Court case W137 2278780-1 – Court Ruling (Austria, 2024)

The data subject was a department head at the Department of Education (the controller). On 20 January 2022, the data subject sent an access request under Article 15 GDPR to the controller regarding his stored personal data. On 25 May 2022, the data subject sent another request. At the same time, two proceedings were pending before the Labour and Social Court (“Arbeits- und Sozialgericht”) between the data subject and the controller. On 30 June 2022 and 17 August 2023, the controller responded to the request and provided the data subject with information. This included a total of 187 documents relating to the data subject and his personal file. However, the controller refused to provide information to certain emails and statements, claiming it relied on overriding confidentiality interests, which would outweigh the data subject’s interest in receiving this information. As there were labour and social court proceedings pending, these emails and statements were part of these proceedings. Providing this information would therefore mean a deterioration of the controller’s litigation position. On 27 September 2022, the data subject lodged a complaint at the Austrian DPA (“Datenschutzbehörde - DSB”) against the controller for violating their right of access under Article 15 GDPR. According to the data subject, the controller provided the data subject with incomplete information. The data subject argued that he was still missing the following documents: the extensive volume of written complaints against the data subject at the controller’s personnel department, the written requests for dismissal from the data subject’s function as appointed department head, statements on the data subject to the controller and other relevant files. The DPA rejected the complaint, because there were no indications that the information provided by the controller was incomplete. The DPA also held that the controller was cooperative throughout the proceedings and had been able to demonstrate in a comprehensible manner that no data existed regarding the other information the data subject requested. Apart from the data subject's mere speculation, they had not provided any substantiated evidence of incomplete information. The data subject appealed this decision at the Federal Administrative Court (“Bundesverwaltungsgericht – BVwG”), arguing that the controller had not yet provided the data subject with complete information regarding his processed data. The claim that the requested data no longer existed was incorrect, because it was suddenly introduced as evidence in the labour court proceedings by the controller in 2022 and 2023. According to various statements in these proceedings, there were also other files that still needed to be given to the data subject. The data subject also rejected the claim that certain information could not be shared due to the ongoing labour court proceedings, as this legal view of the controller overlooks the principle of immediacy in personnel matters under labour law. The court agreed with the controller that it had a confidentiality interest. As the data subject was provided with extensive information and that the controller’s refusal to provide information was only limited to the emails and statements, the court held that requesting access to strengthen the data subject's case goes beyond the protective purpose of this right. Thus, the controller’s legitimate interest in confidentiality outweighed the interests of the data subject. The court further held that the physical folders requested by the data subject are exclusively physical files located in the controller’s office. The court thus agreed with the DPA’s reasoning that these physical files did not qualify as a filing system. With regard to the other information that the data subject claimed the controller had about them, the court found that these documents or files do not exist at all. By providing a negative answer to the data subject, the controller also complied in this regard with the access request. The court therefore held that the controller was justified to withhold certain information and thus the controller did comply with the the data subject's access request. The data subject’s right of access was thus not violated.