The GDPR grants data subjects strong rights. This includes the right to lodge a complaint with the data protection authority (DPA). At the same time, this right to lodge a complaint must not be abused. The Austrian Administrative Court (VwGH) has addressed the question of when a complaint can be considered excessive or abusive.
The complainants filed a complaint with the Data Protection Authority (DSB) and sought a declaration that their right to confidentiality under Section 1 of the DSB had been violated by a billing company. They alleged that this company had unlawfully used their data (in particular their name and address) for approximately 15 years without legal basis or consent in order to inflate consumption figures for heating, hot and cold water to many times the actual measured consumption and to intentionally issue false invoices.
The Data Protection Authority (DSB) rejected the complaint by means of a formal decision. The complainants had jointly filed 19 complaints regarding individual billing statements over a period of 50 months, 18 of which had already been concluded by the DSB. Given that an unsuccessful conciliation procedure followed by civil proceedings through two instances had already taken place, and that the Heating and Cost Billing Act (HeizKG) provides sufficient legal protection for objections to individual billing statements, the DSB considered attempting to achieve the same objective under data protection law to be a circumvention of the HeizKG. The purpose of data protection law is not to correct unwanted bills. According to the DSB, the complaint should be classified as an abuse of the DSB's services.
The Administrative Court upheld the appeal against this decision, set aside the contested decision without substitution, and instructed the Data Protection Authority (DPA) to continue the proceedings, abandoning the grounds for rejection it had used. However, the substantive requirements for determining whether the appeal was indeed "manifestly unfounded" or "excessive" within the meaning of Article 57(4) GDPR, and whether the DPA had made sufficient factual findings regarding the intent to misuse the data, remained unclear. The DPA subsequently filed an extraordinary appeal on points of law with the Administrative Court of Appeal, which re-examined these questions on substantive legal grounds.
In its decision, the Austrian Administrative Court (VwGH) emphasizes that Article 57(4) GDPR can only apply if the complaint is manifestly unfounded, excessive, or an abuse of process. A complaint is not considered abusive simply because it fails or the complainants repeatedly appear before the Data Protection Authority (DSB). Abuse can only be assumed if the complainants pursue objectives that clearly lie outside the scope of protection of the GDPR (such as solely correcting invoices or reducing costs), and if, after multiple unsuccessful proceedings, they realize that their legal position is unenforceable. At the same time, the VwGH identified deficiencies in the Administrative Court's assessment of the facts, as it had failed to adequately consider either the "manifest unfoundedness" or all circumstances relevant to the excessiveness and intent to abuse the process, as required by Section 42(2)(1) of the Administrative Court Act (VwGG). The contested decision was overturned due to its illegality.
The decision clarifies for practical purposes: Data subjects generally retain the right to lodge complaints with the data protection authority, provided they concern genuine data protection infringements. However, the data protection authority may reject complaints as excessive or abusive under Article 57(4) GDPR if it is apparent that the complainants are not primarily seeking to address a data protection issue, but rather to pursue a different legal objective through data protection channels. Companies can refer to the decision of the Austrian Administrative Court (VwGH) in such proceedings, but should always remain objective and clearly document their arguments, even in cases of complaints that appear to be vexatious.
VwGH 21.08.2025, Ra 2025/04/0147