Werner A. (data subject) – Complaint Upheld (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A psychologist involved in family court proceedings failed to respond to a data access request from a client. The Austrian data protection authority ruled that the psychologist must comply with GDPR rules. This case highlights the responsibility of professionals to respect individuals' rights to access their personal data.
What happened
A psychologist did not respond to a data access request from a client regarding personal data used in a court report.
Who was affected
The client involved in the family court proceedings was affected by the psychologist's lack of response.
What the authority found
The authority found that the psychologist violated GDPR by not responding to the access request within the required timeframe.
Why this matters
This ruling emphasizes that professionals, including psychologists, must adhere to data protection laws and respect clients' rights to access their information. It serves as a reminder for all service providers to be diligent in their data handling.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Linked-source text retrieved.
Automated check recorded — 1 May 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject was involved in family court proceedings concerning custody and contact rights. The controller, a court-appointed psychologist, collected and processed the data subject’s personal data to prepare an expert report for the court. On 17 February 2024, the data subject sent an access request to the controller under Article 15 GDPR. At that time, the controller still stored the report and related personal data. The controller received the request but did not respond or inform the data subject about any reasons inaction. The data subject then filed a complaint with the DPA. During the proceedings, the controller argued that she acted on behalf of the court and that most data had already been deleted, except for a copy of the report. She did not provide further submissions despite requests from the DPA. First, the DPA held that the psychologist qualified as a controller under Article 4(7) GDPR. It noted that court-appointed experts act independently when determining how to collect and process personal data for their reports. Therefore, they decide on the means of processing and cannot rely on the court’s mandate to avoid GDPR obligations. Second, the DPA found that the data subject had submitted a valid access request under Article 15 GDPR. The controller received the request, and personal data was still being processed at that time. Third, the DPA held that the controller violated Article 12(3) GDPR and Article 12(4) GDPR by failing to respond within one month and by not informing the data subject about the reasons for inaction. The DPA also clarified that even where conflicting rights exist under Article 15(4) GDPR, a controller cannot refuse access entirely and must at least provide a partial response. A general reference to confidentiality obligations is not sufficient. Finally, the DPA ordered the controller under Article 58(2)(c) GDPR to comply with the access request within four weeks or to inform the data subject of the reasons for refusal.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Werner A. (data subject) in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Werner A. (data subject) - Austria (2025). Retrieved from cookiefines.eu
Last updated: