DPA case 2025-0.789.117 – Dismissed (Austria, 2025)

The daughter (the data subject) of a deceased patient, who repeatedly emailed a hospital (the controller) requesting information on the medical cause of death of her father. The controller responded that she was not registered as a “trusted person”, and the deceased had designated another trusted person, who alone had access to the medical records. The data subject filed a complaint with the Austrian Data Protection Authority (DSB), alleging a violation of her right of access under Article 15 GDPR, arguing that the hospital failed to respond properly to her requests. The DSB dismissed the complaint as unfounded. It held that the data subject’s emails did not constitute a valid access request under Article 15 GDPR, as they merely sought disclosure of a specific piece of information (the medical cause of death) rather than information about the processing of personal data. Consequently, no obligation to respond under Article 12(3) GDPR arose. The DSB further found that the requested information did not relate to the data subject’s own personal data but to that of her deceased father. Since the GDPR does not apply to personal data of deceased persons under Recital 27 and the right of access is a strictly personal and non-transferable right, the complainant could not rely on Article 15 GDPR to obtain the information. The absence of a valid access request was not a procedural defect capable of being cured, and the complaint therefore had to be rejected.