Court case W137 2308681-1 – Court Ruling (Austria, 2025)

The data subject filed a complaint on 07.05.2024 with the Austrian Data Protection Authority (DSB), alleging that an Estonian company located in Tallinn, Estonia, had failed to fully respond to a request for access under Article 15 GDPR. By 12.02.2025, more than six months later, the DSB had not issued a decision. As a result, the data subject filed an inactivity complaint with the DSB, arguing that it had failed to act within the legally required time. By letter dated 17.02.2025, the DSB informed the data subject that the complaint had been forwarded to the Estonian supervisory authority, which would assume responsibility as the lead supervisory authority. By letter from the DSB dated 20.02.2025, the inactivity complaint was transmitted to the Federal Administrative Court. It stated in particular that, due to cross-border processing, the Estonian supervisory authority is allegedly the responsible authority under the procedure referred to in Article 60 GDPR, and that the decision-making period is suspended for the duration of this procedure, in accordance with national procedural law. The Court dismissed the inactivity complaint as unfounded. Under Austrian procedural law, specifically [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20008255&FassungVom=2025-02-02&Artikel=&Paragraf=8&Anlage=&Uebergangsrecht= § 8(1) VwGVG] and [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A2P24/NOR40262693?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=dsg&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=24&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=12.09.2024&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=f3119544-88f3-40ff-a7b3-a77e97056d8d § 24 DSG,] an inactivity complaint may not be filed until the authority has failed to issue a decision on the matter within six months. However, when calculating this six-month period, any time during which cooperation procedures are carried out under Articles 56, 60, and 63 of the GDPR is excluded. According to Article 56(1) GDPR, when a complaint concerns cross-border processing of personal data, there is a division of responsibilities between a lead supervisory authority, usually the authority of the main or sole establishment of the controller under Article 60 GDPR, and the other supervisory authorities concerned. These authorities are required to cooperate according to the process set out in Article 60 GDPR. In this case, the DSB correctly recognized that the complaint involved cross-border processing, as defined under Article 4(23) GDPR. Therefore, the Austrian DPA qualifies as a concerned supervisory authority under Article 4(22)(c) GDPR. The responsibility for leading the case lies with the Estonian DPA, as the lead supervisory authority. As set out in Article 60(7) GDPR, decisions in such cases are adopted by the lead supervisory authority, even though they are based on cooperation and input from the other authorities involved. If a complaint is rejected, the formal rejection is issued by the supervisory authority where the complaint was originally lodged, in this case, the DSB. As confirmed by [https://gesetzefinden.at/judikatur/bvwg/bvwgt_20240911_w256_2290824_1_00 national case law,] the initiation of the cooperation procedure under Articles 56 and 60 GDPR is not at the discretion of the supervisory authority. It occurs automatically once a complaint involving cross-border processing is submitted. The national procedural deadline for the authority to make a decision was interrupted automatically at the moment the complaint was submitted. Therefore, the DSB is not inactive in the sense of national procedural law, as the conditions for asserting a failure to act have not been met.