[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwMbxgizoU-K7fCOMTXv0VOJQcGLo8Mg7hIrcdLMPnBA":3},{"article":4,"iocs":43},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":26},"d5b009fc-e08b-4e1f-adda-6eea818fca9b","BVwG - W292 2342582-1\u002F13E","bvwg-w292-2342582-1-13e-130b59","← Older revision Revision as of 09:21, 17 September 2026 (One intermediate revision by the same user not shown) Line 16: Line 16: |Original_Source_Link_1=https:\u002F\u002Fris.bka.gv.at\u002FDokument.wxe?ResultFunctionToken=207ab2fc-f1ba-4f4e-859b-e3c5b9e1dd9e&Position=1&SkipToDocumentPage=True&Abfrage=Bvwg&Entscheidungsart=Undefined&SucheNachRechtssatz=True&SucheNachText=True&GZ=&VonDatum=01.01.2014&BisDatum=28.08.2026&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=dsgvo&Dokumentnummer=BVWGT_20260701_W292_2342582_1_00 |Original_Source_Link_1=https:\u002F\u002Fris.bka.gv.at\u002FDokument.wxe?ResultFunctionToken=207ab2fc-f1ba-4f4e-859b-e3c5b9e1dd9e&Position=1&SkipToDocumentPage=True&Abfrage=Bvwg&Entscheidungsart=Undefined&SucheNachRechtssatz=True&SucheNachText=True&GZ=&VonDatum=01.01.2014&BisDatum=28.08.2026&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=dsgvo&Dokumentnummer=BVWGT_20260701_W292_2342582_1_00 |Original_Source_Language_1= |Original_Source_Language_1= |Original_Source_Language__Code_1= |Original_Source_Name_2= |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Date_Started= |Date_Started= |Date_Decided=07.01.2026 |Date_Decided=07.01.2026","The Austrian Supreme Administrative Court (VwGH) ruled that a Data Protection Authority (DPA) can refuse to act on a complaint filed by an association on behalf of a data subject. This is permissible when the association's business model involves financially profiting from favorable court decisions related to data protection violations, and the data subject shows no genuine interest in the request for data protection reasons.","Austrian court rules DPA can refuse complaints from associations profiting from data subject requests.","Help BVwG - W292 2342582-1\u002F13E: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 13:41, 1 September 2026 view sourceMba (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators979 editsm Tag: Visual edit← Older edit Latest revision as of 09:21, 17 September 2026 view source Lh (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators59 editsTag: Visual edit (One intermediate revision by the same user not shown)Line 16: Line 16: |Original_Source_Link_1=https:\u002F\u002Fris.bka.gv.at\u002FDokument.wxe?ResultFunctionToken=207ab2fc-f1ba-4f4e-859b-e3c5b9e1dd9e&Position=1&SkipToDocumentPage=True&Abfrage=Bvwg&Entscheidungsart=Undefined&SucheNachRechtssatz=True&SucheNachText=True&GZ=&VonDatum=01.01.2014&BisDatum=28.08.2026&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=dsgvo&Dokumentnummer=BVWGT_20260701_W292_2342582_1_00|Original_Source_Link_1=https:\u002F\u002Fris.bka.gv.at\u002FDokument.wxe?ResultFunctionToken=207ab2fc-f1ba-4f4e-859b-e3c5b9e1dd9e&Position=1&SkipToDocumentPage=True&Abfrage=Bvwg&Entscheidungsart=Undefined&SucheNachRechtssatz=True&SucheNachText=True&GZ=&VonDatum=01.01.2014&BisDatum=28.08.2026&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=dsgvo&Dokumentnummer=BVWGT_20260701_W292_2342582_1_00 |Original_Source_Language_1=|Original_Source_Language_1= |Original_Source_Language__Code_1= |Original_Source_Name_2=|Original_Source_Name_2= |Original_Source_Link_2=|Original_Source_Link_2= |Original_Source_Language_2=|Original_Source_Language_2= |Original_Source_Language__Code_2= |Date_Started=|Date_Started= |Date_Decided=07.01.2026|Date_Decided=07.01.2026 Latest revision as of 09:21, 17 September 2026 BVwG - W292 2342582-1\u002F13E Court: BVwG (Austria) Jurisdiction: Austria Relevant Law: Article 57(4) GDPR Decided: 07.01.2026 Published: Parties: National Case Number\u002FName: W292 2342582-1\u002F13E European Case Law Identifier: Appeal from: Appeal to: Original Language(s): [[:Category:|]] [[Category:]] Original Source: RIS (in ) Initial Contributor: lh A court held that the DPA can refuse to act on a complaint concerning an access request filed by an association on behalf of a data subject as part of a business model where the association financially profits from favourable court decisions and the data subject did not show any interest in filing the request for data protection reasons. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts A data subject hired an association whose business model is to automatically search for possible data protection violations and filing complaints or lawsuits on behalf of data subjects with the financial aid of litigation funders. The agreement between the data subject and the association foresees that the data subject receives 70% of possible profits coming from a favourable judicial or administrative decision and 30% of the profits go to the litigation funders. In the agreement, the association claims their offer would generate profit without any risk for their customers. The association made an access request and filed a complaint via a lawyer on behalf of the data subject. The telecommunication provider charged the data subject with a service fee the parties have not agreed upon. The access request concerned invoices of a telecommunication provider that the data subject was in a contractual relationship with and the service fee was indicated on the invoices. On the initiative of the association, not the data subject, the association made an access request, claiming the service fee let the data subject to believe that the telecommunication provider might possess documents concerning the data subject without their knowledge and might process their personal data unlawfully. The data subject already had access to the invoices through the telecommunication provider’s online portal for customers. The data subject did not, or did not remember, to explicitly mandate the association to lodge the access request. The lawyer hired by the association filed a complaint on behalf of the data subject because of a possible violation of Article 15 GDPR. The grounds of the violation were illustrated only rudimentary in the complaint. The association filed a total of more than 900 complaints with the DPA that follow the same pattern, with 142 of those complaints being filed against the telecommunication provider because of GDPR violations in the context of charging a service fee. The DPA refused to act on the request on the basis of Article 57(4) GDPR because it held that the data subject lodged the complaint not for reasons of the protection of personal data. The data subject appealed the decision. Holding The Federal Administrative Court (Bundesverwaltungsgericht) upheld the decision of the DPA and decided that the data subject lodged the complaint not for reasons of the protection of personal data but for financial reasons. Therefore, Article 57(4) GDPR was applicable. The Court believed that without the financial incentive, the data subject would not have lodged the complaint. According to the Court, the fact that the initiative to exercise the data subject’s right did not come from the data subject themselves but from the association, is another factor that lead the Court to assume an abusive exercise of data subjects’ rights. The data subject did not explicitly mandate the association with the access request, the data was already available to the data subject via the portal but they did not show any interest in it and there was no indication of unlawful processing. All those factors added to the conclusion that the data subject did not have a data protection interest for exercising their rights. The sole motivation for the access request was to enable the business model of the association. These activities of the association that are aimed primarily at re-claiming the service fee through the means of civil law, are already known to the Court. The decision of the DPA to reject the complaint instead of requesting the DPA to issue a fee for their activity pursuant to Article 57(4) GDPR, which would be a less intrusive measure, was adequate. Because of the notorious activity of the association that is systematically disabling the work of the DPA, a fee would not be adequate to stop this activity. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the original. Please refer to the original for more details. Date of Decision July 1, 2026 Legal Provisions B-VG Art. 133(4) DSG § 1 DSG § 18 DSG § 24 GDPR Art. 15 GDPR Art. 51(1) GDPR Art. 57(1)(f) GDPR Art. 57(4) GDPR Art. 77(1) B-VG Art. 133 (current version) B-VG Art. 133 effective from January 1, 2019, through May 24, 2018, last amended by Federal Law Gazette I No. 138\u002F2017 B-VG Art. 133 effective as of January 1, 2019, last amended by BGBl. I No. 22\u002F2018 B-VG Art. 133 effective from May 25,May 2018 through December 31, 2018; last amended by Federal Law Gazette I No. 22\u002F2018; Federal Constitutional Law (B-VG) Art. 133; effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164\u002F2013, B-VG Art. 133, effective from Jan. 1, 2014, through July 31, 2014, last amended by Federal Law Gazette I No. 51\u002F2012 B-VG Art. 133 in effect from Jan. 1, 2004, through Dec. 31, 2013, last amended by BGBl. I No. 100\u002F2003 Federal Constitutional Law (B-VG) Art. 133, effective from January 1, 1975, through December 31, 2003, last amended by Federal Law Gazette No. 444\u002F1974 Federal Constitutional Law (B-VG) Art. 133, effective from December 25, 1946, through December 31, 1974, last amended by Federal Law Gazette No. 211\u002F1974 Federal Constitutional Law (B-VG) Art. 133, effect","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=BVwG_-_W292_2342582-1\u002F13E&diff=53113&oldid=52864","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-09-17T09:21:19+00:00","2026-09-17T10:00:15.479235+00:00",7,[18],{"name":19,"type":20},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":21,"icon":23,"name":24,"slug":25},null,"Policy","policy",[27,31,36,38],{"category":28},{"id":29,"icon":23,"name":19,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":32},{"id":33,"icon":23,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":21,"icon":23,"name":24,"slug":25},{"category":39},{"id":40,"icon":23,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]