Court case 13R70/25x – Court Ruling (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that a company did not have to provide digital copies of invoices to a customer who requested them. This decision is significant because it clarifies what companies must provide when someone asks for their personal data. It shows that just asking for documents doesn’t guarantee you will receive them if they are not necessary for understanding your data.
What happened
A customer sued a company for not providing digital copies of invoices and transaction data after making an access request.
Who was affected
The customer who requested their personal data, including invoices and transaction details.
What the authority found
The court decided that the company had provided sufficient information and was not required to give copies of the documents requested, as they were not essential for the customer to understand the data processing.
Why this matters
This case highlights the limits of data access rights under GDPR. Companies should be aware that they may not need to provide every document requested, especially if the information already shared is adequate.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A data subject brought proceedings against a controller after it refused to provide, free of charge, digital copies of invoices and transaction data following an access request. The data subject argued that Article 15(3) GDPR entitled them to receive a complete copy of the personal data processed by the controller, including the copies of invoices and transaction data. The controller argued that it had complied with both of the data subject's requests for information in a timely and complete manner. It argued that Article 15(3) GDPR entitled the data subject to a copy of their personal data, rather than to copies of documents as such. The controller alleged that it had disclosed the payment details provided by the data subject, thereby enabling them to clearly identify which bank account had been debited. The first-instance court dismissed the data subject’s action. It acknowledged that, according to the CJEU in judgement [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62021CJ0487 C-487/21], copies of whole documents must be provided only where they are indispensable for the data subject to understand the processing of their personal data or to effectively exercise their GDPR rights. The court considered that the data subject had not proved such necessity. It noted that they had already received the relevant invoices during the contractual relationship following the respective billing periods and the information disclosed by the controller was sufficient to understand the processing at issue. The therefore found that the controller could make any re-sending of invoices conditional upon payment of a fee. The data subject appealed to the Higher Regional Court of Vienna (OLG WIEN) and argued that in accordance with the case law of the CJEU ([https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62022CJ0307 CJEU judgment C-307/22]) a data subject need not provide reasons for requesting a copy of their personal data from the controller, and that the right
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 13R70/25x in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 13R70/25x - Austria (2025). Retrieved from cookiefines.eu
Last updated: