Court case W137 2278780-1 – Court Ruling (Austria, 2024)

Court Ruling
Datenschutzbehörde8 July 2024Austria
final
Court Ruling

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

The data subject was a department head at the Department of Education (the controller). On 20 January 2022, the data subject sent an access request under Article 15 GDPR to the controller regarding his stored personal data. On 25 May 2022, the data subject sent another request. At the same time, two proceedings were pending before the Labour and Social Court (“Arbeits- und Sozialgericht”) between the data subject and the controller. On 30 June 2022 and 17 August 2023, the controller responded to the request and provided the data subject with information. This included a total of 187 documents relating to the data subject and his personal file. However, the controller refused to provide information to certain emails and statements, claiming it relied on overriding confidentiality interests, which would outweigh the data subject’s interest in receiving this information. As there were labour and social court proceedings pending, these emails and statements were part of these proceedings. Providing this information would therefore mean a deterioration of the controller’s litigation position. On 27 September 2022, the data subject lodged a complaint at the Austrian DPA (“Datenschutzbehörde - DSB”) against the controller for violating their right of access under Article 15 GDPR. According to the data subject, the controller provided the data subject with incomplete information. The data subject argued that he was still missing the following documents: the extensive volume of written complaints against the data subject at the controller’s personnel department, the written requests for dismissal from the data subject’s function as appointed department head, statements on the data subject to the controller and other relevant files. The DPA rejected the complaint, because there were no indications that the information provided by the controller was incomplete. The DPA also held that the controller was cooperative throughout the proceedings and had been able to demonstrate in

GDPR Articles Cited

Art. 15 GDPR

National Law Articles

§ 4 Z 6 DSG 2000
Decision AuthorityBVwG
Reviewed AuthorityDSB (Austria)
Full Legal Summary

The data subject was a department head at the Department of Education (the controller). On 20 January 2022, the data subject sent an access request under Article 15 GDPR to the controller regarding his stored personal data. On 25 May 2022, the data subject sent another request. At the same time, two proceedings were pending before the Labour and Social Court (“Arbeits- und Sozialgericht”) between the data subject and the controller. On 30 June 2022 and 17 August 2023, the controller responded to the request and provided the data subject with information. This included a total of 187 documents relating to the data subject and his personal file. However, the controller refused to provide information to certain emails and statements, claiming it relied on overriding confidentiality interests, which would outweigh the data subject’s interest in receiving this information. As there were labour and social court proceedings pending, these emails and statements were part of these proceedings. Providing this information would therefore mean a deterioration of the controller’s litigation position. On 27 September 2022, the data subject lodged a complaint at the Austrian DPA (“Datenschutzbehörde - DSB”) against the controller for violating their right of access under Article 15 GDPR. According to the data subject, the controller provided the data subject with incomplete information. The data subject argued that he was still missing the following documents: the extensive volume of written complaints against the data subject at the controller’s personnel department, the written requests for dismissal from the data subject’s function as appointed department head, statements on the data subject to the controller and other relevant files. The DPA rejected the complaint, because there were no indications that the information provided by the controller was incomplete. The DPA also held that the controller was cooperative throughout the proceedings and had been able to demonstrate in

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Related Cases (0)

No other cases found for Court case W137 2278780-1 in AT

This is the only recorded case for this entity in this jurisdiction.

Details

Ruling Date

8 July 2024

Authority

Datenschutzbehörde

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified

Cite as: Cookie Fines. Court case W137 2278780-1 - Austria (2024). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: