Father and child (data subjects) – Dismissed (Austria, 2025)

The data subjects were father and child (a minor). The controller was a court-appointed expert in a custody and contact-rights proceeding before an Austrian district court. On 14 October 2024, the court appointed the expert to prepare an opinion on contact arrangements between the father and the child and on joint custody. On 23 December 2024, the expert conducted a diagnostic interview with the father and collected personal data relating to both data subjects as part of the court mandate. On 12 April 2025, the father requested the court-appointed expert to delete all personal data concerning himself and the child. On 27 October 2025, the father filed a complaint with the Austrian DPA. He requested a finding that his rights to confidentiality, information and erasure had been violated and asked the DPA to order the deletion of all personal data processed by the expert. First, the DPA referred to recent case law of the [https://infocuria.curia.europa.eu/tabs/document?source=document&text&docid=294111&pageIndex=0&doclang=DE&mode=req&dir&occ=first&part=1%7CCJEU CJEU] and the [https://ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Vwgh&Dokumentnummer=JWT_2023040002_20230627L00|Austrian Administrative Court] on Article 57(4) GDPR noting that supervisory authorities may refuse to act on excessive or manifestly unfounded complaints. As the complaint primarily targeted the alleged bias of the court-appointed expert and sought to undermine the expert’s role in the custody proceedings, the DPA found that the data subject (father) attempted to use GDPR procedures to delegitimise the expert’s work and obtain deletion of evidence gathered under a judicial mandate. The authority considered this a misuse of rights and an abuse of the complaint mechanism under Article 57(4) GDPR. Second, the DPA emphasised that it had no competence to review procedural defects in civil proceedings, assess the admissibility of expert evidence or replace remedies available under Austrian procedural law. Finally, the DPA refused to handle the complaint under Article 57(4) GDPR because it considered the complaint both abusive and manifestly unfounded.