Public Employment Service Austria (controller) – Complaint Upheld (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Austrian Public Employment Service was found to have mishandled a user's request for their data but did not face a fine. This matters because it shows that organizations must respond properly to data requests from users. Small businesses should be aware of their obligations to provide information when requested.
What happened
The Austrian Public Employment Service had a complaint upheld for failing to respond adequately to a user's data request.
Who was affected
Users who requested their data from the Public Employment Service were affected by the mishandling of their requests.
What the authority found
The Austrian authority ruled that the service did not properly handle the user's request for information about their data, violating GDPR requirements.
Why this matters
This case highlights the importance of timely and accurate responses to user data requests. Businesses should ensure they have processes in place to handle such requests effectively.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
Entities Involved
On 07. August 2023, the data subject made a request to the processor to provide the report and the questionnaire completed by the data subject at an information event. The processor responded to this request on 08. August 2023, stating that they would receive a final report and that all required documents were provided to the controller. It was found later that the questionnaire had already been deleted after the initial interview. The data subject sent a request to the controller on 30. September 2023, which remained unreplied. On 13. January 2024, the data subject sent another request to the controller, also asking about the processor's procedure, as their "Kulturpass" card had not been picked up. The controller answered on 23. January 2024 and stated that the questionnaire had already been disposed of and therefore could not be provided. On 10. February 2024, the data subject lodged a complaint with the Austrian DPA (DSB) regarding the withholding of information about their processed data and their deletion despite the processor being aware of an information request, submitted by the data subject on 07. August 2023. Several statements were made by the data subject, the controller and the processor. In essence, the controller argued that the data subject did not explain or prove the necessity of the requested information. From the data subject's perspective, the controller oversimplified the case. On 30. June 2024, during the proceedings, data relating to a project involving the data subject was deleted. First, the DPA held that the processor had not violated the right of access under Article 15 GDPR as there was no evidence of contractual violations between the processor and the contractor under Article 28(10) GDPR. As defined in Article 4(8) GDPR, the processor processes personal data on behalf of the controller and thereby acts as their "extended arm". The processor is in physical possession of the data and is bound by the controller's directives regardin
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Public Employment Service Austria (controller) in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Public Employment Service Austria (controller) - Austria (2025). Retrieved from cookiefines.eu
Last updated: