BVwG - W274 2246166-1
|BVwG - W274 2246166-1|
|Relevant Law:||Article 12(3) GDPR|
Article 15 GDPR
Article 77(1) GDPR
§ 13(8) AVG
§ 24(1), (6) BDSG
|National Case Number/Name:||W274 2246166-1|
|European Case Law Identifier:||ECLI:AT:BVWG:2021:W274.2246166.1.00|
|Original Source:||Rechtsinformationssystem des Bundes (RIS) (in German) (in German)|
|Initial Contributor:||Heiko Hanusch|
The Federal Administrative Court held that the Austrian DPA rightfully rejected a complaint by a data subject regarding an access request that was responded late but during the administrative proceedings. It also held that when large amounts of data are processed, access requests may be answered in a two-step approach.
English Summary[edit | edit source]
Facts[edit | edit source]
The data subject has requested access to their personal data under Article 15 GDPR. The controller (Arbeitsmarktservice Österreich) did not fulfill the request at first. Later – during the administrative proceeding – the controller, however, did. Thereupon, the DSB (Austria) informally closed the proceeding. The data subject objected to the termination of the proceedings on the grounds that the answer to their request was too late and was insufficient. The DSB maintained its decision arguing that the data subject has no right to have a past violation of the GDPR determined and that the assertion of insufficiency is be regarded as a new submission under § 13(8) AVG since it changes the substance of the matter.
Holding[edit | edit source]
The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision and reasoning of the DSB.
First, the court elaborated on Article 15 GDPR though these statements were not necessary for the decision of the case. It held that a data subject has no general duty to cooperate, but at most an obligation to specify if the controller processes a large amount of data and the data subject makes a very general request or is only interested in specific information or data processing. In these cases, the controller can request clarification from the data subject, but has no right to do so. The data subject may nevertheless insist that all data be disclosed. This means that the two-stage information procedures that occur in practice, in which the data controller initially only provides information on master data and only provides comprehensive information at the express request of the applicant, are perfectly permissible, provided that the applicant is made aware of this fact.
Second, the court determined that the DSB was not allowed to close the proceedings informally but should have issued a formal notice according to § 24(6) BDSG because the data subject had objected with reasons against the termination of the proceedings.
Third, the court stipulated that the complaint about the delayed (Article 12(3) GDPR) response by the controller does not amount to a new complaint under § 13(8) AVG but is encompassed by the original complaint as a minus to it. However, it reasoned that a data subject has no right to have a past infringement of the GDPR determined by the data protection authority since § 24(1) BDSG and Article 77(1) GDPR refer to “infringes” in the present tense and not “has infringed”. Moreover, the court referred to Recital 63 according to which the right of access is intended to enable data subjects to be aware of the processing of personal data concerning them and to verify its lawfulness. In order to achieve this goal, it is not necessary for data subjects to have infringements which have been remedied in the meantime declared as unlawful. It also cited the decisions of the Supreme Administrative Court of Austria (Verwaltungsgerichtshof – VwGH, 2006/06/0330) and of the Austrian Constitutional Court (Verfassungsgerichtshof – VfGH, VfSgl. Nr. 12.768).
At last, the court determined that the "matter" of a proceeding (§ 13(8) AVG) which alleged non-disclosure under Article 15 GDPR cannot be entirely severed from the question of the completeness of the answer to the request. The core of the right of access is that the controller must disclose the specific content of all data being processed. However, the objective of Article 15 GDPR to enable the data subject to exercise their other rights must be considered as well. Therefore, if this objective is achieved by the answer, disputes about the sufficiency of specific parts of the answer may be considered as a different matter. This does, naturally, not apply to expressly limited requests of confirmation as to whether data about the data subject is being processed under the first part of Article 15(1) GDPR. Such matters are resolved with a simple yes or no answer.
Comment[edit | edit source]
Although the termination of the proceedings should have been formally pronounced by the DSB, the court did not annul the decision since the data subject requested the correction of the decision and not the annulment.
