View source for VfGH - G 287/2022-16, G 288/2022-14

{{COURTdecisionBOX

|Jurisdiction=Austria
|Court-BG-Color=
|Courtlogo=Courts_logo1.png
|Court_Abbrevation=VfGH
|Court_Original_Name=Verfassungsgerichtshof
|Court_English_Name=Austrian Constitutional Court
|Court_With_Country=VfGH (Austria)

|Case_Number_Name=G 287/2022-16, G 288/2022-14
|ECLI=

|Original_Source_Name_1=Verfassungsgerichtshof Österreich
|Original_Source_Link_1=https://www.vfgh.gv.at/downloads/VfGH-Erkenntnis_G_287_2022-_G_288_2022_vom_14._Dezember_2022.pdf
|Original_Source_Language_1=German
|Original_Source_Language__Code_1=DE
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=

|Date_Decided=14.12.2022
|Date_Published=09.01.2023
|Year=2022

|GDPR_Article_1=Article 85 GDPR
|GDPR_Article_Link_1=Article 85 GDPR
|GDPR_Article_2=
|GDPR_Article_Link_2=
|GDPR_Article_3=
|GDPR_Article_Link_3=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=§ 1(1) DSG
|National_Law_Link_1=https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597
|National_Law_Name_2=§ 1(2) DSG
|National_Law_Link_2=https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597
|National_Law_Name_3=§ 9(1) DSG
|National_Law_Link_3=https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597
|National_Law_Name_4=
|National_Law_Link_4=
|National_Law_Name_5=
|National_Law_Link_5=

|Party_Name_1=
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=

|Appeal_From_Body=BVwG (Austria)
|Appeal_From_Case_Number_Name=G 287/2022 and G 288/2022
|Appeal_From_Status=
|Appeal_From_Link=
|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=Unknown
|Appeal_To_Link=

|Initial_Contributor=
|
}}

The Austrian Constitutional Court held that § 9(1) Austrian Data Protection Act (DSG), which provides a blanket data protection exemption for a broad category of media actors, is not required by [[Article 85 GDPR]] and unconstitutional pursuant to § 1 DSG, the Austrian constitutional right to privacy and secrecy.

== English Summary ==

=== Facts ===
Prompted by two complaints again decisions of the Austrian DPA, which were brought in before it, the Austrian Federal Administrative Court questioned the constitutionality of § 9(1) Austrian Data Protection Law (DSG) and sent an application to the Austrian Constitutional Court for the assessment of the constitutionality of § 9(1) DSG.  

Besides through the GDPR, and in contrast to the majority of other EU member states,  data protection in Austria is also covered by the constitutional right to data protection and secrecy pursuant to § 1 DSG. This stood in contrast with § 9(1) DSG, which provided a blanket data protection exemption for a broad category of media actors. 

The first complaint, which the Federal Administrative Court took note of, was the case G 287/2022, which concerned an alleged data protection breach of a media company. The company had published a report and images of a house search, including unredacted pictures of a data subject's business card. The DPA rejected the complaint, arguing that considering the "media privilege" pursuant to § 9(1) DSG, it was not competent to handle the complaint.

In complaint number two, concerning case G 288/2022, data subjects argued that a publishing company and a broadcasting company had unlawfully disclosed a "data leak" at an e-mail box attributable to the data subjects. Similar to the complaint mentioned above, the DPA deemed itself not competent pursuant to § 9(1) DSG.

The data subjects in both cases appealed to the Federal Administrative Court which further sent an application to the Constitutional Court for the assessment of the constitutionality of § 9(1) DSG.

=== Holding ===
The Austrian Constitutional Court sided with the data subjects and held that the "blanket" exemption, which § 9(1) Data Protection Act gives to media owners and journalists, is unconstitutional and not in line with the requirements of [[Article 85 GDPR|Article 85 GDPR]].

§ 9(1) DSG provides - in implementation of the obligation under EU law pursuant to [[Article 85 GDPR|Article 85(1) GDPR]] - that the provisions of the DSG (and several chapters of the GDPR) do not apply to the processing of personal data by media owners, publishers, media staff and employees of a media company or media service within the meaning of the Austrian Media Act for journalistic purposes of the media company or media service.

In its assessment, the Constitutional Court first noted that the legislator is subject to a double binding, namely a binding to Union law (in this case the opening clause of [[Article 85 GDPR]]) and a binding to the framework established by constitutional law.

The relevant provision of Union law, [[Article 85 GDPR|Article 85 GDPR]], only states that Member State should provide for "derogations or exemptions" to the GDPR for the processing of personal data for journalistic purposes "to the extent necessary to reconcile the right to the protection of personal data with the freedom of expression and information." 

Therefore, the Court held that Union law does not require the Austrian legislator to enact a provision according to which any data processing of media owners, publishers, media staff and employees of a media enterprise or media service within the meaning of the Media Act is completely exempted from the DSG and the GDPR. On the contrary, [[Article 85 GDPR|Article 85 GDPR]] obliges the Member States to define the relationship between data protection and freedom of expression in more detail to ensure an appropriate balance between the conflicting fundamental rights positions. As the regulatory content of § 9(1) DSG is not mandatory under EU law, the Constitutional Court held that the provision is subject to its review with regard to its conformity with domestic constitutional law. 

In the Austrian constitutional law in question, § 1 DSG, the Austrian fundamental right to data protection, § 1(1) DSG guarantees everyone the right to confidentiality of personal data concerning him or her, insofar as he or she has an interest worthy of protection, in particular with regard to respect for private life. § 1(2) DSG contains a material legal limitation in this regard. Apart from the use of personal data in the vital interest of the person concerned or with his or her consent, restrictions on the right to confidentiality are only permissible to protect the overriding legitimate interests of another person.

On the basis of the fundamental right to data protection pursuant to § 1(1) DSG in conjunction with § 1(2) DSG, the Court thus held that the legislator is always required to weigh the interests of the data subject in the protection of his or her personal data against the opposing (legitimate) interests of another party. Consequently, the fundamental right to data protection pursuant to §1(1) DSG does not allow the legislator to categorically exclude the applicability of all data protection regulations of a substantive and procedural nature under the DSG in their entirety within the scope of application of the "media privilege".

The Court therefore held § 9(1) DPA to be unconstitutional. In addition, although the Court did not elaborate its legal reasoning (or only to a limited extent), it also held that § 9(1) DPA would also have been unconstitutional under other Austrian constitutional law (namely, the principle of equality pursuant to [https://www.jusline.at/gesetz/b-vg/paragraf/artikel7 Article 7 B-VG] and [https://www.jusline.at/gesetz/stgg/paragraf/artikel2 Article 2 StGG], the right to a trial before the lawful judge pursuant to [https://www.jusline.at/gesetz/b-vg/paragraf/artikel83 Article 83(2) B-VG], the right to protection of personal data pursuant to [https://fra.europa.eu/en/eu-charter/article/8-protection-personal-data Article 8 CFR], and the right to privacy pursuant to [https://www.echr.coe.int/documents/convention_eng.pdf Article 8 ECHR]).

== Comment ==
''Share your comments here!''

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the German original. Please refer to the German original for more details.

<pre>
CONSTITUTIONAL COURT
G 287/2022-16, G 288/2022-14
December 14, 2022








                      IN THE NAME OF THE REPUBLIC!



The Constitutional Court is chaired by the Vice President
dr Verena MADNER


in the presence of the members
dr Markus ACHATZ,

dr Sieglinde GAHLEITNER,
dr Andreas HAUER,
dr Christoph HERBST,

dr Michael HOLOUBEK,
dr Helmut HÖRTENHUBER,

dr Claudia KAHR,
dr Georg LIENBACHER,
dr Michael MAYRHOFER and

dr Ingrid SIES-SCHERZ


and the substitute member
MMag. dr Barbara LEITL-STAUDINGER


as voting leader, in the presence of the constitutional employee
dr Philip SELIM, BA

as secretary,











                            Constitutional Court

                           Freyung 8, A-1010 Vienna
                        www.verfassungsgerichtshof.atG 287/2022-16,
 G 288/2022-14
    14.12.2022



              on the applications of the FEDERAL ADMINISTRATION COURT for repeal of § 9
              Para. 1 DSG because of unconstitutionality in its current non-public position

              140 B-VG rightly recognised:


              I. Section 9 (1) of the Federal Act on the Protection of Natural Persons in the
                   Processing of personal data (Data Protection Act - DSG), Federal Law Gazette I

                   No. 165/1999, as amended by Federal Law Gazette INo. 24/2018 is repealed as unconstitutional.

              II. The repeal will come into effect at the end of June 30, 2024.


              III. Previous statutory provisions will not come into force again.


              IV. The Federal Chancellor is responsible for the immediate publication of these statements

                   required in Federal Law Gazette I.



                                           Reasons for decision


              I. Application


              With the present applications based on Art. 140 Para. 1 Z 1 lit
              belongs to the requesting court, the Constitutional Court wanted


              "Art. 2 § 9 para. 1 of the Federal Act on the Protection of Natural Persons in the
              Processing of personal data (Data Protection Act - DSG), Federal Law Gazette I
              No. 165/1999, in the version of the amendment Federal Law Gazette I No. 24/2018 (Data Protection Dere-
              Regulation Act 2018) as unconstitutional".


              II. Legal situation


              1. The relevant provisions of the Federal Law on the Protection of Natural 2
              persons in the processing of personal data (Privacy Act –
              DSG), BGBl. I165/1999, as amended by Federal Law Gazette I24/2018 (the contested provision

              is highlighted):






      2 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



                                    "Article 1
                           (constitutional provision)

                          fundamental right to data protection

§ 1. (1) Everybody has, in particular also with regard to the respect of his
family and family life, right to confidentiality of personal
Son-related data, insofar as there is a legitimate interest in it. That

Existence of such an interest is excluded if data as a result of their
general availability or because of their lack of traceability to the
Those affected are not accessible to a non-disclosure claim.

(2) Insofar as the use of personal data is not essential for life
gene interest of the person concerned or with his consent, are restrictions
declarations of the right to secrecy only to safeguard overriding
legitimate interests of another, namely in the event of intervention by one
state authority only on the basis of laws resulting from the in Art. 8 para. 2 of
European Convention for the Protection of Human Rights and Fundamental Freedoms

(EMRK), Federal Law Gazette No. 210/1958, are necessary. such
allow the use of data which, by their nature, are particularly worthy of protection
dig, only provide and must provide for the protection of important public interests
at the same time appropriate guarantees for the protection of confidentiality interests
of those affected. Even in the case of permissible restrictions, the
encroached on the basic right only in the mildest way that led to the goal
be taken.

(3) Everyone has, insofar as personal data concerning him/her are automatically
tion-assisted processing or for processing in manual, ie. without
tomation support files are determined, in accordance with statutory

legal provisions
1. The right to information about who is processing which data about him and from where
where the data comes from and what it is used for, in particular to whom
they are transmitted;
2. the right to have incorrect data corrected and the right to have un-
lawfully processed data.

(4) Restrictions of the rights according to paragraph 3 are only under those mentioned in paragraph 2
conditions allowed.


[...]

            Freedom of expression and freedom of information

§ 9. (1) On the processing of personal data by media content
Editors, media workers and employees of a media company
mens or media service within the meaning of the Media Act - MedienG, BGBl.



                                                                                  3 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              No. 314/1981, for journalistic purposes of the media company or medi-
              endienstes find the provisions of this federal law as well as of the
              GDPR chapters II (principles), III (rights of the data subject), IV (responsibility
              literal and processor), V (transfer of personal data
              to third countries or to international organizations), VI (Independent Supervisory
              authorities), VII (cooperation and coherence) and IX (rules for special
              their processing situations) does not apply. The data protection authority has
              when exercising their powers towards the persons named in the first sentence
              to observe the protection of editorial secrecy (§ 31 MedienG).


              (2) To the extent necessary to exercise the right to protection of personal data
              data with freedom of expression and freedom of information in
              sound, see Chapter II (Principles) of the GDPR, with exception
              of Art.5, Chapter III (Rights of the person concerned), Chapter IV (Responsible
              and processors), with the exception of Art. 28, 29 and 32, Chapter V (Super-
              transmission of personal data to third countries or to international organi-
              sations), Chapter VI (Independent Regulatory Authorities), Chapter VII (Collaboration
              work and consistency) and Chapter IX (rules on special processing
              situations) to processing leading to scientific, artistic or
              literary purposes, no application. From the provisions of this

              In such cases, Section 6 (data secrecy) of the federal law applies.

              [...]

                                                 2nd section
                                             Data Protection Authority

                                                  furnishings


              § 18. (1) The Data Protection Authority shall act as national supervisory authority pursuant to
              Art. 51 GDPR set up.

              (2) The data protection authority is headed by a manager. In his absence directs his
              representative of the data protection authority. On it you will find the regulations regarding
              of the head of the data protection authority.

                                               independence

              § 19. (1) The data protection authority is a service authority and personnel department.


              (2) For the duration of his office, the head may not exercise any activity that
              1. Doubts about the independent exercise of his office or his impartiality
              could cause heat
              2. hinders him in the fulfillment of his official duties or
              3. essential official interests endangered.




      4 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



He is obliged to carry out activities that he performs in addition to his work as head of data
protection authority, immediately to the Federal Minister for the Constitution, Reform
men, deregulation and the judiciary.

(3) The Federal Minister for the Constitution, Reforms, Deregulation and Justice can
contact the head of the data protection authority about the subjects of the
teach. The head of the data protection authority only allows this insofar
correspond, as this does not correspond to the complete independence of the supervisory authority in
within the meaning of Art. 52 GDPR.


[...]

                                    tasks

§ 21. (1) The data protection authority advises the committees of the National Council and the
Bundesrat, the federal government and the state governments at their request
on legislative and administrative measures. The data protection authority is in front
Enactment of federal laws and ordinances in the area of implementation of the
Federal, which directly concern questions of data protection.


(2) The data protection authority has the lists according to Art. 35 Para. 4 and 5 DSGVO im
Ways to announce an ordinance in the Federal Law Gazette.

(3) The data protection authority must determine the
to announce the criteria by way of an ordinance. At the same time, it acts as
only national accreditation body according to Art. 43 Para. 1 lit. a GDPR.

                                   powers

Section 22. (1) The data protection authority may be instructed by the person responsible or

employees of the checked data processing, in particular all necessary processing
request clarifications and inspection of data processing and related
request documents. The controller or processor has the necessary
to provide agile support. The control activity is to be carried out with the greatest
assertion of the rights of the person responsible or the processor and third parties
exercise.

(2) For the purpose of inspection, the data protection authority is, after notifying the
owner of the premises and the person responsible or the order processor
beiters entitled to rooms in which data processing is carried out

to enter the data processing systems to be checked
to carry out processing as well as copies of data carriers in the for
the exercise of control powers to produce the extent absolutely necessary
len.





                                                                                  5 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              (3) Information that the data protection authority or its agents
              of the control activity may only be used for the control within the
              be used to implement data protection regulations. in the
              Otherwise, the duty of confidentiality also applies to courts and
              Administrative authorities, in particular tax authorities; this, however, with the
              Provided that when the inspection suspects a criminal act
              according to § 63 of this federal law or according to §§ 118a, 119, 119a, 126a to 126c,
              148a or § 278a of the Criminal Code - StGB, Federal Law Gazette No. 60/1974, or one
              crime with a maximum sentence of imprisonment exceeding five years,

              arises, is to be reported and with regard to such crimes and misdemeanors
              also requests according to § 76 of the Code of Criminal Procedure - StPO, Federal Law Gazette No. 631/1975
              correspond to.

              (4) If the operation of data processing involves a significant direct
              bare endangerment of secrecy interests worthy of protection of the persons concerned
              (risk of delay), the data protection authority may continue
              of data processing with a decision in accordance with Section 57 (1) of the General Administration
              1991 – AVG, Federal Law Gazette No. 51/1991. If this
              technically possible, reasonable with regard to the purpose of the data processing and
              seems sufficient to eliminate the hazard, the continuation can

              even partially prohibited. The data protection authority can also
              Request of a data subject to restrict processing
              Order Art. 18 GDPR with a decision in accordance with § 57 Para. 1 AVG if the responsible
              does not comply with a verbal obligation in this regard in a timely manner. Will
              the data protection authority has not complied with a prohibition immediately
              to proceed according to Art. 83 Para. 5 GDPR.

              (5) Within the scope of its competence, the data protection authority is responsible for
              Payment of fines to natural and legal persons.


              (6) If, in the course of a lawsuit based on Section 29, an affected person exists who
              from an institution, organization or association within the meaning of Art. 80
              Para. 1 DSGVO can be represented, doubts as to the existence of the relevant criteria,
              the data protection authority shall, at the request of the court of appeal,
              relevant findings with notice. This institution, organization or association
              agreement has party status in the proceedings. Against a negative assessment
              She is free to lodge a complaint with the Federal Administrative Court.

              [...]











      6 of 71 G 287/2022-16,
                                                                                    G 288/2022-14
                                                                                    14.12.2022



                                   3rd section
                     Remedies, Liability and Penalties

                     Complaint to the data protection authority

§ 24. (1) Every data subject has the right to lodge a complaint with the data
protection authority, if it considers that the processing of data concerning you-
the personal data against the GDPR or against § 1 or Article 2
1. Major breaches.


(2) The complaint must contain:
1. the designation of the right deemed to have been infringed,
2. as far as this is reasonable, the designation of the legal entity or body, the
the alleged infringement is attributed (respondent party),
3. the facts from which the infringement is derived,
4. the grounds on which the allegation of illegality is based,
5. the desire to determine the alleged infringement and
6. the information required to assess whether the complaint is justified
is brought in on time.


(3) A complaint may include the application on which it is based and a
attach any response from the respondent. The data protection
hear further in case of a complaint at the request of the person concerned
to provide support.

(4)The entitlement to treatment of a complaint expires if the intervener
not within one year after becoming aware of the complaining
event, but at the latest within three years after the event
has taken place to a large extent. Late complaints are
to reject.


(5) If a complaint proves to be justified, it must be followed. is
an infringement is to be attributed to a person responsible for the privatearea
instruct him to respond to the complainant's requests for information, reporting
cessation, deletion, restriction or data transmission to the extent
speak, which is necessary to eliminate the identified infringement.
If the complaint proves to be unjustified, it must be dismissed.

(6) A respondent may, until the conclusion of the procedure before the data
protection authority subsequently eliminate the alleged infringement by

it complies with the complainant's requests. If the data protection
hear the complaint to the extent that it is irrelevant, she has the complaint
listen to it. At the same time, he should be made aware that the data
data protection authority will informally discontinue the procedure if he is not within
within a reasonable period of time why he originally claimed that
Violation of the law is at least partially still considered not to have been remedied.



                                                                                    7 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              If such a statement by the complainant puts the matter in perspective
              sen after changed (§ 13 Abs. 8 AVG), the withdrawal of the original
              a complaint and the simultaneous filing of a new complaint
              to go out In this case, too, the original complaint procedure is informal
              discontinue and notify the complainant. Delayed foreign
              ments are not to be taken into account.

              (7) The complainant will be contacted by the data protection authority within three
              months from the filing of the complaint about the status and the outcome of the

              investigation taught.

              (8) Any data subject may refer the matter to the Federal Administrative Court if
              the data protection authority does not deal with the complaint or the
              affected person within three months about the status or the result
              nis of the complaint lodged.

              (9) The data protection authority can – if necessary – appoint official experts in
              bring procedures.

