Court case 6Ob174/25v – Court Ruling (Austria, 2026)

The data subject made an access request to a national security authority (the controller) who had conducted multiple security assessments about him. The data subject had been informed that the security assessment in connection with his use of the federal press service’s online accreditation had resulted in a negative recommendation. The data subject stated that the controller had provided him incomplete information as a response to the access request. In the proceedings before the court of first instance, the data subject demanded the controller to provide him access to complete and correct information according to Article 15 GDPR and claimed €100 in damages. In addition, he requested a declaration of the liability of the controller due to the inadequate execution of his access request. The court of first instance rejected the claims on the grounds of inadmissibility of legal recourse. The appeals court found GDPR did not apply to the case according to the exception in Article 2(2)(d) GDPR and held that the alleged infringement must be asserted before the DPA with legal recourse to the administrative court. The data subject stated in his appeal before the Austrian Supreme Court that he had the right to assert his claims in the ordinary course of law by virtue of Article 79 GDPR. The Austrian Supreme Court rejected the appeal with regard to the access request under Article 15 GDPR. It held that the data subject would only benefit from the dual nature of legal protection by the DPA and the civil courts within the scope of application of the GDPR. The court ruled that the GDPR was not applicable in the present case: the purpose of the security assessments was to evaluate the trustworthiness of a person and provide information on whether they would commit dangerous attacks. Therefore, they clearly fell within the scope of the exception in Article 2(2)(d) GDPR. The data subject was not able to prove that his personal data had also been processed for administrative, organisational, or other purposes. Furthermore, the court referred the case back to the court of first instance with regard to the asserted claims for damages and declaratory judgment on the liability of the controller. It held that the reasons assumed by the lower courts for the dismissal of these claims were not present.