- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case DSB-D124.2016/23 – Dismissed (Austria, 2026)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A retailer in Austria dismissed a complaint from a person who received a notebook they never ordered. The retailer mistakenly processed the person's data after a third party used their information to place an order. This case emphasizes the importance of verifying customer orders to prevent misuse of personal information.
What happened
A retailer sent a notebook to a person after a third party ordered it using their name and address.
Who was affected
The person who received the notebook but did not place the order.
What the authority found
The authority found that the person's request for data access was invalid since the retailer had deleted their data following their request.
Why this matters
This case highlights the risks of data misuse and the importance of proper data handling by businesses. Companies should ensure they have robust verification processes to avoid similar situations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A retailer (controller) sent a notebook to the address of a data subject after having received an order to that address. However, the data subject has never placed the order and did not hold an account with the retailer. An unknown third person has placed the order, using the data subject’s address, correct first and last name and date of birth. The e-mail address and phone number used by the third person did not belong to the data subject. After having received the order, and believing that the order was placed by the data subject, the controller carried out a credit check of the data subject with a credit information agency. After receiving the notebook and learning about the false order, the data subject requested within one e-mail both access to their personal data held by the controller and the deletion of their personal data. The controller gave access to some of the data subject's personal data. Afterwards, the data subject filed a complaint with the DPA, claiming the data received upon their access request was incomplete because the data relating to the credit check were not included, amongst others. Moreover, the data subject claimed that the controller did not have a legal basis for disclosing their personal data to the credit rating agency. After the complaint was lodged, the controller replied to the access request and subsequently deleted the data. At the time of the procedure before the DPA, the controller did not process personal data of the data subject anymore. According to the DPA, the data subject cannot claim a violation of their access right because of incomplete access to their data when the data is already deleted, in accordance with their request. The data subject runs the risk of impairing their access right in case of incomplete access to their personal data when the data subject requests access to their personal data and the deletion thereof at the same time. Since the data subject requested the deletion before the involvement of the DPA
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DSB-D124.2016/23 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DSB-D124.2016/23 - Austria (2026). Retrieved from cookiefines.eu
Last updated: