
aringer herbst winklbauer rechtsanwälte
INPLP member firm · Wien, Austria
Aringer herbst winklbauer rechtsanwälte is a full service commercial law firm. The advisory activities range from IT law, mergers & acquisitions, corporate law, real estate law, to capital market and private trusts. From our base in Vienna, we advise national and international companies as well as private clients and represent them in court, before authorities and arbitration proceedings. Our expertise in IT law covers all aspects of information technology, in particular outsourcing, software-licensing, software development and maintenance services. In recent matters, a strong focus lies on cloud services and data protection matters. "Grillparzerstraße 5 A-1010 WienTelefon: +43 (1) 890 90 17-0Telefax: +43 (1) 890 90 17-99E-mail: office@ahwlaw.atWebsite: www.ahwlaw.at" Stephan Winklbauer is an expert in IT-law and real estate law. Regarding the latter he primarily counsels real estate developers and building contractors, however he also advises private investors. Stephan Winklbauer’s specialities are the acquisition and sale of real estates, their planning and construction as well as their renting and leasing. Concerning IT-law he counsels clients about software, outsourcing, and project contract law in relation to IT. For more than 20 years, Stephan Winklbauer supports international and national companies with the contractual structuring of their IT-projects.In addition, Stephan Winklbauer's publication activities include numerous articles in IT and data protection journals. Memberships:
Representatives

Stephan Winklbauer
partner
Publications
- CJEU RULING IN THE MATTER OF “SCHUFA” NOT ONLY AFFECTS CREDIT SCORING (C-634/21)In December 2023, the European Court of Justice (CJEU) had to decide yet another case that will have a significant effect beyond the core facts of the case. The ruling will likely affect not only credit scoring agencies but every sector and controller that works with some probability analysis to predict and ultimately influence data subjects’ decisions or may legally affect them otherwise.25 April 2024
- Waiting for Cjeu Ruling in the Matter of “Deutsche Wohnen” (C-807/21)Since the end of December 2021, the preliminary ruling of the European Court of Justice (CJEU) on the conditions under which an administrative fine may be imposed on a legal entity for violating the GDPR has been pending. Since then, the Austrian Data Protection Authority and the administrative courts have suspended all proceedings against legal persons who have violated the GDPR pending the decision of the CJEU. This decision is now expected to be rendered on December 5, 2023.23 November 2023
- I Meta Tracking Tools Illegal – Austrian Data Protection Authority Holds That the Use Directly Violates the Gdpr and the “Schrems II” DecisionThe Austrian Data Protection Authority (DPA) decided (6th of March 2023, D155.028, 2022-0.726.643) that the use of the Facebook Business Tools “Facebook Login” and “Facebook Pixel is violating the GDPR. The DPA held that the findings made in the “Google Analytics Decision” (22nd of December 2021, D155.027, 2021-0.586.2579; “GA”) were applicable to this case.8 May 2023
- Use of Google analytics (still) breaches the GDPR – austrian data protection authority rejects risk based approachThe Austrian Data Protection Authority (DPA) decided in another decision (22nd of April 2022, D155.026, 2022-0.298.191) that the use of Google Analytics (GA) is (still) violating the GDPR. The DPA held that the transfer of personal data to the US in light of the Schrems II decision is particularly problematic. In this second decision on the usage of GA the DPA explicitly rejects the “risk-based approach” for data transfers to third countries.16 August 2022
- Use of Google analytics violates the GDPR - Recent decision of the austrian data protection authorityThe Austrian Data Protection Authority (DPA) decided in a recent groundbreaking decision (22nd of December 2021, D155.027 2021-0.586.257) that the use of Google Analytics is currently violating the GDPR. The DPA held that the transfer of personal data to the US in light of the Schrems II decision is particularly problematic. This is the first decision on the 101 model complaints filed by noyb. Soon similar decisions are to be expected in other EU member states.19 January 2022
Join the network
Applications from qualified privacy practices are reviewed individually by the INPLP board.