aringer herbst winklbauer rechtsanwälte

Aringer herbst winklbauer rechtsanwälte is a full service commercial law firm. The advisory activities range from IT law, mergers & acquisitions, corporate law, real estate law, to capital market and private trusts. From our base in Vienna, we advise national and international companies as well as private clients and represent them in court, before authorities and arbitration proceedings. Our expertise in IT law covers all aspects of information technology, in particular outsourcing, software-licensing, software development and maintenance services. In recent matters, a strong focus lies on cloud services and data protection matters. "Grillparzerstraße 5 A-1010 WienTelefon: +43 (1) 890 90 17-0Telefax: +43 (1) 890 90 17-99E-mail: office@ahwlaw.atWebsite: www.ahwlaw.at" Stephan Winklbauer is an expert in IT-law and real estate law. Regarding the latter he primarily counsels real estate developers and building contractors, however he also advises private investors. Stephan Winklbauer’s specialities are the acquisition and sale of real estates, their planning and construction as well as their renting and leasing. Concerning IT-law he counsels clients about software, outsourcing, and project contract law in relation to IT. For more than 20 years, Stephan Winklbauer supports international and national companies with the contractual structuring of their IT-projects. In addition, Stephan Winklbauer's publication activities include numerous articles in IT and data protection journals. Memberships:

Representatives

Stephan Winklbauer

partner

Contact

Publications

• Austrian DPA decisions on Microsoft 365 Education: Unlawful Cookie tracking of school children – and nobody knew about itIn two parallel decisions of October 2025 and January 2026, the Austrian Data Protection Authority (DSB) ruled that Microsoft Corporation acts as a (joint) controller for parts of the data processing carried out via Microsoft 365 Education and unlawfully placed tracking cookies on a pupil’s device without consent. The decisions clarify the allocation of GDPR responsibilities between Microsoft, schools and education ministries. These decisions also have implication for any organisation using Microsoft 365 across the EEA.5 May 2026
• CJEU RULING IN THE MATTER OF “SCHUFA” NOT ONLY AFFECTS CREDIT SCORING (C-634/21)In December 2023, the European Court of Justice (CJEU) had to decide yet another case that will have a significant effect beyond the core facts of the case. The ruling will likely affect not only credit scoring agencies but every sector and controller that works with some probability analysis to predict and ultimately influence data subjects’ decisions or may legally affect them otherwise.25 April 2024
• Waiting for Cjeu Ruling in the Matter of “Deutsche Wohnen” (C-807/21)Since the end of December 2021, the preliminary ruling of the European Court of Justice (CJEU) on the conditions under which an administrative fine may be imposed on a legal entity for violating the GDPR has been pending. Since then, the Austrian Data Protection Authority and the administrative courts have suspended all proceedings against legal persons who have violated the GDPR pending the decision of the CJEU. This decision is now expected to be rendered on December 5, 2023.23 November 2023
• I Meta Tracking Tools Illegal – Austrian Data Protection Authority Holds That the Use Directly Violates the Gdpr and the “Schrems II” DecisionThe Austrian Data Protection Authority (DPA) decided (6th of March 2023, D155.028, 2022-0.726.643) that the use of the Facebook Business Tools “Facebook Login” and “Facebook Pixel is violating the GDPR. The DPA held that the findings made in the “Google Analytics Decision” (22nd of December 2021, D155.027, 2021-0.586.2579; “GA”) were applicable to this case.8 May 2023
• Use of Google analytics (still) breaches the GDPR – austrian data protection authority rejects risk based approachThe Austrian Data Protection Authority (DPA) decided in another decision (22nd of April 2022, D155.026, 2022-0.298.191) that the use of Google Analytics (GA) is (still) violating the GDPR. The DPA held that the transfer of personal data to the US in light of the Schrems II decision is particularly problematic. In this second decision on the usage of GA the DPA explicitly rejects the “risk-based approach” for data transfers to third countries.16 August 2022
• Use of Google analytics violates the GDPR - Recent decision of the austrian data protection authorityThe Austrian Data Protection Authority (DPA) decided in a recent groundbreaking decision (22nd of December 2021, D155.027 2021-0.586.257) that the use of Google Analytics is currently violating the GDPR. The DPA held that the transfer of personal data to the US in light of the Schrems II decision is particularly problematic. This is the first decision on the 101 model complaints filed by noyb. Soon similar decisions are to be expected in other EU member states.19 January 2022
• Damages For GDPR Violation – Austrian Supreme Court Refers Several Questions To Court Of Justice Of The European Union (Cjeu)The Austrian Supreme Court paved the way for a more coherent interpretation of the GDPR regarding damages by initiating the preliminary reference procedure. In its reference for a preliminary ruling, the Austrian Supreme Court asked several questions on the interpretation of Art. 82 GDPR. The forthcoming clarification of fundamental questions on damages in the legal system of the GDPR will have a considerable influence on corresponding and future court proceedings in all European member states.9 August 2021
• Austrian Data Protection Authority Ruling On The Right To Obtain A Copy (Art 15 Para 3 Gdpr)Art 15 GDPR does not only enable the data subject to obtain information on the content of his/her data undergoing processing, but also provides for a right to obtain a copy of the respective data. In August 2020, the Austrian data protection authority issued an interesting decision addressing the content and scope of this right (10th August 2020, Case No. 2020-0.204.456).9 February 2021
• Austrian Court Ruling on Immaterial Damages for GDPR violation – A Mere Violation Of Data Protection Regulations Is Not EnoughIn February, the first decision of an Austrian Appellate Court regarding a claim for immaterial damages under Art 82 GDPR has been issued. In its final decision (13th February 2020, 1 R 182/19b), the Higher Regional Court of Innsbruck, as the court of appeal, overturned a much-noticed decision of the Regional Court of Feldkirch:8 June 2020
• Enforcement of GDPR Infringements by Third Parties – First Decision of the Austrian Supreme CourtWhile the GDPR deals extensively with the rights and claims of data subjects, it mainly leaves the provisions for the assertion of such claims by third parties to the member states and their courts. In a recent decision, the Austrian Supreme Court now addressed this matter for the first time (OGH 26.11.2019, 4 Ob 84/19k): violations of data protection rights can only be asserted by the affected data subject.2 March 2020