- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Court case W211 2261980-1 – Court Ruling (Austria, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that a user could not request the transfer of her training data from a discontinued app. The court found that the data was no longer processed by the app operator, as it was only stored on the user's device. This case illustrates the challenges users face in accessing their data from outdated services.
What happened
The court ruled that the app operator did not have to transfer training data because it was no longer processed on their servers.
Who was affected
A user who requested the transfer of her training data from a discontinued health and fitness app.
What the authority found
The Austrian court held that the app operator was not obligated to fulfill the user's data transfer request since the data was not being processed by them.
Why this matters
This case shows the complexities of data access rights when services are discontinued. Users and businesses should be aware of how data is stored and processed to understand their rights.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject concluded a contract with an app operator (the controller) in 2017 for the use of a health and fitness app, which she used until 2021. The data subject submitted a request for a transfer of her training data from 2020 in a structured, commonly used and machine-readable format by virtue of Article 20 GDPR. The controller refused to do so because her request referred to an outdated version of the app which had been discontinued in the meantime, that is, the data were no longer synchronised to the servers of the controller and were only locally saved and processed on the data subject's device. Yet, the old app could still be used locally, hence, data processing only took place on the users' devices but the controller did not have access to the data and could thus not process them. Furthermore, users could access and download all of their training and health data from the website of the controlller, which the data subject did. The users were notified of this change in a sufficient way. However, the data subject argued that she had not been properly informed of the changes regarding the processing and, as a layperson, she could not have known the difference. Furthermore, she pointed out that the "raw data" provided was not useable for the average user and that the controller kept processing her personal data because her contract with the controller had never been amended nor terminated. The Austrian DPA (DSB) dismissed the complaint based on the fact that essentially no data was processed by the controller between 2020 and 2021 and thus Article 20 GDPR could not apply. Dissatisfied with the DSB's decision, the data subject filed an appeal with the BVwG, restating the arguments she had broguht before the DSB. The BVwG held that after the date of the discontinuation, the data subject's training data was no longer saved and processed on the servers of the controller and data processing only continued on the device of the data subject through her own acti
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W211 2261980-1 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
7 September 2023
Authority
DPA BVwG
About this data
Cite as: Cookie Fines. Court case W211 2261980-1 - Austria (2023). Retrieved from cookiefines.eu
Last updated: