Supplementary data copy in DPA proceedings: identify the open parts of the request

When a controller provides documents only after a data protection complaint has been filed, the proceedings are not automatically over. The data subject must compare the supplementary data copy with the original request and the earlier response. The key question is which specific parts of the request have actually been answered and which remain open.

Section 24(6) of the Austrian Data Protection Act governs how a later remedy is treated in proceedings before the Austrian Data Protection Authority. This article explains how to respond to a notice asking whether the complaint has become devoid of purpose. It does not address the first access request or a civil damages claim.

Until proceedings before the Data Protection Authority are concluded, the respondent may remedy the alleged infringement by complying with the complainant's requests. If the authority considers the complaint devoid of purpose as a result, it must hear the complainant on that point.

The authority also points out that it will close the proceedings informally if the complainant does not explain within a reasonable period why the originally alleged infringement has at least partly not been remedied. The statement must therefore start with the original request. General dissatisfaction with the format of the delivery is not enough, and neither is a blanket confirmation.

Section 24(6) does not set one fixed response period for every such hearing. The relevant information is in the specific notice and any deadline stated there. Under the statutory rule, late statements are not taken into account.

Start with the version that was the subject of the complaint. Mark each requested data area, each requested piece of supplementary information and each explanation that the controller was expected to provide. Then match each item to the earlier response and the supplementary delivery.

Under section 24(3) of the Austrian Data Protection Act, the underlying request and any response from the respondent are to be attached to a complaint where appropriate. These documents show which issue was originally before the authority. A later delivery cannot be assessed in isolation from that procedural material.

Keep the date and delivery method of the supplementary documents. If several files were delivered, record when each version arrived and whether the transfer itself was complete and readable. This makes clear what the authority and the other party can actually assess.

First check whether the supplementary data cover the original period and the processing activities concerned. A single export may fall short if, for example, the customer account, email communication, support system and archive are kept separately. The specific scope of the complaint remains the reference point.

Keep the data copy separate from the additional information about the processing. Article 15 GDPR may require information on purposes, categories, recipients, storage period, source and automated decision-making in addition to the personal data. A data file therefore does not automatically answer every outstanding information point.

Describe technical or formal problems precisely. Examples include files that do not open, unreadable tables, missing periods or an export containing headings without the related content. The more specifically the defect is described, the easier it is for the authority to classify the open issue.

A useful statement links every open point to the original request. State, for example, which period is missing, which data category is absent, which information on recipients or storage period was not answered, or which file does not present the data in a readable form.

Distinguish between missing data, missing explanations and a dispute about the accuracy of data. These classifications lead to different next steps. Saying only that the access response is incomplete leaves unclear what remedy is being requested.

Finally describe what action is still expected. It may be a supplementary copy, an answer to a specific Article 15 point or a comprehensible explanation of the search scope. A new demand that is materially different from the original matter may change the nature of the case and therefore needs separate consideration.

Read the notice for the stated deadline and the required form of the response. Attach the relevant documents in an orderly way and refer to specific pages, files or passages. The authority should be able to see which part of the original request remains open without reconstructing the case itself.

A short chronology helps: receipt of the original request, earlier response, filing of the complaint, supplementary delivery and the current notice. Add the relevant communication between the parties. This shows whether the delivery actually remedied the alleged infringement.

If documents are missing or the supplementary delivery cannot be evaluated, say so before the deadline and explain why. Do not assume that a later addition will necessarily be considered. The statute excludes late statements from consideration.

The Data Protection Authority decides whether the complaint has become devoid of purpose after hearing the complainant. The data subject may state that the original request has been fully satisfied or explain why the infringement continues at least in part.

If the statement changes the nature of the matter, section 24(6) treats the original complaint as withdrawn and a new complaint as filed at the same time. The original proceedings are then closed informally. This does not mean that every additional explanation automatically creates a new subject matter. The question is whether the matter has changed in its essence.

Keep new concerns separate from the open original request. An additional period or a processing operation that arose later may require its own assessment. Calling something an amendment does not decide its legal classification by itself.

The situation described here begins after a data protection complaint and a hearing on whether the complaint has become devoid of purpose. It does not replace the handling of a first Article 15 GDPR access request. The separate overview of access requests covers identity checks, deadlines, searches and data copies.

A data incident is another legal trigger. If a data copy is sent to the wrong person or information reaches an unauthorised recipient, the relevant security and notification assessment applies. The distinction from an email sent to the wrong recipient helps classify that situation.

Damages, rectification, erasure and restriction may raise separate claims or procedural questions. They should not be mixed into the question whether the original access request was satisfied by the supplementary delivery.

Is the complaint automatically over once documents are supplied? No. The Data Protection Authority hears the complainant on whether the complaint has become devoid of purpose. The complainant may identify which parts of the original request remain open.

Is there always one fixed deadline for the statement? Section 24(6) refers to a reasonable period, but it does not set one number of days for every case. The specific notice from the authority is decisive. Late statements are not taken into account.

Is it enough to say that the file is incomplete? The data subject should identify the missing file, period, data category or additional information. This makes clear what remedy is still requested.

Does every addition automatically become a new complaint? No. That consequence requires the nature of the matter to have changed. The answer depends on the original subject matter and the content of the statement.

The original request, earlier communication, supplementary delivery and notice from the Data Protection Authority must be assessed together. We identify the open parts of the request, the alleged infringement and the evidence needed for the statement. Send the documents with the stated deadline so that the next step can be determined on a sound basis.