DSB (DPA) – Court Ruling (Austria, 2023)

The data subject's business profile appeared on an online platform operated by the controller. The profile displayed his name, address, telephone number, opening hours, profile pictures and information about peak visiting times. In 2020, the data subject submitted a request seeking the erasure of his personal data. He argued that he had not consented to the processing and that some of the published data were inaccurate. In particular, he claimed that profile pictures had been wrongly associated with his business profile. In 2021, the data subject lodged a complaint with the Austrian DPA against the controller. He alleged violations of his right to rectification (Article 16 GDPR), his right to erasure (Article 17 GDPR) and the right not to be subject to a decision based solely on automated processing (Article 22 GDPR). He argued that the controllers had rejected his erasure request and that the automatic assignment of profile pictures involved unlawful automated processing. The DPA asked the data subject to provide evidence of a rectification request and of a request concerning Article 22 GDPR. The data subject replied that his statements about inaccurate data should be treated as an implicit rectification request. He also argued that Article 22 GDPR did not require a prior request to the controller. The DPA rejected the complaint concerning Article 16 GDPR and Article 22 GDPR, as it found that the data subject had never submitted a rectification request or a request under Article 22 GDPR to the controllers, only a deletion request. During the proceedings, the controllers removed and corrected some information. However, the data subject maintained that incorrect profile pictures and opening hours continued to appear because of automated updates. First, the court held that the right to rectification under Article 16 GDPR generally required a prior request to the controller. The court noted that the data subject must identify which data are inaccurate and explain how they should be corrected. The data subject only requested erasure under Article 17 GDPR and merely stated that some data were inaccurate. He did not specify how the allegedly incorrect profile pictures or opening hours should be corrected. The court also rejected the argument that Article 5(1)(d) GDPR imposed a standalone obligation on the controllers to correct the data without a rectification request. The court held that such an obligation only arose where the controller could concretely determine the correct data. In this case, the data subject had not provided sufficient information to enable a correction. The court therefore confirmed that the absence of a rectification request constituted a missing procedural requirement for a complaint under Article 16 GDPR. Second, the court noted that Article 22 GDPR may prohibit certain automated decisions even without a request from the data subject. However, the court held that the profile picture assignment did not amount to profiling or automated decision-making, as it did not evaluate personal aspects of the data subject within the meaning of Article 4(4) GDPR. The court further held that the display of incorrect profile pictures was not a decision under Article 22 GDPR because the processing did not produce legal effects or similarly significant effects for the data subject. The court considered that the incorrect images could at most cause irritation or mild embarrassment. It found no evidence that the images affected the data subject’s legal position, reputation or business activities in a significant way. The court therefore dismissed the complaint.