OGH: Privacy policy subject to clause review

26. January 2023

In its judgement of 23.11.2022 in case 7 Ob 112/22d, the Supreme Court (OGH) subjected the "data protection notice" of an insurance company to a clause review under the Consumer Protection Act after a complaint by the Association for Consumer Information (VKI).

In the insurance contract, the customers had to confirm that they had taken note of the "data protection notice". Even if such an acknowledgement is interpreted in the most customer-friendly way, it could still imply consent to the notice’s content.

The data protection notice therefore does not merely serve the purpose of providing information as defined in Art. 13 f of the GDPR, but has the character of a contractual declaration (legal intention), and so is to be regarded as a contractual provision.  The entire data protection notice was therefore subject to clause review.

The Supreme Court then examined all the information in the data protection notice on the basis of the most anti-customer interpretation. The result was that the clauses subject to complaint were non-transparent and grossly disadvantageous.

The VKI’s complaint was therefore upheld and the defendant insurance company was ordered to refrain from using the objectionable clauses in its business dealings with consumers.

Given the Supreme Court’s strict ruling, companies should urgently check their references to their data protection declarations, cookie policies, etc. and also subject the content of documents to a review, to ensure they could withstand a judicial review according to the provisions of consumer law in the event of a case.