BVwG - W245 2226261-1
From GDPRhub
| BVwG - W245 2226261-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 57(4) GDPR |
| Decided: | 24.03.2022 |
| Published: | 03.05.2022 |
| Parties: | anonymous DSB (Austria) |
| National Case Number/Name: | W245 2226261-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2022:W253.2226261.1.00 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (RIS) (in German) |
| Initial Contributor: | Heiko Hanusch |
The Austrian Federal Court held that the Austrian DPA was not allowed to reject a complaint as excessive. In particular, the DPA did not demonstrate that the specific complaint was similar to the other 86 filed by the same data subject.
English Summary
Facts
The controller is a psychotherapist and the data subject is his patient. About four years after the therapy had been stopped, the data subject requested access to his data. The therapist replied that no personal data was undergoing processing. The data subject was skeptical and filed a complaint with the Austrian DPA (DSB). The DSB considered the complaint excessive because 86 other complaints lodged by the data subject were still pending with it and therefore rejected to handle the complaint under Article 57(4) GDPR. The data subject appealed this decision to the Austrian Federal Court (Bundesverwaltunsgericht – BVwG). During the court proceedings, the DSB provided the court with a list of all pending cases which did not mention the content of the cases.
Holding
The Austrian Federal Court held that the rejection by the DSB was unlawful because the DSB failed to show that the present complaint and the past complaints were homogeneous. The court clarified that, according to the last sentence of Article 57(4) GDPR, the DPA bears the burden of demonstrating the excessive character of the request. The court then found that the amount of complaints is an important factor in determining whether a complaint is excessive. However, it also reasoned that the complaint must be of repetitive character which only occurs when the present complaint and the previous ones are (nearly) identical. In the present case, the court concluded that DPA did not show that the complaints were (nearly) identical since it only provided a list of the complaints pending without describing their the content and similarities.
Comment
The court sometimes spoke of "similar/homogeneous" and sometimes of "(nearly) identical", apparently meaning the same thing. The court did not take into account that Article 57(4) GDPR speaks of “in particular” when referring to the repetitive character as an example of an excessive request indicating that there are also other circumstances which can render a request excessive.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Postal address:
Erdbergstrasse 192 – 196
1030 Vienna
Phone: +43 1 601 49-0
Fax: + 43 1 711 23-889 15 41
Email: einlaufstelle@bvwg.gv.at
www.bvwg.gv.at
DECISIONS D A T U M
2 4 . 0 3 . 2 0 2 2
BUSINESS NUMBER
W 2 5 3 2 2 2 6 2 6 1 - 1/8 E
I M N A M E N D E R E P U B L I K !
The Federal Administrative Court has judge Mag. Jörg C. Binder as chairman and
the expert lay judges Gerhard Raub and Dr. Ulrich ZELLENBERG as assessor on the
Complaint by XXXX XXXX against the decision of the data protection authority of 06/11/2019
XXXX rightly recognized:
a)
The complaint will be followed, the contested decision will be remedied and the one prosecuted
Authority ordered to continue the lawful process.
b)
The revision is permitted in accordance with Art. 133 Para. 4 B-VG., - 2 -
Reasons for decision:
I. Procedure:
By letter dated October 26th, 2021, subject “Privacy complaint information XXXX turned to
XXXX (hereinafter complainant) to the data protection authority (hereinafter
relevant authority).
In summary, the complainant submitted an application on May 19, 2019
to have provided information about his data to the psychotherapist Mr. XXXX. In the year
In 2015, the complainant had his last consultation with Mr. XXXX
The complainant also attended the course years ago in a professional context
"Group dynamic processes - learn to lead groups!" Visited by Mr. XXXX. Mr. Mag.
XXXX replied to the complainant with an email dated 06/01/2019, no more data
on the person of the complainant from the professional cooperation with him
to have.
Subject to his right to information, the complainant sent an email dated
October 26, 2021 to the authority concerned and filed a complaint against XXXX.Mr. XXXX
was a psychotherapist and had at least ten years from the end of the care service
Retention periods according to § 16a Abs. 3 PsthG and § 35 Abs. 3 PG 2013. According to § 132 BAO
would have XXXX according to tax law and corporate law standards
Retention requirements of at least seven years. The ABGB see a statute of limitations
from three years ago. The complainant has a right to information. Mr. XXXX is this
As a psychotherapist, he has not complied with his obligation to provide information.
With the decision of November 6th, 2019, XXXX, the competent authority rejected the treatment of the
Complaint in accordance with Art. 57 Para. 4 GDPR and stated that the
Complainant made a first complaint to the data protection authority on 06/14/2018,
which was recorded under the reference number D123.021. Since this
At that time, the complainant had 86 further procedures specified in more detail in the decision
pending. The majority of them have unlawful processing of the data of the
Complainant and his underage son on the content.
For all complaints, the complainant accuses different persons responsible
or respondent to incorrect processing of his data and the data of his, - 3 -
minor son. This argument, always the same, by the complainant was in
In view of the facts to see that the minor son is his ordinary
no longer stay with the complainant in Austria and the complainant
was also no longer entitled to custody of his son. For all complaints of
Complainant is addressed that his personal data as well as the
personal data of his underage son through various public and
private bodies in Austria and Italy - also incorrectly reproduced by XXXX
or processed. In addition, the complainant has numerous
Complaints against the received data protection information from various public
and private bodies brought to the data protection authority, which, in the opinion of the
complainant in the allegedly inadmissible processing of his data and
the data of his underage son are involved. The authorities concerned therefore have priority
against the background of the total number of complaints submitted and the
Complainant himself stated the core of his complaint, in which it always
to the allegation of incorrect reproduction or processing of his data and
of the data of his underage son go through various responsible persons, from
a "frequent repetition" within the meaning of Art. 57 Para. 4 GDPR.
The complainant appealed against this decision in a letter dated November 24, 2019
timely complaint, which the competent authority on 06.12.2019 dem
was submitted to the Federal Administrative Court. As far as relevant to the procedure, the
Complainant stated that the application against XXXX was obviously not unfounded or
excessive, for example, this states that at the beginning of 2016 there were professional data on
person of the complainant. The blanket reference to other procedures
have no probative value with regard to the reasoning of the authority concerned in the
the present proceedings. The complainant is concerned with the violation of a right
for information. Contrary to the assertions of the authority concerned, he did not believe
that XXXX is processing personal data relating to his underage son. Of the
In these proceedings, the complainant is merely violating his right to information
applicable to the authority concerned. A case of Art. 57 Para. 4 GDPR does not exist
before, since neither a "recurrence" nor a "frequent repetition" is given., - 4 -
II. The Federal Administrative Court considered:
The complaint is justified to the extent evident in the decision:
1. Findings:
The complainant addressed the relevant authority in a letter dated October 26, 2021
and essentially argued that his right to information had been violated by XXXX
be.
The authority concerned rejected the treatment of these with a decision dated November 6th, 2019, XXXX
Complaint according to Art. 57 Para. 4 GDPR, since as of 16.10.2019
File management system ELAK 86 files relating to the complainant and
various respondents were conducted. Therefore, the authority concerned went by
excessive use of the right to lodge a complaint.
It is found that in the tabular led by the competent authority
List of the procedures recorded by her for this complainant, the content and
the respective requests for these complaints are not evident. Furthermore, it is determined
that none of the above proceedings were conducted against XXXX.
With a complaint dated November 24, 2019, the complainant made the
violation of his right to information and not as claimed by the authority concerned
alleges the incorrect processing of the data of his underage son.
2. Evidence assessment:
The above statements are based on an inspection of the
administrative act submitted to the authority concerned, the administrative court act,
the decision of the competent authority and the complainant's complaint.
