[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBC-7fiAcCZ0MUuDhQZi0CIjEPiYcpslcqF_2hwwegVA":3},{"article":4,"iocs":43},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":26,"category":27,"article_tags":31},"b039eb46-bb68-4bc2-af9e-04cc3087c0f2","DSB (Austria) - DSB-D124.2437\u002F25","dsb-austria-dsb-d124-2437-25-e88c0b","Created page with \"{{DPAdecisionBOX |Jurisdiction=Austria |DPA-BG-Color= |DPAlogo=LogoAT.png |DPA_Abbrevation=DSB |DPA_With_Country=DSB (Austria) |Case_Number_Name=DSB-D124.2437\u002F25 |ECLI=ECLI:AT:DSB:2026:2026.0.018.391 |Original_Source_Name_1=RIS |Original_Source_Link_1=https:\u002F\u002Fwww.ris.bka.gv.at\u002FDokument.wxe?ResultFunctionToken=4f8db4f2-b42e-4519-b771-ac24a4b94b92&Position=1&SkipToDocumentPage=True&Abfrage=Dsk&Entscheidungsart=Undefined&Organ=Undefined&SucheNachRechtssatz=True&SucheNac...\" New page {{DPAdecisionBOX |Jurisdiction=Austria |DPA-BG-Color= |DPAlogo=LogoAT.png |DPA_Abbrevation=DSB |DPA_With_Country=DSB (Austria) |Case_Number_Name=DSB-D124.2437\u002F25 |ECLI=ECLI:AT:DSB:2026:2026.0.018.391 |Original_Source_Name_1=RIS |Original_Source_Link_1=https:\u002F\u002Fwww.ris.bka.gv.at\u002FDokument.wxe?ResultFunctionToken=4f8db4f2-b42e-4519-b771-ac24a4b94b92&Position=1&SkipToDocumentPage=True&Abfrage=Dsk&Entscheidungsart=Undefined&Organ=Undefined&SucheNachRechtssatz=True&SucheNachText=True&GZ=&VonDatum=01.01.1990&BisDatum=&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=EinerWoche&ResultPageSize=100&Suchworte=DSGVO&Dokumentnummer=DSBT_20260109_2026_0_018_391_00 |Original_Source_Language_1=German |Original_Source_Language__Code_1=DE |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Complaint |Outcome=Upheld |Date_Started=13.08.2025 |Date_Decided=09.01.2026 |Date_Published=07.07.2026 |Year=2026 |Fine= |Currency= |GDPR_Article_1=Article 2 GDPR |GDPR_Article_Link_1=Article 2 GDPR |GDPR_Article_2=Article 4(1) GDPR |GDPR_Article_Link_2=Article 4 GDPR#1 |GDPR_Article_3=Article 4(2) GDPR |GDPR_Article_Link_3=Article 4 GDPR#2 |GDPR_Article_4=Article 4(6) GDPR |GDPR_Article_Link_4=Article 4 GDPR#6 |GDPR_Article_5=Article 15(1) GDPR |GDPR_Article_Link_5=Article 15 GDPR#1 |GDPR_Article_6=Article 22 GDPR |GDPR_Article_Link_6=Article 22 GDPR |GDPR_Article_7=Article 31 GDPR |GDPR_Article_Link_7=Article 31 GDPR |GDPR_Article_8=Article 51(1) GDPR |GDPR_Article_Link_8=Article 51 GDPR#1 |GDPR_Article_9=Article 57(1)(f) GDPR |GDPR_Article_Link_9=Article 57 GDPR#1f |GDPR_Article_10=Article 58(2)(c) GDPR |GDPR_Article_Link_10=Article 58 GDPR#2c |GDPR_Article_11=Article 77(1) GDPR |GDPR_Article_Link_11=Article 77 GDPR#1 |GDPR_Article_12= |GDPR_Article_Link_12= |GDPR_Article_13= |GDPR_Article_Link_13= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1=Meinhard A |Party_Link_1= |Party_Name_2=Verein N***-Therapie |Party_Link_2= |Party_Name_3= |Party_Link_3= |Party_Name_4= |Party_Link_4= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status=Unknown |Appeal_To_Link= |Initial_Contributor=stella | }} The DSB held that a therapy association violated a patient's right of access by failing to disclose personal data in a therapist's handwritten notes and by omitting required information on purposes, categories, recipients and retention. == English Summary == === Facts === The controller, an Austrian registered association, operates a therapy centre for psychosomatic illnesses. The data subject was a patient of the controller. On 28 July 2025, the data subject sent an access request by email under [[Article 15 GDPR|Article 15 GDPR]], asking for full information on all personal data processed about him including specific categories of data, processing purposes, recipients, storage periods, data origin, any automated decision-making, a copy of his data in electronic format and what data had been processed by two named individuals (a doctor and a body therapist working for the controller) and whether either had disclosed his data to third parties. The controller's chairperson replied by email on 12 August 2025, attaching a PDF of the data collected from the data subject and a list of medications, noting the data originated from a named doctor and that there was no planned retention period. The reply stated that data recorded by the body therapist existed only in handwritten form and had not been electronically processed and offered to send the data subject a copy by post or email. The reply did not include information on the purposes of processing, categories of data, recipients or categories of recipients, or the criteria used to determine retention periods. The data subject filed a complaint with the Austrian DPA, alleging that the access provided was incomplete. Despite being invited to comment twice by the DPA, the controller did not respond at any point during the proceedings, although a delivery receipt confirmed it had received the correspondence. === Holding === First, addressing the controller's failure to participate in the proceedings, the DPA held that although it is required to investigate matters on its own initiative, a party's persistent failure to cooperate despite repeated invitations may properly be taken into account in the DPA's free assessment of evidence, rather than obliging the DPA to conduct further investigations of its own accord. On this basis, the DPA treated the data subject's account of events, including that no further information had been provided beyond the 12 August 2025 email, as established. Second, on the scope of the complaint, the DPA reiterated that in a complaint-based procedure, the content of the complaint itself defines and limits the subject matter of the proceedings. The DPA can only rule on what was actually raised. The data subject's complaint was based on the incompleteness of the access provided, specifically regarding the handwritten notes and the missing meta-information. Third, on the handwritten notes, the DPA held that the GDPR's material scope extends not only to automated processing but also to non-automated processing where the data form part of a \"filing system\" under [[Article 4 GDPR|Article 4(6) GDPR]] defined broadly by the CJEU case-law C-740\u002F22 as any structured collection of personal data accessible according to specific criteria that make data easily retrievable. The DPA held that although the controller had not specified how the therapist's handwritten notes were organised, it could reasonably be assumed that such clinical notes on patients are typically structured by criteria such as name or treatment period to ensure future retrievability, consistent with professional standards of care in the therapeutic field. On this basis, the DPA held that the notes fell within the GDPR's material scope and that the data subject was entitled to access the personal data they contained, so the complaint was well-founded on this point. Fourth, on the missing meta-information, the DPA held that [[Article 15 GDPR|Article 15(1) GDPR]] entitles a data subject not only to the specific personal data processed but also to the accompanying information listed in Article 15(1)(a)-(h) GDPR, including processing purposes, categories of data, recipients or categories of recipients and criteria for determining storage periods. Since the controller's response of 12 August 2025 included none of this information, the complaint was also well-founded on this point. The DPA accordingly upheld the complaint and found a violation of the right of access. Citing CJEU case-law C-46\u002F23 on the DPA's obligation to adopt appropriate corrective measures once a violation is established, the DPA ordered the controller, under [[Article 58 GDPR|Article 58(2)(c) GDPR]], to fully comply with the data subject's access request including disclosure of the handwritten notes and the outstanding meta-information within four weeks. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the German original. Please refer to the German original for more details. Text Ref. No.: 2026-0.018.391 dated January 9, 2026 (Case No.: DPA-D124.2437\u002F25) [Note from the processor: Names and company names, legal forms and product names, addresses (including URLs, IP addresses, and email addresses), file numbers (and the like), statistical data, etc., as well as their initials and abbreviations, may have been abbreviated and\u002For altered for pseudonymization purposes. Obvious spelling, grammar, and punctuation errors have been corrected.] DECISION RULING The Data Protection Authority rules on the data protection complaint filed by Meinhard A*** (complainant) on August 13, August 2025, supplemented on 18 August 2025, against the N***-Therapie NGO (Respondent) regarding an alleged violation of the right to access information, as follows: 1. The complaint is upheld, and it is determined that the respondent violated the complainant’s right of access by failing to disclose the complainant’s personal data contained in handwritten notes and by failing to provide the complainant with information regarding the processing purposes, categories of data, recipients or categories of recipients, or the criteria for determining the retention period. 2. The respondent is ordered to provide the complainant, within a period of four weeks or face enforcement, with the personal data contained in handwritten notes, as well as to provide the complainant with information regarding the processing purposes, categories of data, and recipients or categories of recipients, as well as the criteria for determining the retention period. Legal basis: Art. 2, Art. 4(1), (2), and (6), Art. 15(1), Art. 51(1), Art. 57(1)(f), Art. 58(2)(c), and Art. 77(1) of Regulation (EU) 2016\u002F679 (General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of May 4, 2016, p. 1; Sections 18(1) and 24(1) and (5) of the Data Protection Act (DSG), Federal Law Gazette I No. 165\u002F1999, as amended.Legal basis: Article 2, Article 4(1), (2), and (6), Article 15(1), Article 51(1), Article 57, paragraph 1, subparagraph (f), Article 58, paragraph 2, subparagraph (c), and Article 77, paragraph 1, of Regulation (EU) 2016\u002F679 (General Data Protection Regulation, hereinafter: GDPR), Official Journal No. L 119 of May 4, 2016, page 1; Paragraphs 18(1), 24(1), and 24(5) of the Data Protection Act (DSG), Federal Law Gazette, Part I, No. 165 of 1999, as amended. STATEMENT OF REASONS A. Arguments of the Parties and Course of Proceedings 1. In his petition initiating the proceedings, the complainant alleged a violation of the right of access due to the provision of incomplete information. 2. The Data Protection Authority subsequently requested the respondent to submit a statement on August 25, 2025, and October 2, 2025. 3. The respondent did not submit a statement by the conclusion of the proceedings. A return receipt confirming receipt by the respondent is included in the case file. B. Subject Matter of the Complaint The subject matter of the complaint is whether the respondent violated the complainant’s right to access information by providing incomplete information. C. Findings of Fact 1. The Data Protection Authority bases its findings of fact on the arguments set forth in Section A. 2. The respondent is an NGO registered under ZVR *1*66*22* in the Austrian Register of NGOs, which operates a therapy center for psychosomatic disorders in **** P***berg. 3. On July 28, 2025, the complainant sent the following message via email to the respondent’s email address (excerpted to the extent relevant to the proceedings): “Dear Sir or Madam, Pursuant to Article 15 of the General Data Protection Regulation (GDPR), I request full information regarding all personal data about me that has been or is currently being processed by your NGO, N***-Therapie.Pursuant to Article 15 of the General Data Protection Regulation (GDPR), I request full information regarding all personal data about me that has been or is currently being processed by your NGO, N***-Therapie. In particular, I request information regarding: ● the specific personal data processed (currently and in the past), ● processing purposes, ● categories of data, ● recipients or categories of recipients, ● planned or actual retention periods, ● the source of the data (if not collected directly from me), ● any automated decision-making or profiling pursuant to Article 22 of the GDPR, ● as well as a copy of all personal data in a commonly used electronic format (PDF). In addition, I request information regarding which of my personal data were specifically processed by Mr. Theodor M*** and Mr. Josef L***, and whether any of my personal data were transferred to third parties by Mr. Theodor M*** or Mr. Josef L*** to third parties and, if so, to which recipients the data was disclosed.” 4. The representative of the respondent replied to the complainant by email on August 12, 2025, as follows: “Dear Mr. A***, Please find attached as a PDF the data we collected from you and the list of medications that was processed; the data comes from Dr. C***. There is no planned retention period. The data collected by Mr. Josef L*** is recorded by hand and has not been processed electronically. We would be happy to send it to you by mail or email. Please note that we are under no obligation to continue storing your data. Upon request, we can delete it at any time. We hope you are well and wish you all the best! If you have any questions, please feel free to contact me by phone.” 5. Josef L*** is a physical therapist working for the respondent. 6. Until the conclusion of the present proceedings, the respondent did not provide the complainant with any further information. Nor did the respondent make any statements to the Data Protection Authority at any time. Assessment of Evidence: The findings are based on the complainant’s submissions in the petition initiating the proceedings, as well as on the copies of documents provided by the complainant. Furthermore, the findings are based on an ex officio query of the Central Register of Associations and the website “https:\u002F\u002Fn***therapie.org\u002F,” both of which were last accessed by the Data Protection Authority on January 9, 2026. D. From a legal perspective, the following conclusions follow: D1. Regarding Lack of Cooperation As can be seen from the course of the proceedings and the findings, the respondent failed to submit any arguments despite repeated requests by the Data Protection Authority. Pursuant to Article 31 of the GDPR, a controller is obligated to cooperate with the supervisory authority upon request in the performance of its duties. Pursuant to Article 31 of the GDPR, a controller is obligated to cooperate with the supervisory authority upon request in the performance of its duties. It is true that, pursuant to Section 39(2) of the Administrative Procedure Act (AVG), the authority must, in principle, act ex officio and determine the course of the investigative proceedings. It is true that, pursuant to Section 39(2) of the Administrative Procedure Act (AVG), the authority must, in principle, act ex officio and determine the course of the investigative proceedings. However, if a party fails to provide the required cooperation despite appropriate requests, it is not considered unlawful for the authority to refrain from conducting further investigations on its own initiative, but rather to take this failure into account in its assessment of the available investigative findings pursuant to § 45(2) and § 46 of the AVG, within the scope of its discretion in evaluating evidence, incorporates this failure into the assessment of the available investigative findings (see Decision of the Administrative Court of August 28, 2024, Ra 2023\u002F08\u002F0087).However, if a party fails to cooperate as required despite corresponding requests, it is not considered unlawful for the authority to refrain from conducting further investigations on its own initiative, but rather to incorporate this failure, pursuant to Section 45, paragraph 2, and Section 46, of the AVG, within the scope of its discretion in evaluating evidence, in its assessment of the available findings of the investigation (see Decision of the Administrative Court of August 28, 2024, Ra 2023\u002F08\u002F0087). Against this background, the Data Protection Authority assessed the respondent’s lack of cooperation within the scope of its discretion in evaluating evidence to mean that the complainant’s email message dated July 28, July 2025 and that, apart from the email message of August 12, 2025, no further information was provided. D2. Regarding the Complaint (Point 1) It should be noted at the outset that the Administrative Court (VwGH) has consistently held that, in administrative proceedings requiring a petition, it is primarily the petitioner who determines the subject matter of the proceedings. In principle, both the administrative authority and the Court may only rule on what was actually requested; in this respect, the authority and the Court are bound by the content of the applicant’s petition, and they are also prohibited from unilaterally deviating from it (see decision of the Administrative Court [VwGH] dated June 22, 2016, Ra 2016\u002F03\u002F0027). It should be noted at the outset that the Administrative Court (VwGH) has consistently held that, in administrative proceedings requiring a petition, it is primarily the petitioner who determines the subject matter of the proceedings. In principle, both the administrative authority and the Court may only rule on what was actually requested; in this respect, the authority and the Court are bound by the content of the applicant’s petition, and they are also prohibited from unilaterally deviating from it—see the decision of the Administrative Court (VwGH) dated June 22, 2016, Ra 2016\u002F03\u002F0027). Against this backdrop, both the Data Protection Authority and the Federal Administrative Court (BVwG) have repeatedly stated that, in the complaint procedure pursuant to Art. 77 GDPR in conjunction with § 24(1) of the Data Protection Act (DSG), the content of the complaint constitutes and defines the subject matter of the complaint (see, for example, the BVwG decision of May 17, 2022, W214 2233132-1).Against this background, both the Data Protection Authority and the BVwG have repeatedly stated that in the complaint procedure pursuant to article 77, GDPR in conjunction with Section 24(1) of the DSG, the content of the complaint constitutes and delimits the subject matter of the complaint (see, for example, the BVwG decision of May 17, 2022, W214 2233132-1). The complainant justified the alleged violation of the right of access by arguing that no complete information had been provided regarding the purposes of processing, the categories of personal data, the retention period, and the recipients. At the same time, data processed by hand had not been disclosed. a. Regarding “handwritten” data Article 2 of the GDPR defines the material scope of application of the GDPR, which is determined by the form of data processing and the purpose pursued thereby. With regard to the form of data processing, the scope of application of the GDPR applies when personal data is processed either fully or partially by automated means, or when it is processed non-automatically but is stored or is intended to be stored in a file. The decisive factor is therefore whether there is an operation or a set of operations performed on personal data using automated means, or whether the data is part of a collection structured according to specific criteria, thereby facilitating access to the data.Article 2 of the GDPR governs the material scope of the GDPR, which is determined by the form of data processing and the purpose for which it is carried out. With regard to the form of data processing, the scope of the GDPR applies when personal data is processed either fully or partially by automated means, or when it is processed non-automatically but is stored or intended to be stored in a file. The decisive factor is therefore whether there is an operation or a set of operations performed on personal data using automated means, or whether the data forms part of a collection structured according to specific criteria, thereby facilitating access to the data. Article 4(6) of the GDPR defines the term “filing system” in more detail. Accordingly, a “filing system” is any structured collection of personal data that is accessible according to specific criteria, regardless of whether this collection is managed centrally, decentralized, or organized according to functional or geographic criteria. There must therefore be a specific criterion by which a collection is accessible, such as name, address, or gender. It must involve a systematic compilation of individual pieces of information that are internally related (Hödl in Knyrim (ed.), DatKomm Art. 4 GDPR para. 72, as of Dec. 1, 2018, rdb.at). Article 4(6) of the GDPR defines the term “filing system” in more detail. Accordingly, a “filing system” is any structured collection of personal data that is accessible according to specific criteria, regardless of whether this collection is managed centrally, decentralized, or organized according to functional or geographic criteria. There must therefore be a specific criterion by which a collection is accessible, such as name, address, or gender. It must involve a systematic compilation of individual pieces of information that are intrinsically linked (Hödl in Knyrim (ed.), DatKomm article 4, GDPR para. 72, as of Dec. 1, 2018, rdb.at). In this regard, the CJEU has already held on multiple occasions that the term “file” is broadly defined in this provision, particularly because it encompasses “any” structured collection of personal data. Furthermore, the requirement that the collection of personal data must be “structured according to specific criteria” simply means that the data concerning a specific individual can be easily retrieved (see CJEU judgement of March 7, 2024, Case C-740\u002F22, para. 37). In this regard, the CJEU has already held on several occasions that the term “file” is broadly defined in this provision, in particular because it encompasses “any” structured collection of personal data. Furthermore, the requirement that the collection of personal data must be “structured according to specific criteria” simply means that the data concerning a specific individual can be easily retrieved (see judgement of the CJEU of March 7, 2024, Case C-740\u002F22, para. 37). Notwithstanding the fact that the respondent did not comment on the specific form in which the handwritten notes of the therapist working for her are kept and stored, it must nevertheless be assumed that this constitutes a filing system within the meaning of Article 4(6) of the GDPR.Notwithstanding the fact that the respondent has not commented on the specific manner in which the handwritten notes of the therapist working for her are maintained and stored, it must nevertheless be assumed that these constitute a filing system