CJEU case C-185/25 Waldfelber – CJEU Judgment (Austria, 2026)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
The Court of Justice ruled that a headteacher at a primary school in Austria failed to provide a teacher's personal data when requested. This case shows that individuals have the right to access their personal information, and schools must comply with these requests. Small business owners should understand that transparency is key in handling personal data.
What happened
A headteacher refused to disclose the identity of a third party who provided negative feedback about a proposed program coordinator.
Who was affected
The program coordinator, who was the subject of the headteacher's email, was affected by this lack of transparency.
What the authority found
The Court held that the headteacher must provide access to the personal data requested under GDPR.
Why this matters
This case reinforces the right of individuals to access their personal data. Businesses should be prepared to respond to such requests to avoid legal issues.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The headteacher of a primary school in Austria was in charge of organising mandatory continuing training programmes for teachers at the school. The training programmes were provided by a University, which supplied schools with organisational staff known as programme coordinators. The data subject was proposed by the University as the coordinator for an upcoming training programme at the school. After being informed of this proposal, the headteacher asked a teacher about the data subject’s reputation in a face-to-face conversation. The teacher expressed a negative opinion about the data subject. The headteacher then sent an email from his professional email address, using a school computer and a designated server, to an employee of the University. In the email, he requested that another programme coordinator be assigned. He referred to the information obtained from the third party, according to which the data subject allegedly opposed the public school system and was in constant dispute with the relevant education authority. When the data subject became aware of the email, he requested access under Article 15 GDPR. In particular, he asked for the identity of the third party who had provided the information, as well as a copy of the personal data concerning him processed in the email. The headteacher refused to provide this information. He argued that he had not possessed or stored personal data concerning the data subject and had merely expressed concerns about the proposed appointment. The data subject brought legal proceedings. The first instance court dismissed the claim, and the appeal court upheld that decision. The courts found that the headteacher had acted as an executive officer of the legal entity governing the school. They also held that the means of processing, including the professional email address, server and computer, had been prescribed to him. Therefore, they considered that he could not be treated as a controller under the GDPR. The appeal court a
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (0)
No other cases found for CJEU case C-185/25 Waldfelber in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. CJEU case C-185/25 Waldfelber - Austria (2026). Retrieved from cookiefines.eu
Last updated: