BVwG - W245 2226261-1: Difference between revisions

Revision as of 16:10, 18 May 2022

BVwG - W245 2226261-1

Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 57(4) GDPR
Decided:	24.03.2022
Published:	03.05.2022
Parties:	anonymous DSB (Austria)
National Case Number/Name:	W245 2226261-1
European Case Law Identifier:	ECLI:AT:BVWG:2022:W253.2226261.1.00
Appeal from:
Appeal to:
Original Language(s):	German
Original Source:	Rechtsinformationssystem des Bundes (RIS) (in German)
Initial Contributor:	Heiko Hanusch

The Austrian Federal Court held that the Austrian DPA was not allowed to reject a complaint as excessive. In particular, the DPA did not demonstrate that the specific complaint was similar to the other 86 filed by the same data subject.

English Summary

Facts

The controller is a psychotherapist and the data subject is his patient. About for years after the therapy had been stopped, the data subject requested access to his data. The therapist replied that no personal data was undergoing processing. The data subject was skeptical and filed a complaint with the Austrian DPA (DSB). The DSB considered the complaint excessive because 86 other complaints lodged by the data subject were still pending with it and therefore rejected to handle the complaint under Article 57(4) GDPR. The data subject appealed this decision to the Austrian Federal Court (Bundesverwaltunsgericht – BVwG). During the court proceedings, the DSB provided the court with a list of all pending cases which did not mention the content of the cases.

Holding

The Austrian Federal Court held that the rejection by the DSB was unlawful because the DSB failed to show that the present complaint and the past complaints were homogeneous. The court clarified that, according to the last sentence of Article 57(4) GDPR, the DPA bears the burden of demonstrating the excessive character of the request. The court then found that the amount of complaints is an important factor in determining whether a complaint is excessive. However, it also reasoned that the complaint must be of repetitive character which only occurs when the present complaint and the previous ones are (nearly) identical. In the present case, the court concluded that DPA did not show that the complaints were (nearly) identical since it only provided a list of the complaints pending without describing their the content and similarities.

Comment

The court sometimes spoke of "similar/homogeneous" and sometimes of "(nearly) identical", apparently meaning the same thing. The court did not take into account that Article 57(4) GDPR speaks of “in particular” when referring to the repetitive character as an example of an excessive request indicating that there are also other circumstances which can render a request excessive.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Postal address:
Erdbergstrasse 192 – 196
1030 Vienna
Phone: +43 1 601 49-0
Fax: + 43 1 711 23-889 15 41
Email: einlaufstelle@bvwg.gv.at

www.bvwg.gv.at

DECISIONS D A T U M

2 4 . 0 3 . 2 0 2 2

BUSINESS NUMBER

W 2 5 3 2 2 2 6 2 6 1 - 1/8 E

I M N A M E N D E R E P U B L I K !

The Federal Administrative Court has judge Mag. Jörg C. Binder as chairman and
the expert lay judges Gerhard Raub and Dr. Ulrich ZELLENBERG as assessor on the

Complaint by XXXX XXXX against the decision of the data protection authority of 06/11/2019
XXXX rightly recognized:

a)

The complaint will be followed, the contested decision will be remedied and the one prosecuted
Authority ordered to continue the lawful process.

b)

The revision is permitted in accordance with Art. 133 Para. 4 B-VG., - 2 -

Reasons for decision:

I. Procedure:

By letter dated October 26th, 2021, subject “Privacy complaint information XXXX turned to

XXXX (hereinafter complainant) to the data protection authority (hereinafter

relevant authority).

In summary, the complainant submitted an application on May 19, 2019

to have provided information about his data to the psychotherapist Mr. XXXX. In the year
In 2015, the complainant had his last consultation with Mr. XXXX

The complainant also attended the course years ago in a professional context

"Group dynamic processes - learn to lead groups!" Visited by Mr. XXXX. Mr. Mag.
XXXX replied to the complainant with an email dated 06/01/2019, no more data

on the person of the complainant from the professional cooperation with him

to have.

Subject to his right to information, the complainant sent an email dated

October 26, 2021 to the authority concerned and filed a complaint against XXXX.Mr. XXXX

was a psychotherapist and had at least ten years from the end of the care service
Retention periods according to § 16a Abs. 3 PsthG and § 35 Abs. 3 PG 2013. According to § 132 BAO

would have XXXX according to tax law and corporate law standards

Retention requirements of at least seven years. The ABGB see a statute of limitations
from three years ago. The complainant has a right to information. Mr. XXXX is this

As a psychotherapist, he has not complied with his obligation to provide information.

With the decision of November 6th, 2019, XXXX, the competent authority rejected the treatment of the

Complaint in accordance with Art. 57 Para. 4 GDPR and stated that the

Complainant made a first complaint to the data protection authority on 06/14/2018,
which was recorded under the reference number D123.021. Since this

At that time, the complainant had 86 further procedures specified in more detail in the decision

pending. The majority of them have unlawful processing of the data of the
Complainant and his underage son on the content.

For all complaints, the complainant accuses different persons responsible

or respondent to incorrect processing of his data and the data of his, - 3 -

minor son. This argument, always the same, by the complainant was in
In view of the facts to see that the minor son is his ordinary

no longer stay with the complainant in Austria and the complainant

was also no longer entitled to custody of his son. For all complaints of
Complainant is addressed that his personal data as well as the

personal data of his underage son through various public and

private bodies in Austria and Italy - also incorrectly reproduced by XXXX
or processed. In addition, the complainant has numerous

Complaints against the received data protection information from various public

and private bodies brought to the data protection authority, which, in the opinion of the
complainant in the allegedly inadmissible processing of his data and

the data of his underage son are involved. The authorities concerned therefore have priority

against the background of the total number of complaints submitted and the
Complainant himself stated the core of his complaint, in which it always

to the allegation of incorrect reproduction or processing of his data and

of the data of his underage son go through various responsible persons, from
a "frequent repetition" within the meaning of Art. 57 Para. 4 GDPR.

The complainant appealed against this decision in a letter dated November 24, 2019
timely complaint, which the competent authority on 06.12.2019 dem

was submitted to the Federal Administrative Court. As far as relevant to the procedure, the

Complainant stated that the application against XXXX was obviously not unfounded or
excessive, for example, this states that at the beginning of 2016 there were professional data on

person of the complainant. The blanket reference to other procedures

have no probative value with regard to the reasoning of the authority concerned in the
the present proceedings. The complainant is concerned with the violation of a right

for information. Contrary to the assertions of the authority concerned, he did not believe

that XXXX is processing personal data relating to his underage son. Of the
In these proceedings, the complainant is merely violating his right to information

applicable to the authority concerned. A case of Art. 57 Para. 4 GDPR does not exist

before, since neither a "recurrence" nor a "frequent repetition" is given., - 4 -

II. The Federal Administrative Court considered:

The complaint is justified to the extent evident in the decision:

1. Findings:

The complainant addressed the relevant authority in a letter dated October 26, 2021
and essentially argued that his right to information had been violated by XXXX

be.

The authority concerned rejected the treatment of these with a decision dated November 6th, 2019, XXXX
Complaint according to Art. 57 Para. 4 GDPR, since as of 16.10.2019

File management system ELAK 86 files relating to the complainant and

various respondents were conducted. Therefore, the authority concerned went by
excessive use of the right to lodge a complaint.

It is found that in the tabular led by the competent authority

List of the procedures recorded by her for this complainant, the content and
the respective requests for these complaints are not evident. Furthermore, it is determined

that none of the above proceedings were conducted against XXXX.

With a complaint dated November 24, 2019, the complainant made the
violation of his right to information and not as claimed by the authority concerned

alleges the incorrect processing of the data of his underage son.

2. Evidence assessment:

The above statements are based on an inspection of the

administrative act submitted to the authority concerned, the administrative court act,
the decision of the competent authority and the complainant's complaint.

3. Legal assessment:

to A)

The subject of the proceedings is the question of whether the requirements of Art. 57 (4) GDPR

are met and the refusal of the respondent to deal with the complaint
authority was rightly done., - 5 -

The governing provision of REGULATION (EU) 2016/679 OF THE EUROPEAN
PARLIAMENTS AND COUNCIL of April 27, 2016 on the protection of natural persons at the

Processing of personal data, the free movement of data and the cancellation of the
Directive 95/46/EG (General Data Protection Regulation, hereinafter referred to as GDPR).
excerpt as follows:

"Art. 57 para. 4 GDPR

In the case of manifestly unfounded or — in particular in the case of frequent repetition —

excessive requests, the supervisory authority may charge a reasonable fee on the
Request based on administrative costs or refuse to act on the basis of the request
to become. In this case, the supervisory authority bears the burden of proof for the obvious

unreasonable or excessive nature of the request.”

The data protection complaint relates to a request for information from the

Psychotherapists XXXX which the applications to assert the right to

Information pursuant to Art. 13 et seq. GDPR and the right to information pursuant to Art. 15 GDPR
was complete, incorrect and untimely.

According to Art. 57 Para. 4 GDPR, last sentence, the authority bears the burden of proof for the obvious
unfounded or excessive nature of the request. In the present case, the

authority on the total number of complaints submitted and the

Complainants have always alleged violations of a large number of rights
the processing of the data of his underage son by various

Respondent against whom he had also made numerous requests for information.

The investigative process of the authority concerned is limited to the literal

Reproduction of the complainant's attachment and a list of the

complaints pending by the complainant and the determination that
that the bulk of the complaints submitted by the complainant concern the processing

of the data of his underage son. As the primary core of the complaint to the

The authority concerned will be accused of incorrect reproduction by the authority
or processing of the data of the complainant and the data of his

underage son defined by various responsible persons, against which - as well
In the present case, numerous requests for information had been made. This question

according to the official statements, the majority of the others are with her

Appellant's pending proceedings based. From the point of view of the authority is one
Basic protection no longer to be assumed.

The competent authority is to concede that the complainant has a not inconsiderable

number of attachments addressed to them. The senate responsible for the decision fails to recognize - 6 -

not the fact that the problem smoldering in the background about the custody of the
minor son of the complainant the starting point of numerous complaints

appears to be with the data protection authority. From the point of view of the Senate responsible for the decision

However, the authority has the proof to be provided by the mere reproduction of the
Attachment of the complainant, the tabular list of her to this

Complainant logged procedures and the presentation of the official

assumedor assumedmotiveofthecomplainant,notdelivered.Itwouldhave
at least an overview of the content of the relevant authority

pending proceedings and their similarity (explanation that the requested information

is already the subject of numerous proceedings). From the authority concerned
submitted tabular list of the procedures logged with her

Complainant is not clear what content these complaints had and whether these

actually had numerous requests for information on the subject. The Regulatory Authority
can only reject applications if they are manifestly unfounded or disproportionate

where the volume of applications plays an important role (Nguyen in Gola, Datenschutz-

Basic Ordinance, 2nd edition, Art. 57 margin no. 16). An application after the is excessive
Legal wording of Art. 12 Para. 5 S.2, if it is repeated too often (Franck in Gola,

General Data Protection Regulation, 2nd edition, Art. 12Rz35).
considered if the applicant despite lawful information or rejection

the person responsible submits further (almost) identical applications (Heckmann/Paschke

in Ehmann/Selmayr, General Data Protection Regulation, 2nd edition, Art. 12 margin no. 43). That the
procedural application is almost identical to the other applications, it follows

from the explanations given by the authority concerned. The authority concerned came to her

Burden of proof that the complainant's numerous applications are
identical applications is therefore not sufficiently followed up.

This results in the contested decision being remedied and the execution of the
lawful procedure by the authority.

It was therefore to be decided accordingly.

Re B) Admissibility of the revision:, - 7 -

According to § 25a Abs. 1 VwGG, the administrative court in the ruling of its knowledge or
Pronounce a resolution as to whether the revision is permissible in accordance with Art. 133 Para. 4 B-VG. Of the

Statement must be briefly justified.

The revision is admissible according to Art. 133 Para. 4 B-VG because the decision of the solution

depends on a legal question, there is no jurisdiction of the Administrative Court.

@@ Line 62: / Line 62: @@
 }}
-The Austrian Federal Court held that the Austrian DPA was not allowed to reject a complaint as excessive, because it failed to establish that the complaint was similar to the other 86 complaints raised by the same complainant.
+The Austrian Federal Court held that the Austrian DPA was not allowed to reject a complaint as excessive. In particular, the DPA did not demonstrate that the specific complaint was similar to the other 86 filed by the same data subject.
 == English Summary ==