Unknown data subject (complainant) – Court Ruling (Austria, 2021)

The complainant is the parent of a minor who was a patient at a child and adolescent psychiatry center. They claimed that the family, including their underage children, had been filmed in the patient's room during a visit. In 2021, they filed a complaint with the Austrian Data Protection Authority (DSB) regarding the lawfulness of these recordings. The DSB rejected the handling of the complaint based on Articles 57(4) and 77 (1) GDPR, arguing that the complainant had made excessive use of the right to lodge a complaint. Between August and 2018 and August 2021, the complainant had indeed brought a total of 29 similar proceedings to the DSB pertaining to their underage daughter's personal data. The complainant appealed this decision with the Austrian Federal Administrative Court (BVwG). The BVwG decided in favour of the complainant. It repealed the contested decision and instructed the DSB to resume the procedure. According to the BVwG, the DSB did not meet the threshold set out in Article 57(4) GDPR for demonstrating the manifestly unfounded or excessive character of these requests. The minimum requirements would have entailed an overview of the content of the proceedings pending at the DBS, as well as assessing their similarity. Furthermore, the court held that the DSB did not specifically explain the excessive nature of the inquiries, but rather made legally irrelevant speculations about the complainant's motivations, instead of assessing the merit of the complaint.