Access request must be identifiable as Art. 15 GDPR request, not just inquiry

Date of Decision July 27, 2026 Legal Provision AVG § 13(3) B-VG Art. 133(4) BVwG-EVV § 1(1) GDPR Art. 15 AVG § 13 (current version) effective as of August 15, 2018, last amended by Federal Law Gazette I No. 57/2018; AVG § 13 effective from January 1, 2012, through August 14,2018, last amended by Federal Law Gazette I No. 100/2011 AVG § 13 in effect from Jan. 1, 2011, through Dec. 31, 2011, last amended by Federal Law Gazette I No. 5/2008 AVG § 13 effective from January 1, 2008, through December 31, 2010, last amended by Federal Law Gazette I No. 5/2008 AVG § 13 effective from July 1,2004 through December 31, 2007; last amended by Federal Law Gazette I No. 10/2004; AVG § 13 valid from March 1, 2004, through June 30, 2004; last amended by Federal Law Gazette I No. 10/2004 AVG § 13, effective from April 20, 2002, through February 29, 2004, last amended by Federal Law Gazette I No. 65/2002 AVG § 13 valid from January 1, 2002, through April 19, 2002, last amended by Federal Law Gazette I No. 137/2001 AVG § 13 valid from January 1,1999 through December 31, 2001; last amended by Federal Law Gazette I No. 158/1998; AVG § 13, effective from February 1, 1991, through December 31, 1998 B-VG Art. 133 (now B-VG Art. 133), effective from January 1, 2019, through May 24, 2018, last amended by Federal Law Gazette I No. 138/2017 B-VG Art. 133 effective as of January 1, 2019, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 effective from May 25,May 2018 through December 31, 2018, last amended by Federal Law Gazette I No. 22/2018, B-VG Art. 133, effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164/2013, B-VG Art. 133, effective from Jan. 1, 2014, through July 31, 2014, last amended by Federal Law Gazette I No. 51/2012 Federal Constitutional Law (B-VG) Art. 133, effective from January 1, 2004, through December 31, 2013, last amended by Federal Law Gazette (BGBl.)

The Federal Administrative Court, composed of Judge Dr. Tatjana CARDONA as presiding judge, lay judge Mag. Viktoria HAIDINGER, and lay judge Mag. Thomas GSCHAAR, has ruled on the complaint filed by XXXX, against the decision of the Data Protection Authority dated October 7, 2025, Ref. No. XXXX (involving the co-parties XXXX regarding a data protection matter), in a closed session, has rightly ruled as follows:The Federal Administrative Court, composed of Judge Dr. Tatjana CARDONA as presiding judge, lay judge Mag. Viktoria HAIDINGER, and lay judge Mag. Thomas GSCHAAR, ruled on the complaint filed by Roman numeral 40, against the decision of the Data Protection Authority dated October 7, 2025, Ref. No. Roman 40 (involving parties Roman 40) concerning a data protection matter in a closed session, has ruled as follows: A) The complaint is dismissed as unfounded. B) The appeal is not admissible pursuant to Article 133, paragraph 4, B-VG.

The appeal is not admissible pursuant to Article 133, paragraph 4, B-VG. Text Reasons for the Decision: I. Course of Proceedings: Roman numeral I. Course of Proceedings: 1. In a petition initiating proceedings filed on October 2, 2025, with the Data Protection Authority (hereinafter “the authority in question”), the complainant (hereinafter “BF”) alleged that the co-party (hereinafter “mP”) had violated his right to access information within the meaning of Art. 15 of the GDPR, as he had not received any information regarding his exclusion from an integration course.1. In a petition initiating proceedings filed on October 2, 2025, with the Data Protection Authority (hereinafter “the authority against which the complaint was filed”) the complainant (hereinafter “BF”) alleged that the co-party (hereinafter “mP”) had violated his right to access information under Article 15 of the GDPR, as he had not received any information regarding his exclusion from an integration course. 2.

In a decision dated October 7, 2025, the respondent authority dismissed the complainant’s data protection complaint and stated, in summary, that the complainant had not submitted an access request to the co-party. Even assuming that the complainant had submitted an access request, the complaint to the respondent authority was to be considered premature and therefore rejected. 3. In an appeal against the decision filed on October 9, 2025, the complainant challenged the decision and argued, in essence, that the GDPR does not contain specific procedural rules for submitting access requests within the meaning of Article 15 of the GDPR, and that his requests should therefore be classified as “access requests.” 3. In an appeal against the decision dated October 9, 2025, the BF challenged the decision and essentially argued that the GDPR does not contain any specific procedural rules for submitting access requests within the meaning of article 15, GDPR and that his requests should therefore be classified as “access requests.” 4.

On December 10, 2025, a statement from the BF was received via email. In further statements sent by email on December 24, 2025, the BF again pointed out that he had submitted a properly formatted access request and referred to various screenshots in the attachment, according to which he had submitted an access request pursuant to Art. 15 of the GDPR on November 20,2025. On May 15, 2026, the BF again submitted a supplementary statement to the Federal Administrative Court via email, in which he explained that he had submitted another request for information on February 15, 2026, and applied, among other things, for legal aid. 7. On December 10, 2025, a statement from the BF was received via email. In further statements sent by email on December 24, 2025, the BF again pointed out that he had submitted a properly formatted access request and referred to various screenshots in the attachment, according to which he had submitted an access request pursuant to Article 15 of the GDPR on November 20,In 2025 I submitted an application for access under article 15 of the GDPR.

However, I would like to expressly state here that I **was neither given a written warning in advance nor invited to a meeting to clarify the matter**, as required by the educational standards for subsidized courses. If my behavior had indeed been problematic, there should have been an official warning or a personal meeting. The fact that this was not done suggests to me that **internal biases or personal conflicts**, without any factual basis, led to this action. I therefore request the following: 1. Please provide the official justification from XXXX for my exclusion. 1. Please provide the official justification from Roman 40 for my exclusion. 2. Please verify whether the formal steps (warning, meeting) were followed. 3. Please clarify whether the exclusion was justified from both a legal and educational standpoint. I am aware that such measures can have an impact on my integration and professional future.

This makes a fair and transparent clarification all the more important. Thank you in advance for your response, and please feel free to contact me at any time if you have any questions. Sincerely, […]” 1.4. On August 13, 2025, the BF sent the following letter to the mP (formatting not as in the original): “Dear Sir or Madam, It has now been two weeks since I filed my complaint on July 30, 2025, and it has not yet been processed. I therefore intend to pursue this matter both in Court and with the Equal Treatment Commission. The arbitrary and unfounded removal from the language course—without seriously considering my perspective, giving me a second chance, or objectively investigating the incident—is shameful and reveals a great deal about the approach taken. Unfortunately, I am not surprised that Austria is considered the “most unfriendly country” in the world. This is a direct consequence of the systematic promotion of hatred, prejudice, and hostility—especially when the XXXX and social media specifically target Syrians, while Ukrainians are treated quite differently.Unfortunately, I’m not surprised that Austria is regarded worldwide as the “most unfriendly country.”

This is a direct consequence of the systematic promotion of hate, prejudice, and hostility—especially when the Roman 40 and social media specifically target Syrians, while Ukrainians are treated quite differently. A look at the figures shows that the number of Syrian refugees Austria has taken in since 2011 is nearly equal to the number of Ukrainian refugees since 2021. Nevertheless, public criticism, Surveillance, and systematic incitement by the media, politicians, and authorities are directed almost exclusively at Syrian refugees. This creates the impression that the Austrian economy depends solely on Syrians and that all Syrian refugees are unemployed, whereas in my class, most of the participants were Ukrainians who are also unemployed but are not subjected to any comparable hostility. In fact, Syrians make a far greater contribution to the Austrian economy. It is particularly shameful that Syrian women are specifically targeted because of their clothing and the number of children they have—to the point of the absurd practice of checking birth rates at hospital entrances—while no similar standards are applied to Ukrainian women.

I have a question: Isn’t it my right to review the report that was prepared about me and on the basis of which my exclusion from the B1 integration course “Roman 40” was decided? I would like to review the report solely to understand how the decision was reached. I would greatly appreciate receiving a copy of the report. Thank you very much for your time and support. Sincerely, […]” 1.7. In a letter dated September 8, 2025, the BF again requested a response. 1.8. In emails dated September 12, 2025, and September 19, 2025, the complainant contacted the Data Protection Authority directly and requested access to all personal data stored about him by mP. 2. Assessment of the Evidence: The findings are based on the consistent account of the facts provided by the complainant and the co-party, as also relied upon by the respondent authority in the contested decision. With regard to the complainant’s letters to mP, the findings are based on the corresponding excerpts included in the administrative act and thus available to the Court. 3.

Legal Assessment: 3.1. Regarding the statements submitted via email: The Federal Chancellor’s Regulation on Electronic Communication between the Federal Administrative Court and Parties (BVwG Electronic Communication Regulation – BVwG-EVV), StF: Federal Law Gazette II No. 515/2013, as amended, reads as follows:The Federal Chancellor’s Regulation on Electronic Communication between the Federal Administrative Court and Parties (BVwG Electronic Communication Regulation—BVwG-EVV), original version, Federal Law Gazette Part 2, No. 515 of 2013, as amended, reads as follows: Electronic Filing of Pleadings and Attachments to Pleadings § 1. (1) Pleadings and attachments to pleadings may be submitted electronically in the following ways, subject to technical feasibility: Paragraph 1, (1) Pleadings and attachments to pleadings may be submitted electronically in the following ways, subject to technical feasibility: 1. via electronic legal communications; 2. via electronic service of process in accordance with the provisions of Section 3 of the Service of Process Act (ZustG), Federal Law Gazette No. 200/1982;2. via electronic service of process in accordance with the provisions of Section 3 of the Service of Process Act (ZustG), Federal Law Gazette No. 200 of 1982; 3. via an electronic file; 4. via a standardized interface function; 5. using electronic forms available on the website www.bvwg.gv.at; 6. by fax.

The submissions by the BF, which were sent by email to the Federal Administrative Court, are therefore deemed not to have been filed. 3.2. On appeals against decisions and the requirements of Article 15, GDPR3.2. On appeals against decisions and the requirements of Article 15, GDPR Article 15 of the GDPR grants data subjects the right to request confirmation from a controller as to whether personal data concerning them is being processed and, if so, the right to access such personal data. Para 1, subparagraphs (a) through (h), cit. contain more specifically defined information that must be provided to the data subject. Article 15 of the GDPR grants data subjects the right to request confirmation from a controller as to whether personal data concerning them is being processed and, if so, the right to access such personal data. Paragraph 1, subparagraphs (a) through (h), of the cited law contain more specific information that must be provided to data subjects.

The right of access is strictly personal and cannot be transferred to third parties. The obligation to provide information within the meaning of Article 15 of the GDPR therefore requires that the controller receive a request that is legally attributable to the data subject. It follows that only the failure to fulfill—or the incomplete fulfillment of—an obligation to provide information arising from a specific, legally valid request can be the subject of a data protection complaint proceeding. Consequently, the subject matter of a data protection complaint alleging a violation of the right of access must relate to the obligation to provide information established by a specific request and to the failure to fulfill or the incomplete fulfillment of that obligation. The right of access is strictly personal and cannot be transferred to third parties. The obligation to provide information within the meaning of Article 15 of the GDPR therefore requires that the controller have received a request that is legally attributable to the data subject.

It follows that only the failure to fulfill—or the incomplete fulfillment of—an obligation to provide information arising from a specific legally valid request can be the subject of a data protection complaint proceeding. Consequently, the subject matter of a data protection complaint regarding a violation of the right of access must relate to the obligation to provide information arising from a specific request and its non-fulfillment or incomplete fulfillment. Consequently, it is not possible to submit the request for information—which forms the subject matter of the complaint—only during the data protection proceedings, because the filing of a legally valid request for information is the factual prerequisite for the (potentially) data subject’s rights could have been violated in the first place. (see VwGH Dec. 10, 2024, Ra 2022/04/0107)Consequently, it is not possible to submit the request for information that forms the subject matter of the complaint only during the data protection proceedings, because the submission of a legally valid request for information is the factual prerequisite for the (potentially) data subject’s rights could have been infringed at all.

(See VwGH Dec. 10, 2024, Ra 2022/04/0107) The last sentence of Recital 63 of the GDPR states that controllers who process a large amount of information about a data subject should be able to require the data subject to specify which information or which processing operations their access request relates to before information is provided. The prevailing legal literature assumes in this regard that, while this cannot be understood as a “duty to cooperate” in the traditional sense, it does indicate an obligation on the part of the data subject to provide further clarification in certain cases. In particular, reference is made to blanket access requests. (see Haidinger in Knyrim, DatKomm Art. 15 GDPR Marg. No. 11/1 (as of July 1, 2024, rdb.at)) The last sentence of Recital 63 of the GDPR states that controllers who process a large amount of information about a data subject should be able to require the data subject to specify which information or which processing operations their access request relates to before providing the information.

The prevailing legal literature assumes in this regard that, while this cannot be understood as a “duty to cooperate” in the traditional sense, it does indicate an obligation on the part of the data subject to provide clarification in certain cases. In this context, particular reference is made to blanket access requests. See Haidinger in Knyrim, DatKomm article 15, GDPR Marginal Note 11/1 (as of July 1, 2024, rdb.at)) 3.3. In the context of corporate law documents, the Administrative Court (VwGH)—as correctly stated by the respondent authority—held that the assessment of declarations depends on their objective meaning, that is, on how a reasonable recipient of a statement would have to understand it, taking all circumstances into account. The content of a document only becomes the content of the signatory’s declaration of intent upon its signing if the other party could not have inferred anything else from the circumstances.

(see VwGH Dec. 15, 2021, Ra 2021/13/0078)3.3. In the context of documents under corporate law, the VwGH —as correctly stated by the respondent authority—that the assessment of declarations depends on their objective meaning, i.e., on how a reasonable recipient of a declaration would have had to understand it, taking all circumstances into account. The content of a document only becomes the content of the signatory’s declaration of intent upon signing if the other party could not have inferred anything else from the circumstances. (See Administrative Court, December 15, 2021, Ra 2021/13/0078) With regard to procedural statements as well, the VwGH held that these must be interpreted exclusively according to their objective meaning. What matters is how the statement must be objectively understood, taking into account the specific statutory provision, the purpose of the proceedings, and the case file available to the authority.

Regarding the subject matter of the proceedings, the VwGH stated that the “matter” of the appeal proceedings before the VwG is the issue that formed the content of the decision issued by the respondent authority (see VwGH Oct. 29, 2025, Ra 2024/08/0071; VwGH Jan. 14, 2022, Ra 2020/10/0082). Furthermore, the VwGH has held in its case law that motions in administrative appeal proceedings on which the authority has not made a decision cannot under any circumstances be the subject of administrative court proceedings (see VwGH, Nov. 18, 2025, Ra 2025/09/0065). 3.5. For the present case, this means the following: 3.5.1. As noted, on July 31, 2025, August 13, 2025, August 20, 2025, September 7, 2025, and September 8, 2025, to the mP, which, in his view, should—at least in part—be classified as access requests within the meaning of Art. 15 of the GDPR. 3.5.1. As noted, the BF sent letters to mP on July 31, 2025, August 13, 2025, August 20, 2025, September 7, 2025, and September 8, 2025, which, in his view, should—at least in part—be classified as access requests within the meaning of article 15 of the GDPR.

Ultimately, the Court cannot concur with this view: The wording of the BF’s letters was established at the outset, and no content emerges from them that, viewed objectively, would have had to be understood by the mP as a request for information within the meaning of Article 15 of the GDPR. In his briefs, the BF argues that he was not given a reason for his exclusion from the integration course, that internal procedural rules were not followed (i.e., a warning or a meeting instead of exclusion from the course), and that the decision has implications for his professional future. Furthermore, he expressed his view that the action constituted unequal treatment of him personally because he is Syrian. In his letter dated July 31, 2025, the complainant merely requested (i) that an official justification for his exclusion be provided, (ii) an examination of whether all necessary procedural steps, such as a warning or a meeting, had been followed, and (iii) clarification as to whether the exclusion was legally and pedagogically justified.

The wording of the BF’s letters was noted at the outset, and it does not contain any content that, viewed objectively by the mP, should have been understood as a request for information within the meaning of article 15 of the GDPR. In his briefs, the BF argues that he was not given a reason for his exclusion from the integration course, that internal procedural rules were not followed (i.e., a warning or a meeting instead of exclusion from the course), and that the decision has implications for his professional future. Furthermore, he expressed his view that the action constituted differential treatment against him because he is Syrian. In his letter dated July 31, 2025, the complainant requested only (i) that an official explanation for his exclusion be provided, (ii) a review of whether all necessary procedural steps, such as a warning or a meeting, had been followed, and (iii) clarification as to whether the exclusion was legally and pedagogically justified.

Nor do the subsequent letters, in which the BF regularly refers to his “complaint,” contain any content that would indicate a request for information within the meaning of Art. 15 of the GDPR. None of the letters refers to data processing or mentions the GDPR or data protection rights in general. In the letter dated September 7, 2025, the BF merely complained that it was his right to inspect the report on the suspension or that he would appreciate receiving a copy of the report. Given that the right to access files and the right to information under the GDPR are, in principle, distinct claims that coexist, and that the BF—as explained —made no mention whatsoever of the topic of “data protection”—the mP was not necessarily required to assume that an access request under Art. 15 GDPR had been made or to reinterpret the BF’s letters in that regard (see also Haidinger in Knyrim, DatKomm Art. 15 GDPR Marg.

No. 56 et seq. [as of July 1, 2024, rdb.at]).Nor can any content be inferred from the subsequent letters—in which the BF regularly refers to its “complaint”—that would indicate a request for access within the meaning of article 15 of the GDPR. None of the letters make any reference to data processing or mention the GDPR or data protection rights in general. In the letter dated September 7, 2025, the BF merely complained that it was his right to inspect the report on the exclusion or, alternatively, that he would appreciate receiving a copy of the report. Given that the right of access to files and the right to information under the GDPR are, in principle, distinct claims that coexist, and given that the BF—as explained —made no mention whatsoever of the topic of “data protection,” the mP need not necessarily assume that a request for access under article 15 of the GDPR, or reinterpret the Federal Office’s letters in that regard (see also Haidinger in Knyrim, DatKomm article 15, GDPR, para. 56 et seq. [as of July 1, 2024, rdb.at]). 3.5.2.

