BVwG - W211 2286882-1

BVwG - W211 2286882-1
Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 15(1) GDPR Article 15(2) GDPR Article 15(3) GDPR
Decided:	22.07.2024
Published:	14.08.2024
Parties:	Datenschutzbehörde
National Case Number/Name:	W211 2286882-1
European Case Law Identifier:	ECLI:AT:BVWG:2024:W211.2286882.1.00
Appeal from:	DSB (Austria)
Appeal to:
Original Language(s):	German
Original Source:	RIS (in German)
Initial Contributor:	fb

The Federal Administrative Court held that, in light of recent CJEU case law, Article 15(3) GDPR does not confer to the data subject a separate and independent right to obtain copies in addition to the information provided according to Article 15(1) GDPR.

English Summary

Facts

In 2022, the data subject (represented by their parents) filed an access request with the DPA. They aimed at accessing some documents concerning an investigation conducted by the DPA on a controller. According to a statement of the DPA, the data subject was not a party in this procedure.

After receiving an answer only partially disclosing the file of this investigation, the data subject filed a complaint with the DPA (which, in this case, acts both as the supervisory authority and the controller), arguing that no complete copy of the documents of the file had been made available.

The DPA rejected this complaint, pointing out that, on the one hand, it had disclosed the information provided for by Article 15(1) and (2) GDPR. On the other hand, the data subject does not have a right to inspect the entire file since they are not a party of this investigation proceeding.

In a separate and previous legal proceeding before the BVwG, the data subject appealed this complaint. In this case, the BVwG did not upheld the complaint. It ruled that the DPA lawfully only partially disclosed the documents contained in the file and that the disclosed parts easily allow the data subject to get the information stated in Article 15(1) and (2) GDPR.

As for Article 15(3) GDPR, the DPA suspended the proceedings, due to the fact that there was a preliminary ruling proceeding before the CJEU under number C-487/21. After the CJEU issued its judgement in case C-487/21, Österreichische Datenschutzbehörde and CRIF, the DPA rejected the data subject’s complaint. It argued that, in light of this judgement, Article 15(3) GDPR does not enshrine an independent right, but merely represents a modality of the provision of information.

Therefore, the data subject appealed the DPA’s decision before the Federal Administrative Court (Bundesverwaltungsgericht – BVwG).

Holding

First, the court noted that in case C-487/21, Österreichische Datenschutzbehörde and CRIF, the CJEU had ruled that Article 15(3) GDPR must be interpreted as meaning that the right to obtain from the controller a copy of the personal data undergoing processing means that the data subject must be given a faithful and intelligible reproduction of all those data.

Furthermore, the CJEU ruled that this right should entail the right to obtain copies from databases which contain those data, if the provision of such a copy is essential in order to enable the data subject to exercise effectively the rights conferred on them by the GDPR, taking also into account the rights and freedoms of others.

Therefore, according to the court, Article 15(3) GDPR does not confer to the data subject a separate and independent right to obtain copies in addition to the information provided according to Article 15(1) GDPR.

As for the case at hand, the court noted that, in its previous judgement, it had already ruled that the DPA had already provided the data subject with the information in full within the meaning of Article 15(1) to 15(3) GDPR in a sufficiently understandable and comprehensible manner.

Therefore, the DPA concluded that – since the data subject’s right of access has already been satisfied – there is no need to provide them with a copy of the documents.

On these grounds, the court ruled that the DPA rightly rejected the complaint concerning the violation of Article 15(3) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Decision date

July 22, 2024

Standard

B-VG Art133 Paragraph 4
GDPR Art15
GDPR Art4 Z2

B-VG Art. 133 today B-VG Art. 133 valid from January 1, 2019 to May 24, 2018 last amended by BGBl. I No. 138/2017 B-VG Art. 133 valid from January 1, 2019 last amended by BGBl. I No. 22/2018 B-VG Art. 133 valid from May 25, 2018 to December 31, 2018 last amended by BGBl. I No. 22/2018 B-VG Art. 133 valid from August 1, 2014 to May 24, 2018 last amended by BGBl. I No. 164/2013 B-VG Art. 133 valid from 01.01.2014 to 31.07.2014 last amended by BGBl. I No. 51/2012 B-VG Art. 133 valid from 01.01.2004 to 31.12.2013 last amended by BGBl. I No. 100/2003 B-VG Art. 133 valid from 01.01.1975 to 31.12.2003 last amended by BGBl. No. 444/1974 B-VG Art. 133 valid from 25.12.1946 to 31.12.1974 last amended by BGBl. No. 211/1946 B-VG Art. 133 valid from 19.12.1945 to December 24, 1946, last amended by StGBl. No. 4/1945 B-VG Art. 133 valid from January 3, 1930 to June 30, 1934

Saying

W211 2286882-1/3E

IN THE NAME OF THE REPUBLIC!

The Federal Administrative Court, through Judge Mag.a Barbara SIMMA LL.M. as chair and the expert lay judge Margareta MAYER-HAINZ and the expert lay judge Dr. Ulrich E. ZELLENBERG as assessors, rightly recognizes the complaint of XXXX , represented by XXXX , against the partial decision of the data protection authority dated XXXX 2024, XXXX :The Federal Administrative Court, through Judge Mag.a Barbara SIMMA LL.M. as chairperson and the expert lay judge Margareta MAYER-HAINZ and the expert lay judge Dr. Ulrich E. ZELLENBERG as assessor and assessor on the complaint of the roman 40 , represented by roman 40 , against the partial decision of the data protection authority of roman 40 2024, roman 40 , rightly:

A)

The complaint is dismissed as unfounded.

