BVwG - W137 2328811-1
From GDPRhub
| BVwG - W137 2328811-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 51(1) GDPR Article 57(4) GDPR Article 77 GDPR § 24 DSG |
| Decided: | 12.01.2026 |
| Published: | 02.03.2026 |
| Parties: | |
| National Case Number/Name: | W137 2328811-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2026:W137.2328811.1.00 |
| Appeal from: | DPA D124.2626/25, 2025-0.706.946 |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | RIS (in German) |
| Initial Contributor: | avalang |
A court held that the DPA rightfully refused to handle a complaint in accordance with Article 57(4) GDPR after a data subject tried to misuse the complaint mechanism to delay the enforcement of a debt.
English Summary
Facts
In 2008, a district court issued a payment order against the data subject for an unpaid lawyer’s fee. The payment order became final and enforceable in June 2008, but the data subject never paid the debt. After the judgement, the data subject changed her surname, moved to Germany and did not inform the lawyer (the controller) about these changes.
The controller attempted to recover the unpaid legal fee from the data subject. He discovered the data subject’s new address and contacted her, requesting the outstanding payment. The data subject asked the controller where it got her address from, arguing that failing to provide this information would violate Article 14 GDPR.
The controller responded that he had obtained the address in the course of his professional activity and could not disclose details due to his duty of professional secrecy. On the same day, the data subject filed a complaint with the Austrian Data Protection Authority (DSB). She alleged violations of Article 14(2)(f) GDPR, the principles of processing under Article 5(1)(b) GDPR, the lawfulness requirement under Article 6 GDPR, and her right to erasure under Article 17 GDPR. The data subject claimed she would not pay until these procedures were concluded.
The DSB refused to deal with the complaint under Article 57(4) GDPR as it considered the complaint unfounded and abusive because it served only to delay or obstruct the enforcement of the debt.
The data subject appealed this decision to the court.
Holding
First, the court confirmed that supervisory authorities may refuse to act on complaints that are manifestly unfounded or abusive under Article 57(4) GDPR. It referred to the case law of the CJEU that clarifies that the concept of an “application” in Article 57(4) GDPR also covers complaints under Article 77 GDPR.
Second, the court assessed whether the complaint pursued a legitimate data protection objective. It found that the data subject used the complaint primarily to delay or prevent the enforcement of the controller’s claim.
Third, the court held that the complaint was manifestly unfounded. A creditor may lawfully process personal data such as name, date of birth, and address for the purpose of enforcing a claim. This also applies to updated information, such as a changed surname or address.
Fourth, the court considered the DSB’s choice of measure under Article 57(4) GDPR was appropriate as a supervisory authority may either charge a fee or refuse to act. The court agreed with the DPA that imposing a fee would likely not deter the data subject, because the fee would probably be lower than the outstanding debt.
The court dismissed the appeal and confirmed that the DPA lawfully refused to deal with the complaint under Article 57(4) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Decision Date
January 12, 2026
Legal Norm
Federal Constitutional Law (B-VG) Art. 130 para. 1 no. 1
Federal Constitutional Law (B-VG) Art. 133 para. 4
Data Protection Act (DSG) § 24
General Data Protection Regulation (GDPR) Art. 51 para. 1
General Data Protection Regulation (GDPR) Art. 57
General Data Protection Regulation (GDPR) Art. 57 para. 4
General Data Protection Regulation (GDPR) Art. 130 (current version)
Federal Constitutional Law (B-VG) Art. 130 valid from February 1, 2019, last amended by Federal Law Gazette I No. 14/2019
Federal Constitutional Law (B-VG) Art. 130 valid from January 1, 2019 to January 31, 2019, last amended by Federal Law Gazette I No. 22/2018
Federal Constitutional Law (B-VG) Art. 130 valid from January 1, 2019 to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017
Federal Constitutional Law (B-VG) Art. 130 valid from Article 130 of the Federal Constitutional Law (B-VG) valid from 25 May 2018 to 31 December 2018, last amended by Federal Law Gazette I No. 22/2018; Article 130 valid from 1 January 2015 to 24 May 2018, last amended by Federal Law Gazette I No. 101/2014; Article 130 valid from 1 January 2014 to 31 December 2014, last amended by Federal Law Gazette I No. 115/2013; Article 130 valid from 1 January 2014 to 31 December 2013, last amended by Federal Law Gazette I No. 51/2012; Article 130 valid from 1 January 2004 to 31 December 2013, last amended by Federal Law Gazette I No. 100/2003 B-VG Art. 130 valid from 01.01.1998 to 31.12.2003, last amended by BGBl. I No. 87/1997; B-VG Art. 130 valid from 01.01.1991 to 31.12.1997, last amended by BGBl. No. 685/1988; B-VG Art. 130 valid from 01.07.1976 to 31.12.1990, last amended by BGBl. No. 302/1975; B-VG Art. 130 valid from 18.07.1962 to 30.06.1976, last amended by BGBl. No. 215/1962; B-VG Art. 130 valid from 25.12.1946 to 17.07.1962, last amended by Federal Law Gazette No. 211/1946, Federal Constitutional Law Art. 130, valid from 19.12.1945 to 24.12.1946, last amended by State Law Gazette. No. 4/1945 B-VG Art. 130 valid from January 3, 1930 to June 30, 1934
B-VG Art. 133 today B-VG Art. 133 valid from January 1, 2019 to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017 B-VG Art. 133 valid from January 1, 2019, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 valid from May 25, 2018 to December 31, 2018, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 valid from August 1, 2014 to May 24, 2018, last amended by Federal Law Gazette I No. 164/2013 B-VG Art. 133 valid from 01.01.2014 to 31.07.2014, last amended by BGBl. I No. 51/2012; B-VG Art. 133 valid from 01.01.2004 to 31.12.2013, last amended by BGBl. I No. 100/2003; B-VG Art. 133 valid from 01.01.1975 to 31.12.2003, last amended by BGBl. No. 444/1974; B-VG Art. 133 valid from 25.12.1946 to 31.12.1974, last amended by BGBl. No. 211/1946; B-VG Art. 133 valid from 19.12.1945 to Last amended by the Federal Law Gazette on 24 December 1946. No. 4/1945 B-VG Art. 133 valid from January 3, 1930 to June 30, 1934
Data Protection Act (DSG) Art. 2 § 24 now DSG Art. 2 § 24 valid from July 15, 2024, last amended by Federal Law Gazette I No. 70/2024; Data Protection Act (DSG) Art. 2 § 24 valid from May 25, 2018 to July 14, 2024, last amended by Federal Law Gazette I No. 120/2017; Data Protection Act (DSG) Art. 2 § 24 valid from January 1, 2010 to May 24, 2018, last amended by Federal Law Gazette I No. 133/2009; Data Protection Act (DSG) Art. 2 § 24 valid from January 1, 2000 to December 31, 2009
Slogan
W137 2328811-1/3E
IN THE NAME OF THE REPUBLIC!
The Federal Administrative Court, composed of Judge Peter Hammer, presiding, and lay judges Ursula Illibauer and Martina Chlestil, has ruled in a non-public session on the appeal of XXXX against the decision of the Data Protection Authority of October 20, 2025, file number D124.2626/25, 2025-0.706.946, as follows:
A)
The appeal is dismissed pursuant to Art. The appeal is dismissed as unfounded pursuant to Article 130, paragraph 1, point 1 of the Federal Constitutional Law (B-VG).
B)
The appeal on points of law is inadmissible pursuant to Article 133, paragraph 4 of the Federal Constitutional Law (B-VG).
Text
Grounds:
I. Procedural History:
1. By letter dated August 11, 2025, attorney XXXX (respondent before the Data Protection Authority and co-party in the present administrative court proceedings) demanded payment of a total sum of EUR 838.46 from XXXX (appellant before the Data Protection Authority and in the present administrative court proceedings), which resulted from the execution of a lease agreement including procedural and enforcement costs as well as interest. Enforcement orders already exist in this regard. At the same time, the complainant was granted a payment deadline of August 29, 2025. 1. By letter dated August 11, 2025, attorney Roman 40 (respondent before the Data Protection Authority and co-party in the present administrative court proceedings) demanded payment of a total sum of EUR 838.46 from Roman 40 (complainant before the Data Protection Authority and in the present administrative court proceedings). This sum was claimed to be the result of the execution of a lease agreement, including procedural and enforcement costs as well as interest. Enforcement orders already exist in this regard. At the same time, the complainant was granted a payment deadline of August 29, 2025.
... 2. In a letter dated August 23, 2025, the complainant replied, among other things, that it first needed to be clarified where the co-party had obtained its current address before any discussion of a possible settlement could even take place. She set a deadline of ten working days for him to provide her with complete and comprehensible information, otherwise this would constitute a refusal of the right to information under Article 14 GDPR. In this case, she would forward this matter to the Tyrolean Bar Association and the respondent authority. In this case, she will forward this to the Tyrolean Bar Association and the respondent authority.
3. By letter dated August 29, 2025, the co-respondent informed the appellant that he had obtained her current address in connection with his legal work and that, due to his professional obligation of confidentiality, he could not and was not permitted to provide any further details. He also stated that, in accordance with the provisions of the GDPR, he was of course entitled to use addresses of individuals who had become known to him from any source and who had failed to pay his fees despite the existence of court-ordered enforcement judgments, for the purpose of enforcing his claims. He again set her a payment deadline of September 10, 2025.
4. On August 29, 2025, the complainant lodged a complaint with the respondent authority, alleging a violation of her right to information under Article 14(2)(f) GDPR, the principles of data processing under Article 5(1)(b) GDPR, the lawfulness of processing under Article 6 GDPR, and her right to erasure under Article 17 GDPR. The complainant therefore requested the respondent authority to determine the origin of her address and to assess the lawfulness of the processing with regard to Articles 5, 6, 14, and 17 GDPR. On August 29, 2025, the complainant filed a complaint with the respondent authority, alleging a violation of her right to information under Article 14(2)(f) GDPR, the principles of data processing under Article 5(1)(b) GDPR, the lawfulness of processing under Article 6 GDPR, and her right to erasure under Article 17 GDPR. The complainant therefore requested the respondent authority to determine the origin of her address and to assess the lawfulness of the processing with regard to Articles 5, 6, 14, and 17 GDPR.
5. On September 3, 2025, the complainant sent a letter to the co-respondent party informing them, among other things, that she had filed complaints with the respondent authority and the Tyrolean Bar Association. She granted the co-litigant another seven working days to provide complete, legally compliant information and to substantiate her claim in a comprehensible manner. Should the co-litigant fail to do so, she assumed that the co-litigant would henceforth have to spend its time not sending threatening letters, but rather justifying its position before the respondent authority and the Tyrolean Bar Association, and considered the claim forfeited.
6. On September 9, 2025, the appellant further informed the co-litigant that it expressly objected to the payment deadline of September 10, 2025. The deadline set by the co-litigant was neither legally nor factually tenable.
7. By letter dated September 17, 2025, the co-litigant informed the appellant that no further deadlines of any kind were necessary, as it possessed legally valid and enforceable judgments against the appellant to enforce its existing claims. It granted the appellant until September 26, 2025, to submit a suitable and acceptable solution proposal. Should this not occur, the co-litigant would, without further correspondence, instruct a law firm located at the appellant's current place of residence in Germany to enforce the judgments against the appellant.
8. On September 19, 2025, the appellant forwarded the aforementioned correspondence since the filing of the appeal to the respondent authority and noted that the co-litigant had responded, even though the respondent authority was already conducting a review.
On October 2, 2025, the complainant submitted her reply dated September 25, 2025, to the respondent authority in response to the letter from the co-respondent dated September 17, 2025 (see point 7). In this letter, the complainant stated that, due to "the ongoing proceedings before the Austrian Data Protection Authority (DSB, file number: D124.2626/25) and the Tyrolean Bar Association (RAK), [...] all deadlines you have set are to be considered suspended until these investigations are concluded." Until the matter is "fully clarified," she will "take no further steps regarding your claim, as its basis, legality, and admissibility are subject to official review." The complainant "will await the decisions of the DSB and the RAK and will only comment further thereafter. Until then, I see no reason to respond to the deadlines or demands you have set."
``` 9. By decision of October 20, 2025, the respondent authority rejected the complaint on the grounds of abusive filing and manifest lack of merit pursuant to Article 57(4) GDPR. The respondent authority stated that it was obvious that the complainant's data protection complaint was solely related to the collection of the claim by the co-defendant from the complainant and had no connection to data protection issues or violations. In particular, it was unequivocally clear from the complainant's letter of September 25, 2025, that the complainant was using the data protection complaint procedure to delay or evade the collection of the claim by the co-defendant, or to prevent the co-defendant from pursuing the claim further. The complaint was therefore abusive and, moreover, manifestly unfounded. The complainant is attempting to construct a connection, although data protection issues cannot, in principle, affect the legality and enforceability of the claim against her. Imposing a fee for processing the complaint is not appropriate in this case, as the respondent authority assumes that the complainant will not be deterred from pursuing the abusive complaint by the imposition of a fee, or is even willing to pay a fee for processing this complaint, particularly since the fee would likely be lower than the claim of the co-defendant. Therefore, the conditions for rejecting the complaint pursuant to Article 57(4) GDPR are met. By decision of October 20, 2025, the respondent authority rejected the processing of the complaint due to its abusive nature and manifest lack of merit, pursuant to Article 57(4) GDPR. The respondent authority stated that it was obvious the complainant's data protection complaint was solely related to the collection of the claim by the co-defendant from the complainant and had no connection to data protection issues or violations. In particular, the complainant's letter of September 25, 2025, clearly demonstrated that the complainant was using the data protection complaint procedure to delay or evade the collection of the co-defendant's claim, or to prevent the co-defendant from pursuing the claim further. The complaint was therefore abusive and, moreover, manifestly unfounded. The complainant was attempting to fabricate a connection, even though data protection issues cannot, in principle, affect the legality and enforceability of the claim against her. Imposing a fee for processing the complaint would not be appropriate in this case, as the respondent authority assumes that the complainant would not be deterred from pursuing the abusive complaint by such a fee, and is also prepared to pay a fee for processing this complaint, particularly since the fee would likely be lower than the amount demanded by the intervening party. Therefore, the conditions for rejecting the complaint pursuant to Article 57(4) GDPR are met.
10. On November 15, 2025, the complainant filed her appeal against the respondent authority's decision, arguing essentially that the respondent authority had failed to establish the relevant facts but had drawn an incorrect conclusion based on a mere assertion by the intervening party. The respondent authority should have examined, in particular, the proceedings from which the co-defendant obtained the data, the original purpose for which it was collected, whether the use of this data for a privately asserted claim was permissible, whether there was a change of purpose in the further processing of the data, and whether the co-defendant had demonstrably conducted its own investigation into the current address. It therefore requests the annulment of the contested decision, the remand of the case to the respondent authority for a full investigation of the facts, or, in the alternative, a decision on the merits by the Federal Administrative Court.
On December 4, 2025, the respondent authority submitted the appeal, along with the administrative file, to the Federal Administrative Court. The respondent authority contested the grounds of appeal in their entirety and referred in full to the contested decision. The respondent authority, pursuant to Section 28 Paragraph 2 of the Administrative Court Procedure Act (VwGVG), requested a decision on the merits from the Federal Administrative Court and the dismissal of the appeal. On December 4, 2025, the respondent authority submitted the appeal, along with the administrative act, to the Federal Administrative Court. The respondent authority contested the grounds of appeal in their entirety and referred in full to the contested decision. The respondent authority, pursuant to Section 28 Paragraph 2 of the Administrative Court Procedure Act (VwGVG), requested a decision on the merits from the Federal Administrative Court and the dismissal of the appeal.
II. The Federal Administrative Court considered the following:
1. Findings:
On April 25, 2008, the District Court of XXXX issued a payment order in XXXX, based on a lawsuit filed by XXXX concerning an unpaid invoice. The payment order was declared enforceable on June 9, 2008. The first defendant and first debtor was/is the appellant, who in the proceedings under file number XXXX (still) bore the surname "XXXX" and resided in XXXX. The appellant did not pay the amount. The District Court (case number 40) issued a payment order on April 25, 2008, under file number 40, based on a lawsuit filed by the District Court (case number 40) regarding an unpaid invoice. The payment order was declared enforceable on June 9, 2008. The first defendant and first debtor was/is the appellant, who in the proceedings under file number 40 (still) bore the surname "XXXX" and resided in file number 40. The appellant did not pay the amount.
The intervening party thus has – evidently justifiably – at least the personal data of the appellant, namely her name, date of birth, and address.
At an unspecified time, but certainly after the issuance of the payment order, the appellant changed her surname from "XXXX" to "XXXX" and moved to Germany, specifically to XXXX. The appellant did not inform the co-respondent of her change of name and address.
By letter dated August 11, 2025, the co-respondent contacted the appellant at her new address and explained that she had learned of the change of name and address indirectly. She pointed out the outstanding amount of EUR 838.46 and set a deadline of August 29, 2025, for transferring this amount to the law firm's account.
The complainant initially requested information regarding the origin of her address, to which the co-litigant responded by referring to her legal practice and the enforcement of a legally enforceable claim. In response to this letter (and subsequent correspondence), the complainant filed the present complaint with the Data Protection Authority (DSB) on August 29, 2025 (and a complaint with the local bar association). Since then, she has consistently and explicitly argued in these complaints that she is refusing payment.
2. Evaluation of Evidence:
The findings are based on the uncontested contents of the file, primarily the correspondence between the complainant and the co-litigant, which she herself submitted.
There is no doubt about the fundamental validity of the claim, nor about the relocation and name change – these circumstances are undisputed. Accordingly, there can also be no doubt that the co-defendant is legally entitled to possess and process (at least) the complainant's personal data, including her name, date of birth, and address, in this context.
The use of the data protection complaint as an argument for refusing or challenging the payment obligation is evident from the administrative act. This is clearly demonstrated, for example, by the complainant's email to the respondent authority dated September 19, 2025, in which she responds to the co-defendant's reply that they will instruct a law firm located in the complainant's place of residence to enforce the claim against her, stating, "This reaction occurred even though your authority is already conducting a review." Furthermore, this is evident from the complainant's letters to the co-defendant dated September 3, 2025 ("Should you fail to do so, I will assume that you will have to spend your time in the future not sending me threatening letters, but justifying yourself before the aforementioned authorities, and I consider your claim forfeited") and September 25, 2025 ("Due to the ongoing proceedings before the Austrian Data Protection Authority (DSB, file number: D124.2626/25) and the Tyrolean Bar Association (RAK), all deadlines you have set are to be considered suspended until these investigations are concluded. Until the matter is fully clarified, I will not take any further steps regarding your claim, as its basis, legality, and admissibility are the subject of official review. [...] I will await the decisions of the DSB and the RAK and only comment further thereafter. Until then, I see no reason to respond to any deadlines or demands you have set").
3. Legal Assessment:
3.1. Pursuant to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court decides by a single judge unless federal or state law provides for a decision by a panel.
Pursuant to Section 27 Paragraph 1 of the Data Protection Act (DSG), the Federal Administrative Court decides by a panel on appeals against decisions concerning violations of the duty to provide information pursuant to Section 24 Paragraph 7 of the DSG and the duty of the data protection authority to make a decision. Pursuant to Section 27 Paragraph 2 Sentence 1 of the DSG, the panel consists of a presiding judge and one lay judge each from the employer and employee sectors. The case therefore falls within the jurisdiction of the Senate. Pursuant to Section 27, Paragraph 1, of the Data Protection Act (DSG), the Federal Administrative Court, through a Senate, decides on appeals against decisions concerning violations of the duty to provide information pursuant to Section 24, Paragraph 7, of the DSG and the duty of the Data Protection Authority to make a decision. According to Section 27, Paragraph 2, first sentence, of the DSG, the Senate consists of a presiding judge and one lay judge each from the employer and employee sectors. Therefore, the case in question falls within the jurisdiction of the Senate.
The procedures of the administrative courts, with the exception of the Federal Fiscal Court, are governed by the Administrative Court Procedure Act (VwGVG), Federal Law Gazette I 2013/33 as amended by Federal Law Gazette I 2013/122 (Section 1 of the VwGVG). Pursuant to Section 59, Paragraph 2 of the Administrative Court Procedure Act (VwGVG), conflicting provisions that were already promulgated at the time this Federal Act entered into force remain in force. The procedures of the administrative courts, with the exception of the Federal Fiscal Court, are governed by the Administrative Court Procedure Act (VwGVG), Federal Law Gazette (BGBl.) No. 1 2013/33, as amended by Federal Law Gazette (BGBl.) No. 1 2013/122 (Section 1, as amended). Pursuant to Section 59, Paragraph 2 of the Administrative Court Procedure Act (VwGVG), conflicting provisions that were already promulgated at the time this Federal Act entered into force remain in force.
The procedures of the administrative courts, with the exception of the Federal Fiscal Court, are governed by the Administrative Court Procedure Act (VwGVG), Federal Law Gazette (BGBl.) No. 1 2013/33, as amended by Federal Law Gazette (BGBl.) No. 1 2013/122 (Section 1, as amended). Pursuant to Section 17 of the Administrative Court Procedure Act (VwGVG), unless otherwise provided in this Federal Act, the provisions of the General Administrative Procedure Act (AVG), with the exception of Sections 1 to 5 and Part IV, the provisions of the Federal Fiscal Code (BAO), Federal Law Gazette No. 194/1961, the Agricultural Procedure Act (AgrVG), Federal Law Gazette No. 173/1950, and the Civil Service Procedure Act 1984 (DVG), Federal Law Gazette No. 29/1984, and, in all other respects, those procedural provisions in federal or state laws that the authority applied or would have had to apply in the proceedings preceding the proceedings before the Administrative Court, shall apply mutatis mutandis to the proceedings concerning appeals pursuant to Article 130, paragraph 1, of the Federal Constitutional Law (B-VG). 5, as well as Part IV of the Roman numeral system, the provisions of the Federal Fiscal Code (BAO), Federal Law Gazette No. 194 of 1961, the Agricultural Procedure Act (AgrVG), Federal Law Gazette No. 173 of 1950, and the Civil Service Procedure Act 1984 (DVG), Federal Law Gazette No. 29 of 1984, and, in all other respects, those procedural provisions in federal or state laws that the authority applied or would have had to apply in the proceedings preceding the proceedings before the Administrative Court, shall apply mutatis mutandis.
3.2. Pursuant to Section 31 Paragraph 1 of the Administrative Court Procedure Act (VwGVG), decisions and orders are issued by resolution, unless a judgment is to be rendered.
3.2. Pursuant to Section 31 Paragraph 1 of the Administrative Court Procedure Act (VwGVG), decisions and orders are issued by resolution, unless a judgment is to be rendered. Pursuant to Section 28 Paragraph 1 of the Administrative Court Procedure Act (VwGVG), the Administrative Court must decide the case by judgment, unless the appeal is to be dismissed or the proceedings discontinued.
Regarding A)
3.3. The relevant provisions of the GDPR are as follows:
Article 51
Supervisory Authority
(1) Each Member State shall provide that one or more independent authorities are responsible for monitoring the application of this Regulation, with a view to safeguarding the fundamental rights and freedoms of natural persons with regard to processing and facilitating the free movement of personal data within the Union (hereinafter referred to as ‘supervisory authority’).
(…)
Article 57
Tasks
(1) Without prejudice to other tasks set out in this Regulation, each supervisory authority shall, within its territory,
(a) monitor and enforce the application of this Regulation;
b) Raise public awareness of the risks, rules, safeguards, and rights relating to data processing and inform the public accordingly. Particular attention shall be paid to specific measures for children;
c) Advise the national parliament, government, and other bodies and institutions on legislative and administrative measures for the protection of the rights and freedoms of natural persons with regard to data processing, in accordance with the law of the Member State;
d) Raise awareness among controllers and processors of their obligations under this Regulation;
e) Provide information to any data subject, upon request, on the exercise of their rights under this Regulation and, where appropriate, cooperate with supervisory authorities in other Member States for this purpose;
f) Address complaints from a data subject or from a body, organization, or association pursuant to Article 80, investigate the subject matter of the complaint appropriately, and inform the complainant within a reasonable timeframe of the progress and outcome of the investigation, in particular where further investigation or coordination with another supervisory authority is necessary;
(…)
(2) Each supervisory authority shall facilitate the submission of complaints referred to in paragraph 1(f) by measures such as providing a complaint form which may also be completed electronically, without excluding other means of communication.
(3) The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
(4) In the case of manifestly unfounded or, in particular, excessive requests, the supervisory authority may charge a reasonable fee based on administrative costs or refuse to act on the request. In this case, the supervisory authority shall bear the burden of proof that the request was manifestly unfounded or excessive.
Article 77
Right to lodge a complaint with a supervisory authority
(1) Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
(2) The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78.
3.4. The relevant provisions of the GDPR are as follows:
Complaint to the Data Protection Authority
Section 24. (1) Every data subject shall have the right to lodge a complaint with the Data Protection Authority if he or she considers that the processing of personal data relating to him or her infringes the GDPR or Section 1 or Article 2, Chapter 1. This does not apply insofar as a right to lodge a complaint with the Parliamentary Data Protection Committee exists pursuant to Section 35f, paragraph 1. Section 24, (1) Every data subject has the right to lodge a complaint with the data protection authority if they consider that the processing of personal data relating to them infringes the GDPR or Section 1, or Article 2, Chapter 1. This does not apply insofar as a right to lodge a complaint with the Parliamentary Data Protection Committee exists pursuant to Section 35f, paragraph 1.
(2) The complaint must contain:
1. the designation of the right allegedly infringed,
2. where reasonable, the designation of the legal entity or body to which the alleged infringement is attributed (respondent),
3. the facts from which the infringement is derived,
4. the grounds on which the claim of unlawfulness is based,
5. the request to establish the alleged infringement, and
6. the information necessary to assess whether the complaint was filed in a timely manner.
(3) Where appropriate, the underlying application and any response from the respondent must be attached to a complaint. The Data Protection Authority shall provide further assistance to the data subject upon request in the event of a complaint.
``` (4) The right to have a complaint addressed expires if the complainant does not submit it within one year of becoming aware of the event giving rise to the complaint, but no later than three years after the event allegedly occurred. Complaints submitted after this deadline shall be rejected.
(5) If a complaint is found to be justified, it shall be granted. If an infringement is attributable to a private entity, that entity shall be ordered to comply with the complainant's requests for access, rectification, erasure, restriction of processing, or data portability to the extent necessary to remedy the established infringement. If the complaint is found to be unjustified, it shall be dismissed.
(…)
3.5. Pursuant to Article 57(4) GDPR, the data protection authority may, in the case of manifestly unfounded or – in particular in the case of frequent repetition – excessive requests, charge a reasonable fee based on administrative costs or refuse to act on the request, with the burden of proof regarding the manifestly unfounded or excessive nature of the request lying with the data protection authority. According to the case law of the Court of Justice of the European Union (CJEU), the term “request” also includes a complaint within the meaning of Article 77 GDPR (see CJEU judgment of 9 January 2025, C-416/23). 3.5. Pursuant to Article 57(4) GDPR, the data protection authority may, in the case of manifestly unfounded or – in particular in the case of frequent repetition – excessive requests, charge a reasonable fee based on administrative costs or refuse to act on the request, with the burden of proof regarding the manifestly unfounded or excessive nature of the request lying with the data protection authority. According to the case law of the CJEU, the term "request" also includes a complaint within the meaning of Article 77 GDPR (see CJEU judgment of 9 January 2025, C-416/23).
3.6. The Administrative Court has repeatedly stated in the past that, in accordance with the CJEU case law, an intent to abuse the data within the meaning of Article 57(4) GDPR is to be assumed primarily when the complainant raises the complaints to achieve a purpose not protected by data protection regulations (such as publicity, hostility, or sensationalism). This is consistent with the fact that, according to the CJEU, Article 57(4) GDPR reflects the Court's settled case law, according to which there is a general principle of law in EU law that citizens may not invoke EU law in a fraudulent or abusive manner (see CJEU judgment of 9 January 2025, C-416/23, paragraph 49, and the case law cited therein). Even if a complaint is not accompanied by an outright vexatious intent, it can be considered abusive if a person uses the resources of the authority when it is already evident from the complaint itself that the submission is clearly pursuing objectives other than enforcing the protection afforded by the GDPR. The existence of such a purpose other than pursuing the rights of a complainant under the GDPR (and thus the existence of an intent to abuse) must be determined on the basis of all relevant circumstances of each individual case. (cf. VwGH of 29 January 2025, Ro 2023/04/0018-9; VwGH of 29 January 2025, Ra 2023/04/0002; VwGH of 29 January 2025, Ra 2020/04/0084; ECJ of 9 January 2025, C-416/23). 3.6. The Administrative Court has repeatedly stated in the past that an intent to abuse data within the meaning of Article 57(4) GDPR, in accordance with the ECJ case law, is to be assumed primarily when the complainant raises the complaints to achieve a purpose not protected by data protection regulations (such as publicity, hostility, or sensationalism). This is consistent with the fact that, according to the CJEU, Article 57(4) GDPR reflects the Court's settled case law, according to which there is a general principle of law in EU law that citizens may not invoke EU law in a fraudulent or abusive manner (see CJEU judgment of 9 January 2025, C-416/23, paragraph 49, and the case law cited therein). Even if there is no outright vexatious intent behind a complaint, it can be considered abusive if a person uses the resources of the authority when it is already evident from the complaint itself that the submission is clearly pursuing objectives other than enforcing the protection afforded by the GDPR. The existence of such a purpose other than pursuing the rights of a complainant under the GDPR (and thus the existence of an intent to abuse) must be determined on the basis of all relevant circumstances of each individual case. (See Austrian Administrative Court [VwGH] decisions of January 29, 2025, Ro 2023/04/0018-9; Ra 2023/04/0002; and Ra 2020/04/0084; and the European Court of Justice [ECJ] decision of January 9, 2025, C-416/23).
3.7. As already established by the Data Protection Authority (DSB), it is evident from the appellant's submissions that the complaint was filed to obstruct/delay the collection of the debt by the co-litigant. It is equally evident that the core of the dispute does not lie in data protection concerns/issues, but rather in the co-litigant's claim against the appellant. In this context, the fact that the complainant deliberately did not inform her creditor of either her move or her name change is also substantially significant. The complainant now explicitly links the refusal to pay to the pending complaints she has filed.
3.8. Requests or complaints are considered "manifestly unfounded" if, upon reasonable consideration of the arguments presented, there is absolutely no prospect of success for the data subject (Zavadil in Knyrim, DatKomm Art. 57 GDPR para. 27 [as of July 1, 2024, rdb.at]).
