Court case W214 2233132-1/13E – Court Ruling (Austria, 2022)

A data subject made an access request with an address publisher and direct marketing company, the controller, asking it specifically to provide him with information about his data stored in relation to "political preference" and about the recipients of his "target group" data. As the controller only partially complied with the access request, the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde, DSB) claiming a violation of his right to access under Article 15 GDPR. The DSB partially upheld the complaint of the data subject, stating that (1) the controller did not fully comply with his access request and ordered the controller to (2a) disclose to the data subject the names of the recipients of his personal data, (2b) provide him with comprehensible information on the terms of the advertising groups, in particular about the key terms used, relevant parameters, and their allocation to the data subject, and (2c) to provide generally understandable information about the term "possible target group - academics" to the data subject. The controller appealed the decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht, BVwG), claiming that it is not obliged to disclose the names of the recipients of the data subject's personal data, as that would mean disclosing its sales channels and customer relationships. The BVwG started evaluating the case but then suspended the proceedings, pending the decision of the CJEU in case C-154/21 and issued only a partial decision on 17 May 2022. In the first partial decision n. W214 2233132-1/13E, the BVwG limited its decision to points (2b) and (2c) of the DSB's decision. In this respect, the court agreed with the controller stating that the DSB had gone beyond what was requested by the data subject in his complaint. In fact, the data subject's complaint under Article 77 GDPR was very clear and limited in scope. However, the DSB went on to assert a violation of Article 12 GDPR and Ar