DSB Cases

On 10 August 2026, I unexpectedly received an email informing me that an account had been created on a dating/communication platform using my personal Gmail address. I had not created this account, had not initiated the registration, and had not authorized another person to use my email address for this purpose. The timing was particularly…

1. An unexpected newsletter In 2026, I began receiving newsletters from a well-known international news organization at my personal email address. The newsletters stated that I was receiving them because I had signed up for updates. I did not recall making such a subscription. Rather than simply unsubscribing, I wanted to understand how my email…

Status: Proceedings before the Austrian Data Protection AuthorityInitial event: May 2026Relevant GDPR provisions: Articles 12 and 15 GDPRMain issue: An unsolicited invitation to speak at an international AI conference was sent to my professional email address. My subsequent request to establish the source and processing of my personal data was not answered within the statutory…

Status: Complaint submitted to the Austrian Data Protection AuthorityDate of complaint: 21 August 2026Relevant GDPR provisions: Articles 12 and 15 GDPRMain issue: Whether a work email address was collected from an external source, supplied by a third party, or generated, inferred, predicted or verified algorithmically On 27 July 2026, I received a transparency notice from…

Status: Proceedings before the Austrian Data Protection AuthorityInitial events: April 2026Relevant GDPR provisions: Articles 12–15 GDPRMain issue: Personal data, an apparent opt-in and campaign interactions were attributed to me within a multi-party marketing chain that I did not knowingly initiate. In April 2026, I received an unsolicited marketing email at my professional email address concerning…

Status: Pending before the Austrian Data Protection AuthorityYear: 2026Relevant GDPR provisions: Articles 12, 14 and 15 GDPRMain issue: Source, legal basis and onward disclosure of a private telephone number This case concerns the processing of my private telephone number within the business-contact and data-enrichment ecosystem. The number is particularly significant because, unlike a professional email…

Background On 6 February 2026, I received an unsolicited professional email at my work email address inviting me to attend a conference on conversational AI and customer experience in Munich. The message was sent by a marketing representative of an event-organising company. The issue was not the conference invitation itself. My concern was that I…

In February 2026, I received an unsolicited marketing email at my work email address promoting scientific products relating to cancer research. Since my work email address was not publicly available and I had no professional activity relating to the advertised products, I asked the sender to explain how my contact details had been obtained and…

In January 2026, I received an unsolicited business email at my work email address. Unlike several previous cases involving my private email address,this communication was sent to a work email address that, to my knowledge,was not publicly available. Since I did not know how the address had been obtained,I asked the sender to explain the…

In June 2024, shortly before the end of my employment at the University of Natural Resources and Life Sciences, Vienna (BOKU) https://boku.ac.at/, I became aware that my private mobile telephone number had been forwarded to another member of my research group without my prior knowledge or consent. I was subsequently contacted via Telegram regarding my…