unknown data subject – Court Ruling (Austria, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that Google did not properly provide a user with access to their personal data. The user had requested access but was asked to log into their account, which they refused. This case emphasizes the right to access personal data without unnecessary hurdles.
What happened
Google failed to provide a user with access to their personal data without requiring them to log into their account.
Who was affected
A Google user who requested access to their personal data processed by Google.
What the authority found
The Austrian authority ruled that Google violated the user's right to access their data by imposing unnecessary conditions, such as logging into their account.
Why this matters
This ruling reinforces the right of individuals to access their personal data easily. Companies should ensure they provide straightforward access to personal data without imposing unnecessary barriers.
GDPR Articles Cited
National Law Articles
= On 30.10.2015, the data subject (user) sent an access request under § 26 DSG 2000 to Google Inc. (now Google LLC) via registered letter, including a copy of his passport. The user requested access to all his data processed by Google Inc. (Note: § 26 DSG 2000 used to be the Austrian provision for access requests prior to 25.05.2018.) On 22.12.2015, Google Inc. replied, asking the user to log into his Google-Account to access all data processed in the account and additional information on the processing. The user refused to log into his account For data that could not be accessed from the user's account, Google asked him to use an online form accessible from the Google account, to make sure that the user would only receive personal data that are truly relating to him (and not some other natural person). The user refused to do so. = On 01.02.2016, the user filed a complaint against Google Inc. with the Austrian Data Protection Authority (DSB) claiming that Google had violated his right to access under § 26 DSG 2000 (now Article 15 GDPR) - inter alia by requesting him to log into his Google account and to use an online form in order to gain access to his data. On 24.02.2020, in the course of the pending DSB-procedure, Google Inc. communicated again with the user, asking him to log into his Google account for authentication. On 15.06.2016, that DSB issued its decision that consisted of three rulings: I) The DSB held, that Google Inc. violated Article 15 GDPR by not providing *access to the user's data that has been processed outside the user's Google account; *certain information on data recipients and data sources as far as those information cannot be accessed in the user's Google account; *information on automated decision making; *information on the purpose and the legal basis of the processing and *information on data processors. II) The DSB ordered Google Inc. to provide this missing data/information within 4 weeks. III) Lastly, the DSB rejected parts of the user
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for unknown data subject in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. unknown data subject - Austria (2020). Retrieved from cookiefines.eu
Last updated: