DSB – Court Ruling (Austria, 2026)

The data subject was a military officer against whom were launched disciplinary proceedings. These proceedings resulted first in the imposition of a fine against them and ultimately in their dismissal. The dismissal judgement was later annulled by the Supreme Administrative Court. The data subject lodged 14 complaints with the DPA from 11 April 2023 to 22 August 2024. The DPA pointed out that in the recent past, it had already decided on 19 previous complaints that the data subject had lodged with it. From these 19 cases, the data subject’s complaints were dismissed nine times. Eight complaints were upheld, and one was partially upheld. Moreover, the data subject had appealed three of these decisions. The DPA found that all of the new 14 complaints shared a common link. They were all related to the data subject’s employment-related conflicts and the disciplinary proceedings. They were also filed against individuals connected to the data subject’s former employment. In addition, the DPA noted the repetitive language in the data subject's submissions. The data subject in their complaints regularly alleged unlawful use of their data, unlawful disclosures and violations of their data subject rights. The DPA highlighted that on some occasions the data subject had filed a complaint with it as early as the day after the rejection of one of their requests. The DPA believed that the data subject was attempting to resolve issues with former departments and superiors through data protection complaints. It concluded that the data subject was using the complaints as a form of retaliation, rather than genuinely seeking to protect their legal rights due to an alleged data protection violation. The DPA emphasized that data protection proceedings should not be used as a means of pressure against former superiors. Consequently, the DPA determined that the data subject's complaints were abusive and their actions excessive. Deeming this an abuse of rights, the DPA decided not to process the 14 new complaints under Article 57(4) GDPR. The reason for this was that the requests were deemed excessive because they were clearly aimed at causing annoyance or exerting pressure. The DPA issued a decision refusing to handle the 14 complaints. The data subject then appealed this decision before the Federal Administrative Court. The data subject contended that the DPA did not adequately address the specific grounds of their complaints. They also argued that the DPA had relied on the overall number of proceedings instead of assessing the individual complaints. The data subject cited the CJEU ruling in [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62023CJ0416 Case C-416/23] to argue for the proper interpretation of Article 57(4) GDPR. CJEU had clarified that repeated Article 77 GDPR complaints are not excessive merely because of their number and that the DPA must prove abusive intent. Moreover, they argued, that one of the complaints should not have been included in the DPA’s refusal decision, because it had already been submitted to the Federal Administrative Court. The court partly upheld the appeal only in relation to one complaint, which had already been submitted to court and therefore should not have been included in the DPA’s refusal decision. Therefore, it ruled that there were 13 complaints at issue in this case, not 14. The court did not examine the merits of the data subject’s complaints. It reviewed only whether the DPA was entitled to refuse to handle them under Article 57(4) GDPR. The court relied heavily on [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62023CJ0416 CJEU Case C-416/23] to evaluate whether the complaints were excessive pursuant to Article 57(4) GDPR and recognized that the number or frequency of the requests alone is insufficient to indicate excessiveness. The DPA must establish abusive intent. However, it remarked that these factors could suggest that the data subject's primary aim was unrelated to data protection. The court also noted that hostility towards specific individuals could constitute an abusive purpose. It observed that the 13 complaints were primarily directed against the data subject’s superiors, many of whom were involved in their disciplinary proceedings. The court also highlighted the close temporal proximity between these proceedings and the filing of the complaints. Consequently, the court determined that the complaints were closely linked to the data subject’s disciplinary disputes and mainly targeted former superiors involved in those proceedings. The court concluded that the complaints were used as a means of pressure, rather than to primarily protect data protection rights. The court upheld the DPA's opinion that there was abusive intent in the data subject's 13 complaints and that they were excessive under Article 57(4) GDPR.