The data subject, an Austrian citizen residing in Vienna, was enrolled in a distance-learning programme at a German university (the controller)

Decision Date April 14, 2026 Legal Norm Federal Constitutional Law (B-VG) Art. 133 para. 4 GDPR Art. 16 GDPR Art. 18 GDPR Art. 23 GDPR Art. 55 GDPR Art. 56 GDPR Art. 60 GDPR Art. 77 para. 1 ECHR Art. 8 Federal Constitutional Law (B-VG) Art. 133 today; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019 to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019, last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 133 valid from May 25, 2018 to December 31, 2018, last amended by Federal Law Gazette I No. 2018, last amended by Federal Law Gazette I No. 164/2013. 2014, last amended by Federal Law Gazette I No. 51/2012. 2013, last amended by Federal Law Gazette I No. 100/2003. 2003, last amended by Federal Law Gazette No. 444/1974. 1974, last amended by Federal Law Gazette.

No. 211/1946 B-VG Art. 133 valid from December 19, 1945 to December 24, 1946, last amended by Federal Law Gazette No. 4/1945 B-VG Art. 133 valid from January 3, 1930 to June 30, 1934 ECHR Art. 8 now ECHR Art. 8 valid from May 1, 2004 Judgment , W 254 2321912-1/10E IN THE NAME OF THE REPUBLIC! The Federal Administrative Court, composed of Judge Dr. Tatjana Cardona as presiding judge and lay judges Mag. Viktoria Haidinger and Mag. Thomas Gschaar, rendered the following judgment in a non-public session regarding the appeal of XXXX against the decision of the Data Protection Authority dated September 3, 2025, file number XXXX: A) The appeal is dismissed as unfounded. B) The appeal is inadmissible pursuant to Article 133, paragraph 4 of the Austrian Federal Constitutional Law (B-VG). Text Reasons for the Decision: I. Procedural History: 1. By filing a data protection complaint on April 3, 2024, amended on May 6, 2024, the complainant (hereinafter: the complainant) contacted the Data Protection Authority (hereinafter: the respondent authority or DPA) and argued, in summary, that XXXX (hereinafter: the co-respondent party or co-respondent) had failed to comply with a request for rectification pursuant to Article 16 GDPR from the official name to the chosen name XXXX, even though the chosen name of the complainant was factually correct.

, official documentation or supplementary identification) was inadmissible. 1. By filing a data protection complaint on April 3, 2024, amended on May 6, 2024, the complainant (hereinafter: bP) contacted the Data Protection Authority (hereinafter: the respondent authority or DPA) and argued, in summary, that the Roman numeral 40 (hereinafter: the party involved or mP) had not complied with a request for rectification pursuant to Article 16 GDPR from the official name to the chosen name Roman numeral 40, even though the chosen name of bP was factually correct. , official documentation or supplementary identification) was inadmissible. 2. By letter dated May 7, 2024, the respondent authority informed the applicant that, in the respondent authority's legal opinion, the Thuringian State Commissioner for Data Protection and Freedom of Information had subject-matter jurisdiction pursuant to Article 56(1) GDPR.

3. ) and therefore no incorrect data within the meaning of the GDPR existed that required correction. Furthermore, a supplementary ID card would only allow for changes to pronouns and first names. A change to the surname would not be possible, as the mP, as a higher education institution, is required to issue official documents with legal validity, such as certificates. 4. In a statement dated May 27, 2024, the bP argued that the mP's statements were contradictory and that its reasoning could not be accepted. 5. On May 13, 2025, after hearing the mP, the Thuringian State Commissioner for Data Protection and Freedom of Information submitted a statement to the respondent authority. He summarized that the right to rectification of personal data under Article 16 of the GDPR requires that the mP has violated Union law or the law of the Federal Republic of Germany in processing the data. The personal data must be inaccurate.

However, the bP was unable to demonstrate that the mP was processing data that did not correspond to reality. The mP, as a state-recognized university, issues certificates and diplomas that are valid outside the university. Therefore, individuals receiving certificates must be identifiable. There is no objection to the mP's request for a supplementary identification card. 5. On May 13, 2025, after hearing the mP, the Thuringian State Commissioner for Data Protection and Freedom of Information submitted a statement to the respondent authority. He summarized that the right to rectification of personal data under Article 16 of the GDPR requires that the mP has violated Union law or the law of the Federal Republic of Germany in processing the data. The personal data must be inaccurate. However, the bP was unable to prove that the mP was processing data that did not correspond to reality. The mP, as a state-recognized university, issues certificates and diplomas that are valid outside the university.

Therefore, individuals receiving certificates must be identifiable. There would be no objection to the request of the person concerned to have a supplementary identity card issued. On August 22, 2025, the Thuringian State Commissioner for Data Protection and Freedom of Information issued a decision with essentially the same content pursuant to Article 60(8) GDPR. 6. By the decision in question, dated September 3, 2025, the data protection complaint was dismissed. Regarding jurisdiction, the respondent authority stated that supervisory authorities cooperate in cross-border matters pursuant to Article 60 GDPR and that, in the event of a dismissal of the complaint, the supervisory authority to which the data protection complaint was submitted is competent to issue the decision. 6. By the decision of September 3, 2025, which is the subject of these proceedings, the data protection complaint was dismissed.

Regarding jurisdiction, the respondent authority stated that supervisory authorities cooperate in cross-border matters within the meaning of Article 60 of the GDPR and that, in the event of a dismissal of the complaint, the supervisory authority to which the data protection complaint was submitted is responsible for issuing the decision. In terms of substance, the respondent authority concurred with the lead German supervisory authority and summarized its reasoning as follows: mP, as an international university, is permitted to process the data of its students; bP has not submitted an official identification document to effect a name change, nor has it submitted a supplementary identification document. Furthermore, bP's arguments frequently refer to Austrian legal provisions, which are not applicable in Thuringia (Germany). mP, as a university, guarantees that issued certificates and conferred academic degrees are error-free and can be clearly attributed to a specific individual.

The documents issued by mP (the university) have legal effect outside the university, which is why the individuals concerned must be identifiable. Consequently, bP (the university) was not found to have been infringed in its right to rectification under Article 16 of the GDPR. The respondent authority concurred with the lead German supervisory authority and summarized that mP, as an international university, is permitted to process the data of its students. bP had not presented an official identification document to effect a name change, nor had it presented a supplementary identification document. Furthermore, bP's arguments frequently referred to Austrian legal provisions, which are not applicable in Thuringia (Germany). As a university, mP guarantees that issued certificates and conferred academic degrees are error-free and can be clearly attributed to a specific individual. The documents issued by mP have legal effect outside the university, which is why the individuals concerned must be identifiable.

Consequently, bP's right to rectification under Article 16 of the GDPR was not infringed. 7. By way of an appeal dated October 1, 2025, the bP (presumably a data subject) addressed the Federal Administrative Court, arguing in summary that there was an incorrect application of the law and that the accuracy of data is not automatic. The use of the bP's chosen name avoids misattributions and systematic misgendering. The CJEU, in its decision in case C-247/23 [Deldits], held that the exercise of the right to rectification under Article 16 GDPR must not be thwarted by relying on a lack of national procedures or by demanding excessive evidence. The evidence regarding the name demanded by the mP (presumably a data subject) is disproportionate, and the mP can verify the bP's identity at any time. Furthermore, it is unclear why German law, and not Austrian law, should apply. In a complaint dated October 1, 2025, the applicant (bP) appealed to the Federal Administrative Court, arguing in summary that there was an incorrect application of the law and that the accuracy of data is not automatic.

The use of the applicant's chosen name prevents misattributions and systematic misgendering. The European Court of Justice (ECJ) ruled in its decision C-247/23 [Deldits] that the exercise of the right to rectification under Article 16 GDPR must not be thwarted by relying on a lack of national procedures or by demanding excessive evidence. The evidence regarding the name demanded by the applicant (mP) is disproportionate, and the applicant can verify the applicant's identity at any time. Furthermore, it is unclear why German law, and not Austrian law, should apply. , learning platform, email alias, campus card, registration lists) and to process/display their official name only where legally required (certificates, notifications) and to implement technical and organizational measures to restrict the processing of and access to their official name. , learning platform, email alias, campus card, registration lists) and to process/display their official name only where legally required (certificates, notifications) and to implement technical and organizational measures to restrict the processing of and access to their official name.

to process/display only where legally required (certificates, reports) and to implement technical and organizational measures to restrict the processing of and access to their official name. 8. By letter dated October 8, 2025, received on October 10, 2025, the respondent authority submitted the administrative act in question to the Federal Administrative Court, contested the grounds of appeal, and referred in full to the decision. 9. The applicant was given the opportunity, by way of a hearing on October 27, 2025, to submit a statement on the applicant's appeal. 10. By letter dated November 5, 2025, the applicant transmitted a decision regarding the accreditation of the quality management system in accordance with the decision of the Accreditation Council. 11. In its statement of November 27, 2025, mP explained that it was legally obligated to identify students and process their data based on official identification documents.

This applied, on the one hand, to the certificates mentioned in the administrative proceedings, but also to other achievements of the students, such as individual assignments, seminar papers, or work within interdisciplinary study teams. Furthermore, students had access to various online services, such as an email program, cloud storage, and various work software, all of which were linked to the students' (official) names. License fees for these services would increase enormously if each student could use an additional chosen name. 12. In its statement of April 8, 2026, bP countered, in particular, that the respondent authority had apparently assumed, contrary to the record, that bP had requested the correction of the first and last names throughout mP's entire administrative system. The GDPR focuses on factual accuracy; the (in)accuracy and (in)completeness of the data must be assessed in light of the purpose for which the data were collected.

Article 8 of the ECHR protects a person's gender identity, which also implies the establishment of effective and accessible procedures that must guarantee effective respect for the right to gender identity. The applicant can also request a correction of their first and last name for the purpose of communication in everyday student life simply by means of a supplementary declaration. The proposal to submit a supplementary identification document contradicts the principle of facilitating the exercise of rights under the GDPR and the free provision of rectification requests. 12. In its statement of April 8, 2026, the applicant responded, in particular, that the respondent authority had apparently assumed, contrary to the record, that the applicant had requested the correction of their first and last name throughout the entire administrative system of the student. The GDPR focuses on factual accuracy; the (in)accuracy and (in)completeness of the data must be assessed in light of the purpose for which the data were collected.

Article 8 of the ECHR protects a person's gender identity, which also implies the establishment of effective and accessible procedures that must guarantee effective respect for the right to gender identity. The applicant can also request a correction of their first and last name for the purpose of communication in everyday student life simply by means of a supplementary declaration. The proposal to submit a supplementary identification card contradicts the principle of facilitating the exercise of rights under the GDPR and the requirement that requests for rectification be free of charge. II. The Federal Administrative Court considered: Roman numeral two. The Federal Administrative Court considered: 1. 1. The applicant is an international, accredited university located in XXXX, Germany. It can administer university examinations, issue certificates, and award academic degrees. 1. mP is an international, accredited university located in [City 40], Germany.

The bP has not submitted an official ID card certifying a name change or a supplementary ID card. A name change to the bP's chosen name has not been recorded in the mP's administrative system. 2. Evaluation of Evidence: The findings are based on the administrative act, in particular the data protection complaint, the statements, and the appeal against the decision. The facts of the case are undisputed. Regarding the accreditation of mP, a decision from the Accreditation Council Foundation was submitted with a statement dated November 5, 2025, confirming that mP's accreditation was valid until September 2033. org/2021/09/05/der-ergaenzungsausweis-der-dgti-e-v/. bP did not contest these statements. 3. 1. Legal Basis: Article 8 ECHR Right to respect for private and family life (1) Everyone has the right to respect for his or her private and family life, home and correspondence. (2) Any interference by a public authority with the exercise of this right shall be lawful only insofar as such interference is provided for by law and constitutes a measure which, in a democratic society, is necessary in the interests of national security, public safety, the economic well-being of the country, the prevention of crime, the protection of health or morals, or the protection of the rights and freedoms of others.

(1) Everyone has the right to respect for his or her private and family life, his or her home and his or her correspondence. (2) The interference by a public authority shall be lawful only insofar as it is necessary in the interests of national security, public safety, the economic well-being of the country, the defence of public order and order, the prevention of crime, the protection of health or morals, or the protection of the rights and freedoms of others. 2016, hereinafter referred to as GDPR, are as follows, including their headings: Article 16 Right to rectification The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Article 16 Right to rectification Article 18 Right to restriction of processing (1) The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject. (2) Where processing has been restricted pursuant to paragraph 1, such personal data shall, with the exception of storage, only be processed with the consent of the data subject or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

(3) A data subject who has obtained a restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction is lifted. Article 23 Restrictions (1) Union or Member State law to which the controller or processor is subject may, by legislative measures, restrict the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 insofar as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, provided that such restriction respects the essence of the fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society, ensuring: (a) national security; (b) national defence; (c) public security; d) The prevention, investigation, detection, or prosecution of criminal offences or the enforcement of criminal penalties, including the protection against and prevention of threats to public security; e) The protection of other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, such as in the areas of currency, budget, and taxation, as well as in the areas of public health and social security; f) The protection of the independence of the judiciary and the protection of judicial proceedings; g) The prevention, detection, investigation, and prosecution of breaches of the professional rules of regulated professions; h) Control, monitoring, and regulatory functions permanently or temporarily linked to the exercise of public authority for the purposes referred to in points (a) to (e) and (g); i) The protection of the data subject or the rights and freedoms of other persons; (j) the enforcement of civil claims.

(2) Any legislative measure referred to in paragraph 1 must, in particular, where appropriate, contain specific provisions at least with regard to: (a) the purposes of the processing or the categories of processing; (b) the categories of personal data; (c) the scope of any restrictions imposed; (d) the safeguards against misuse or unlawful access or disclosure; (e) the details of the controller or categories of controllers; (f) the respective retention periods and the safeguards applicable, taking into account the nature, scope, and purposes of the processing or the categories of processing; (g) the risks to the rights and freedoms of data subjects; and (h) the right of data subjects to be informed of the restriction, provided that this does not undermine the purpose of the restriction. Article 55 Competence (1) Each supervisory authority shall be competent to perform the tasks and exercise the powers conferred upon it by this Regulation within the territory of its own Member State.

(2) Where processing is carried out by public authorities or private bodies on the basis of Article 6(1)(c) or (e), the supervisory authority of the Member State concerned shall be competent. In this case, Article 56 shall not apply. (3) Supervisory authorities shall not be competent to supervise processing carried out by courts in the exercise of their judicial functions. Article 56 Competence of the lead supervisory authority (1) Without prejudice to Article 55, the supervisory authority of the main establishment or sole establishment of the controller or processor shall be the competent lead supervisory authority for cross-border processing carried out by that controller or processor, in accordance with the procedure laid down in Article 60. (2) By way of derogation from paragraph 1, each supervisory authority shall be competent to deal with a complaint lodged with it or with a possible infringement of this Regulation if the matter relates only to an establishment in its Member State or significantly affects data subjects only in its Member State.

(3) In the cases referred to in paragraph 2 of this Article, the supervisory authority shall immediately inform the lead supervisory authority of the matter. Within three weeks of receiving this information, the lead supervisory authority shall decide whether or not to take up the case in accordance with the procedure laid down in Article 60, taking into account whether or not the controller or processor has an establishment in the Member State whose supervisory authority informed it. (4) If the lead supervisory authority decides to take up the case, the procedure laid down in Article 60 shall apply. The supervisory authority that informed the lead supervisory authority may submit a draft decision to it. The lead supervisory authority shall take this draft into account as far as possible when drawing up the draft decision pursuant to Article 60(3). (5) If the lead supervisory authority decides not to take up the case itself, the supervisory authority that notified the lead supervisory authority shall take up the case in accordance with Articles 61 and 62.

(6) The lead supervisory authority shall be the sole point of contact for controllers or processors regarding cross-border processing carried out by that controller or processor. Article 60 Cooperation between the lead supervisory authority and the other supervisory authorities concerned (1) The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article and shall endeavour to reach a consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information. (2) The lead supervisory authority may at any time request mutual assistance from other supervisory authorities concerned in accordance with Article 61 and implement joint measures in accordance with Article 62, in particular to conduct investigations or to monitor the implementation of a measure concerning a controller or processor established in another Member State.

(3) The lead supervisory authority shall immediately transmit to the other supervisory authorities concerned the relevant information on the matter. It shall immediately submit a draft decision to the other supervisory authorities concerned for their comments and shall duly take into account their views. (4) If, within four weeks of being consulted in accordance with paragraph 3 of this Article, one of the other supervisory authorities concerned lodges a relevant and reasoned objection to that draft decision, and the lead supervisory authority does not adopt the relevant and reasoned objection or considers that the objection is not relevant or is not reasoned, the lead supervisory authority shall initiate the consistency procedure in accordance with Article 63 for the matter. (5) If the lead supervisory authority intends to adopt the relevant and reasoned objection, it shall submit a revised draft decision to the other supervisory authorities concerned for their comments.

The revised draft decision shall be subject to the procedure laid down in paragraph 4 within two weeks. (6) If none of the other supervisory authorities concerned objects to the draft decision submitted by the lead supervisory authority within the time limit laid down in paragraphs 4 and 5, the lead supervisory authority and the supervisory authorities concerned shall be deemed to accept the draft decision and be bound by it. (7) The lead supervisory authority shall adopt the decision and communicate it to the main establishment or sole establishment of the controller or, where applicable, the processor, and shall inform the other supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and reasons. The supervisory authority with which a complaint has been lodged shall inform the complainant of the decision. (8) If a complaint is rejected or dismissed, the supervisory authority with which the complaint was lodged shall, notwithstanding paragraph 7, adopt the decision, communicate it to the complainant, and inform the controller.

(9) If the lead supervisory authority and the supervisory authorities concerned agree to reject or dismiss parts of the complaint and to take action on other parts of that complaint, a separate decision shall be adopted for each of those parts. The lead supervisory authority shall adopt the decision for the part concerning action on the controller, communicate it to the main establishment or sole establishment of the controller or processor in its Member State, and inform the complainant accordingly. The supervisory authority responsible for the complainant shall adopt the decision for the part concerning the rejection or dismissal of that complaint, communicate it to the complainant, and inform the controller or processor accordingly. (10) After being informed of the decision of the lead supervisory authority in accordance with paragraphs 7 and 9, the controller or processor shall take the necessary measures to bring the processing activities of all its establishments in the Union into compliance with the decision.

The controller or processor shall communicate the measures taken to comply with the decision to the lead supervisory authority, which in turn shall inform the other supervisory authorities concerned. (11) Where, in exceptional cases, a supervisory authority concerned has reason to believe that urgent action is required to protect the interests of data subjects, the urgency procedure under Article 66 shall apply. (12) The lead supervisory authority and the other supervisory authorities concerned shall exchange the information required under this Article electronically using a standardized format. The German Act on Self-Determination with Regard to Gender Registration (SBGG) reads in excerpts, including headings, as follows: Section 1 Purpose of the Act; Scope of Application (1) The purpose of this Act is to: 1. decouple the legal assignment of gender and the choice of first names from the assessment of third parties and to strengthen the self-determination of the data subject; 2.

realize the right of every person to respect and respectful treatment with regard to their gender identity. (2) Medical measures are not regulated in this Act. (3) If a person has chosen German law pursuant to Article 7a, paragraph 2 of the Introductory Act to the German Civil Code, a change of gender entry and first names is only permissible if, as a foreign national, they 1. have an unlimited right of residence, 2. have a renewable residence permit and are lawfully residing in Germany, or 3. hold an EU Blue Card. Section 2 Declarations Regarding Gender Entry and First Names (1) Any person whose gender identity differs from their gender entry in the civil status register may declare to the registry office that the information regarding their gender in a German civil status entry should be changed by replacing it with another entry provided for in Section 22, paragraph 3 of the Civil Status Act or by deleting it.

According to Section 13, Paragraph 4, of the General Admission and Enrollment Regulations (AZE), students must submit the documents listed in Appendix 1 upon enrollment. Item 8 of Appendix 1 stipulates the presentation of a valid identity card or passport. Based on this verification, the name recorded there is entered into our system. 2. 1. According to Article 77(1) GDPR, without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement, if the data subject considers that the processing of personal data relating to them infringes the GDPR. 1. According to Article 77(1) GDPR, without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement, if the data subject considers that the processing of personal data relating to them infringes the GDPR.

As provided for in Articles 55, 56, and 60 GDPR, the supervisory authorities of the individual Member States are required to cooperate in cases involving cross-border issues. The GDPR essentially distinguishes between the "lead supervisory authority" and the other supervisory authorities involved. The lead supervisory authority generally has the power to make decisions. As stipulated in Articles 55, 56, and 60 of the GDPR, the supervisory authorities of the individual Member States must cooperate in cases involving cross-border issues. The GDPR essentially distinguishes between the "lead supervisory authority" and the other supervisory authorities involved. The lead supervisory authority generally has the power to make decisions. In the present case, the German supervisory authority is to be considered the lead supervisory authority, since the data controller within the meaning of the GDPR (the university) is located in Germany.

However, since a negative decision was issued, the respondent authority, as a data protection authority involved, was lawfully authorized to issue the decision pursuant to Article 60(8) of the GDPR. This is also undisputed. In the present case, the German supervisory authority is to be considered the lead supervisory authority, since the data controller within the meaning of the GDPR is located in Germany. The GDPR (the university) is located in Germany. However, since a negative decision was issued, the respondent authority, as the data protection authority involved, was lawfully authorized to issue the decision pursuant to Article 60, paragraph 8 of the GDPR. This is also undisputed. 2. The applicant argues in its appeal that the (German) law applied by the respondent authority in its assessment is not applicable and that, given its situation – as a person with Austrian citizenship and habitual residence in Austria – Austrian name law applies.

This argument cannot be accepted. While Article 7a, paragraph 1 of the German Introductory Act to the Civil Code (EGBGB) stipulates that gender and Article 10 EGBGB stipulate that a person's name is governed by Austrian law in the applicant's case, the applicant has not officially changed its name or gender registration in Austria. The mP is an international university whose headquarters are indisputably located in Germany. Therefore, the mP is generally subject to German law and not the law of the state of which the university's students are citizens. As the respondent authority correctly states, while Germany does contain a provision for name protection in Section 12 of the German Civil Code (BGB), which is very similar to Section 43 of the Austrian Civil Code (ABGB), this does not allow for the unrestricted use of a chosen name. According to Section 2 Paragraph 1 of the German Law on Self-Determination Regarding Gender Registration, individuals can apply to change the gender recorded in the civil registry.

Section 2 Paragraph 3 of the same law requires that the declaration of change specify the given names to be used and the gender to be registered (see also Section 45b of the German Civil Registry Act). However, under German law, a change of surname is only permissible if there are compelling reasons (see Section 3 Paragraph 1 of the German Law on Name Changes). A complete change of name would therefore not be possible in this case. While Article 7a, paragraph 1 of the German Introductory Act to the Civil Code (EGBGB) stipulates that gender and Article 10 of the EGBGB stipulate that a person's name is governed by Austrian law in the case of bP, bP has not officially changed its name or gender registration in Austria. mP is an international university whose headquarters are indisputably located in Germany. Therefore, mP is subject to German law and not the law of the state whose citizenship its students hold.

at › Career [accessed on April 8, 2026]). 3. Insofar as the applicant refers to the cross-border recognition of changed civil status data and, in this context, to the case law of the ECJ in C-4/23 [Mirin], this argument is also unfounded. While the cited decision – as the applicant herself explains – concerns a person who, after naturalization in an EU Member State, had changes to their civil status officially registered and wanted to transfer these changes to the civil status register of their former home country, another EU Member State, there is no official change to the applicant's name in the present case. Moreover, such a change has never been alleged. 3. 1. According to the case law of the Court of Justice of the European Union and the European Court of Human Rights, Article 8 ECHR protects a person's gender identity as one of the most intimate aspects of their private life (see paragraph 47 of the ECJ's Deldits case of 13 March 2025, C-247/23).

According to this jurisprudence, gender identity, which is understood as psychological sex, is more important than a person's biological (physical) sex when determining legal gender. Recognition of gender identity may not be made dependent on the dissolution of a marriage or on the performance of medical interventions (Austrian Constitutional Court decision E 1297/2025 of December 18, 2025). 1. According to the jurisprudence of the Court of Justice of the European Union and the European Court of Human Rights, Article 8 of the European Convention on Human Rights protects a person's gender identity as one of the most intimate areas of private life (see paragraph 47 of the ECJ decision Deldits of March 13, 2025, C-247/23). According to this jurisprudence, gender identity, which is understood as psychological sex, is more important than a person's biological (physical) sex when determining legal gender.

Legal recognition of gender identity must not be made dependent on the dissolution of a marriage or the performance of medical procedures (Austrian Constitutional Court decision E 1297/2025 of December 18, 2025). According to the case law of the European Court of Justice of March 13, 2025, C-247/23 [Deldits], a national authority entrusted with maintaining a public register is obliged to correct personal data concerning a natural person's gender identity. In this context, the data subject requesting the rectification of this data may be required to provide relevant and sufficient evidence, which, taking into account the circumstances of the individual case, can reasonably be expected of them, in order to establish the inaccuracy of this data (see paragraph 41 Deldits). According to the case law of the Court of Justice of the European Union (CJEU) of 13 March 2025, C-247/23 [Deldits], a national authority entrusted with maintaining a public register is obliged to rectify personal data concerning a natural person's gender identity.

In this context, the data subject requesting the rectification of this data may be required to provide relevant and sufficient evidence, which, taking into account the circumstances of the individual case, can reasonably be expected of them, in order to establish the inaccuracy of this data (see paragraph 41 Deldits). 2. According to Article 16 of the GDPR, data subjects have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement. Although the right to restriction of processing is described as an independent right in Article 18 of the GDPR, it is systematically a predominantly temporary ancillary right in connection with the rights to rectification (Article 16), erasure (Article 17), and objection (Article 21) (Haidinger in Knyrim, DatKomm Art 18 GDPR para.

at]). 2. According to Article 16 of the GDPR, data subjects have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to request the completion of incomplete personal data, including by means of a supplementary statement. Although the right to restriction of processing is described as an independent right in Article 18 of the GDPR, it is systematically a predominantly temporary ancillary right in connection with the rights to rectification (Article 16), erasure (Article 17), and objection (Article 21) (Haidinger in Knyrim, DatKomm Article 18, GDPR, para. at]). , the data subject. at]). , the data subject. at]). 3. In summary, the applicant argues that the personal data processed by the applicant is incorrect because her chosen name differs from her legal name, which is processed by the applicant.

The respondent authority, in assessing the facts of the case, failed to consider the case law of the CJEU in C-247/23 [Deldits] and overlooked the fact that the proof of name change or the submission of a supplementary identity document required by the applicant was disproportionate. In the aforementioned case law, the CJEU addressed the interpretation of Article 16 GDPR and the "accuracy" of data. It held that, according to its case law, the accuracy and completeness of personal data must be assessed in relation to the purpose for which the data were collected. In this regard, it referred to its judgment of 20 December 2017, Case C-434/16 [Nowak]. The CJEU, in the aforementioned case law, addressed the interpretation of Article 16 GDPR and the "accuracy" of data. In this context, he noted that, according to the case law of the CJEU, the accuracy and completeness of personal data must be assessed in light of the purpose for which the data were collected.

He referred in this regard to the judgment of 20 December 2017, Case C-434/16 [Nowak]. It is therefore incumbent upon the court to examine the accuracy of the data at issue in the main proceedings in light of the purpose for which they were collected and, in particular, to assess, in light of the applicable legal systems, the objective of the data processing. The data subject requesting rectification of the data may be required to provide relevant and sufficient evidence, which, taking into account the circumstances of the individual case, can reasonably be expected of them, to establish the inaccuracy of that data. The exercise of the right to rectification may be restricted only in accordance with Article 23 of the GDPR. The data subject requesting rectification of their data may be required to provide relevant and sufficient evidence, which can reasonably be expected of them in light of the specific circumstances, to establish the inaccuracy of that data.

