[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpR-27szD2o8MT1MejX74saUlsHggU8ZrSRnHchHy650":3},{"article":4,"iocs":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":24,"category":25,"article_tags":29},"cd1bcb29-0d50-4c74-a616-330b0b507667","DSB (Austria) - DSB-D124.0531\u002F24","dsb-austria-dsb-d124-0531-24-5215d9","← Older revision Revision as of 09:49, 9 September 2026 Line 164: Line 164: }} }} The DPA held that the controller had disposed of personal data during the proceedings, constituting a violation of the data subject's right of access under Article 15 in conjunction with [[Article 5 GDPR|Article 5(1)(a) GDPR]]. The DPA held that the deletion of personal data by the controller during the proceedings constituted a violation of the data subject's right of access under Article 15 in conjunction with [[Article 5 GDPR|Article 5(1)(a) GDPR]]. == English Summary == == English Summary == === Facts === === Facts === On 07. August 2023, the data subject made a request to the processor to provide the report and the questionnaire completed by the data subject at an information event. The processor responded to this request on 08. August 2023, stating that they would receive a final report and that all required documents were provided to the controller. It was found later that the questionnaire had already been deleted after the initial interview. On 07. August 2023, the data subject made a request to the processor to provide the report and the questionnaire completed by the data subject at an information event. The processor responded to this request, stating that they would receive a final report and that all required documents were provided to the controller. The data subject sent a request to the controller on 30. September 2023, which remained unreplied. The data subject sent a request to the controller on 30. September 2023, specifically asking for access to personal data, which remained unreplied. The questionnaire had already been deleted at that time. On 13. January 2024, the data subject sent another request to the controller, also asking about the processor's procedure, as their \"Kulturpass\" card had not been picked up. The controller answered on 23. January 2024 and stated that the questionnaire had already been disposed of and therefore could not be provided. On 13. January 2024, the data subject sent another request to the controller, also asking about the processor's procedure. The controller answered on 23. January 2024 and stated that the questionnaire had already been disposed of and therefore could not be provided. On 10. February 2024, the data subject lodged a complaint with the Austrian DPA (DSB) regarding the withholding of information about their processed data and their deletion despite the processor being aware of an information request, submitted by the data subject on 07. August 2023. The data subject lodged a complaint with the Austrian DPA (DSB) regarding the withholding of information about their processed data and their deletion despite the processor being aware of an information request, submitted by the data subject on 07. August 2023. Several statements were made by the data subject, the controller and the processor. In essence, the controller argued that the data subject did not explain or prove the necessity of the requested information. From the data subject's perspective, the controller oversimplified the case. During the proceedings, data relating to a project involving the data subject was deleted. On 30. June 2024, during the proceedings, data relating to a project involving the data subject was deleted. === Holding === === Holding === First, the DPA held that the processor had not violated the right of access under [[Article 15 GDPR]] as there was no evidence of contractual violations between the processor and the contractor under [[Article 28 GDPR|Article 28(10) GDPR]]. First, the DPA held that the processor had not violated the right to access under [[Article 15 GDPR]] as there was no evidence of contractual violations between the processor and the contractor under [[Article 28 GDPR|Article 28(10) GDPR]]. As defined in [[Article 4 GDPR|Article 4(8) GDPR]], the processor processes personal data on behalf of the controller and thereby acts as their \"extended arm\". The processor is in physical possession of the data and is bound by the controller's directives regarding the purposes and means of the processing. Therefore, the controller is responsible for the actions of the processor if the processor were their own, except in cases where the processor exceeds the defined scope and determines the purposes and means of processing under [[Article 28 GDPR|Article 28(10) GDPR]]. This concludes to the controller's responsibility to ensure that the data subjects can exercise their rights, with the processor providing support where possible. As defined in [[Article 4 GDPR|Article 4(8) GDPR]], the processor processes personal data on behalf of the controller and thereby acts as their \"extended arm\". The processor is in physical possession of the data and is bound by the controller's directives regarding the purposes and means of the processing. Therefore, the controller is responsible for the actions of the processor if the processor were their own, except in cases where the processor exceeds the defined scope and determines the purposes and means of processing under [[Article 28 GDPR|Article 28(10) GDPR]]. This concludes to the controller's responsibility to ensure that the data subjects can exercise their rights, with the processor providing support where possible. Second, the DPA held that both the email from 30. September 2023 and the email of 13. January 2024 did constitute information requests under [[Article 15 GDPR]]. The data subject's email on 07. August 2023 to the processor did not constitute a request under [[Article 15 GDPR]], as this was not apparent. The data subject simply requested the transmission of the report and the questionnaire. Second, the DPA held that both the email from 30. September 2023 and the email of 13. January 2024 did constitute information requests under [[Article 15 GDPR]]. The data subject simply requested the transmission of information, namely the report and the questionnaire and did not refer to personal data. Third, the DPA held that the disposal of project data during the proceedings constituted a violation of the data subject's right of access under Article 15 in conjunction with [[Article 5 GDPR|Article 5(1)(a) GDPR]]. This is not permitted during an ongoing information request. However, the disposal of the questionnaire right after the initial interview had happened before the data subject's first email on 08. August 2023. Third, the DPA held that the disposal of project data during the proceedings constituted a violation of the data subject's right of access under Article 15 in conjunction with [[Article 5 GDPR|Article 5(1)(a) GDPR]]. The deletion of personal data that is subject to an access request that has already reached the controller violates Article 15 GDPR. This is because the deletion makes it impossible for the DPA to investigate in a possible breach of the access right. Fourth, the DPA held that it was the controller's responsibility to provide the processed data 'in an intelligible form', 'which allows' the data subject 'to become aware of those data and to check that they are accurate and processed in compliance with' the GDPR (see [https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Faffair?lang=EN&searchTerm=C%25E2%2580%2591141%252F12&publishedId=C-141%2F12 CLEU in joined cases 'YS and Others' (C‑141\u002F12) and 'M and S' (C‑372\u002F12)]). Hence, the controller's view that it was in the data subject's duty to explain why the provision of the processed data had to be in an intelligible way had to be rejected. A right to receive every document containing processed personal data could not be recognised under [[Article 15 GDPR]] in conjunction with [https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2016\u002F679\u002Foj\u002Feng Recital 63 GDPR]. However, the deletion of the questionnaire right after the initial interview had happened before the data subject's first email on 08. August 2023 and was thus lawful. Fourth, the DPA held that a right to receive the documents containing processed personal data could not be recognised under [[Article 15 GDPR]] in conjunction with [https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2016\u002F679\u002Foj\u002Feng Recital 63 GDPR] per se, the provision of a copy is just a modality of the access request. It depends on the individual case whether the controller must provide the documents or just a register of the personal data. == Comment == == Comment == The \"Kulturpass\" card gives people with socially disadvantaged background free access to a variety of cultural institutions. See more information on the initiative's [https:\u002F\u002Fwww.hungeraufkunstundkultur.at\u002Fenglish_basic_informations website]. == Further Resources == == Further Resources == ''Share blogs or news articles here!'' ''Share blogs or news articles here!''","The Austrian Data Protection Authority (DSB) ruled that a controller violated a data subject's right of access under GDPR by deleting project data during an ongoing information request. While the deletion of a questionnaire before the first request was deemed lawful, the subsequent deletion of project data made it impossible for the DSB to investigate the access right violation. The controller was held responsible for the processor's actions, emphasizing the controller's duty to ensure data subjects can exercise their rights.","Austrian DPA fines controller for deleting data during access request.","Help DSB (Austria) - DSB-D124.0531\u002F24: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 15:36, 25 August 2026 view sourceMarcm (talk | contribs)44 editsm Tag: Visual edit← Older edit Latest revision as of 09:49, 9 September 2026 view source Lh (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators38 editsTag: Visual edit Line 164: Line 164: }}}} The DPA held that the controller had disposed of personal data during the proceedings, constituting a violation of the data subject's right of access under Article 15 in conjunction with [[Article 5 GDPR|Article 5(1)(a) GDPR]].The DPA held that the deletion of personal data by the controller during the proceedings constituted a violation of the data subject's right of access under Article 15 in conjunction with [[Article 5 GDPR|Article 5(1)(a) GDPR]]. == English Summary ==== English Summary == === Facts ====== Facts === On 07. August 2023, the data subject made a request to the processor to provide the report and the questionnaire completed by the data subject at an information event. The processor responded to this request on 08. August 2023, stating that they would receive a final report and that all required documents were provided to the controller. It was found later that the questionnaire had already been deleted after the initial interview. On 07. August 2023, the data subject made a request to the processor to provide the report and the questionnaire completed by the data subject at an information event. The processor responded to this request, stating that they would receive a final report and that all required documents were provided to the controller. The data subject sent a request to the controller on 30. September 2023, which remained unreplied. The data subject sent a request to the controller on 30. September 2023, specifically asking for access to personal data, which remained unreplied. The questionnaire had already been deleted at that time. On 13. January 2024, the data subject sent another request to the controller, also asking about the processor's procedure, as their \"Kulturpass\" card had not been picked up. The controller answered on 23. January 2024 and stated that the questionnaire had already been disposed of and therefore could not be provided.On 13. January 2024, the data subject sent another request to the controller, also asking about the processor's procedure. The controller answered on 23. January 2024 and stated that the questionnaire had already been disposed of and therefore could not be provided. On 10. February 2024, the data subject lodged a complaint with the Austrian DPA (DSB) regarding the withholding of information about their processed data and their deletion despite the processor being aware of an information request, submitted by the data subject on 07. August 2023.The data subject lodged a complaint with the Austrian DPA (DSB) regarding the withholding of information about their processed data and their deletion despite the processor being aware of an information request, submitted by the data subject on 07. August 2023. Several statements were made by the data subject, the controller and the processor. In essence, the controller argued that the data subject did not explain or prove the necessity of the requested information. From the data subject's perspective, the controller oversimplified the case. During the proceedings, data relating to a project involving the data subject was deleted. On 30. June 2024, during the proceedings, data relating to a project involving the data subject was deleted. === Holding ====== Holding === First, the DPA held that the processor had not violated the right of access under [[Article 15 GDPR]] as there was no evidence of contractual violations between the processor and the contractor under [[Article 28 GDPR|Article 28(10) GDPR]].First, the DPA held that the processor had not violated the right to access under [[Article 15 GDPR]] as there was no evidence of contractual violations between the processor and the contractor under [[Article 28 GDPR|Article 28(10) GDPR]]. As defined in [[Article 4 GDPR|Article 4(8) GDPR]], the processor processes personal data on behalf of the controller and thereby acts as their \"extended arm\". The processor is in physical possession of the data and is bound by the controller's directives regarding the purposes and means of the processing. Therefore, the controller is responsible for the actions of the processor if the processor were their own, except in cases where the processor exceeds the defined scope and determines the purposes and means of processing under [[Article 28 GDPR|Article 28(10) GDPR]]. This concludes to the controller's responsibility to ensure that the data subjects can exercise their rights, with the processor providing support where possible.As defined in [[Article 4 GDPR|Article 4(8) GDPR]], the processor processes personal data on behalf of the controller and thereby acts as their \"extended arm\". The processor is in physical possession of the data and is bound by the controller's directives regarding the purposes and means of the processing. Therefore, the controller is responsible for the actions of the processor if the processor were their own, except in cases where the processor exceeds the defined scope and determines the purposes and means of processing under [[Article 28 GDPR|Article 28(10) GDPR]]. This concludes to the controller's responsibility to ensure that the data subjects can exercise their rights, with the processor providing support where possible. Second, the DPA held that both the email from 30. September 2023 and the email of 13. January 2024 did constitute information requests under [[Article 15 GDPR]]. The data subject's email on 07. August 2023 to the processor did not constitute a request under [[Article 15 GDPR]], as this was not apparent. The data subject simply requested the transmission of the report and the questionnaire.Second, the DPA held that both the email from 30. September 2023 and the email of 13. January 2024 did constitute information requests under [[Article 15 GDPR]]. The data subject simply requested the transmission of information, namely the report and the questionnaire and did not refer to personal data. Third, the DPA held that the disposal of project data during the proceedings constituted a violation of the data subject's right of access under Article 15 in conjunction with [[Article 5 GDPR|Article 5(1)(a) GDPR]]. This is not permitted during an ongoing information request. However, the disposal of the questionnaire right after the initial interview had happened before the data subject's first email on 08. August 2023.Third, the DPA held that the disposal of project data during the proceedings constituted a violation of the data subject's right of access under Article 15 in conjunction with [[Article 5 GDPR|Article 5(1)(a) GDPR]]. The deletion of personal data that is subject to an access request that has already reached the controller violates Article 15 GDPR. This is because the deletion makes it impossible for the DPA to investigate in a possible breach of the access right. Fourth, the DPA held that it was the controller's responsibility to provide the processed data 'in an intelligible form', 'which allows' the data subject 'to become aware of those data and to check that they are accurate and processed in compliance with' the GDPR (see [https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Faffair?lang=EN&searchTerm=C%25E2%2580%2591141%252F12&publishedId=C-141%2F12 CLEU in joined cases 'YS and Others' (C‑141\u002F12) and 'M and S' (C‑372\u002F12)]). Hence, the controller's view that it was in the data subject's duty to explain why the provision of the processed data had to be in an intelligible way had to be rejected. A right to receive every document containing processed personal data could not be recognised under [[Article 15 GDPR]] in conjunction with","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DSB_(Austria)_-_DSB-D124.0531\u002F24&diff=52982&oldid=52784","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F1\u002F1f\u002FLogoAT.png","2026-09-09T09:49:58+00:00","2026-09-09T10:00:11.484668+00:00",7,[18,21],{"name":19,"type":20},"Kulturpass","product",{"name":22,"type":23},"DSB","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":24,"icon":26,"name":27,"slug":28},null,"Policy","policy",[30,35,40,45],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":36},{"id":37,"icon":26,"name":38,"slug":39},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":41},{"id":42,"icon":26,"name":43,"slug":44},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":46},{"id":24,"icon":26,"name":27,"slug":28},[]]