within the meaning of Article 4(6), GDPR. In the case of a therapist’s handwritten notes about their patients, it is typically assumed that these are organized according to certain criteria—such as name or treatment period—to ensure they can be retrieved later. Such structuring is both obvious and necessary due to the professional duties of care in the therapeutic field. Against this background, the material scope of application of the GDPR is also extended to the complainant’s personal data contained in the handwritten notes. On the Right of Access Pursuant to Article 15(1) of the GDPR, a data subject has the right to request confirmation from the controller as to whether personal data concerning him or her is being processed; if so, they have the right to access such personal data and to receive certain information as set forth in subparagraphs (a) through (h) of the aforementioned article. Pursuant to Article 15, paragraph 1, GDPR, a data subject has the right to request confirmation from the controller as to whether personal data concerning him or her is being processed; if this is the case, he or she has the right to access this personal data and to certain information in accordance with subparagraphs (a) through (h) of the aforementioned provision. As already noted in point a., the information contained in the therapist’s handwritten notes constitutes the complainant’s personal data. Consequently, the respondent should have disclosed this information when providing the requested details. The complaint was therefore found to be justified on this point. In addition to receiving information about the specific data processed, a data subject also has the right to be provided with the information listed in Article 15(1)(a) through (h) of the GDPR (so-called “meta-information”). Pursuant to subparagraph (a) of the aforementioned provision, this includes the processing purposes; pursuant to subparagraph (b), the categories of data; pursuant to subparagraph (c), the recipients (or categories of recipients); and pursuant to subparagraph (d), at least the criteria for determining the retention period.In addition to receiving information about the specific data being processed, a data subject also has the right to receive the information specified in Article 15, paragraph 1, subparagraphs (a) through (h) of the GDPR (so-called “meta-information”). This includes, pursuant to subparagraph (a) of the aforementioned provision, the processing purposes; pursuant to subparagraph (b) of the aforementioned provision, the categories of data; pursuant to subparagraph (c), the recipients (or categories of recipients); and pursuant to subparagraph (d), at least the criteria for determining the retention period. As can be seen from the findings, the respondent’s response dated August 12, 2025, did not contain any of this information, thereby confirming that the complaint was also justified on this point. The Data Protection Authority therefore concludes that the respondent violated the complainant’s right of access by providing incomplete information, and thus the complaint must be upheld pursuant to para 24(5) DSG and the violation of rights must be established.The Data Protection Authority therefore concludes that the respondent violated the complainant’s right of access by providing incomplete information, and thus the complaint must be upheld pursuant to paragraph 24(5) of the Data Protection Act (DSG) and the violation of law must be established. D3. Regarding the Mandate (Point 2) If a supervisory authority—as in the present case—concludes at the end of its investigation that the processing does not comply with the requirements of the GDPR, it must, under Union law, adopt appropriate measures to remedy the identified violations (see judgement of the CJEU of March 14, 2024, C-46\u002F23, para. 42). If a supervisory authority—as in the present case —at the conclusion of its investigation, concludes that the processing does not comply with the requirements of the GDPR, it must, under Union law, adopt appropriate measures to remedy the identified infringements; see Judgement of the CJEU of March 14, 2024, C-46\u002F23, para. 42). Pursuant to Article 58(2)(c) of the GDPR, the supervisory authority must instruct controllers to comply with requests from the data subject to exercise the rights granted to them under this Regulation.Pursuant to Article 58(2)(c) of the GDPR, the supervisory authority must instruct controllers to comply with requests from the data subject to exercise the rights granted to them under this Regulation. Consequently, the