The reasoning behind the missing right of a data subject to have a past violation declared seems disputable. Past violations may be fined by DPAs under Article 83 GDPR. Such a fine would be an implicit decision on a past violation.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Postal address: Erdbergstrasse 192 – 196 1030 Vienna Phone: +43 1 601 49-0 Fax: +43 1 711 23 – 889 15 41 Email: email@example.com www.bvwg.gv.at DECISIONS D A T U M 2 2 . 1 2 . 2 0 2 1 BUSINESS NUMBER W 2 7 4 2 2 4 6 1 6 6 - 1/4 E I M N A M E N D E R E P U B L I K ! The Federal Administrative Court recognizes Mag. LUGHOFER as chairman through the judge as well as the expert lay judges Prof. KommR POLLIRER and Dr. GOGOLA about the Complaint by Mag. XXXX against the decision of the data protection authority, Barichgasse 40- 42, 1030 Vienna, from July 26th, 2021, GZ: XXXX, involved labor market service Austria, XXXX , due to violation of the right to information, rightly in a non-public session: The complaint will not be followed. The revision is not permitted according to Art. 133 Para. 4 B-VG. Reasons for decision: By e-mail dated June 10, 2020, Mag. XXXX (hereinafter: complainant, BF) filed a complaint the labor market service Austria (participating party before the administrative court, MB). the data protection authority (hereinafter: the authority concerned) Complaint pursuant to Art. 77 GDPR because of violation of the right to information (Article 15 GDPR) and claimed that he hadam 01/31/2020 submitted an application to the MB, in which he asked them to do so, - 2 - to grant him this right. The MB did not respond to his request within a month reacted. He therefore raises a complaint because of the failure to provide information on the part of the MB according to DSGVO or DSG. In the attachment, the BF sent the application dated to the MB (by e-mail). 01/31/2020: "Re: Data information according to DSG/DSGVO about my person I now ask you to send me all in your system about me in accordance with DSG/DSGVO stored data, including the information (as specified by your ombudswoman in XXXX executed) also who entered, saved, changed, retrieved as well as passed on. Furthermore, I ask you to transmit all information which is within the AMS and between the AMS and third parties about my person. Ideally, I would ask you to transmit the data in electronic form by email or Download." The official file does not indicate whether the request by the relevant authority to Statement of 13.7.2020 which MB reached. On December 18, 2020, the MB returned a request of the same content dated December 2, 2020 Statement in which she stated that the BF had by copying the MB in the mail dated 06/10/2020 (complaint filing) the team of the data protection officer of the MB about the information not received. The necessary steps are to be taken on the same day been arranged to send the relevant information to the BF. At the On June 15, 2020, the office completed the IT-supported creation and transmission of the data printout confirmed. The information was therefore provided within the complaint procedure, which is why requested that the appeal be dismissed as unfounded. In a letter dated December 22, 2020, the authority concerned sent the statement to the BF the MB from December 18th, 2020 with the note that due to the reaction of the MB the complaint in To be regarded as completed within the meaning of Section 24 (6) DSG. If the BF fails to do so within a period of two weeks justify why he originally claimed infringement (none, - 3 - response to the request for information) at least partially still as not eliminated consider that the authority concerned will discontinue the procedure informally. In a letter dated January 11, 2021, the BF stated that the MB’s statement was correct Review of the information sent to him by the MB from 06/15/2020 and 12/04/2020 (Providing information) surprising. The reason for their delay seems that this Information was crucial in a procedure and therefore by the MB not communicated within the period of one month from his request for information had been. In addition, the MB can be seen in the information provided in the meantime sent requests for correction ignored and only incomplete and partial incorrect information submitted. In addition, the XXXX branch also has data forwarded by him, for which he expressly gave no authorization. The MB has in the processing, collection, processing and forwarding of his data in the following points in data processing or disclosure demonstrably not the GDPR Compliant: "1. Delayed information (1st information on 15.6.2020, 2nd information on 4.12.2020) 2. Incomplete submission of information (only titles of attachments and no copies e.g. 2. information page 38 final report_ XXXX ) 3. Missing information in the first report (e.g. 1st report page 1 etc. Information on the right to information and the basis for collecting data) 4.Missing information in the second disclosure (e.g. 2nd disclosure page 101ff.none Information on information from third parties, for example companies, no information on automatic decision-making based on stored data) 5. Correction not made (e.g. 2nd information page 44 transcript) 6. Incorrect information (e.g. 2nd information page 4 point dates) 7. Missing information to pass on information to third parties (e.g. 2. disclosure Page 44 private phone number and social security number to Mr. XXXX and Ms. XXXX has been demonstrably transmitted by the job market service XXXX), - 4 - 8. Missing information for personal appointments (e.g. request for an extension of support measure ItWorks) 9. Unauthorized obtaining of information from third parties (e.g. 2nd disclosure page 31 XXXX )” On the basis of the demonstrably incomplete, uncorrected and incorrect or non-GDPR compliant collection of information in the information provided by the MB data, he was convinced that his right to information was neither timely nor fully answered and corrected. He therefore asks for appropriate Response of the authority concerned due to violation of the DSG/GDPR to the MB. In the appendix, the BF sent the information provided by the AMS XXXX of June 15, 2020 (50 pages) and from December 4th, 2020 (109 pages) as well as an e-mail sent to the MB dated 01/27/2020: This is excerpt: "Violations of the GDPR/DSG by AMS XXXX: […] As discussed over the phone, there are currently three violations of the Data protection regulation or your internal guidelines of employees of the AMS XXXX in specifically my supervisor Ms. XXXX, your supervisor Mr. XXXX and the Head of department Mr. XXXX : 1. Disclosure of my phone number to third parties (see attachments and statement of facts telephone number) 2. Disclosure of social security numbers to third parties (see Appendices and statement of facts social security number) 3. Failure to verify PIN number when calling AMS XXXX (see statement of facts PIN number) […] it would be ideal if you […] manage the respective people to comply with the to ask for data protection rules […].” With a notification dated January 25, 2021, the relevant authority informed the BF of the (informal) Discontinuation of the proceedings and stated in summary that the MB - like the BF in carried out his submission of January 11, 2021 himself - their obligation to provide information, - 5 - complied. You have the request of the BF for information (refusal to provide information) in Complyed with the meaning of § 24 Para. 6 DSG and thereby the alleged infringement subsequently eliminated. At the same time, however, the BF stated that he considered this information to be inadequate. According to § 24 paragraph 6 DSG is by law from the withdrawal of the original complaint and the simultaneous filing of a new complaint if a statement by the complainant would change the essence of the matter. In this case, the original complaint procedure should be discontinued informally and the to inform the complainant. This is the case here. In the original complaint, the BF violated the law requested information due to information that was not provided. Since he is now a claims that the information provided is inadequate, the nature of the procedural matter changes as a result after. The complaints procedure should therefore be discontinued informally in accordance with Section 24 (6) DSG been. At the same time, the BF's submission of January 11, 2021 due to alleged infringement is in the right for information (inadequate information) as a new complaint about a new reference number been logged. With a submission dated February 10, 2021, the BF submitted that the termination of the proceedings was for him neither understandable nor does he agree with it. The MB got me their late Feedback violate the DSG or the GDPR. Furthermore, they also have against it Section 229 or Section 295 of the Criminal Code is violated because it gives the BF access to evidence in denied court proceedings. He therefore asks for the "cancellation of the setting" of the Procedure and creation of a decision, which the violations of the MB against the GDPR or against § 229 or § 295 StGB. With the contested decision, the authority concerned rejected the complaint of the BF as unfounded and stated that due to the application of the BF, despite the Provision of information is a violation of the right to information in accordance with Art. 15 GDPR to be determined, with a decision on his application to be discussed. The BF essentially argued that the information from the MB was late and incomplete., - 6 - Regarding the delay, it should be noted that Art. 77 GDPR (in conjunction with Section 24 DSG) only gives the right can be deduced to lodge a complaint with a supervisory authority and thereby Enforcement of subjective rights - if necessary by means of an official performance mandate enable. A right to ascertain that the information was provided too late cannot be taken from this provision. The input of the BF from January 11th, 2021 is the alleged incompleteness of the information in this regard as a new entry in a separate data protection procedure been judged because the substance of the matter had changed. A complaint about information that is not provided is fundamentally different from information that was provided inadequately differentiate. The complaint regarding the alleged defectiveness will be Procedure XXXX treated. The BF filed a timely appeal against this decision with the application that contested decision "to improve, supplement and correct the violations of Respondent (here MB) against the GDPR to be included accordingly”. the The MB was late in answering the request for information and correction and violate the GDPR. The decision does not mention that the MB against the have violated the statutory obligation to provide information within the statutory period of time in accordance with the GDPR. Moreover, in spite of repeated requests, he was given part of what was demanded of him Information has not been provided to date. The MB have therefore to comply with his orders to remedy defects and it is the verifiable to include withholding of information in the decision. On September 1st, 2021, the authority concerned submitted the complaint, following the electronic administrative file with the request to dismiss the complaint. The Federal Administrative Court bases its decision on the just presented - undisputed and covered by the content of the file - the course of the procedure is based and supplemented these as follows: With regard to the BF's request for information of January 31, 2020 and after "Copying the MB through the email from the BF of June 10, 2020, the MB sent the BF 2 a letter of information: The one from June 15th, 2020 with a total of 50 pages (hereinafter: "Information 1") and the one from December 4, 2020, 109 pages ("Information 2"). Both pieces of information provide information on the first page about the content and the legal basis of the Information., - 7 - "Information 1" includes, as far as can be seen, essentially the history of the Mediation efforts regarding the BF, "Information 2" also includes “Employment and Insurance Data” and Benefit (Payout) Data. Among other things, the following circumstances are presented in the information: In "Information 2" p 38 as part of a chronological multi-page table, referred to S 19 as “chronological documentation”, the following entry on June 5th, 2020: "Report of a training session The following attachments are available for this document: Final Report XXXX." (Fact 1) In "Information 2" p 44 (reproduced without correction): "Date created: 24.1.2020 Information/conversation notes/notes Mr XXXX : I phoned Mr. XXXX and asked if he was on 3.2. could start to work. Mr. XXXX has said he still has court hearings due on 04/02/20 and he also has on a loan that he can't service with the salary we pay Ms XXXX : Customer comes to the interview (23/01/20) does not give any personal data the private is also Mr. XXXX wrote down everything I said. Mr XXXX would like to work at home because he lives in XXXX would like to please say that he does I can probably start working on February 3rd, 2020, but I have to go to Vienna on February 4th a witness statement. Finally, Mr. XXXX wanted a confirmation from me that I had one His private phone number was transmitted from the office and I his private number called even though he indicated a different one for job interviews. I him said he didn't get it. Then Mr XXXX said he would take me in because I refused him a confirmation. I rejected that, whether he still wanted me I can't tell because he held his cell phone in his hand for a while..., - 8 - Due to the behavior of the customer, no possibility of an AA" (Fact 2) In "Information 2" on page 101 under "Where does the processed data come from (origin)?" "The AMS processes personal data that it receives from you, e.g. as part of the Applying for services and funding or as part of the advisory or mediation process receives. The AMS also processes personal data that it receives from other bodies for the Fulfillment of its tasks and legal obligations provided by the following institutions: umbrella organization of social security institutions Central register of residents tax offices pension insurance institution competent federal ministry In general, other authorities, courts, social security institutions and Social assistance, the Ministry of Social Services and institutions for which the tasks of the AMS have been transmitted, transmit personal data to the AMS, insofar as this is necessary for the execution of the statutory duties are essential. Within the framework of administrative assistance Regional authorities, municipal associations and other self-governing bodies transmit personal data to the AMS. ... Who receives your data (categories of recipients)? The AMS transmits to other authorities, courts, social security institutions and the Bundesanstalt Statistics Austria personal data, insofar as this is necessary for the execution of the statutory duties are essential ..., -9- Employers receive data from the AMS in connection with the establishment of a employment relationship and the assessment of professional suitability or the implementation of the application process are required. .." (Fact 3) The supplementary statements are based on the ones specified in the file Bundles with which the MB provided information. Legally follows: According to Art. 15 Para. 1 GDPR, the person concerned has the right to be informed by the person responsible to request confirmation as to whether personal data concerning you are processed; if this is the case, she has a right to information about this personal data or the following information: a) the processing purposes; b) the categories of personal data being processed; c) the recipients or categories of recipients to which the personal data has been or will be disclosed; d) if possible, the planned duration for which the personal data will be stored or if that is not possible, the criteria used to determine that duration; e) the existence of a right to rectification or erasure of data concerning them personal data or restriction of processing by the controller or a right to object to this processing; f) the existence of a right of appeal to a supervisory authority; g) if the personal data are not collected from the data subject, all available information about the origin of the data; f) the existence of automated decision-making including profiling pursuant to Art. 22 para. 1 and 4 and - at least in these cases - meaningful information about the logic involved, and the scope and intended impact of any such Processing for the data subject., - 10 - According to Art. 15, only the data subject has a right to information, which they assert have to do. A general obligation to cooperate cannot be derived, but at most one Obligation to specify if the controller processes a large amount of data and the data subject submits a very general request or only on specific ones information or data processing is interested. In these cases, the Controller entitled to request clarification from the data subject, he has but not entitled to it. The person concerned can nevertheless insist that all data are disclosed. This means that the two-stage ones that occur in practice are Information procedures in which the person responsible initially only discloses master data and only provides comprehensive information at the express request of the applicant, entirely permissible provided the applicant is informed of this fact (Haidinger in Knyrim, DatKomm, Art. 15 GDPR, margin no. 11). According to § 27 VwGVG, the administrative court issued the contested decision on the basis of the Complaint (§ 9 Para. 1 Z 3 and 4) or on the basis of the declaration of the scope of the challenge (§ 9 Para. 3) to review. According to the judicature, the VwG is responsible for examining the matter before it on the basis of the In its legal assessment, the complaint is not bound by the complaint. However, if the complainant bears a certain burden of allegation, then the relevant factual statements limit the facts to be ascertained and thus the authority to examine the VwG (Fister/Fuchs/Sachs, administrative court proceedings² (2018) § 27 VwGVG S 190). In the matter: The following must be sent in advance: As shown in the course of the procedure, the authority concerned sent the BF the Statement of the MB with letter dated December 22nd, 2020 § 24 para. 6 DSG and expressly stated that if the BF did not justify within a period, why he still considers the originally claimed infringement at least in part not eliminated, the data protection authority will informally discontinue the procedure. When "Originally alleged infringement" of the BF expressly stated the authority concerned "No response to the request for information". The fact that there has been a response to the request for information in the meantime (a transmission of a data printout) results from the statement of the MB from December 28th, 2020., - 11 - The BF also confirms this fact in his letter to the relevant authority dated 01/11/2021 ("... after reviewing the information sent to me by the 15.06.2020 and 04.12.2020 ..."). It follows from this letter that the BF criticizes the delay in the information, but also states that this is incomplete(and partly incorrect). on "Page 38 final report_ XXXX", "Page 101 ff. no information for the information of Third parties, e.g. companies, do not provide any information for automatic decision-making on the basis of stored data" and regarding "Page 44" for the transfer of information to third parties. The authority concerned then initiated the procedure for the reference number at issue here informally according to §24 Abs and stated that the BF reported in his submission of January 11, 2021 that the MB was her complied with the obligation to provide information, but at the same time he submitted that he considered this information as insufficient. In relation to a non-provided information put a Insufficient information represents a change in the nature of the matter in accordance with Section 13 (8) AVG, which is why the subject procedure for information is to be discontinued informally and the input dated January 11, 2021, due to insufficient information, is to be regarded as a new complaint and in had been recorded in an independent procedure for a new reference number. After the BF then, in a letter dated February 10, 2021, “repealed the suspension of the Procedure and preparation of a notice” sought, the authority concerned rejected Complaint of violation of the right to information as detailed above. To do this: Pursuant to Section 24 (6) DSG, a respondent can Data protection authority subsequently eliminate the alleged infringement by corresponds to the requests of the BF. If the complaint appears to the data protection authority to the extent that pointless, she has to hear the BF about it. At the same time he is paying attention to it make sure that the data protection authority will informally discontinue the procedure if he does not within a reasonable period of time why he originally claimed that Violation of the law is at least partially still considered not to have been remedied. Will through such a statement by the complainant changed the essence of the matter (§ 13 Para. 8 AVG), the original complaint and the simultaneous filing of a new complaint. Also in this case it is - 12 - to informally discontinue original complaint procedures and the complainant thereof to agree. The purpose of this provision is that the BF has the opportunity to respond to the Respondent to comment and to give reasons why he originally alleged violation of rights is still considered not to have been remedied. Does he Those responsible have the option of pursuing the alleged infringement until the conclusion of the procedure before the data protection authority, e.g. by providing information of the complainant is met, this is if no arguments according to which the information has been provided inadequately and this is not inferred from the complaint can be made harmless or the data protection authority has the asserted violation of his right to information informally cease (Thiele/Wagner, Practical commentary on the Data Protection Act (DSG) § 24, margin nos. 259, 260 mwN, rdb.at) In general, the setting not expressly provided for in the AVG becomes one Administrative procedure then considered admissible if no party has more entitlement to settlement. This can also be expressly stated in the administrative regulations be provided (e.g. § 24 Para. 6 DSG). An outwardly appearing form, in particular the form of notification of the termination of proceedings, is not provided for in the AVG. To it according to the judicature of the VwGH, the fact that with the setting certain legal consequences are associated with the procedure, such as the termination of the pending proceedings. Proceedings can be discontinued simply by making a memorandum to the file be certified. However, it is also argued that the hiring will be recognized in the form of a notification must if the existence of a reason for hiring is disputed (Hengstschläger/Leeb, AVG § 56 margin nos. 87 and 88 with further references). According to Walter/Mayer, Grundriss des Österreichisches Administrative Procedure Law, margin no. 374, has the setting in undisputed cases without to issue a notice. Already according to the legal text of § 24 paragraph 6 DSG, which is also used by the authority concerned in Letter dated December 22nd, 2020, will only be discontinued informally if not reasons are given as to why the originally alleged violation of the law was at least partly justified is still considered unresolved. A reaction (of whatever kind) to the request for information in no way excludes that the initially claimed Violation of the right to withhold information also subsequently, at least partially is not eliminated. The same follows from the presentation in Thiele/Wagner, margin no. 260, as above., - 13 - It would be conceivable that the person concerned, in accordance with the wording of Art. 15 para. 1 GDPR only requires confirmation as to whether data relating to him is being processed will. However, the request for information on which this is based also includes that Request for information on the content. It is certainly permissible in the case of a very general request for information and a large amount of processed data in the sense of a two-stage information procedure initially only to provide information about the master data and only upon express request to provide comprehensive information, in this case the applicant would have to refer to this circumstance but be advised (Haidinger in Knyrim, DatKomm Art. 15 GDPR, margin no. 11). This was obviously not the case here, especially since - albeit only during the course of the proceedings - extensive content-related information was given to the BF on the basis of the first application. Based on the unequivocal statement of the BF in his letter dated January 11, 2021, (in response to the authority's notification of the intended cessation) according to which i.a. the information is incomplete and in this regard also individual specific circumstances were executed incompletely (see above), the relevant authority within the meaning of the The legal situation presented does not assume that there are reasons within the meaning of Section 24 (6) GDPR that the Authority to entitle the hiring, were undisputedly present. The authority concerned was therefore to informal cessation of proceedings is not justified. Apparently, the authority concerned considered due to the further input of the BF from 10.02.201 the procedure is not considered discontinued anyway, otherwise it would be application in this regard due to the lack of pendency of the proceedings as a result of the termination not to be done in terms of content but to be rejected. For the content of the notification: Regarding the alleged delay in providing information: In the complaint, the BF complains that the MB violated its obligation to provide information violate the legal deadline, whereby also a violation of §§ 229 and 295 StGB present. First of all, it should be noted that the submission of the late provision of information - as a minus to the non-disclosure of the information - at least of the matter of the data protection complaint as is to be considered included and does not lead to a significant change in the attachment of the BF led., - 14 - § 24 DSG is intended to grant a data subject the right to object to any violations of to enforce rights arising from the DSG or the GDPR (Bresich/Dopplinger/Dörnhöfer/Kunnert/Riedl, DSG (2018) Section 24 margin no. 7). A statement of Violations of the law, which no longer exist at the time of the decision of the data protection authority exist, but is expressly not intended, especially since § 24 paragraph 6 DSG in such a case basically provides for the informal discontinuation of the proceedings. For such an interpretation The present tense provisions of § 24 Para. 1 DSG and Art. 77 Para. 1 GDPR - "violates" and not "has violated" - as well as § 24 Para. 5 DSG, according to which a legitimate complaint about an infringement by those responsible for the private sector a performance notice must be issued. Such would already be in the case of one adjusted infringement not possible. In addition, according to recital 63 of the GDPR, the right to information serves to enable data subjects to to be aware of the processing of personal data concerning them and their verify legality. For the achievement of this goal it is for data subjects not necessary, infringements of rights that have been remedied in the meantime to be notified. The Administrative Court also ruled on the Data Protection Act 2000 (DSG 2000) Federal Law Gazette I No. 1999/1965, in the version of Federal Law Gazette I No. 13/2005, denied such a right (VwGH 09/27/2007, 2006/06/0330 with reference to the landmark decision VwGH 03/28/2006, 2004/06/0125). is not directly transferrable to the new legal situation, the supporting ones can Considerations of the Higher Administrative Court – essentially those outlined above Considerations correspond - be transferred to the new legal situation. Finally, the Constitutional Court also ruled on the legal situation before the DSG 2000, viz to the right to information according to §14 paragraph 1 of the Data Protection Act idFBGBlNr denied on the determination of past violations of the law that have since been remedied (VfGH June 26, 1991, VfSgl. No. 12,768). In particular, it follows that the fundamental right to Data protection, that in relation to the right to information - as far as relevant to the decision here - has not changed (§ 1 Para. 3 Data Protection Act as amended by Federal Law Gazette No. 565/1978 or § 1 Para. 3 Z 1 DSGidFBGBlINr.165/1999 last changed by BGBlINr.51/2012) does not show that his data subject has the right to a notification of the past violations of the law must be acknowledged. If the BF argues in the complaint that the contested decision is unlawful because the MB did not respond to the request for information within the statutory, - 15 - answered within one month or this circumstance is completely missing in the notification therefore to reply that - as shown - neither the DSG nor the GDPR in relation to the Right to information provides for the determination of past infringements, which is why the BF in any case not in his right solely due to the delayed provision of information by the MB information is violated. Regarding the alleged incompleteness of the information: Although the complaint is essentially the question of the late reply dedicated, the BF states sufficiently clearly that, despite repeated requests, there is one Part of the information requested by the MB not handed over until now been. The question underlying this objection of the "incompleteness of the Information” was dealt with