DPA case DSB-D123.921/0005-DSB/2019 – Complaint Upheld (Austria, 2019)

The complainant had received the information that "N*** Austria" would process her personal data. In a letter she requested general information in this regard. There was no reaction, which is why she urged corresponding information in another letter. Both letters were addressed to N*** Wirtschaftsprüfungsgesellschaft mbH. Originally, the complainant did not know which company had processed her data. "N*** Austria" was not clear in this regard. The company refused to provide information with reference to the provision of Article 15(4) GDPR as well as business secrets, copyrights and professional secrets (according to the Act on the Profession of Chartered Accountant). After several exchanges of correspondence the Respondent provided very general information. Information about the specifically processed data and a copy of this data was expressly refused. The data subject lodged a complaint with the data protection authority. The complainant requested the DPA to impose a fine on the respondent. The DPA partly upheld the complaint and found that the respondent had violated the complainant's right to access by not providing her with any information about the specific entries of the categories of personal data (such as names, tax-relevant information). The DPA obliged the respondent to provide the relevant information to the data subject. Regarding other aspects the supervisory authority held that the complaint was unfounded and rejected the complainant's request for a fine for the respondent. Regarding the allegations of the bank, with grounds on their secrecy obligation, the DPA also stated that the right to access does not always apply in absolute terms and that it may be restricted by third-party interests such as secrecy obligations. However, in order for such a restriction to apply, a data controller must properly substantiate their arguments for denying the right to access.