Data subject – Court Ruling (Austria, 2026)

The data subject sent an access request to the service provider (the processor). It replied that it held no personal data concerning the data subject in its capacity as controller. It explained that it provided services to N-GmbH and acted as its processor. The processor and N-GmbH belonged to the same corporate group. The data subject had received payment demands from a debt collection agency in 2020 and 2021 that identified the processor as the instructing party and also received demands from a law firm in 2020 and 2024 referring to the processor as its client. The DPA initially rejected the data subject's complaint in 2023. In 2025, the Federal Administrative Court partially voided the decision because the DPA had not adequately investigated whether the processor had processed the data in connection with the debt collection and litigation activities, including whether those activities fell within the processing agreement with N-GmbH. The court upheld the rejection of the data subject's other requests. Following the remittal, the DPA again rejected the data protection complaint. The data subject appealed, arguing that the controller had acted in its own name and therefore as controller rather than processor. First, the court distinguished between a controller and a processor by focusing on who actually decided the purposes and essential means of the processing. A processor could not freely determine those elements because it processed personal data on behalf of the controller. Second, the court found that the processor had been commissioned by N-GmbH to handle payment processing, including payment reminders and the handling of legal cases. The payment demands and reminder sent to the data subject therefore formed part of the tasks assigned to the processor and were covered by the processing agreement. The court found no evidence that it had exceeded the authority given to it under that agreement. The court therefore concluded that N-GmbH, as controller, was responsible for responding to the data subject's access request and the processor did not have a separate obligation to provide the requested information beyond its processor role. The court upheld the DPA's decision and dismissed the data subject's complaint as unfounded.