A-1030 Vienna, Barichgasse 40-42
Republic of Austria
Data
protection
GZ: 2022-0.820.551
Data protection complaint (access and information)
Decision of the Data Protection Authority
CONTACT
PROVERB
The data protection authority decides on the data protection complaint of the (complainant)
of 19 March 2019 against (respondent) for breach of the right to information and access
as follows:
— The complaint will be rejected in respect of those parts relating to the partial (subsequently) fulfilled data
access request as well as the right to information.
Legal bases: § 24(1) and (5) of the Data Protection Act (DSG), BGBl. I No 165/1999 as amended; Articles
13, 15, 60(9) and 77 of Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR), OJ
L 119, 4.5.2016, p. 1.
—2—
JUSTIFICATION
A. Arguments of the parties and proceedings
1. By complaint of 19 March 2019, improved by submissions of 2 April 2019, 23 April 2019 and 8 May
2019, the complainant claimed an infringement of the right to information and information and claimed that
he had acquired a a person with four training sessions per week from the
Respondent in April 2018; consists of, among other things, a licensed software. By e-mail from 18
April 2018 the Complainant the
Respondent informed that medical data would be collected during the operation of the software and a
monthly Data matching with the information in the Online database the
The respondent seems to be taking place. The complainant then agreed with the respondent to purchase
an offline variant. On 11 June 2018, the complainant received the following notification from the
programme: No synchronisation hasbeen performed for 30 days. The program cannot be reused until a
synchronisation has been carried out with an existing internet connection.’ The complainant then connected
the device to the Internet. As a result, 55 entries for various training sessions were sent to the Respondent.
On 7 September 2018, another synchronisation took place, in which 114 entries were transferred. The
complainant was not informed by the respondent of the purposes of the data processing nor of the legal
basis for this. Furthermore, the complainant had requested the respondent by e-mail of 11 September 2018
to provide information pursuant to Article 15 of the GDPR, but this request for information had not yet been
answered.
2. As this is a cross-border situation and the main establishment or sole establishment of the respondent
is located in Germany, the proceedings were suspended by decision of the Data Protection Authority of 21
June 2019, GZ DSB-D130.241/0006-DSB/2019 until the decision of a lead supervisory authority or the
European Data Protection Board.
3. Subsequently, the Bavarian State Office for Data Protection Supervision (BayLDA) has declared itself
the lead supervisory authority and submitted the Respondent’s complaint for comments and made several
requests in this regard.
From the respondent’s point of view, the facts are different from those stated by the complainant in the
following points: The purchase of the offline variant was made after consultation by the Respondent about
the differences between online and offline variants. In this context, the complainant confirmed to the
respondent that he waived the online synchronisation of his data. He also noted that his data could not be
recovered even in the event of a loss or defect of a device. A corresponding confirmation signed by the
complainant on 23 April 2018 was submitted by the Respondent. In order to be able to use the licensed
offline version, an activation must be made. In this case, license data (name, address, PIN) would be
requested, which the complainant had also agreed to after corresponding oral information by the
—3—
respondent. In that regard, the respondent submitted the judgment of the Amtsgericht Nürnberg of 25
March 2019 (ref. 12 C 8459/18) in which that facts were found. However, the complainant subsequently
attempted to perform an online synchronisation despite the confirmation signed on 23 April 2018 and
entered data. By e-mail of 12 June 2018, the Respondent agreed to the complainant to provide and activate
a so-called single version. This is a software extension that allowed the complainant to train on a larger
scale. The nature of the software acquired by the complainant as an offline variant was not thereby altered.
However, the complainant subsequently attempted to carry out an online synchronisation and entered data
contrary to the agreement reached on 23 April 2018. The message “No synchronisation has been
performed for 30 days”. The program can only be reused once a synchronisation has been performed on
an existing Internet connection’ is based on the fact that the complainant unlawfully installed an older
software version on another device that had a software error. Therefore, instead of contacting the
Respondent, the complainant carried out the synchronisation. The complainant was unable to provide proof
of when and by which device this notification was displayed. Moreover, that was also stated in the above-
mentioned judgment of the Amtsgericht Nürnberg. The complainant’s request for information had already
been answered by e-mail of 12 September 2018. A corresponding e-mail has been submitted. Neither the
right to information nor the right to information have been violated.
4. By final notification of 25 November 2020, the BayLDA informed the complainant of the results of the
investigation.
5. By letter dated 9 June 2021, the BayLDA requested further information from the Respondent, namely
the sending of the second information provided on 13 September 2018, as well as information on the state
of play of the court proceedings conducted between the complainant and the respondent. The respondent
informed the BayLDA by e-mail of 3 August 2021 that the appeal against the judgment of the Amtsgericht
Nürnberg of 25 March 2019 had been withdrawn. Furthermore, the information provided by e-mail of 13
September 2018 was sent.
6. With regard to the decision taken by the lead supervisory authority, the decision of the data protection
authority suspending the proceedings was remedied by a decision of today’s day and is issued by ggstl
regarding the part of the complaint to be dismissed. Let’s go.
B. Subject of complaint
The subject matter of the complaint is whether the Respondent has thereby infringed the complainant’s
rights of access and information by not providing him with information or sufficient information. For the part
to be granted, the lead supervisory authority, the BayLDA, already has Article 60. Paragraph 9 of the
GDPR. In accordance with Article 60(9) of the GDPR, the Austrian data protection authority has to decide
on the parts of the complaint to be rejected, which define the subject-matter of the complaint.
—4—
C. Factual findings
The respondent has its office in Nuremberg, Germany. The complainant is domiciled in Austria.
A dispute was pending between the parties concerning the withdrawal of the complainant’s contract from
a complete set purchased from the respondent, including a license of a so-called
software for training purposes, and the complainant’s action in this regard — which had cited as grounds
for rescission of data protection defects — was dismissed by judgment of the Amtsgericht Nürnberg of 25
March 2019 (ref. 12 C 8459/18) after conducting an oral hearing — now final.
Among other things, the District Court found that the complainant initially ordered and delivered an offline
version in April 2018. In June 2018, the offline version was converted into a single version at the
complainant’s request. Names, address and PIN number were unlocked for initial setup or licensing
verification. Furthermore, the respondent’s body size, weight and e-mail address were recorded. No further
data query by the Respondent took place.
The complainant was informed about the licence query or now has the information concerning him or her
of the respondent’s data processing.
Assessment of evidence: The findings are based first on the arguments put forward by the parties to the
proceedings and from the documents in the file. As regards the information of the complainant by the
respondent, in particular the judgment of the Amtsgericht Nürnberg of 25 March 2019
—5—
(Ref. 12 C 8459/18) and the BayLDA’s final communication of 25 November 2020.
On the basis of the complainant’s request of 11 September 2018, the Respondent provided the following
information by letters of 12 September and 13 September 2018:
In addition, except for the clear data processed by the Respondent, which have been unsolicited by the
Respondent, the Complainant has been informed of his data processed by the Respondent.
Assessment of evidence: The finding is based, in particular, on the judgment of the Amtsgericht Nürnberg
of 25 March 2019 (ref. 12 C 8459/18) as well as on the final notification of the BayLDA of 25 November
2020 and the contents of the file.
By complaint of 19 March 2019, the complainant brought a data protection complaint to the Austrian data
protection authority for breach of the right to information and information.
Assessment of evidence: The finding is based on the arguments put forward by the parties and the content
of the file.
D. From a legal point of view, it follows:
The complaint processing is a cross-border data processing within the meaning of Article 4(23)(b) of the
GDPR, since the complainant is domiciled in Austria, but the controller (respondent) is established in
Nuremberg, Germany. In accordance with Article 56(1) GDPR, the lead supervisory authority was therefore
—6—
the Bavarian State Office for Data Protection Supervision (BayLDA). According to Art. 4 para. 22 lit. c
GDPR, the Austrian data protection authority was the supervisory authority with which the complaint was
submitted.
In the course of the proceedings, the lead supervisory authority concluded that the respondent infringed
the complainant’s right of access by providing data information but not providing clear information to the
complainant. In this regard, the BayLDA referred to Guidelines 01/2022 on data subject rights — Right of
access, EDPB, para. 19 (version 1.0, adopted on 18 January 2022) and on ErwGr. 63 of the GDPR.