respondent was to be instructed to fully comply with the complainant’s request for access to information. A deadline of four weeks appears appropriate given the scope of the request. The decision was therefore rendered in accordance with the ruling.","The Austrian Data Protection Authority (DSB) ruled that a therapy association violated a patient's right of access under GDPR. The association failed to disclose personal data contained in handwritten therapist notes and omitted crucial information regarding processing purposes, data categories, recipients, and retention periods. The DSB emphasized that even non-automated data in a structured 'filing system' is subject to GDPR access rights.","Austrian DPA upholds patient's access request against therapy association for incomplete data disclosure.","Help DSB (Austria) - DSB-D124.2437\u002F25: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 20:32, 25 August 2026 view source Stella (talk | contribs)17 edits Tag: Decisions [1.0] (No difference) Latest revision as of 20:32, 25 August 2026 DSB - DSB-D124.2437\u002F25 Authority: DSB (Austria) Jurisdiction: Austria Relevant Law: Article 2 GDPR Article 4(1) GDPR Article 4(2) GDPR Article 4(6) GDPR Article 15(1) GDPR Article 22 GDPR Article 31 GDPR Article 51(1) GDPR Article 57(1)(f) GDPR Article 58(2)(c) GDPR Article 77(1) GDPR Type: Complaint Outcome: Upheld Started: 13.08.2025 Decided: 09.01.2026 Published: 07.07.2026 Fine: n\u002Fa Parties: Meinhard A Verein N***-Therapie National Case Number\u002FName: DSB-D124.2437\u002F25 European Case Law Identifier: ECLI:AT:DSB:2026:2026.0.018.391 Appeal: Unknown Original Language(s): German Original Source: RIS (in DE) Initial Contributor: stella The DSB held that a therapy association violated a patient's right of access by failing to disclose personal data in a therapist's handwritten notes and by omitting required information on purposes, categories, recipients and retention. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The controller, an Austrian registered association, operates a therapy centre for psychosomatic illnesses. The data subject was a patient of the controller. On 28 July 2025, the data subject sent an access request by email under Article 15 GDPR, asking for full information on all personal data processed about him including specific categories of data, processing purposes, recipients, storage periods, data origin, any automated decision-making, a copy of his data in electronic format and what data had been processed by two named individuals (a doctor and a body therapist working for the controller) and whether either had disclosed his data to third parties. The controller's chairperson replied by email on 12 August 2025, attaching a PDF of the data collected from the data subject and a list of medications, noting the data originated from a named doctor and that there was no planned retention period. The reply stated that data recorded by the body therapist existed only in handwritten form and had not been electronically processed and offered to send the data subject a copy by post or email. The reply did not include information on the purposes of processing, categories of data, recipients or categories of recipients, or the criteria used to determine retention periods. The data subject filed a complaint with the Austrian DPA, alleging that the access provided was incomplete. Despite being invited to comment twice by the DPA, the controller did not respond at any point during the proceedings, although a delivery receipt confirmed it had received the correspondence. Holding First, addressing the controller's failure to participate in the proceedings, the DPA held that although it is required to investigate matters on its own initiative, a party's persistent failure to cooperate despite repeated invitations may properly be taken into account in the DPA's free assessment of evidence, rather than obliging the DPA to conduct further investigations of its own accord. On this basis, the DPA treated the data subject's account of events, including that no further information had been provided beyond the 12 August 2025 email, as established. Second, on the scope of the complaint, the DPA reiterated that in a complaint-based procedure, the content of the complaint itself defines and limits the subject matter of the proceedings. The DPA can only rule on what was actually raised. The data subject's complaint was based on the incompleteness of the access provided, specifically regarding the handwritten notes and the missing meta-information. Third, on the handwritten notes, the DPA