In a recent judgment, rendered on 15 April 2021, the Austrian Supreme Court (Oberste Gerichtshof, OGH) held that the processing of data on the subject’s affinity for a political party constitutes a special category of personal data. This applies even if the data concerned is based on anonymized polls and statistics.

In addition, by request for a preliminary ruling pursuant to Art. 267 TFEU, the OGH submitted fundamental questions pertaining to the interpretation of Art. 82 GDPR to the European Court of Justice (CJEU). More specifically, it sought clarification on the requirements of awarding damages based on GDPR violations and the assessment of said compensation under Art. 82 GDPR.

Facts

The facts underlying this case find their origin in a separate legal dispute (6Ob35/21x).

• The Defendant sold personal data for third-party marketing purposes as an address publisher (‘Adresshändler’) under § 151 Austrian Trade Regulation Act (Gewerbeordnung 1994, GewO);
• The information collected by the Defendant included details as to the party affinity of Austrian nationals;
  Following an access request (Art. 15 GDPR), the Claimant learnt that the Defendant had presumed the Claimant’s political affinity to lie with the Austrian Freedom Party (FPÖ);
• The information regarding the subject’s affinity was derived through the use of an algorithm to define “target group addresses” according to socio-demographic characteristics;
• Without consent having being given with respect to the processing and storing of data, the Claimant requested:
• An injunction to prevent the Defendant from processing data on his presumed political views;
• Compensation of EUR 1, 000 for the immaterial damage caused as a result of the party affinity that had been assigned to him, which he deemed to be insulting, shameful and damaging to credit.

While the injunction request was upheld by the Vienna Regional Court for Civil Matters (Landesgericht für Zivilsachen), damages were denied for reasons of failing to meet the required threshold for compensable immaterial damage. The decision was confirmed by the Higher Regional Court (Oberlandesgericht). The decision was appealed by both parties.

Legal Issues

The OGH judgment focused on 1) whether data concerning the party’s affinity for political parties qualifies as personal data (Art. 4(1) GDPR); 2) whether said data constitutes a special category of personal data (Art. 9 GDPR); 3) whether the Defendant must refrain from continuing to process the Claimant’s data in the future; 4) whether the processing of data entitles the Claimant to compensation (Art. 82 GDPR).

Partial Ruling by OGH

• Personal Data (Art. 4(1) GDPR)
• Personal data refers to any information relating to identified or identifiable natural persons (‘data subjects’);
• An identifiable natural person must be one that can be identified, directly or indirectly by particular reference to an identifier;
• Personal data was held to include data obtained using subjective and/or objective assessments (i.e. non-personal data, e.g. polls/statistics) given that it allowed the ‘affinity for a political party’ to be directly assigned to an identified/identifiable natural person;
• The validity of the alleged affinity is hereby irrelevant;
• The fact that the information was merely an expression of the subjects assumed interest in a particular political party is equally immaterial.¹

Special Category of Personal Data (Art. 9 GDPR)

• The term ‘political opinion’ is to be interpreted broadly to guarantee a uniform and high level of protection;
• Any risk of severe discrimination as a result of processing particular kinds of data is to be undermined;
• Data as to the political preferences of subjects gives rise to potential discrimination and thus must be regarded as falling within the scope of political opinion pursuant to Art. 9 GDPR.²

Remedy (Art. 79 GDPR)

• The right to an effective judicial remedy is guaranteed under Art. 79 GDPR where the rights of the data subject have been infringed as a result of the processing of his or her personal data in non-compliance with GDPR provisions;
• In the absence of explicit consent being given by the subject, the processing of data on the affinity for a political party is deemed unlawful under 9(2)(a) in and of itself;
• The fact that the relevant data had been deleted/not published, i.e. taking place internally but not appearing externally, is immaterial since it does not remove the danger of said data being (re)created in the future;
• An injunction is to be upheld where the possibility of data being recreated in the future exists.

Questions referred to the CJEU

The Austrian Supreme Court requested a preliminary ruling by the CJEU under Art. 267 TFEU on the interpretation and application of the claim for damages regulated in Art. 82 GDPR.

In particular, the CJEU is asked to clarify:

• Whether a claim for damages, in addition to the violation of a GDPR provision, requires the Claimant to have suffered specific damages or whether said violation is sufficient to qualify for the award;
• Whether additional requirements of EU law, beyond the principles of effectiveness and equivalence must be considered by national courts in its assessment of damages;
• Whether the threshold for non-pecuniary/non-material damages requires that the infringement has consequences of a certain degree or weight that extends beyond anger or annoyance caused by said infringement.

Although typically pursued via mass claims, any person that has suffered material or non-material damage as a result of an infringement of a GDPR provision, retains the right to bring legal action under Art. 82 GDPR.

Companies are well advised to monitor press reports on data loss closely and identify indicators of data protection violations early to allow for the expeditious revision of shortfalls within existing data protection regulations. Further it would be beneficial to ensure that the documentation and internal processes are brought in line with GDPR principles and implementation requirements. To this end, the review of past decisions relating to Art. 82 GDPR at both domestic and EU level will be instrumental. It is evident that based on the referral of preliminary questions by the OGH to the CJEU, an important foundation has been laid that could allow for a uniform interpretation of data protection law on damages.

Footnotes

1. See also 6Ob127 / 20z (OGH); W258 2217446-1 (BVwG).

2. See also W258 2217446-1 (BVwG).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.