Court case W252 2246156-1 – Court Ruling (Austria, 2024)

On 9 April 2020, the data subject sent an access request to the controller, the legal representative of the data subject's former landlord. The controller provided the data subject with information about their personal data that was processed and about a rental agreement and communications between the data subject and their landlord, without providing copies of these to the data subject. On 11 May 2020, the data subject lodged a complaint with the Austrian DPA ("Datenschutzbehörde"), arguing that the controller violated their right of access by providing incomplete information. In particular, documents like their rental agreement and email correspondence were missing. On 22 July 2021, the DPA dismissed the complaint, stating that the right of access does not include providing entire documents. On 30 August 2021, the data subject appealed the DPA's decision at the Federal Administrative Court ("Bundesverwaltungsgericht"), claiming the controller did not provide all information about the origin of the data and did not provide copies of certain documents. Copies of documents like land register and company register extracts, as well as various correspondence between the data subject, the controller and the data subject's former landlord were still missing. On 13 July 2023, the controller provided the additional information on the land register and company register extracts. Regarding the origin of the data The court found that the data subject's argument was vague and that the controller explained the sources of the individual data in a transparent way. There is thus no violation of right of access under Article 15(1)(g) GDPR as the origin of all the relevant data was clear. Regarding the land register extract of property and the commercial register extract The court took into account [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=2&Paragraf=24&Anlage=&Uebergangsrecht= Section 24(6) of the Austrian data prote