Datenschutzbehörde – Court Ruling (Austria, 2024)

In 2022, the data subject (represented by their parents) filed an access request with the DPA. They aimed at accessing some documents concerning an investigation conducted by the DPA on a controller. According to a statement of the DPA, the data subject was not a party in this procedure. After receiving an answer only partially disclosing the file of this investigation, the data subject filed a complaint with the DPA (which, in this case, acts both as the supervisory authority and the controller), arguing that no complete copy of the documents of the file had been made available. The DPA rejected this complaint, pointing out that, on the one hand, it had disclosed the information provided for by Article 15(1) and (2) GDPR. On the other hand, the data subject does not have a right to inspect the entire file since they are not a party of this investigation proceeding. In a separate and previous legal proceeding before the BVwG, the data subject appealed this complaint. In this case, the BVwG did not upheld the complaint. It ruled that the DPA lawfully only partially disclosed the documents contained in the file and that the disclosed parts easily allow the data subject to get the information stated in Article 15(1) and (2) GDPR. As for Article 15(3) GDPR, the DPA suspended the proceedings, due to the fact that there was a preliminary ruling proceeding before the CJEU under number C-487/21. After the CJEU issued its judgement in case C-487/21, Österreichische Datenschutzbehörde and CRIF, the DPA rejected the data subject’s complaint. It argued that, in light of this judgement, Article 15(3) GDPR does not enshrine an independent right, but merely represents a modality of the provision of information. Therefore, the data subject appealed the DPA’s decision before the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). First, the court noted that in case C-487/21, Österreichische Datenschutzbehörde and CRIF, the CJEU had ruled that Article 15(3) GDPR must be interpreted as meaning that the right to obtain from the controller a copy of the personal data undergoing processing means that the data subject must be given a faithful and intelligible reproduction of all those data. Furthermore, the CJEU ruled that this right should entail the right to obtain copies from databases which contain those data, if the provision of such a copy is essential in order to enable the data subject to exercise effectively the rights conferred on them by the GDPR, taking also into account the rights and freedoms of others. Therefore, according to the court, Article 15(3) GDPR does not confer to the data subject a separate and independent right to obtain copies in addition to the information provided according to Article 15(1) GDPR. As for the case at hand, the court noted that, in its previous judgement, it had already ruled that the DPA had already provided the data subject with the information in full within the meaning of Article 15(1) to 15(3) GDPR in a sufficiently understandable and comprehensible manner. Therefore, the DPA concluded that – since the data subject’s right of access has already been satisfied – there is no need to provide them with a copy of the documents. On these grounds, the court ruled that the DPA rightly rejected the complaint concerning the violation of Article 15(3) GDPR.