- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Court case W274 2237071-1 – Court Ruling (Austria, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A union asked a member for extra identification before deleting their data after they quit. The court decided this was unnecessary and that the union should have processed the deletion request without additional proof. This ruling reinforces the rights of individuals to have their data deleted.
What happened
The union required a copy of the person's ID to process their request for data deletion.
Who was affected
The former union member who requested the deletion of their personal data.
What the authority found
The court ruled that the union's request for additional identification was unjustified and that they failed to act on the deletion request.
Why this matters
This case emphasizes that organizations cannot impose unnecessary barriers for individuals trying to exercise their data rights. It encourages unions and similar organizations to streamline their processes for data deletion.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 21 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
After multiple years as a member of a union the data subject decided to quit and sent the union a letter requesting termination of the membership and the deletion of personal data. Among other information the letter contained the membership number and the handwritten signature of the data subject. The union immediately terminated the membership of the data subject. In terms of the erasure request, however, the union asked for a copy of the ID of the data subject in order to progress with the deletion. Although the name and membership number were known to the union, it could not verify that also the signature on the letter was from the data subject. The union argued that although the data subject stated to be known to the union due to their long membership, the size of the union with over 1.2 million members and different administrative responsibilities did not constitute a personal relationship with the data subject. Moreover, the consequences of the data deletion would be severe compared to a resignation given that the data was necessary for a later re-entry in the union to continue the data subject’s membership. Therefore, and in accordance with Article 12(6) GDPR additional measures of identification were required. The data subject refused to provide a copy of the ID seeing a contradiction in providing even more data to achieve its deletion. The data subject argued that sending a copy of the ID does not mean any higher degree of reliability or proof of identity since it could be stolen, forged or used by another person. According to the GDPR additional information may only be requested if there are reasonable doubts about the identity of the natural person which does not allow for routine identity checks in all data subjects' rights. The BVwG ruled that the union unjustifiably requested proof of identity of the data subject and had not dealt with the latter's request for deletion. In this regard, it followed a previous position of the Austrian DPA according to
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W274 2237071-1 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
21 June 2021
Authority
DPA BVwG
About this data
Cite as: Cookie Fines. Court case W274 2237071-1 - Austria (2021). Retrieved from cookiefines.eu
Last updated: