Court case W245 2247035-1/8E and W245 2251274-1/6E – Court Ruling (Austria, 2022)

The data subject was a patient in a hospital department. The controller was the head of such department. The data subject was of the opinion that there had been medical negligence during the treatment. Consequently, the data subject sent the following access request to the controller. It was titled "Application for data information in accordance with DSG, GDPR and any other conceivable legal basis", and read: "I hereby submit the request for information in accordance with § 44 DSG and thus make use of my right to receive confirmation as to whether you process personal data concerning me and if this is the case, I make use of my right, To obtain information about the personal data concerned in accordance with § 44 DSG." Although § 44 DSG does grant data subjects a right to access, according to its chapter in the DSG, it only applies to the "Processing of personal data for the purposes of the security police, including the protection of the constitution, military self-defence, the investigation and prosecution of criminal offenses, the execution of sentences and the enforcement of measures". The controller objected to the request, arguing that they were not a controller pursuant to § 44 DSG. Subsequently, the data subject complaint to the Austrian DPA. In its assessment, the DPA stated that Article 15 GDPR, the appropriate right to access in the present case, does not require any specific formulation. The only requirement for the applicability of a right, according to the GDPR, is that the addressed controller can recognize which right the data subject wished to apply. If this was the case, a controller would be obliged to respond to an access request within the time limits set by Article 12(3) GDPR. This was objectively possible in the case at hand. It was clear from the request that the data subject wanted to rely on its right to access. Therefore, the controller should not have denied the data subject its right simply because the data subject mistakenly