Data subject – Court Ruling (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court case in Austria revealed that a person could not access their data from a service provider because the provider claimed it did not hold any personal data about them. This is important for users who want to know what information companies have about them. It shows the need for companies to clearly communicate their data practices.
What happened
A person requested access to their personal data from a service provider, which denied having any data about them.
Who was affected
The individual who made the access request was affected by the service provider's response.
What the authority found
The court determined that the service provider did not adequately investigate whether it had processed the individual's data, leading to an incomplete response to the access request.
Why this matters
This ruling highlights the importance of transparency in data handling. Companies must ensure they properly investigate and respond to data access requests to maintain trust.
GDPR Articles Cited
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 2 October 2026.
Processing notes: articles corrected, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject sent an access request to the service provider (the processor). It replied that it held no personal data concerning the data subject in its capacity as controller. It explained that it provided services to N-GmbH and acted as its processor. The processor and N-GmbH belonged to the same corporate group. The data subject had received payment demands from a debt collection agency in 2020 and 2021 that identified the processor as the instructing party and also received demands from a law firm in 2020 and 2024 referring to the processor as its client. The DPA initially rejected the data subject's complaint in 2023. In 2025, the Federal Administrative Court partially voided the decision because the DPA had not adequately investigated whether the processor had processed the data in connection with the debt collection and litigation activities, including whether those activities fell within the processing agreement with N-GmbH. The court upheld the rejection of the data subject's other requests. Following the remittal, the DPA again rejected the data protection complaint. The data subject appealed, arguing that the controller had acted in its own name and therefore as controller rather than processor. First, the court distinguished between a controller and a processor by focusing on who actually decided the purposes and essential means of the processing. A processor could not freely determine those elements because it processed personal data on behalf of the controller. Second, the court found that the processor had been commissioned by N-GmbH to handle payment processing, including payment reminders and the handling of legal cases. The payment demands and reminder sent to the data subject therefore formed part of the tasks assigned to the processor and were covered by the processing agreement. The court found no evidence that it had exceeded the authority given to it under that agreement. The court therefore concluded that N-GmbH, as controller, was resp
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (1)
Other cases involving Data subject in AT
Details
About this data
Cite as: Cookie Fines. Data subject - Austria (2026). Retrieved from cookiefines.eu
Last updated: