Case C-585/26, Trezor Company – a newsletter, a processor and a server abroad
Many newsletters are sent by someone other than the company whose name is on it. The Oberster Gerichtshof asks what the GDPR requires when it is.
Facts
SV is suing Trezor Company s.r.o., which sells hardware wallets for cryptocurrencies. According to published extracts of the Oberster Gerichtshof’s referral decision of 26 May 2026 (6 Ob 69/25b), SV bought a hardware wallet from Trezor in 2020 and in 2021 received an email confirming his subscription to its newsletter. He claims that his personal data were stored and processed on servers in the United States without his consent; Trezor relies on consent, on the contract and on its legitimate interests under Article 6(1)(a), (b) and (f) of the GDPR. The newsletter was sent by a processor established in a third country. The court asks two questions.
Questions Referred
1. Does the transfer of personal data from a controller to a processor require a separate legal basis pursuant to Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, OJ 2016 L 119, p. 1; ‘the GDPR’)?
2. If the answer to Question 1 is in the negative: Does consent to the receipt of a newsletter satisfy the requirement that it be ‘informed’ within the meaning of Article 4(11) of the GDPR, for the purposes of Article 6(1)(a) thereof, only if the data subject, before giving that consent, is aware that the controller intends to engage a processor, within the meaning of Article 4(8) of the GDPR, established in a third country for that processing operation (the sending of a newsletter)?
Sources
OJ notice C/2026/5607 (EUR‑Lex) · Case file on CURIA · Regulation (EU) 2016/679 · Planet49, C‑673/17 (ECLI:EU:C:2019:801)
Comment
The first question looks simple and is not. A processor is a person “which processes personal data on behalf of the controller” (Article 4(8)), and the definition of “third party” in Article 4(10) expressly excludes the processor. The structure of the GDPR suggests that the processor is an extension of the controller. The processing it carries out is the controller’s processing, covered by the controller’s legal basis and governed by the contract Article 28 requires. But handing data to someone else is itself an operation on those data, and “processing” in the GDPR includes “disclosure by transmission”. If that disclosure needs its own basis, every outsourced IT service in the Union needs one too. A negative answer would confirm what most practice assumes. A positive one would unsettle it.
The second question is about what a subscriber must know. Consent must be “freely given, specific, informed and unambiguous” (Article 4(11)). Article 13(1) separately requires the controller to give the data subject “the recipients or categories of recipients” and, where applicable, “the fact that the controller intends to transfer personal data to a third country”. The Oberster Gerichtshof asks whether a failure on the second front invalidates the consent itself. The Court has linked the two before. In Planet49 (C‑673/17), a case on cookies, it held that the information a provider must give includes “whether or not third parties may have access to those cookies”. A processor is not a third party in the GDPR’s sense. Whether a processor in a third country is something a subscriber must know about before consenting, rather than something to be found in the privacy notice, is the question.