Vera A. – Complaint Upheld (Austria, 2025)

The data subjects were three children and their parents. The controller was a regional education authority responsible for maintaining student records under national education law. The children were subject to compulsory schooling. One child completed the nine-year compulsory schooling at the end of the 2022/23 school year, while the other two were still subject to compulsory schooling. On 15 February 2024, the data subjects submitted access requests, which the controller answered on 12 August 2024. On 16 August 2024, the data subjects submitted requests for erasure of their personal data. The controller refused to delete the data for all data subjects. On 18 September 2024, the data subjects filed a complaint with the DPA, alleging a violation of their right to erasure under Article 17 GDPR. First, the DPA held that the controller lawfully refused erasure for the parents and the two children that are still subject to compulsory schooling. It found that the controller had a legal obligation under national education law to process their personal data as long as they are still in school. Therefore, Article 17(3)(b) GDPR applied, excluding the right to erasure. This part of the claim was therefore denied. Second, the DPA assessed the situation of the child who had already completed compulsory schooling. The authority noted that the controller could not rely on Article 17(3)(e) GDPR based on a general reference to potential future legal claims. It pointed out that this exception requires concrete and imminent proceedings, not a merely abstract possibility. Finally, the DPA held that the controller violated Article 17 GDPR by retaining the former pupil’s data without a valid legal basis. It ordered the controller, under Article 58(2)(c) GDPR, to delete the personal data within four weeks.