DPA – Court Ruling (Austria, 2026)

The data subject filed a complaint with a DPA on 18 June 2024 under Article 77 GDPR. The complaint concerned a controller established in another Member State and alleged an incomplete response to an access request under Article 15 GDPR. The DPA did not issue a decision within six months. On 26 August 2025, the data subject lodged a complaint with the court, claiming that the DPA had failed to comply with its obligation to decide within the statutory deadline. The DPA argued that the case involved cross-border processing and that another supervisory authority acted as the lead authority under Article 56 GDPR. It further stated that the decision deadline was suspended due to the cooperation procedure under Article 60 GDPR. The DPA formally transmitted the complaint to the lead authority on 22 October 2025. First, the court held that the case concerned cross-border processing within the meaning of Article 4(23) GDPR. Therefore, the cooperation and consistency mechanism under Articles 56 and 60 GDPR applied, making the foreign supervisory authority the lead authority. Second, the court considered that, in such cases, the competence to issue a final decision depends on the outcome of the cooperation procedure. It noted that only the lead authority can adopt binding decisions concerning cross-border processing, while other DPAs act as concerned authorities. Third, the court held that the decision period under national law was suspended pursuant to § 24 DSG during the cooperation procedure under Articles 56 and 60 GDPR. The court clarified that this suspension applied automatically from the moment the complaint was filed, not only after the formal initiation of cooperation between authorities. Finally, the court concluded that the DPA had not failed to act within the required time frame. As a result, there was no violation of the duty to decide, and the complaint was dismissed.