Public Employment Service Austria (controller) – Complaint Upheld (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Austrian Public Employment Service faced a complaint for not providing requested personal data to a user. This matters because it highlights the importance of transparency and access to personal information for individuals.
What happened
The controller did not respond to a user's request for access to their personal data.
Who was affected
The user who requested access to their personal data was affected.
What the authority found
The authority found that the controller did not violate the user's right to access their data as there was no evidence of contractual violations.
Why this matters
This case underlines the necessity for organizations to respond to data access requests promptly and correctly, reinforcing the rights of individuals regarding their personal information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Secondary-source text retrieved.
Automated check recorded — 24 August 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 07. August 2023, the data subject made a request to the processor to provide the report and the questionnaire completed by the data subject at an information event. The processor responded to this request, stating that they would receive a final report and that all required documents were provided to the controller. The data subject sent a request to the controller on 30. September 2023, specifically asking for access to personal data, which remained unreplied. The questionnaire had already been deleted at that time. On 13. January 2024, the data subject sent another request to the controller, also asking about the processor's procedure. The controller answered on 23. January 2024 and stated that the questionnaire had already been disposed of and therefore could not be provided. The data subject lodged a complaint with the Austrian DPA (DSB) regarding the withholding of information about their processed data and their deletion despite the processor being aware of an information request, submitted by the data subject on 07. August 2023. During the proceedings, data relating to a project involving the data subject was deleted. First, the DPA held that the processor had not violated the right to access under Article 15 GDPR as there was no evidence of contractual violations between the processor and the contractor under Article 28(10) GDPR. As defined in Article 4(8) GDPR, the processor processes personal data on behalf of the controller and thereby acts as their "extended arm". The processor is in physical possession of the data and is bound by the controller's directives regarding the purposes and means of the processing. Therefore, the controller is responsible for the actions of the processor if the processor were their own, except in cases where the processor exceeds the defined scope and determines the purposes and means of processing under Article 28(10) GDPR. This concludes to the controller's responsibility to ensure that the data subjects can exercis
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Public Employment Service Austria (controller) in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Public Employment Service Austria (controller) - Austria (2025). Retrieved from cookiefines.eu
Last updated: