Court case 6Ob174/25v – Court Ruling (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that a national security authority did not have to provide complete information to a person who requested access to their security assessment data. The court found that privacy rules did not apply in this case due to the nature of the security assessments. This decision clarifies the limits of access rights in sensitive security matters.
What happened
A person requested access to their security assessment data from a national security authority, but the authority did not provide complete information.
Who was affected
The individual who made the access request regarding their security assessment data.
What the authority found
The court held that privacy rules did not apply to the security assessments, so the authority was not required to provide the requested information.
Why this matters
This ruling highlights the limitations of access rights in security contexts. Organizations should be aware of how different legal frameworks may affect data access requests.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 29 May 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject made an access request to a national security authority (the controller) who had conducted multiple security assessments about him. The data subject had been informed that the security assessment in connection with his use of the federal press service’s online accreditation had resulted in a negative recommendation. The data subject stated that the controller had provided him incomplete information as a response to the access request. In the proceedings before the court of first instance, the data subject demanded the controller to provide him access to complete and correct information according to Article 15 GDPR and claimed €100 in damages. In addition, he requested a declaration of the liability of the controller due to the inadequate execution of his access request. The court of first instance rejected the claims on the grounds of inadmissibility of legal recourse. The appeals court found GDPR did not apply to the case according to the exception in Article 2(2)(d) GDPR and held that the alleged infringement must be asserted before the DPA with legal recourse to the administrative court. The data subject stated in his appeal before the Austrian Supreme Court that he had the right to assert his claims in the ordinary course of law by virtue of Article 79 GDPR. The Austrian Supreme Court rejected the appeal with regard to the access request under Article 15 GDPR. It held that the data subject would only benefit from the dual nature of legal protection by the DPA and the civil courts within the scope of application of the GDPR. The court ruled that the GDPR was not applicable in the present case: the purpose of the security assessments was to evaluate the trustworthiness of a person and provide information on whether they would commit dangerous attacks. Therefore, they clearly fell within the scope of the exception in Article 2(2)(d) GDPR. The data subject was not able to prove that his personal data had also been processed for administrative, or
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 6Ob174/25v in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 6Ob174/25v - Austria (2026). Retrieved from cookiefines.eu
Last updated: