024)