Barichgasse 40-42
A-1030 Wien
Tel.: +43-1-52152 302583
E-Mail: [email protected]
GZ: D130.352 Sachbearbeiter:
2022-0.052.510
Data protection complaint (Right of Access)
per RSb/Brief/E-Mail «emailadresse»
D E C I S I O N
The data protection authority decides on the data protection complaint of
(complainant) of 2 December 2019 against (respondent) for violation of the
right of access as follows:
- The complaint is dismissed.
Legal basis: Art. 15, Art. 51 para. 1, Art. 57 para. 1 lit. f, Art. 60 para. 8, Art. 77 para. 1 and Art. 85 of
Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR); § 18 para. 1 and
24 para. 1 and para. 5 of the Data Protection Act (DSG)
-2–
J U S T I F I C A T I O N
A. Arguments of the parties and course of proceedings
1. By complaint of 2 December 2019, as amended by submissions of 28 January 2020 and 2 March
2020, the complainant alleged a violation of the right of access because the respondent had not
responded to her request for information.
2. As the case involved a cross-border issue, the DPA placed the case in the Internal Market Information
(IMI) system, which is used under the consistency mechanism to handle the cross-border procedure
under the provisions of the GDPR.
3. The head office of the respondent is in the Netherlands, which is why the Dutch supervisory authority
(Autoriteit Persoonsgegevens) was the lead supervisory authority in these proceedings pursuant to
Article 56(1) GDPR.
The Dutch supervisory authority considered itself competent to deal with the substance and forwarded
the complaint to the respondent.
4. The lead supervisory authority subsequently submitted a draft decision to the data protection
authority pursuant to Article 69 (3) of the GDPR by letter of 18 November 2020. This shows that on 31
October 2019, the respondent requested the complainant's representative to provide proof that he had
been mandated as an authorised representative on behalf of the complainant. No reply had been
received.
The respondent further stated that it had received confirmation on 30 October 2020 that the requested
proof would be sent by the complainant.
According to Article 12 of the GDPR, it is permissible for a controller to request additional information if
the controller doubts the identity of the data subject.
The Dutch supervisory authority could not find a violation of the GDPR.
B. Subject matter of the complaint
The subject matter of the complaint is whether the respondent infringed the complainant's right of
access under Article 15 GDPR.
C. Findings of fact
-3–
The data protection authority bases its decision on the facts of the case as set out in point A. and
documented in the file.
D. From a legal point of view, the following follows:
The data processing subject of the complaint is a cross-border data processing within the meaning of
Article 4(23)(b) of the GDPR, as the complainant is domiciled in Austria, but the controller (respondent)
is established in the Netherlands. The lead supervisory authority was therefore the Dutch supervisory
authority pursuant to Art. 56(1) GDPR.
In the course of the proceedings, the lead supervisory authority came to the conclusion that no violation
of the GDPR had occurred.
The lead supervisory authority informed the Austrian data protection authority of this fact in its decision
pursuant to Article 60 (3) of the GDPR. There were no grounds for an authoritative and substantiated
appeal.
If a complaint is rejected or dismissed, the supervisory authority to which the complaint was submitted
shall adopt the decision and notify the complainant and inform the controller, in accordance with Article
60(8) of the GDPR. This is the case here. For this reason, the decision in question was issued by the
Austrian data protection authority.
Therefore, the decision had to be made in accordance with the ruling.
I N F O R M A T I O N O F L E G A L R E M E D I E S
An appeal against this decision may be lodged in writing with the Federal Administrative Court within
four weeks of notification. The complaint must be lodged with the data protection authority and must
include
- the name of the contested decision (GZ, subject)
- the name of the authority being prosecuted,
- the grounds on which the allegation of illegality is based,
- desire and
- the information necessary to assess whether the complaint has been lodged in good time.
The data protection authority may within two months either amend its decision by means of a preliminary
decision on the complaint or submit the complaint with the files of the proceedings to the Federal
Administrative Court.
-4–
The appeal against this decision is subject to a fee. The fixed fee for a corresponding submission
including enclosures is 30 euros. The fee is to be paid into the account of the tax office for fees,
transaction taxes and gambling (IBAN: AT83 0100 0000 0550 4109, BIC: BUNDATWW), whereby the
respective appeal procedure (business number of the notice) is to be stated as the purpose of payment
on the payment order.
In the case of electronic transfer of the appeal fee with the "tax office payment", the tax office for fees,
transaction taxes and gambling (IBAN as before) must be stated or selected as the recipient. In addition,
the tax number/tax account number 109999102, the tax type "EEE - complaint fee", the date of the
notice as the period and the amount must be stated.
The payment of the fee must be proven to the data protection authority when the complaint is lodged
by means of a original payment receipt confirmed by a postal office or a credit institution, which must
be attached to the submission. If the fee is not paid or not paid in full, a report is sent to the competent
tax office.
A timely filed and admissible appeal to the Federal Administrative Court has suspensive effect. The
suspensive effect may have been excluded in the ruling of the decision or may have been excluded by
a separate decision.
January 21, 2022
For the head of the data protection authority