DSB (Austria) – Court Ruling (Austria, 2022)

The controller is a psychotherapist and the data subject is his patient. About four years after the therapy had been stopped, the data subject requested access to his data. The therapist replied that no personal data was undergoing processing. The data subject was skeptical and filed a complaint with the Austrian DPA (DSB). The DSB considered the complaint excessive because 86 other complaints lodged by the data subject were still pending with it and therefore rejected to handle the complaint under Article 57(4) GDPR. The data subject appealed this decision to the Austrian Federal Court (Bundesverwaltunsgericht – BVwG). During the court proceedings, the DSB provided the court with a list of all pending cases which did not mention the content of the cases. The Austrian Federal Court held that the rejection by the DSB was unlawful because the DSB failed to show that the present complaint and the past complaints were homogeneous. The court clarified that, according to the last sentence of Article 57(4) GDPR, the DPA bears the burden of demonstrating the excessive character of the request. The court then found that the amount of complaints is an important factor in determining whether a complaint is excessive. However, it also reasoned that the complaint must be of repetitive character which only occurs when the present complaint and the previous ones are (nearly) identical. In the present case, the court concluded that DPA did not show that the complaints were (nearly) identical since it only provided a list of the complaints pending without describing their the content and similarities.