Austrian Supreme Administrative Court confirms a parent company is not automatically a joint controller under Article 26 GDPR

Background

In October 2021, the Austrian Data Protection Authority (Datenschutzbehörde, DSB) imposed an administrative fine of EUR 8 million, plus EUR 800,000 in procedural costs, on the parent company of an Austrian corporate group. The DSB argued that the consent forms used from 2 May 2019 onwards for profiling within a multi-partner customer loyalty programme failed to meet the requirements for valid consent under Article 4(11) read with Article 5(1)(a) and Article 7 GDPR. The subsequent processing operations therefore allegedly lacked any lawful basis under Article 6(1) GDPR.

The DSB attributed responsibility for those processing activities to the parent company as a joint controller alongside the operational subsidiary, relying on Article 4(7) in conjunction with Article 26 GDPR.

Procedural history

By judgment of 28 May 2024 (W176 2249328-1/7E), the Austrian Federal Administrative Court (Bundesverwaltungsgericht, BVwG) upheld the parent company's appeal, set aside the administrative penalty and discontinued the proceedings. It rejected the qualification of the parent as a joint controller.

The DSB then lodged an official appeal (Amtsrevision) before the Austrian Supreme Administrative Court (Verwaltungsgerichtshof, VwGH).

The VwGH's decision

By order of 14 April 2026 (Ra 2024/04/0375), the VwGH rejected the appeal as inadmissible for lack of a question of fundamental legal importance within the meaning of Article 133(4) of the Austrian Federal Constitution (Section 34(1) VwGG). As a result, the BVwG's reversal of the administrative penalty is now final.

Key reasoning

The VwGH endorsed the BVwG's application of settled CJEU case law. A controller is any natural or legal person who, in pursuit of its own interests, exerts influence on the processing of personal data and thereby participates in the determination of the purposes and means of that processing (para. 21, citing inter alia CJEU 7 March 2024, C-604/22, IAB Europe; 5 December 2023, C-683/21, Nacionalinis visuomenės sveikatos centras; 10 July 2018, C-25/17, Jehovan todistajat).

What matters is the actual decision both on the "why" (purpose) and the "how" (means) of the specific processing operation (para. 24). There is no controllership for upstream or downstream operations in the processing chain whose purposes and means the entity does not in fact determine (para. 22, citing CJEU C-40/17, Fashion ID).

In the case at hand, the parent company's involvement was confined to:

• a strategic decision, taken during the concept phase from 2017 onwards, to set up an in-house multi-partner customer loyalty programme; and
• the incorporation of the operating subsidiary (indirectly, via a group service company), together with the provision of the necessary financial and personnel resources.

Once the subsidiary began operations in May 2019, the parent was no longer involved in shaping the actual data processing activities, the consent declarations, the privacy notice, the record of processing activities or the technical and organisational measures (para. 6).

The VwGH agreed with the BVwG that this constellation precisely lacks the "deliberate and conscious cooperation" required by CJEU case law to establish joint controllership (para. 28). In fact, the DSB's own contention that the parent had carried out "no management or control activities whatsoever" with regard to the subsidiary demonstrated the absence of any genuine influence on purposes and means.

The VwGH expressly distinguished the case from Nacionalinis visuomenės sveikatos centras (C-683/21): unlike there, the subsidiary here was not commissioned to develop a specific IT application for carrying out the processing operations (para. 26).

Practical implications

For day-to-day advisory work in corporate groups, the order offers concrete reference points.

According to the VwGH, the following are not sufficient, taken alone, to establish joint controllership of a parent company under Article 26 GDPR:

• a strategic decision to launch a data-driven programme;
• the incorporation of an operating subsidiary;
• the provision of financial and personnel resources; and
• the mere shareholding structure.

Whether joint controllership nevertheless arises will continue to depend on the specifics of each case. Factors that may shift the analysis include overlapping board members, ongoing instructions from the parent, joint commissioning of a specific IT application, or continuing substantive steering of the processing activities by the parent.

Wider context

The order does not extend the case law in doctrinal terms — the relevant criteria are already settled by the CJEU and by earlier VwGH case law (most recently VwGH 27 March 2025, Ro 2022/04/0023). Its significance lies in the application of those criteria to a typical group structure and in the confirmation that a parent company's strategic incorporation and funding decisions do not, on their own, give rise to joint controllership under Article 26 GDPR. For this reason, a preliminary reference to the CJEU under Article 267 TFEU was not necessary (para. 30).

Source

VwGH 14 April 2026, Ra 2024/04/0375; ECLI:AT:VWGH:2026:RA2024040375.L00.

About Sabadello Legal

Sabadello Legal advises companies across all industries on data protection matters: from ongoing GDPR compliance and the drafting of data processing agreements and joint controller arrangements to representation before the Austrian Data Protection Authority and the administrative courts. A particular focus lies on supporting non-EEA companies with GDPR compliance for their data flows into the EEA, as well as on data protection issues within corporate group structures. We also advise on data protection issues arising in the employment context.

Contact

Andreas Sabadello, Attorney at Law
Sabadello Legal
https://sabadello.legal
Tel: +43 1 997 19 30
E-Mail: office@sabadello.legal

Disclaimer

This article is provided for general information purposes only and does not constitute legal advice in any individual case.