DSB (Austria) - DSB-D124.0531/24
Austrian DPA fines controller for deleting data during access request.
The Austrian Data Protection Authority (DSB) ruled that a controller violated a data subject's right of access under GDPR by deleting project data during an ongoing information request. While the deletion of a questionnaire before the first request was deemed lawful, the subsequent deletion of project data made it impossible for the DSB to investigate the access right violation. The controller was held responsible for the processor's actions, emphasizing the controller's duty to ensure data subjects can exercise their rights.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DSB?
Get an email when a new story names DSB, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Austrian DSB found that a controller breached GDPR Article 15 rights by allowing project data to be deleted while an active data subject access request (DSAR) was in progress. This effectively obstructed the regulatory investigation and prevented the data subject from exercising their lawful rights. Critically, the controller was held accountable for the processor's deletion actions, reinforcing that controllers cannot delegate away their GDPR obligations. This case highlights how data retention decisions made during live requests can constitute a compliance violation even if the original deletion policy was otherwise lawful. Organizations must implement legal holds and clear DSAR workflows that span both controllers and their processors.