3.8. Requests or complaints are considered "manifestly unfounded" if, upon reasonable consideration of the arguments presented, there is absolutely no prospect of success for the data subject (Zavadil in Knyrim, DatKomm Art. 57 GDPR para. 27 [as of July 1, 2024, rdb.at]). As already discussed, the purpose of the complaint(s) is to obstruct or delay the debt collection by the other party involved. In the present case, there can be no doubt that a creditor may lawfully process a debtor's personal data—name, date of birth, and address—in the context of debt collection. This applies regardless of any specific details—which is why a changed name and address may undoubtedly be processed (without renewed consent or any other procedure).
Even if the respondent authority were to address the complaint, the complainant would have no chance of success, as there is no argument whatsoever as to why the creditor's processing of the relevant data in connection with the debt collection could be unlawful. The complaint must therefore be classified as manifestly unfounded within the meaning of Article 57(4) GDPR. Even if the respondent authority were to address the complaint, the complainant would have no chance of success, as there is no argument whatsoever as to why the processing of the relevant data by a creditor in connection with a claim could be unlawful. The complaint must therefore be classified as manifestly unfounded within the meaning of Article 57(4) GDPR.
Furthermore, it is undoubtedly abusive simply by virtue of its nature – the (attempted) obstruction of debt collection or the (albeit rather abstract) attempted intimidation of the other party involved.
3.9. The authority in question generally has the option, within the scope of Article 57(4) GDPR, of either imposing a reasonable fee or refusing to process the complaint altogether. However, it must consider all relevant circumstances and ensure that the chosen option is appropriate, necessary, and proportionate (Austrian Administrative Court [VwGH] of 29 January 2025, Ro 2023/04/0018-9; European Court of Justice [ECJ] of 9 January 2025, C-416/23). In this context, the suitability of the chosen option for achieving the objective of Article 57(4) GDPR, namely to prevent abuse of the data subject's right to pursue their rights under the GDPR, must also be examined (Austrian Administrative Court [VwGH] of 29 January 2025, Ra 2023/04/0002-11). 3.9. The competent authority has the option, in principle, of choosing whether to impose a reasonable fee or refuse to process the complaint altogether, within the scope of Article 57(4) GDPR. However, it must consider all relevant circumstances and ensure that the chosen option is appropriate, necessary, and proportionate (Austrian Administrative Court [VwGH] of 29 January 2025, Ro 2023/04/0018-9; European Court of Justice [ECJ] of 9 January 2025, C-416/23). In this context, the suitability of the chosen option for achieving the objective of Article 57(4) GDPR, namely to prevent abuse of the data subject's right to pursue their rights under the GDPR, must also be examined (Austrian Administrative Court [VwGH] of 29 January 2025, Ra 2023/04/0002-11).
Austrian Administrative Court [VwGH] of 29 January 2025, Ra 2023/04/0002-11. The respondent authority's assessment that imposing a fee would not deter the complainant from pursuing the unfounded and abusive complaint, and that the complainant would likely pay the fee since it would probably be significantly lower than the amount demanded, is understandable and correct. In the present case, it cannot be assumed that imposing a fee would achieve the objective of Article 57(4) GDPR – namely, to prevent the abuse of a data subject's right to pursue their rights under the GDPR. The respondent authority's assessment that imposing a fee would not deter the complainant from pursuing the unfounded and abusive complaint, and that the complainant would probably pay the fee since it would probably be significantly lower than the amount demanded, is understandable and correct. In the present case, it cannot be assumed that imposing a fee would achieve the objective of the provision of Article 57, paragraph 4, GDPR – namely to prevent the abuse of the opportunity afforded to a data subject to pursue their rights under the GDPR.
Taking into account all relevant circumstances, the chosen option of refusing to process the complaint pursuant to Article 57(4) GDPR proves to be appropriate, proportionate, and ultimately necessary.
Regarding B) (In)admissibility of the appeal:
3.12. Pursuant to Section 25a(1) of the Administrative Court Act (VwGG), the Administrative Court must state in the operative part of its judgment or decision whether the appeal is admissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG). The statement must be briefly reasoned.
3.12. Pursuant to Section 25a(1) of the Administrative Court Act (VwGG), the Administrative Court must state in the operative part of its judgment or decision whether the appeal is admissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG). The statement must be briefly reasoned. The appeal is inadmissible pursuant to Article 133, paragraph 4 of the Austrian Federal Constitutional Law (B-VG) because the decision does not depend on the resolution of a legal question of fundamental importance. The present decision neither deviates from the established case law of the Administrative Court nor is there a lack of relevant case law (see in particular the cited decisions of the Administrative Court and the European Court of Justice); furthermore, the existing case law of the Administrative Court cannot be considered inconsistent. There are also no other indications that the legal question to be resolved is of fundamental importance. There is also no other indication that the legal question to be resolved is of fundamental importance.
