Barichgasse 40-42
A-1030 Vienna
Tel.:+ 43-1-52152 302579
E-mail:[email protected]
GZ:D130.474 Clerk:
2021-0.281.893
Data protection complaint (Access)
D E C I S I O N
R U L I N G
The data protection authority decides on the data protection complaint of (complainant),
dated 6 July 2020, against (opponent) based in Düsseldorf, Germany, for violation
of the right to access as follows:
- The handling of the complaint is rejected.
Legal basis: Art. 4 subpara 23 lit. b, Art. 51 para 1, Art. 57 para. 1 lit. f and para 4, Art. 60 and Art. 77
para 1 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), ABl. Nr.
L 119 vom 4.5.2016 p. 1; §§ 18 para 1 and 24 para 1 and para 5 of the Data Protection Act (DSG),
Federal Law Gazette I No. 165/1999 idgF.
R E A S O N S
A. Claims of the parties and proceeding
1. By initiating the proceedings of 6 July 2020, the complainant claimed an infringement of the right to
access and basically argued that the respondent had only partially complied with his request of 15 May
2020.
As an attachment, the complainant submitted correspondence with the opponent.
This included the request for access dated 15 May 2020. In this request, the complainant requested
payment data in connection with his master card, e-mail correspondence, contact form requests in
connection with the reservation code , web log data in particular concerning his reservation,
service center log data and audio recordings of telephone contact with the service hotline as well as
other data relating to his booking. Furthermore, the complainant stated in this letter that he was willing
to refrain entirely from the complete request and that he would withdraw his request as soon as the
—2—
respondent came to the conclusion that it would be more economic to comply with his and his family’s
claim for reimbursement of more than EUR 280 immediately. If the opponent fails to comply with his
request within the time limit, he would lodge a complaint with the competent supervisory authority on
15 June 2020.
Furthermore, to the complaint was attached the respondent’s reply, respectively the information
requested, of 9 June 2020.
2. Since there is a cross-border situation, the Data Protection Authority placed the case in the “Internal
Market Information (IMI) system”, which is used in the context of the coherence procedure to process
the cross-border procedure in accordance with the provisions of the GDPR. The respondent’s
headquarters are in Düsseldorf, Germany.
Accordingly, it had to be assumed that according to Art. 56 para. 1 GDPR, the responsible German
supervisory authority, specifically the Land Commissioner for Data Protection and Freedom of
Information North Rhine-Westphalia, was the lead supervisory authority for this procedure. This
circumstance was communicated to the complainant.
3. The Land Commissioner for Data Protection and Freedom of Information North Rhine -Westphalia
(LDI NRW) considered itself responsible for the handling of the complaint. The latter subsequently
submitted a draft decision pursuant to Art. 60 para. 3 GDPR.
It is clear from this draft decision that an investigation has not been initiated. The opponent had fully
complied with the obligation to provide information. According to the information provided, only calls
from Germany are recorded and log data are processed without personal reference and there are no
indications to call these statements into question.
Art. 15 GDPR regulates the right of access to personal data processed by a controller. This right is not
forfeited by the fact that information is sought for a purpose other than data protection law, in particular
if the parties are involved in a dispute.
However, it was questionable whether the request for information had been abusive. However, the
existence of an abuse of rights can only be assumed if it is apparent from special circumstances that
the request for access is aimed solely at the damage to the person responsible. One indication of this
could be the complainant’s intention to cause harm, which the complainant openly expresses in his
request. In this respect, the complainant made a very extensive claim for information, which alone was
not an indication of abuse of rights. However, in his letter of 15 May 2020, the complainant clearly
pointed out that it could be more economic for the company to immediately comply with the
complainant’s and his family’s claims for reimbursement of EUR 280. In the event of an immediate
reimbursement, he would be willing to refrain from requesting the information. This appr oach could well
—3—
be interpreted as blackmail. The complainant thus made it clear that he would refrain from his request
if his claim was met, which, in the view of the LDI NRW, constituted an abuse of law.
In view of the fact that the complainant’s request for information had already been fully complied with
and that the letter of 15 May 2020 also indicated an abusive intention, the complaint was not taken up
in the present case.
B. Subject of appeal
The subject-matter of the complaint is whether the opponent violated the complainant’s right to access
pursuant to Art. 15 GDPR.
However, it must be checked in advance whether the requirements of Art. 57 para. 4 GDPR are met.
C. Findings of facts
The data protection authority shall base its decision on the facts set out in point A.
D. From a legal point of view, it follows:
The subject-matter data processing is a cross-border data processing according to Art. 4 subpara 23
lit. b GDPR, since the complainant is domiciled in Austria, the controller (opponent) is established in
Düsseldorf, Germany. The leading supervisory authority is therefore the LDI NRW pursuant to Art. 56
para. 1 GDPR.
The Lead Supervisory Authority came to the conclusion that an investigation was not to be conducted,
respectively that the handling of the complaint was to be rejected. This, particularly since, on the one
hand, full information was given and, on the other hand, the request for access from the complainant
dated 15 May 2020 indicated that the right of information was abusively exer cised.
The responsible supervisory authority informed this circumstance in accordance with Art. 60 para. 3
GDPR in its decision to the Austrian Data Protection Authority. Relevant and reasoned objection were
not raised.
In accordance with Art. 57 para. 4 GDPR, the supervisory authority may in cases where requests are
manifestly unfounded or excessive, in particular because of their repetitive character, charge a
reasonable fee based on administrative costs, or refuse to act on the request. The purpose of the right
to information is that a data subject receives information about their personal data processed by a
controller. On 9 June 2020, the controller had already provided full access to the complainant and the
complainant had indeed stated in his request of 15 May 2020 that he would refrain from his request if
he received a refund of the amount requested. The complaint therefore proves to be manifestly
unfounded, why according to Art. 57 para. 4 GDPR the treatment had to be rejected.
—4—
If a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged
shall in accordance with Art. 60 para. 8 GDPR adopt the decision and notify it to the complainant and
shall inform the controller thereof. As this is the case in the present case, the decision in question is
issued by the Austrian Data Protection Authority.
It was to be decided according to the ruling.
L E G A L N O T I C E
A complaint to the Federal Administrative Court may be lodged against this decision in writing
within four weeks of notification.The complaint must be lodged with the Data Protection Authority
and must include
- the name of the contested decision (GZ, subject)
- the name of the authority concerned;
- the grounds on which the allegation of illegality is based,
- the demand as well as
- the information necessary to assess whether the appeal has been lodged in time.
The Data Protection Authority has the option to amend its decision by means of a preliminary
complaint decision or to submit the complaint with the files of the proceeding to the Federal
Administrative Court.
The appeal against this decision is subject to a fee. The fixed fee for a corresponding submission
including attachments is EUR 30. The fee must be paid on the account of the Austrian Tax Office,
stating the purpose of use.
The fee must in principle be transferred electronically with the function “ Finanzamtszahlung”. As
recipient, the Austrian Tax Office – Department of Special Responsibilities should be indicated or
selected (IBAN: AT83 0100 0000 0550 4109, BIC: BUNDATWW). Furthermore, the tax number/tax
account number 10 999/9102, the type of fee “EEE-Beschwerdegebühr”, the date of the decision as
the period and the amount must be indicated.
If the e-banking system of your credit institution does not have the function “Finanzamtszahlung”, the
eps procedure can be used in FinanzOnline. From an electronic transfer can only be refrained if no e-
banking system has been used (even if the taxable person has an internet connection). Then the
payment must be made by means of a payment order, taking care of the correct attribution. Further
information can be obtained from the Tax Office and in the manual ” Elektronische Zahlung und Meldung
zur Zahlung von Selbstbemessungsabgaben“.
—5—
The payment of the fee shall be demonstrated when the complaint is lodged with the data protection
authority by means of a payment document to be followed by the submission of a payment order or an
expression of the issue of a payment order. If the fee is not paid or not paid in full, a notification will
be sent to the competent Tax Office.
A timely and admissible appeal to the Federal Administrative Court has suspensive effect. The
suspensive effect may have been excluded in the statement of the decision or may be excluded by an
own decision.
3. Mai 2021
For the head of the Data Protection Authority: