DPA case 2022-0.616.013 – Dismissed (Austria, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian DPA case involved a young person who complained after their account was deleted when they requested access to their data. This is important because it shows that organizations must handle data access requests carefully.
What happened
A young person’s account was deleted after they requested access to their personal data.
Who was affected
The young person who had their account deleted and requested access to their data.
What the authority found
The DPA found that the organization complied with the access request but also violated the principle of fair processing by deleting the data prematurely.
Why this matters
This case serves as a reminder for businesses to properly manage data access requests and ensure that they do not delete information before responding. Organizations must balance compliance with user rights.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 1 July 2018, the data subject sent an access request to the controller. The controller replied with the information of the access request attached as PDF files, and stated that they had deleted the data subject’s account, because they found out, during the processing of his request, that the data subject was not yet of legal age. On 1 August 2018, the data subject lodged a complaint at the Austrian DPA (“Datenschutzbehörde”). They argued that their right of access had been violated by the controller as their data got deleted even though he had only requested access. The controller argued that the data subject was requested to provide proof of identity after receiving their request for access. When the controller examined the application, they noticed that the data subject had registered for their customer loyalty programme as a minor (at the age of 14). According to the controller’s terms and conditions, this was not actually permitted. Therefore, the controller cancelled the data subject’s membership and deregistered the data subject from their customer loyalty programme. The data subject argued that under Article 8(1) GDPR in conjunction with Austrian data protection law ([https://www.jusline.at/gesetz/dsg/paragraf/artikel2zu4 § 4(4) DSG]), they had effectively consented to the processing of their data upon reaching the age of fourteen. The DPA held that the deletion of data after receipt of an access request but before the response to the access request does not comply with the principle of fair processing under Article 5(1)(a) and thus would constitute a violation of the data subject’s right of access under Article 15 GDPR. However, after the investigation, the DPA found that the controller rightly deleted the data subject’s data after providing information. The DPA found that the information provided by the controller was complete. Therefore, the controller complied with the data subject’s access request under Article 15 GDPR. However, when it comes to l
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2022-0.616.013 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2022-0.616.013 - Austria (2022). Retrieved from cookiefines.eu
Last updated: