Court case W298 2263736-1/9E – Court Ruling (Austria, 2025)

On the 14 October 2022, the data subject alleged a violation of his right to access under Article 15 GDPR by the controller. The Austrian DPA (Datenschutzbehörde – DSB) however rejected the complaint on the 18 October 2022. The DSB detailed that the data subject had lodged his first complaint on the 3 September 2018 and since then he had followed it with 73 other complaints. The DSB held that although Article 57(4) GDPR does not specify the meaning of “excessive”, it certainly indicates that a high number of complaints can be considered excessive. The DSB went on to say that the initiated proceedings were legally complex and the statements made by the data subject were very detailed which meant that a lot of resources would be necessary for the assessment of the case. As Article 57(4) GDPR enables the supervisory authority to choose between implementing a fee or refusing to process the complaint, the DSB found itself validated in its decision to reject the complaint. The data subject appealed the decision of the DSB to the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The data subject posed that the DSB had given no legal justification for the rejection of the complaint proceedings. The BVwG paused its assessment of the matter until the conclusion of the CJEU case C-416/23 which had been referred to the CJEU by the Supreme Administrative Court of Austria (Verwaltungsgerichtshof – VwGH). The CJEU in C-416/23 held that placing a numerical threshold on complaints would undermine the data subject's rights. The BVwG held that the DSB had failed to carry out an investigation into whether the data subject had abusive intensions. The BVwG found that there were no indications on an abusive intension of the data subject. Therefore, the BVwG concluded that the rejection of the complaint had been unlawful. The BVwG reverted the case back to the DSB for an adequate assessment of the claims.