Barichgasse 40-42
A-1030 Vienna
Tel.: +43-1-52152
E-mail: [email protected]
GZ: D130.633 Case handler:
2025-0.322.866
Data protection complaint (Right of access)
,
by RSb/letter/email
FINAL DECISION
VERDICT
The Austrian Data Protection Authority decides on the data protection complaint of
(complainant) of 7 February 2021 against the Luxembourg-based
(respondent) for infringement of the right of access as follows:
The complaint is rejected as unfounded.
Legal bases: Article 4(23), Article 12, Article 15, Article 51(1), Article 56, Article 57(1)(f), Article 60 and
Article 77(1) of Regulation (EU) 2016/679 (General Data Protection Regulation; ‘the General Data
Protection Regulation’): GDPR), OJ No L 119, 4.5.2016, p. 1; Sections 18(1) and 24(1) and (5) of the
Austrian Data Protection Act (DSG), Federal Law Gazette I No 165/1999, as amended; Article 47 of the
Charter of Fundamental Rights of the European Union (‘the Charter’): EU-CRC), OJ No C 202,
7.6.2016, p. 389.
-2--
JUSTIFICATION
A. Arguments of the parties and procedure
1. By submission of 7 February 2021 initiating the proceedings, the complainant alleged an
infringement of the right of access and, in summary, argued that the respondent had refused to reply to
its request for access of 25 October 2020.
2. On 10 March 2021, the Austrian Data Protection Authority initiated the procedure under Article
56 of the GDPR, because there was a situation which did not fall within its sole competence. The
Luxembourg supervisory authority has subsequently declared itself as the lead supervisory authority
and has carried out an investigation.
3. By submission of 18 April 2021, the complainant urged the handling of his complaint and, by
letter of 3 October 2021, contacted the Finanzprokuratur (Austrian Financial Procuratorate) on the basis
of an intended filing of failure-to-act complaint due to an alleged breach of the duty to take a decision.
4. By letter of 7 October 2021, the Finanzprokuratur (Austrian Financial Procuratorate) informed
the Austrian Data Protection Authority that, in the absence of sufficient specification, it did not qualify
the complainant’s request as a demand for official liability and therefore did not take any further steps.
5. By letter of 11 April 2022, the Austrian Data Protection Authority informed the complainant of
the results of the investigation carried out by the Luxembourg supervisory authority and granted the
right to be heard to him. In particular, the respondent’s statement that the respondent had contacted
the complainant and unsuccessfully asked him to authenticate his request since his request for access
had been made from an unverified e-mail address was communicated to the complainant.
6. The complainant did not make any further submissions in the context of the hearing of the
parties, despite the granted opportunity. The Austrian Data Protection Authority notified this fact to the
Luxembourg supervisory authority on 17 June 2022 and suggested the submission of a draft decision.
7. The Luxembourg supervisory authority issued a draft decision on 13 December 2024, rejecting
the present complaint.
B. Subject matter of the complaint
The subject matter of the proceedings is the question whether the respondent infringed the appellant's
right to access.
-3--
C. Findings
C.1. The Austrian Data Protection Authority bases its findings on the procedure set out in point A.
C.2. The complainant contacted the respondent by e-mail of 25 October 2020 and filed a request for
access within the meaning of Art. 15 GDPR. The complainant used the e-mail address
C.3. By e-mail of 27 October 2020, the respondent asked the complainant to verify his request, as he
sent his request from an e-mail address that was not linked to a account at the time. On 20 July
2021 and 9 August 2021, the respondent contacted the complainant again and asked him to verify his
identity. The complainant did not respond.
Consideration of evidence: The findings are based on the present administrative act and the statements
documented on file therein, as well as the correspondence between the parties to the proceedings.
D. From a legal point of view, it follows that:
D.1. On the cooperation mechanism of the GDPR
Pursuant to Article 56(1) of the GDPR, the supervisory authority of the main establishment or the single
establishment of the controller or processor is, in accordance with the procedure laid down in Article 60
of the GDPR, the competent lead supervisory authority for cross-border processing carried out by that
controller or processor.
Pursuant to Article 4(23)(2) of the GDPR, ‘cross-border processing’ means processing of personal data
carried out in the context of the activities of an individual establishment of a controller or processor in
the European Union, which has or may have a significant impact on data subjects in more than one
Member State.
In accordance with Article 60(3) of the GDPR, the lead supervisory authority shall, without undue delay,
provide the other supervisory authorities concerned with relevant information on the matter and shall,
without undue delay, submit a draft decision to the other supervisory authorities concerned for
comments.
If none of the supervisory authorities concerned objects to the draft decision submitted by the lead
supervisory authority, the lead supervisory authority and the supervisory authorities concerned shall be
deemed to agree with and be bound by the draft decision in accordance with Article 60(6) of the GDPR.
In accordance with Article 60(8) of the GDPR, where a complaint is dismissed or rejected, the
supervisory authority with which the complaint has been lodged shall, by way of derogation from
paragraph 7, leg. cit., adopt the (final) decision, notify the complainant and inform the controller.
-4--
D.2. On the modalities of the right of access
Pursuant to Article 15(1) of the GDPR, the data subject has the right to obtain from the controller
confirmation as to whether personal data relating to him or her are being processed and, if so, the data
subject has a right of access to those personal data and to the further information referred to in Article
15 of the GDPR.
Pursuant to Article 12(3) of the GDPR, the controller shall provide the data subject with information on
the measures taken on request pursuant to Article 15 of the GDPR without undue delay and in any
event within one month of receipt of the request.
