Court case W298 2322178-1 – Court Ruling (Austria, 2026)

A data subject made an access request to a credit information agency (the controller) in 2023. He later filed a complaint with the Austrian DPA and alleged that the controller had violated his right of access under Article 15 GDPR by providing him partially flawed and inconsistent information. In particular, the data subject claimed that no information regarding the logic involved in the calculation of credit scores were disclosed by the controller. The data subject also stated that his right to information, rectification, erasure, restriction of processing, objection and the right not to be subjected to automated decision-making under Articles 14 and 16–22 GDPR had been violated. While the controller provided further access in course of the procedure, it argued that it provided all information required under Article 15 GDPR. After the DPA initially ordered the data subject to provide more information regarding his complaint, the DPA found no infringement of the GDPR. In particular, the DPA held that the data subject limited its access request to partial information and that he failed to exercise his rights under Article 16–22 GDPR before failing the respective complaint. The data subject subsequently appealed the decision to the Austrian Federal Administrative Court. The court dismissed the data subject’s appeal. First, the court interpreted the access request narrowly and found that the controller had not violated Article 15 GDPR. It stated that the data subject had limited his access request to concern certain information only and held that the controller had provided him all such information. Second, the court could not find any infringement of Article 14 GDPR: it held that the data subject had failed to elaborate why he considered his right to information had been violated. Furthermore, the court stated that Articles 16–22 GDPR had not been infringed, as the data subject had not exercised his rights under these provisions by sending the controller a corresponding request on rectification, erasure, restriction of processing, objection or the right not to be subject to automated decision-making. In particular, the data subject failed to comply with the DPA’s order to further specify his complaint.