BVwG - W292 2342582-1/13E
Austrian court rules DPA can refuse complaints from associations profiting from data subject requests.
The Austrian Supreme Administrative Court (VwGH) ruled that a Data Protection Authority (DPA) can refuse to act on a complaint filed by an association on behalf of a data subject. This is permissible when the association's business model involves financially profiting from favorable court decisions related to data protection violations, and the data subject shows no genuine interest in the request for data protection reasons.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GDPR?
Get an email when a new story names GDPR, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Austrian Administrative Court ruled that data protection complaints filed by associations acting in bad faith — specifically those financially motivated by favorable rulings rather than genuine privacy protection — can be lawfully dismissed by supervisory authorities. This case highlights a growing concern around the weaponization of GDPR complaint mechanisms for commercial gain rather than individual rights protection. It matters because it sets a precedent that undermines the credibility of legitimate data subject rights advocacy and burdens regulatory bodies with frivolous or commercially motivated filings. Organizations and individuals must understand that GDPR enforcement mechanisms are intended to protect genuine privacy interests, not serve as revenue streams.