3. Legal assessment:
to A)
The subject of the proceedings is the question of whether the requirements of Art. 57 (4) GDPR
are met and the refusal of the respondent to deal with the complaint
authority was rightly done., - 5 -
The governing provision of REGULATION (EU) 2016/679 OF THE EUROPEAN
PARLIAMENTS AND COUNCIL of April 27, 2016 on the protection of natural persons at the
Processing of personal data, the free movement of data and the cancellation of the
Directive 95/46/EG (General Data Protection Regulation, hereinafter referred to as GDPR).
excerpt as follows:
"Art. 57 para. 4 GDPR
In the case of manifestly unfounded or — in particular in the case of frequent repetition —
excessive requests, the supervisory authority may charge a reasonable fee on the
Request based on administrative costs or refuse to act on the basis of the request
to become. In this case, the supervisory authority bears the burden of proof for the obvious
unreasonable or excessive nature of the request.”
The data protection complaint relates to a request for information from the
Psychotherapists XXXX which the applications to assert the right to
Information pursuant to Art. 13 et seq. GDPR and the right to information pursuant to Art. 15 GDPR
was complete, incorrect and untimely.
According to Art. 57 Para. 4 GDPR, last sentence, the authority bears the burden of proof for the obvious
unfounded or excessive nature of the request. In the present case, the
authority on the total number of complaints submitted and the
Complainants have always alleged violations of a large number of rights
the processing of the data of his underage son by various
Respondent against whom he had also made numerous requests for information.
The investigative process of the authority concerned is limited to the literal
Reproduction of the complainant's attachment and a list of the
complaints pending by the complainant and the determination that
that the bulk of the complaints submitted by the complainant concern the processing
of the data of his underage son. As the primary core of the complaint to the
The authority concerned will be accused of incorrect reproduction by the authority
or processing of the data of the complainant and the data of his
underage son defined by various responsible persons, against which - as well
In the present case, numerous requests for information had been made. This question
according to the official statements, the majority of the others are with her
Appellant's pending proceedings based. From the point of view of the authority is one
Basic protection no longer to be assumed.
The competent authority is to concede that the complainant has a not inconsiderable
number of attachments addressed to them. The senate responsible for the decision fails to recognize - 6 -
not the fact that the problem smoldering in the background about the custody of the
minor son of the complainant the starting point of numerous complaints
appears to be with the data protection authority. From the point of view of the Senate responsible for the decision
However, the authority has the proof to be provided by the mere reproduction of the
Attachment of the complainant, the tabular list of her to this
Complainant logged procedures and the presentation of the official
assumedor assumedmotiveofthecomplainant,notdelivered.Itwouldhave
at least an overview of the content of the relevant authority
pending proceedings and their similarity (explanation that the requested information
is already the subject of numerous proceedings). From the authority concerned
submitted tabular list of the procedures logged with her
Complainant is not clear what content these complaints had and whether these
actually had numerous requests for information on the subject. The Regulatory Authority
can only reject applications if they are manifestly unfounded or disproportionate
where the volume of applications plays an important role (Nguyen in Gola, Datenschutz-
Basic Ordinance, 2nd edition, Art. 57 margin no. 16). An application after the is excessive
Legal wording of Art. 12 Para. 5 S.2, if it is repeated too often (Franck in Gola,
General Data Protection Regulation, 2nd edition, Art. 12Rz35).
considered if the applicant despite lawful information or rejection
the person responsible submits further (almost) identical applications (Heckmann/Paschke
in Ehmann/Selmayr, General Data Protection Regulation, 2nd edition, Art. 12 margin no. 43). That the
procedural application is almost identical to the other applications, it follows
from the explanations given by the authority concerned. The authority concerned came to her
Burden of proof that the complainant's numerous applications are
identical applications is therefore not sufficiently followed up.
This results in the contested decision being remedied and the execution of the
lawful procedure by the authority.
It was therefore to be decided accordingly.
Re B) Admissibility of the revision:, - 7 -
According to § 25a Abs. 1 VwGG, the administrative court in the ruling of its knowledge or
Pronounce a resolution as to whether the revision is permissible in accordance with Art. 133 Para. 4 B-VG. Of the
Statement must be briefly justified.
The revision is admissible according to Art. 133 Para. 4 B-VG because the decision of the solution
depends on a legal question, there is no jurisdiction of the Administrative Court.
