DSB (Austria) – Court Ruling (Austria, 2021)

The data subject has requested access to their personal data under Article 15 GDPR. The controller (Arbeitsmarktservice Österreich) did not fulfill the request at first. Later – during the administrative proceeding – the controller, however, did. Thereupon, the DSB (Austria) informally closed the proceeding. The data subject objected to the termination of the proceedings on the grounds that the answer to their request was too late and was insufficient. The DSB maintained its decision arguing that the data subject has no right to have a past violation of the GDPR determined and that the assertion of insufficiency is be regarded as a new submission under § 13(8) AVG since it changes the substance of the matter. The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision and reasoning of the DSB. First, the court elaborated on Article 15 GDPR though these statements were not necessary for the decision of the case. It held that a data subject has no general duty to cooperate, but at most an obligation to specify if the controller processes a large amount of data and the data subject makes a very general request or is only interested in specific information or data processing. In these cases, the controller can request clarification from the data subject, but has no right to do so. The data subject may nevertheless insist that all data be disclosed. This means that the two-stage information procedures that occur in practice, in which the data controller initially only provides information on master data and only provides comprehensive information at the express request of the applicant, are perfectly permissible, provided that the applicant is made aware of this fact. Second, the court determined that the DSB was not allowed to close the proceedings informally but should have issued a formal notice according to § 24(6) BDSG because the data subject had objected with reasons against the termination of the proceedings. Third, the court stipula