If the controller has reasonable doubts as to the identity of the natural person making the request
pursuant to Article 15 GDPR, it may request additional information necessary to confirm the identity of
the data subject pursuant to Article 12(6) of the GDPR.
D.3. In the matter
D.3.1. On the competence
As a preliminary point, it should be noted that the present complaint constitutes a ‘cross-border
processing’ within the meaning of Article 4(23) GDPR, which is why a cooperation procedure under
Articles 56 and 60 et seq. GDPR had to be initiated. Since the respondent is mainly established in
Luxembourg, the Luxembourg supervisory authority, as the lead supervisory authority, was called upon
to carry out the investigations and to submit a draft decision pursuant to Article 60(3) of the GDPR.
In the absence of an objection to the draft decision of the Luxembourg supervisory authority, it has
become binding on all other supervisory authorities concerned, and thus also on the Austrian Data
Protection Authority. As the draft decision rejects the appeal as a result, the final decision in the sense
of Article 60(8) GDPR was to be adopted by the Austrian Data Protection Authority, whereby the
Austrian Data Protection Authority is materially bound by the draft decision of the Luxembourg
supervisory authority.
D.3.2. Rejection of the present complaint
The Luxembourg supervisory authority, after carrying out the investigation procedure and the
observations obtained therein, was of the opinion that the respondent duly complied with the request
for access made by the complainant, which is why no violation of the right of access was to be seen.
As can be deduced from the findings, the complainant was contacted several times by the respondent
and asked to verify his identity. In that regard, the respondent could rely on the provision of Article 12(6)
of the GDPR, which allows a controller to request additional information in the event of reasonable
doubts as to the identity of the data subject filing a request.
-5--
When processing requests from data subjects pursuant to Articles 15 to 21 GDPR, the controller must
in any case ensure that the request comes from a legitimate person and that there is neither confusion
nor misuse by third parties. A general obligation for identification cannot be derived from this and the
assessment of whether there are reasonable doubts regarding the identity of the applicant must be
assessed on a case-by-case basis.
Since the respondent is undoubtedly a large payment service provider through which a large number
of data subjects process payment transactions, the request to the complainant for verification of his
identity cannot be opposed, especially since the complainant submitted his request for information from
an e-mail address which could not be assigned to an existing account by the respondent at that
time.
The authentication method required by the respondent, i.e. the logging-in of the complainant into his
account, is also not objectionable in principle, since the (digital) identification of a data subject
includes authentication procedures with the same credentials as the data subject uses to log-in to the
online service provided by the controller (cf. Recital 57 GDPR).
An unjustified refusal by the respondent to deal with the request for access addressed to it by the
complainant is therefore not discernible. Rather, the respondent has tried several times to contact the
complainant to verify his identity, which ultimately (only) failed due to the lack of cooperation of the
complainant.
From a procedural point of view, it should be noted that in the present proceedings the complainant
was given the opportunity to take note of the findings of the lead Luxembourg supervisory authority and
the statements of the respondent in the context of the hearing of the parties and to comment on them.
A violation of the qualified right to be heard within the meaning of Article 47 of the EU-Charter is
therefore not present.
In the light of the foregoing considerations, the complaint ultimately proved to be unfounded, which is
why it had to be dismissed in accordance with the verdict.
The final decision will be delivered directly on the complainant by the Austrian Data Protection Authority,
while the respondent will be informed of the present decision in the sense of Article 60(8) of the GDPR
via the Luxembourg supervisory authority.
-6--
INSTRUCTIONS ON APPEAL
This decision may be appealed in writing to the Federal Administrative Court within four weeks of
service. The complaint must be lodged with the Austrian Data Protection Authority and must
contain:
- the name of the contested decision (ref.no., subject)
- the name of the issuing authority;
- the grounds on which the allegation of illegality is based;
- the request and
- the information necessary to assess whether the complaint has been lodged in due time;
The Austrian data protection authority has the possibility to amend its decision within two months either
by means of a preliminary appeal decision or to submit the appeal with the files of the
proceedings to the Federal Administrative Court.
The appeal against this decision is subject to a fee. The fixed fee for such submission, including
supplements, shall be EUR 30. The fee must be paid to the account of the Austrian Tax Office, stating
the intended purpose.
In principle, the fee must be paid electronically using the ‘tax office payment’ function. The recipient
must be the Austrian Tax Office (Finanzamt Österreich - Dienststelle Sonderzuständigkeiten) (IBAN:
AT83 0100 0000 0550 4109, BIC: BUNDATWW). In addition, the tax number/tax account number 10
999/9102, the tax type ‘EEE -Beschwerdegebühr, the date of the decision must be indicated as the
period and the amount.
If your credit institution’s e-banking system does not have the ‘tax office payment’ function, the eps
procedure can be used in FinanzOnline. An electronic transfer can only be dispensed with if no e-
banking system has been used so far (even if the taxpayer has an Internet connection). Then the
payment must be made by means of a payment order, whereby care must be taken to ensure the
correct allocation. Further information can be obtained from the tax office and from the manual
‘Electronic payment and reporting of self-assessment levies’.
The payment of the fee must be demonstrated when the complaint is lodged with the Austrian data
protection authority by means of a proof of payment to be attached to the submission or a printout of
the issuing of a payment order . If the fee is not paid or not paid in full, a notification shall be made
to the competent tax office.
A timely and admissible appeal to the Federal Administrative Court shall have suspensive effect. The
suspensive effect may have been ruled out in the decision or may be ruled out by a separate decision.
-7--
25. April 2025
For the Head of the Austrian Data Protection Authority: