BVwG - W137 2324046-1
From GDPRhub
| BVwG - W137 2324046-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 4 GDPR Article 55 GDPR Article 56 GDPR Article 60 GDPR Article 77 GDPR § 24 DSG |
| Decided: | 04.03.2026 |
| Published: | 25.03.2026 |
| Parties: | DPA Data subject |
| National Case Number/Name: | W137 2324046-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2026:W137.2324046.1.00 |
| Appeal from: | DSB (Austria) |
| Appeal to: | Not appealed |
| Original Language(s): | German |
| Original Source: | RIS (in German) |
| Initial Contributor: | Ava Lang |
A court held that, in accordance with national procedural law, the six-months period in which the DPA has to decide on a complaint is suspended in case of a cross-border case.
English Summary
Facts
The data subject filed a complaint with a DPA on 18 June 2024 under Article 77 GDPR. The complaint concerned a controller established in another Member State and alleged an incomplete response to an access request under Article 15 GDPR.
The DPA did not issue a decision within six months. On 26 August 2025, the data subject lodged a complaint with the court, claiming that the DPA had failed to comply with its obligation to decide within the statutory deadline.
The DPA argued that the case involved cross-border processing and that another supervisory authority acted as the lead authority under Article 56 GDPR. It further stated that the decision deadline was suspended due to the cooperation procedure under Article 60 GDPR. The DPA formally transmitted the complaint to the lead authority on 22 October 2025.
Holding
First, the court held that the case concerned cross-border processing within the meaning of Article 4(23) GDPR. Therefore, the cooperation and consistency mechanism under Articles 56 and 60 GDPR applied, making the foreign supervisory authority the lead authority.
Second, the court considered that, in such cases, the competence to issue a final decision depends on the outcome of the cooperation procedure. It noted that only the lead authority can adopt binding decisions concerning cross-border processing, while other DPAs act as concerned authorities.
Third, the court held that the decision period under national law was suspended pursuant to § 24 DSG during the cooperation procedure under Articles 56 and 60 GDPR. The court clarified that this suspension applied automatically from the moment the complaint was filed, not only after the formal initiation of cooperation between authorities.
Finally, the court concluded that the DPA had not failed to act within the required time frame. As a result, there was no violation of the duty to decide, and the complaint was dismissed.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Decision Date
March 4, 2026
Legal Norm
Federal Constitutional Law (B-VG) Art. 130 para. 1 no. 3
Federal Constitutional Law (B-VG) Art. 133 para. 4
Data Protection Act (DSG) § 24
General Data Protection Regulation (GDPR) Art. 4
General Data Protection Regulation (GDPR) Art. 55
General Data Protection Regulation (GDPR) Art. 56
General Data Protection Regulation (GDPR) Art. 60
General Data Protection Regulation (GDPR) Art. 77
Administrative Court Procedure Act (VwGVG) § 8
Federal Constitutional Law (B-VG) Art. 130 currently in force; Federal Constitutional Law (B-VG) Art. 130 valid from February 1, 2019, last amended by Federal Law Gazette I No. 14/2019; Federal Constitutional Law (B-VG) Art. 130 valid from January 1, 2019 to January 31, 2019, last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 130 valid from January 1, 2019 to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017 Article 130 of the Austrian Federal Constitutional Law (B-VG) valid from May 25, 2018 to December 31, 2018, last amended by Federal Law Gazette I No. 22/2018; Article 130 of the Austrian Federal Constitutional Law (B-VG) valid from January 1, 2015 to May 24, 2018, last amended by Federal Law Gazette I No. 101/2014; Article 130 of the Austrian Federal Constitutional Law (B-VG) valid from January 1, 2014 to December 31, 2014, last amended by Federal Law Gazette I No. 115/2013; Article 130 of the Austrian Federal Constitutional Law (B-VG) valid from January 1, 2014 to December 31, 2013, last amended by Federal Law Gazette I No. 51/2012; Article 130 of the Austrian Federal Constitutional Law (B-VG) valid from January 1, 2004 to December 31, 2013, last amended Article 130 of the Federal Constitutional Law (B-VG) was valid from January 1, 1998 to December 31, 2003, last amended by Federal Law Gazette I No. 87/1997. Article 130 was valid from January 1, 1991 to December 31, 1997, last amended by Federal Law Gazette No. 685/1988. Article 130 was valid from July 1, 1976 to December 31, 1990, last amended by Federal Law Gazette No. 302/1975. Article 130 was valid from July 18, 1962 to June 30, 1976, last amended by Federal Law Gazette No. 215/1962. Article 130 was valid from 25.12.1946 to 17.07.1962, last amended by Federal Law Gazette No. 211/1946, Federal Constitutional Law Art. 130, valid from 19.12.1945 to 24.12.1946, last amended by State Law Gazette. No. 4/1945 B-VG Art. 130 valid from January 3, 1930 to June 30, 1934
B-VG Art. 133 today B-VG Art. 133 valid from January 1, 2019 to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017 B-VG Art. 133 valid from January 1, 2019, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 valid from May 25, 2018 to December 31, 2018, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 valid from August 1, 2014 to May 24, 2018, last amended by Federal Law Gazette I No. 164/2013 B-VG Art. 133 valid from 01.01.2014 to 31.07.2014, last amended by BGBl. I No. 51/2012; B-VG Art. 133 valid from 01.01.2004 to 31.12.2013, last amended by BGBl. I No. 100/2003; B-VG Art. 133 valid from 01.01.1975 to 31.12.2003, last amended by BGBl. No. 444/1974; B-VG Art. 133 valid from 25.12.1946 to 31.12.1974, last amended by BGBl. No. 211/1946; B-VG Art. 133 valid from 19.12.1945 to Last amended by the Federal Law Gazette on 24 December 1946. No. 4/1945 B-VG Art. 133 valid from January 3, 1930 to June 30, 1934
DSG Art. 2 § 24 now DSG Art. 2 § 24 valid from July 15, 2024, last amended by Federal Law Gazette I No. 70/2024; DSG Art. 2 § 24 valid from May 25, 2018 to July 14, 2024, last amended by Federal Law Gazette I No. 120/2017; DSG Art. 2 § 24 valid from January 1, 2010 to May 24, 2018, last amended by Federal Law Gazette I No. 133/2009; DSG Art. 2 § 24 valid from January 1, 2000 to December 31, 2009
VwGVG Section 8 of the Administrative Court Procedure Act (VwGVG) is valid from January 1, 2014.
Ruling
W137 2324046-1/3E
IN THE NAME OF THE REPUBLIC!
The Federal Administrative Court, composed of Judge Peter Hammer, M.Sc., presiding, and lay judges Ursula Illibauer, M.Sc., and Martina Chlestil, M.Sc., as associate judges, has ruled on the appeal of XXXX, represented by SUMMER SCHERTLER KAUFMANN Rechtsanwälte GmbH, concerning a breach of the Data Protection Authority's duty to decide on the data protection complaint of June 18, 2024, as follows:
A)
The appeal is dismissed pursuant to Section 130 Paragraph 1 Item 3 of the Federal Constitutional Law (B-VG) in conjunction with Section 8 The appeal is dismissed as unfounded pursuant to Section 130, paragraph 1, number 3, of the Federal Constitutional Law (B-VG) in conjunction with Section 8 of the Administrative Court Procedure Act (VwGVG) as amended.
B)
The appeal on points of law is inadmissible pursuant to Article 133, paragraph 4, of the Federal Constitutional Law (B-VG).
Text
Grounds for the decision:
I. Procedural History:
1. By means of a preliminary submission dated June 18, 2024, the complainant filed a data protection complaint with the Data Protection Authority (hereinafter also referred to as the respondent authority) pursuant to Article 77 GDPR against XXXX for a violation of her right of access pursuant to Article 15 GDPR. In support of her complaint, the complainant stated that she had submitted a request for access to XXXX, but that XXXX had not fully complied. By a procedural submission dated June 18, 2024, the complainant filed a data protection complaint with the Data Protection Authority (hereinafter also referred to as the respondent authority) pursuant to Article 77 GDPR against Rome 40 for a violation of her right of access under Article 15 GDPR. The complainant stated that she had submitted a request for access to Rome 40, but that the authority had not fully complied.
2. On August 26, 2025, the complainant filed the present complaint of failure to act with the respondent authority, referring to the data protection complaint filed on June 18, 2024, because the respondent authority had failed to comply with its obligation to make a decision within six months.
2. 3. By letter dated October 23, 2025, received on October 29, 2025, the Data Protection Authority forwarded the complaint for failure to act, along with the administrative act, to the Federal Administrative Court. The letter stated, in particular, that due to the cross-border processing, the Maltese supervisory authority was presumably the lead supervisory authority responsible for the proceedings under Article 60 GDPR, and that the time limit for a decision was suspended for the duration of these proceedings. This suspension did not take effect only upon the initiation of the proceedings under Articles 56 and 60 GDPR by the Data Protection Authority, but rather upon the filing of the complaint. Reference was made to relevant decisions of the Federal Administrative Court. 3. By letter dated October 23, 2025, received on October 29, 2025, the Data Protection Authority forwarded the complaint for failure to act, along with the administrative act, to the Federal Administrative Court. The decision stated, in particular, that due to the cross-border processing, the Maltese supervisory authority was presumably the lead supervisory authority responsible for the proceedings under Article 60 GDPR, and that the time limit for a decision was suspended for the duration of these proceedings. This suspension did not begin only upon the initiation of the proceedings under Articles 56 and 60 GDPR by the Data Protection Authority (DPA), but rather upon the filing of the complaint. Reference was made to corresponding decisions of the Federal Administrative Court.
II. The Federal Administrative Court considered the following:
1. Findings:
The data protection complaint filed by the complainant on June 18, 2024, is directed against XXXX, located in XXXX, for a violation of the right of access under Article 15 GDPR. Subsequently, on August 26, 2025, the complainant filed a complaint alleging a breach of the respondent authority's duty to decide, pursuant to Section 8(1) of the Administrative Court Procedure Act (VwGVG). The complainant's data protection complaint, filed on June 18, 2024, was directed against Rome 40, located in Rome 40, concerning a violation of the right of access under Article 15 of the GDPR. Subsequently, on August 26, 2025, the complainant filed a complaint alleging a breach of the respondent authority's duty to decide, pursuant to Section 8(1) of the VwGVG.
By letter dated October 22, 2025, the respondent authority forwarded the complainant's data protection complaint to the Maltese supervisory authority established under the GDPR via the IT cooperation platform "Internal Market Information System" (IMI) and informed the authority that it had accepted the Maltese authority as the lead supervisory authority.
``` The data protection authority had not yet initiated proceedings pursuant to Articles 56 and 60 of the GDPR at the time the complaint for failure to act was filed.
2. Evaluation of Evidence:
The findings are based on the unobjectionable contents of the file, in particular the complainant's data protection complaint of June 18, 2024, the complaint for failure to act of August 26, 2025, and the IMI Report No. 839727.1, dated October 22, 2025, which is included in the administrative file.
3. Legal Assessment:
3.1. Pursuant to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court decides by a single judge, unless federal or state law provides for a decision by a panel. According to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court decides by a single judge unless federal or state law provides for a decision by a panel.
According to Section 27 Paragraph 1 of the Data Protection Act (DSG), the Federal Administrative Court decides by panel on appeals against decisions concerning violations of the duty to provide information pursuant to Section 24 Paragraph 7 of the DSG and the duty of the data protection authority to make a decision. According to Section 27 Paragraph 2 Sentence 1 of the DSG, the panel consists of a presiding judge and one lay judge each from the employer and employee sectors. Therefore, the case falls within the jurisdiction of the panel. According to Section 27 Paragraph 1 of the DSG, the Federal Administrative Court decides by panel on appeals against decisions concerning violations of the duty to provide information pursuant to Section 24 Paragraph 7 of the DSG and the duty of the data protection authority to make a decision. According to Section 27, Paragraph 2, first sentence of the Data Protection Act (DSG), the Senate consists of a presiding judge and one lay judge each from the employer and employee sectors. Therefore, the Senate has jurisdiction in this case.
The procedures of the administrative courts, with the exception of the Federal Fiscal Court, are governed by the Administrative Court Procedure Act (VwGVG), Federal Law Gazette I 2013/33 as amended by Federal Law Gazette I 2013/122 (Section 1 of the aforementioned Act). According to Section 59, Paragraph 2 of the Administrative Court Procedure Act, conflicting provisions that were already promulgated at the time this Federal Act entered into force remain in effect. The procedures of the administrative courts, with the exception of the Federal Fiscal Court, are governed by the Administrative Court Procedure Act (VwGVG), Federal Law Gazette I 2013/33 as amended by Federal Law Gazette I 2013/122 (Section 1 of the aforementioned Act). According to Section 59, Paragraph 2, VwGVG, conflicting provisions that were already published at the time this federal law came into force shall remain in force.
Pursuant to Section 17 of the Administrative Court Procedure Act (VwGVG), unless otherwise provided in this Federal Act, the provisions of the General Administrative Procedure Act (AVG), with the exception of Sections 1 to 5 and Part IV, the provisions of the Federal Fiscal Code (BAO), Federal Law Gazette No. 194/1961, the Agricultural Procedure Act (AgrVG), Federal Law Gazette No. 173/1950, and the Civil Service Procedure Act 1984 (DVG), Federal Law Gazette No. 29/1984, and, in all other respects, those procedural provisions in federal or state laws that the authority applied or would have had to apply in the proceedings preceding the proceedings before the Administrative Court, shall apply mutatis mutandis to the proceedings concerning appeals pursuant to Article 130, paragraph 1, of the Federal Constitutional Law (B-VG). 5, as well as the provisions of Part Four, the Federal Fiscal Code (BAO), Federal Law Gazette No. 194 of 1961, the Agricultural Procedure Act (AgrVG), Federal Law Gazette No. 173 of 1950, and the Civil Service Procedure Act 1984 (DVG), Federal Law Gazette No. 29 of 1984, and, moreover, those procedural provisions in federal or state laws that the authority applied or would have had to apply in the proceedings preceding the proceedings before the Administrative Court, shall be applied mutatis mutandis.
3.2. Pursuant to Section 31 Paragraph 1 of the Administrative Court Procedure Act (VwGVG), decisions and orders are issued by resolution, unless a judgment is to be rendered.
3.2. Pursuant to Section 31 Paragraph 1 of the Administrative Court Procedure Act (VwGVG), decisions and orders are issued by resolution, unless a judgment is to be rendered. Pursuant to Section 28 Paragraph 1 of the Administrative Court Procedure Act (VwGVG), the Administrative Court must decide the case by judgment, unless the appeal is to be dismissed or the proceedings discontinued. According to Section 28, Paragraph 1, of the VwGVG, the Administrative Court must decide the case by judgment, unless the appeal is to be dismissed or the proceedings discontinued.
Regarding A)
3.3. The relevant provisions of the GDPR:
Article 4
Definitions
For the purposes of this Regulation, the following terms shall apply:
1.-6. (...)
7. ‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for by Union or Member State law;
8.-20. (…)
21. ‘Supervisory authority’ means an independent public authority established by a Member State pursuant to Article 51;
22. ‘Supervisory authority concerned’ means a supervisory authority which is affected by the processing of personal data because
(a) the controller or processor is established in the territory of the Member State of that supervisory authority,
(…)
23. ‘Cross-border processing’ means either
(a) processing of personal data which takes place in the context of the activities of establishments of a controller or processor in the Union in more than one Member State, where the controller or processor is established in more than one Member State, or
(…)
24-26. (…)
Article 55
Competence
(1) Each supervisory authority shall be competent to perform the tasks and exercise the powers conferred on it by this Regulation within the territory of its own Member State.
(…)
Article 56
Competence of the lead supervisory authority
(1) Without prejudice to Article 55, the supervisory authority of the main establishment or the sole establishment of the controller or processor shall be the competent lead supervisory authority for cross-border processing carried out by that
controller or processor, in accordance with the procedure laid down in Article 60.
(2) By way of derogation from paragraph 1, each supervisory authority shall be competent to deal with a complaint lodged with it or with a possible infringement of this Regulation if the subject matter relates only to an establishment in its Member State or significantly affects data subjects only in its Member State.
(3) In the cases referred to in paragraph 2 of this Article, the supervisory authority shall immediately inform the lead supervisory authority of the matter. Within three weeks of receiving the notification, the lead supervisory authority shall decide whether or not to address the case in accordance with the procedure laid down in Article 60, taking into account whether the controller or processor has an establishment in the Member State whose supervisory authority notified it.
(4) If the lead supervisory authority decides to address the case, the procedure laid down in Article 60 shall apply. The supervisory authority that notified the lead supervisory authority may submit a draft decision to it. The lead supervisory authority shall take the draft decision into account as far as possible when drawing up the draft decision pursuant to Article 60(3).
(4) If the lead supervisory authority decides to address the case, the procedure laid down in Article 60 shall apply. The supervisory authority that notified the lead supervisory authority may submit a draft decision to it. (5) If the lead supervisory authority decides not to handle the case itself, the supervisory authority that notified the lead supervisory authority shall handle the case in accordance with Articles 61 and 62.
(6) The lead supervisory authority shall be the sole point of contact for controllers or processors regarding cross-border processing carried out by that controller or processor.
(...)
Article 60
Cooperation between the lead supervisory authority and the other supervisory authorities concerned
(1) The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article and shall endeavour to reach a consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information.
(2) The lead supervisory authority may at any time request mutual assistance from other supervisory authorities concerned in accordance with Article 61 and implement joint measures in accordance with Article 62, in particular to conduct investigations or to monitor the implementation of a measure concerning a controller or processor established in another Member State.
(3) The lead supervisory authority shall immediately transmit to the other supervisory authorities concerned the relevant information on the matter. It shall immediately submit a draft decision to the other supervisory authorities concerned for their comments and shall duly take into account their views.
(4) If, within four weeks of being consulted in accordance with paragraph 3 of this Article, one of the other supervisory authorities concerned lodges a relevant and reasoned objection to that draft decision, and the lead supervisory authority does not adopt the relevant and reasoned objection or considers that the objection is not relevant or is not reasoned, the lead supervisory authority shall initiate the consistency procedure in accordance with Article 63 for the matter.
(5) If the lead supervisory authority intends to adopt the relevant and reasoned objection, it shall submit a revised draft decision to the other supervisory authorities concerned for their comments. The revised draft decision shall be subject to the procedure laid down in paragraph 4 within two weeks.
(6) If none of the other supervisory authorities concerned objects to the draft decision submitted by the lead supervisory authority within the time limit laid down in paragraphs 4 and 5, the lead supervisory authority and the supervisory authorities concerned shall be deemed to accept the draft decision and be bound by it.
(7) The lead supervisory authority shall adopt the decision and communicate it to the main establishment or sole establishment of the controller or, where applicable, the processor, and shall inform the other supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and reasons. The supervisory authority with which a complaint has been lodged shall inform the complainant of the decision.
(8) If a complaint is rejected or dismissed, the supervisory authority with which the complaint was lodged shall, notwithstanding paragraph 7, adopt the decision, communicate it to the complainant, and inform the controller.
(9) If the lead supervisory authority and the supervisory authorities concerned agree to reject or dismiss parts of the complaint and to take action on other parts of that complaint, a separate decision shall be adopted for each of those parts. The lead supervisory authority shall adopt the decision for the part concerning action on the controller, communicate it to the main establishment or sole establishment of the controller or processor in its Member State, and inform the complainant accordingly. The supervisory authority responsible for the complainant shall adopt the decision for the part concerning the rejection or dismissal of that complaint, communicate it to the complainant, and inform the controller or processor accordingly.
(10) After being informed of the lead supervisory authority’s decision pursuant to paragraphs 7 and 9, the controller or processor shall take the necessary measures to bring the processing activities of all its establishments in the Union into compliance with the decision. The controller or processor shall communicate the measures taken to comply with the decision to the lead supervisory authority, which in turn shall inform the other supervisory authorities concerned.
(11) Where, in exceptional circumstances, a supervisory authority concerned has reason to believe that urgent action is required to protect the interests of data subjects, the urgency procedure referred to in Article 66 shall apply.
(12) The lead supervisory authority and the other supervisory authorities concerned shall exchange the information required under this Article electronically using a standardized format.
(13) (…)
Article 77
Right to lodge a complaint with a supervisory authority
(1) Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
(…) (2) The supervisory authority with which the complaint was lodged shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Article 78.
3.4 The relevant provisions of the GDPR:
Complaint to the Data Protection Authority
Section 24. (1) Every data subject has the right to lodge a complaint with the Data Protection Authority if they consider that the processing of personal data relating to them infringes the GDPR or Section 1 or Article 2, Chapter 1.
(1) Every data subject has the right to lodge a complaint with the Data Protection Authority if they consider that the processing of personal data relating to them infringes the GDPR or Section 1 or Article 2, Chapter 1. (2) - (7) (…)
(8) Any data subject may appeal to the Federal Administrative Court if the Data Protection Authority does not address the complaint or does not inform the data subject of the status or outcome of the complaint within three months.
(9) (…)
(10) The following are not included in the decision period pursuant to Section 73 of the General Administrative Procedure Act (AVG):
1. the time during which the proceedings are suspended pending a final decision on a preliminary issue;
2. the time during proceedings under Articles 56, 60, and 63 of the GDPR.
3.5. The admissibility of a complaint for failure to act presupposes the failure of the authority before the Administrative Court, whose duty to decide is being asserted, and thus the obligation of this authority to decide on the application submitted to it by means of a formal decision. If the authority is not in default, the complaint for failure to act must be dismissed (see Austrian Administrative Court [VwGH] 28 March 2019, Ra 2018/14/0286; 10 December 2018, Ro 2018/12/0017). 3.5. The admissibility of a complaint for failure to act presupposes the failure of the authority before the Administrative Court, whose duty to decide is being asserted, and thus the obligation of this authority to decide on the application submitted to it by means of a formal decision. If the authority is not in default, the complaint for failure to act must be dismissed (see Austrian Administrative Court [VwGH] 28 March 2019, Ra 2018/14/0286; 10 December 2018, Ro 2018/12/0017).
3.6. In the present case, it was therefore necessary to examine whether the respondent authority was in default. According to Section 8 Paragraph 1 of the Administrative Court Procedure Act (VwGVG), a complaint for failure to act can only be filed if the authority has not decided the matter within six months, or within six months if a shorter or longer decision period is provided for by law. The period begins when the application for a decision on the merits is received by the legally designated body. In accordance with this, Section 24 Paragraph 10 of the Data Protection Act (DSG), which is relevant in this case, refers first to Section 73 of the General Administrative Procedure Act (AVG), which requires authorities to decide without undue delay, but no later than six months after receipt of an application. Section 24(10) further stipulates that the following are not included in this decision period: on the one hand, the time during which the proceedings are suspended pending a legally binding decision on a preliminary issue (point 1), and on the other hand, the time during proceedings under Articles 56, 60, and 63 GDPR (point 2). In both cases, the decision period is to be suspended (see Austrian Administrative Court [VwGH] 14 November 2023, Ro 2020/04/0009). 3.6. In the present case, it was therefore necessary to examine whether the respondent authority was in default. According to Section 8(1) of the Administrative Court Procedure Act (VwGVG), a complaint for inaction can only be lodged if the authority has not decided the matter within six months, or, if a shorter or longer decision period is provided for by law, within that period. The period begins when the application for a decision on the merits is received by the legally designated body. In accordance with this, the relevant section 24, paragraph 10, of the Data Protection Act (DSG) refers first to section 73 of the General Administrative Procedure Act (AVG), which requires authorities to decide without undue delay, but no later than six months after receipt of an application. Section 24, paragraph 10 further states that the following are not included in this decision period: firstly, the time during which the proceedings are suspended pending a final decision on a preliminary issue (point one), and secondly, the time during proceedings under Articles 56, 60, and 63 of the GDPR (point two). In both cases, the decision period is to be suspended (see Austrian Administrative Court [VwGH] decision of November 14, 2023, Ro 2020/04/0009).
Article 55(1) of the GDPR stipulates that each supervisory authority is, in principle, responsible for fulfilling the tasks and exercising the powers conferred upon it by the Regulation within the territory of its own Member State. Among the tasks assigned to it, pursuant to Article 57(f) GDPR, is the handling of complaints from data subjects, provided that the supervisory authority is competent for a specific data processing activity (see CJEU 15 June 2021, C-645/19, paras. 47 et seq.). Article 55(1) GDPR stipulates that each supervisory authority is, in principle, competent to perform the tasks and exercise the powers conferred upon it by the Regulation within the territory of its own Member State. Among the tasks assigned to it, pursuant to Article 57(f) GDPR, is the handling of complaints from data subjects, provided that the supervisory authority is competent for a specific data processing activity (see CJEU 15 June 2021, C-645/19, paras. 47 et seq.).
`` ... Article 56(1) GDPR provides – without prejudice to the rule on jurisdiction contained in Article 55(1) of the Regulation – for ‘cross-border processing’ within the meaning of Article 4(23) of the Regulation, a procedure for cooperation and consistency is established, based on a division of responsibilities between a ‘lead supervisory authority’ and the other supervisory authorities concerned. Accordingly, the supervisory authority of the main establishment or the sole establishment of the controller or processor is the competent lead supervisory authority for the cross-border processing carried out by that controller or processor, in accordance with the procedure laid down in Article 60. This implies, in conjunction with Article 60, that with regard to ‘cross-border processing’, the various national supervisory authorities concerned must cooperate in accordance with the procedure laid down in those provisions in order to reach a consensus and a single decision which is binding on all supervisory authorities and with which the controller must align the processing activities of all its establishments in the Union (see CJEU 15.06.2021, C-645/19, paragraphs 50 et seq.). Article 56(1) GDPR provides – without prejudice to the rule on jurisdiction contained in Article 55(1) of the Regulation – for ‘cross-border processing’ within the meaning of Article 4(23) of the Regulation, the procedure of cooperation and consistency is based on a division of responsibilities between a ‘lead supervisory authority’ and the other supervisory authorities concerned. The supervisory authority of the controller's or processor's main establishment or sole establishment, in accordance with the procedure laid down in Article 60, is the competent lead supervisory authority for the cross-border processing carried out by that controller or processor. This, in conjunction with Article 60, means that, with regard to "cross-border processing," the various national supervisory authorities concerned must cooperate, in accordance with the procedure laid down in those provisions, to reach a consensus and a single decision, which is binding on all supervisory authorities and with which the controller must align the processing activities of all its establishments in the Union (see CJEU 15 June 2021, C-645/19, paragraphs 50 et seq.).
This means that the various national supervisory authorities concerned must cooperate, in accordance with the procedure laid down in those provisions, to reach a consensus and a single decision, which is binding on all supervisory authorities and with which the controller must align the processing activities of all its establishments in the Union (see CJEU 15 June 2021, C-645/19, paragraphs 50 et seq.). In the case of cross-border processing, the responsibility of the "lead supervisory authority" to conduct such a cooperation and consistency procedure – as is particularly evident from Article 56(6) GDPR – is the rule, from which deviations are only permitted in exceptional cases, as provided for in Article 56(2) and Article 60(11) GDPR (not applicable here). The responsibility to decide on a complaint concerning cross-border data processing itself ("issuing decisions"), however, is dependent on the outcome of the cooperation procedure. While decisions by the supervisory authorities involved are issued by the lead supervisory authority pursuant to Article 60(7) GDPR, the decision to dismiss the complaint pursuant to Article 60(8) GDPR, made by the supervisory authorities involved, is to be made by the supervisory authority to which the complaint was submitted (see Federal Administrative Court, 11 September 2024, W256 2290824-1/14E). In the case of cross-border processing, the responsibility of the "lead supervisory authority" to conduct such a cooperation and consistency procedure – as is evident in particular from Article 56(6) GDPR – is the rule, from which deviations are only permitted in exceptional cases, as provided for in Article 56(2) and Article 60(11) GDPR (not applicable here). The authority to decide on a complaint concerning cross-border data processing (“issuing decisions”) is, however, dependent on the outcome of the cooperation procedure. While decisions in favor of the complainant by the participating supervisory authorities pursuant to Article 60(7) GDPR are issued by the lead supervisory authority, the decision to dismiss the complaint pursuant to Article 60(8) GDPR, made by the participating supervisory authorities, is to be made by the supervisory authority to which the complaint was submitted (see BVwG 11.09.2024, W256 2290824-1/14E).
