Barichgasse 40-42
A-1030 Vienna
Tel.: + 43-1-52152
Republic of Austria
Data
protection E-mail: [email protected]
GZ: D155.085 Clerk:
2023-0.883.894
Data protection complaint
(A56ID 425901, Case Register 392556)
via RSb/letter/e-mail “email address”
FINAL DECISION
VERDICT
The Data Protection Authority decides on the data protection complaint of (complainant)
of 30 October 2021, submitted to the Bavarian Lander Office for Data Protection Supervision, against
(respondent) for breach of the right to access as follows:
1. The complaint is granted and it is established that the respondent has infringed the
complainant in the right of access.
2. The respondent is ordered to provide the complainant with information on the personal data
concerning him within a period of two (2) weeks in the case of other execution within the
scope of Art. 15 GDPR.
Legal bases: Articles 4(7), 15, 51(1), 57(1)(f), 58(2)(c) and 77(1) of Regulation (EU) 2016/679 (General
Data Protection Regulation; ‘the General Data Protection Regulation’: GDPR), OJ L 119, 4.5.2016, p. 1;
Sections 18(1) and 24(1) and (5) of the Data Protection Act (DSG), Federal Law Gazette I No 165/1999
as amended.
—2—
REASONING
A. Arguments of the parties and the proceeding of the proceedings
1. By letter of 30 October 2021, the complainant lodged a complaint to the Bavarian Lander Office
for Data Protection Supervision and stated, in summary, that the respondent did not respond to his
request for access dated 28 November 2020 and 5 November 2020.
2. The Bavarian Lander Office for Data Protection Supervision submitted the complaint with entry
dated 27. April 2022 under the IMI number 392556 to the Internal Market Information System of the
European Union and suggested the lead responsibility of the Data Protection Authority. The complaint
was re-submitted to the European Union’s Internal Market Information System with the entry of 5 August
2022 under the IMI number 425901. By entry of 19 October 2022, the Data Protection Authority declared
its lead responsibility and requested additional documents from the Bavarian Lander Office for Data
Protection Supervision.
3. By letters dated 10 November 2022 and with further urgency letters of 7 November 2022.
December 2022 and 5 January 2023 the Data Protection Authority requested the respondent to provide
a statement.
4. By submission of 16 January 2023, the respondent replied and requested that more information
on the complainant, as he is not the only person with that name.
5. The Data Protection Authority sent the respondent’s reply with entry dated 19. January 2023
under the IMI number 477883 on the Internal Market Information System of the European Union to the
Bavarian Lander Office for Data Protection Supervision.
6. The Bavarian Lander Office for Data Protection Supervision transmitted via the European Union
Internal Market Information System with entry dated 16 February 2023 under IMI number 477883, a
supplementary statement of the complainant to the data protection authority. An e-mail correspondence
between the complainant and the respondent of 19 November 2020, in which the respondent referred
to a person named was enclosed.
7. By letter of 21 February 2023, the data protection authority transmitted the supplementary
information obtained from the respondent and requested the respondent to submit a statement. The fact
that the respondent referred to a person named was pointed out by the Data Protection
Authority in its correspondence with the respondent.
8. The respondent submitted by submission of 23 February 2023 that the the case at issue had
—3—
already been handled in December 2022 and the file was closed. In response to an additional request
for clarification by the Data Protection Authority, the respondent informed, by submission of 27 February
2023, that file had been closed. The respondent alleged to have received from its
contract partner on 14. December 2020 a list of cases to be closed, but could not transmit it for data
protection reasons, since other debtors were also mentioned there. Upon another request and notice
from the Data Protection Authority that the complainant was not , the respondent informed,
by submission of 1 March 2023, that the file had been closed and that an e-mail had been sent to the
complainant.
9. The data protection authority transmitted the results of the investigation procedure with entry
on 2 March 2023, under the IMI number 491932 on the European Union Internal Market Information
System, to the Bavarian Lander Office for Data Protection Supervision and granted the complainant the
right to be heard.
10. By letter dated 25 April 2023, the complainant informed the Bavarian Lander Office for Data
Protection Supervision that he had received a message from the respondent that file
had been closed.
11. The Data Protection Authority informed the respondent by letter of 25 April 2023 that the
complainant had not received the requested data information so far and again pointed out a possible
confusion with
12. By submission of 25 April 2023, the respondent replied that it had informed the respondent on
27 February 2023 that the file of had been. In addition, on 1 March 2023, the complainant
had been informed that everything had been completed.
13. By letter of 25 April 2023, the Data Protection Authority reiterated that and the
complainant were two different persons. The respondent then requested the complainant’s e-mail to
resend him the message. The Data Protection Authority provided the respondent with the complainant’s
e-mail address. The respondent then informed that it would contact the complainant.
14. By letter dated 19 June 2023, the Data Protection Authority asked the respondent whether it had
contacted the complainant.
15. By letter of 20 August 2023, the respondent informed that file had been closed
and reiterated its claim that it had been closed on 14 August 2023. In December 2020, the respondent’s
contract partner had issued a list of cases to be closed, but the list could not be transmitted for data
protection reasons, since other debtors were also mentioned there.
16. By letter dated 26 June 2023, the Data Protection Authority again requested the respondent to
inform whether it had contacted the complainant under the notified e-mail address.
—4—
17. By letter of 26 June 2023, the respondent indicated that it had informed the complainant that Mr
file had been closed and, moreover, reiterated its previous arguments. By further letter of
26 June 2023, the complainant informed, contrary to its previous statement, that according to its records,
only the correspondence with the data protection authority had been documented and that no letter had
been sent to the complainant.
18. The data protection authority transmitted the results of the further investigations to the Bavarian
Lander Office for Data Protection Supervision with entry dated 27 June 2023 under the IMI number
531693 on the Internal Market Information System of the European Union. The Bavarian Lander Office
for Data Protection Supervision replied by entry dated 28 June 2023 and informed the data protection
authority that the respondent’s replies do not show any progress and that still no information had been
provided to the complainant in accordance with Article 15 GDPR.
19. With entries dated 24 October 2023 and 7. December 2023 under the IMI number 570230 and
with entries dated 8 December 2023 and 13 December 2023 under IMI number 585709, the Data
Protection Authority and the Bavarian Lander Office for Data Protection Supervision exchanged
information on the state of play of the present proceedings on the Internal Market Information System of
the European Union.
B. Subject matter of appeal
The subject-matter of the proceedings is whether the respondent infringed the complainant in the right
of access.
C. Findings
C.1. The data protection authority shall base its findings on the arguments of the parties set out in point
A. and the course of the proceedings.
Assessment of evidence: The finding on C.1. is undisputed and stems from the present file and the
submissions of the parties to the proceedings documented therein.
C.2. The Respondent is a limited liability company registered under in the Commercial
Register with its registered office in . The complainant submitted on 28 November 2020
and on 5 December 2020 an application for access pursuant to Art. 15 GDPR to the respondent’s non-
standalone German branch.
Assessment of evidence: The findings on C.2. are based, on one hand, on the basis of an officially
obtained and documented company register excerpt for on the other hand on the
complainant’s application of 28 November 2020 and 5. December 2020, the letter from the Bavarian
Lander Office for Data Protection Supervision to the respondent dated 30 August 2022 and 22
September 2022, as well as the letter from the respondent’s legal representative of 24 January 2022,
—5—
indicating that the German postal address is a non-standalone branch of the respondent with main
establishment in Austria.
C.3. Despite several requests from the data protection authority and the reference to a possible
confusion of persons in relation to the complainant’s request for information, the respondent replied as
follows, inter alia:
D. From a legal point of view, it follows:
D.1. Ad) Controllership
The data protection authority does not disregard that the respondent has its main establishment in
Austria but the complainant has transmitted the request for access to a German postal address. The
investigations carried out in advance by the Bavarian Lander Office for Data Protection Supervision have
shown that the postal address is a non-standalone establishment of the respondent based in Austria.
This was also confirmed in the letter of the respondent’s legal representative of 24 January 2022 and
the status of the respondent as a controller within the meaning of Article 4(7) of the GDPR was never
disputed by the respondent in the course of the proceedings at issue.
—6—
From the point of view of the data protection authority, there are therefore no indications that the
respondent is not the controller pursuant to Art. 4(7) GDPR.
D.2. Ad) Right of Access
In accordance with Article 15(1) of the GDPR, the data subject has the right to obtain confirmation from
the controller as to whether personal data concerning him or her are being processed and, where this is
the case, the data subject has the right to access such personal data and a right to the information
referred to in points a to h leg. Cit.
