We are taking DAC8 to court. Our complaint has been filed.

We are convinced that collecting data on every crypto customer without suspicion violates the fundamental right to data protection.

Support the case

Where the case stands

At Bitcoin Austria’s initiative, attorney Dr Oliver Völkel (CERHA HEMPEL) filed a complaint with the Austrian Data Protection Authority in October 2026, as a customer of a crypto provider.

Provider A customer objects to how their provider processes their data for DAC8. In substance, it is about the law that requires the provider to do so.
Data Protection Authority Now The authority applies the law as it stands. Whether that law breaches the constitution or EU law is for the highest courts to decide.
Federal Administrative Court An appeal against the authority’s decision comes next. The court reviews it.
Constitutional Court / CJEU Then comes the Constitutional Court. It can review the law and refer the EU directive to the Court of Justice of the EU. We have no right to a review: the court can, for example, decline to hear a complaint if it sees no reasonable prospect of success.

How much data may the state demand, just in case?

The complaint starts from one concrete case: the data a provider prepares about one of its customers for DAC8. It asks three questions.

May the state demand this?
Providers must collect every customer’s data for the tax office, without suspicion, and keep each report for ten years. Is that compatible with the fundamental right to data protection?
Does the tax office need this data?
The report usually includes how much you transfer to your own wallet each year, as a total without wallet addresses. On its own, that is no more taxable than withdrawing cash.
Could it be done with less?
Any interference with fundamental rights must be necessary and proportionate. Milder means exist: Germany and the Netherlands have data compiled only for customers whose data actually goes to the tax office, and Ireland generally keeps it for six years instead of ten.

What we demand instead

Will it make a difference? A surveillance law has fallen before.

Whether we win is for the courts to decide. But they have already answered whether the state may have data on everyone stored just in case.

Data retention. Phone and internet providers had to store for six months who was in contact with whom and when, for all customers and without suspicion. A challenge organised by AKVorrat, now epicenter.works, took this to the Constitutional Court, which referred the questions to the Court of Justice of the EU (CJEU). In April 2014 the CJEU declared the EU directive invalid, and in June the Constitutional Court struck down the Austrian rules.

Support the case

Elsewhere in Europe

DAC8 applies across the EU, but each country has its own legal route. The question stays the same: is collecting every customer’s data compatible with fundamental rights?

France: Bull Bitcoin

In February 2026 Bull Bitcoin asked the Conseil d’État to annul the decree that implements DAC8 in France. On 14 September 2026 the court refused to suspend it as an emergency measure. The action for annulment is still pending.

Bull Bitcoin’s campaign at dac8.com inspired ours.

The French challenge on dac8.com

And in your country?

The campaign concerns everyone covered by DAC8, whatever crypto-assets they use. It starts in Austria. If you want to challenge the law in your country, get in touch.

kontakt@dac8.org

Updates

We post every new step in the case here and in the RSS feed as soon as it is public.

Subscribe via RSS

No updates published yet.

For the media

The association and the attorney are available for questions and interviews.

Campaign and case
Bitcoin Austria
The non-profit association behind dac8.org.
kontakt@dac8.org
Legal questions
Dr Oliver Völkel, LL.M.
Attorney and partner at CERHA HEMPEL in Vienna. He filed the complaint.
Profile at CERHA HEMPEL

Who is the complaint against?

Formally, against the way Oliver Völkel’s provider processes his data for DAC8. In substance it is about the law: the obligations that DAC8 and Austria’s Crypto-Asset Reporting Obligations Act place on every reporting provider.

Why go through the Data Protection Authority?

A law can only be challenged directly before the Constitutional Court if no other reasonable route is available. Anyone objecting to the processing of their data has such a route: a complaint to the Data Protection Authority, then the Federal Administrative Court, then the Constitutional Court. How the complaint fares at the authority does not matter for this, as the Constitutional Court held in April 2026 in a case about the electronic vaccination record.

Does DAC8 apply while the case is pending?

Yes. Providers have been collecting the data since 1 January 2026 and report the year 2026 to the tax office by 31 July 2027. The complaint does not stop that.

How long will the case take?

We do not know. The Data Protection Authority and the courts set the pace.

Who pays for the case?

Bitcoin Austria, with donations in bitcoin or by bank transfer.

Can others join the case?

We are still working out how individuals can take part. Once that is settled, we will publish it here.

Who is behind dac8.org?

Bitcoin Austria, a non-profit, independent Bitcoin association based in Vienna, active since 2011. dac8.org is its campaign against the blanket collection of financial data.