Court case W252 2246883-1 – Court Ruling (Austria, 2023)

The data subject was an employee of the controller. The data subject claimed that a manager addressed them through their official email address, even if the communication concerned personal issues unrelated to work. Thus, the data subject filed a complaint with the Austrian DPA. The Austrian DPA dismissed the complaint because it was lodged after more than 1 year after the data subject became aware of the alleged infringement. The data subject appealed this decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG) for violation of Article 77 GDPR. The court clarified that Article 77 GDPR, providing for the right to lodge a complaint with the competent DPA, does not establish any deadline for the exercise of such a right. However, the activity of the DPAs is regulated by national procedural law within the limits of Article 58(4) GDPR. In lack of a regulation addressing the matter, specific rules governing procedures before the DPAs are subject to the principle of procedural autonomy of the Member States. The only limits to such a broad discretion of the Member States are the principle of equivalence – according to which procedural guarantees concerning European rights cannot be lower than guarantees set forth in the context of merely national rights – and the principle of effectiveness, which states that the exercise of European rights shall not be made impossible or excessively difficult in practice. In the present case, the court pointed out how that the 1-year limitation period applied both to GDPR-related complaints and complaints which were exclusively based on national law. Therefore, the protection offered by the Austrian legislator respected the principle of equivalence. Moreover, the introduction of such a deadline was considered necessary by the legislator, as the assessment of excessively old data protection violations would be in practice very difficult, if not impossible. In light of the above, the court rejected the