held that the GDPR's material scope extends not only to automated processing but also to non-automated processing where the data form part of a \"filing system\" under Article 4(6) GDPR defined broadly by the CJEU case-law C-740\u002F22 as any structured collection of personal data accessible according to specific criteria that make data easily retrievable. The DPA held that although the controller had not specified how the therapist's handwritten notes were organised, it could reasonably be assumed that such clinical notes on patients are typically structured by criteria such as name or treatment period to ensure future retrievability, consistent with professional standards of care in the therapeutic field. On this basis, the DPA held that the notes fell within the GDPR's material scope and that the data subject was entitled to access the personal data they contained, so the complaint was well-founded on this point. Fourth, on the missing meta-information, the DPA held that Article 15(1) GDPR entitles a data subject not only to the specific personal data processed but also to the accompanying information listed in Article 15(1)(a)-(h) GDPR, including processing purposes, categories of data, recipients or categories of recipients and criteria for determining storage periods. Since the controller's response of 12 August 2025 included none of this information, the complaint was also well-founded on this point. The DPA accordingly upheld the complaint and found a violation of the right of access. Citing CJEU case-law C-46\u002F23 on the DPA's obligation to adopt appropriate corrective measures once a violation is established, the DPA ordered the controller, under Article 58(2)(c) GDPR, to fully comply with the data subject's access request including disclosure of the handwritten notes and the outstanding meta-information within four weeks. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Text Ref. No.: 2026-0.018.391 dated January 9, 2026 (Case No.: DPA-D124.2437\u002F25) [Note from the processor: Names and company names, legal forms and product names, addresses (including URLs, IP addresses, and email addresses), file numbers (and the like), statistical data, etc., as well as their initials and abbreviations, may have been abbreviated and\u002For altered for pseudonymization purposes. Obvious spelling, grammar, and punctuation errors have been corrected.] DECISION RULING The Data Protection Authority rules on the data protection complaint filed by Meinhard A*** (complainant) on August 13, August 2025, supplemented on 18 August 2025, against the N***-Therapie NGO (Respondent) regarding an alleged violation of the right to access information, as follows: 1. The complaint is upheld, and it is determined that the respondent violated the complainant’s right of access by failing to disclose the complainant’s personal data contained in handwritten notes and by failing to provide the complainant with information regarding the processing purposes, categories of data, recipients or categories of recipients, or the criteria for determining the retention period. 2. The respondent is ordered to provide the complainant, within a period of four weeks or face enforcement, with the personal data contained in handwritten notes, as well as to provide the complainant with information regarding the processing purposes, categories of data, and recipients or categories of recipients, as well as the criteria for determining the retention period. Legal basis: Art. 2, Art. 4(1), (2), and (6), Art. 15(1), Art. 51(1), Art. 57(1)(f), Art. 58(2)(c), and Art. 77(1) of Regulation (EU) 2016\u002F679 (General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of May 4, 2016, p. 1; Sections 18(1) and 24(1) and (5) of the Data Protection Act (DSG), Federal Law Gazette I No. 165\u002F1999, as amended.Legal basis: Article 2, Article 4(1), (2), and (6), Arti","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DSB_(Austria)_-_DSB-D124.2437\u002F25&diff=52791&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F1\u002F1f\u002FLogoAT.png","2026-08-25T20:32:15+00:00","2026-08-25T22:00:17.876793+00:00",7,[18,21,24],{"name":19,"type":20},"DSB","vendor",{"name":22,"type":23},"GDPR","product",{"name":25,"type":23},"handwritten notes","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":26,"icon":28,"name":29,"slug":30},null,"Policy","policy",[32,36,41],{"category":33},{"id":34,"icon":28,"name":22,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":37},{"id":38,"icon":28,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":26,"icon":28,"name":29,"slug":30},[]]