              (10) The decision period according to § 73 AVG does not include:

              1. the time during which the procedure until the final decision is
              is exposed to a preliminary question;
              2. the time during a procedure according to Art. 56, 60 and 63 DSGVO.

                             Accompanying measures in the complaints procedure

              § 25. (1) If the complainant makes a significant
              material impairment of his interests in secrecy, which are worthy of protection
              the processing of his personal data is credible, the data
              protection authority according to § 22 para. 4.


              (2) If the accuracy of personal data is disputed in a procedure,
              the respondent is to file a dispute
              If necessary, the data protection authority has requested this
              to order the complainant's application with a decision in accordance with Section 57 (1) AVG.

              (3) If a person responsible invokes the data protection authority on a
              Restriction within the meaning of Art. 23 GDPR, this has the legality of
              review application of restrictions. Does she come to the conclusion that
              the secrecy of processed personal data from the

              affected person was not justified, the disclosure of the personal
              to apply the data obtained with a notification. If the decision of the data protection authority
              If you do not respond within eight weeks, the data protection authority has the
              Disclosure of the personal data to the data subject
              to do it yourself and to give her the requested information or to inform her
              find out which personal data has already been corrected or deleted.



      8 of 71 G 287/2022-16,
                                                                                   G 288/2022-14
                                                                                   14.12.2022



(4) Notices with which transfers of personal data abroad
country have been approved are to be revoked if the legal or factual
the conditions for granting the permit no longer exist."


2. The relevant provisions of Regulation (EU) No. 2016/679 as of 3
Protection of natural persons during the processing of personal data, e.g
free movement of data and repealing Directive 95/46/EC (data protection

Basic Regulation, hereinafter: GDPR), OJ 2016 L 119, 1, read:


                                   "CHAPTER VI
                        Independent Regulators

                                   Part 1
                                 independence

                                    Article 51
                                supervisory authority

1. Each Member State shall provide for one or more independent authorities
are responsible for supervising the application of this regulation so that the

Fundamental rights and freedoms of natural persons in the processing
are protected and the free flow of personal data in the Union
facilitated (hereinafter 'Supervisory Authority').

(2) Each supervisory authority contributes to the uniform application of
this regulation throughout the Union. To this end, the supervisory
authorities among themselves and with the Commission in accordance with Chapter VII.

(3) If there is more than one supervisory authority in a Member State, so determined
this Member State the supervisory authority that these authorities represent in the committee

occurs and puts in place a procedure to ensure that the others
authorities comply with the rules for the consistency mechanism under Article 63.

4. Each Member State shall notify the Commission by 25 May 2018 at the latest
Legislation which he enacts on the basis of this chapter, as well as all without delay
following amendments to these regulations.

[...]










                                                                                   9 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



                                                  Section 2
                                    Responsibilities, duties and powers

                                                   Article 55
                                                 jurisdiction

               (1) Each supervisory authority is responsible for the fulfillment of the tasks and the exercise of the
               Powers conferred on it by this regulation in the territory
               of their own Member State.


               (2) If the processing is carried out by authorities or private bodies on the basis
               situation of Article 6 paragraph 1 letter c or e, the supervisory authority of
               concerned Member State responsible. In this case Article 56 does not apply
               turn.

               (3) The supervisory authorities are not responsible for the supervision of the
               direct processing carried out within the scope of their judicial activities.

               […]


                                                  CHAPTER VIII
                                    Remedies, Liability and Penalties

                                                   Article 77
                               Right to lodge a complaint with a supervisory authority

               (1) Without prejudice to any other administrative
               legal or judicial remedy the right to complain to a
               Supervisory authority, in particular in the Member State of your habitual residence
               places of residence, their place of work or the location of the alleged violation, if

               the data subject believes that the processing is relevant to them
               personal data violates this regulation.

               (2) The supervisory authority to which the complaint was lodged will be informed
               inform the complainant about the status and the results of the complaint
               finally the possibility of a judicial remedy under Article 78.

                                                   Article 78
                Right to an effective judicial remedy against a supervisory authority


               (1) Every natural or legal person has, without prejudice to anything else
               administrative or non-judicial remedy, the right to a
               effective judicial remedy against a legal
               binding decision of a supervisory authority.

               (2) Without prejudice to any other administrative
               legal or non-judicial remedy the right to an effective


     10 of 71 G 287/2022-16,
                                                                                   G 288/2022-14
                                                                                   14.12.2022



judicial remedy if the competent authority under Articles 55 and 56
supervisory authority does not deal with a complaint or the person concerned
not within three months of the status or outcome of the pursuant
complaint made under Article 77.

(3) For proceedings against a supervisory authority, the courts of the member
competent state in which the supervisory authority has its seat.

(4) If there are proceedings against the decision of a supervisory authority,

which an opinion or a decision of the committee within the framework of the
inheritance proceedings, the supervisory authority directs this agency
consent or this order to the court.

                                    Article 79
  Right to an effective judicial remedy against data controllers or
                               processor

(1) Every data subject has, without prejudice to an available administrative right

judicial or extrajudicial legal remedy, including the right to
appeal to a supervisory authority pursuant to Article 77 the right to an effective
Same judicial remedy if she believes that her due
rights to which you are entitled under this Regulation as a result of a non-compliance with this
regulation violates the processing of your personal data
became.

(2) For lawsuits against a person responsible or against a processor
The courts of the Member State in which the controller is responsible have jurisdiction
or the processor has an establishment. Optionally, such
Actions can also be brought before the courts of the Member State in which the

affected person has their usual place of residence, unless it acts
the person responsible or the processor is an authority
of a Member State acting in the exercise of its sovereign powers
is.

[...]

                                   CHAPTER IX
              Rules for special processing situations


                                    Article 85
   Processing and freedom of expression and information

(1)Member States bring the right to protection through legislation
personal data according to this regulation with the right to free ma-
expression of opinion and freedom of information, including processing for jour-
nalistical purposes and for scientific, artistic or literary purposes
purposes, in accordance.


                                                                                   11 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022




              (2) For processing for journalistic purposes or for scientific
              ing, artistic or literary purposes, the Member States
              ten deviations or exceptions from Chapter II (Principles), Chapter III (Rights
              of the data subject), Chapter IV (Controller and processor),
              Chapter V (Transfer of personal data to third countries or to internal
              national organizations), Chapter VI (Independent Regulatory Authorities), Chapter VII
              (Cooperation and Consistency) and Chapter IX (Rules for Special
              work situations) if this is necessary to exercise the right to protection of

              personal data with freedom of expression and information
              to reconcile freedom of information.

              3. Each Member State shall notify the Commission of the legislation which it
              reason of paragraph 2, as well as immediately all subsequent amendments
              implement or amend these regulations."


              III. Facts, submissions and preliminary proceedings


              1. The procedure recorded at the Constitutional Court on number G 287/2022 4
              ren is based on the following facts:


              1.1. In his complaint to the data protection authority dated 29. No-5
              vember 2019, the complainant alleged a violation of his right

              Confidentiality according to § 1 DSG applies. In summary, he submitted that the
              Severe opponent, a media company, has a contribution on her homepage

              tragedy and images of a house search were published. on one of the
              published images are the business card of the complainant (unredacted)

              been pictured. His name as well as in employers were recognizable.
              The media privilege of § 9 DSG is not applicable to the present case.
              Even if you assume the applicability of § 9 DSG, you can get by

              an interpretation conforming to Union law to the conclusion that the existing
              sufficient data processing was not necessary.


              1.2. The respondent in the proceedings before the data protection authority reimbursed 6

              tete a statement in which she put forward a media outlet
              § 1 para. 1 no. 6 MedienG. The publication of the pictures was too journalistic
              cal purposes; the images were later blacked out. Since the

              Heavy publication under the media privilege according to § 9 paragraph 1
              DSG falls, the data protection authority is not competent in the present case.



     12 of 71 G 287/2022-16,
                                                                                   G 288/2022-14
                                                                                   14.12.2022



1.3. With notice dated 23. July 2020, the data protection authority dismissed the complaint 7

back and justified this in summary by the fact that the
Heavy opponent is a media company that, as the media owner

responsible for the content of the reporting. The data of the complaint
deführers are in the context of journalistic articles or journalistic reports

processed and subsequently published. Due to the
Application of the media privilege according to § 9 Abs. 1 DSG is the authority concerned

not competent to deal with the complaint.


1.4. The complainant lodged a complaint against this decision within the time limit 8
to the Federal Administrative Court. He stated in particular that § 9 DSG was
unconstitutional and unlawful.


2. The procedure recorded at the Constitutional Court on number G 288/2022 9

ren is based on the following facts:


2.1. In its complaint to the data protection authority dated 26 November - 10
About 2021, the complaining parties (among others) made a breach of their

The right to secrecy according to § 1 DSG applies. They brought together
suggests that a publishing company and a broadcasting company have a

"Data leak" at one attributable to the second complaining party
E-mail mailbox that is in the power of disposal of the party filing the first

tei stand, reported. The media companies mentioned would have
circumstances unlawfully disclosed. The application of the media privilege

according to § 9 Abs. 1 DSG is unconstitutional.


2.2. With a decision of December 10, 2021, the data protection authority proved the
complaint of the complaining parties, with reference to media privacy

leg of § 9 Para. 1 DSG.

2.3. The complaining parties lodged a complaint against this decision within the 12

complaint to the Federal Administrative Court and suggested an application
According to Art. 140 Para. 1 Z 1 lit. a B-VG to the Constitutional Court and the Einho

ment of a preliminary ruling by the Court of Justice of the European Union
Art. 267 TFEU.




