Court case W605 2289290-2/18E – Court Ruling (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that a public authority provided incomplete access to a person's data during an investigation into their benefits. The individual had requested more information about photos taken of their property. This case highlights the importance of transparency in how personal data is handled by authorities.
What happened
The court found that the public authority did not fully comply with a request for access to personal data related to an investigation.
Who was affected
The individual receiving social benefits from the public authority was affected by this ruling.
What the authority found
The court determined that the authority did not provide complete information regarding the data it processed, violating access rights under GDPR.
Why this matters
This ruling underscores the need for public authorities to be transparent and thorough when responding to access requests. Organizations should ensure they provide all relevant information to individuals to avoid legal issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 9 September 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject received social benefits from a public authority (controller) because of their unemployment. The controller has established an investigation unit that investigates undeclared workers and people who refuse to work but receive benefits. Employees from that investigation unit visited the data subject’s address and took pictures in the context of an investigation into possible income from self-employed work. The data subject requested from the controller access to their personal data processed by the controller pursuant to Article 15 GDPR. The controller submitted the data to the data subject. In an additional access request, the data subject requested information as to the number of photos taken at the address of the data subject, what objects were depicted, which employees took those pictures and with what justification. As a response, the controller sent six pictures that were taken at the address of the data subject in PDF format to the data subject. Three pictures were taken from the public pavement and depicted a poster and an advertisement placard, both visible from the public pavement. Three other pictures depicted the data subject’s car and house. The data subject lodged a complaint with the DPA, claiming incomplete access to their personal data, especially because the controller failed to provide them with information concerning the employers who conducted the investigation against them and meta data of the pictures, including technical data of the pictures. The DPA rejected the complaint and the data subject appealed it to the Federal Administrative Court (BVwG). As far as the scope of the access request was concerned, the Court held that the data subject has narrowed the scope of the subject matter of the access request to the pictures and the justification to take them by specifying those matters in their request. Since the access request is triggered by the request of the data subject, the request can limit the scope of what the DPA ha
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W605 2289290-2/18E in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W605 2289290-2/18E - Austria (2026). Retrieved from cookiefines.eu
Last updated: