# BVwG - W605 2289290-2/18E

- Type: Case Law
- Source: Federal Administrative Court
- Date: 2026-07-14
- Original: https://gdprhub.eu/index.php?title=BVwG_-_W605_2289290-2/18E
- Canonical: https://overview.legal/posts/353784
- Topics: Right of Access Procedures, Personal Data, Public Sector, Right of Access, Controllers, Supervisory Authorities, Public Authority, Right to Restriction, Profiling, Statistics

## Summary

Facts — The data subject received social benefits from a public authority (controller) because of their unemployment. The controller has established an investigation unit that investigates undeclared workers and people who refuse to work but receive benefits. Employees from that investigation unit visited the data subject’s address and took pictures in the context of an investigation into possible income from self-employed work. The data subject requested from the controller access to their personal data processed by the controller pursuant to Article 15 GDPR. The controller submitted the data to the data subject. In an additional access request, the data subject requested information as to the number of photos taken at the address of the data subject, what objects were depicted, which employees took those pictures and with what justification. As a response, the controller sent six pictures that were taken at the address of the data subject in PDF format to the data subject. Three pictures were taken from the public pavement and depicted a poster and an advertisement placard, both visible from the public pavement. Three other pictures depicted the data subject’s car and house. The data subject lodged a complaint with the DPA, claiming incomplete access to their personal data, especially because the controller failed to provide them with information concerning the employers who conducted the investigation against them and meta data of the pictures, including technical data of the pictures. The DPA rejected the complaint and the data subject appealed it to the Federal Administrative Court (BVwG). Holding — As far as the scope of the access request was concerned, the Court held that the data subject has narrowed the scope of the subject matter of the access request to the pictures and the justification to take them by specifying those matters in their request. Since the access request is triggered by the request of the data subject, the request can limit the scope of what the DPA has to decide on, and thus, define the subject matter in the proceeding before the Court. Concerning the access to specific documents, the Court held that the access request can only include the information mentioned in Article 15 GDPR. In specific cases, in order to fulfill the obligation under Article 15 GDPR, it is necessary for the controller to provide whole documents in which the personal data is included. However, Article 15 GDPR does not stipulate a right to access to documents. Article 15(3) GDPR that stipulates that the controller shall provide a copy of personal data, must be understood as specifying a means of providing the information pursuant to Article 12 GDPR. It depends on the individual case whether the controller is required to provide whole documents or whether they fulfil their obligation by providing a register of the personal data. As far as access to data about the employees who took the pictures was concerned, the Court held that the right to access does not include the personal data of third persons. This is also true for the meta data requested. Moreover, according to the Court, the controller fulfilled their access request by providing the six pictures and information of the modalities of taking the pictures and the justification thereof. The data subject’s claim of the existence of more than those six pictures was unfounded according to the Court. The data subject was unable to demonstrate any facts that point to the existence of further pictures. However, it is for the data subject to prove that the access was incomplete. Mere speculation is not sufficient for the Court to investigate into the existence of further pictures. In conclusion, the Court confirmed the DPA decision that the controller did not violate Article 15 GDPR and gave complete access.

## Full text

Date of Decision July 14, 2026 Legal Provisions AlVG §50 AlVG §58 B-VG Art. 133(4) DSG §24(4) DSG §4 GDPR Art. 15 GDPR Art. 4(1) AlVG Art. 3 § 50 (current version) AlVG Art. 3 § 50 effective as of July 1, 2013, last amended by Federal Law Gazette I No. 67/2013 AlVG Art. 3, § 50, in effect from Jan. 1, 2000, through June 30, 2013, last amended by Federal Law Gazette I No. 179/1999; AlVG Art. 3, § 50, in effect from Jan. 1,1998 through December 31, 1999; last amended by Federal Law Gazette I No. 139/1997; AlVG Art. 3 § 50; effective from May 1, 1996, through December 31,1997, last amended by Federal Law Gazette No. 201/1996, AlVG Art. 3 § 50, effective from July 1, 1994, through April 30, 1996, last amended by Federal Law Gazette No. 314/1994 AlVG Art. 3 § 50, effective from August 1, 1989, through June 30, 1994, last amended by Federal Law Gazette No. 364/1989 AlVG Art. 3 § 58 (now AlVG Art. 3 § 58), effective July 1, 1997, last amended by Federal Law Gazette I No. 47/1997 AlVG Art. 3 § 58, effective from April 29, 1994, to April 28, 1994, last amended by Federal Law Gazette No. 314/1994 AlVG Art. 3 § 58, effective from July 1, 1992, through June 30, 1997, last amended by Federal Law Gazette No. 416/1992 B-VG Art. 133 (now B-VG Art. 133), effective from January 1, 2019, through May 24, 2018, last amended by Federal Law Gazette I No. 138/2017 B-VG Art. 133 effective as of January 1, 2019, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 effective from May 25,May 2018 through December 31, 2018, last amended by Federal Law Gazette I No. 22/2018, B-VG Art. 133, effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164/2013, B-VG Art. 133, effective from Jan. 1, 2014, through July 31, 2014, last amended by Federal Law Gazette I No. 51/2012 Federal Constitutional Law (B-VG) Art. 133, effective from January 1, 2004, through December 31, 2013, last amended by Federal Law Gazette (BGBl.) I No. 100/2003 B-VG Art. 133 valid from January 1, 1975, through December 31, 2003, last amended by Federal Law Gazette No. 444/1974 B-VG Art. 133 valid from Dec. 25, 1946, through Dec. 31, 1974, last amended by Federal Law Gazette No. 211/1946 B-VG Art. 133 valid from Dec. 19,December 1945 through December 24, 1946; last amended by StGBl. No. 4/1945; B-VG Art. 133; in effect from January 3, 1930, through June 30, 1934 DSG Art. 2 § 24 (currently DSG Art. 2 § 24), effective as of July 15, 2024, last amended by Federal Law Gazette I No. 70/2024; DSG Art. 2 § 24, effective from May 25,May 2018 through July 14, 2024, last amended by Federal Law Gazette I No. 120/2017 DSG Art. 2 § 24 valid from January 1, 2010, through May 24,2018, last amended by Federal Law Gazette I No. 133/2009, DSG Art. 2 § 24, effective from Jan. 1, 2000, through Dec. 31, 2009 DSG Art. 2 § 4 (currently DSG Art. 2 § 4), effective as of January 1, 2020, last amended by Federal Law Gazette I No. 14/2019 DSG Art. 2 § 4 valid from May 25, 2018, through December 31, 2019, last amended by Federal Law Gazette I No. 24/2018 DSG Art. 2 § 4 effective from May 25, 2018, through May 24, 2018, last amended by Federal Law Gazette I No. 120/2017 DSG Art. 2 § 4 effective from Jan. 1,January 2010 through May 24, 2018; last amended by Federal Law Gazette I No. 133/2009; DSG Art. 2 § 4 valid from January 1, 2000, through December 31, 2009 Judgment , W605 2289290-2/18E IN THE NAME OF THE REPUBLIC! The Federal Administrative Court, composed of Judge Mag.a Julia LUDWIG as presiding judge, expert lay judge Dr.in Barbara FELLNER-RESCH, and expert lay judge Mag. Florian SCHULTES, LL.M., on the complaint filed by XXXX, with representation provided by Attorney Dr. Herbert POCHIESER, 1017 Vienna, against the decision of the Data Protection Authority dated February 19, 2024, Ref. No. XXXX, (co-party: XXXX), has rightly ruled as follows: The Federal Administrative Court, presided over by Judge Mag.a Julia LUDWIG, with expert lay judge Dr. Barbara FELLNER-RESCH and expert lay judge Mag. Florian SCHULTES, LL.M., on the complaint filed by Roman numeral 40, represented by Attorney Dr. Herbert POCHIESER, 1017 Vienna, against the decision of the Data Protection Authority dated February 19, 2024, Ref. No. Roman 40, (co-party: Roman 40), has rightly ruled as follows: A) The complaint is dismissed as unfounded. B) The appeal is not admissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG). The appeal is not admissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG). Text Reasons for the Decision: I. Course of Proceedings: Roman numeral 1. Course of proceedings: 1. In a petition initiating proceedings dated October 12, 2023, the complainant, represented by a representative, filed a data protection complaint against the co-party alleging a violation of the right of access under Article 15 of the GDPR and § 44 of the DSG, filed a motion for a declaration of unlawfulness pursuant to § 24 of the Data Protection Act (DSG), and requested action under Art. 58 of the GDPR, as well as the initiation of criminal proceedings and the imposition of a fine. 1. In a petition initiating proceedings dated October 12, 2023, the complainant, represented by legal representatives, filed a data protection complaint against the co-respondent regarding an alleged violation of the right of access pursuant to article 15 of the GDPR and Section 44 of DSG, filed a motion for a declaration of unlawfulness pursuant to Section 24 of the DSG, and requested action pursuant to Article 58 of the GDPR, as well as the initiation of criminal proceedings and the imposition of a fine. In support of her complaint—insofar as relevant to the proceedings—the complainant stated that she was unemployed and receiving unemployment insurance benefits, and that the co-respondent had been conducting investigations against her since at least 2020. For example, on August 7, 2020, she saw a man with a camera. Furthermore, on September 16, 2020, an employee of the co-respondent visited her and photographed her personal documents. On September 26, 2020, this person also appeared at her home, and shortly thereafter, the financial police arrived at her residence based on an “anonymous tip.” Since then, she has been requesting information once a year pursuant to Article 15 of the GDPR, in response to which she receives approximately 300 pages; however, these documents contain no information regarding the incidents described, nor are any attachments provided. On August 25, 2022, and October 11, 2022, an employee of the co-respondent was also at her property and took several photos. The co-respondent had established a so-called “investigative unit” intended to track down individuals unwilling to work, those falsely registered as unemployed, and undocumented workers; however, she was never informed of whether the complainant was suspected of any offenses, what those offenses might be, or on what grounds she was suspected. The complainant did not receive any substantiated information as to how any photographs might contribute to clarifying the facts of the case—which were unknown to her—or how their use could be justified. Although three photos from 2020 were sent to the complainant, she was aware of visits by the co-respondent’s “investigative unit” to her home on at least October 11, 2022, August 25, 2022, and September 9, 2022. In support of her claim—to the extent relevant to the proceedings—the complainant stated that she was unemployed and receiving unemployment insurance benefits, and that the co-party had been conducting investigations against her since at least 2020. For example, on August 7, 2020, she saw a man with a camera. Furthermore, on September 16, 2020, an employee of the co-respondent visited her and photographed her personal documents. On September 26, 2020, this person also appeared at her home, and shortly thereafter, the financial police arrived at her residence based on an “anonymous tip.” Since then, she has submitted a request for information once a year pursuant to Article 15 of the GDPR, in response to which she receives approximately 300 pages; however, these documents contain no information regarding the incidents described, nor are any attachments provided. On August 25, 2022, and October 11, 2022, an employee of the co-respondent was also on her property and took several photos. The co-respondent had established a so-called “investigative unit” intended to track down individuals unwilling to work, those falsely registered as unemployed, and undocumented workers; however, she was never informed of whether the complainant was suspected of any offenses, what those offenses might be, or on what grounds she was suspected. The complainant did not receive any substantiated information as to how any photographs might contribute to clarifying the facts of the case—which were unknown to her—or how their use could be justified. Although three photos from 2020 were sent to the complainant, she was aware of visits by the co-party’s “investigative unit” to her home at least on October 11, 2022, August 25, 2022, and September 9, 2022. The information provided to her by the co-party for the years 2020 and 2021 lacked all data processed by the data collection service or other departments, all attachments mentioned in the text of the information provided, all data from the companies, NGOs, or various providers of training and other measures, and any data related thereto (such as data exchanged with the AMS). The information provided must include all details necessary to assess the lawfulness of the specific data processing. In the present case, this means, at a minimum, details regarding the offense of which the complainant is suspected and the grounds for that suspicion. 2. In its response dated November 20, 2023, the co-party contested the complainant’s allegations to the extent that that information resulting from the right to access files under § 17 AVG and that resulting from the right regarding processed personal data under Art. 15 GDPR are not identical. Information from an administrative proceeding and the data from a preliminary investigation underlying the issuance of that decision […] would, in principle, not be subject to the right of access under Article 15 of the GDPR, but would instead have to be requested through the right to inspect the case file. Furthermore, based on the current case law of the CJEU (C-487/21), it cannot be inferred that there is a general right to receive documents in which personal data is processed. 2. In its submitted statement of November 20, 2023, the co-party countered the complainant’s arguments to the extent that information derived from the right to inspect files under Section 17, AVG, or from that right with respect to processed personal data under Article 15 of the GDPR, are not identical. Information from an administrative proceeding and the data from a preliminary investigation underlying the issuance of that decision […] are, in principle, not subject to the right of access under article 15 of the GDPR, but must be requested through the right to inspect files. Furthermore, based on the current case law of the CJEU (C-487/21), it cannot be inferred that there is a general right to receive documents in which personal data is processed. 3. In a submission dated December 11, 2023, the complainant filed another (301-page) “request for information pursuant to Article 15 of the EU General Data Protection Regulation (Regulation (EU) 2016/679),” dated January 5, 2022, into the proceedings. She also submitted a letter from the co-party dated August 29, 2023, as well as email correspondence from August 30, 2023, to September 7, 2023, including attached photographs. 3. In a submission dated December 11, 2023, the complainant introduced another (301-page) “Response pursuant to Article 15 of the EU General Data Protection Regulation (Regulation (EU) 2016/679),” dated January 5, 2022, into the proceedings. She also submitted a letter from the co-party dated August 29, 2023, as well as email correspondence from August 30, 2023, to September 7, 2023, including the attached photographs. 4. In a submission dated January 16, 2024, the co-party further argued that photographs taken by the investigation unit were intended for official purposes and were therefore not subject to the right of access under Article 15 of the GDPR. Furthermore, the alleged incompleteness of the information provided in this regard was based on a legal error, since the complainant herself acknowledged that the co-party had complied with the right of access. 4. In a submission dated January 16, 2024, the co-party further argued that photographs taken by the investigation service served official purposes and were therefore not subject to the right of access under article 15 of the GDPR. Furthermore, the alleged incompleteness of the information in question is based on a legal error, since the complainant herself acknowledges that the co-party complied with the right of access. 5. In the decision dated February 19, 2024, Ref. No. XXXX, the Data Protection Authority dismissed the complainant’s complaint against the co-respondent regarding an alleged violation of the right of access with respect to the requests for information dated September 28, 2020, and December 16, 2021 (Point 1 of the decision) and dismissed the complaint as to the remainder as unfounded (Point 2 of the decision). 5. By the decision of February 19, 2024, Ref. No. 40, the Data Protection Authority dismissed the complainant’s complaint against the co-respondent regarding an alleged violation of the right to access information in connection with the requests for access dated September 28, 2020, and December 16, 2021 (Point 1 of the decision) and dismissed the remainder of the complaint as unfounded (Point 2 of the decision). 6. The complainant, represented by counsel, filed a full appeal against this decision in a brief dated May 22, 2024. 7. To determine the facts relevant to the decision, an oral appeal hearing was held on June 10, 2026. II. The Federal Administrative Court considered: Roman numeral two. The Federal Administrative Court considered: 1. Findings: 1.1. At the time of the decision, the complainant is unemployed and receives benefits from unemployment insurance. 1.2. The intervening party is the regional office of XXXX responsible for providing support and counseling to the complainant. 1.2. The intervening party is the regional office of Roman numeral 40 responsible for providing support and counseling to the complainant. As part of targeted campaigns, an investigative unit was established at the co-party in 2018 to conduct investigations on behalf of the co-party in connection with ex officio reductions in unemployment insurance benefits. This unit was housed within the Legal Affairs Department of XXXX.As part of targeted initiatives, an investigative unit was established at the co-respondent in 2018 to conduct investigations on its behalf regarding ex officio reductions in unemployment insurance benefits. This unit was established within the Legal Affairs Department of Roman 40. At the beginning of 2020, in connection with the suspension and adjustment of the complainant’s benefit payments due to her disputed income from self-employment, ex officio investigations were initiated against the complainant, and inquiries were conducted by employees:within the co-party or the investigative service. 1.3. In a letter dated September 28, 2020, the complainant submitted a request for information to the co-party. In a letter from the co-party dated November 4, 2020, the complainant received a 117-page response listing the personal data processed at the time the information was compiled. 1.4. In a letter dated December 18, 2020, the complainant objected to the incompleteness of this response dated November 4, 2020, and claimed that official actions taken by an employee of the co-respondent’s legal department on September 16, 2020, and September 25, 2020, were not included in the response. 1.5. After the complainant’s legal representative reviewed the file, the transcript dated September 25, 2020, and photographs were provided. 1.6. In a letter dated December 16, 2021, the complainant filed another request with XXXX for information regarding all personal data that the co-party had stored about her as of November 1, 2020: 1.6. In a letter dated December 16, 2021, the complainant submitted another request to Roman 40 for information regarding all personal data that the co-party had stored about her as of November 1, 2020: In a letter from the co-party dated January 5, 2022, the complainant received a 301-page response listing the data processed regarding her person as of the date the response was prepared 1.7. At the same time, in connection with the disputed suspension and adjustment of the complainant’s benefit payments due to her disputed income from self-employment, the Labor Market Service’s Investigation Department conducted an investigation against the complainant; as part of which an employee of the Legal Affairs Department of XXXX—where the Investigation Service is based—visited the complainant at her home address on August 25, 2022, following a tip. 1.7. At the same time, in connection with the suspension and adjustment in question of the complainant’s benefit payments due to her disputed income from self-employment, the Investigation Division of the Labor Market Service conducted an investigation into the complainant, during which an employee from the Legal Affairs Department at Roman 40—where the Investigation Service is located—visited the complainant on August 25, 2022, following a tip received at her home address. 1.8. In a letter dated November 12, 2022, addressed to XXXX / Regional Office XXXX, the complainant submitted the following request for information: 1.8. In a letter dated November 12, 2022, addressed to Roman 40 /Regional Office Roman 40, the complainant submitted the following request for information: “[…] Subject: Request for information pursuant to Article 15 of the GDPR, […]Subject: Request for information pursuant to Article 15 of the GDPR, […] Dear Sir or Madam, I am invoking my rights under the GDPR, in particular Article 15 of the GDPR. I am invoking my rights under the GDPR, in particular Article 15 of the GDPR. Please confirm whether you are processing personal data concerning me. I request information regarding all personal data you have stored about me as of November 1, 2021. In addition, I request the following information: - The processing purposes and the categories of personal data being processed; and, if the personal data was not collected directly from me, all information regarding the source of this data. - All contractual or legal bases on which this data is being used. - the recipients or categories of recipients to whom the personal data has been or will be disclosed or transferred, as well as the safeguards under Article 46 of the GDPR, if personal data is or has been transferred to a third country or to international organisations. - The recipients or categories of recipients to whom the personal data has been or will be disclosed or transferred, as well as the safeguards provided for under article 46 of the GDPR, if personal data is or has been transferred to a third country or to international organisations. - the existence of a right to rectification and erasure of the personal data concerning me, or to restriction of processing by you, or a right to object to such processing. - the existence of a right to lodge a complaint with the competent supervisory authority - the planned duration for which the personal data will be stored, or, if this is not possible, the criteria for determining that duration. - Where applicable, the existence of automated decision-making, including profiling, pursuant to article 22 paragraphs 1 and 4 of the GDPR and—at least in such cases—meaningful information regarding the logic involved, as well as the scope and intended effects of such processing on me. Pursuant to Art 12 of the GDPR, I request that you provide me with this information without undue delay, and in any event within one month, in writing, free of charge, and in an easily understandable form.Pursuant to article 12 of the GDPR, I request that you provide me with this information without undue delay, and in any event within one month, in writing, free of charge, and in a comprehensible form. […]” 1.9. In a letter from the co-respondent dated December 9, 2022, the complainant received a 351-page response with the following title and content (emphasis and formatting as in the original): “Information pursuant to Art. 15 of the”Information pursuant to Article 15 of the EU General Data Protection Regulation (Regulation (EU) 2016/679) Data subject: XXXX, born on XXXX Data subject: Roman 40, born on Roman 40 The Public Employment Service (AMS) processes personal data only to the extent permitted by law. The legal basis consists of the provisions of the General Data Protection Regulation (Regulation (EU) 2016/679) and the Data Protection Act (DSG) in conjunction with the relevant provisions of the Public Employment Service Act (AMSG), the Labor Market Promotion Act (AMFG), the Unemployment Insurance Act (AlVG), and the Foreign Nationals Employment Act (AuslBG), etc. Of particular importance are Section 25 of the AMSG, Section 6 of the AMFG, and Section 69 of the AlVG. Of particular importance are Section 25 of the AMSG, Section 6 of the AMFG, and Section 69 of the AlVG. […] Please note: Official documents (e.g., decisions, minutes, file notes pursuant to the General Administrative Procedure Act) are not subject to the right to access information. Therefore, you will not find this data in the information provided here. The following lists the personal data processed by the AMS as of the date this information was prepared, December 9, 2022: For what purposes does the AMS process data (processing purposes)? ● Placement in jobs and apprenticeships ● Improving opportunities in the labor market (e.g., training, reintegration measures) ● Preserving jobs through the use of subsidies ● Reviewing eligibility for benefits (e.g., unemployment benefits, continuing education allowances) and subsidies ● Processing applications under the Foreign Nationals Employment Act ● Archival purposes in the public interest, statistical purposes, and scientific or historical research purposes (e.g., determining the unemployment rate) Table of Contents Personal Master Data 3 Contact Information 3 Data on Family Members 8 Data on Registration with the AMS 8 Benefit Periods 9 Data Relevant to Job Placement 12 Benefit Cases and Course Participation 22 Payment Data 23 Economic Characteristics and Income 28 Employment and Insurance Data 39 Employment Termination Data 42 Determination of Entitlement 42 Chronological Documentation 46 Where Does the Processed Data Come From (Source)? 343 Who Receives Your Data (Categories of Recipients)? 344 How long is your data retained (retention period)? 344 What are your rights? 345 List of Abbreviations 346 Personal Master Data Personal Data First Name: XXXX First Name: Roman numerals 40 Last Name: XXXX Last Name: Roman numerals 40 Birth name or former names: XXXX Names: Roman numerals 40 Gender: XXXX Gender: Roman numerals 40 Marital status: XXXX Marital status: Roman numerals 40 Number of Children: XXXX Number of Children: Roman numerals 40 Nationality: XXXX Nationality: Roman numerals 40 Beneficiary Status: XXXX Beneficiary Status: Roman numerals 40 Social Security Number, Date of Birth: Social Security Number: XXXX Social Security Number: Roman numeral 40 Date of Birth: XXXX Date of Birth: Roman numeral 40 Address State: XXXX State: Roman numeral 40 Street, Number: XXXX Street, Number: Roman numeral 40 Zip Code: XXXX Zip Code: Roman numeral 40 City: XXXX City: Roman numeral 40 Municipality: XXXX Municipality: Roman numeral 40 Municipal code: XXXX Municipal code: Roman numeral 40 Administrative Data: Your record number: XXXX Your record number: Roman numeral 40 Your identification number: XXXX “Your identification number: Roman numeral 40 “ […] Contact Information […] Appointments Reason Date At Office Room With Note […] […] […] […] Family Members’ Information Social Security Number Date of Birth Last Name Gender Relationship Address […] […] […] […] […] Information on Registration with the AMS Registration Periods:, Registration Periods: From To […] […] […] Employment Relevant to Job Placement: Name Location Art of Employment From To […] […] […] […] […] […] Benefit Periods From To Benefit Type Daily Rate Number Family Allowances […] […] […] […] […] […] Data Relevant to Job Placement Education: Highest level of education completed: XXXX Highest level of education completed: Roman numeral 40 Occupation/Desired Occupation: Last occupation held (according to the systematic directory of XXXX (according to the systematic directory of Roman numeral 40 Occupations): Desired occupation 1: XXXX Desired occupation 1: Roman numeral 40 Education for desired occupation 1: XXXX Education for desired occupation 1: Roman numeral 40 Work experience for desired occupation 1: XXXX Work experience for Preferred Occupation 1: Roman numeral 40 Preferred Occupation 2: XXXX Preferred Occupation 2: Roman numeral 40 Training for Preferred Occupation 2: XXXX Training for Preferred Occupation 2: Roman numeral 40 Work Experience for Career Choice 2: XXXX Work Experience for Career Choice 2: Roman numeral 40 Keywords: XXXX Keywords: Roman numeral 40 Placement Restrictions XXXX Keywords: Placement Restrictions Roman numeral 40, Keywords: Eligible Work Locations: XXXX Eligible Work Locations: Roman numeral 40 Eligible Work Hours: XXXX Earliest Start Time: XXXX Latest end of work shift: XXXX Weekly hours: XXXX Possible start date: XXXX Eligible work hours: Roman numeral 40, Earliest start time: Roman numeral 40, latest end of work shift: Roman numeral 40, weekly hours: Roman numeral 40, possible start date: Roman numeral 40 List of AMS applications / job placement proposals: Date created Company Name / ZIP Code Order No. Employment as Status […] […] […] […] […] […] Your current job posting: Text of the job posting: […] Your ad has been approved for publication on the Internet. Placement-Relevant Characteristics Code Description […] […] […] Investigation proceedings under the Foreign Nationals Employment Act (AusIBG) Approval Pending Valid Suspended […] […] […] […] […] Funding Cases and Course Participation Grant / Course Title Status From To […] […] […] […] Payment Details Bank Transfer on [date], on Entitlement5 Deductions5 Net Amount5 […] […] […] […] […] Financial Information and Income Who Name From To Type Contributions […] […] […] […] […] […] […] Employment and Insurance Data From To Art Employer Insurance Provider […] […] […] […] […] Termination Data for Employment Relationships […] Determination of Entitlement […] […] Chronological Documentation Date Created Title / Content […] […] […] Where does the processed data come from (source)? The AMS processes personal data that it receives from you, for example, when you apply for benefits and financial assistance or as part of the counseling or job placement process. The AMS also processes personal data that it receives from other agencies in order to fulfill its duties and legal obligations. For example, the AMS receives data from the following institutions: ● Umbrella Organization of Social Insurance Institutions or the relevant social insurance institution (e.g., regarding employment relationships or periods of insurance coverage) ● Central Register of Residents (e.g., regarding place of residence) ● Tax offices (e.g., data from income tax and sales tax assessment notices) ● Pension insurance agencies (e.g., regarding the pension effective date) ● The relevant federal ministry (e.g., regarding issued residence permits) In general, other government agencies, Courts, social insurance and social assistance agencies, the Social Ministry Service, and institutions to which AMS tasks have been delegated may transmit personal data to the AMS to the extent that such data is essential for the performance of statutory duties. Within the framework of administrative assistance, local authorities, municipal associations, and other self-governing bodies may transmit personal data to the AMS. In cross-border cases (e.g., for cross-border workers), data transfers may be conducted by labor market authorities of other countries to the AMS in accordance with international regulations (e.g., European Regulation (EC) No. 883/2004).In cross-border cases (e.g., for cross-border workers), data transfers may occur to the AMS from labor market authorities of other countries in accordance with international regulations (e.g., European Regulation (EC) No. 883 of 2004). Who receives your data (categories of recipients)? The AMS transmits personal data to other authorities, Courts, social insurance agencies, and Statistics Austria to the extent that such data is essential for the performance of its statutory duties. Within the framework of administrative assistance, personal data may be made available to regional authorities, municipal associations, and other self-governing bodies. Specifically, the AMS transmits personal data (in particular regarding benefit receipt and registration as a job seeker) to the umbrella organization of social insurance providers or the relevant social insurance providers (such as the Austrian Health Insurance Fund) and the pension insurance provider. The AMS transmits data (in particular, benefit receipt data) to the tax office. Where applicable, data is transferred to the social assistance agency (e.g., when receiving social assistance) and the Ministry of Social Affairs Service. The AMS transmits data to the Chambers of Labor and the Chambers of Agricultural Labor for the purpose of registering unemployed persons eligible to vote. Employers receive data from the AMS that is required in connection with establishing an employment relationship, assessing professional suitability, and conducting the application process. The AMS transmits data to its IT service providers, Bundesrechenzentrum GmbH (BRZ) and IBM Austria Internationale Büromaschinen Gesellschaft m.b.H. (IBM), as well as to institutions to which AMS tasks have been delegated. In cross-border cases (e.g., for cross-border workers), data may be transferred to labor market authorities in other countries in accordance with international regulations (e.g., Regulation (EC) No. 883/2004).In cross-border cases (e.g., for cross-border workers), data may be transferred to labor market authorities in other countries in accordance with international regulations (e.g., Regulation (EC) No. 883 of 2004). How long will your data be retained (retention period)? Your data will be retained for a period of seven years following the conclusion of the respective business transaction. The retention period is extended by any periods during which the data is still required to assert, exercise, or defend legal claims, or if other legal provisions stipulate longer retention periods. For economic and technical reasons, erasure is limited to one date per year. Until then, there is no right to early erasure (Paragraph 25(9) AMSG). Your data will be retained for a period of seven years following the conclusion of the respective business transaction. The retention period is extended by any time during which the data is still needed to assert, exercise, or defend legal claims, or if other legal provisions stipulate longer periods. For economic and technical reasons, erasure is limited to one date per year. Until then, there is no right to early erasure (Paragraph 25(9) AMSG). What rights do you have? In the following, we inform you, in accordance with Article 15 of the GDPR, about the rights existing under the provisions of the GDPR and the DSG. Whether a particular right actually applies in a specific case or does not exist due to legal restrictions or exceptions can only be assessed by taking into account all the circumstances of the individual case. Under article 15 of the GDPR, you have the right to access your personal data. The right to access data is limited where the rights and freedoms of other individuals would be impaired. For example, there is no right to access data if providing such information would jeopardize a trade or business secret of the AMS or a third party (paragraph 4(6) of the DSG). Furthermore, there is no right to access data if providing such information would jeopardize the fulfillment of the tasks legally assigned to the AMS (in the exercise of its sovereign authority) (Paragraph 4(5) of the Data Protection Act). Please note: Official records (e.g., decisions, minutes, and file notes under the General Administrative Procedure Act) are not subject to the right of access. Therefore, you will not find this information in the present disclosure.Under Article 15 of the GDPR, you have the right to access your personal data. The right to access data is limited where the rights and freedoms of others would be impaired. For example, there is no right to access data if providing the information would jeopardize a trade or business secret of the AMS or a third party (Section 4, paragraph 6 of the Data Protection Act). Furthermore, there is no right to access data if providing such information would jeopardize the AMS’s ability to fulfill the tasks legally assigned to it (in its capacity as a public authority) (Section 4, paragraph 5 of the Data Protection Act). Please note: Records held by public authorities (e.g., decisions, minutes, and file annotations under the General Administrative Procedure Act) are not subject to the right to access information. Therefore, you will not find this data in the information provided here. Under Article 16 of the GDPR, you have the right to rectification of inaccurate personal data. Once the statutory retention period has expired, you have the right to have your personal data erased. For further details on the scope of the right to erasure and the applicable restrictions, please refer to the provisions of article 17 of the GDPR. In certain cases (e.g., in the context of a filed objection), you have the right to restriction of processing (Article 18 of the GDPR, paragraph 4(2) of the DSG). Furthermore, under certain conditions arising from your specific situation, you may object to the processing. For details and limitations regarding the right to object, please refer to the provisions of article 21 of the GDPR. Under Article 16 of the GDPR, you have the right to rectification for inaccurate personal data. Once the statutory retention period has expired, you have the right to have your personal data erased. For further instances in which the right to erasure applies, as well as the existing restrictions, please refer to the provisions of article 17 of the GDPR. In certain cases (e.g., in the context of an objection that has been lodged), you have the right to restriction of processing (Article 18 of the GDPR, Section 4, paragraph 2 of the DSG). Furthermore, under certain conditions arising from your specific situation, you may object to the processing. For details and limitations regarding the right to object, please refer to the provisions of article 21 of the GDPR. Pursuant to Section 24 of the Data Protection Act (DSG), you may file a complaint with the Austrian Data Protection Authority if you believe that the processing of your data violates the GDPR or the DSG.Pursuant to Section 24 of the Data Protection Act (DSG), you may file a complaint with the Austrian Data Protection Authority if you believe that the processing of your data violates the GDPR or the DSG. […]“ List of Abbreviations […]“ 1.10. In a letter dated August 22, 2023, the complainant requested the following: “XXXX” Roman numeral 40 XXXX Roman numeral 40 XXXX Roman numeral 40 XXXX Roman numeral 40 XXXX, on August 22, 2023 Roman numeral 40, on August 22, 2023 […] Data Processing Dear Sir or Madam, As you are aware, I am acting as a representative for Ms. XXXX in the proceedings regarding GZ XXXX at the XXXX State Administrative Court, in which the unlawfulness of the surveillance conducted by your agency has been raised as an issue and for which you have still not provided any justification.As you are aware, I am acting as a representative for Ms. Roman 40 in the proceedings regarding Case No. Roman 40 at the Regional Administrative Court of Roman 40, in which the unlawfulness of the surveillance conducted by your agency has been raised as an issue and you have still not provided any justification for it. The assumption regarding the existence of photographs of my client’s private property is based on photographic evidence she gathered herself, in which she captured the line of sight of your employee, which was clearly directed toward the property. Furthermore, the assumption that such photographs were processed is based on your own observations and those of your visitor at the time. […] I am therefore required, pursuant to Article 12(3) of the GDPR, to request that you inform me within one month of how many and which photographs were taken of my client’s property or of objects or persons located thereon, and on what grounds this documented action was carried out. I am therefore required, pursuant to paragraph 3 of article 12 of the GDPR, to request that you inform me within one month of the number and specific nature of the photographs taken of my client’s property or of objects or persons located thereon, and the justification for this documented action. […]” November 1. In response, the co-party submitted, via email dated August 30, 2023, three photographs from a survey conducted on September 9, 2020, as well as the letter dated September 28, 2022, in which the co-party stated the following: “[…] With reference to your letter dated August 22, 2023, we would like to inform you that, in response to the complaint regarding the measures you filed following the request from the XXXX State Administrative Court dated October 24,2022, we submitted our statement on November 18, 2022, within the prescribed time limit. It is beyond our understanding how you have come to the conclusion that we “have still not provided any justification for this.” With reference to your letter dated August 22,2023, we would like to inform you that, in response to the appeal you filed regarding the measures—pursuant to the request from the State Administrative Court Roman 40 dated October 24, 2022—we submitted our statement by the deadline on November 18, 2022. How you have come to the conclusion that we “have still not provided any justification for this” is beyond our understanding. Pursuant to § 50(2) of the ALVG, the regional office, acting in its capacity as a public authority, is authorized to verify whether the eligibility requirements are met by conducting appropriate investigations. Neither the ALVG nor the AVG provides an exhaustive list of possible evidence for this purpose; rather, anything that is suitable for determining the relevant facts and appropriate to the circumstances of the individual case may be considered. Pursuant to paragraph 50(2) of the ALVG, the regional office, acting in its capacity as a public authority, is authorized to verify whether the eligibility requirements are met by conducting appropriate investigations. Neither the ALVG nor the AVG provides an exhaustive list of possible evidence for this purpose; rather, anything that is suitable for establishing the relevant facts and appropriate to the circumstances of the individual case may be considered. Three photographs were taken from the sidewalk of a display board and an advertising poster, both of which were set up for public view and were visible to the public. The property was not entered, and the building was not surveilled. […] No surveillance of the house took place. From the perspective of the Employment Service, photographing the display board and the advertising poster, as well as retaining the photographs, does not constitute a violation of the GDPR. Such simple photographing and retention occurred in the case at hand and served solely to fulfill internal statutory obligations of the agency. The photographs were not taken unnoticed. Even if they had been taken without your client’s knowledge, photographing display boards and advertising posters—which are placed for public viewing and are therefore visible to everyone—cannot be considered an infringement of legal rights or privacy. […]” In an email dated September 7, 2023, three additional photographs were submitted; these were taken on August 25, 2022, and showed the complainants’ car as well as the house—photographed from across the street—along with another car. It could not be determined whether additional photographs were taken or are at least currently still stored. 2. Assessment of the Evidence: Evidence was gathered by reviewing the relevant administrative and court records. The findings made are based on the documents underlying the proceedings and, consequently, on the uncontroversial and undisputed contents of the files, as well as on the following considerations: 2.1. The fact that the complainant is unemployed and receives unemployment insurance benefits is evident from her own statements and the undisputed contents of the file. It is equally undisputed —as essentially argued by both parties in the proceedings—is that the complainant is being assisted by the co-party as the competent regional office and that, within the framework of the established investigation service, ex officio investigations were also conducted against the complainant regarding the possible withdrawal of benefits. Overall, during the oral appeal hearing on June 10, 2026, both parties gave the impression of being credible in the essential aspects and of striving for clarification, although the adjudicating panel also gained the impression that the overall situation is fraught with conflict and complicated. The complainant gave the strong impression that she felt she had been treated unfairly and taken advantage of by employees of the Public Employment Service and that she harbored deep mistrust toward her case management. Findings regarding the investigation service are generally based on ex officio research conducted on the relevant websites of the co-party XXXX and, specifically with regard to residence, on the email correspondence dated November 7,2023, which is attached to the statement. Findings regarding the collection service are generally based on ex officio research on the relevant websites of the co-party Roman 40 and, specifically with regard to the location, on the email correspondence dated November 7, 2023, attached to the co-party’s statement of November 20,2023, attached to the email correspondence dated November 7, 2023. 2.2. The findings regarding points 1.3 and 1.4 are derived from the contents of the file (the complainant’s submitted attachment containing her data protection complaint of October 12, 2023, as well as her statement of December 11, 2023) and are undisputed. 2.3. The fact that the complainant inspected the investigative file concerning her is evident, on the one hand, from her statements on this matter during the oral complaint hearing, as well as from her handwritten notes on the copy of her letter dated December 18, 2020, submitted as part of the data protection complaint. 2.4. As already stated, it is undisputed that the investigative unit conducted investigations concerning the complainant, as this is essentially the basis for the arguments of both parties. Both parties stated that an employee of the Legal Affairs Department of XXXX visited the complainant at her home address on August 25, 2022, and that the complainant did not open the door for him (see the letter from the co-party dated November 18, 2022, as well as the complainant’s data protection complaint, pp. 3 and 7, and Appendix ./D to the data protection complaint). 2.4. As already explained, it is undisputed that the investigative service conducted an investigation concerning the complainant, as this is essentially the basis for the arguments of both parties. Both parties stated that an employee of the Legal Affairs Department of Roman 40 visited the complainant at her home address on August 25, 2022, and that the complainant did not open the door for him; was stated by both parties (see the co-party’s letter dated November 18, 2022, as well as the complainant’s data protection complaint, pp. 3 and 7, and Appendix ./D to the data protection complaint). 2.5. The complainant herself stated that on October 3, 2022, she filed a complaint seeking injunctive relief with the XXXX Regional Administrative Court against the co-party “on the grounds of surveillance, including the processing of photographs taken” (see data protection complaint, p. 4). The fact that this complaint was dismissed by order dated December 1, 2023, is evident from the order contained in the case file. 2.5. The complainant herself stated that on October 3, 2022, she filed an administrative complaint with the Regional Administrative Court Roman 40 against the co-party “regarding surveillance, including the processing of photographs taken”; see Data Protection Complaint, p. 4). The fact that this complaint was dismissed by order dated December 1, 2023, is evident from the order contained in the case file. 2.6. The findings regarding the further written correspondence between the parties to the proceedings (i.e., requests for information and subsequent responses) concerning points 1.6. and 1.8. through 1.11. are evident from the undisputed documents in the case file. It could not be established with sufficient probability that additional photographs exist beyond those submitted, due to the lack of any argument—beyond mere speculation—to that effect. The photographs attached to the complaint, which show an employee of the co-party, undoubtedly support the assumption that this person had entered the complainant’s property; but they do not support the conclusion that he also took additional photographs or that any such photographs, if taken, were still stored at the time the information was provided. 3. Legal Assessment: Pursuant to § 6 BVwGG, the Federal Administrative Court decides through a single judge, unless federal or state laws provide for a decision by a panel. Pursuant to § 6 BVwGG, the Federal Administrative Court decides through a single judge, unless federal or state laws provide for a decision by a panel. Pursuant to § 27 of the Data Protection Act (DSG), the Federal Administrative Court decides by a panel on complaints against decisions regarding a violation of the duty to inform under para 24(7) and the Data Protection Authority’s duty to decide.Pursuant to Section 27 of the DSG, the Federal Administrative Court decides by a panel on complaints against decisions regarding a violation of the duty to inform under paragraph 24(7) and the Data Protection Authority’s duty to decide. Pursuant to § 9 of the Federal Administrative Court Act (BVwGG), the presiding judge manages the affairs of the panel and conducts the proceedings up to the hearing. The resolutions required for this do not require a panel resolution. He makes a decision on whether an oral hearing is to be scheduled, opens, presides over, and closes it. He announces the Senate’s decisions, signs the written copies, drafts the final disposition, and submits the motion for a decision to the Senate. Pursuant to Section 9 of the BVwGG, the presiding judge manages the Senate’s affairs and conducts the proceedings up to the hearing. The decisions required in this regard do not require a Senate resolution. He decides whether to schedule an oral hearing, opens, presides over, and closes it. He announces the Senate’s decisions, signs the written copies, drafts the final decision, and submits the motion for a decision to the Senate. Re A) 3.1. Legal Provisions 3.1.1. The relevant provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data, on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation—GDPR), read in part, including the heading, as follows: “Art. 4 “Art.” 4 Definitions For the purposes of this Regulation, the term 1. ‘personal data’ means any information relating to an identified or identifiable natural person (hereinafter referred to as the ‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person; […] Art. 15 Article 15, Right of access by the data subject (1) The data subject has the right to obtain from the controller confirmation as to whether personal data concerning him or her are being processed; if so, he or she has the right to access such personal data and to receive the following information: a) the processing purposes b) the categories of personal data being processed; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; d) if possible, the planned duration for which the personal data will be stored, or, if this is not possible, the criteria for determining that duration; the existence of a right to rectification or erasure of personal data concerning the data subject, or a right to restriction of processing by the controller, or a right to object to such processing; f) the existence of a right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to the source of the data; h) the existence of automated decision-making, including profiling, pursuant to article 22 paragraphs 1 and 4, and—at least in such cases—meaningful information about the logic involved, as well as the scope and intended consequences of such processing for the data subject. […] (3) The controller shall provide a copy of the personal data being processed. 2For any additional copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. 3If the data subject submits the request electronically, the information must be provided in a commonly used electronic format, unless the data subject specifies otherwise. (4) The right to receive a copy pursuant to paragraph 3 shall not infringe upon the rights and freedoms of other individuals.” Section 4 of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999, reads: Section 4 of the Data Protection Act (DSG), Federal Law Gazette Part I, No. 165 of 1999, reads: “(1) The provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data, on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ No. L 119 of May 4, 2016, p. 1, (hereinafter: GDPR) and this Federal Act apply to the fully or partially automated processing of personal data of natural persons, as well as to the non-automated processing of personal data of natural persons that is stored or is to be stored in a filing system, unless the more specific provisions of Part 3 of this Federal Act take precedence.“(1) The provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data, on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Official Journal No. L 119 of May 4, 2016, page 1, (hereinafter: GDPR) and this Federal Act apply to the fully or partially automated processing of personal data of natural persons, as well as to the non-automated processing of personal data of natural persons that are stored or are to be stored in a filing system, unless the more specific provisions of Part 3 of this Federal Act take precedence. (2) If the rectification or erasure of automated personal data cannot be carried out immediately because, for economic or technical reasons, it can only be performed at specific times, the processing of the personal data in question shall be restricted until that time, with the effect provided for in Article 18(2) of the GDPR.(2) If the rectification or erasure of automated personal data cannot be carried out immediately because, for economic or technical reasons, it can only be performed at specific times, the processing of the personal data in question shall be restricted with the effect provided for in article 18, paragraph 2, GDPR until that time. (3) The processing of personal data relating to criminal acts or omissions established by a Court or administrative authority—in particular, including suspected criminal offenses—as well as criminal convictions or preventive measures is permitted in compliance with the provisions of the GDPR if 1. there is an express statutory authorization or obligation to perform processing of such data, or 2. the lawfulness of the processing of such data otherwise arises from statutory duties of care, or the processing is necessary to safeguard the legitimate interests of the controller or a third party pursuant to Article 6(1)(f) of the GDPR, and the manner in which the data processing is carried out ensures the protection of the data subject’s interests in accordance with the GDPR and this Federal Act.2. the lawfulness of the processing of such data otherwise arises from statutory duties of care, or the processing is necessary to safeguard the legitimate interests of the controller or a third party pursuant to article 6, paragraph 1, (f) of the GDPR, and the manner in which the data processing is carried out ensures the protection of the data subject’s interests in accordance with the GDPR and this Federal Act. (4) In the case of an offer of information society services made directly to a child, consent pursuant to Article 6(1)(a) of the GDPR to the processing of the child’s personal data is lawful if the child has reached the age of fourteen.(4) In the case of an offer of information society services made directly to a child, consent pursuant to Article 6, paragraph 1, subparagraph a, of the GDPR to the processing of the child’s personal data is lawful if the child has reached the age of fourteen. (5) The data subject’s right of access under Article 15 of the GDPR does not apply to a controller acting in an official capacity, notwithstanding other statutory restrictions, if providing such access would jeopardize the fulfillment of a task legally assigned to the controller.(5) The data subject’s right of access under Article 15 of the GDPR does not apply to a controller acting in its capacity as a public authority, without prejudice to other statutory restrictions, if providing such information would jeopardize the fulfillment of a task lawfully assigned to the controller. (6) The data subject’s right of access under Article 15 of the GDPR generally does not apply to a controller, without prejudice to other statutory restrictions, if providing such information would jeopardize a trade or business secret of the controller or a third party.(6) The data subject’s right of access pursuant to Article 15 of the GDPR generally does not apply with respect to a controller, without prejudice to other statutory restrictions, if providing such information would jeopardize a trade or business secret of the controller or of a third party. (Note: Paragraph 7 repealed by Article 5(3), Federal Law Gazette Part I No. 14/2019) “Note: Paragraph 7, repealed by Article 5, paragraph 3, Federal Law Gazette Part I, No. 14 of 2019,)“ The relevant provisions of the Unemployment Insurance Act of 1977 (AlVG) read, in part, as follows: “ARTICLE III“ARTICLE Roman numeral three Procedures […] Notifications § 50. (1) Any person receiving benefits under the unemployment insurance system is required to notify the competent regional office without delay of the commencement of employment in accordance with § 12, para 3. In addition, any other change in the unemployed person’s financial circumstances that is relevant to the continuation and extent of the entitlement, as well as any change of residence, must be reported to the regional office without delay, but no later than one week after the event occurs. If unemployment benefits are received pursuant to § 18(5), the obligation to report also applies to the institution’s operating agency. If continuing education benefits or part-time education benefits are received, the obligation to report also applies to the employer. Para 50, (1) Any person receiving benefits under the unemployment insurance system is required to notify the competent regional office without delay of the commencement of employment in accordance with paragraph 12(3). In addition, any other change in the unemployed person’s financial circumstances that affects the continuation or extent of their entitlement, as well as any change of residence, must be reported to the regional office without delay, but no later than one week after the event occurs. When receiving unemployment benefits pursuant to Section 18, paragraph 5, the obligation to report also applies to the institution’s operating agency. When receiving continuing education benefits or part-time education benefits, the obligation to report also applies to the employer. (2) The regional office is authorized to verify that the eligibility requirements are met by conducting appropriate investigations. […] Procedures in Matters Concerning Emergency Assistance § 58. This article shall apply to procedures in matters concerning emergency assistance, with the proviso that emergency assistance shall take the place of unemployment benefits.”Section 58. This article shall apply to proceedings concerning emergency assistance, with the proviso that emergency assistance shall take the place of unemployment benefits.” 3.2. Regarding point 1 of the contested decision with respect to the requests for information dated September 28, 2020, and December 16, 2021, the following considerations applied: Pursuant to § 24(4) of the Data Protection Act (DSG), the right to have a complaint considered expires if the complainant does not file it within one year after becoming aware of the event giving rise to the complaint, but no later than three years after the event allegedly took place. Late complaints must be dismissed.Pursuant to Section 24(4) of the DSG, the right to have a complaint considered expires if the complainant does not file it within one year after becoming aware of the event giving rise to the complaint, but no later than three years after the event allegedly took place. Late complaints must be dismissed. In the present case, only the subjective time limit (within one year of becoming aware) is at issue. The provision of § 24(4) of the DSG limits the time for filing a data protection complaint to one year from the date of becoming aware of the event giving rise to the complaint.The provision of paragraph 24(4) of the DSG limits the time for filing a data protection complaint to one year from the date of becoming aware of the event giving rise to the complaint. On September 28, 2020, the complainant submitted a request for information and received a response to this request in a letter from the co-party dated November 4, 2020. In any case, the complainant became aware of the alleged violation (“incomplete provision of information”). However, as noted in Section 1.4, in a letter dated November 4, 2020, she complained—in a letter dated December 18, 2020—about precisely this incompleteness. The complainant filed the data protection complaint regarding this alleged violation on October 12, 2023. The one-year subjective deadline under § 24(4) of the Data Protection Act (DSG) had therefore already expired, and the filing of the data protection complaint was no longer permissible. The complainant submitted a request for information on September 28, 2020, and received a response to this request in a letter from the co-party dated November 4, 2020. In any case, the complainant became aware of the alleged violation (“incomplete provision of information”). However, as noted in Section 1.4, in a letter dated November 4, 2020, she did in fact complain—as stated in a letter dated December 18, 2020—about this very incompleteness. The complainant filed the data protection complaint regarding this alleged violation on October 12, 2023. The one-year subjective deadline under paragraph 24(4) of the Data Protection Act (DSG) had therefore already expired, and the filing of the data protection complaint was no longer admissible. The same applies to the complainant’s request for information dated December 16, 2021. The complainant received a response to this request in a letter from the co-party dated January 5, 2022, and thereby became aware of the alleged violation of law (“incomplete disclosure of information”). Consequently, the data protection complaint filed on October 12, 2023, against the co-party’s provision of this information was no longer admissible due to the expiration of the one-year deadline set forth in para 24(4) of the DSG. The same applies to the complainant’s request for information dated December 16, 2021. The complainant received a response to this request in a letter from the co-party dated January 5, 2022, and thereby became aware of the alleged violation (“incomplete provision of information”). Consequently, the data protection complaint filed on October 12, 2023, against the provision of this information by the co-party was also no longer admissible due to the expiration of the one-year period specified in paragraph 24(4) of the DSG. Even during the oral complaint hearing, the complainant was unable to provide any information that would have cast doubt on her own knowledge of the information in question. Contrary to the assertion of the complainant, who was represented by legal counsel, there is also no violation of the duty to state reasons under § 60 in conjunction with § 58 of the Administrative Procedure Act (AVG), as it is clearly evident from the Data Protection Authority’s statements in the context of the legal assessment why the data protection complaint of October 12, 2023, had to be dismissed with regard to the alleged violation concerning her requests for information dated September 28, 2020, and November 4, 2020. Substantive comments on the content of the requested information and the content of the response, as sought by the complainant, are not relevant to the question of the admissibility of the complaint filed.Contrary to the assertion of the complainant, who is represented by legal counsel, there is also no violation of the duty to state reasons under Section 60, in conjunction with Section 58, of the Administrative Procedure Act (AVG), since it is clearly evident from the Data Protection Authority’s statements in the context of the legal assessment why the data protection complaint of October 12, 2023, had to be dismissed with respect to the alleged legal violation concerning her requests for information dated September 28, 2020, and November 4, 2020. Substantive comments on the content of the requested information and the content of the response, as sought by the complainant, are not relevant to the question of the admissibility of the complaint filed. The Data Protection Authority correctly ruled that the data protection complaint against the requests for information dated September 28, 2020, and November 4, 2020, was to be dismissed. 3.3. Regarding Issue 2 and the complainant’s requests dated November 12, 2022, and August 22, 2023, the following considerations apply: 3.3.1. In its legal assessment, the Data Protection Authority essentially stated that the complainant had submitted a request for information on November 12, 2022, but had narrowed the scope of that request in a letter dated August 22, 2023, specifically by clarifying her request to the effect that she now demanded “that the authority disclose, within one month, how many and which photographs were taken of her client’s property or of objects or persons located thereon, and on what grounds this documented action was carried out”. Since the complainant had specified and thereby narrowed the underlying request, only the fulfillment of the narrowed request was subsequently to be examined. In this regard, the complainant essentially argued in her complaint that specifying a particular aspect—in this case, relating to the photographic material—did not constitute a limitation of the subject matter of the complaint. 3.3.2. In administrative proceedings that, pursuant to the statutory basis, can be initiated only by a corresponding application from the parties involved, the content of the application determines the subject matter of the proceedings (see Hengstschläger/Leeb, Administrative Procedure Law (2023)7, para. 114). 3.3.2. In administrative proceedings that, pursuant to the statutory basis, can only be initiated by a corresponding application from the parties involved, the content of the application determines the subject matter of the proceedings; see Hengstschläger/Leeb, Administrative Procedure Law (2023)7, para. 114). In cases where proceedings are initiated by application, the application not only obligates the authority to conduct the administrative proceedings, but it is also a prerequisite for the decision and simultaneously establishes the substantive legal basis for the issuance of the administrative decision. Accordingly, the content of such a petition constitutes and delimits the subject matter of the administrative proceedings—that is, the (administrative) “matter” within the meaning of §§ 8, 66(4), and § 68(1) AVG (see Hengstschläger/Leeb, § 13 AVG, para. 3). In cases where the proceedings are initiated by an application, the application not only obligates the authority to conduct the administrative proceedings, but it is also a prerequisite for the decision and simultaneously establishes the substantive legal basis for the issuance of the administrative decision. Accordingly, the content of such an application defines and delimits the subject matter of the administrative proceeding—that is, the (administrative) “matter” within the meaning of Sections 8, 66, paragraph 4, and Section 68, paragraph 1, of the Administrative Procedure Act (AVG); see Hengstschläger/Leeb, Section 13, AVG, para. 3) Determining the content of an application is of decisive importance for the subject matter of the administrative proceeding and thus for the scope of the authority’s obligation to decide; in the case of decisions requiring an application, it is also decisive for the scope of the authority’s decision-making power (see Hengstschläger/Leeb, § 13 AVG, para. 38). Determining the content of an application is of decisive importance for the subject matter of the administrative proceeding and thus for the scope of the authority’s obligation to decide; in the case of decisions requiring an application, it is also decisive for the scope of the authority’s decision-making authority—see Hengtschläger/Leeb, § 13, AVG, para. 38). When determining the legal nature and content of a submission, what matters is not the designation given by the petitioner or incidental verbal formulations, but rather the content of the submission—that is, the discernible and inferable objective (request) of the petitioner. According to the established case law of the Administrative Court, statements made by parties in proceedings must be interpreted exclusively based on their objective meaning. The decision is based on how the statement must be objectively understood, taking into account the specific statutory provision, the purpose of the proceedings, and the record. If, however, the content of a submission is unambiguous, any deviating intentions or motives that were not outwardly expressed are, in principle, irrelevant. In the case of administrative acts requiring a petition, it is impermissible to interpret the party’s request—contrary to the party’s stated intent—in a way that cannot be directly inferred from the wording of the request, even if the request, as submitted, may be futile or even inadmissible from the outset (see Hengstschläger/Leeb, § 13 AVG, para. 38). When determining the legal nature and content of a submission, what matters is not the designation given by the petitioner or incidental verbal forms, but rather the content of the submission—that is, the discernible and inferable objective (request) of the petitioner. According to the established case law of the Administrative Court, statements made by parties in proceedings must be interpreted exclusively based on their objective meaning. The decision is based on how the statement must be objectively understood, taking into account the specific statutory provision, the purpose of the proceedings, and the record. If, however, the content of a submission is unambiguous, any deviating intentions or motives that have not been expressed outwardly are, in principle, irrelevant. In the case of administrative acts requiring a petition, it is impermissible to interpret the party’s request—contrary to the party’s stated intent—in a way that cannot be directly inferred from the wording of the request, even if the request, as submitted, may be futile or even inadmissible from the outset (see Hengstschläger/Leeb, Section 13, AVG, para. 38). In a letter dated November 12, 2022, the complainant explicitly requested information from the co-party based on Article 15 of the GDPR, which the co-party provided in letters dated December 9, 2022 (see findings under 1.8. and 1.9.). In a letter dated November 12, 2022, the complainant explicitly requested, pursuant to article 15, GDPR, and the co-respondent provided this information in letters dated December 9, 2022 (see findings regarding 1.8 and 1.9). In a