Public Employment Service Austria (controller) – Complaint Upheld (Austria, 2025)

On 07. August 2023, the data subject made a request to the processor to provide the report and the questionnaire completed by the data subject at an information event. The processor responded to this request, stating that they would receive a final report and that all required documents were provided to the controller. The data subject sent a request to the controller on 30. September 2023, specifically asking for access to personal data, which remained unreplied. The questionnaire had already been deleted at that time. On 13. January 2024, the data subject sent another request to the controller, also asking about the processor's procedure. The controller answered on 23. January 2024 and stated that the questionnaire had already been disposed of and therefore could not be provided. The data subject lodged a complaint with the Austrian DPA (DSB) regarding the withholding of information about their processed data and their deletion despite the processor being aware of an information request, submitted by the data subject on 07. August 2023. During the proceedings, data relating to a project involving the data subject was deleted. First, the DPA held that the processor had not violated the right to access under Article 15 GDPR as there was no evidence of contractual violations between the processor and the contractor under Article 28(10) GDPR. As defined in Article 4(8) GDPR, the processor processes personal data on behalf of the controller and thereby acts as their "extended arm". The processor is in physical possession of the data and is bound by the controller's directives regarding the purposes and means of the processing. Therefore, the controller is responsible for the actions of the processor if the processor were their own, except in cases where the processor exceeds the defined scope and determines the purposes and means of processing under Article 28(10) GDPR. This concludes to the controller's responsibility to ensure that the data subjects can exercise their rights, with the processor providing support where possible. Second, the DPA held that both the email from 30. September 2023 and the email of 13. January 2024 did constitute information requests under Article 15 GDPR. The data subject simply requested the transmission of information, namely the report and the questionnaire and did not refer to personal data. Third, the DPA held that the disposal of project data during the proceedings constituted a violation of the data subject's right of access under Article 15 in conjunction with Article 5(1)(a) GDPR. The deletion of personal data that is subject to an access request that has already reached the controller violates Article 15 GDPR. This is because the deletion makes it impossible for the DPA to investigate in a possible breach of the access right. However, the deletion of the questionnaire right after the initial interview had happened before the data subject's first email on 08. August 2023 and was thus lawful. Fourth, the DPA held that a right to receive the documents containing processed personal data could not be recognised under Article 15 GDPR in conjunction with [https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng Recital 63 GDPR] per se, the provision of a copy is just a modality of the access request. It depends on the individual case whether the controller must provide the documents or just a register of the personal data.