The exercise of the right to rectification may only be restricted in accordance with Article 23 of the GDPR. Article 23(1) of the GDPR provides that Union or Member State law to which the controller or processor is subject may restrict, by legislative measures, the obligations and rights set out in Articles 12 to 22 and 34, as well as Article 5 of the GDPR, insofar as its provisions correspond to the rights and obligations provided for in Articles 12 to 22 of the GDPR. This restriction is permissible, however, provided that such a restriction respects the essence of the fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society, achieving certain objectives listed in the GDPR, such as... important objectives of the general public interest of the Union or a Member State. , 50). Article 23(1) GDPR provides that Union or Member State law to which the controller or processor is subject may restrict, by legislative measures, the obligations and rights under Articles 12 to 22 and Article 34, as well as Article 5 GDPR, insofar as its provisions correspond to the rights and obligations provided for in Articles 12 to 22 GDPR.

This is, however, subject to the condition that such a restriction respects the essence of fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society, safeguarding certain objectives listed in the GDPR, such as important objectives of the general public interest of the Union or a Member State. , 50). 4. The Austrian Administrative Court (VwGH) also bases its assessment of data accuracy on the processing purpose: According to Article 16 GDPR, the data subject has the right to request from the controller the immediate rectification of inaccurate personal data concerning him or her. " Article 5(1)(d) GDPR stipulates, however, that data must be "factually correct" and that all reasonable steps must be taken to ensure that personal data which are inaccurate in relation to the purposes for which they are processed are rectified (or erased). The GDPR thus focuses on factual accuracy, whereby the (in)accuracy of the data must be assessed in relation to the purpose of the data processing.

] are rectified" and see also the Austrian Administrative Court (VwGH) decision of July 17, 2023, Ro 2021/04/0015 with further references). 4. The Austrian Administrative Court also bases its assessment of data accuracy on the purpose of processing: According to Article 16 of the GDPR, the data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. However, the GDPR does not provide a more detailed definition of the term "inaccuracy". Article 5, paragraph 1, letter d, of the GDPR stipulates, however, that data must be "factually correct" and that all reasonable steps must be taken to rectify (or erase) personal data that is inaccurate with regard to the purposes for which it is processed. The GDPR thus focuses on factual accuracy, whereby the (in)accuracy of the data must be assessed in relation to the purpose of the data processing.

]" and see also the Austrian Administrative Court (VwGH) decision of July 17, 2023, Ro 2021/04/0015 (with further references). 5. The literature assumes that, with regard to Article 16 GDPR, "objectively inaccurate" data must exist in order to have a right to rectification. Data processed by the controller is therefore inaccurate if it does not correspond to reality. In this respect, inaccuracy can also be assumed if a controller processes the gender of data subjects but only provides for the categories male and female in databases, as this would leave individuals with non-binary gender entries out of the equation. However, with reference to the case law of the Austrian Administrative Court (VwGH), the literature also assumes that the principle of data accuracy is linked to the purpose of the processing (see Haidinger in Knyrim, DatKomm Art 17 GDPR para. at]). 5. The literature assumes that, with regard to Article 16 GDPR, "objectively inaccurate" data must exist in order to have a right to rectification.

Data processed by the controller is therefore inaccurate if it does not correspond to reality. In this respect, inaccuracy can also be assumed if a controller processes the gender of data subjects but only provides for the categories "male" and "female" in databases, as this would leave individuals with non-binary gender entries unaccounted for. However, with reference to the jurisprudence of the Austrian Administrative Court (VwGH), legal literature also assumes that the principle of data accuracy is linked to the purpose of the processing (see Haidinger in Knyrim, DatKomm Article 17, GDPR, para. 21 ff. at]). 6. Applied to the facts of the present case, this means the following: The applicant enrolled in a course of study at the institution. In the course of this, she provided, among other things, her official name for identification purposes and also submitted a corresponding official identification document.

Subsequently, the individual chose a gender-neutral name and now uses it. In light of the cited case law of the CJEU and the Austrian Administrative Court (VwGH), as well as the cited literature, the individual's right to rectification under Article 16 GDPR was not violated by the individual's refusal to change their name in the individual's administrative system. The individual cannot be prevented from requesting at least a supplementary certificate for the change of name and gender, especially since this supplementary certificate is issued at the individual's request without requiring expert opinions. According to Article 16 of the GDPR, a natural person may be required to provide relevant and sufficient evidence, which can reasonably be expected of them, to establish the inaccuracy of their data for the purposes of exercising their right to rectification. The applicant cannot be opposed if they request at least a supplementary certificate for the change of name and gender, especially since this supplementary certificate is issued solely at the applicant's request without the submission of expert opinions.

According to Article 16 of the GDPR, a natural person may be required to provide relevant and sufficient evidence, which can reasonably be expected of them, to establish the inaccuracy of their data for the purposes of exercising their right to rectification. As the CJEU and the Austrian Administrative Court (VwGH) have stated, the accuracy of data must be assessed based on the purpose of the processing. The applicant is enrolled in a course of study at the institution and, in the course of this study, provided all their relevant personal data. As has been established, mP is an accredited university offering various degree programs and, in this context, also holds the sovereign authority to issue certificates and award academic degrees. It is clear and undisputed that bP enrolled at mP to complete a course of study and subsequently obtain an academic degree, which can then certify the completion of studies to third parties, particularly potential employers.

The unambiguous purpose of the data processing in question by mP is therefore the administration of the studies, ensuring that student achievements are completed by bP personally, and subsequently, that a certificate or graduation document can be issued in bP's name. The data processing is thus carried out to identify bP and to assign academic achievements and successes. This purpose has not changed since bP's enrollment. In light of the processing purpose described above, the processed data of bP is to be considered "accurate" within the meaning of Article 16 GDPR. The applicant has not officially changed its legal name and does not object to the fact that certificates and ultimately the academic title are to be issued in its legal name. The study cited by the applicant in its amended data protection complaint also states that while names may generally be chosen freely, this does not apply to dealings with public authorities.

With regard to the processing purpose described above, the data processed by the applicant is to be considered "correct" within the meaning of Article 16 of the GDPR. The applicant has not officially changed its legal name and does not object to the fact that certificates and ultimately the academic title are to be issued in its legal name. The study cited by the applicant in its amended data protection complaint also states that while names may generally be chosen freely, this does not apply to dealings with public authorities. The CJEU, in its cited case law, assumes that important objectives of general public interest can justify restrictions on rights under the GDPR. The Senate considers it to be in the important public interest that universities only process name changes upon presentation of appropriate documentation, as this preserves the integrity of the universities and the integrity of the certificates and academic titles they issue.

, learning platform, email alias, campus card, registration lists), it must be noted that this argument deviates from the subject matter of the appeal. Furthermore, a university cannot be obligated to allow the student to use two different names simultaneously, which would involve costs and effort, as long as it provides an easily accessible option to use a chosen name by presenting a supplementary ID card. The argument that the supplementary ID card is subject to a fee and that personal data must therefore be transferred to a third party fails to demonstrate the disproportionality of this requirement. Since the student has not provided any evidence confirming the requested name change, the respondent authority was therefore correct in rejecting the application for correction of the name, and the decision was rendered accordingly. 4. Regarding the proposed referral to the CJEU It should be noted that, in addition to the appeal to the Administrative Court of Justice pursuant to Article 133(1)(1) of the Austrian Federal Constitutional Law (B-VG), decisions of the Federal Administrative Court are also subject to the remedy of a complaint to the Constitutional Court pursuant to Article 144 of the B-VG.

). However, the necessity of a preliminary ruling was not deemed to exist in light of the existing case law of the Court of Justice of the European Union. 5. Regarding the waiver of an oral hearing: Pursuant to Section 24 Paragraph 1 of the Administrative Court Procedure Act (VwGVG), the Administrative Court must hold a public oral hearing upon request or, if it deems it necessary, ex officio. Pursuant to Section 24 Paragraph 4 of the VwGVG, unless otherwise provided by federal or state law, the Administrative Court may dispense with a hearing, irrespective of a party's request, if the case file indicates that an oral hearing would not provide any further clarification of the case, and if neither Article 6 Paragraph 1 of the European Convention on Human Rights (ECHR) nor Article 47 of the Charter of Fundamental Rights of the European Union (CFR) precludes dispensing with a hearing. According to Section 24, Paragraph 4 of the Administrative Court Procedure Act (VwGVG), unless otherwise provided by federal or state law, the Administrative Court may, irrespective of a party's request, dispense with a hearing if the case file indicates that an oral hearing would not provide any further clarification of the legal issue, and if neither Article 6, Paragraph 1 of the European Convention on Human Rights (ECHR) nor Article 47 of the Charter of Fundamental Rights of the European Union (CFR) precludes dispensing with a hearing.

The dispensing with a hearing is not contrary to Article 6, Paragraph 1 of the ECHR. 394/95, Döry v. 853/00, Miller v. Sweden). 853/00, Miller v. Sweden). In the present case, the decision not to hold an oral hearing can be based on the fact that the facts were clear from the case file. The case file clearly contained all the facts necessary for a legal assessment of the case. Although the applicant requested an oral hearing, no additional insights were expected for the assessment of the proceedings. According to the jurisprudence of the Constitutional Court, an oral hearing may also be omitted if the facts are undisputed and the legal question is not particularly complex (VfSlg. 597/2005; VfSlg. 855/2006; or, for example, VfGH June 18, 2012, B 155/12). Therefore, pursuant to Section 24, paragraphs 1 and 4 of the Administrative Court Procedure Act (VwGVG), an oral hearing was not required.