Data Protection Authority: Right to Dismiss Excessive Requests?

Jun 20, 2025 Benn-Ibler Rechtsanwälte

The Austrian Administrative Court (Verwaltungsgerichtshof, hereinafter VwGH) dealt with the question of when the Austrian Data Protection Authority (Datenschutzbehörde, hereinafter DSB) may reject requests in accordance with Article 57 (4) of the General Data Protection Regulation (GDPR). In the case at hand, the DSB had rejected a request due to over 60 previous complaints from the data subject, stating that there had been ‘an excessive number of requests’. The VwGH deemed this argument to be insufficient and emphasized that the DPSB needed to prove the complainant’s intent to abuse. A large number of complaints alone is not sufficient.

Data protection authority refused to deal with requests

In the case at hand, the DSB had rejected a request based on Article 57 (4), justifying this with over 60 complaints that the complaining party had previously submitted to the DSB. According to subsection 4, the DSB may refuse to act on a request ‘when requests are manifestly unfounded or excessive, in particular because of their repetitive character’.

Local Administrative Court: More than 60 requests are insufficient to prove excessiveness

However, the local administrative court (Verwaltungsgericht, hereinafter VwG), to which the case was referred, did not consider this reasoning sufficient. The DSB’s refusal to handle a data protection complaint pursuant to Art. 57(4) of the GDPR requires the DSB to demonstrate that the complaining party had acted in bad faith. A large number of requests alone is not sufficient to justify excessiveness. Frequent exercise of rights under the GDPR must not lead to a restriction of rights for potentially affected parties. However, rhe DSB lodged an extraordinary appeal against this ruling.

VwGH: The local administrative court did not make its own findings

In this case, the again ruled that the local administrative court would have been obliged to establish the facts relevant to the examination of the legality of the rejection of the data protection complaint. As it only limited itself to settling the legal question of excessiveness without making its own findings, the VwGH overturned the decision of the local administrative court.

Nevertheless, the VwGH agreed that more than 60 requests alone do not constitute an excessive exercise of the right to complain. Therefore, the data protection authority must prove an intent to abuse on the part of the complaining party. Such an intention can be assumed if the complaining party has not raised its large number of data protection complaints to protect its rights under the GDPR, but for other, extraneous motives.

VwGH Ra 2022/04/0143 (31.03.2025)