OGH: Statistically derived probability data constitute personal data

Apr 14, 2021 Benn-Ibler Rechtsanwälte

Data calculated via statistical probabilities and merely "attributed" to a person are also personal data within the meaning of the General Data Protection Regulation (GDPR).

Upon the plaintiff's request, the defendant provided him with information about the personal data processed in relation to his person. In particular, the following data had been stored about the plaintiff: Telephone number, academic, do-it-yourselfer, affinity for investments, affinity for organic food, night owl.

These affinities were attributed to the plaintiff on the basis of a marketing analysis procedure. The attribute "affinity for investments" was therefore not assigned to the plaintiff on the basis of special circumstances concerning the person, but on the basis of certain socio-demographic circumstances (age, place of residence, etc.) with regard to which the existence of this attribute was assumed with a certain probability.

The court of first instance took the view in the proceedings that the probability figures determined were not statements about specific persons, but rather anonymous, abstract averages of marketing groups and were merely "attributed" to a person.

The Austrian Supreme Court (Oberster Gerichtshof, OGH) disagreed with this view and made it clear that Article 4(1) of the GDPR defines personal data as any information relating to an identified or identifiable natural person. The term also includes opinions, motives, beliefs, assessments and judgments about the data subject. Data relating to a person are also personal if they are inaccurate.

According to the OGH, the presence of personal data is not affected by the fact that the data was only calculated using statistical probabilities because it was directly assigned to the plaintiff and contains statements about his preferences. Whether these assessments are actually correct is irrelevant.

OGH 6 Ob 127/20z (18.02.2021)