very briefly by the authority concerned in the notice, in that it stated the second Input of the BF, that of January 11th, 2021, regarded as a new input and executed it circumstances to be dealt with in proceedings XXXX. To do this: As can already be seen from the above statements, the analogous reasoning is the authorities concerned both in the decision and the notification of January 25, 2021, according to which Circumstances concerning the completeness of information provided upon request should under no circumstances be dealt with in a procedure which, due to the primary refusal of Information was initiated not to follow: The "matter" of a complaint procedure alleged non-disclosure of information can not be a priori in the question exhaust whether at the latest by the end of the hearing any information, which Whatever the content and scope, has been granted. A settlement will the circumstance of Completeness of the information, based on the wording of the request for information, not can be excluded entirely. In any case, something else will apply if the request for information is initially expressly based on a confirmation as to whether data about the data subject is being processed (Art 15 para 1 1st case GDPR). On the other hand, particularly in cases where the controller is very extensive Data files of the data subject processed, not every conceivable issue of the completeness of information until its final clarification, the termination of a Information procedure, in which general information about the data of the person concerned is desired, can prevent., - 16 - The core content of the right to information is that the person responsible for the data subject person must disclose the specific content of all data processed about them (Jahnel in Jahnel, Commentary on the GDPR, Art. 15 Rz 18). An explicit literary debate or judicature on the question of how far the right to information is to be interpreted in the event of a general request for information and to what extent in cases of very extensive and complex data sets the person obliged to provide information may initially set a limit and it is reserved for the person seeking information to set further limits There is no way to ask for additional information. As a principle, it can be assumed that the data subject is in a position to continue his further processing by providing the information to exercise the rights of data subjects. As has been established, in the present case very extensive information was provided in two tranches ("Information 1" and "Information 2"). In his complaint, the BF left it at that to state that part of the information requested from him is up to the present time not been handed out. The complaint itself contains no clarifications in this regard. Only from the letter of the BF of 11.01.2021 regarding specific circumstances out to what extent the information was incomplete in the opinion of the BF. Even if apparently only as an example, the BF only addresses three facts here, whereby apparently once in the 109-page document "Information 2" a designated one Appendix (page 38 "Final report XXXX ") is not printed. Since this part of the file is mentioned, the BF is able to exercise further rights in this regard (also in in the sense of further detailing the information). Regarding page 44, entry from January 24th, 2020, the BF apparently complains that the entries in this regard require that the persons named there telephone number and social security number of the BF had been transmitted. In this regard, the BF apparently has the information that he does not disclose (“has been verifiably transmitted”). Finally, the BF apparently wants more information about the origin and transmission of Data beyond the information provided on pages 101 and 102. Irrespective of the legal assessment of the scope of the “matter of the here underlying administrative procedure" there is no objection to the result if the authority concerned the last questions raised by the BF on, - 17 - Incompleteness of the information or supplementary information no more than the subject of the original request for information was recorded, but this was the subject matter anyway of another procedure (to XXXX ), so that it will have to be dealt with there. As a result, the complaint is therefore not justified. An oral hearing within the meaning of § 24 VwGVG was not required, especially since the relevant facts are established according to the file situation. A hearing was held not requested. A factual submission that goes beyond the undisputed from the file goes beyond the obvious facts, was not reimbursed. Regarding the inadmissibility of the revision: The question of how far the primary obligation to provide information in the case is very extensive Databases in the case of a blanket information procedure, up to now in the highest court not resolved. Due to the constellation of facts, there is none in this regard procedure to be clarified legal question of fundamental importance.