BVwG: Data protection complaint by litigation-funded enforcement association inadmissible
A data subject hired an association whose business model is to automatically search for possible data protection violations and filing complaints or lawsuits on behalf of data subjects with the financial aid of litigation funders.
Status Not cited by any decision here yet
Original title: BVwG - W292 2342582-1/13E
Judgment
Holding
The Federal Administrative Court (Bundesverwaltungsgericht) upheld the decision of the DPA and decided that the data subject lodged the complaint not for reasons of the protection of personal data but for financial reasons. Therefore, Article 57(4) GDPR was applicable. The Court believed that without the financial incentive, the data subject would not have lodged the complaint. According to the Court, the fact that the initiative to exercise the data subject’s right did not come from the data subject themselves but from the association, is another factor that lead the Court to assume an abusive exercise of data subjects’ rights. The data subject did not explicitly mandate the association with the access request, the data was already available to the data subject via the portal but they did not show any interest in it and there was no indication of unlawful processing. All those factors added to the conclusion that the data subject did not have a data protection interest for exercising their rights. The sole motivation for the access request was to enable the business model of the association. These activities of the association that are aimed primarily at re-claiming the service fee through the means of civil law, are already known to the Court. The decision of the DPA to reject the complaint instead of requesting the DPA to issue a fee for their activity pursuant to Article 57(4) GDPR, which would be a less intrusive measure, was adequate. Because of the notorious activity of the association that is systematically disabling the work of the DPA, a fee would not be adequate to stop this activity.
From GDPRhub’s case note — a summary of the decision, not its own words. Read it in the text ↓
The agreement between the data subject and the association foresees that the data subject receives 70% of possible profits coming from a favourable judicial or administrative decision and 30% of the profits go to the litigation funders. In the agreement, the association claims their offer would generate profit without any risk for their customers. The association made an access request and filed a complaint via a lawyer on behalf of the data subject. The telecommunication provider charged the data subject with a service fee the parties have not agreed upon. The access request concerned invoices of a telecommunication provider that the data subject was in a contractual relationship with and the service fee was indicated on the invoices. On the initiative of the association, not the data subject, the association made an access request, claiming the service fee let the data subject to believe that the telecommunication provider might possess documents concerning the data subject without their knowledge and might process their personal data unlawfully. The data subject already had access to the invoices through the telecommunication provider’s online portal for customers. The data subject did not, or did not remember, to explicitly mandate the association to lodge the access request. The lawyer hired by the association filed a complaint on behalf of the data subject because of a possible violation of Article 15 GDPR. The grounds of the violation were illustrated only rudimentary in the complaint. The association filed a total of more than 900 complaints with the DPA that follow the same pattern, with 142 of those complaints being filed against the telecommunication provider because of GDPR violations in the context of charging a service fee. The DPA refused to act on the request on the basis of Article 57(4) GDPR because it held that the data subject lodged the complaint not for reasons of the protection of personal data. The data subject appealed the decision.
Full text 49 paragraphs
Machine translation of the decision, via GDPRhub — not the official text. Read the original
Date of Decision July 1, 2026 Legal Provisions B-VG Art. 133(4) DSG § 1 DSG § 18 DSG § 24 GDPR Art. 15 GDPR Art. 51(1) GDPR Art. 57(1)(f) GDPR Art. 57(4) GDPR Art. 77(1) B-VG Art. 133 (current version) B-VG Art. 133 effective from January 1, 2019, through May 24, 2018, last amended by Federal Law Gazette I No. 138/2017 B-VG Art. 133 effective as of January 1, 2019, last amended by BGBl. I No. 22/2018 B-VG Art. 133 effective from May 25,May 2018 through December 31, 2018; last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 133; effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164/2013, B-VG Art. 133, effective from Jan. 1, 2014, through July 31, 2014, last amended by Federal Law Gazette I No. 51/2012 B-VG Art. 133 in effect from Jan. 1, 2004, through Dec. 31, 2013, last amended by BGBl. I No. 100/2003 Federal Constitutional Law (B-VG) Art. 133, effective from January 1, 1975, through December 31, 2003, last amended by Federal Law Gazette No. 444/1974 Federal Constitutional Law (B-VG) Art. 133, effective from December 25, 1946, through December 31, 1974, last amended by Federal Law Gazette No. 211/1974 Federal Constitutional Law (B-VG) Art. 133, effective from December 25, 1946, through December 31, 1974, last amended by Federal Law Gazette No. 211/1974-VG Art. 133 valid from December 25, 1946, through December 31, 1974, last amended by Federal Law Gazette No. 211/1946 B-VG Art. 133 valid from December 19,December 1945 through December 24, 1946; last amended by State Gazette No. 4/1945; B-VG Art. 133, in effect from January 3, 1930, through June 30, 1934 DSG Art. 1 § 1 (now DSG Art. 1 § 1), effective as of Jan. 1, 2014, last amended by Federal Law Gazette I No. 51/2012; DSG Art. 1 § 1, effective from January 1, 2000, through December 31, 2013 DSG Art. 2 § 18 (now DSG Art. 2 § 18), effective as of May 25, 2018, last amended by Federal Law Gazette I No. 120/2017; DSG Art. 2 § 18, effective from January 1, 2014, through May 24, 2018, last amended by Federal Law Gazette I No. 83/2013 DSG Art. 2 § 18, effective from April 1,April 2005 through December 31, 2013; last amended by Federal Law Gazette I No. 13/2005; DSG Art. 2 § 18; effective from January 1, 2000, through March 31, 2005 DSG Art. 2 § 24 (now DSG Art. 2 § 24), effective as of July 15, 2024, last amended by Federal Law Gazette I No. 70/2024; DSG Art. 2 § 24, effective from May 25,May 2018 through July 14, 2024; last amended by Federal Law Gazette I No. 120/2017 DSG Art. 2 § 24 effective from January 1, 2010, through May 24,2018, last amended by Federal Law Gazette I No. 133/2009, DSG Art. 2 § 24, effective from Jan. 1, 2000, through Dec. 31, 2009 Decision , W292 2342582-1/13E W292 2342582-1/13E, IN THE NAME OF THE REPUBLIC!
The Federal Administrative Court, with Judge Herwig ZACZEK, M.A., presiding, and the lay judges Robert AUER, M.A., and Thomas GSCHAAR, M.A., serving as associate judges, ruled on the appeal filed by XXXX, born XXXX, represented by Attorney Dr. Gregor KLAMMER, Goldschmiedgasse 6/6-8, 1010 Vienna, against the decision of the Data Protection Authority dated XXXX, Ref. No. XXXX (co-party: XXXX, represented by DORDA Rechtsanwälte GmbH, Universitätsring 10, 1010 Vienna) after conducting a public oral hearing, has rightly ruled as follows: The Federal Administrative Court, presided over by Judge Mag. Herwig ZACZEK and with lay judges Mag. Robert AUER and Mag. Thomas GSCHAAR as associate judges, ruled on the appeal filed by Roman numeral 40, born Roman numeral 40, represented by Attorney Dr. Gregor KLAMMER, Goldschmiedgasse 6/6-8, 1010 Vienna, against the decision of the Data Protection Authority dated Roman 40, Ref.
No. Roman 40 (co-party: Roman 40, represented by DORDA Rechtsanwälte GmbH, Universitätsring 10, 1010 Vienna) after conducting a public oral hearing, the Court has rightly ruled as follows: A) The appeal is dismissed as unfounded pursuant to § 28(2) VwGVG, in conjunction with Art. 57(4) GDPR. The appeal is dismissed as unfounded pursuant to Section 28(2) of the VwGVG, in conjunction with Article 57(4) of the GDPR. B) The appeal is not admissible pursuant to Article 133(4) of the B-VG.The appeal is not admissible pursuant to Article 133, paragraph 4, of the Federal Constitutional Law (B-VG). Text Reasons for the Decision: I. Course of Proceedings: Roman numeral I. Course of Proceedings: 1. In the contested decision dated XXXX, the respondent authority refused to process the complainant’s data protection complaint filed on XXXX regarding an alleged violation of the right of access (Article 15 of the GDPR) pursuant to Article 57(4) of the GDPR.1.
In the contested decision dated Roman numeral 40, the respondent authority refused to process the complainant’s data protection complaint dated Roman numeral 40 regarding an alleged violation of the right of access (Article 15, GDPR) pursuant to Article 57, paragraph 4, GDPR. 1.2. In its reasoning, the respondent authority summarizes the facts by assuming that the complainant had commissioned the association “XXXX” (“XXXX”) to automatically search for data protection violations and, with the help of litigation funders, to file lawsuits or complaints, with the promise that 70% of the (potential) profits would be paid out to the complainants, while 30% would go to the litigation funders; the underlying power of attorney indicates that the subscription (meaning the authorization by the data subject) “brings in cash without risk.” The association “XXXX,” in turn, had commissioned the legal representative named in the decision to represent the complainants, which subsequently led to the filing of the complaint(s) in question with the respondent authority. 1.2.
In its reasoning, the respondent authority summarizes its factual findings as follows: the complainant commissioned the association “Roman 40” (“Roman 40”) to automatically search for data protection violations and, with the help of litigation funders, to file lawsuits or complaints, with the promise that 70% of the (potential) profits would be paid out to the complainants, while 30% would go to the litigation funders; the underlying power of attorney indicates that the subscription (meaning the authorization by the data subject) “brings in cash with no risk.” The association “Römisch 40,” in turn, instructed the legal representative named in the decision to represent the complainants, which subsequently led to the filing of the complaint(s) in question with the respondent authority. 1.3. From a legal perspective, the respondent authority finds that no genuine data protection interests are being pursued in the present case.
Rather, the purpose of the power of attorney granted to the association “XXXX” and to the legal representative named in the decision is to automatically —that is, independently of any specific incident—to search for data protection violations and to use the right to lodge a complaint under Art. 77 of the GDPR as a tool to systematically initiate court proceedings following administrative proceedings. 1.3. From a legal perspective, the respondent authority finds that no genuine data protection interests are being pursued in the present case. Rather, the purpose of the power of attorney granted to the association “Römisch 40” or the legal representative named in the decision is to automatically—i.e., independently of any specific incident—search for data protection violations and to use the right to lodge a complaint under Article 77, GDPR as a tool to systematically initiate judicial proceedings following administrative proceedings. 1.4.
Consequently, the present arrangement—namely, a blanket power of attorney for the purpose of automatically searching for data protection violations and obtaining financial benefits—justifies a refusal to process a complaint pursuant to Article 57(4) of the GDPR and the relevant case law of the CJEU, the Supreme Administrative Court (VwGH) and the Federal Administrative Court (BVwG). 1.4. Consequently, the present arrangement—namely, a blanket authorization for the purpose of automatically searching for data breaches and obtaining financial benefits—justifies a refusal to process a complaint pursuant to Article 57, paragraph 4, GDPR and the relevant case law of the CJEU, the VwGH, and the BVwG. Furthermore, the respondent authority assumes that the complainants would not be deterred from filing further complaints by the imposition of a fee within the meaning of Article 57(4) of the GDPR.Furthermore, the respondent authority assumes that the complainants would not be deterred from filing further complaints by the imposition of a fee within the meaning of Article 57(4) of the GDPR.
From the authority’s perspective, this already follows from the fact that the complaints are closely linked to a litigation financier or the association “XXXX,” which reserves the right to a percentage share of any damages awarded in the event of a (judicial) victory, the imposition of a fee on a case-by-case basis is therefore considered an unsuitable course of action. From the authority’s perspective, this already follows from the fact that the complaints are closely linked to a litigation financier or the association “Roman 40 ,” which reserves the right to a percentage share of any damages awarded in the event of a (judicial) victory; therefore, prescribing a fee on a case-by-case basis is considered an unsuitable course of action. 2. The appeal filed against this decision (and prepared by counsel) on February 25, 2026, states in its introduction that companies such as the co-respondent have, over many years, unlawfully collected a so-called “service fee”—in some cases without any contractual basis—and that, according to the established case law of the Supreme Court, such a fee is impermissible, which is why “needless to say” countless lawsuits are being brought against mobile network providers. 2.1.
The complainant was charged a service fee—without this ever having been agreed upon—which “greatly surprised” the complainant and he wondered whether the co-respondent might have documents in its possession without his knowledge or whether there might have been an error in data processing in this case. 2.2. Furthermore, the reasoning in the contested decision contains only a rudimentary description of the facts, without addressing the complainant’s arguments. 2.3. Citing specific case law of the European Court of Justice, the complaint further argues that the provision of an initial copy of the personal data free of charge is not dependent on a specific statement of reasons, neither under the wording of Article 12(5), nor that of Article 15(1) and (3) of the GDPR, contingent upon a specific justification. 2.3. Citing specific case law of the CJEU, the complaint further argues that the provision of a first copy of personal data free of charge is not contingent upon a specific justification under the wording of Article 12, paragraph 5, nor that of Article 15, paragraphs 1 and 3 of the GDPR, on any specific justification. 2.4.
The respondent authority is also attempting to shift its responsibilities to the BVwG by arbitrarily rejecting complaints pursuant to Article 57(4) of the GDPR. 2.4. The respondent authority is also attempting to shift its responsibilities to the Federal Administrative Court (BVwG) by arbitrarily rejecting complaints pursuant to Article 57(4) of the GDPR. 3. On June 2, 2026, the Federal Administrative Court held a public oral hearing on the complaint. In accordance with the guidelines of the Administrative Court, the hearing involved questioning the parties to investigate the primary purpose of the requests for information and to discuss the factual and legal circumstances in detail with the parties. II. The Federal Administrative Court considered: Roman numeral two. The Federal Administrative Court considered: 1. Findings: 1.1. The power of attorney granted by the complainant reads as follows [formatting not as in the original]: “XXXX” Roman numeral 40 “ The form contains the complainant’s personal information in the corresponding fields as well as a (handwritten) signature. 1.2.
The complainant is in a valid contractual relationship (cell phone contract) with the co-party, a telecommunications company. The complainant regularly receives bills under this contractual relationship and can also view them online via the co-party’s customer portal (including retroactively for at least the last six months). 1.3. The association “XXXX” has justified the request for information under data protection law on behalf of the complainant to the co-party as follows: it wished to obtain information (specifically, certain billing statements) in order to determine when a so-called “service fee” had been paid in connection with the complainant’s mobile phone contract. 1.3. The association “Roman 40 ” justified the data protection request for information on behalf of the complainant to the co-party by stating that it sought to obtain information (specifically, certain billing statements) in order to determine when a so-called “service fee” had been paid in connection with the complainant’s cell phone contract. 1.3.1.
It is not true that the complainant was surprised by the co-respondent’s billing of a service fee in connection with the telecommunications contract and subsequently developed concerns regarding the lawfulness of the co-respondent’s company’s processing of his personal data. 1.3.2. The complainant does not recall having specifically instructed the XXXX Association to take legal action against the co-party on his behalf. 1.3.2. The complainant does not recall having specifically instructed the association “Römisch 40” to take legal action against the co-respondent on his behalf. 1.3.3. On the part of the complainant, there were and are no indications that the co-respondent’s company has unlawfully processed personal data concerning him in connection with the existing contractual relationship or that this might be the case at the present time. 1.4. Background: In addition to the data protection complaints arising from the contested decision, more than 900 proceedings had been initiated with the respondent authority—using the present arrangement (Association “XXXX ” and “XXXX”), at the time of the decision, with the association’s approach and that of the attorney authorized by it being identical in all cases. 1.4.
Background: In addition to the data protection complaints arising from the contested decision, more than 900 proceedings had been initiated with the authority in question—using the present arrangement (association “Roman 40 ” and “Roman 40”), more than 900 proceedings were pending with the authority in question as of the date of the decision, with the association’s approach and that of the attorney authorized by it being identical in all cases. Since January 18, 2024, clause review proceedings initiated by the Federal Chamber of Labor against flat-rate service fees charged by various mobile network operators have been pending. This followed a successful lawsuit filed by the Federal Chamber of Labor against a fitness center operator (OGH 4 Ob 59/22p). Subsequently, the Federal Chamber of Labor attempted to apply this decision to other industries as well. This was partially successful, but the Supreme Court also rejected some of these attempts—for example, regarding food delivery services (OGH 9 Ob 116/24k) or ticket sellers (OGH 9 Ob 34/24a; OGH 8 Ob 64/24f).
This thus raises a contentious legal issue in the field of consumer protection law. The data protection complaint proceedings at issue in this case are one of a total of 142 proceedings brought against the co-party’s company before the Data Protection Authority, all of which were initiated by the complainant’s representative in the first instance and decided identically by the Data Protection Authority. 2. Assessment of the Evidence: First, the findings made regarding the conduct of the XXXX Association and the terms of the power of attorney at issue are based on the unobjectionable content of the administrative act; furthermore, the adjudicating panel formed its own impression of the complainant and questioned him personally regarding the grounds for the proceedings, furthermore, the background of the exercise of data subject rights in connection with the so-called “XXXX” was discussed in detail with the representatives of the co-party.
First, the findings regarding the conduct of the association Roman 40 and the wording of the power of attorney at issue are based on the unobjectionable content of the administrative act; furthermore, the adjudicating panel formed a personal impression of the complainant and questioned him personally regarding the grounds for the proceedings; in addition, the background regarding the exercise of data subject rights in connection with the so-called “Roman 40” was discussed in detail with the representatives of the co-party. The findings under Section 1.1 are based on the content of the relevant power of attorney as documented in the case file, as well as the corresponding statements made by the complainant. The finding under point 1.2 is based on the consistent statements of the parties in this regard, as well as the statements of the representatives of the co-party. Furthermore, the fact that invoices for mobile phone services for customers of the co-party can be viewed online is also evident from the informed and conclusive statements made by the representative of the co-party before the adjudicating court.
The finding in Section 1.3 is based, first, on the wording of the request for information under data protection law, as documented in the case file, which the association XXXX sent to the co-party via email on behalf of the complainant; the relevant email reads as follows [Formatting not as in the original]: The finding regarding point 1.3 is based primarily on the text of the data protection request documented in the case file, which the association “Roman 40” sent to the co-party via email on behalf of the complainant; the email in question reads as follows [formatting not as in the original]: “From: XXXX “From: Roman 40 To: XXXX To: Roman 40 Sent on: August 1, 2025, 12:10:57 Subject: XXXX Request for Information: XXXX Subject: Roman 40 Request for Information: Roman 40 Dear Sir or Madam, I hereby state that I am acting as legal counsel for the above-named individual; I refer to the attached power of attorney.
I hereby request that you inform me, in accordance with Article 15 of the GDPR, which data (including billing data) pertaining to my client is being processed by you. In particular, I request that you inform me whether, and if so, in what amount, my client has paid you so-called “service fees” or similarly designated charges. I expressly note that, pursuant to my power of attorney (which includes authorization to receive service of process), all communication regarding this matter must be directed to me, and I hereby expressly consent to the electronic delivery of the requested information to the email address I have provided. Thank you very much for your assistance! Sincerely, XXXX Roman 40 Chairman XXXX Chairman Roman 40 XXXX “ Roman 40 “ It is clear from the wording of the power of attorney and the complaint filed with the Federal Court that the data protection request asserted by the XXXX Association—or subsequently by the authorized law firm on behalf of the complainant—is primarily aimed at to obtain information regarding a service fee that may have been paid to the co-party, is readily apparent from the wording of the power of attorney as well as the complaint filed with the Federal Administrative Court, in which the following is stated verbatim under the heading “Facts of the Case”: That the data protection claim asserted by Verein römisch 40—and subsequently by the authorized law firm on behalf of the complainant—is primarily aimed at to obtain information regarding a service fee that may have been paid to the co-party, is readily apparent from the wording of the power of attorney as well as the complaint filed with the Federal Administrative Court, in which, under the heading “Facts of the Case,” the following is stated verbatim: “Companies such as the respondent have, over many years, unlawfully collected a so-called ‘service fee’—in some cases even without a contractual basis.
According to the now well-established case law of the Supreme Court, such a fee is unlawful. Needless to say, countless lawsuits are now being filed against mobile phone providers. A service fee was deducted from the complainant’s account—without this ever having been agreed upon.” This greatly surprised the complainant, and he wondered whether the respondent might have documents in its possession without his knowledge and whether this might have resulted in incorrect data processing. The BF wanted to investigate this further.” It should be noted that the written complaint (drafted by an attorney), in which the complainant stated that he was “very” surprised by the deduction of a service fee from his account and wondered whether the other party might possess documents without his knowledge or whether “incorrect” data processing had occurred, stands in direct contradiction to the complainant’s personal statements before the trial court.
For example, during his questioning before the adjudicating panel, the complainant could not recall whether he had granted power of attorney to the XXXX Association one or two years ago; he also stated—which was implausible since it bore no relation to the subject matter of the case—that he had authorized the association to recover portions of the XXXX membership fee, claimed not to have known that he had ever paid a service fee to the co-party, “thinks so” that he had always received the co-party’s invoices, and stated that he had not had the explicit intention to gain access to his cell phone bills by means of a data protection request, and ultimately states, in essence, that the reason for granting the power of attorney was to reclaim amounts paid by whomever, “provided his data is misused.”It should be noted that the written (and attorney-drafted) complaint, in which the complainant states that he was “very” surprised by the deduction of a service fee from his account and wondered whether the co-party might have documents in his possession without his knowledge or whether “incorrect” data processing had occurred, stands in open contradiction to the complainant’s personal statements before the adjudicating court.
For example, during his questioning before the adjudicating panel, the complainant could not recall whether he had granted power of attorney to the “Römisch 40” association one or two years ago, and furthermore—in a statement that was implausible because it bore no relation to the subject matter of the case—stated that he had authorized the association to recover portions of the “Römisch 40” membership fee, claimed not to have known that he had ever paid a service fee to the co-party, “thinks so” that he always received the co-party’s invoices, and stated that he had not had the explicit desire to to gain access to his cell phone bills by means of a data protection-related request for information, and ultimately stated, in essence, that the reason for granting the power of attorney was to reclaim amounts paid by whomever, “provided his data is misused.” The findings regarding the so-called background, in particular the course of action taken by the authorized association and attorney—specifically, the systematic filing of requests for information with the co-party in preparation for asserting civil claims in connection with (allegedly) wrongfully paid flat-rate service fees, follow from the wording of the power of attorney at hand, the clear and credible statements of the informed representatives of the co-involved party as well as the authority being sued; furthermore, they may also—due to a large number of similar proceedings —be regarded as a matter of judicial common knowledge. 3.
Legal Assessment: Pursuant to § 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court decides through a single judge, unless federal or state laws provide for a decision by a panel. Pursuant to Paragraph 6, BVwGG, the Federal Administrative Court decides through a single judge, unless federal or state laws provide for a decision by a panel. Since the subject matter of the complaint is a decision by the Austrian Data Protection Authority, the present case falls under the jurisdiction of a panel pursuant to § 27 DSG.Since the subject matter of the appeal is a decision by the Austrian Data Protection Authority, this case falls under the jurisdiction of a panel pursuant to Section 27 of the Data Protection Act (DSG). Re: A) 3.1. Applicable law: Art. 51(1), 57(1)(f), and 77(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data, on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation — GDPR), OJ L 119 of May 4, 2016; Sections 18(1) and 24 of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999, as amended.
These provisions were also applicable in the present appeal proceedings before the Federal Administrative Court. Article 51(1), Article 57(1)(f), and Article 77(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data, on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation — GDPR), OJ L 119 of May 4, 2016, Section 18(1) and Section 24 of the Data Protection Act (DSG), Federal Law Gazette Part I, No. 165 of 1999, as amended. These provisions were also applicable in the present appeal proceedings before the Federal Administrative Court. Articles 51, 57, and 77 of the GDPR read, in part: Articles 51, 57, and 77 of the GDPR read, in part: “Art. 51” “Art.” 51 Supervisory Authority (1) Each Member State shall provide that one or more independent authorities are responsible for supervising the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons with regard to the processing of personal data and to facilitate the free flow of personal data within the Union.”
“Art
57 GDPR “"Art". 57 GDPR Tasks (1) Without prejudice to other tasks set out in this Regulation, each supervisory authority shall, within its territory, […] (f) handle complaints from a data subject or complaints from a body, organization, or association pursuant to Article 80, investigate the subject matter of the complaint to an appropriate extent, and inform the complainant within a reasonable time of the progress and outcome of the investigation, in particular where further investigation or coordination with another supervisory authority is necessary; […] (4) In the case of manifestly unfounded requests or—in particular in the event of frequent repetition—excessive requests, the supervisory authority may charge a reasonable fee based on administrative costs or refuse to act on the request. 2In this case, the supervisory authority bears the burden of proof regarding the manifestly unfounded or excessive nature of the request.
“Art
77 GDPR” “Art.” 77 GDPR Right to lodge a complaint with a supervisory authority (1) Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or the place of the alleged infringement, if the data subject considers that the processing of personal data concerning them infringes this Regulation.” Sections 18(1) and 24(1), (5), and (8) of the DSG read as follows: Sections 18, paragraph 1, and 24, paragraphs 1, 5, and 8 of the DSG read as follows: “Art. 2 § 18 “"Art". 2 Section 18, Section 2 Data Protection Authority Establishment § 18. (1) The Data Protection Authority is established as the national supervisory authority pursuant to Art. 51 of the GDPR. Section 18, (1) The Data Protection Authority is established as a national supervisory authority pursuant to Article 51 of the GDPR.
Section 3 Remedies, Liability, and Sanctions Complaints to the Data Protection Authority § 24. (1) Every data subject has the right to lodge a complaint with the Data Protection Authority if they believe that the processing of their personal data violates the GDPR or Section 1 or Article 2, Part 1. Section 24, (1) Every data subject has the right to lodge a complaint with the data protection authority if they believe that the processing of their personal data violates the GDPR or Section 1 or Article 2, Part 1. […] (5) If a complaint is found to be justified, it must be addressed. If a violation is attributable to a data controller in the private sector, that controller must be instructed to comply with the complainant’s requests for access, rectification, erasure, restriction, or data portability to the extent necessary to remedy the identified violation. If the complaint proves to be unfounded, it shall be dismissed. […] (8) Any data subject may bring the matter before the Federal Administrative Court if the data protection authority fails to address the complaint or fails to inform the data subject of the status or outcome of the complaint within three months. 3.2.
On the fulfillment of the requirements under Article 57(4) of the GDPR: 3.2. On the fulfillment of the requirements under Article 57(4) of the GDPR: 3.2.1. In its decision of December 18, 2025, Ro 2025/04/0027, based on its decision of January 29, 2025, Ra 2023/04/0002, and with reference to the judgment of the Court of Justice of the European Union of January 9, 2025, C-416/23, regarding the conditions for refusing to process a complaint pursuant to Art. 57(4) of the GDPR, the Administrative Court summarized that an intent to abuse pursuant to Art. 57( 4 of the GDPR may be presumed to exist if the complainant’s primary reasons for filing a large number of data protection complaints do not lie in the pursuit of the rights granted to them under the GDPR, and the complainant would not have filed the large number of data protection complaints without these irrelevant reasons. In other words, filing a data protection complaint constitutes an abuse if the complainant raises the complaint to achieve a purpose not protected by data protection provisions (such as publicity, hostility, or sensationalism).
This is consistent with the fact that, according to the CJEU, Article 57(4) of the GDPR reflects the Court’s established case law, according to which there is a general legal principle under EU law that citizens may not invoke EU legal norms in a fraudulent or abusive manner. Even if no outright vexatious intent is associated with the submission of a request, it may still be considered abusive if a person draws on the authority’s resources, even though it is already apparent from the grounds of the complaint that the submission in question is manifestly intended to pursue objectives other than the enforcement of the protection afforded by the provisions of the GDPR (see again VwGH, Jan. 29, 2025, Ro 2023/04/0018, para. 17 et seq., with reference to ECJ, Jan. 9, 2025, C-416/23, para. 49, as well as the case law cited therein). 3.2.1. In its decision of December 18, 2025, Ro 2025/04/0027, based on its decision of January 29, 2025, Ra 2023/04/0002, and with reference to the judgment of the ECJ of January 9, 2025, C-416/23, regarding the conditions for refusing to process a complaint under Article 57(4) of the GDPR, summarized that an intent to abuse under Article 57(4) GDPR is to be presumed to exist if the complainant’s primary reasons for filing a large number of data protection complaints do not lie in the pursuit of the rights granted to them under the GDPR, and the complainant would not have filed the large number of data protection complaints without these extraneous reasons.
In other words, the filing of a data protection complaint is considered abusive if the complainant files the complaints to achieve a purpose not protected by data protection provisions (such as publicity, hostility, or sensationalism). This is consistent with the fact that Article 57(4) GDPR reflects the Court’s established case law, according to which there is a general legal principle in Union law that citizens may not invoke Union law in a fraudulent or abusive manner. Even if no outright vexatious intent is associated with the filing of a request, it may still be considered abusive if a person draws on the authority’s resources, even though it is already apparent from the grounds of the complaint that the submission in question is manifestly intended to pursue objectives other than the enforcement of the protection afforded by the provisions of the GDPR; see also VwGH, Jan. 29, 2025, Ro 2023/04/0018, para. 17 et seq., with reference to ECJ, Jan. 9, 2025, C 416/23, para. 49, as well as the case law cited therein). 3.2.2.
In the appeal proceedings, the Administrative Court must itself assess the existence of an intent to abuse the system based on all relevant circumstances of the individual case as determined by the Court. If necessary, the Administrative Court must, on its own initiative, gather the facts relevant to reviewing the legality of the rejection of the data protection complaint pursuant to Art. 57(4) of the GDPR (see VwGH, Jan. 29, 2025, Ra 2023/04/0002, para. 29).3.2.2. In appeal proceedings, the Administrative Court must itself assess the existence of an intent to abuse the system based on all relevant circumstances of the individual case that it is required to determine. If necessary, the Administrative Court must, on its own initiative, establish the facts relevant to reviewing the lawfulness of the rejection of the data protection complaint pursuant to Article 57(4) of the GDPR (see VwGH January 29, 2025, Ra 2023/04/0002, para. 29). 3.2.3.
In the case at hand, there is no doubt that the data protection complaint in question is manifestly intended to pursue objectives other than the enforcement of the protection afforded by the provisions of the GDPR. 3.2.4. Indeed, it is already clear and unambiguous from the contractual terms (“XXXX”) that the commissioned association (and the legal representative covered by the power of attorney) is to indiscriminately submit data protection requests on behalf of the complainant to companies not specified by the complainant himself (in this case, initially to the company of the co-party) in order to subsequently pursue monetary claims in or out of court. In the event of success, the association or the authorized legal representative is to receive 30 percent of the amount recovered as a fee. It should be noted at this point that, pursuant to § 879(2)(2) of the Austrian Civil Code (ABGB), a contract is void if a legal advisor takes over, in whole or in part, a dispute entrusted to him or her, or secures a promise of a specific portion of the amount awarded to the party.
The threat of nullity thus covers both the taking over of the dispute and the agreement on a share of the proceeds (pactum de quota litis). Such agreements have already been recognized as void on multiple occasions (8 Ob 101/05v, SZ 39/160, JBl 1955, 624; RIS-Justiz RS0038729). 3.2.4. Thus, it is already clear and unambiguous from the present contractual wording (“Roman 40”) that the commissioned association (and the legal representative covered by the power of attorney) is to indiscriminately submit data protection requests on behalf of the complainant to companies not specifically designated by the complainant —in this case, initially to the company of the co-party—in order to subsequently pursue monetary claims in or out of court. In the event of success, the association or the authorized legal representative is to receive 30 percent of the amount recovered as a fee. It should be noted at this point that, pursuant to Section 879, Paragraph 2, Subparagraph 2, of the Austrian Civil Code (ABGB), a contract is void if a legal counsel appropriates, in whole or in part, a dispute entrusted to him or her or secures a promise of a specific portion of the amount awarded to the party.
The threat of nullity thus encompasses both the taking over of the dispute and the agreement on a share of the proceeds (pactum de quota litis). Such agreements have already been ruled void on multiple occasions (8 Ob 101/05v, SZ 39/160, JBl 1955, 624; RIS-Justiz RS0038729). 3.2.5. For this reason alone, the respondent authority’s position should be upheld, and it should be noted that the data protection complaint in question—without extraneous motives—namely, the promised financial benefit under the blanket power of attorney for representation in data protection matters and the automatic search for data breaches — would not have been filed in any case. This is not altered by the fact that (only) one proceeding was initiated on behalf of the complainant before the respondent authority, since even a single proceeding may be deemed manifestly unfounded within the meaning of Art. 57(4) of the GDPR; this already follows from the converse reasoning that a large number of pending proceedings, considered in and of themselves, does not necessarily indicate excessive litigation (ECJ, Jan. 9, 2025, C‑416/23, para. 44 et seq.). 3.2.5.
For this reason alone, it was necessary to concur with the respondent authority and to hold that the data protection complaint at issue would not have been filed—at least not—without irrelevant motives, namely the prospect of financial gain under the blanket power of attorney for representation in data protection matters and the automatic search for data breaches — would not have been filed in any event. This is not altered by the fact that (merely) one proceeding was initiated on behalf of the complainant before the respondent authority, since even a single proceeding can be deemed manifestly unfounded within the meaning of Article 57(4) of the GDPR; this already follows from the converse reasoning that a large number of pending proceedings, considered in isolation, does not necessarily indicate excessive litigation (ECJ, Jan. 9, 2025, C‑416/23, para. 44 et seq.). 3.2.6. It is also noteworthy that the complainant—albeit unknowingly—participated in an arrangement which, upon reasonable consideration, suggests that the initiative to enforce data protection rights on behalf of data subjects did not originate with the complainant himself, but rather with the association authorized for this purpose.
Thus, before the adjudicating panel, the complainant stated regarding his motives for granting power of attorney to XXXX that he had hoped to recover part of the XXXX payment; however, he had no grounds to believe that the co-party (a telecommunications provider) might have unlawfully processed personal data relating to the complainant. Nor could the co-party report any (data protection-related) disputes in connection with the contractual relationship with the complainant. 3.2.6. It is also noteworthy that the complainant—albeit unknowingly—participated in an arrangement which, upon reasonable consideration, suggests that the initiative to enforce data protection rights did not originate from the complainant himself, but rather from the association authorized for this purpose. Thus, before the adjudicating panel, the complainant stated regarding the motivation for granting the power of attorney to Roman 40 that he had hoped to recover portions of the Roman 40 contribution, but to have had no grounds whatsoever to believe that the co-party (a telecommunications provider) might have unlawfully processed personal data concerning the complainant.
Nor could the co-respondent report any (data protection-related) disputes in connection with the contractual relationship with the complainant. 3.2.7. When further asked whether the complainant himself specifically instructed the XXXX association to exercise the right of access under Article 15 of the GDPR on his behalf vis-à-vis the co-respondent, the complainant stated before the trial court that he could not recall doing so or having explicitly instructed the association to reclaim any flat-rate service fees paid to the co-party’s telecommunications provider. 3.2.7. When further asked whether the complainant himself specifically instructed the association “römisch 40” to exercise the right of access under Article 15, GDPR against the co-party, the complainant states before the adjudicating court that he cannot recall doing so or having explicitly instructed the association to reclaim any flat-rate service fees paid to the co-party’s telecommunications provider. 3.2.8.
