DSB (Austria) - 2025-0.276.820

Holding === Holding ====== Holding === The DSB held that the controller violated [[Article 58 GDPR#2d|Article 58(2)(d) GDPR]], which grants supervisory authorities the power to issue binding instructions to data controllers to ensure compliance with the GDPR. The violation arose from the controller’s failure to implement the binding instruction requiring modification of the website cookie banner to allow users to refuse consent as easily as giving it.The DSB held that the controller violated [[Article 58 GDPR#2d|Article 58(2)(d) GDPR]], by failing to comply with the DSB's binding instructions regarding the implementation of changes to the controller's website's cookie banner allowing users to refuse consent as easily as giving it. The DSB found that the failure was negligent rather than intentional. Following the [[CJEU - C-807/21 - Deutsche Wohnen|CJEU ruling]] , negligence is sufficient to justify a GDPR fine. Negligence occurs when the responsible party cannot claim i