DSB (Austria) - DSB-D124.2437/25

Summary

The Austrian Data Protection Authority (DSB) ruled that a therapy association violated a patient's right of access under GDPR. The association failed to disclose personal data contained in handwritten therapist notes and omitted crucial information regarding processing purposes, data categories, recipients, and retention periods. The DSB emphasized that even non-automated data in a structured 'filing system' is subject to GDPR access rights.

Full text

Help DSB (Austria) - DSB-D124.2437/25: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 20:32, 25 August 2026 view source Stella (talk | contribs)17 edits Tag: Decisions [1.0] (No difference) Latest revision as of 20:32, 25 August 2026 DSB - DSB-D124.2437/25 Authority: DSB (Austria) Jurisdiction: Austria Relevant Law: Article 2 GDPR Article 4(1) GDPR Article 4(2) GDPR Article 4(6) GDPR Article 15(1) GDPR Article 22 GDPR Article 31 GDPR Article 51(1) GDPR Article 57(1)(f) GDPR Article 58(2)(c) GDPR Article 77(1) GDPR Type: Complaint Outcome: Upheld Started: 13.08.2025 Decided: 09.01.2026 Published: 07.07.2026 Fine: n/a Parties: Meinhard A Verein N***-Therapie National Case Number/Name: DSB-D124.2437/25 European Case Law Identifier: ECLI:AT:DSB:2026:2026.0.018.391 Appeal: Unknown Original Language(s): German Original Source: RIS (in DE) Initial Contributor: stella The DSB held that a therapy association violated a patient's right of access by failing to disclose personal data in a therapist's handwritten notes and by omitting required information on purposes, categories, recipients and retention. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The controller, an Austrian registered association, operates a therapy centre for psychosomatic illnesses. The data subject was a patient of the controller. On 28 July 2025, the data subject sent an access request by email under Article 15 GDPR, asking for full information on all personal data processed about him including specific categories of data, processing purposes, recipients, storage periods, data origin, any automated decision-making, a copy of his data in electronic format and what data had been processed by two named individuals (a doctor and a body therapist working for the controller) and whether either had disclosed his data to third parties. The controller's chairperson replied by email on 12 August 2025, attaching a PDF of the data collected from the data subject and a list of medications, noting the data originated from a named doctor and that there was no planned retention period. The reply stated that data recorded by the body therapist existed only in handwritten form and had not been electronically processed and offered to send the data subject a copy by post or email. The reply did not include information on the purposes of processing, categories of data, recipients or categories of recipients, or the criteria used to determine retention periods. The data subject filed a complaint with the Austrian DPA, alleging that the access provided was incomplete. Despite being invited to comment twice by the DPA, the controller did not respond at any point during the proceedings, although a delivery receipt confirmed it had received the correspondence. Holding First, addressing the controller's failure to participate in the proceedings, the DPA held that although it is required to investigate matters on its own initiative, a party's persistent failure to cooperate despite repeated invitations may properly be taken into account in the DPA's free assessment of evidence, rather than obliging the DPA to conduct further investigations of its own accord. On this basis, the DPA treated the data subject's account of events, including that no further information had been provided beyond the 12 August 2025 email, as established. Second, on the scope of the complaint, the DPA reiterated that in a complaint-based procedure, the content of the complaint itself defines and limits the subject matter of the proceedings. The DPA can only rule on what was actually raised. The data subject's complaint was based on the incompleteness of the access provided, specifically regarding the handwritten notes and the missing meta-information. Third, on the handwritten notes, the DPA held that the GDPR's material scope extends not only to automated processing but also to non-automated processing where the data form part of a "filing system" under Article 4(6) GDPR defined broadly by the CJEU case-law C-740/22 as any structured collection of personal data accessible according to specific criteria that make data easily retrievable. The DPA held that although the controller had not specified how the therapist's handwritten notes were organised, it could reasonably be assumed that such clinical notes on patients are typically structured by criteria such as name or treatment period to ensure future retrievability, consistent with professional standards of care in the therapeutic field. On this basis, the DPA held that the notes fell within the GDPR's material scope and that the data subject was entitled to access the personal data they contained, so the complaint was well-founded on this point. Fourth, on the missing meta-information, the DPA held that Article 15(1) GDPR entitles a data subject not only to the specific personal data processed but also to the accompanying information listed in Article 15(1)(a)-(h) GDPR, including processing purposes, categories of data, recipients or categories of recipients and criteria for determining storage periods. Since the controller's response of 12 August 2025 included none of this information, the complaint was also well-founded on this point. The DPA accordingly upheld the complaint and found a violation of the right of access. Citing CJEU case-law C-46/23 on the DPA's obligation to adopt appropriate corrective measures once a violation is established, the DPA ordered the controller, under Article 58(2)(c) GDPR, to fully comply with the data subject's access request including disclosure of the handwritten notes and the outstanding meta-information within four weeks. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Text Ref. No.: 2026-0.018.391 dated January 9, 2026 (Case No.: DPA-D124.2437/25) [Note from the processor: Names and company names, legal forms and product names, addresses (including URLs, IP addresses, and email addresses), file numbers (and the like), statistical data, etc., as well as their initials and abbreviations, may have been abbreviated and/or altered for pseudonymization purposes. Obvious spelling, grammar, and punctuation errors have been corrected.] DECISION RULING The Data Protection Authority rules on the data protection complaint filed by Meinhard A*** (complainant) on August 13, August 2025, supplemented on 18 August 2025, against the N***-Therapie NGO (Respondent) regarding an alleged violation of the right to access information, as follows: 1. The complaint is upheld, and it is determined that the respondent violated the complainant’s right of access by failing to disclose the complainant’s personal data contained in handwritten notes and by failing to provide the complainant with information regarding the processing purposes, categories of data, recipients or categories of recipients, or the criteria for determining the retention period. 2. The respondent is ordered to provide the complainant, within a period of four weeks or face enforcement, with the personal data contained in handwritten notes, as well as to provide the complainant with information regarding the processing purposes, categories of data, and recipients or categories of recipients, as well as the criteria for determining the retention period. Legal basis: Art. 2, Art. 4(1), (2), and (6), Art. 15(1), Art. 51(1), Art. 57(1)(f), Art. 58(2)(c), and Art. 77(1) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of May 4, 2016, p. 1; Sections 18(1) and 24(1) and (5) of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999, as amended.Legal basis: Article 2, Article 4(1), (2), and (6), Arti

Entities