Court case W 254 2323066 – 1/14E – Court Ruling (Austria, 26)

The data subject participated in an integration course and was excluded from the course for disciplinary reasons. As a reaction, he addressed a letter to the organisation responsible for the integration course. In this letter, he asked the organisation to inform him about the reasons that lead to his exclusion from the course. In the letters, he did not refer to the GDPR, data protection or the processing of data. He repeated his request in four subsequent letters. The organisation rejected his request. The data subject lodged a complaint with the DPA, claiming a violation of Article 15 GDPR. The DPA rejected his complaint on the grounds that his request to the organisation could not be understood as an access request provided for by Article 15 GDPR. The data subject appealed the decision to the Federal Administrative Court (Bundesverwaltungsgericht). The court upheld the decision of the DPA. A request to access to their personal data by the data subject is a prerequisite for a possible violation of a data subject’s access right. Article 15 GDPR does not request the data subject to state any reasons for their access request or follow a specific format. However, it can be concluded from Recital 63, that under certain circumstances, the data subject can be expected to make their request precise, e.g. what personal data the data subject requests access to. In general, the request is to be interpreted objectively from a third-person-perspective, considering all circumstances. In the light of the aforementioned, the court decided that the letter the data subject sent to the organisation must objectively not be understood as an access request. It did not refer to the GDPR, data protection or the processing of personal data at all and merely expressed a request to the reason for his exclusion from the course, which is an information request. An information request is a different instrument that is separate from an access request pursuant to Article 15 GDPR. The first time the data subject mentioned data protection reasons was when lodging the complaint with the DPA. However, the court held that the request must first be addressed to the controller and not to the DPA to be considered an access request because a violation of Article 15 GDPR can only come from a failure to grant (full) access to the personal data. Without a request addressed to the controller, the controller cannot fail at granting access because he is not obliged to grant access to any personal data.