Court case W252 2248013-1 – Court Ruling (Austria, 2023)

In this case an individual was seeking to exercise data subject rights on behalf of his deceased father, against a bank (the controller). The individual in question had submitted an access request to the bank and subsequently made a complaint, dated 1 October 2018, alleging that the information he received from the controller was incomplete. In particular, he asserted that his father’s bank details were not included, even though he had inherited the data subject rights of his father. On 19 August 2021 the DPA rejected the complaint, the individual subsequently appealed this decision to the Federal Administrative Court (BVwG), on 24 September 2021. The BVwG dismissed the appeal in its entirety. In doing so, the Court referred to Recital 27 which clarifies that “this regulation does not apply to the personal data of deceased persons”. Furthermore, the court outlined that “an assertion of the right to information (right to access) under Article 15 GDPR on behalf of the father through his son as heir, is out of the question…. The fundamental right to data protection or the right to information is a highly personal right that only the data subject can exercise themselves… Accordingly, highly personal rights cannot be inherited”. Accordingly, the data subject had no right to access this data under Article 15 GDPR.