It was not until the emails dated September 12, 2025, and September 19, 2025—which were addressed to the respondent authority and not to the mP—that the BF first referred to the GDPR or data protection law in general. However, these letters cannot be regarded as requests for information within the meaning of Article 15 of the GDPR, since they were addressed directly to the respondent authority and—as explained at the outset—an actual request for information must be directed to the controller, as only failure to comply or improper compliance is considered a violation of the law. 3.5.2. It was not until the emails dated September 12, 2025, and September 19, 2025—which were addressed to the respondent authority and not to mP—that the BF first referred to the GDPR or data protection law in general. However, these letters cannot be regarded as requests for information within the meaning of Article 15 of GDPR, as they were addressed directly to the respondent authority and—as explained at the outset—an actual request for information must be directed to the controller, since only non-compliance or inadequate compliance is considered a violation of the law. 3.5.3.

In his data protection complaint to the respondent authority, the complainant also stated verbatim that he “[…] had ‘submitted his complaints to XXXX on July 29, 2025, by email; on August 7, 2025, also by email; and on August 20, 2025, by mail as well as by email.’” It is therefore evident that the complainant—before becoming aware of the issue regarding the submission of a request within the meaning of Art. 15 of the GDPR—did not himself assume that he was submitting a request for access per se, but rather that he was raising the grounds for a complaint. 3.5.3. In his data protection complaint to the respondent authority, the complainant also stated verbatim that he “[…] had ‘submitted his complaints to Roman 40 on July 29, 2025, via email; on August 7, 2025, also via email; and on August 20, 2025, by mail and via email.’” It is therefore evident that the complainant—before becoming aware of the issue regarding the submission of a request within the meaning of article 15 of the GDPR—did not himself consider his communications to be a request for access per se, but rather as the presentation of a complaint. 3.5.4.

Overall, the Federal Data Protection Commissioner (BF) is therefore correct in principle that Article 15 of the GDPR does not prescribe a specific form for submitting a request for access; however, not every instance of contact—even if it relates to the justification of actions—can simply be regarded as a “access request” within the meaning of the GDPR. From an objective perspective, the letters that the BF sent to the mP could not be recognized as access requests within the meaning of the GDPR, and the mP cannot, in this sense, be accused of a legal violation for failing to respond to such requests. 3.5.4. Overall, therefore, the BF is generally correct in stating that article 15 of GDPR does not prescribe a specific form for submitting a request for access; however, not every instance of contact—even if it is related to the justification of actions—can simply be regarded as a “access request” within the meaning of the GDPR.

From an objective perspective, the letters that the BF sent to the mP could not be recognized as access requests within the meaning of the GDPR, and therefore the mP cannot be accused of a violation of the law for failing to respond to requests. Nor do the decisions of the CJEU and the Federal Administrative Court cited by the BF convince the adjudicating Court to adopt a different view. Although the courts address Article 15 of the GDPR in the cited decisions, these do not contain any substantive arguments that support the Federal Finance Court’s position. Nor do the decisions of the CJEU and the Federal Administrative Court cited by the Federal Finance Court (BF) convince this Court to adopt a different view. Although the courts address Article 15 of the GDPR in the cited decisions, no compelling arguments supporting the BF’s position can be found therein. 3.5.5. For the sake of completeness, however, it should also be noted in addition to point 3.1. that, in this regard, the BF argues in the administrative court proceedings that on August 22,2025 and submitted a corresponding invoice from the post office, this cannot establish the existence of a (substantive) access request within the meaning of the GDPR.

The BF did not submit a copy of the letter. Furthermore, an actual request would no longer be “at issue” in the present proceedings. Nor can the applicant’s request for information dated November 20, 2025—thus more than a month after the issuance of the decision at issue—be taken into account in this decision, as this would likewise go beyond the subject matter and thus the “scope” of the pending proceedings. 3.5.6. An order to amend the complaint by the respondent authority was not an option in the present case, since—as explained above—deficiencies that impair the prospects of success are not subject to such an order. These are not merely deficiencies concerning the completeness of the complaint. 3.5.7. Furthermore, the complainant is free to file a lawful request for information under Article 15 of the GDPR against the controller(s) at any time. 3.5.7. Furthermore, the complainant is free to file a lawful request for information under article 15 of the GDPR against the controllers at any time. 3.6.