B)

The appeal is inadmissible according to Art. 133, Paragraph 4 B-VG.The appeal is inadmissible according to Article 133, Paragraph 4, B-VG.

Text

Reasons for the decision:

I. Course of proceedings: roman one. Course of proceedings:

1. On the preliminary proceedings:

1.1. The minor BF, represented by his parents, submitted a request for information under data protection law to the data protection authority (as DSB) on XXXX 2022. 1.1. The minor BF, represented by his parents, submitted a request for information under data protection law to the Data Protection Authority in the version of the DSB on 40 Roman 2022.

By letter dated XXXX 2022, the DSB provided information and sent a number of copies of documents to the BF. By letter dated 40 Roman 2022, the DSB provided information and sent a number of copies of documents to the BF.

On XXXX 2022, the BF then filed a complaint with the DSB against the DSB in accordance with Art. 77 GDPR and requested that it be determined that the information had been provided inadequately because no complete information had been provided about recipients or categories of recipients to whom personal data had been disclosed and no complete copy of the personal data had been made available. On the second point, the argument of the DSB that only copies or transcripts of the BF's submissions and the DSB's outputs addressed to the BF could be sent to the BF for the ex officio investigation procedure into the DSB's GZ D213.985 against XXXX (as S.L.) due to a lack of party status and existing official secrecy obligations cannot be accepted. On Roman 40, 2022, the BF then filed a complaint with the DSB against the DSB pursuant to Article 77, GDPR, and requested that it be established that the information had been provided inadequately because no complete information had been provided about recipients or categories of recipients to whom personal data had been disclosed and no complete copy of the personal data had been made available. On the second point, the DSB's argument that only copies or transcripts of the BF's submissions and the DSB's outputs addressed to the BF could be sent to the BF for the ex officio review procedure for the DSB's GZ D213.985 against the Roman 40 in the S.L. version due to the lack of party status and existing official confidentiality obligations cannot be accepted.

With a letter dated XXXX 2022, the DSB supplemented the information it had previously provided. With a letter dated Roman 40 2022, the DSB supplemented the information it had previously provided.

1.2. With a partial decision dated XXXX 2022, XXXX , the DSB suspended the proceedings in question to the extent of Art. 15 (3) GDPR due to the preliminary ruling proceedings pending at the time before the ECJ in case C-487/21. 1.2. By partial decision of roman 40 2022, roman 40 , the DSB suspended the proceedings in question to the extent of Article 15, paragraph 3, GDPR due to the preliminary ruling proceedings pending at the time before the ECJ under number C-487/21.

By complaint of XXXX 2022, the BF complained about the illegality of the suspension of the proceedings with regard to Art. 15, paragraph 3, GDPR. By complaint of roman 40 2022, the BF complained about the illegality of the suspension of the proceedings with regard to Article 15, paragraph 3, GDPR.

By decision of XXXX 2023, XXXX , the DSB revoked the decision of XXXX 2023, XXXX , which suspended the proceedings with regard to Art. 15 Paragraph 3 GDPR, and continued the proceedings.By decision of Roman 40 2023, Roman 40 , the DSB revoked the decision of Roman 40 2023, Roman 40 , which suspended the proceedings with regard to Article 15 Paragraph 3 GDPR, and continued the proceedings.

The separate appeal proceedings in this regard were discontinued by decision of the Federal Administrative Court of XXXX 2024, W211 2261563-1/14E. The separate appeal proceedings in this regard were discontinued by decision of the Federal Administrative Court of Roman 40 2024, W211 2261563-1/14E.

1.3. In a partial decision dated XXXX 2022, XXXX , the DSB dismissed the BF's complaint as unfounded. The BF lodged an appeal against this decision.1.3. In a partial decision dated roman 40 2022, roman 40 , the DSB dismissed the BF's complaint as unfounded. The BF lodged an appeal against this decision.

In a preliminary decision on the appeal dated XXXX 2022, XXXX , the DSB amended the ruling of its decision dated XXXX 2022, XXXX , to the effect that it should read: "The complaint is dismissed as unfounded with regard to a violation of Art. 15 Para. 1 and Para. 2 GDPR." In this regard, it stated that the DSB was prohibited, as the BF correctly stated in its appeal, from making a final settlement in view of the suspension of the proceedings under Art. 15 Para. 3 GDPR by the decision. The ruling therefore only has to be directed against Art. 15, paragraphs 1 and 2 of the GDPR. In addition, the DSB confirmed its decision of XXXX 2022, XXXX .With the preliminary decision on the appeal of roman 40 2022, roman 40 , the DSB amended the ruling of its decision of roman 40 2022, roman 40 , to the effect that it should read: "The complaint is dismissed as unfounded with regard to a violation of Article 15, paragraph one and paragraph 2, GDPR." In this regard, it stated that the DSB was prohibited, as the BF correctly stated in its complaint, from making a final settlement in view of the suspension of the proceedings under Article 15, paragraph 3, GDPR. The ruling therefore only has to be directed against Article 15, paragraphs one and 2 of the GDPR. In addition, the DSB confirmed its decision of roman 40 2022, roman 40 .

The DSB supplemented the information it had previously provided with letters dated XXXX 2023 and XXXX 2023.The DSB supplemented the information it had previously provided with letters dated Roman 40 2023 and Roman 40 2023.

1.4. By final decision of the Federal Administrative Court of XXXX 2024, W211 2262850-2/19E, the BF’s appeal against the decision of XXXX 2022, XXXX , as amended by the preliminary appeal decision of XXXX 2022, XXXX , was dismissed as unfounded and the preliminary appeal decision of XXXX 2022 was confirmed with the proviso that its ruling must read: “The appeal is dismissed as unfounded”.1.4. By a final decision of the Federal Administrative Court of roman 40 2024, W211 2262850-2/19E, the BF's appeal against the decision of roman 40 2022, roman 40 , as amended by the preliminary decision on the appeal of roman 40 2022, roman 40 , was dismissed as unfounded and the preliminary decision on the appeal of roman 40 2022 was confirmed with the proviso that its ruling should read: "The appeal is dismissed as unfounded".

2. On the present proceedings:

With the decision of XXXX 2024, XXXX , which is now the subject of the proceedings, the DSB dismissed the BF's appeal on the grounds of an alleged violation of the right to information under Art. 15 (3) GDPR. According to the ECJ ruling in case C-487/21, there is no longer any scope for a separate agreement on Article 15 paragraph 3 of the GDPR, as the provision does not regulate an independent right, but merely represents a modality for providing information. With the decision now at issue in the proceedings, dated Roman 40 2024, Roman 40 , the DSB rejected the BF's complaint on the grounds of an alleged violation of the right to information under Article 15 paragraph 3 of the GDPR. According to the ECJ ruling in case C-487/21, there is no longer any scope for a separate agreement on Article 15 paragraph 3 of the GDPR, as the provision does not regulate an independent right, but merely represents a modality for providing information.

By letter dated XXXX 2024, the BF lodged an appeal against the decision of XXXX 2024, XXXX .By letter dated roman 40 2024, the BF lodged an appeal against the decision of roman 40 2024, roman 40 .

By letter dated XXXX 2024, the DSB submitted the files and the appeal to the Federal Administrative Court for a decision. By letter dated roman 40 2024, the DSB submitted the files and the appeal to the Federal Administrative Court for a decision.

II. The Federal Administrative Court has considered: Roman II. The Federal Administrative Court has considered:

1. Findings:

On XXXX 2022, the BF sent a request for information to the DSB pursuant to Art. 15 GDPR.On Roman 40 2022, the BF sent a request for information to the DSB pursuant to Article 15, GDPR.

The DSB provided the BF with information in letters dated XXXX 2022, XXXX 2022, XXXX 2023 and XXXX 2023.The DSB provided the BF with information in letters dated Roman 40 2022, Roman 40 2022, Roman 40 2023 and Roman 40 2023.

With a partial decision dated XXXX 2022, XXXX , the DSB dismissed the BF's complaint as unfounded. By preliminary decision on the complaint dated XXXX 2022, the DSB amended the ruling of its decision dated XXXX 2022, XXXX , to the effect that it should read: “The complaint is dismissed as unfounded with regard to a violation of Art. 15 (1) and (2) GDPR.” By partial decision dated roman 40 2022, roman 40 , the DSB dismissed the BF’s complaint as unfounded. With the preliminary decision on the appeal of roman 40 2022, the DSB amended the ruling of its decision of roman 40 2022, roman 40 , to the effect that it should read: "The complaint is dismissed as unfounded with regard to a violation of Article 15, paragraph one and paragraph 2, GDPR."

With the final decision of the Federal Administrative Court of XXXX 2024, W211 2262850-2/19E, the BF's complaint against the decision of XXXX 2022, XXXX , as amended by the preliminary decision on the appeal of XXXX 2022, XXXX , was dismissed as unfounded and the preliminary decision on the appeal of XXXX 2022 was confirmed with the proviso that its ruling should read: "The complaint is dismissed as unfounded". By a final ruling of the Federal Administrative Court of roman 40 2024, W211 2262850-2/19E, the BF's appeal against the decision of roman 40 2022, roman 40 , in the version of the preliminary appeal decision of roman 40 2022, roman 40 , was dismissed as unfounded and the preliminary appeal decision of roman 40 2022 was confirmed with the proviso that its ruling must read: "The appeal is dismissed as unfounded".

In this ruling, the Federal Administrative Court stated in part:

" [...] Since the right to be provided with a copy under Art. 15 Para. 3 GDPR is not an independent right but a modality for providing information, this particular aspect of the right to information must be addressed in the present appeal procedure when considering the right to information under Art. 15 Para. 1 and Para. 2 GDPR. (Page 10 of the decision of XXXX 2024). […]" […] Since the right to be provided with a copy according to Article 15, paragraph 3, GDPR is not an independent right, but a modality for providing information, this particular aspect of the right to information must be addressed in the present complaint procedure when considering the right to information according to Article 15, paragraph one and paragraph 2, GDPR. (Page 10 of the decision of Roman 40 2024). […]

The DPO basically informed the BF on XXXX 2022 and on XXXX 2022 that it was processing the BF's personal data specified in the findings in the context of two proceedings conducted by it, a procedure initiated by the BF and an official investigation procedure by the DPO against S.L. (and thus provided information about the information that data was being processed [Art. 15 Para. 1 1st sentence GDPR]; about the categories of personal data [Art. 15 Para. 1 lit. b GDPR] and the processing purposes [Art. 15 Para. 1 lit. a GDPR]). In addition, the DPO provided information about data recipients and processors (cf. Art. 15 Para. 1 lit. c GDPR). The DSB also provided information on the storage period (cf. Art. 15 Para. 1 lit. d GDPR), the rights of those affected (Art. 15 Para. 1 lit. e and f GDPR) as well as on the non-existence of automated decision-making and the transfer of data to a third country or an international organization (Art. 15 Para. 1 lit. h and Para. 2 GDPR). The DPO informed the BF in principle on 40 Roman 2022 and 40 Roman 2022 that it was processing personal data of the BF specified in the findings in the context of two proceedings conducted before it, a procedure initiated by the BF and an ex officio investigation procedure by the DPO against S.L. (and thus provided information about the information that data was being processed [Article 15 paragraph one, first sentence GDPR]; about the categories of personal data [Article 15 paragraph one, letter b, GDPR] and the purposes of processing [Article 15 paragraph one, letter a, GDPR]). In addition, the DPO informed the data recipients and processors (see Article 15 paragraph one, letter c, GDPR). The DSB also provided information on the storage period (see Article 15, paragraph one, letter d, GDPR), the rights of the data subject (Article 15, paragraph one, letters e and f, GDPR) as well as on the absence of automated decision-making and the transfer of data to a third country or an international organization (Article 15, paragraph one, letter h and paragraph 2, GDPR).

In addition, the DSB provided copies, in particular, of the DSB procedure conducted by the BF and, with regard to the DSB's ex officio review procedure, for which the BF is not entitled to inspect the files due to its lack of party status, on XXXX 2022, additionally provided a list of those documents in which the BF's name appears. Finally, on XXXX 2023 and on XXXX 2023, the DSB finally provided copies of partially blacked-out extracts from documents in connection with the ex officio review procedure, including extracts from the statement by S.L. dated XXXX 2020, which it had sent to the DSB as part of the ex officio examination procedure. In addition, the DSB provided copies, in particular of the DSB procedure conducted by the BF, and, with regard to the ex officio examination procedure conducted by the DSB, for which the BF is not entitled to inspect the files due to its lack of party status, on Roman 40 2022, it also provided a list of those documents in which the name of the BF appears. On Roman 40 2023 and on Roman 40 2023, the DSB finally provided copies of partially blacked-out extracts from documents in connection with the ex officio examination procedure, including extracts from the statement of the S.L. dated Roman 40 2020, which it had sent to the DSB as part of the ex officio examination procedure.

In its statement of XXXX 2023, the BF essentially argues that the DPO must have "obviously further information within the meaning of Art. 4 Z 1 GDPR"; the term personal data also includes opinions and assessments. Under the circumstances at hand, the BF's claim extends to all information on the "background" of the S.L.'s activities, which was provided in extracts, in particular as to why "reporting to XXXX in a non-public meeting" was carried out via the BF. In its statement of Roman 40 2023, the BF essentially argues that the DPO must have "obviously further information within the meaning of Article 4, paragraph one, GDPR"; the term personal data also includes opinions and assessments. Under the circumstances at hand, the BF's claim extends to all information on the "background" of the S.L.'s activities, which was provided in extracts, in particular as to why "reporting to Roman 40 in a non-public meeting" was carried out via the BF.

While the BF is correct in that the concept of personal data is to be interpreted broadly (cf. among others Hödl in Knyrim, DatKomm Art 4 DSGVO (as of 1.12.2018, rdb.at) with examples mentioned therein), it cannot be concluded from this, especially after the ECJ ruling on C-487/21, that in any case a complete copy of documents and records containing the BF's personal data must be transmitted in order to fulfill a right to information. While the BF is correct in that the concept of personal data is to be interpreted broadly (see Hödl in Knyrim, DatKomm Article 4, GDPR (as of 1.12.2018, rdb.at) with examples mentioned there), it cannot be concluded from this, especially after the ECJ ruling on C-487/21, that a complete copy of documents and records containing the BF's personal data must be transmitted in order to fulfill a right to information.

If the BF states in its statement of XXXX 2023 that it needs further copies of documents that the S.L. may have submitted in the official proceedings in order to investigate "the 'background' of the S.L.'s activities with regard to the BF", this purpose goes beyond that of the right to information vis-à-vis the DSB. The DPO must - among other things and essentially - provide information on which of the BF's data it processes for what purposes and for how long, from whom it receives them and to whom it transmits them. The fact that this obligation to provide information should also include providing documents on "backgrounds" about the activities of the S.L. cannot be inferred from the wording or the purpose of Art. 15 GDPR (see the purpose of the provision in more detail below). If the BF states in its statement of Roman 40 2023 that it needs further copies of documents that the S.L. may have submitted in the official procedure in order to investigate "'backgrounds' of the activities of the S.L. with regard to the BF", this purpose goes beyond that of the right to information vis-à-vis the DPO. The DPO must - among other things and essentially - provide information on which of the BF's data it processes for what purposes and for how long, from whom it receives them and to whom it transmits them. The fact that this obligation to provide information should also include providing documents on the “background” of the activities of S.L. cannot be deduced from the wording or the purpose of Article 15 of the GDPR (see the purpose of the provision in more detail below).The DPO responded to the BF's argument that it "obviously had further information from the BF in accordance with Art. 4 Z 1 GDPR" and submitted an unredacted extract of the S.L.'s statement to the DPO in the official review procedure, which now also shows specific administrative procedures that the S.L. conducted. Regarding the "'background' of the S.L.'s activities," it further stated that the BF misunderstood the quoted passage from the S.L.'s statement: the quoted passage (which was broken off in the middle) did mention the BF as XXXX, but the quoted sentence and the following, unquoted passages did not refer to him and therefore the DPO did not have to provide a copy to the BF. The DPO responded to the BF's argument that it "obviously had further information from the BF in accordance with Article 4, paragraph one, GDPR" and submitted an unredacted extract of the S.L.'s statement to the DPO in the ex officio review procedure, which now also shows specific administrative procedures that the S.L. conducted. With regard to the "'background' of the S.L.'s activities," it further stated that the BF misunderstood the quoted passage from the S.L.'s statement: the quoted (and broken off in the middle) passage did indeed mention the BF as Roman 40, but the quoted sentence and the subsequent, unreported passages did not refer to him and therefore the DPO did not have to provide a copy to the BF.

The BF then contradicted these statements in a statement dated XXXX 2023 insofar as, in its opinion, the entire statement of the S.L. would concern the BF and therefore should be disclosed. In cases such as the present one, it is essential to provide the BF with a complete reproduction of the aforementioned documents in particular, as otherwise it would not be possible to adequately contextualise the processed data. The DSB's assumption that the BF would misunderstand the statement in the text of the statement is irrelevant; a person without legal capacity does not have to understand the meaning of a "'justification' for why and because of whom XXXX was rumored about him". The BF then contradicted these statements in a statement of Roman 40 2023 insofar as, in his opinion, the entire statement of the S.L. would concern the BF and therefore should be disclosed. In cases such as the present one, it is essential to provide the BF with a complete reproduction of the aforementioned documents in particular, as otherwise it would not be possible to adequately contextualise the processed data. The DSB's assumption that the BF would misunderstand the statement in the text of the statement is irrelevant; a person who is not legally competent does not have to understand the meaning of a "'reason' for why and because of whom rumors were made about him in Roman 40".

First of all, it must be said that there are no indications that the DSB's statements that the further statements by S.L. in the completion of the quote from the S.L.'s statement of XXXX 2020, which is only reproduced in part, are not relevant to the BF and should not be followed. First of all, it must be said that there are no indications that the DSB's statements that the further statements by S.L. in the completion of the quote from the S.L.'s statement of Roman 40 2020, which is only reproduced in part, are not relevant to the BF and should not be followed.

At this point, it should be recalled that according to Art. 15 Para. 4 GDPR, the right to a copy of personal data must not affect the rights and freedoms of others (see also paragraph 43 in the ECJ judgment on C-487/21 of May 4, 2023). In the present case, the BF is demanding the release of complete copies of S.L.'s submissions in a procedure in which the BF itself is not a party. The DPO must therefore agree in principle that in the case of making copies and extracts from the S.L.'s statement in the ex officio review procedure that concern the BF's personal data available, the rights and freedoms of third parties must be taken into account. At this point, it should be recalled that according to Article 15, paragraph 4, GDPR, the right to a copy of personal data must not affect the rights and freedoms of others (see also paragraph 43 in the ECJ judgment on C-487/21 of May 4, 2023). In the present case, the BF is demanding the release of complete copies of S.L.'s submissions in a procedure in which the BF itself is not a party. The DPO is therefore in principle to agree that in the case of making copies and extracts from the S.L.'s opinion available in the ex officio review procedure that concern the BF's personal data, the rights and freedoms of third parties must be taken into account.

The right to information primarily concerns information about the personal data of the data subject and not about that of third parties. Insofar as the BF refers to the Nowak case (judgment of the ECJ of December 20, 2017, C-434/16) in its statement of XXXX 2023, it is correct that the ECJ states that "in circumstances such as those in the main proceedings, the written answers of a candidate in a professional examination and any comments by the examiner on those answers constitute 'personal data' within the meaning of that provision". However, this does not mean that, in the context of fulfilling a request for information under Art. 15 GDPR, the rights and freedoms of third parties must not nevertheless be taken into account in accordance with the statutory provision of Art. 15 (4) GDPR. The right to information primarily concerns information about the personal data of the data subject and not about that of third parties. Insofar as the BF refers to the Nowak case (judgment of the ECJ of December 20, 2017, C-434/16) in its statement of 40 Roman 2023, it is correct that the ECJ states that "in circumstances such as those in the main proceedings, the written answers of a candidate in a professional examination and any comments by the examiner on those answers constitute "personal data" within the meaning of that provision". However, this does not mean that, in the context of fulfilling a request for information under Article 15, GDPR, the rights and freedoms of third parties must not nevertheless be taken into account in accordance with the legal provision of Article 15, paragraph 4, GDPR.

Finally, with regard to the objective of the right to information under data protection law, it should be recalled that the right to information is particularly necessary to enable the data subject to exercise, where appropriate, his or her rights (under the GDPR) to rectification, erasure (“right to be forgotten”) and restriction of processing, which he or she is entitled to under Articles 16, 17 and 18 of the GDPR, as well as his or her right to object to the processing of his or her personal data under Articles 21 of the GDPR or, in the event of damage, his or her right to lodge a judicial remedy under Articles 79 and 82 of the GDPR. The copy of the personal data being processed to be made available by the controller in accordance with Article 15(3) sentence 1 of the GDPR must have all the features that enable the data subject to effectively exercise his or her rights under this Regulation and must therefore reproduce these data completely and faithfully (cf. ECJ on C-487/21, RZ 35 and 39). Finally, with regard to the objective of the right to information under data protection law, it should be recalled that the right to information is particularly necessary to enable the data subject to exercise, where appropriate, their rights (under the GDPR) to rectification, erasure (“right to be forgotten”) and restriction of processing, which they are entitled to under Articles 16, 17 and 18 of the GDPR, as well as their right to object to the processing of their personal data provided for in Article 21 of the GDPR or, in the event of damage, their right to lodge a judicial remedy provided for in Articles 79 and 82 of the GDPR. The copy of the personal data being processed to be made available by the controller in accordance with Article 15, paragraph 3, sentence 1 of the GDPR must have all the features that enable the data subject to effectively exercise their rights under this regulation and must therefore reproduce these data completely and faithfully (see ECJ on C-487/21, RZ 35 and 39).

However, the BF's request to find out about the data protection right to information, what "background" the activities of the S.L." could have and what could be "rumored" about the BF XXXX, goes beyond the objective of the right to information: the right to information is to be understood as a very important but upstream right that enables the exercise of further rights of the data subject. However, the BF's request to find out about the data protection right to information, what "background" the activities of the S.L." could have and what could be "rumored" about the BF Roman 40, goes beyond the objective of the right to information: the right to information is to be understood as a very important but upstream right that enables the exercise of further rights of the data subject.

The BF submitted a request for information pursuant to Art. 15 GDPR to the DPO, which provided the information on XXXX 2022 (including provision of copies), on XXXX 2022 (with additional information on the ex officio investigation procedure against S.L.), on XXXX 2023 (provision of partially redacted extracts from documents from the ex officio investigation procedure) and on XXXX 2023 (with an unredacted extract from documents from the ex officio investigation procedure and additional information on this). The BF submitted a request for information pursuant to Article 15, GDPR to the DSB, which provided the information on Roman 40 2022 (including provision of copies), on Roman 40 2022 (with additional information on the ex officio investigation procedure against S.L.), on Roman 40 2023 (provision of partially redacted extracts from documents from the ex officio investigation procedure) and on Roman 40 2023 (with an unredacted extract from documents from the ex officio investigation procedure and additional information thereon).

The BF is thus in a position to know, among other things, which personal data have been and are being processed by the DSB, for what purposes, for how long, and to which recipients they have been transmitted.

No indications emerged in the proceedings that the DSB had unjustifiably withheld information from the BF about the processing of his personal data, nor that the information provided to him did not enable the BF to exercise his rights as a data subject. On the basis of the information provided, he can assert his rights as a data subject, such as the right to rectification of data, deletion of data, restriction of processing and objection, both against the DSB itself and against the S.L. In particular with regard to the S.L., he was ultimately provided with detailed extracts from the S.L.'s statements in the official review procedure. The information provided thus proves to be sufficiently understandable and comprehensible. Furthermore, it cannot be determined from the BF's submissions why the transmission of further copies from the official examination procedure should be necessary for the exercise of its data subject rights under the regulation. Nor does it emerge substantiated from the submissions of the BF - represented by a lawyer - that a "contextualization" beyond what has already been made available is necessary for the exercise of the further data subject rights under the GDPR.

However, the information provided by the DPO within the meaning of Art. 15 para. 1 - 3 GDPR is therefore complete. [...]" However, the information provided by the DPO within the meaning of Article 15, paragraph one, - 3 GDPR is therefore complete. [...]"

With the decision of XXXX 2024, XXXX, which is being contested here, the DPO rejected the BF's complaint on the grounds of an alleged violation of the right to information under Art. 15 para. 3 GDPR. With the decision contested here, dated roman 40 2024, roman 40 , the DSB rejected the BF's complaint on the grounds of an alleged violation of the right to information under Article 15, paragraph 3, GDPR.

2. Assessment of evidence:

The findings are based on the administrative documents submitted by the DSB, the court file and the decision of the Federal Administrative Court dated XXXX 2024, W211 2262850-2/19E.The findings are based on the administrative documents submitted by the DSB, the court file and the decision of the Federal Administrative Court dated roman 40 2024, W211 2262850-2/19E.

3. Legal assessment:

Re A)

3.1. Key legal bases in extracts:

Article 4 GDPR - Definitions: (…)

2. "Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or linking, restriction, erasure or destruction; (…)

Article 15 GDPR - Right of access of the data subject:

(1) The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed; where this is the case, he or she shall have the right to information about those personal data and to the following information:

a) the purposes of the processing;

b) the categories of personal data being processed;

(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

f) the existence of the right to lodge a complaint with a supervisory authority;

g) where the personal data are not collected from the data subject, all available information as to their origin;

h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

(2) Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

(3) The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on the administrative costs. Where the data subject makes the request electronically, the information shall be provided in a commonly used electronic format, unless the data subject indicates otherwise.

(4) The right to obtain a copy pursuant to paragraph 1b shall not adversely affect the rights and freedoms of others.

3.2.1. The Administrative Court has already repeatedly stated that in the event of a complaint being rejected by the authority concerned, the only issue to be addressed in the appeals procedure is the question of the legality of the rejection (cf. VwGH 18.12.2014, Ra 2014/07/0002, 0003; 23.06.2015, Ra 2015/22/0040, and 16.09.2015, Ra 2015/22/0082 to 0084, each with further references). The Federal Administrative Court was therefore barred from making a substantive decision on the application at issue in the proceedings.3.2.1. The Administrative Court has already repeatedly stated that in the event of a complaint being rejected by the authority concerned, the only issue to be addressed in the appeal proceedings is the question of the legality of the rejection (see VwGH 18.12.2014, Ra 2014/07/0002, 0003; 23.06.2015, Ra 2015/22/0040, and 16.09.2015, Ra 2015/22/0082 to 0084, each with further references). The Federal Administrative Court was therefore barred from making a substantive decision on the application at issue in the proceedings.

3.2.2. As can be seen from the findings, the Federal Administrative Court had already ruled on the BF's request for information in a legally binding decision dated XXXX 2024, W211 2262850-2/19E. The reasons for this finding show that the DSB provided the information in full within the meaning of Article 15, paragraphs 1 - 3 of the GDPR and that this is sufficiently understandable and comprehensible. 3.2.2. As can be seen from the findings, the Federal Administrative Court has already ruled on the BF's request for information with a legally binding decision dated Roman 40 2024, W211 2262850-2/19E. The reasons for this finding show that the DSB provided the information in full within the meaning of Article 15, paragraph 1 - 3 of the GDPR and that this is sufficiently understandable and comprehensible.

Regarding the copy (Article 15 (3) GDPR), the VwGH states, following the ECJ ruling of May 4, 2023 on C-487/21 (ECLI:EU:C:2023:369) (as amended by ECJ C-487/21), that Article 15 (3) sentence 1 GDPR is to be interpreted as meaning that the right to receive a copy of the personal data being processed from the controller means that the data subject is provided with a faithful and intelligible reproduction of all of this data. This right may also include the right to obtain a copy of extracts from documents or even entire documents or extracts from databases containing, among other things, this data, if the provision of such a copy is essential to enable the data subject to effectively exercise the rights conferred on him or her by this Regulation, taking into account the rights and freedoms of others. Art. 15 Para. 3 Sentence 1 GDPR does not grant the data subject an additional - independent - right to copies of extracts from documents, entire documents or extracts from databases containing personal data in addition to the right to information pursuant to Art. 15 Para. 1 GDPR. According to the [...] case law of the ECJ, Art. 15 Para. 3 (Sentence 1) GDPR is (merely) a regulation for the form of information, which is intended to ensure, if necessary, that the information to be provided is provided in an intelligible manner. The right to information pursuant to Art. 15 GDPR - in particular with regard to the principle of transparency pursuant to Recital 58 of the GDPR - is only adequately met under certain circumstances if the data subject is (also) provided by the controller with copies of extracts from documents or even entire documents or extracts from databases containing personal data that are the subject of the processing. When assessing whether such copies must be made available, the circumstances of the individual case are important (VwGH, August 3, 2023, Ro 2020/04/0035). With regard to copies (Article 15, paragraph 3, GDPR), the VwGH states, following the ECJ ruling of May 4, 2023 on C-487/21 (ECLI:EU:C:2023:369) in the version ECJ C-487/21), that Article 15, paragraph 3, sentence 1 GDPR is to be interpreted as meaning that the right to receive a copy of the personal data being processed from the controller means that the data subject is provided with a faithful and intelligible reproduction of all of this data. This right may also include the right to receive a copy of extracts from documents or even entire documents or extracts from databases which, among other things, contain the personal data that are being processed. containing these data, if the provision of such a copy is essential to enable the data subject to effectively exercise the rights conferred on him or her by this Regulation, taking into account the rights and freedoms of others. In addition to the right to information pursuant to Article 15, paragraph 1, GDPR, the data subject does not have an additional - independent - right to copies of extracts from documents, entire documents or extracts from databases containing personal data. According to the [...] case law of the ECJ, Article 15, paragraph 3 (sentence 1) GDPR (merely) represents a regulation for the form of information, which is intended to ensure, where necessary, that the information to be provided is provided in an intelligible manner. The right to information pursuant to Article 15 of the GDPR - in particular with regard to the principle of transparency pursuant to Recital 58 of the GDPR - is only adequately met under certain circumstances if the data subject is provided by the controller with (also) copies of extracts from documents or even entire documents or extracts from databases containing personal data that are the subject of the processing. The assessment of whether such copies are to be made available depends on the circumstances of the individual case (VwGH, August 3, 2023, Ro 2020/04/0035).

In its ruling of XXXX 2024, the Federal Administrative Court, as stated above, dealt with the question of the completeness of the information provided in accordance with Art. 15 Para. 3 GDPR in detail and conclusively and ruled on it with legal effect. This means that there is no longer any room to rule separately on the aspect of the right to information under Art. 15 Para. 3 GDPR, especially since according to the case law of the ECJ and, following it, the VwGH (cf. VwGH, August 3, 2023, Ro 2020/04/0035), Art. 15 Para. 3 Sentence 1 GDPR does not grant the data subject an additional - independent - right to copies in addition to the right to information in accordance with Art. 15 Para. 1 GDPR. In the decision of XXXX 2024, W211 2262850-2/19E, all aspects of the right to information, including Art. 15 Para. 3 GDPR, were addressed and a decision was made. It was therefore no longer necessary to address the BF's further arguments: for the sake of completeness, however, it should be noted that this was already addressed in the decision of XXXX 2024, W211 2262850-2/19E. In its decision of Roman 40 2024, the Federal Administrative Court, as stated above, dealt with the question of the completeness of the information provided in accordance with Article 15, Paragraph 3, GDPR in detail and conclusively and ruled on it with legal effect. This means that there is no longer any scope to discuss the aspect of the right to information under Article 15, Paragraph 3, GDPR separately, especially since according to the case law of the ECJ and, following it, the VwGH (see VwGH, August 3, 2023, Ro 2020/04/0035), Article 15, Paragraph 3, Sentence 1 GDPR does not grant the data subject an additional - independent - right to copies in addition to the right to information under Article 15, Paragraph 1, GDPR. By the decision of Roman 40 2024, W211 2262850-2/19E, all aspects of the right to information, including Article 15, Paragraph 3, GDPR, were dealt with and a decision was made. It was therefore no longer necessary to address the BF's further arguments: for the sake of completeness, however, it should be noted that these were already addressed in the decision of Roman 40 2024, W211 2262850-2/19E.

The DSB was therefore right to reject the data protection complaint due to an alleged violation of the right to information under Art. 15 Paragraph 3 GDPR, which is why the complaint against the decision of XXXX 2024, XXXX , had to be dismissed.The DSB was therefore right to reject the data protection complaint due to an alleged violation of the right to information under Article 15 Paragraph 3 GDPR, which is why the complaint against the decision of Roman 40 2024, Roman 40 , had to be dismissed.

3.3. An oral hearing - which had not been requested - could be dispensed with in accordance with Section 24 Paragraph 2 Item 1 VwGVG, since the party's application initiating the previous administrative procedure - in this case the data protection complaint of the Federal Administrative Court with regard to the alleged violation of the right to information under Article 15 Paragraph 3 GDPR - had to be rejected. In addition, the Federal Administrative Court had to rule exclusively on a legal question (cf. ECHR 20.6.2013, Appl. No. 24510/06, Abdulgadirov/AZE, para. 34 ff.); the facts to be examined are established. Neither Article 6 Paragraph 1 ECHR nor Article 47 of the Charter of Fundamental Rights prevent the hearing from being dispensed with.3.3. An oral hearing - which was not requested - could be omitted according to paragraph 24, paragraph 2, number one, VwGVG, since the party's application initiating the previous administrative procedure - in this case the BF's data protection complaint with regard to the alleged violation of the right to information under Article 15, paragraph 3, GDPR - had to be rejected. In addition, the Federal Administrative Court had to rule exclusively on a legal question (see ECHR 20.6.2013, Appl. No. 24510/06, Abdulgadirov/AZE, para. 34 ff); the facts to be examined are established. Neither Article 6, paragraph one, ECHR nor Article 47, GRC prevent the hearing from being omitted.

B) Inadmissibility of the appeal:

According to Section 25a, Paragraph 1 of the Administrative Court Act, the administrative court must state in its ruling or decision whether the appeal is admissible in accordance with Article 133, Paragraph 4 of the Federal Constitutional Court Act. The ruling must be briefly justified.According to Paragraph 25a, Paragraph 1 of the Administrative Court Act, the administrative court must state in its ruling or decision whether the appeal is admissible in accordance with Article 133, Paragraph 4 of the Federal Constitutional Court Act. The ruling must be briefly justified.

According to Article 133, Paragraph 4 of the Federal Constitutional Court Act, the appeal is not admissible because the decision does not depend on the solution of a legal question that is of fundamental importance. The decision in question neither deviates from the previous case law of the Administrative Court, nor is there no case law (see in particular the case law presented above under 3. on the subject matter of the proceedings); furthermore, the present case law of the Administrative Court cannot be judged to be inconsistent. There are also no other indications of a fundamental importance of the legal question to be resolved. The appeal is not admissible according to Article 133, paragraph 4, B-VG because the decision does not depend on the solution of a legal question that is of fundamental importance. The decision in question does not deviate from the previous case law of the Administrative Court, nor is there a lack of case law (see in particular the case law presented above under 3. on the subject matter of the proceedings); furthermore, the present case law of the Administrative Court cannot be judged to be inconsistent. There are also no other indications of a fundamental importance of the legal question to be resolved.

Furthermore, an examination had to be carried out based on the circumstances of the individual case.

Overall, the decision had to be made in accordance with the ruling.