Status: Proceedings before the Austrian Data Protection Authority
Initial event: May 2026
Relevant GDPR provisions: Articles 12 and 15 GDPR
Main issue: An unsolicited invitation to speak at an international AI conference was sent to my professional email address. My subsequent request to establish the source and processing of my personal data was not answered within the statutory period.
- An unsolicited invitation to speak
In May 2026, I received an unsolicited email at my professional email address inviting me to participate as a speaker at an international conference on artificial intelligence and machine learning scheduled to take place in Barcelona in March 2027.
The invitation described the conference as bringing together researchers, academics and industry professionals and stated that my expertise would be a valuable addition to the event. It also offered a discounted registration and requested, upon confirmation, a short biography, professional designation and recent photograph. The preserved original email links the invitation to the conference organiser’s website.
I had not contacted the organiser for this purpose, and the email did not explain to me how my professional contact details had been obtained.
For me, the important question was therefore not the conference invitation itself, but:
Where did the organiser obtain my personal data?
- My Article 15 GDPR request
On 7 May 2026, I exercised my right of access under Article 15 GDPR.
I asked for information concerning the personal data stored about me, the source from which the data had been obtained, whether they had been acquired from a third-party provider, whether they had been shared with other entities, the applicable retention period and any available technical metadata associated with my profile.
I also asked for the legal basis relied upon for processing my personal data for marketing purposes.
The request was therefore intended to establish both what information the organisation held about me and how that information had entered its systems.
- No response within one month
According to my subsequent complaint, I received no response to my access request within the statutory one month period.
I also received no notification that the response period had been extended.
As a result, I remained unable to establish the source of my personal data, whether the data had been obtained from a third party, the legal basis relied upon for processing them, or whether they had been disclosed to other recipients. These were the issues I subsequently placed before the Austrian Data Protection Authority.
- Complaint to the Austrian Data Protection Authority
On 8 June 2026, I submitted a complaint to the Austrian Data Protection Authority concerning the alleged infringement of my right of access under Article 15 GDPR.
The purpose of the complaint was straightforward.
I was not asking the DSB to infer where the organiser had obtained my information.
I was asking for enforcement of my right to receive the information available from the organisation that had actually processed my data.
- Clarifying the correct respondent
An additional procedural issue subsequently arose.
The original conference email had been signed by an individual associated with the conference. In my initial filing, that person’s name therefore appeared as the respondent.
Following a request for clarification from the DSB, I explained that my complaint was not directed against that individual personally.
I clarified that the intended respondent was the conference organisation operating the relevant website and, according to my understanding, responsible for the processing associated with the marketing communication.
I also explained that the organisation’s own privacy information described the collection and processing of personal data, including their use for marketing purposes.
The complaint continued on that clarified basis.
This procedural step is worth documenting because it illustrates a recurring difficulty for recipients of unsolicited communications: identifying the legal or organisational entity actually responsible for the processing is not always obvious from the email itself.
- The DSB opened proceedings against the organisation
The case subsequently progressed.
Under reference D135.706, the Austrian Data Protection Authority treated the matter as an Article 15 complaint against the conference organisation.
On 10 September 2026, the DSB issued a formal Aufforderung zur Stellungnahme; a request for the respondent to provide its position on the complaint.
The DSB expressly recorded that the complaint concerned an alleged infringement of my right of access under Article 15 GDPR.
There was also an important jurisdictional aspect.
The DSB stated, as its non-prejudicial legal view, that the processing at issue falls within the territorial scope of the GDPR pursuant to Article 3(2).
This is significant because the case involves an organisation connected with an international conference rather than an ordinary Austrian domestic business.
It does not prejudge the ultimate outcome of the complaint, but it means that the DSB has provisionally considered the GDPR applicable to the processing at issue.
- The organisation was given two weeks to respond
The DSB required the respondent to submit a statement concerning my complaint within two weeks of receiving the authority’s letter.
The respondent was also invited to provide appropriate evidence supporting its position.
Importantly, the DSB expressly reminded the respondent of its duty to cooperate under Article 31 in conjunction with Article 58(1)(a) and (e) GDPR and stated that the authority must be provided with the information necessary for the performance of its tasks.
This moves the matter beyond my own unanswered correspondence with the organisation.
The question is now being addressed within a formal supervisory-authority proceeding.
- The company can still remedy the alleged infringement
The DSB also informed the respondent of an important feature of Austrian data-protection procedure.
Under § 24(6) DSG, the alleged infringement may still be remedied during the proceedings by complying with my Article 15 request.
If the respondent subsequently provides the requested access, the information is to be provided directly to me, with a copy supplied to the DSB as part of the respondent’s statement.
In practical terms, this means that the proceedings do not prevent the organisation from answering my original request now.
What remains to be seen is whether it does so and, if it does, what the response reveals about the provenance and processing of my professional contact information.
- The DSB also referred to possible fines
The DSB additionally informed the respondent that an infringement of data-subject rights under Articles 12–22 GDPR falls within Article 83(5)(b) GDPR and that a fine may be imposed.
This statement should not be misunderstood.
It does not mean that the DSB has already determined that an infringement occurred, nor does it mean that a fine will necessarily be imposed.
The proceedings are still ongoing.
It does, however, make clear that compliance with data-subject rights such as Article 15 is an enforceable legal obligation rather than an informal customer-service matter.
- What remains unresolved
The central factual questions remain the same as they were when I sent my original request:
- What personal data concerning me does the organisation process?
- Where did it obtain my professional contact information?
- Was the information obtained from a publicly available source, a third-party data provider, a conference or academic database, or another source?
- What legal basis was relied upon for using the data for this communication?
- Were my personal data disclosed to other organisations?
- How long are the data retained?
- What technical or provenance information concerning my record remains available?
At present, I do not know the answers.
That is precisely why I exercised my right of access.
- What the case does establish
The documentary record establishes that I received the unsolicited conference invitation, submitted an Article 15 request, subsequently complained that no response had been received within one month, and brought the matter before the Austrian DSB.
It also establishes that the DSB has now formally transmitted the complaint to the respondent, provisionally considered the processing to fall within the territorial scope of the GDPR, and required the respondent to provide a statement.
What it does not yet establish is where my data originally came from, why I was selected as a recipient, whether another organisation supplied the data, or whether the DSB will ultimately find an infringement.
Those questions remain open.
- Why I am documenting this case
This case began with something that can easily appear trivial: an unsolicited invitation to speak at a conference.
But unsolicited professional communication can reveal a broader data-provenance question.
When an organisation knows a person’s name, professional role and contact address sufficiently well to target that person with a specialised invitation, the recipient may reasonably want to understand where that information came from and how it is being processed.
That is one of the purposes of the GDPR right of access.
For me, the central question in this case remains very simple:
How did my personal data enter the organisation’s systems?
I asked the organisation directly.
When I did not receive the requested information within the applicable period, I brought the matter before the Austrian Data Protection Authority.
The DSB has now formally requested the organisation’s position and reminded it of its obligation to cooperate.
The proceedings remain ongoing.
Note
This case report documents my own experience and the procedural steps reflected in my correspondence and filings before the Austrian Data Protection Authority.