In a case against a well-known financial institution already conducted in 2018, the data protection authority ruled that the charging of account statements that can no longer be accessed electronically is inadmissible in the case of a request for information under data protection law.
In the underlying case, the financial institution had made the issuance of account statements subject to fees. The request for information pursuant to the then Section 26 of the Austrian Data Protection Act 2000 was not answered in terms of content. The proceedings subsequently went beyond May 25, 2018, and had to be decided under the new legal situation. The data protection authority recognized that the subsidiarity of the right to information under data protection law, which is inherent in the Data Protection Act 2000, is not also reflected in Article 15 of the GDPR and must therefore be granted free of charge. The financial institution invoked the lawfulness of the fees under the ZaDiG 2018, as it contains special standards under data protection law. This was not followed by the data protection authority.
The Federal Administrative Court confirmed the decision of the data protection authority with the proviso that the provisions cited by the financial institution do not contain any standards that are more specific to the right to information under Article 15 of the GDPR, but are similar to the information obligations under Articles 13 and 14 of the GDPR. The ordinary appeal was declared admissible due to the lack of case law on this issue.