Barichgasse 40-42
A-1030 Wien
Tel.: +43-1-52152
E-Mail: [email protected]
GZ: D155.017
2023-0.279.664 Sachbearbeiterin:
Complaint (Art. 77 GDPR)
(IMI Nr. A56 ID 92101, Case Register "134353" )
FINAL DECISION
Subject: Closing of proceeding
1. Procedure/ Facts of the case
The complainant filed a complaint against (opponent) concerning
the right to data portability, with the State Commissioner for Data Protection of Lower Saxony (LfD).
The complaint was submitted to the Austrian Data Protection Authority (DSB) on November 21, 2019.
In her complaint, the complainant stated that she requested data portability according to Article 20
GDPR on September 16, 2019. She sent another reminder via email on October 2, 2019. The opponent
answered on October 3, 2019 that her request will be answered soon. Up to the date of the complaint
(October 23, 2019), the complainant didn’t receive an answer. The controller didn’t comply with the time
limit laid down in Article 12 (3) GDPR.
The opponent, , has its establishment in ,
, Austria. The DSB took up the complaint as Lead Supervisory Authority according to Article 56 (1)
GDPR.
By letter dated June 29, 2020, the DSB requested the opponent to submit its comments to the
complaint. At the same time, it was pointed out that - until the closure of the proceedings before the
DSB - there would be the possibility to remedy the alleged infringement by complying with the data
subjects request pursuant to Article 20 GDPR ("right to data portability"). The information on the
subsequent compliance with the request should be provided directly to the complainant, a copy should
be attached to the statement to the DSB.
With statement from September 23, 2020, the opponent commented that they have contacted the
complainant in order to grant her the right to data portability. As attachment, the opponent submitted
the email issued to the complainant on September 23, 2020. In this email, the opponent asked the
-2–
complaint to, if applicable, provide a corresponding functional link for the transmission of her personal
data to another controller. Attached to the email was the complainant’s personal data in a structured,
machine-readable format (CSV/excel file).
The statement of the controller was shared with the LfD in order for them to grant the complainant the
right to be heard. The complainant did not issue any further statements.
On June 14, 2021, the DSB requested the opponent to submit further comments. As the opponent has
expressed in its statement of September 23, 2020, that they have contacted the complainant, they were
requested to inform the DSB whether the complainant's requests have now been complied with. Further
it was recalled, that – in view of remedying the alleged infringement by complying with the requests of
the complainant pursuant to Article 20 GDPR - a copy of the provided data should be attached to the
statement to the DSB.
With statement of June 22, 2021, the opponent emphasized again that the complainant was contacted
on September 23, 2020. Since then, the complainant has not contacted the opponent again, or reacted
to the email or shared data. As attachment, the opponent submitted the complainant’s personal data
as CSV/excel file.
The DSB shared the opponent’s statement of June 22, 2021, including the provided personal data in
the format of a CSV/excel file, as well as a letter of the DSB dated July 6, 2021 to the complainant with
the LfD on August 6, 2021. In this letter, the DSB stated that it is of the opinion that an amicable
settlement could be reached as a result of the opponent’s response and that the complaint could be
considered closed. The complainant was given a period of two weeks from receipt of this letter, to justify
- if necessary - why she still considers the originally alleged infringement (data portability) to be at least
partially unresolved. Otherwise, the DSB will assume that an amicable settlement has been reached.
On June 9, 2022, the DSB asked the LfD, whether the DSB’s letter and the documents have been
shared with the complainant.
On June 15, 2022, the LfD stated, that the letter and documents have been shared with the complainant.
The LfD commented that they assume that the complaint has been settled as to date, they have not
received a reaction of the complainant.
2. Amicable settlement
According to paragraph 24 (6) DSG (Austrian Data Protection Act), an opponent may subsequently
remedy the alleged infringement by complying with the requests of the complainant until the conclusion
of the proceedings before the data protection authority. If the data protection authority deems the
complaint to be without merit in this respect, it shall hear the complainant on the matter. At the same
time, the complainant's attention shall be drawn to the fact that the data protection authority will
informally discontinue the proceedings if the complainant fails to substantiate within a reasonable period
-3–
of time why he or she still does not consider the originally alleged infringement to have been remedied,
at least in part. Late statements shall not be taken into account.
As explained above, the statements of the controller, including the CSV/excel file, have been shared
with the LfD. In accompanying letter of the DSB, the complainant was informed that the DSB considers
the issue as amicable settled. The complainant was further informed on the legal consequences in case
she will not issue any further statements.
Despite being given the opportunity to do so, the complainant did not submit any further comments.
Due to the reaction of the opponent, especially due to the fact that the opponent shared the requested
data with the complainant on September 23, 2020 and again via the DSB/LfD, in a structured, commonly
used and machine-readable format (CSV/excel file), the complaint is considered to be amicably settled
in accordance with paragraph 24 (6) DSG (Austrian Data Protection Act).
Accordingly, the proceeding is to be discontinued.
12. April 2023
Für die Leiterin der Datenschutzbehörde: