Unofficial translation of the Final Decision of the Austrian DPA, A60FD 289688
D E C I S I O N
S P E E C H
The data protection authority decides on the data protection complaint of (complainant)
of 10.4.2019 against with registered office in Hamburg, Germany, (respondent) for
violation of the right of access as follows:
- The complaint is dismissed.
Legal basis: Art. 4 Z 23 lit. b, Art. 15, Art. 51 para. 1, Art. 56 para. 1, 57 para. 1 lit. f, Art. 60 para. 8, Art.
77 para. 1 as well as Art. 85 of Regulation (EU) 2016/679 (General Data Protection Regulation,
hereinafter: GDPR), OJ No. L 119, 4.5.2016 p. 1; §§ 18 para. 1 as well as 24 para. 1 and para. 5 of the
Austrian Data Protection Act (DSG), Federal Law Gazette I No. 165/1999 as amended.
J U S T I F I C A T I O N
A. Arguments of the parties and course of the proceedings
1. By complaint dated 10.4.2019, as improved by submission dated 8.5.2019, the complainant alleged
a violation of the right of access and, in summary, submitted that on 25.1.2019 and 26.1.2019, he had
participated in a selection procedure for pilots conducted by the respondent. In the context of this
procedure, the respondent had collected personal data from him. On 22.2.20219, he sent a request for
information to the respondent by post. The letter was demonstrably taken over by an employee of the
respondent on 25.2.2019. However, the respondent did not react to this request.
2. Since the case involved a cross-border issue, the data protection authority placed the case
in the "Internal Market Information (IMI) System", which is used under the consistency
mechanism to handle the cross-border procedure under the provisions of the GDPR. It turned
out that the main office of the respondent in Hamburg is in Germany.
According to Article 56(1) of the GDPR, the Hamburg Commissioner for Data Protection and Freedom
of Information was the lead supervisory authority in these proceedings. This fact was communicated to
the complainant.
3. The Hamburg Commissioner for Data Protection and Freedom of Information considered himself
responsible for dealing with the content and forwarded the complaint to the respondent.
-2–
4. In its opinion, the respondent submitted that it had provided the complainant with information by e-
mail of 21.3.2019, namely that it had deleted all of the complainant's personal data due to the fact that
the complainant had not passed the selection procedure.
5. The respondent's statement was subsequently sent to the complainant by letter of the data protection
authority dated 28.11.2019, ref. DSB-D130.254/0003-DSB/2019, together with a request to comment
on whether the complainant had received the respondent's email of 21.3.2019.
6. In his statement of 12 December 2019, the complainant essentially argued that he had definitely not
received the respondent's e-mail of 21 March 2019. It was not even clear from the enclosure sent to
which e-mail address the e-mail was supposed to have been sent.
7. The complainant's opinion was forwarded to the lead supervisory authority. The supervisory authority
subsequently submitted a draft decision pursuant to Article 60(3) of the GDPR. The draft decision stated
that it could not be proven whether the complainant had actually received the respondent's e-mail.
Although the complainant's denial of receipt cast doubt on the proper provision of information, the
complainant had at least received the negative information provided in the course of the proceedings.
Thus, the respondent had fulfilled its accountability obligation under Article 56(2) of the GDPR. The law
did not set high requirements for the obligations of the controller and it was therefore up to the
supervisory authority to prove a violation. There were no possibilities for this, even after consultation
with IT employees. In the event that such incidents were to occur more frequently at the respondent,
appropriate measures would be taken.
B. Subject of the complaint
The subject matter of the complaint is the question whether the respondent has violated the
complainant's right of access pursuant to Art. 15 GDPR.
C. Findings of fact
The data protection authority bases its decision on the facts of the case as set out in point A. and
documented in the file.
D. In legal terms, it follows that:
The data processing subject of the complaint is a cross-border data processing within the meaning of
Art. 4(23)(b) of the GDPR, as the complainant is resident in Austria, but the controller (respondent) is
established in Hamburg, Germany. The Hamburg Commissioner for Data Protection and Freedom of
Information was therefore the lead supervisory authority pursuant to Art. 56(1) of the GDPR.
In the course of the proceedings, the lead supervisory authority came to the conclusion that although it
was not verifiable whether the complainant had received the requested information by e-mail of
-3–
21.3.2019, the complainant had received the information in the course of the proceedings (via the
Austrian data protection authority in the context of the hearing of the parties).
The lead supervisory authority informed the Austrian data protection authority of this fact in its decision
pursuant to Art. 60(3) of the GDPR. There was no reason for a relevant and well-founded objection. A
legitimate grievance on the part of the complainant cannot be identified, as the purpose of the right of
access is to provide a data subject with information about the personal data processed about him or
her by the controller. The complainant received this (negative) information in the course of the
proceedings (cf. in the national context § 24 para. 6 of the Austrian Data Protection Act, according to
which a controller may subsequently remedy the alleged infringement by complying with the requests
of the data subject). The fact that the information provided by the respondent was defective was not
alleged by the complainant at any time.
As a result, the complainant was left without a complaint.
If a complaint is rejected or dismissed, the supervisory authority to which the complaint was lodged
shall adopt the decision and notify it to the complainant and inform the controller, in accordance with
Article 60(8) of the GDPR. This is the case here. For this reason, the decision in question is issued by
the Austrian data protection authority.
Therefore, the decision had to be in accordance with the ruling.