letter dated August 22, 2023, the complainant—who was then represented by legal counsel—under the heading “Data Processing” and with reference to Article 12(3) of the GDPR, requested that the co-party disclose within one month how many and which photographs had been taken of her property or of objects or persons located thereon, and on what legal grounds this documented action had been carried out (see the finding under 1.10.). No reference was made to the previous response dated December 9, 2022. In a letter dated August 22, 2023, the complainant—who was then represented by legal representatives—under the heading “Data Processing” and with reference to Article 12, paragraph 3, GDPR, requested the party involved to provide, within one month, information on how many and which photographs were taken of her property or of objects or persons located thereon, and on what grounds this documented action was carried out (see the finding under 1.10.). No reference was made to the previous response dated December 9, 2022. Although the respondent authority, in its assessment of these two requests dated November 12, 2022, and August 22,August 2023 is not accepted insofar as, in the view of this panel, the later request dated August 22, 2023, constitutes an independent request [contrary to the wording] for information pursuant to Art. Since this constitutes a violation of Article 15 of the GDPR and does not amount to a mere restriction of the request for information dated November 12, 2022—which is why both pieces of information subsequently provided in this case had to be assessed against the criteria of Article 15 of the GDPR— —notwithstanding this—the present complaint is nevertheless not justified based on the following considerations: Although the respondent authority, in its characterization of these two requests dated November 12, 2022, and August 22,August 2023 is not accepted insofar as, in the view of this panel, the later request dated August 22, 2023 constitutes an independent request [contrary to the wording] for information under Article 15, GDPR—and that it is not merely a restriction of the request for information dated November 12, 2022—which is why, in the present case, both pieces of information subsequently provided had to be assessed against the criteria of Article 15, GDPR—notwithstanding this—the present complaint is nevertheless unfounded for the following reasons: 3.3.3. In substance, Article 15(1) of the GDPR grants the data subject the right to obtain information as to whether personal data concerning them is being processed (negative response) and, if so, what specific data is involved. In the event of data processing, the controller must also provide additional, exhaustively listed information regarding the data processing, specifically the respective processing purposes, the categories of personal data concerned, their recipients (or categories of recipients), if possible—the retention period, the origin of the data where applicable, and whether automated decision-making within the meaning of Article 22 of the GDPR takes place. Finally, the data subject must be informed of their right to rectification, erasure, restriction of processing, or objection, as well as their right to lodge a complaint with the competent supervisory authority. 3.3.3. In substance, article 15(1) of the GDPR grants the data subject the right to be informed as to whether personal data concerning them is being processed (negative response) and, if so, what specific data is involved. In the event of data processing, the controller must also provide additional, exhaustively listed information regarding the data processing, specifically the respective processing purposes, the categories of personal data concerned, their recipients (or categories of recipients), if possible—the retention period, the origin of the data if applicable, and whether automated decision-making within the meaning of Article 22 of the GDPR takes place. Finally, the data subject must be informed of their existing rights to rectification and erasure, restriction of processing, or objection, as well as the right to lodge a complaint with the competent supervisory authority. This essentially ensures—as is particularly evident from Recital 63—that the data subject is not only enabled to be aware of the processing of their data but also to verify its lawfulness. Thus, Article 15(1) of the GDPR limits the right of access to personal data within the meaning of Article 4(1) of the GDPR and to the additional information specifically set forth in para 2 that is related to such data. Since the concept of personal data under Article 4(1) of the GDPR is multifaceted and need not (always) be limited to individual data points (see Recital 63 in this regard with respect to information such as diagnoses, test results, findings by treating physicians, and details regarding treatments and procedures, as well as the CJEU decision of Dec. 20, 2017, C-434/16 regarding a candidate’s written answers in a professional examination and any comments by the examiner on those answers), it may—in accordance with the requirement for transparent information —it may therefore sometimes be necessary or even appropriate in individual cases for the controller to provide individual text passages or even documents pertaining to the data subject. However, a general right to receive documents in which personal data is processed cannot be derived from Article 15 of the GDPR. Thus, article 15(1) of the GDPR limits the right of access to personal data within the meaning of Article 4(1) of the GDPR and to additional information specifically defined in paragraph 2 that is related to such data. Since the concept of personal data under Article 4(1) GDPR is multifaceted and need not (always) be limited to individual data points (see Recital 63 regarding information such as diagnoses, test results, findings by treating physicians, and details on treatments and procedures, as well as the CJEU, December 20, 2017, C-434/16, regarding a candidate’s written answers in a professional examination and any comments by the examiner on those answers), it may—in accordance with the requirement for transparent information —it may therefore sometimes be necessary or even appropriate in individual cases for the controller to provide individual text passages or even documents belonging to the data subject. However, a general right to receive documents in which personal data is processed cannot be derived from article 15 of the GDPR. Article 15(3) of the GDPR also merely stipulates that the controller must provide a copy of the data that is the subject of the processing. Article 15(3) of the GDPR also merely stipulates that the controller must provide a copy of the data being processed. This is merely a modification of the form of notification compared to Art 12 of the GDPR and not—as assumed by the intervening party and ultimately also by the authority being challenged —a separate right to receive a copy, existing in particular alongside the right of access under para 1 of Article 15 of the GDPR. Rather, Article 15(3) of the GDPR stipulates that the right of access under Article 15(1) of the GDPR must be provided by the controller in the form of a copy of the data to the data subject, which is why the data subject is entitled to receive a copy solely in connection with their right of access (see also Paal in Paal-Pauly (eds.), General Data Protection Regulation² on Art. 15, para. 33). This is merely a modification of the form of notification compared to Article 12 of the GDPR and not—as assumed by the intervening party and ultimately also by the authority in question—an independent right to receive a copy, in particular in addition to the right of access under Article 15, paragraph 1, GDPR. Rather, article 15(3) of the GDPR stipulates that the right of access under article 15(1) GDPR must be provided by the controller in the form of a copy of the data subject’s personal data; therefore, the data subject is entitled to receive a copy solely in connection with their right of access (see also Paal in Paal-Pauly (eds.), General Data Protection Regulation² on article 15, para. 33). Whether the right of access is ultimately satisfied by providing a copy of a list of the individual pieces of personal data, or whether the provision of a copy of individual text passages or even individual documents is (additionally) required can, however, only ever be assessed on a case-by-case basis, taking into account the principles set forth in Art 12 of the GDPR, as well as the rights and freedoms of others as set forth in Art 15(4) of the GDPR.Whether the right of access is ultimately satisfied by providing a copy of a list of the individual pieces of personal data, or whether the provision of a copy of individual text passages or even individual documents is (additionally) required, can, however, only ever be assessed on a case-by-case basis, taking into account the principles set forth in Article 12, GDPR, as well as the rights and freedoms of others as set forth in article 15(4) of the GDPR. 3.3.4. The complainant’s data protection complaint expressly refers to the (allegedly deficient) response letter dated August 22, 2023. Any deficiencies in the information provided on December 9, 2022, are in fact only criticized in the underlying data protection complaint to the extent that none of the documents—totaling more than one hundred pages—contained any information regarding investigations by the investigation service concerning the complainant. Furthermore, the information provided to her did not contain any (meta)data regarding the Labor Market Service staff members assigned to her or regarding anonymous tipsters on the basis of whose reports investigations against her had been initiated. As noted (see Section 1.9), in response to her request dated November 12, 2022, the complainant was sent the 351-page document package dated December 9, 2022, which contained detailed information on personal master data, contact information, as well as data on the complainant’s family members, financial circumstances, and income. In addition, she was informed about data regarding registrations with the Public Employment Service, benefit receipt periods, instances of financial assistance, course participation, payment data, employment and insurance data, termination of employment records, and the determination of entitlement. Finally, the notification contained information on the source of the data, any recipients (or categories thereof), the retention period, and a notice regarding further rights to rectification, erasure, restriction, and the right to lodge a complaint with the supervisory authority. Insofar as the information provided contained comprehensive chronological documentation of entries regarding the complainant from the Public Employment Service’s e-services and this documentation —as alleged—proved to be incomplete, it had to be considered that, strictly speaking, this did not constitute information concerning data processing, the disclosure of which is required under Art. Article 15 of the GDPR would be mandatory. While it can be assumed here that transparent information, within the meaning of the above considerations, would in any case appear appropriate, no general right to receive documents can be derived from this; therefore, the complainant’s argument during the oral complaint hearing, that the deficiency (also) lies in the fact that the attachments mentioned in the documentation were not provided or were provided only upon request, does not hold up in this case. Furthermore, Art. 15(3) of the GDPR merely establishes the right to receive a “copy of the personal data that is being processed.” The purposes of the right of access are not thwarted by providing a data subject with mere copies of the personal data contained in documents rather than copies of the documents themselves that contain personal data about the data subject.To the extent that the information provided contained comprehensive chronological documentation of entries regarding the complainant from the Labor Market Service’s e-services and this documentation —if true—proved to be incomplete, it had to be considered that, strictly speaking, this did not constitute information relating to data processing for which disclosure would be mandatory under Article 15 of the GDPR. Although it can be assumed here that transparent information within the meaning of the above considerations would in any case appear appropriate, no general right to receive documents can be derived from this; therefore, the complainant’s argument during the oral complaint hearing, that the deficiency (also) lies in the fact that the attachments mentioned in the documentation were not provided or were provided only upon request, does not hold up in the present case. Furthermore, article 15(3) of the GDPR merely establishes the right to receive a “copy of the personal data undergoing processing.” The purposes of the right of access are not thwarted by providing a data subject with mere copies of the personal data contained in documents rather than copies of the documents themselves that contain personal data about the data subject. Furthermore, if the complainant represents the view that her right of access also includes the right to receive information about employees of the Public Employment Service as well as about persons on whose basis investigative activities against her were initiated, she fails to recognize that the right of access under Art. 15 of the GDPR is limited to one’s own personal data; that is, there is no right to receive or be informed of third parties’ personal data, nor is there a right to information indicating which employees of a controller processed which data and when (see Haidinger in Knyrim, DatKomm Art. 15 GDPR para. 31 (as of July 1, 2024, rdb.at)). If the complainant further maintains the legal view that her right of access also includes the right to receive information about employees of the Public Employment Service as well as about persons on whose basis investigative activities against her were initiated, she fails to recognize that the right of access under Article 15, GDPR is limited to one’s own personal data; that is, there is no right to receive or obtain personal data of third parties, nor is there a right to information indicating which employees of a controller processed which data and when—see Haidinger in Knyrim, DatKomm, Article 15 of the GDPR, Marginal Note 31 (as of July 1, 2024, rdb.at)). Notwithstanding this, it should be noted that the right of access under Article 15 of the GDPR—contrary to the representation initially held by the co-party—is not superseded by the right to inspect files under § 17 of the Administrative Procedure Act (AVG), which is why, in principle, the processing of personal data in the context of sovereign activities—in the absence of relevant provisions to the contrary (see § 84 GOG)—must also be disclosed pursuant to Article 15 of the GDPR. However, in the view of this panel, the information provided on December 9, 2022, is to be regarded as complete in this regard as well; furthermore, no grounds have emerged in the proceedings to suggest that the categories of data to be disclosed in this context within the meaning of Art. 15(1) of the GDPR differ from the information provided in the response dated December 9, 2022, or that they should have been supplemented; nor were any (further) categories claimed. With regard to individual file contents (documents), the above applies, and in this context as well, based on Article 15(3) of the GDPR, there is no right to receive entire documents. As the complainant acknowledged during the oral complaint hearing, she was also granted access to these documents as part of the file inspection pursuant to § 17 AVG. Notwithstanding this, it should be noted that the right to access information under Article 15 of the GDPR—contrary to the legal opinion initially represented by the co-party—is not superseded by the institution of access to files under Section 17, AVG, which is why, in principle, the processing of personal data in the context of sovereign activities—in the absence of relevant provisions to the contrary (see § 84 GOG)—must also be disclosed pursuant to article 15 of the GDPR. However, in the view of this panel, the information provided on December 9, 2022, is to be regarded as complete in this regard as well; furthermore, no grounds have emerged in the proceedings to suggest that the categories of data to be disclosed in this context within the meaning of article 15, paragraph 1, of the GDPR differ from the information provided in the disclosure dated December 9, 2022, or that they would have needed to be supplemented; nor were any (further) categories claimed. With regard to individual file contents (documents), the above applies, and in this context as well, based on article 15, paragraph 3, of the GDPR, there is no right to receive entire documents. As the complainant acknowledged during the oral complaint hearing, she was also granted access to these documents as part of the file inspection pursuant to Section 17 of the Administrative Procedure Act (AVG). 3.3.5. The complainant’s request dated August 22, 2023, which related to and was limited to data processing in connection with photographs taken, as well as information regarding their number, the area in which they were taken, and the justification therefor, was—as is evident from the findings —what was answered to the extent that various photographs were transmitted via email and, in the letter dated September 28, 2023, the relevant conditions under which they were taken and the legal bases were communicated (see findings under 1.11.). With regard to the complainant’s argument justifying the alleged incompleteness—namely, that additional photographs exist, the Data Protection Authority is correct in stating that an argument based on (unspecified) conjectures amounts to an inadmissible request for exploratory evidence, which the Data Protection Authority is not obligated to consider. With regard to the timing of when the respective photos were taken, the Data Protection Authority states that the co-party has already provided information that the photos were taken on August 25, 2022, and that the right of access does not include an obligation to provide any kind of report in addition to that. Given that it could neither be substantively alleged nor established by the adjudicating panel that, in addition to the images disclosed, further photographs of the complainant had been processed, the response to the request for information was not deficient in this regard either. In this regard, it must be considered that, based on the wording in Art. 15(1) (“are being processed”), it must be concluded that the substantive obligation to provide information is triggered when the controller is currently processing data (i.e., at least storing it), but not if the controller has processed the data subject’s data in the past and that data has since been deleted (see Haidinger in Knyrim, Dat-Komm Art. 15 GDPR [July 1, 2024, rdb.at], para. 27).In this regard, it must be considered that, based on the wording of Article 15, paragraph 1 (“are being processed”), it follows that the substantive obligation to provide information is triggered when the controller is currently processing data (i.e., at least storing it), but not if the controller has processed the data subject’s data in the past and that data has since been deleted (see Haidinger in Knyrim, Dat-Komm article 15, GDPR [July 1, 2024, rdb.at], para. 27). The burden of proof that the controller is currently processing the data subject’s data rests with the data subject. Similarly, in the complaint procedure, the data subject must specifically demonstrate why the information provided is incomplete. A mere blanket assertion or mere assumptions in this regard are insufficient (see Haidinger in Knyrim, Dat-Komm Art. 15 GDPR [July 1, 2024, rdb.at], para. 28/1). The burden of proof that the controller is processing the data subject’s data at all lies with the data subject. Likewise, in the complaint procedure, the data subject must specifically state why the information provided is incomplete. A mere blanket assertion or mere speculation in this regard is insufficient (see Haidinger in Knyrim, Dat-Komm article 15, GDPR [July 1, 2024, rdb.at], para. 28/1). A general argument consisting of mere conjecture generally amounts to inadmissible exploratory evidence, which the Administrative Court is not obligated to consider (see VwGH Jan. 3, 2018, Ra 2017/11/0207, para. 21).A general argument consisting of mere speculation generally amounts to inadmissible evidence sought through inquiry, which the Administrative Court is not obligated to admit—see VwGH Jan. 3, 2018, Ra 2017/11/0207, para. 21). As already considered in the evaluation of the evidence, the complainant has not succeeded in convincing the adjudicating panel with sufficient certainty that, in addition to the photographs submitted, further photographs were taken and were still stored at the time the information was provided. 3.3.6. Insofar as the complainant assumes that, in the context of a request for access under Article 15 of the GDPR, it would not be sufficient to provide PDF copies of the photographs in question because these would not include the respective metadata of the photographs (date taken, time taken, location taken, device used, focal length, shutter speed, and lighting conditions) would not be included, we refer to the above and to the fact that, pursuant to Article 15 of the GDPR, there is only a right to receive information concerning data processing as exhaustively listed therein, and the requested information is not covered by this provision. 3.3.6. Insofar as the complainant assumes that, within the scope of a request for information pursuant to Article 15 of the GDPR, it would not be sufficient to provide PDF copies of the photographs in question because they do not contain the respective metadata of the photographs (date taken, time taken, location taken, camera used, focal length, shutter speed, and lighting conditions) would not be included, reference is made to the above and to the fact that, pursuant to article 15 of the GDPR, there is merely a right to receive the information concerning data processing exhaustively listed therein, and the requested information is not included in this list. Against this background, it was also possible in the present case to refrain from obtaining the requested expert opinion in the field of information technology with a specialization in digital photography. 3.4. Conclusion: In light of these considerations, the adjudicating panel could not find a violation of the complainant’s right of access under Article 15 of the GDPR, and the decision was rendered accordingly. In light of these considerations, the adjudicating panel could not find a violation of the complainant’s right to access information under article 15 of the GDPR, and the decision was rendered accordingly. Re B) Inadmissibility of the Appeal: The appeal is inadmissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG) because the decision does not depend on the resolution of a legal issue of fundamental importance. Neither does the decision at issue deviate from the Administrative Court’s previous case law, nor is there a lack of case law; furthermore, the Administrative Court’s existing case law cannot be deemed inconsistent. Nor are there any other indications that the legal issue at hand is of fundamental importance. The appeal is not admissible pursuant to article 133, paragraph 4, of the Federal Constitutional Law (B-VG) because the decision does not depend on the resolution of a legal issue of fundamental importance. The decision at hand neither deviates from the Administrative Court’s existing case law nor is there a lack of case law on the matter; furthermore, the Administrative Court’s existing case law on this issue cannot be considered inconsistent. Nor are there any other indications that the legal issue to be resolved is of fundamental importance. The Federal Administrative Court may rely on the established case law of the Administrative Court or on a legal situation that is already clear with respect to all relevant legal issues.

---
Generated by overview.legal · https://overview.legal/posts/353784 · 2026-09-09