Werner A. (data subject) – Complaint Upheld (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court-appointed psychologist in Austria failed to respond to a personal data access request from a person involved in family court proceedings. This matters because it shows that even professionals working for the court must follow data protection rules and respond to requests about personal data. The ruling emphasizes the importance of transparency and accountability in handling personal information.
What happened
The psychologist did not respond to a personal data access request from the data subject.
Who was affected
The person involved in family court proceedings whose personal data was processed by the psychologist.
What the authority found
The authority ruled that the psychologist must comply with data protection rules and respond to access requests, as she acted independently in processing the data.
Why this matters
This case highlights that professionals, like psychologists, must adhere to data protection laws and respond to access requests. It sets a precedent for accountability in handling personal data.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
Entities Involved
The data subject was involved in family court proceedings concerning custody and contact rights. The controller, a court-appointed psychologist, collected and processed the data subject’s personal data to prepare an expert report for the court. On 17 February 2024, the data subject sent an access request to the controller under Article 15 GDPR. At that time, the controller still stored the report and related personal data. The controller received the request but did not respond or inform the data subject about any reasons inaction. The data subject then filed a complaint with the DPA. During the proceedings, the controller argued that she acted on behalf of the court and that most data had already been deleted, except for a copy of the report. She did not provide further submissions despite requests from the DPA. First, the DPA held that the psychologist qualified as a controller under Article 4(7) GDPR. It noted that court-appointed experts act independently when determining how to collect and process personal data for their reports. Therefore, they decide on the means of processing and cannot rely on the court’s mandate to avoid GDPR obligations. Second, the DPA found that the data subject had submitted a valid access request under Article 15 GDPR. The controller received the request, and personal data was still being processed at that time. Third, the DPA held that the controller violated Article 12(3) GDPR and Article 12(4) GDPR by failing to respond within one month and by not informing the data subject about the reasons for inaction. The DPA also clarified that even where conflicting rights exist under Article 15(4) GDPR, a controller cannot refuse access entirely and must at least provide a partial response. A general reference to confidentiality obligations is not sufficient. Finally, the DPA ordered the controller under Article 58(2)(c) GDPR to comply with the access request within four weeks or to inform the data subject of the reasons for refusal.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Werner A. (data subject) in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Werner A. (data subject) - Austria (2025). Retrieved from cookiefines.eu
Last updated: