The Federal Administrative Court (BVwG), in its decision of August 3, 2023, Case No. W101 2258430-1/33E, partially upheld the decision of the Austrian data protection authority (DSB) regarding the right of access, right of privacy, and the right to request the appointment of a data protection officer (DPO) of the complainant under the General Data Protection Regulation (GDPR).

Background to the case

In particular, the BVwG noted that according to the complainant, their right of access was violated by the respondent, an unnamed university. The BVwG noted that the university had forwarded an email concerning an alleged breach of the complainant's official duties to several departments. Additionally, when the complainant requested access to their data, they received a document with more than 800 pages that did not have any reference to them. Furthermore, the BVwG stated that according to the complainant, the access request should have been answered by a DPO and not by the university's dean.

Findings of the BVwG

The BVwG determined that the university violated the complainant's right to confidentiality by sending the abovementioned email and a letter that was disclosed to other people.

Further, regarding the review of the appointment of a DPO, the BVwG stated that, although the appointment of a DPO represents an obligation of the data controller, it does not at the same time entail a data subject's right to request the appointment of a DPO.

Outcomes

In light of the above, the BVwG partially upheld the complaint and dismissed the appeal. 

You can read the judgment, only available in German, here.