Recital 10 of the GDPR states that one of its aims is to ensure that the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data are applied uniformly and consistently throughout the Union and that obstacles to the free movement of personal data within the Union are removed. However, this objective and the practical effectiveness of the cooperation and consistency mechanism under Articles 56(1) and 60 of the GDPR could be jeopardized or impaired if a supervisory authority other than the lead authority adopts a decision under this mechanism (see CJEU 15 June 2021, C-645/19, paragraphs 64 et seq.). Recital 10 of the GDPR states that one of its aims is to ensure that the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data are applied uniformly and consistently throughout the Union and that obstacles to the free movement of personal data within the Union are removed. This objective and the practical effectiveness of the cooperation and consistency mechanism under Articles 56(1) and 60 GDPR could be jeopardized or impaired if a supervisory authority other than the lead authority were to issue a decision under this mechanism (see CJEU 15 June 2021, C-645/19, paragraphs 64 et seq.).
As established, the complainant filed her initiating data protection complaint with the respondent authority on 18 June 2024. This complaint was directed against XXXX, located at a specified address in Malta, concerning an alleged infringement of the right of access under Article 15 GDPR. The respondent authority rightly points out in its statement on the submitted complaint of inaction that the present data protection complaint is related to cross-border processing of personal data within the meaning of Article 4(23) GDPR and would therefore have been required by the respondent authority, as the supervisory authority concerned, to initiate a cooperation procedure with the Maltese lead supervisory authority pursuant to Article 56(1) in conjunction with Articles 60 et seq. GDPR, in accordance with Article 4(22)(c) GDPR. As established, the complainant filed her initiating data protection complaint with the respondent authority on June 18, 2024. This complaint was directed against [Company Name], located at a specified address in Malta, due to an alleged infringement of the right of access under Article 15 GDPR. The respondent authority rightly points out in its response to the submitted complaint of inaction that the present data protection complaint relates to cross-border processing of personal data within the meaning of Article 4(23) GDPR and that, as the supervisory authority concerned, it would have been required under Article 4(22)(c) GDPR to initiate a cooperation procedure with the Maltese lead supervisory authority pursuant to Article 56(1) in conjunction with Articles 60 et seq. GDPR.
As mentioned above, in the case of cross-border processing, the authority to issue a decision on the merits depends on the outcome of the cooperation and consistency procedure under Articles 56(1) and 60 GDPR. Against this background, and to protect the practical effectiveness of this procedure, a breach of the duty to decide by a supervisory authority cannot be legally asserted until such a procedure has been concluded. This is also consistent with the previously described provision of Section 24(10)(2) of the Data Protection Act (DSG), according to which the time spent in proceedings under Articles 56, 60 [and 63] of the GDPR cannot be included in the six-month decision period. As mentioned above, in the case of cross-border processing, the authority to issue a decision on the merits of a request for a ruling thus depends on the outcome of the cooperation and consistency procedure under Article 56(1) and Article 60 of the GDPR. Against this background, and to protect the practical effectiveness of this procedure, a breach of the duty to decide by a supervisory authority cannot be legally asserted until such proceedings have been concluded. This is also consistent with the previously described provision of Section 24(10)(2) of the Data Protection Act (DSG), according to which the time spent in proceedings under Articles 56, 60 [and 63] of the GDPR cannot be included in the six-month decision period.
... In this context, it should be noted that initiating the procedure under Articles 56 et seq. GDPR is not at the discretion of the authority concerned, but rather is automatically initiated upon filing a data protection complaint if the legal requirements are met. A different interpretation would jeopardize the objective and practical effectiveness of the cooperation and consistency procedure (see Federal Administrative Court [BVwG] 11.09.2024, W256 2290824-1/14E).
`` As a result, the suspension of the six-month decision period under Section 24 Paragraph 10 Item 2 of the Data Protection Act (DSG) did not begin with the transmission of the data protection complaint to the presumably competent lead supervisory authority on October 22, 2025, but rather automatically with the filing of the data protection complaint relating to cross-border data processing. Therefore, the respondent authority is not at fault with regard to the decision period in question.
In conclusion, the suspension of the six-month decision period under Section 24 Paragraph 10 Item 2 of the Data Protection Act (DSG) did not begin with the transmission of the data protection complaint to the presumably competent lead supervisory authority on October 22, 2025, but rather automatically with the filing of the data protection complaint relating to cross-border data processing. Therefore, the respondent authority is not at fault with regard to the decision period in question. The adjudicating Senate further notes that there is no legal basis, in particular that of Section 38 of the General Administrative Procedure Act (AVG), for the suspension of data protection complaint proceedings by way of an administrative decision pending the determination of the lead supervisory authority pursuant to Article 56 GDPR. The wording of Section 24(10) of the Data Protection Act (DSG) and its systematic structure, which clearly distinguishes between the situations described in point 1 (suspension of proceedings and preliminary question) and point 2 (coherence procedure under the GDPR), make it clear that the latter does not involve a preliminary question requiring a suspension of the data protection proceedings by way of an administrative decision. Otherwise, the provision in point 2 would be unnecessary, and the legislature would have to be allowed to regulate something superfluous. This also precludes the application of the case law of the Austrian Administrative Court (VwGH) concerning Sections 38 and 38a of the General Administrative Procedure Act (AVG) to cases under Section 24 Paragraph 10 Item 2 of the Data Protection Act (DSG) (see VwGH 14.11.2023, Ro 2020/04/0009). Furthermore, the deciding panel notes that any legal basis, in particular that of Section 38 of the AVG, is lacking for the suspension of data protection complaint proceedings by administrative decision with regard to proceedings to determine the lead supervisory authority under Article 56 of the GDPR. The wording of Section 24, Paragraph 10, of the Data Protection Act (DSG), and its systematic structure, which clearly distinguishes between the scenarios described in point 1 (suspension of proceedings and preliminary question) and point 2 (coherence procedure under the GDPR), makes it clear that the latter does not involve a preliminary question requiring a formal suspension of the data protection proceedings. Otherwise, the provision in point 2 would be unnecessary, and the legislature would have to be allowed to regulate something superfluous. Consequently, the case law of the Austrian Administrative Court (VwGH) concerning Section 38 and Section 38a of the General Administrative Procedure Act (AVG) cannot be applied to cases under Section 24, Paragraph 10, Point 2, of the DSG (see VwGH 14.11.2023, Ro 2020/04/0009).
3.7. The complaint of default is therefore to be dismissed for lack of a default within the meaning of Section 130 Paragraph 1 Item 3 of the Federal Constitutional Law (B-VG). 3.7. The complaint of default is therefore to be dismissed for lack of a default within the meaning of Section 130, Paragraph 1, Item 3, of the Federal Constitutional Law (B-VG).
3.8. Pursuant to Section 24 Paragraph 1 of the Administrative Court Procedure Act (VwGVG), the Administrative Court must hold a public oral hearing upon request or, if it deems it necessary, ex officio. 3.8. Pursuant to Section 24, Paragraph 1, of the Administrative Court Procedure Act (VwGVG), the Administrative Court must hold a public oral hearing upon request or, if it deems it necessary, ex officio.
The appellant has submitted a request for a public hearing. In the present case, however, the omission of an oral hearing can be based on the fact that the facts are clear from the case file. The Federal Administrative Court had to rule exclusively on a legal question (the existence of a default). According to the jurisprudence of the Constitutional Court, an oral hearing may be dispensed with if the facts are undisputed and the legal question is not of particular complexity (VfSlg. 17.597/2005; VfSlg. 17.855/2006; most recently, for example, VfGH 18.06.2012, B 155/12).
Consequently, pursuant to Section 24 Paragraph 1 of the Administrative Court Procedure Act (VwGVG), an oral hearing was not required.
Regarding B) (In)admissibility of the appeal:
Pursuant to Section 25a Paragraph 1 of the Administrative Court Act (VwGG), the Administrative Court must state in the operative part of its judgment or decision whether the appeal is admissible pursuant to Article 133 Paragraph 4 of the Federal Constitutional Law (B-VG). The ruling must be briefly reasoned. Pursuant to Section 25a, paragraph 1, of the Administrative Court Act (VwGG), the Administrative Court must state in the operative part of its judgment or decision whether an appeal on points of law is admissible under Article 133, paragraph 4, of the Federal Constitutional Law (B-VG). The ruling must be briefly reasoned.
The appeal on points of law is inadmissible under Article 133, paragraph 4, of the Federal Constitutional Law (B-VG) because the decision does not depend on the resolution of a legal question of fundamental importance. The present decision neither deviates from the established case law of the Administrative Court nor is there a lack of case law; furthermore, the existing case law of the Administrative Court cannot be considered inconsistent. There are also no other indications of the fundamental importance of the legal question to be resolved. The appeal on points of law is inadmissible under Article 133, paragraph 4, of the Federal Constitutional Law (B-VG) because the decision does not depend on the resolution of a legal question of fundamental importance. The present decision neither deviates from the established case law of the Administrative Court nor is there a lack of relevant case law; furthermore, the existing case law of the Administrative Court cannot be considered inconsistent. There are also no other indications that the legal question to be resolved is of fundamental importance.