                                                                                   13 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              3. In order to deal with these complaints, the Federal Administrative 13
              court had concerns about the constitutionality of Section 9 (1) DSG,

              which prompted it to submit an application to the Constitutional Court.
              The supporting court lays its concerns in this regard in the

              sungsgerichtshof on number G 287/2022 as follows
              (without the emphasis in the original):


              "III. Constitutional concerns:

              1. In the present case, the data protection authority with the contested proof
              decided the complainant's data protection complaint because of an alleged
              In accordance with § 1 DSG, they withdraw from infringement because they are based on the media privilege
              of § 9 Para. 1 DSG for the handling of a complaint against a media company
              do not take responsibility.

              2. The Federal Administrative Court has serious concerns about the constitutional

              compliance with Section 9 (1) DSG.

              In detail:

              2.1. The Federal Administrative Court primarily has the concern that its applicable
              realization of the basic right to data protection of § 1 DSG in the scope
              of § 9 para. 1 DSG is effectively undermined, since due to the in § 9 para. 1 DSG
              standardized exclusion of the provisions of the DSG - and thus also the non-
              applicability of § 24 Para. 1 DSG - (as well as the entire Chapter VI of the GDPR)
              no national supervisory authority is available to a data subject,

              to assert a violation of fundamental rights. The Federal Administrative
              court is of the opinion that its national supervisory authority should also
              9 Para. 1 DSG a responsibility for the treatment of complaints
              must come.

              The following is stated in the scientific literature on Section 9 (1) DSG:

              According to the wording of Section 9 (1) DSG, a total exception to this applies
              the provisions of the DSG' (Zöchbauer, MR 2018, 102 [103]; cf. also Kunnert
              in Bresichet al (editor), DSG comment (2018) §9DSGRz 10).'§ 9 Para.1 DSG sees
              in the first sentence that under the conditions defined in more detail there 'the

              Provisions of this federal law do not apply. This will - in
              Difference to the previous provision of §48DSG2000 -also the applicable-
              of the fundamental right to data
              Protection according to § 1 DSG excluded. […]' (Jahnel, comment on data protection
              Basic Regulation Art. 85 GDPR, margin no. 42).





     14 of 71 G 287/2022-16,
                                                                                   G 288/2022-14
                                                                                   14.12.2022



After Jahnel comes a constitutional interpretation of Section 9 (1) DSG
'in view of the clear wording ('find the provisions of this federal
zes […] no application') […] not to be considered.' (Jahnel, comment on data
General Protection Regulation Art. 85 GDPR, margin no. 44).

'Like all fundamental rights, the fundamental right to data protection does not apply
restricts. A limitation of this fundamental right is only in the presence of a
of the reasons provided for in Section 1 (2) DSG. Since the approval and
vital interests in connection with media privilege not in

come, is for the constitutional conformity of an intervention in the fundamental
Right to data protection through a legal provision at least one
balancing of interests required. Both in § 9 para. 1 […], however, there is a
General exclusion of the fundamental right to data protection, provided that the other
conditions of a privilege exist.' (Jahnel, comment on data
General Protection Regulation Art. 85 GDPR, margin no. 43).

'§ 9 para. 1 takes processing for journalistic purposes as an overriding norm
by media companies or media services within the meaning of a blanket exception
almost completely from the data protection regulation regime. In particular
the persons affected by the processing situations mentioned

the rights of data subjects enshrined in Chapter III GDPR in accordance with Section 9 (1) DSG fully
extensively withdrawn. This blanket withdrawal of the rights of those affected is before
Background of the material legal reservation according to § 1 paragraph 2 DSG as non-
proportionate encroachment on the fundamental right to data protection. the
Withdrawal of the rights of those affected should rather be within the meaning of the principle of proportionality
solely on the basis of an evaluative consideration of the (public) interests
ressing journalistic activity and the fundamental right to data protection of the
take place. The blanket exception of § 9 Para. 1 DSG privileges journa-
cunning activities of media companies or media services, however
a priori in the negation of any data subject rights and thus encroaches on disproportionate

moderate and consequently unconstitutional manner in § 1 DSG.' (Marco Blo-
cher/Lukas Wieser, Of privileged journalists and data in the (almost) right-
free space - For a unilateral solution to the conflict of fundamental rights between
Data protection and freedom of expression through § 9 DSG, data protection law yearbook
2019, 303 [312f]).

In this context, it is stated that, in the opinion of the Federal
administrative court the simple legal provision of § 9 paragraph 1 DSG, in any case
not the basic right to data protection, which has constitutional status
of media privilege. Even if one interprets

could make going that the exception of the DSG mentioned in § 9 paragraph 1
only concerns its simple legal regulations, the fundamental right in the
consequence can also be asserted. However, this is precisely not the case
since also § 24 DSG, which is the basis for the determination of (also in the past
factual) violations of rights, in particular of the fundamental right to property
secrecy, would not be applicable.



                                                                                   15 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              For the reasons mentioned, the exception of the entire DSG seems to contradict
              to stand with the basic right to data protection standardized in § 1 DSG.

