Austrian OGH: Applying Country-of-Origin Rules to Access User Data

Apr 30, 2026 Benn-Ibler Rechtsanwälte

The Austrian Supreme Court (Oberster Gerichtshof, OGH) recently examined the question of whether an Irish platform operator could be compelled to disclose information regarding a user who had disseminated personal data during a social media backlash.

In the original case, the applicant had sought information from the operator of a communication platform regarding the name, address, and email address of a user. This user had published the applicant’s name, postcode, and place of residence in a comment under a post about the applicant’s fashion label. The applicant argued that this infringed her personal rights and that she required the data in order to assert claims for an injunction and damages against the user.

International jurisdiction may be an option

The court of first instance affirmed the international jurisdiction of Austrian courts and granted the application for information regarding the name and address. However, the appeal court denied international jurisdiction and dismissed the application.

The OGH partially quashed this decision, ruling that an infringement of the right to information under Section 13(3) of the Austrian E-Commerce Act (E-Commerce-Gesetz, ECG) could constitute a ‘tortious act’ under Article 7(2) of the Brussels I Regulation. This could therefore open up the international jurisdiction of Austrian courts over a foreign platform operator.

No departure from the country-of-origin principle

In this specific case, however, it was Irish law that applied, not Austrian law. Under the country-of- origin principle (Section 20 et seq. ECG), the legal requirements for a service provider are generally governed by the law of the country in which the provider is established.

Deviation from this standard is only considered in instances involving exceptionally serious violations of personal rights or public order. According to the OGH, the information disclosed here—such as an individual's name, postal code, and place of residence from the trademark register—does not constitute such a level of seriousness. Furthermore, a general statement regarding the user's participation in a social media backlash is insufficient to warrant this exception.

Examination of Irish law

In ongoing proceedings, the court of first instance is required to ascertain whether Irish law provides a right to access information concerning the user’s name and address. This determination is a prerequisite for evaluating whether Austrian courts possess international jurisdiction.

OGH, 6 Ob 185/24k, 28 January 2026

data protection, country of origin principle, user data, personal rights, right to information