It should also be noted that the exercise of the data subject’s right to access information under Article 15 of the GDPR in connection with obtaining monthly statements regarding the existing contractual relationship between the complainant and the co-party—was not, in any event, necessary for the exercise of his rights under the GDPR —was not necessary, since the complainant, as a customer of the co-respondent, already has access to invoices for the past months via the online customer portal and has regularly received the respective monthly invoices for his mobile phone contract; he has viewed them on occasion but, in some cases, has not been interested in their content. 3.2.8. It must also be noted that the exercise of the data subject’s right to access under Article 15 of the GDPR in connection with obtaining monthly statements regarding the existing contractual relationship between the complainant and the co-respondent—at least not for the purpose of exercising his rights under the GDPR —since the complainant, as a customer of the co-party, already has access to invoices for the past months via the online customer portal, and since he regularly received the respective monthly bills for his cell phone contract, occasionally reviewed them, but at times was not interested in their content. 3.2.9.
In the view of the adjudicating panel, there is no doubt that the primary motivation for pursuing this case is not to exercise data subject rights under data protection law, but rather to reclaim so-called “service fees” promised by the authorized association or legal representative, to reclaim so-called service fees, whereby the authorized representatives, in order to implement the “XXXX” business model without the complainant’s knowledge or involvement, attempted, by exercising the right to access information, to obtain the relevant invoice documents, even though the requested invoice documents are in any case regularly provided to the complainant by the co-party in the course of the existing contractual relationship or are available via the online customer portal. However, upon reasonable consideration, it also follows that the exercise of the right of access within the meaning of Art. 15 of the GDPR, in the present case, primarily served to facilitate the business model of the authorized association and legal representative, rather than to enforce the complainant’s strictly personal rights under the GDPR. 3.2.9.
In the view of this panel, there is no doubt that the primary motivation for bringing this action is not to exercise data subject rights under data protection law, but rather the promise made by the authorized association or legal representative to reclaim so-called “service flat fees,” whereby the agents, in order to implement the “Roman 40” business model without the complainant’s knowledge or involvement, attempted, by invoking the right of access, to obtain the relevant invoice documents, even though the requested invoice documents are in any case regularly provided to the complainant by the co-party in the course of the existing contractual relationship or are available via the online customer portal. However, upon reasonable consideration, it also follows that the exercise of the right of access within the meaning of Article 15, GDPR in the present case primarily served to facilitate the business model of the authorized association and legal representative, but not to enforce the complainant’s strictly personal rights under the GDPR.
This amounts to an attempt to draw on the authority’s resources on a case-by-case basis, even though it is already clear and unambiguous from the complaint’s allegations that the data protection complaint is manifestly pursuing objectives other than the enforcement of the protection afforded by the provisions of the GDPR (see again VwGH, January 29, 2025, Ro 2023/04/0018, para. 17 et seq.). This is intended to tie up the authority’s resources on a case-by-case basis, even though it is already clear and unambiguous from the complaint’s allegations that the data protection complaint is manifestly pursuing objectives other than the enforcement of the protection afforded by the provisions of the GDPR—see again VwGH 29 Jan.2025, Ro 2023/04/0018, para. 17 et seq.). This is against the backdrop of the business practices of the XXXX Association, which are known to the court; the association has had such powers of attorney granted to it in hundreds of cases and, in this context, makes blanket promises regarding the recovery of funds allegedly paid in error, whereby the approach is ostensibly directed at recovering off-set lump-sum fees in connection with telecommunications and energy supply contracts, and thus aims to enforce genuinely civil-law claims.
This is against the backdrop of the association’s business practices, which are known to the court, whereby the association has obtained such powers of attorney in hundreds of cases and, in this context, makes blanket promises to recover funds allegedly paid in error, whereby the action is ostensibly directed at recovering flat-rate fees charged in connection with telecommunications and energy supply contracts, and thus aims to enforce genuine civil law claims. 3.2.10. Consequently, the present course of action was to be regarded as an abuse of rights within the meaning of Art. 57(4) of the GDPR, since the right of access under Art. 15 of the GDPR is to be exercised to obtain information (copies of invoices) that the data subject already possesses or can access via a customer portal, in order to subsequently systematically assert civil claims that bear no connection to the abusive processing of personal data; but rather the approach taken is clearly intended to pursue the economic interests of third parties, namely the generation of revenue from a contingency fee agreement (“XXXX”).3.2.10.
Consequently, the present course of action was to be regarded as an abuse of rights within the meaning of Article 57(4) of the GDPR, since the right of access under Article 15, GDPR is intended to be exercised to obtain information (copies of invoices) that is already available to the data subject or accessible via a customer portal, with the aim of subsequently systematically asserting civil claims that bear no connection to the abusive processing of personal data, but rather the approach taken clearly serves the pursuit of third parties’ economic interests, namely the generation of proceeds from a contingency fee agreement (“Roman 40”). The authority in question therefore rightly refused to process the data protection complaint in the present case pursuant to Article 57(4) of the GDPR. The respondent authority was therefore correct in refusing to address the data protection complaint in the present case pursuant to Article 57(4) of the GDPR. 3.3.
In its judgment of January 9, 2025, the European Court of Justice (ECJ) also correctly held “that, in the event of excessive requests, a supervisory authority may, by means of a reasoned decision, choose whether to charge a reasonable fee based on administrative costs or to refuse to take action in response to the request, in which case it must take into account all relevant circumstances and ensure that the chosen option is appropriate, necessary, and proportionate” (see again VwGH, Jan. 29, 2025, Ra 2023/04/0002, para. 22, with reference to the judgment of the ECJ of Jan. 9, 2025, C 416/23). 3.3. In its judgment of Jan. 9, 2025, the ECJ also correctly held “that, in the event of excessive requests, a supervisory authority may, by means of a reasoned decision, choose either to charge a reasonable fee based on administrative costs or to refuse to to act on the request, in which case it must take all relevant circumstances into account and ensure that the chosen option is appropriate, necessary, and proportionate”—see again VwGH, Jan. 29, 2025, Ra 2023/04/0002, para. 22, with reference to the judgment of the European Court of Justice of January 9, 2025, C-416/23). 3.3.1.
Since the existence of an intent to abuse was affirmed in the present case, the Federal Administrative Court subsequently had to assess whether the respondent authority’s refusal to take action was appropriate, necessary, and proportionate in relation to the imposition of a fee. 3.3.1.1. Even if the imposition of a reasonable fee for processing excessive data protection complaints infringes upon a complainant’s rights under the GDPR to a lesser extent than the refusal to process such complaints, the imposition of a fee should not be given preference from the outset in light of the case law of the ECJ and the VwGH as described above. Rather, the suitability of this option (in the appeal proceedings before the Federal Administrative Court) must therefore be examined with a view to whether it achieves the objective of Article 57(4) of the GDPR, namely to prevent the abuse of a data subject’s right to pursue their rights under the GDPR.
The appropriateness of imposing a fee will therefore be negated, for example, if the enforceability of the fee assessment is doubtful due to the financial situation of the appellant, or if it is assumed that the complainant will also use the legal remedies available against a fee notice to paralyze the authorities. Based on the case law of the ECJ and the VwGH, the imposition of fees also proves to be inappropriate if, despite the imposition of fees for excessive data protection complaints, the complaining party does not refrain from filing such complaints (VwGH, Jan. 29, 2025, Ra 2023/04/0002, paras. 24, 25). 3.3.1.1. Even if the imposition of a reasonable fee for processing excessive data protection complaints infringes upon a complainant’s rights under the GDPR to a lesser extent than the refusal to process such complaints, the imposition of a fee should not be given preference from the outset in light of the case law of the CJEU and the VwGH as outlined above.
Rather, the suitability of this option (in the appeal proceedings before the Federal Administrative Court) must be assessed to determine whether it achieves the objective of Article 57(4) GDPR—namely, to prevent the abuse of a data subject’s right to pursue their rights under the GDPR—is achieved. Accordingly, the appropriateness of imposing a fee would be negated, for example, if the enforceability of the fee assessment is doubtful due to the financial situation of the appealing party, or in light of the assumption that the complainant will also use the legal remedies available against a fee notice to paralyze the authorities. Based on the case law of the ECJ and the VwGH, the imposition of fees also proves to be inappropriate if, despite the imposition of fees for excessive data protection complaints, the complaining party does not refrain from filing such complaints (VwGH, Jan. 29, 2025, Ra 2023/04/0002, paras. 24, 25). 3.3.1.2.
In this specific case, reference must once again be made to the well-documented practice of the association and legal representative authorized by the complainant. The complainant—even if he was only partially aware of this—participated in a business model designed to initiate proceedings with the data protection authority in hundreds of cases, thereby systematically paralyzing the authority. Against this backdrop, the alternative of imposing a reasonable fee already proves to be unsuitable. Furthermore, it must be reiterated that the complainant suffers no apparent lack of legal protection as a result of the rejection of his data protection complaint, since he already possesses the requested information and —had he not granted power of attorney—he would have recognized the futility and lack of prospects for success of his legal action, since he himself stated before the adjudicating court that he had no data protection concerns whatsoever regarding the processing of his data by the co-respondent. 3.3.1.3.
Against this background, the alternative chosen by the respondent authority—to refuse to process the data protection complaint pursuant to Art. 57(4) GDPR— rather than initially exercising the option to charge a reasonable fee for processing the complainant’s excessive data protection complaints, was not objectionable. 3.3.1.3. Against this background, the alternative chosen by the respondent authority—to refuse to process the data protection complaint pursuant to Article 57(4), GDPR, rather than first exercising the option to charge a reasonable fee for processing the complainant’s excessive data protection complaints, was not objectionable. Accordingly, the decision was rendered as stated. Re B) Inadmissibility of the appeal: Pursuant to § 25a(1) VwGG, the Administrative Court must state in the operative part of its judgment or order whether the appeal is admissible under Article 133(4) B-VG.
The ruling must be briefly justified. Pursuant to Section 25a(1) of the VwGG, the Administrative Court must state in the operative part of its judgment or order whether the appeal is admissible under Article 133(4) of the B-VG. The ruling must be briefly justified. In the present case, the Federal Administrative Court was able to rely, in resolving the key legal issues, on the cited—and specifically issued in relation to the proceedings at issue— —which had been issued specifically in relation to the original proceedings—in resolving the key legal issues in the present case, following a preliminary ruling procedure by the European Court of Justice (ECJ) regarding the interpretation of the relevant provision of Union law, Article 57(4) of the GDPR. In the present case, the Federal Administrative Court was able to rely on the cited case law of the Supreme Administrative Court—which was specifically issued in the original proceedings— – case law of the VwGH, which was specifically issued in the underlying proceedings, whereas this was preceded by a preliminary ruling procedure by the ECJ regarding the interpretation of the relevant provision of EU law, Article 57(4) of the GDPR.
Furthermore, the Federal Administrative Court had to conduct a case-by-case assessment of whether the criteria of Article 57(4) of the GDPR were met, based on all the circumstances of the present case; according to the established case law of the Administrative Court, a legal assessment made on a case-by-case basis can only justify the admissibility of an appeal if this is required for reasons of legal certainty due to a gross misjudgment of the circumstances specific to the case by the Administrative Court (see, in this regard, regarding Article 7(3) of the GDPR, Federal Administrative Court decision of January 16, 2025, Ra 2024/04/0424, with further references).Furthermore, the Federal Administrative Court was required to conduct a case-by-case assessment of whether the criteria of Article 57(4) of the GDPR were met, based on all the relevant circumstances of the present case; according to the established case law of the Administrative Court, a legal assessment made on a case-by-case basis can only justify the admissibility of an appeal if this is required for reasons of legal certainty due to a gross misjudgment of the circumstances of the individual case by the Administrative Court; see, in this regard, regarding Article 7(3) of the GDPR, VwGH 16.1.2025, Ra 2024/04/0424, with further references).