The right of access pursuant to Art. 15 GDPR serves as an instrument which enables a data subject to
become aware of the processing by a controller and to verify the lawfulness of the processing (see
Recital 63 first sentence GDPR). In other words, the data subject’s right of access allows an insight into
the “whether and how” of the processing (see. Paal in Paal/Pauly [eds.], General Data Protection
Regulation. Commentary, Art. 15, para. 3).
In order to safeguard the right of access, it is sufficient for the applicant to obtain a complete overview
of his personal data in an intelligible form, that is, in a form which enables him to gain knowledge of
those data and to verify whether they are correct and lawfully processed, so that he may exercise, if
necessary, the other rights of a data subject to which he is entitled (see with regard to the comparable
legal situation under Article 12(a) of the Directive 95/46/EC the judgment of the CJEU of 17 July 2014,
C-141/12 and C-372/12 (YS and MS) para 59).
The subject of data protection information to be provided is the data actually processed by the controller
at the time of receipt of the request for information, whereby the benchmark for this is the formal truth.
D.3. In the subject matter
The complainant has sent a request for access to the respondent, but has not received any information
on the personal data concerning him in the ongoing proceedings before the data protection authority.
The respondent itself admitted, mutatis mutandis, that no response to the request for access had been
provided to the complainant, which is why an infringement in the right to access had to be established
and the complaint had to be granted.
Pursuant to Article 58(2) GDPR, the data protection authority has different remedial powers, which serve
to establish a state corresponding to the GDPR. The exercise of a remedy with regard to ensuring
compliance with the GDPR should be appropriate, necessary and proportionate and should take into
account the circumstances of the respective individual case (see Recital 129 GDPR).
Since the respondent has failed to comply with the complainant’s request for access, the exercise of the
remedial power pursuant to Article 58(2)(c) GDPR is required, according to which a supervisory authority
may instruct the controller to comply with the data subject’s requests for the exercise of the rights
—7—
conferred on him under the GDPR.
The respondent was therefore to be instructed to provide the complainant with information within the
scope of Art. 15 GDPR. The order is based on Article 58(2)(c) GDPR. A period of two weeks seems
appropriate to comply with the order, as there are no indications that the provision of this information
constitutes a particularly high burden for the respondent.
It is again pointed out that in the context of the information to be provided, only data processed by the
respondent referring to the person of the complainant ( ) must be provided. On the other
hand, personal data processed on the person of on third persons must not be provided.
As a result, it had to be decided according to the verdict.
In addition, the Data Protection Authority reserves the right to examine the initiation of administrative
criminal proceedings against the respondent due to its repeated confusions of data subjects.
LEGAL REMEDY
A complaint against this decision may be lodged in writing to the Federal Administrative Court within
four weeksof notification. The complaint must be lodged with the data protection authority and must:
- the name of the contested decision (GZ, subject)
- the name of the competent authority,
- the grounds on which the allegation of illegality is based,
- the desire and
- contain the information necessary to assess whether the complaint has been submitted in good time.
The data protection authority has the possibility to amend its decision within two months either by pre -
trial decision or to submit the complaint with the file of the proceedings to the Federal
Administrative Court.
The complaint against this decision is subject to a fee. The fixed fee for a corresponding input including
inserts is EUR 30. The fee must be paid to the account of the Austrian Tax Office, stating the intended
purpose.
In principle, the fee must be transferred electronically with the function “Tax Office payment”. The tax
office Austria – Department of Special Competences should be specified or selected as the beneficiary
(IBAN: AT83 0100 0000 0550 4109, BIC: BUNDATWW). Furthermore, they are
Tax number/delivery account number 10 999/9102, the tax type “EEE Complaint Fee”, the date of the
decision as the period and the amount.
If the e-banking system of your credit institution does not have the function “Tax Office payment”, the
—8—
eps procedure can be used in FinanzOnline. An electronic transfer can only be excluded if no e-banking
system has been used so far (even if the taxpayer has an internet connection). Then the payment must
be made by means of a payment order, whereby attention must be paid to the correct assignment.
Further information can be found at the tax office and in the manual “Electronic payment and reporting
on the payment of self-assessmentduties”.
The payment of the fee shall be proved upon submission of the complaint to the data protection
authority by means of a payment document to be connected to the input or a printout of the issue of a
payment order. If the fee is not paid or not paid in full, a report shall be made to the competent tax
office.
A complaint lodged in good time and admissible to the Federal Administrative Court has suspensive
effect. The suspensive effect may have been excluded in the sentence of the notice or may be excluded
by a separate decision.