Xz:
|Jurisdiction=Austria
|DPA-BG-Color=
|DPAlogo=LogoAT.png
|DPA_Abbrevation=DSB
|DPA_With_Country=DSB (Austria)
|Case_Number_Name=2025-0.620.443
|ECLI=ECLI:AT:DSB:2025:2025.0.620.443
|Original_Source_Name_1=RIS
|Original_Source_Link_1=https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597
|Original_Source_Language_1=German
|Original_Source_Language__Code_1=DE
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=
|Type=Complaint
|Outcome=Rejected
|Date_Started=03.08.2025
|Date_Decided=08.10.2025
|Date_Published=22.12.2025
|Year=2025
|Fine=
|Currency=
|GDPR_Article_1=
|GDPR_Article_Link_1=
|GDPR_Article_2=
|GDPR_Article_Link_2=
|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=
|National_Law_Name_1=§1 DSG
|National_Law_Link_1=https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597
|National_Law_Name_2=
|National_Law_Link_2=
|National_Law_Name_3=
|National_Law_Link_3=
|Party_Name_1=
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=
|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=
|Appeal_To_Link=
|Initial_Contributor=
|
}}
The DPA held that a legal person does not have standing to bring a complaint under the GDPR, because the regulation is designed to protect only natural persons. Legal persons may, however, assert certain rights under national data protection law.
== English Summary ==
=== Facts ===
A limited liability company filed a complaint on 3 August 2025 with the Austrian Data Protection Authority (DSB) against a medical center (the controller) alleging that linking the company’s telephone extension with the name of the managing director violated GDPR rights.
The complaint was lodged by the managing director, in the name of the company, meaning a legal person, not a natural person, while GDPR primarily protects natural persons in relation to personal data.
=== Holding ===
The DSB did not examine whether this data processing was lawful. Instead, the DSB rejected the complaint, holding that the company, acting as data subject, does not have standing under GDPR, because it is a legal person and GDPR rights apply only to natural persons. The DSB clarified that the company is protected under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597 §1 DSG] only, not GDPR.
Austrian law under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597 §1 DSG] allows some protection for legal persons, but GDPR explicitly limits rights to natural persons, with only narrow exceptions recognized by case law when personal data of a natural person appears in connection with the company, but the complaint was expressly based on the GDPR and not on that national provision. The managing director, as a natural person, retains the right to file a separate complaint if she believes her personal data rights were violated.
== Comment ==
”Share your comments here!”
== Further Resources ==
”Share blogs or news articles here!”
== English Machine Translation of the Decision ==
The decision below is a machine translation of the German original. Please refer to the German original for more details.
<pre>
</pre>