- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2025-0.395.497 – Dismissed (Austria, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Austrian lawyer's Bar Association dismissed a complaint from a person who wanted access to all documents about their case. The authority found that the Bar Association provided some information but was not required to share entire documents due to confidentiality rules. This ruling emphasizes the limits of access rights when third-party information is involved.
What happened
A person requested access to all personal data held by a Bar Association but was denied full access to certain documents.
Who was affected
The individual who filed the complaint and the Bar Association that processed his disciplinary complaint.
What the authority found
The authority decided that the Bar Association was not obligated to disclose entire documents due to confidentiality obligations.
Why this matters
This case illustrates that while individuals have rights to access their data, those rights can be limited when it involves the privacy of others. Businesses should be aware of these boundaries when handling personal data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject filed a disciplinary complaint against a lawyer with a regional Bar Association (the controller). He subsequently submitted an access request under Article 15 GDPR, seeking all personal data processed about him. The Bar Association provided certain information but refused to disclose specific documents. The data subject then lodged a complaint with the Austrian Data Protection Authority (DSB), alleging that his right of access had been violated because the information was incomplete, in particular as the legal opinion of the lawyer concerned and other communications between the Bar Association and that lawyer in the disciplinary proceedings were not disclosed. The DSB dismissed the complaint as unfounded. It held that Article 15 GDPR does not confer a right to obtain copies of entire documents, but only a copy of the personal data contained therein. The communications and legal opinions within disciplinary proceedings include personal data of third parties, particularly the lawyer concerned, whose interests in confidentiality outweigh the data subject’s interest in disclosure. Moreover, [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10002940 Austrian disciplinary law (DSt)] establishes statutory confidentiality obligations for disciplinary files, which constitute a permissible restriction under Article 23 GDPR. Accordingly, the refusal to disclose the requested documents did not violate the data subject’s right of access.
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2025-0.395.497 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2025-0.395.497 - Austria (2025). Retrieved from cookiefines.eu
Last updated: