Data subject – Court Ruling (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A data subject's request for access to personal data was initially rejected, but a court later found that the investigation was insufficient. This ruling matters because it shows that individuals have the right to know what data is held about them. Companies should be prepared to properly handle access requests to avoid legal issues.
What happened
A data subject's access request was not adequately investigated by the service provider's data protection authority.
Who was affected
The individual who made the access request was affected by the lack of response regarding their personal data.
What the authority found
The court determined that the data protection authority did not fully investigate whether the service provider had processed the individual's data.
Why this matters
This case highlights the importance of thorough investigations in data access requests. Companies should ensure they have clear processes for handling such requests.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 2 October 2026.
Processing notes: articles corrected, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject sent an access request to the service provider (the processor). It replied that it held no personal data concerning the data subject in its capacity as controller. It explained that it provided services to N-GmbH and acted as its processor. The processor and N-GmbH belonged to the same corporate group. The data subject had received payment demands from a debt collection agency in 2020 and 2021 that identified the processor as the instructing party and also received demands from a law firm in 2020 and 2024 referring to the processor as its client. The DPA initially rejected the data subject's complaint in 2023. In 2025, the Federal Administrative Court partially voided the decision because the DPA had not adequately investigated whether the processor had processed the data in connection with the debt collection and litigation activities, including whether those activities fell within the processing agreement with N-GmbH. The court upheld the rejection of the data subject's other requests. Following the remittal, the DPA again rejected the data protection complaint. The data subject appealed, arguing that the controller had acted in its own name and therefore as controller rather than processor. First, the court distinguished between a controller and a processor by focusing on who actually decided the purposes and essential means of the processing. A processor could not freely determine those elements because it processed personal data on behalf of the controller. Second, the court found that the processor had been commissioned by N-GmbH to handle payment processing, including payment reminders and the handling of legal cases. The payment demands and reminder sent to the data subject therefore formed part of the tasks assigned to the processor and were covered by the processing agreement. The court found no evidence that it had exceeded the authority given to it under that agreement. The court therefore concluded that N-GmbH, as controller, was resp
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (1)
Other cases involving Data subject in AT
Details
About this data
Cite as: Cookie Fines. Data subject - Austria (2026). Retrieved from cookiefines.eu
Last updated: