GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
The controller is Stichting Bureau Krediet Registratie (BKR), which manages the credit information register (CKI). This register provides an overview of the creditworthiness of people since credit providers (banks etc.) can register (severe) debts of individuals. There were three registrations related to the data subject in the CKI, with special codes that indicated that there had been several payment arrears. In 2021, the data subject requested the BKR to have these registrations and/or these special codes erased, but the controller refused. The data subject then brought the issue before Court, which granted his claim and ordered BKR to erase the codes. The controller then appealed this decision. After some initial hesitations, the controller removed the codes from the registrations, but added a new code “9 Dispute”. The data subject then requested the controller to remove this new code because he claimed that it also negatively affected his creditworthiness (even more than with the previous codes), but the controller refused and explained that this code had been added to explain that the removal of the special codes is still disputed in court (namely: the appeal). After the data subject was refused credit from a credit provider because of this new special code, he brought the issue before court to have this code “9 Dispute” erased pursuant to Article 17(1)(d) GDPR, and to keep having this code erased. The Court decided that the registration was unlawful and ordered the controller to remove the special code “9 Dispute” from the registration pursuant to Article 17(1)(d) GDPR. First, it considered that the data subject did not explain what the legal basis was to have the actual registrations removed (rather than only the special codes that are linked to the registrations), or why this should follow from the circumstances of the case. Hence, it rejected the claim to have the actual registrations removed. Second, it considered that the claim to have the special co
In February 2019, an insolvency procedure was opened in relation to the data subject and published in the national insolvency registry (Insolvenzdatei). After the data subject had learned, that a credit reference agency (controller) had collected that data on him and was storing it in its creditworthiness database, he sent an erasure request under Article 17 GDPR to the controller, which refused to erase the data, arguing that it was allowed to process the data under Article 6(1)(f) GDPR. Consequently, the data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB) against the controller. The DSB dismissed the complaint, holding that the controller has a legitimate interest under Article 6(1)(f) GDPR to collect and process data on insolvency procedures in order to assess the data subject's creditworthiness. The data subject filed an appeal against that decision with the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG dismissed the appeal and upheld the DSB's decision. It held that data on insolvency procedures are apt information to assess an individual's creditworthiness. The BVwG then referred to established BVwG case-law (see e.g. BVwG - W211 2225136-1, BVwG - W274 2232028-1/3E or BVwG - W214 2228164-1) according to which the rules of the Capital Requirements Regulation ([https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02013R0575-20210930 Regulation 575/2013]) should be taken into account when assessing the legitimate storage duration for data on payment defaults or insolvencies. As a result, the BVwG held that the controller is allowed to store data obtained from the Insolvenzdatei for a five-year period after the clearance of the underlying debts.
In November 2019, the church tax office (controller) sent the data subjects questionnaires to provide information on the religious affiliation of their two minor children. In December 2019, the data subjects requested the controller to refrain from such requests. Nevertheless, the controller requested the data subjects to complete the forms again in January 2020. Consequently, in August 2020, the data subjects filed a complaint with the Berlin DPA (Berliner Beauftragte für Datenschutz und Informationssicherheit). They claimed that the questionnaire was unlawful under data protection law. The DPA dismissed the complaint, arguing mainly that it was not competent to decide on the matter because of the church's special competence. Furthermore it did not find a breach of data protection law. Before the court, the data subjects pursued their claim. The Administrative Court of Berlin dismissed the data subjects' claim. The court agreed with the DPA that it had rightfully declared itself incompetent in the matter. First, it held that church data protection such as in the case is subject to church supervision and not to state supervision. According to Article 91(2) GDPR, churches are entitled to establish their own independent supervisory authorities. While the wording of the provision does not clearly state whether such authority must be of an official nature or independent, the court interpreted the provision based on its systematic nature. As Article 91(2) GDPR explicitly mentions that the specific supervisory authority must fulfill the conditions of Chapter VI of the GDPR, such reference would be redundant if only state authorities were allowed since such authorities have to fulfill these regulations in any case. This position is also supported by Recital 128 GDPR. Therefore, the court found the independent nature of the church supervisory authorities to be GDPR-compliant. Second, it clarified that church data protection law must be understood as a comprehensive data
The case involved data retention and admissibility of evidence, unrelated to cookie or consent issues.
This dispute was between a divorced father (the data subject) and the chief of police of Rotterdam (the controller). In 2020, the data subject found out that Veilig Thuis (an advice and reporting centre for domestic violence and child abuse) had registered two reports on him in their database. The first registration stated that he had committed domestic violence and that subsequently he was temporarily denied entrance to the home he had previously shared with his ex-wife. According to the data subject, these allegations were unfounded. According to the data subject, the second registration was also inaccurate since the report did not adequately state that his ex-wife had moved to a new place with their son, without informing him of the new location. He requested to have the first report deleted, and the other rectified, but Veilig Thuis refused. The data subject then brought the issue before Court, which decided that Veilig Thuis did not have a substantial interest in retaining the personal data, and that it had to delete the first report and amend the second one. Because Veilig Thuis had received the information from the Rotterdam police, the data subject subsequently requested the police to delete the inaccurate personal data and rectify the reports. The police, however, claimed that the information was accurate, and refused to rectify their files on the data subject. The data subject then brought the issue before the District Court of First Instance of Rotterdam (hereinafter the Court), basing his claim on Article 12 GDPR on transparent information, communication and modalities for the exercise of the rights of the data subject, and his right to obtain from the controller the rectification of inaccurate personal data pursuant to Article 16 GDPR. The Court upheld the claim. Regarding the first registration (on alleged domestic violence), the Court considered that, in 2019, the police had decided not to further investigate the allegations of domestic violence bro
The controller is a railway company. It has video cameras installed in some of its trains which are active during the operation of the trains. The recordings are automatically deleted after 48 hours. The data subject boarded one of these trains on the 27th of April 2021. By email of the same day the data subject requested the controller to hand over the video footage and, to this end, not delete it. The controller, however, deleted the data within the deletion period of 48 hours and, therefore, refused to provide the requested information to the data subject. As a consequence, the data subject filed a lawsuit with the District Court of Pankow (Amtsgericht Pankow - AG Pankow) requesting damages in the amount of €350 according to Article 82 GDPR. The District Court rejected the claim of the data subject. It held that the controller did not violate Article 15(1) GDPR. It found that the controller's refusal to answer the request of access was legitimate according to [https://www.gesetze-im-internet.de/bgb/__275.html § 275(2) BGB] (German Civil Code) under which a debtor can refuse performance insofar as this requires an effort which, taking into account the legal relationship of the parties and the requirements of good faith, is grossly disproportionate to the creditor's interest in performance. The court concluded that, since the data subject was already aware of the processing, its circumstances and its content, the purpose of Article 15 GDPR was already largely fulfilled. Furthermore the court reasoned that, because of the short retention period of 48 hours, a loss of control of the data subject over his personal data was not apparent. The data subject had also requested the restriction of the processing under Article 18(1)(c) GDPR in order to prevent the controller from deleting the footage while the access request was handled. On this point, the court found that preventing the automatic deletion and filtering out the recording of the data subject would have tak
In March 2019, the data subject requested rectification of his registered address from the controller, a municipality. According to him, he had lived at different addresses in the 1980s which did not show up in the record. The controller refused, arguing that it had no further data about the data subject and that the file had been archived already, meaning that it could not be edited anymore. In April 2019, the data subject brought an action against the controller in court. He argued that the controller had no good reason or legal basis to refuse the rectification. The controller claimed that the data subject had not proven that the data were inaccurate. Since the dates concerned were over 30 years in the past, it had no obligation to keep further documents or records since the retention periods had expired in the meantime. Furthermore, the data subject had violated his obligation to register every relocation which would have allowed a correct and seamless documentation of this information. The Administrative Court of Cologne (Verwaltungsgericht Köln - VG Köln) dismissed the data subject's claim. Initially, the court discussed whether the claim was inadmissible because it doubted that the data subject had a legitimate interest for legal relief in the first place. Such interest does not exist when the lawsuit can obviously not bring a plaintiff any legal or factual advantages. It criticised that the data subject had not substantiated why he had an interest in the rectification of data older than 30 years. It further agreed with the controller that it was partly the the data subject's own fault that the register was not up to date because he himself failed to comply with his obligations to re-register after each relocation. However, the court did not finally decide on the admissibility because it found the claim to be unsubstantiated anyhow. First, the court established that the only basis for the data subject's claim was Article 16 GDPR, as [https://www.gesetze
In October 2018, the data subject, who was being represented by their attorney, were together approached by a journalist inside the courtroom. The journalist had certain documents from the case file which showed the data subject’s name, address and national identification number. Upon being asked by the data subject for the source of the documents, the journalist replied that they “were made available to him under the right of access to the case file” which the Administrative Jurisdiction Division of Council of State grants to journalists. Subsequently, the President of the Administrative Jurisdiction Division of Council of State confirmed to the data subject that certain documents were being given to journalists “to enable them to follow hearings, namely a copy of the notice of appeal, a copy of the response and, where appropriate, a copy of the contested judicial decision” and “those documents being destroyed at the end of the day.” The data subject and their attorney then approached the Dutch Data Protection Authority (DPA) and claimed that “allowing journalists to have access to personal data concerning them” amounted to a violation of GDPR. However, the DPA said that it was not competent to decide on the same due to Article 55(3) GDPR, which bars supervising authorities from supervising “processing operations of courts acting in their judicial capacity.” Thereafter, the DPA forwarded the request to the President of the Administrative Jurisdiction Division of Council of State. The President of the Administrative Jurisdiction Division of Council of State took note of the complaint and in consultation with the Data Protection Commission for Administrative Law Tribunals, Netherlands “formulated a new policy on access to documents from court files”. However, the DPA’s decision to not hear the matter, and to refer it to the President of the Administrative Jurisdiction Division of Council of State, was challenged by the data subject and his attorney before the Distri
The controller is a psychotherapist and the data subject is his patient. About four years after the therapy had been stopped, the data subject requested access to his data. The therapist replied that no personal data was undergoing processing. The data subject was skeptical and filed a complaint with the Austrian DPA (DSB). The DSB considered the complaint excessive because 86 other complaints lodged by the data subject were still pending with it and therefore rejected to handle the complaint under Article 57(4) GDPR. The data subject appealed this decision to the Austrian Federal Court (Bundesverwaltunsgericht – BVwG). During the court proceedings, the DSB provided the court with a list of all pending cases which did not mention the content of the cases. The Austrian Federal Court held that the rejection by the DSB was unlawful because the DSB failed to show that the present complaint and the past complaints were homogeneous. The court clarified that, according to the last sentence of Article 57(4) GDPR, the DPA bears the burden of demonstrating the excessive character of the request. The court then found that the amount of complaints is an important factor in determining whether a complaint is excessive. However, it also reasoned that the complaint must be of repetitive character which only occurs when the present complaint and the previous ones are (nearly) identical. In the present case, the court concluded that DPA did not show that the complaints were (nearly) identical since it only provided a list of the complaints pending without describing their the content and similarities.
The data subject requested that his credit registration be deleted by the Credit Bank. Because the Credit Bank declined, the data subject asked the preliminary relief judge at Rb. Amsterdam for an interim injunction. He did so particularly because this registration formed an obstacle in obtaining a mortgage and his reservation period for the purchase of a house was to expire soon. The data subject and his partner wanted to purchase a house especially in light of the birth of their child. Rb. Amsterdam refused the request for an interim injunction with regard to the removal of the data subject's record in the credit register under Article 34 of the UAVG. The deletion of a credit register is preceded by a weighing of interests in which the individual interest of the applicant in the removal of the credit registration is weighed up against the social interest in maintaining this registration. The outcome of this balancing of interests was that it was still too early to state that the registration was disproportionate just one year after the debt had been repaid. The preliminary relief judge also took other circumstances of the case into account, such as the data subject's fault in incurring his debts and the fact that he had only recently become financially stable. The court also noted that the measure requested by the data subject is not really an interim injunction. The consequences would be irreversible because he would secure a mortgage as a result. However, despite the refusal to issue an interim injunction at this moment, the court pointed out that it does not necessarily mean that the data subject's record should stay in place for another four years.
The controller is a company providing workplace health promotion services by consulting other companies on this topic and developing tailored measures for them. Its main customer base are care facilities. The controller informed its employees that due to an amendment of the German Infection Protection Act, access to care facilities was only permitted to persons that are either vaccinated, recovered or tested negative against Covid-19. The controller asked their employees to prove their vaccination status by either handing over a screenshot of the digital vaccination certificate or by presenting the vaccination card. It also informed them that a copy will be made for documentation purposes. On 03 December 2021, the data subject, who was employed as a counselor, presented her vaccination card to the controller. When asked by the HR officer whether she also has a QR vaccination code, she explained that she only has a digital vaccination certificate stored on her private mobile phone, which she did not have with her at the moment. As it was not possible for the controller to check the validity of the vaccination certificate without the QR code, the controller carried out a batch query, which means that it compared the provided vaccination data with publicly available information on the availability of vaccination batches in order to determine irregularities. It found that the vaccination data provided by the data subject was inconclusive as the first vaccination allegedly took place at a time when only elderly people were vaccinated. During a conversation with the data subject, the suspicion of forgery could not be dispelled, as she then asserted to never have stored the QR code on her phone because of data protection reasons and that she did not know whether she still had the QR code in paper form. As the data subject was unable to provide proof that the vaccination had actually been carried out, the controller terminated the employment relationship. The data subject
Bpost is the main postal service provider in Belgium (the controller), providing services to the general public but also to bulk mailers (end consumers) and mail preparation firms (consolidators). In 2011, Bpost implemented a new tariff system which calculated quantity discounts for consolidators based on the volume of mail items lodged individually by each sender. Previously, this tariff had been calculated based on the total volume of items from all senders. On the 20 July 2011, the Belgian Institute for Postal Services and Telecommunications – IBPT (Institut belge des services postaux et des télécommunications) imposed a €2,300,000 fine on the controller based on a Belgian provision, namely the Law of the 21 March 1991 on the reform of certain public commercial undertakings ([https://www.ejustice.just.fgov.be/cgi_loi/change_lg.pl?language=fr&la=F&table_name=loi&cn=1991032130 Article 144bis et point 5 de l'Article 144ter(1) loi du 21 mars 1991 portant réforme de certaines entreprises publiques économiques]). The IBPT found that the new system unjustly favoured direct clients as opposed to consolidators. On the 10 December 2012, the Belgian Competition Authority (CA) also issued a decision stating that bpost had abused its dominant postion under Article 3 of the Law on the protection of competition ([https://etaamb.openjustice.be/fr/loi-du-10-juin-2006_n2006011269.html Article 3 of the loi du 10 juin 2006 sur la protection de la concurrence économique]) and by [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A12008E102 Article 102 TFEU]. With this decision, the CA also issued a €37,399,786 fine for the abuse. The decision by the IBPT was annulled in 2016 by the Court of Appeal of Brussels (Cour d’appel de Bruxelles) as the court found that the new system was not discriminatory. In 2016 then the Court of Appeal of Brussels annulled the decision of the CA based on the non bis in idem principle (it means that a legal action can’t be constituted twi
The data subject is a freelance artist. She is in a dispute with Google Ireland Limited about her entry in Google Local Listing, a service displaying local business listings on a map on Googles first page results. On her website she disclosed information about her private life, including personal data such as phone number and address. Google Local Listing processed the information from that website and disclosed them on Google Maps or in a sidebar in Google Search. The data subject used a web form provided by Google LCC and requested the deletion of the entry. The deletion request was ignored at first by the defendant. Subsequently, the data subject's attorney submitted a written warning and an injunctive relief. The data subject also demanded the compensation of her attorneys fees. Google subsequently deleted the entry without signing the injunctive relief and without compensation. The data subject argued that the disclosure of her personal data occurred without her cooperation and that data protection law entitled her to receive an injunctive relief from the defendant. The lower regional court in Munich (Landgericht München I) took the view that, although the data subjects demand of deletion was justified, Article 17(1) GDPR supported no indemnification claim – the court rejected her demand of compensation. The court decided further that Article 17(1) GDPR is not only an entitlement of removal, but also an entitlement of injunctive relief, because an injunctive relief could counter a potential risk of recurrence. Therefore, the data subject is entitled to demand an injunctive relief. The lower court convicted the defendant to refrain from any future disclose the personal data of the data subject in the Local Listing service. The defendant appealed the decision of the lower court. The Higher Regional Court Munich (Oberlandesgericht München) overturned the decision of the lower court and dismissed the data subjects claim for an injunctive relief. The Higher Regi
The controller (the defendant) was an electricity company. The data subject (the plaintiff) was a customer. On 6 February 2019, due to an error, an employee of the defendant emailed to one of the company’s clients a file containing the personal data of other clients (data subjects), including the the plaintiff's. The information included: first name, surname, ID number, address, customer number, and numbers of invoices. After learning about the security breach, the defendant notified the Polish DPA of the incident. The defendant also sent a notification to the affected data subjects and asked the recipients of the unintentional disclosure the delete the file. After receiving a notice of the security breach, the plaintiff filed a complaint with the Polish DPA. Moreover, she requested the defendant to terminate her contract by mutual agreement due to the loss of confidence. The defendant stated that a one time breach of the plaintiff’s personal data did not constitute a gross breach of contract and therefore did not provide grounds for termination of the contract. Hence, the plaintiff decided to terminate the contract herself despite a financial penalty. Moreover, due to the security breach and fear that her personal data could be used by third parties, she set up a subscription account with the Credit Information Bureau to receive information on credit obligations attributed to her. On top of that, she suffered non-pecuniary harm from the stress and psychological discomfort related to the fear that her personal data could be used by third parties. Apart from the proceedings at the DPA, the plaintiff brought an action to court seeking damages for the non-material harm caused by the incident on the basis of Article 82 GDPR in the amount of PLN 20,000 (€4,247). First, the District Court of Warsaw-Praga (the Court) confirmed that the incident constituted a 'personal data breach' within the meaning of Article 4(12) GDPR. It also recalled that any person who suffered
In April 2019, the data subject received an advertising email to his professional email address in which a training course organised by the controller was advertised. The data subject had neither ordered this advertisement nor otherwise consented to its receipt. He objected to such mailings by email and set the controller a deadline of 30 May 2019. In June 2019, the controller sent the data subject another advertising email for this event. The data subject started a legal action claiming that the controller had unlawfully obtained his email address, as it was neither generally accessible nor communicated by him. In January 2021, the District Court of Heidelberg (AG Heidelberg) partially granted the action. It ordered the controller to cease and desist further advertising emails and to provide the information requested by the data subject on his personal data and otherwise dismissed the action with regard to the requested damages for pain and suffering. It held that a claim for damages for pain and suffering pursuant to Article 82(1) GDPR did not exist, as the data subject had not suffered any noticeable disadvantage and no objectively comprehensible impairment of personal interests of a certain weight as a result of receiving the two advertising emails. The Regional Court of Heidelberg awarded the data subject damages under Article 82 GDPR in the amount of €25. The court held that the data subject suffered damages because he had to deal with the unsolicited advertising emails of the controller, determine their origin, seek information from the controller by means of a letter and delete the unsolicited emails. An external effect of the infringement affecting the data subject in the sense of a risk of damage to his reputation or profession or a discriminatory effect towards third parties was not apparent. In order to compensate for the impairments suffered, the court considered the payment of €25, similar to the usual lump sum for expenses in traffic accidents fo
The controller is a private health insurance company. The data subject is a customer of the controller. The parties are in dispute about the validity of several increases to the insurance premiums. The data subject filed a lawsuit with the Regional Court of Leipzig (Landgericht Leipzig - LG Leipzig) requesting the refund of overpaid premiums as well as information on all adjustments to the premiums in the form of notification letters sent to the data subject and supplements to the insurance policy. The controller rejected both claims. The Regional Court of Leipzig dismissed the data subject's claim almost entirely. As a consequence, the data subject appealed this decision to the Higher Regional Court of Dresden (Oberlandesgericht Dresden - OLG Dresden). The Higher Regional Court of Dresden dismissed the plaintiffs appeal. The court found that the right to access cannot be used to obtain information about premium increases. For its reasoning the court exclusively quoted a decision of the Higher Regional Court of Hamm (Oberlandesgericht Hamm - OLG Hamm) from the 15th November 2021 (case nr. 20 U 269/21). In the quoted decision, the OLG Hamm held that a controller is allowed to reject a request to access under Article 12(5)(b) GDPR as "excessive" if the request's sole purpose is to verify the validity of premium increases instead of verifying the lawfulness of the processing of personal data. In its reasoning the OLG Hamm found that the term "in particular" in Article 12(5)(b) GDPR shows that there can also be other circumstances than the repetitiveness of a request which can render a request "excessive". The court further referred to Recital 63 and established that the purpose of the right to access is to be aware of, and verify, the lawfulness of the processing of personal data. Therefore, the Court considered a request whose sole purpose is to verify the validity of premium increases instead of verifying the lawfulness of the processing of personal data excessive
The controller is a private health insurance company. The data subject is insured with the controller. The parties are in dispute about the invalidity of several premium increases as well as about the resulting claims for refunds. The data subject filed a lawsuit with the Regional Court of Ansbach (Landgericht Ansbach - LG Ansbach) requesting the refund of overpaid premiums as well as information from the controller on all adjustments to premiums in the form of insurance policies, supplements to these policies and all notification letters sent to the data subject during the contractual relationship. The Higher Regional Court Nuremberg (Oberlandesgericht Nürnberg - OLG Nürnberg) held that the data subject had no right to access under Article 15 GDPR because the controller was entitled to reject the request pursuant to Article 12(5)(b) GDPR. The court reasoned that this provision merely lists "repetitive character" as an example of an excessive request. However, the use of the word "in particular" makes it clear that the provision also intends to cover other forms of abusive requests. To assess what constitutes an abuse of the right to access, the court referred to the purpose Article 15 GDPR which according to Recital 63 is to enable the data subject to be aware of, and verify, the lawfulness of the processing. The court ruled that the data subject was obviously not interested in verifying the lawfulness of the processing but rather to check whether the adjustments made to the premiums were formally compliant with German insurance law. As a consequence, the court concluded that the request was abusive.
A data subject made an appeal to the Federal Administrative Court concerning a decision of the Austria Data Protection authority. The authority had dismissed the data subject`s complaint about a violation of the right to rectification as unfounded. The data subject had applied for the correction of data in a legal notice (Bescheid), which was in connection with investigative actions relating to the data subject's claims for compensation under the Police Powers Compensation Act (PolBEG). Referencing a decision of the Court of Justice of the European Union (ECJ) (ECLI:EU:C:2014:2081), the Austrian Federal Administrative Court stated that personal data legally assessed by the competent state agency in an administrative matter is not considered as information about the data subject. Consequently, the court held that a correction of personal data in a legal notice cannot be based on Article 16 GDPR.
The controller is a municipal water provider. Its data subjects are private persons living on a property that has two residential units. This includes a water meter that records the consumption of both residential units. A letter from the controller of February 2021 contained the note that with the next change of the electronic water meter it was planned to install a water meter that is remotely readable and runs with a wireless function. The controller set the data subjects a deadline of two weeks to make an objection if they did not want the water meter to be remotely readable. The controller made clear that in that case, the supply of several residential units by the water meter would not be given. The data subjects made an objection and did not allow the employee of the controller access the water meter. On 20 April 2021, the data subjects also objected according to Art. 21(1) GDPR. On 12 May 2021, the controller obliged the data subjects by a notice, among other things, to let the employees of the controller access the water meter. On 9 June 2021, the data subjects again did not grant access to the employee of the controller. On 11 June 2021, they filed an appeal against the notice from 12 May 2021 with the Administrative Court Bayreuth VG Bayreuth. The data subjects also requested the VG Bayreuth to grant a preliminary injunction. According to the data subjects, the collection of the data would not be necessary for running the water supply. They argued that the data processed was personal data as it was possible to know who for example is not at home with additional knowledge and other data. The controller on the other hand argued that there was no possibility to assign the consumption of water to individual persons. Therefore, the controller was of the opinion that it was not a matter of personal data. Hence, there was also no possibility to make an objection regarding the installation of a water meter that is remotely readable. On 15 July 2021, the contro
The data subject was a patient in a hospital department. The controller was the head of such department. The data subject was of the opinion that there had been medical negligence during the treatment. Consequently, the data subject sent the following access request to the controller. It was titled "Application for data information in accordance with DSG, GDPR and any other conceivable legal basis", and read: "I hereby submit the request for information in accordance with § 44 DSG and thus make use of my right to receive confirmation as to whether you process personal data concerning me and if this is the case, I make use of my right, To obtain information about the personal data concerned in accordance with § 44 DSG." Although § 44 DSG does grant data subjects a right to access, according to its chapter in the DSG, it only applies to the "Processing of personal data for the purposes of the security police, including the protection of the constitution, military self-defence, the investigation and prosecution of criminal offenses, the execution of sentences and the enforcement of measures". The controller objected to the request, arguing that they were not a controller pursuant to § 44 DSG. Subsequently, the data subject complaint to the Austrian DPA. In its assessment, the DPA stated that Article 15 GDPR, the appropriate right to access in the present case, does not require any specific formulation. The only requirement for the applicability of a right, according to the GDPR, is that the addressed controller can recognize which right the data subject wished to apply. If this was the case, a controller would be obliged to respond to an access request within the time limits set by Article 12(3) GDPR. This was objectively possible in the case at hand. It was clear from the request that the data subject wanted to rely on its right to access. Therefore, the controller should not have denied the data subject its right simply because the data subject mistakenly