DSB (Austria) - DSB-D124.0531/24

Summary

The Austrian Data Protection Authority (DSB) ruled that the Public Employment Service Austria (controller) violated a data subject's right of access under Article 15 GDPR. This occurred when personal data was deleted during proceedings, despite an ongoing information request. The DSB clarified that while the processor did not directly violate the right of access, the controller remains responsible for ensuring data subjects can exercise their rights, even when data is deleted by a processor.

Full text

Help DSB (Austria) - DSB-D124.0531/24: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 10:45, 23 August 2026 view source Marcm (talk | contribs)35 edits Tag: Decisions [1.0]Newer edit → (No difference) Revision as of 10:45, 23 August 2026 DSB - DSB-D124.0531/24 Authority: DSB (Austria) Jurisdiction: Austria Relevant Law: Article 4(7) GDPR Article 4(8) GDPR Article 4(10) GDPR Article 5(1)(a) GDPR Article 12(5) GDPR Article 12(5)(b) GDPR Article 15(1) GDPR Article 15(3) GDPR Article 28(3)(e) GDPR Article 28(10) GDPR Article 57(1)(f) GDPR Recital 63 Regulation 2016/679 (GDPR)Recital 81 Regulation 2016/679 (GDPR)Paras 15ff EDPB Guidelines 07/2020Para 80 EDPB Guidelines 07/2020§ 1(1) AMSG§ 1(2) AMSG§ 1(3) AMSG§ 24(2)(2) DSG§ 59(1) AVG Type: Complaint Outcome: n/a Started: 09.02.2024 Decided: 21.11.2025 Published: 26.05.2026 Fine: n/a Parties: Public Employment Service Austria (controller) ABZ AUSTRIA (processor) National Case Number/Name: DSB-D124.0531/24 European Case Law Identifier: ECLI:AT:DSB:2025:2025.0.566.415 Appeal: Not appealed Original Language(s): German Original Source: RIS (in DE) Initial Contributor: Marc-Michael Haupt The DPA held that the controller had disposed of personal data during the proceedings, constituting a violation of the data subject's right of access under Article 15 in conjunction with Article 5(1)(a) GDPR. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts On 07. August 2023, the data subject made a request to the processor to provide the report and the questionnaire completed by the data subject at an information event. The processor responded to this request on 08. August 2023, stating that they would receive a final report and that all required documents were provided to the controller. It was found later that the questionnaire had already been deleted after the initial interview. The data subject sent a request to the controller on 30. September 2023, which remained unreplied. On 13. January 2024, the data subject sent another request to the controller, also asking about the processor's procedure, as their "Kulturpass" card had not been picked up. The controller answered on 23. January 2024 and stated that the questionnaire had already been disposed of and therefore could not be provided. On 10. February 2024, the data subject lodged a complaint with the Austrian DPA (DSB) regarding the withholding of information about their processed data and their deletion despite the processor being aware of an information request, submitted by the data subject on 07. August 2023. Several statements were made by the data subject, the controller and the processor. In essence, the controller argued that the data subject did not explain or prove the necessity of the requested information. From the data subject's perspective, the controller oversimplified the case. On 30. June 2024, during the proceedings, data relating to a project involving the data subject was deleted. Holding First, the DPA held that the processor had not violated the right of access under Article 15 GDPR as there was no evidence of contractual violations between the processor and the contractor under Article 28(10) GDPR. As defined in Article 4(8) GDPR, the processor processes personal data on behalf of the controller and thereby acts as their "extended arm". The processor is in physical possession of the data and is bound by the controller's directives regarding the purposes and means of the processing. Therefore, the controller is responsible for the actions of the processor if the processor were their own, except in cases where the processor exceeds the defined scope and determines the purposes and means of processing under Article 28(10) GDPR. This concludes to the controller's responsibility to ensure that the data subjects can exercise their rights, with the processor providing support where possible. Second, the DPA held that both the email from 30. September 2023 and the email of 13. January 2024 did constitute information requests under Article 15 GDPR. The data subject's email on 07. August 2023 to the processor did not constitute a request under Article 15 GDPR, as this was not apparent. The data subject simply requested the transmission of the report and the questionnaire. Third, the DPA held that the disposal of project data during the proceedings constituted a violation of the data subject's right of access under Article 15 in conjunction with Article 5(1)(a) GDPR. This is not permitted during an ongoing information request. However, the disposal of the questionnaire right after the initial interview had happened before the data subject's first email on 08. August 2023. Fourth, the DPA held that it was the controller's responsibility to provide the processed data 'in an intelligible form', 'which allows' the data subject 'to become aware of those data and to check that they are accurate and processed in compliance with' the GDPR (CLEU in joined cases 'YS and Others' (C‑141/12) and 'M and S' (C-C‑372/12) ECLI:EU:C:2014:2081). Hence, the controller's view that it was in the data subject's duty to explain why the provision of the processed data had to be in an intelligible way had to be rejected. A right to receive every document containing processed personal data could not be recognised under Article 15 GDPR in conjunction with Recital 63 GDPR. Comment The "Kulturpass" card gives people with socially disadvantaged background free access to a variety of cultural institutions. See more information on the initiative's website. Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Text Ref. No.: 2023-0.273.912 dated October 6, 2023 (Case No.: DPA-D124.5337) [Processing Officer’s Note: Names and company names, legal forms and product names, addresses (including URLs, IP addresses, and email addresses), case numbers (and the like), statistical data, etc., as well as their initials and abbreviations, may have been shortened and/or altered for pseudonymization purposes. Obvious spelling, grammar, and punctuation errors have been corrected. DECISION RULING The Data Protection Authority makes a decision on the data protection complaint filed on November 26, with representatives of Dr. Erich A*** and the B***labor GmbH, both of whom are represented by U*** Rechtsanwalts GmbH, November 2021 against 1) M*** Verlagsgesellschaft m.b.H. (first respondent), with P*** Rechtsanwälte KG acting as its representative, and 2) the N*** Broadcasting Company (second respondent), represented by L*** Rechtsanwälte GmbH, regarding violations of 1) the right to erasure, 2) the right of access, and 3) the right to confidentiality, as follows: I. The second appellant’s complaint against the respondents regarding a violation of the right to erasure is dismissed. The first complainant’s complaint against the first respondent regarding a violation of the right to access is partially granted, and it is determined that the first respondent violated the first complainant’s right to access by failing to provide information regarding the following processed personal data of the first complainant: a. specifically processed (master) data (Art. 15(1), second sentence, GDPR); specifically processed (master) data (Article 15, paragraph 1, second sentence, GDPR); b. the purposes of the data processing (Art. 15(1)(a) GDPR); the purposes of the data processing (Article 15, paragraph 1, subparagraph (a), GDPR); c. the categories of personal data being processed (Art. 15(1)(b) GDPR); the categories of personal data being processed (Article 15, paragraph 1, subparagraph (b), GDPR); d. recipients or categories of recipients (Art. 15(1)(c) GDPR); recipients or categories of recipients (

Entities