DPA case 2023-0.227.168 – Complaint Upheld (Austria, 2023)

The data subject made an access request with a public company – ELGA – tasked with services in the sector of public health, including keeping databases on behalf of the Austrian Ministry of Health. Shareholders in such a company were the Austrian federal government, regional administrations and representatives of social security institutions. ELGA never replied to the request. Thus, the data subject lodged a complaint with the Austrian DPA. ELGA denied to be ‘controller’ pursuant to Article 4(7) GDPR. According to the company, the controller was the Austrian Ministry of Health, which determined purposes and means of the processing operations undertaken by the company, especially in the context of vaccination campaigns. The DPA highlighted that Austrian law assigned to a specific office within ELGA the responsibility to deal with, among others, access requests by data subjects concerning processing activities ordered by the Health Ministry. According to the DPA, the concept of controller pursuant to Article 4(7) GDPR must be kept separated from the duty to address an access request. This can be inferred by the fact that the duty to react, even in a negative way, applies to anyone, the existence of a processing activity not being a necessary element for the request. If the addressee of the access request considers that a substantial reply is either materially or legally impossible, they still have to inform the data subject about the reasons of the refusal pursuant to Article 12(4) GDPR and about the possibility to lodge a complaint with the DPA. In other words, a duty to react is essential to enable the data subject to exercise further rights under the GDPR. Therefore, the DPA used its power under Article 58(2)(c) GDPR and ordered ELGA to provide the requested information.