DPA case [https://www.ris.bka.gv.at/Dokument.wxe?ResultFunctionToken=036dd49c-b588-4ab1-be12-3b42f314776d&Position=1&SkipToDocumentPage=True&Abfrage=Bvwg&Entscheidungsart=Undefined&SucheNachRechtssatz=True&SucheNachText=True&GZ=&VonDatum=01.01.2014&BisDat – Dismissed (Austria, 2023)

On 20 March 2021, an incident occurred in traffic between the complainant (the data subject) and an individual (the reporter), who subsequently filed a complaint at the police station. On 28 September 2021, the complainant inspected the complaint and the associated police file after being informed that the proceedings had been discontinued. The complainant discovered that the reporter knew their name at the time of filing the complaint. As a result, the data subject submitted a (data protection) complaint to the relevant data protection authority (DPA) on 23 October 2021. They alleged a violation of the right to secrecy under § 1 Datenschutzgesetz (Data Protection Act) (DSG) by the police officer involved in their case. On 21 September 2022, the DPA handling the case issued a decision, dismissing the complainant's data protection complaint against the police officer on the grounds that the police officer did not have controller status within the meaning of Article 4(7) Datenschutz-Grundverordnung (General Data Protection Regulation) (GDPR). Following the dismissal, the complainant lodged a new data protection complaint against the police officer involved in a letter dated 09 October 2022. Upon the request of the DPA, the data subject provided a statement that they became aware of the violation of the right to secrecy in December 2021 based on subsequent inquiries. Therefore, they argued that their new complaint filed in October 2022 was timely. On 30 January 2023, the authorities alleged that the data subject made contradictory statements regarding their knowledge of the alleged violation. On 06 February 2023, the complainant responded that there was no contradiction and provided an explanation. The data subject made further submissions on 28 March 2023, highlighting that their new complaint was not identical to the first complaint because the responsible person had changed. They argued that the concept of the ‘responsible person’ should be defined and interpreted