Furthermore, the BayLDA considered that the deletion of the complainant’s data after the court hearing
before the Amtsgericht Nürnberg resulted in an infringement of the complainant’s right to information, since
the complainant did not request such deletion and therefore it became impossible to inform the
complainant’s clear data. In this respect, the BayLDA again referred to the Guidelines 01/2022, specifically
para. 39.
Moreover, the BayLDA considered that the right to information was not infringed. Also the alleged
infringement in the right to information iSd. Article 13 of the GDPR considered the BayLDA not infringed on
the basis of the findings of the investigation. Nor could it be contradicted.
The judgment of the Amtsgericht Nürnberg of 25 March 2019 (ref. 12 C 8459/18) already shows that the
respondent has complied with its obligation to provide information and is also apparent from the findings
that the complainant now has the information in accordance with Article 13(4) of the GDPR. A right to a
declaration that the information has been given too late cannot be derived from the GDPR (see, for this
purpose, the judgment of the Verwaltungsgerichtshof of 27 September 2007, with regard to the comparable
legal situation under the DSG 2000. 2006/06/0330, mwN). In any event, the success of a complaint
pursuant to Article 77(1) of the GDPR in conjunction with Paragraph 24(1) of the DSG is conditional on the
existence of a specific complaint at the time of the administrative decision, which is no longer apparent at
the time of the administrative decision (see, for example, VwSlg 11.568 A/1984 mwN regarding the lack of
a subjective infringement).
This also applies to the other points to be reported iSd. Art. 15 GDPR, of which the complainant (in the
meantime) is aware (e.g. the possibility of lodging a complaint with a supervisory authority or the purposes
of processing; see the findings of the VwGH of 27 March 2006, Zl. 2004/06/0125, of 25 April 2006, Zl.
2004/06/0167, and of 25 November 2008, Zl. 2004/06/0007).
If the lead supervisory authority and the supervisory authorities concerned agree to reject or reject parts of
the complaint and to act on other parts of that complaint, Article 60 shall apply. Paragraph 9 GDPR on this
matter makes a separate decision for each of these parts. The lead supervisory authority shall adopt the
decision for the part concerning action in relation to the controller, notify it to the principal establishment or
—7—
sole establishment of the controller or processor in the territory of its Member State and inform the
complainant thereof, while the supervisory authority responsible for the complainant adopts the decision
for the part concerning the rejection or rejection of that complaint and informs the complainant and informs
the controller or processor thereof. For this reason, the decision in question is taken by the Austrian Data
Protection Authority for the part of the complaint to be dismissed.
The appeal was therefore dismissed in accordance with the opposition.
NOTICE OF APPEAL
A complaint may be lodged in writing to the Federal Administrative Court against this decision within four
weeksof notification. The complaint must be submitted to the Data Protection Authority and must:
- the name of the contested decision (GZ, subject)
- the name of the competent authority;
- the reasons on which the claim of illegality is based;
- the desire and
- contain the information necessary to assess whether the complaint is submitted in good time.
The data protection authority has the possibility to amend its decision within two months either by
means of a preliminary appeal decision or to submit the complaint to the Federal Administrative
Court with the file of the proceedings.
The complaint against this decision is subject to a fee. The fixed fee for a corresponding entry including
supplements is EUR 30. The fee is paid to the tax office’s account for fees, traffic taxes and gambling
(IBAN: AT83 0100 0000 0550 4109, BIC: BUNDATWW) to be paid, whereby the respective complaint
procedure (business number of the decision) must be indicated on the payment order as the intended
use.
In the case of electronic transfer of the appeal fee with the “Finance Office payment”, the tax office for
fees, traffic taxes and gambling (IBAN as before) must be indicated or selected as the recipient.
Furthermore, the tax number/tax account number 109999102, the tax type ‘EEE complaint fee’, the date
of the decision as the period and the amount must be indicated.
The payment of the fee must be proved in original (original) upon lodging the complaint to the Data
Protection Authority by means of a proof of payment confirmed by a post office or a credit institution
confirming the entry. If the fee is not paid or not paid in full, a report will be sent to the responsible tax
office.
A timely and admissible complaint to the Federal Administrative Court shall have suspensive effect.
The suspensory effect may have been excluded in the judgment or may be ruled out by a decision of its
—8—
own.
January 9, 2023