Court case W605 2289290-2/18E – Court Ruling (Austria, 2026)

The data subject received social benefits from a public authority (controller) because of their unemployment. The controller has established an investigation unit that investigates undeclared workers and people who refuse to work but receive benefits. Employees from that investigation unit visited the data subject’s address and took pictures in the context of an investigation into possible income from self-employed work. The data subject requested from the controller access to their personal data processed by the controller pursuant to Article 15 GDPR. The controller submitted the data to the data subject. In an additional access request, the data subject requested information as to the number of photos taken at the address of the data subject, what objects were depicted, which employees took those pictures and with what justification. As a response, the controller sent six pictures that were taken at the address of the data subject in PDF format to the data subject. Three pictures were taken from the public pavement and depicted a poster and an advertisement placard, both visible from the public pavement. Three other pictures depicted the data subject’s car and house. The data subject lodged a complaint with the DPA, claiming incomplete access to their personal data, especially because the controller failed to provide them with information concerning the employers who conducted the investigation against them and meta data of the pictures, including technical data of the pictures. The DPA rejected the complaint and the data subject appealed it to the Federal Administrative Court (BVwG). As far as the scope of the access request was concerned, the Court held that the data subject has narrowed the scope of the subject matter of the access request to the pictures and the justification to take them by specifying those matters in their request. Since the access request is triggered by the request of the data subject, the request can limit the scope of what the DPA has to decide on, and thus, define the subject matter in the proceeding before the Court. Concerning the access to specific documents, the Court held that the access request can only include the information mentioned in Article 15 GDPR. In specific cases, in order to fulfill the obligation under Article 15 GDPR, it is necessary for the controller to provide whole documents in which the personal data is included. However, Article 15 GDPR does not stipulate a right to access to documents. Article 15(3) GDPR that stipulates that the controller shall provide a copy of personal data, must be understood as specifying a means of providing the information pursuant to Article 12 GDPR. It depends on the individual case whether the controller is required to provide whole documents or whether they fulfil their obligation by providing a register of the personal data. As far as access to data about the employees who took the pictures was concerned, the Court held that the right to access does not include the personal data of third persons. This is also true for the meta data requested. Moreover, according to the Court, the controller fulfilled their access request by providing the six pictures and information of the modalities of taking the pictures and the justification thereof. The data subject’s claim of the existence of more than those six pictures was unfounded according to the Court. The data subject was unable to demonstrate any facts that point to the existence of further pictures. However, it is for the data subject to prove that the access was incomplete. Mere speculation is not sufficient for the Court to investigate into the existence of further pictures. In conclusion, the Court confirmed the DPA decision that the controller did not violate Article 15 GDPR and gave complete access.