Court case 11R86/25k – Court Ruling (Austria, 2025)

The data subject was a tenant in an apartment owned by the controller. Termination proceedings were pending between the parties. During those proceedings, the data subject submitted photos and documents suggesting that the controller had been monitoring them. They subsequently submitted an access request, seeking access to personal data processed about them, including among other things, information concerning their heating and hot-water consumption. The controller refused to provide the requested information. The data subject claimed that the refusal had left them with a feeling of powerlessness, stress and uncertainty about the extent to which their private activities had been monitored and their personal data processed. They therefore filed a claim for damages. The controller argued that the data subject’s access request was an abusive exercise of rights because it had been submitted in the context of the termination proceedings. It claimed that their sole intention was to obtain evidence for that dispute. It alleged that the data subject had not shown any interest in this information prior to the court proceedings. The controller also argued that the requested information was protected as its trade secrets. It further requested that the proceedings in this case be stayed until the termination proceedings and the proceedings pending before the Austrian DPA had been finally resolved. The first-instance court rejected the motion for a stay and upheld the data subject’s claims. It found that the access request was not abusive, as the data subject pursued legitimate purposes under Recital 63. It held that the data subject sought to obtain information about the data concerning them and verifying the lawfulness of that processing. It further held that trade secrets could override the right of access only in special circumstances and that the controller’s purpose to avoid giving the data subject an advantage in the termination proceedings was not sufficient. The controller appealed to the Higher Regional Court of Vienna (OLG Wien). It maintained that the access request was abusive and that it was entitled to refuse access in order to protect its trade secrets. The court referred to the CJEU judgment in [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62021CJ0132 Case C-132/21] and ruled that it was permissible to pursue in parallel dual legal remedies, at least until a final decision has been issued. The court confirmed that an access request under Article 15 GDPR is not abusive where it serves a legitimate purpose within the meaning of Recital 63 GDPR. It cited [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62022CJ0307 CJEU C-307/22] and held that an access request may legitimately be used to obtain evidence for litigation. Regarding trade secrets, the court stated that protected information must be secret, commercially valuable and subject to appropriate confidentiality obligations. It found that the controller had failed to explain how the data subject’s own personal data could qualify as trade secrets against themselves. The court emphasised that the controller’s primary concern was that the data subject could gain an advantage in the termination proceedings with this information. However, it pointed out that neither GDPR nor the Austrian Code of Civil Procedure permitted a party to tactically withhold information merely to strengthen its position in a legal dispute. The court therefore dismissed the controller’s appeal in its entirety and upheld the award of €1,000 in non-material damages to the data subject.