Representation of data subjects
According to § 28 DSG, an data subject has the right to commission an institution, organisation or non-profit association, which is duly established and whose statutory objectives are in the public interest, to lodge a complaint with the data protection authority and the right receive compensation on his or her behalf.
Austrian legislators did not make use of the option in Article 80 (2) of the GDPR for organisations to intervene without a specific mandate from the data subject.
Right to lodge a complaint with the supervisory authority
Section 24 DSG contains the requirements and content of a complaint to the supervisory authority.
Each data subject has the right to lodge a complaint with the data protection authority if the data subject is of the opinion that the processing of his/her personal data violates the GDPR or § 1 DSG or §§ 7-13 DSG.
The DSB has provided forms on its website to lodge a complaint against controllers in accordance with the GDPR as well as against controllers in accordance with the third main section of the DSG (the security police, prosecution, carrying out sentences, military, state protection).
The forms are available (in German) at the following link:
https://www.dsb.gv.at/dokumente
Rights of legal persons
Unlike the GDPR, § 1 DSG still protects legal entities in Austria.
Legal persons in non-international cases may exercise the following rights:
- Confidentiality
- Access
- Rectification
- Erasure
Limited right to erasure
- 4 para. 2 of the DSG deems immediate erasure to be unnecessary if, for economic or technical reasons, this can only be carried out at certain times.
In this case, the processing of the relevant personal data is to be restricted until that date in accordance with Art. 18 (2) GDPR.
Right to rectification/erasure and limitation of processing for security police purposes
§ 45 DSG contains separate regulations on the right to rectification/erasure and processing restriction for security police purposes.
