THE HESSIAN COMMISSIONER
FOR DATA PROTECTION AND FREEDOM OF INFORMATION
17 October 2019
Final Decision
Complaint against – Right of access (art. 15 GDPR)
IMI Article 56 No.: 54930
IMI Case Register entry: 62334
The Hessian Commissioner for Data Protection and Freedom of Information (hereinaf-
ter “HBDI”) refers to the complaint of (hereinafter “Complainant”) against
(hereinafter “ ) lodged with the Austrian Data Protec-
tion Authority.
1. Case Description
The underage Complainant requested access to and a copy of his personal data pro-
cessed by (Right of access - art. 15 GDPR). He submitted all information
necessary for his identification by email on 25 July 2018. confirmed the re-
ceipt of his email on the same day.
On 29 August 2018 the Complainant lodged a complaint with the Austrian Supervisory
Authority stating that he had not yet received a reply to his request.
2. Investigation Procedure
HBDI contacted in April 2019. In its immediate answer stated that
at the time of the Complainant’s request the number of complex, data protection related
customer queries had suddenly increased, making it impossible for to ob-
serve the one-month time limit. The Customer Service by mistake did not send a notice
to the Complainant within one month. On 5 September 2018 informed the
Complainant about the aforementioned difficulties and the necessary extension of the
period according to art. 12(3) GDPR. According to the information provided by
the request finally was answered and right of access was granted by
on 28 September 2018, even before has been contacted by HBDI.
stated that their internal processes had already been improved to ensure that timely
responses can be given in similar cases by now.
Page 1 of 3
____________________________________________________________________________________________________
Gustav-Stresemann-Ring 1 65189 Wiesbaden Telephone +49 6 11 14 08 – 0 Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] Web www.datenschutz.hessen.de
Draft Decision – IMI Case 62334
Page 2 of 3
____________________________________________________________________________________________________
3. Decision
failed to inform the Complainant about the necessary and legitimate exten-
sion within the one-month time period set out in art. 12(3) GDPR. dmitted
the failure, attributing this to an extraordinary number of customer queries in a period,
in which GDPR had been fully applicable only for three months and a mistake in the
internal processing of the request.
Considering the fact that the right to access was granted and the requested information
was provided within the (extended) time limit of three months, the mere delay of a few
days in informing the Complainant about the legitimate extension appears a minor in-
fringement, which only slightly affects the Complainant’s rights and freedoms.
After consideration of the significance of the infringement, cooperation in
the investigation process and particularly the improvement action already taken by
HDBI, in its draft decision dated 03 July 2019 (IMI No. A60DD 283423),
considered that the investigation proceedings can be concluded and no further super-
visory measures are necessary.
Within four weeks, the following supervisory authorities concerned commented on the
draft decision:
The Finnish Data Protection Authority stated that it agrees with the findings of the
HBDI.
The French Data Protection Authority commented on the draft decision stating that a
procedure to confirm identity of the data subject where the controller would require
more information than what had provided to use the service at first, would be dispro-
portionate and not compliant with the GDPR. This comment was taken into account
and HBDI can inform that did not request more information than already pro-
vided.
The Italian Data Protection Authority asked whether the Hessian Data Protection Au-
thority issued a reprimand. HBDI affirmed that it had already issued a reprimand and
pointed out to that necessary information about requests from data subjects
under art. 15-22 GDPR shall be provided without undue delay and no later than one
month after receipt of the request.
The Austrian Data Protection Authority expressed an objection and asked whether
HBDI had yet informed the Complainant of the outcome of the investigation and
whether any statement on his part (approved by his father to the fact that the Com-
plainant is a minor) had been taken into account. As the HBDI had not yet informed
the Complainant, HBDI provided the colleagues from the Austrian Data Protection Au-
thority in the course of an Article 61 Voluntary Mutual Assistance Procedure (IMI No.
A61VM 80626) with statement in order to forward it to the Complainant and
Page 2 of 3
____________________________________________________________________________________________________
Gustav-Stresemann-Ring 1 65189 Wiesbaden Telephone +49 6 11 14 08 – 0 Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] Web www.datenschutz.hessen.de
Draft Decision – IMI Case 62334
Page 3 of 3
____________________________________________________________________________________________________
grant him his right to be heard. The Austrian Data Protection has since indicated that
the Complainant has withdrawn the complaint.
As the comments made by the supervisory authorities concerned were addressed and
as the Complainant apparently considers the originally alleged infringement to be elim-
inated, HBDI will not carry out any further supervisory measures and close the file.
On behalf of the HBDI
Page 3 of 3
____________________________________________________________________________________________________
Gustav-Stresemann-Ring 1 65189 Wiesbaden Telephone +49 6 11 14 08 – 0 Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] Web www.datenschutz.hessen.de