BVwG - W101 2132183-1 and W101 2132039-1: Difference between revisions

Revision as of 09:39, 14 October 2020

BVwG - W101 2132183-1

Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 4(1) GDPR Article 4(7) GDPR Article 12(1) GDPR Article 12(2) GDPR Article 15(1) GDPR Article 15(3) GDPR § 24 DSG § 27 DSG § 4 DSG § 69 DSG
Decided:	11.09.2020
Published:	29.09.2020
Parties:	unknown data subject Google LLC
National Case Number/Name:	W101 2132183-1
European Case Law Identifier:	ECLI:AT:BVWG:2020:W101.2132183.1.00
Appeal from:	DSB DSB-D122.471/0007-DSB/2016
Appeal to:	Unknown
Original Language(s):	German
Original Source:	Rechtsinformationssystem des Bundes (in German)
Initial Contributor:	Marco Blocher

The Austrian Federal Administrative Court held

a) that an (alleged) change of controllership from Google LLC to Google Ireland Limited does not have an ex-tunc effect - Google LLC qualifies as controller for alleged data protection violations that took place before the change of controllership

and

b) that Google is allowed to request a data subject exercising their right to access to log into their Google-account to authenticate the data subject and to provide access to their data using the Google account.

English Summary

Facts

Access request and Google's reply

On 30.100.2015, the data subject (user) sent an access request under § 26 DSG 2000 to Google Inc. (now Google LLC) via registered letter, including a copy of his passport. (§ 26 DSG 2000 used to be the Austrian provsion for access request prior to 25.05.2018.)

On 22.12.2015, Google Inc. replied and asked the user to log into his Google-Accont and use special tool provdided there in order to get access to his data. For data that could not be accessed from the user's account, Google asked him to use an online form.

Complaint with the DSB and decision

On 01.02.2016, the user filed a complaint against Google Inc. with the Austrian Data Protection Authority (DSB) claiming a violation of his right to access under Article 15 GDPR.

On 15.06.2016, that DSB held i.a. that Google Inc. violated Article 15 GDPR by not providing

access to the user's data that has been processed outside the user's Google account;
certain information on data recipients and data sources on data that has been processed outside the user's Google account;
information on automated decision making;
information on the purpose and the legal basis of the processing and
information on data processors.

The DSB also ordered Google Inc. to provide the missing information within 4 weeks.

Google's complaint against the DSB's decion

Google Inc. filed a complaint with the BVwG against the decision of the DSB.

In the course of the pending procedurebefore the BVwG, Google Inc. submitted two statements:

On 13.12.2019 explained that

User's complaint against the DSB's decions - parallel procedure before the BVwG

The DSB also rejected parts of the user's complaint. Against that rejection, the user filed a complaint with the BVwG that was handed in a parallel procedure. More details on that complaint and its outcome can be found here. [Link to be inserted]

Dispute

Lorem ipsum

Holding

Lorem ipsum

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

@@ Line 77: / Line 77: @@
 ===Facts===
-On 30.20.2015, the data subject sent an access request under Article 15 GDPR to Google Inc. (now Google LLC) via registered letter, including a copy of his passport.
-On 22.12.2015, Google Inc. replied and asked the data subject to log into his Google-Account and use special tool provdided there in order to get access to his data. For data that could not be accessed from the user's account, Google asked him to use an online form.
+==== Access request and Google's reply ====
+On 30.100.2015, the data subject (user) sent an access request under § 26 DSG 2000 to Google Inc. (now Google LLC) via registered letter, including a copy of his passport. (§ 26 DSG 2000 used to be the Austrian provsion for access request prior to 25.05.2018.)
-On 01.02.2016, the data subject filed a complaint against Google Inc. with the Austrian Data Protection Authority (DSB) claiming a violation of his right to access under Article 15 GDPR.
+On 22.12.2015, Google Inc. replied and asked the user to log into his Google-Accont and use special tool provdided there in order to get access to his data. For data that could not be accessed from the user's account, Google asked him to use an online form.
-TBC
+==== Complaint with the DSB and decision ====
+On 01.02.2016, the user filed a complaint against Google Inc. with the Austrian Data Protection Authority (DSB) claiming a violation of his right to access under Article 15 GDPR.
+On 15.06.2016, that DSB held i.a. that Google Inc. violated Article 15 GDPR by not providing
-Dispute
+* access to the user's data that has been processed outside the user's Google account;
+* certain information on data recipients and data sources on data that has been processed outside the user's Google account;
+* information on automated decision making;
+* information on the purpose and the legal basis of the processing and
+* information on data processors.
+The DSB also ordered Google Inc. to provide the missing information within 4 weeks.
+==== Google's complaint against the DSB's decion ====
+Google Inc. filed a complaint with the BVwG against the decision of the DSB.
+In the course of the pending procedurebefore the BVwG, Google Inc. submitted two statements:
+* On 13.12.2019 explained that
+==== User's complaint against the DSB's decions - parallel procedure before the BVwG ====
+The DSB also rejected parts of the user's complaint. Against that rejection, the user filed a complaint with the BVwG that was handed in a parallel procedure. More details on that complaint and its outcome can be found here. [Link to be inserted]
+=== Dispute ===
 Lorem ipsum