DPA case 2022-0.560.569 – Dismissed (Austria, 2022)

On 22 January 2022, the complainant disclosed the official e-mail address and the official telephone number of a data subject to the Austrian data protection authority (DPA) via a form made available by the DPA. Subsequently, the complainant filed a complaint against itself in order to clarify by way of an official decision whether a data protection violation could technically occur by sharing personal data with the DPA and whether such a violation had actually occurred in practice. The DPA noted that Article 77 (1) GDPR grants a data subject the right to lodge a complaint if there is a breach of the processing of personal data relating to him or her and that the European Court of Justice has held that Article 8 (1) and (3) of the Charter of the EU also grants a data subject the right to submit a petition to the national supervisory authorities for the protection of his or her fundamental rights (see judgment "Schrems I" of the ECJ of 6 October 2015, para. 58 et seq.). However, the DPA also stated that one of the necessary preconditions for asserting the right to lodge a complaint is that the person lodging the complaint is personally affected by the processing. Therefore, Article 77(1) enshrines a right that a data subject is entitled to, but not, for example, a controller or processor. In this case, it was clear to the DPA from the complainant's submissions that he was not himself a data subject, but rather that he may have unlawfully disclosed the personal data of another individual - as the actual data subject - and was then lodging a complaint against himself. Consequently, the DPA held that the complainant was not entitled to lodge the complaint in question.