The Austrian Supreme Court (OGH) has referred two fundamental questions on the GDPR to the Court of Justice of the European Union (CJEU) for a preliminary ruling (OGH 6 Ob 69/25b, 26 May 2026).

The case arose in the context of newsletter processing. However, the first question referred to the CJEU goes far beyond newsletters: it concerns the basic relationship between controllers and processors under the GDPR. If the transfer of personal data from a controller to a processor requires a separate Article 6 legal basis, this may affect a wide range of outsourced processing arrangements, including cloud hosting, CRM systems, payroll providers, IT service providers, email marketing tools and other SaaS solutions.

Background

The dispute arose after the theft of cryptocurrency.

The claimant had purchased a hardware wallet and related software from the defendant. The defendant used a US-based company as a processor for managing and dispatching newsletters to customers' email addresses. That US company had committed itself to the defendant by way of Standard Contractual Clauses for transfers to a third country.

The claimant received an email asking him to confirm his newsletter subscription. At the end of that email, in small print and in English, it stated that the defendant used the US company as its marketing automation platform and that, by confirming the subscription, the claimant acknowledged that the information provided would be transferred to that company for processing in accordance with its privacy policy and terms.

The claimant did not read that small-print notice. He clicked the confirmation link. According to the findings, he was not aware that his email address would be stored and processed on US servers. Had he known that, he would not have consented to the newsletter processing.

In March 2022, accounts of the US processor were attacked by phishing. Among other data, the claimant's email address and IP address were stolen. A few days later, the claimant received a phishing email, was induced to download a supposed update, and entered his recovery seed. His cryptocurrency holdings were then transferred to unknown wallets.

The claimant relies on Article 82 GDPR and argues that the defendant unlawfully transferred his personal data to the US processor without a valid legal basis and without informed consent.

The two questions referred

Question 1: Does a transfer from controller to processor require a separate Article 6 GDPR legal basis?

The first question referred to the CJEU is whether the transmission of personal data from a controller to a processor requires a separate legal basis under Article 6(1) GDPR.

The prevailing view in German-language legal scholarship is that the requirements for engaging a processor are exhaustively governed by Article 28 GDPR and, in the case of third-country transfers, by Articles 44 et seq GDPR. On that view, no separate Article 6 legal basis is required for the transfer to the processor itself.

The main arguments are that the processor is not a "third party" within the meaning of Article 4(10) GDPR, acts under the controller's instructions, and is treated, for data protection purposes, as part of the controller's sphere. The European Data Protection Board's Guidelines 07/2020 also support this approach by stating that the lawfulness of processing by a processor derives from the controller's activity.

A minority view takes the opposite position: the disclosure of personal data to a processor is itself a processing operation and therefore requires justification under Article 6 GDPR.

The OGH considered the question not to be acte clair and noted that, as far as apparent, there is no existing CJEU ruling clarifying the issue.

Question 2: What must the data subject know for newsletter consent to be "informed"?

The second question is conditional. It arises only if the CJEU answers Question 1 in the negative.

The OGH asks whether consent to receiving a newsletter is "informed" within the meaning of Article 4(11) GDPR only if the data subject knows, before giving consent, that the controller intends to use a processor located in a third country for that specific processing operation.

This question shifts the focus from the lawfulness of the transfer itself to the transparency requirements for consent.

The EDPB Guidelines 05/2020 on consent do not expressly require that processors be named as a condition for valid consent. They do, however, refer to minimum information on possible risks of data transfers without an adequacy decision and without appropriate safeguards under Article 46 GDPR. They also leave room for the possibility that, depending on the circumstances and context, more information may be required for the data subject to genuinely understand the processing operation.

In the underlying case, the information about the US processor appeared only in small print at the bottom of the confirmation email, in English, without a separate consent mechanism. The claimant did not read it.

Why this matters

The practical implications may be significant.

Controller-to-processor relationships are a basic feature of modern data processing. Organisations routinely use external providers for cloud hosting, IT support, payroll, accounting, CRM systems, document management, email marketing, analytics, payment services, HR tools and other SaaS solutions.

If the CJEU answers Question 1 affirmatively, every transfer of personal data from a controller to a processor would require its own Article 6 legal basis. That would have substantial consequences for existing data processing arrangements. Organisations would need to reassess whether an independent lawfulness ground covers the transfer to the processor itself, not merely the underlying processing purpose.

If Question 1 is answered negatively, but Question 2 affirmatively, the focus shifts to transparency and consent design. Consent-based newsletter subscriptions involving third-country processors may then be valid only if subscribers are clearly informed, before consenting, that such a processor will be used.

A small-print reference to a processor's privacy policy, especially in a language the subscriber may not use as their primary language, may not be sufficient.

The OGH has suspended the proceedings pending the CJEU's ruling.

Source

The Administrative Court for the Austrian region of Burgenland (Landesverwaltungsgericht Burgenland) quashed an administrative penalty and discontinued the proceedings (E 156/13/2025.001/002, 21.04.2026). The court did not rule on the merits of the underlying allegation. Instead, it found a procedural defect in the sampling process: the inspecting authority had failed to leave a counter-sample. As a result, the official expert opinion of the AGES (Austrian Agency for Health and Food Safety) was inadmissible, and the alleged offence could not be established.

Background

Under Austrian food safety law — the Lebensmittelsicherheits- und Verbraucherschutzgesetz (LMSVG) — food business operators are subject to official inspections, which may include the taking of product samples for laboratory analysis. The operator of an agricultural business was accused of having stored vacuum-packed smoked and cured ham (Schinkenspeck) that was so mouldy as to be unfit for human consumption. The allegation was based on an official AGES laboratory report.

The Counter-Sample Requirement

Section 36(4) LMSVG provides that where a sample is taken at the producer's premises, it must be divided into an official sample and a counter-sample. The counter-sample is left with the business operator and serves as the basis for any independent expert examination the operator may wish to commission.

In this case, no counter-sample was left. Neither as a portion of the sample taken nor as an equivalent unit of the product. The court found that division of the sample would have been readily possible: the product was vacuum-packed, not frozen, and weighed 1,493 g, while the laboratory used only 25 g for its microbiological analysis.

Legal Consequences

Das Landesverwaltungsgericht Burgenland hat ein Straferkenntnis einer Bezirkshauptmannschaft aufgehoben und das Verwaltungsstrafverfahren eingestellt (E 156/13/2025.001/002, vom 21.04.2026). Grund war nicht die fehlende Berechtigung des Tatvorwurfs, sondern ein Verfahrensfehler bei der Probenziehung: Das Aufsichtsorgan hatte keine Gegenprobe zurückgelassen. Das amtliche AGES-Gutachten war deshalb nicht verwertbar, der Tatvorwurf konnte nicht erwiesen werden.

Hintergrund

Der Betreiberin eines landwirtschaftlichen Betriebs wurde vorgeworfen, in ihrem Kühllager vakuumverpackten „Schinkenspeck gesurt und geräuchert" zum Verkauf bereitgehalten zu haben, der so verschimmelt gewesen sei, dass seine Genusstauglichkeit nicht gewährleistet war. Grundlage des Straferkenntnisses war ein amtliches Gutachten der AGES.

Entscheidung

Das LVwG Burgenland hob das Straferkenntnis nicht inhaltlich, sondern aus verfahrensrechtlichen Gründen auf: Das Aufsichtsorgan hatte bei der amtlichen Probenziehung keine Gegenprobe im Betrieb zurückgelassen, weder als Probenteil noch als gleiche Wareneinheit.

Rechtliche Grundlage

§ 36 Abs. 4 LMSVG schreibt vor, dass bei Probenziehung beim Hersteller die entnommene Probe zwingend in eine amtliche Probe und eine Gegenprobe zu teilen ist. Eine Ausnahme von dieser Teilungspflicht lag hier nach Auffassung des Gerichts nicht vor: Bei einer vakuumverpackten, nicht gefrorenen Selchware mit einem Gewicht von 1.493 g wäre eine Teilung ohne Weiteres möglich gewesen; für die mikrobiologische Untersuchung durch die AGES wurden ohnehin nur 25 g der Probe herangezogen.

Kontext