              First of all, the Federal Administrative Court does not fail to recognize that the right to
              do not lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR in Chapter VIII
              is excluded. While the Supreme Court, with reference to the legal
              lien (ErläutAB 1761 BlgNR 25. GP 15) assumes that Art. 77 [GDPR] no
              independent right to appeal standardized (OGH May 23, 2019, 6 Ob 91/19d),
              is used by the doctrine and by the Federal Administrative Court in the cases cited below

              are of the opinion that Art. 77 GDPR should not be implemented in the national
              Law requires (cf. Schweiger in Knyrim, DatKomm Art. 77 GDPR, margin no. 8 (as of
              December 1, 2018, rdb.at), see also BVwG November 23, 2020, W211 2227144-1; BVwG
              8/13/2021, W211 2222613-1.

              But even with a direct applicability of Art. 77 DSGVO results
              following problem:

              Art. 77 D[S]GVO appears from its wording (only) to be currently
              stop ongoing violations. Accordingly, Art. 58
              DSGVO no 'assessment powers', but investigative, remedial and

              approval powers.

              Also according to the case law of the Administrative Court (VwGH December 14, 2021,
              Ro 2020/04/0032) exclusively grants § 24 DSG in his personal
              fundamental right violated the possibility that happened to him
              To have an infringement determined is such a determination competence
              namely not provided for in the GDPR
              therefore (due to the lack of applicability of § 24 DSG) no possibility of a legal
              last (which took place in the past) to determine (yet just now
              a determination of such a violation of fundamental rights is about

              understandable case of complaint), which is why the exclusion of the provisions of the DSG
              in particular due to the principle of equality as not in accordance with
              appears to be based on constitutional law (see below for more details).
              The provisions of §§ 18 to 22 DSG (establishment of data protection
              authority, independence, head of the data protection authority and powers of the
              data protection authority) also not applicable according to the wording of the DSG. Above-
              Strictly speaking, this includes § 9 para. 1 DSG in its diction even itself
              out, which was apparently not intended by the legislature. should be pointed out
              also on the fact that – contrary to the extensive exceptions – the last
              Sentence of § 9 para. 1 DSG seems to assume that the data protection authority

              very well also in the event of complaints against media companies and owners
              to come.

              The Federal Administrative Court does not overlook the fact that despite the exclusion of
              Applicability of all DSG provisions because of the direct applicability
              of Art. 79 GDPR with additional reference to § 1 JN in the case of a
              According to the GDPR, a jurisdiction of the civil courts can be assumed


     16 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



can. However, in the present case, in which the determination of a
Violation of the fundamental right[s] to secrecy was asserted under
Reference to Art. 79 GDPR does not justify any jurisdiction,
since Art. 79 GDPR (like Art. 77 GDPR) only refers to violations of the GDPR
but not on national laws such as the DSG (Marco Blocher/Lukas Wie-
ser, Of privileged journalists and data in (almost) a legal vacuum – Zur
unilateral solution to the conflict of fundamental rights between data protection and opinion
freedom through § 9 DSG, data protection law yearbook 2019, 303 [320]; see also
Jahnel, Commentary on the General Data Protection Regulation Art. 85 GDPR, margin no. 51). So-

legal protection in the present case would be completely excluded. The-
This result does not seem objectively justifiable to the Federal Administrative Court
and therefore in conflict with the principle of equality and the right to
legal judge (see below).

But also a sole jurisdiction of the regional court (cf. § 50 JN in conjunction with § 49
JN and OGH 05/23/2019, 6 Ob 91/19d) would not comply with the provisions of Art. 79
Para. 1 GDPR, according to which each data subject, without prejudice to the
law of gravity at a supervisory authority the right to a judicial
has a right of appeal if it considers that the
rights to which you are entitled as a result of a non-compliance with this Regulation

standing processing of their personal data have been violated and has
the European legislature thus explicitly provides for a two-pronged legal protection
seen. This two-pronged legal protection has already been re-examined by the OGH
Holt affirmed (e.g. 6 Ob35/21x of April 15, 2021 with reference to 6 Ob 131/18kund
6 Ob 91/19k) and most recently in the Opinion of Advocate General de la Tour
of September 8, 2022 in Case C-132/21, BE. Various considerations
Reasons, especially Recital 122 GDPR, assume a comprehensive responsibility of
supervisory authorities.

Even if one assumed a court of jurisdiction, the regulation of the

§ 9 para. 1 DSG irrelevant because the right to complain to the
data protection authority are perceived as less accessible by those affected
can, especially since filing a complaint with the authority - in contrast to
bringing an action before the regional court – is free of charge and before the authority
there is also no obligation to have a lawyer. It is not misunderstood here that in administration
procedure, the principle of self-support prevails and therefore in the case
If the complaint is successful, no representation costs will be reimbursed.
In the event of a lawsuit in civil court, the flat fee is borne by the plaintiff
to be paid, plus the costs for the necessary representation by a
a lawyer, although in the event of complete victory there may also be a

full reimbursement of the procedural and representation costs (cf.
Jahnel, On the Interplay between the Administrative Law Way and the
Civil law and the interfaces to constitutional law and European law
in: Nunner-Krautgasser/Garber/Klauser (editors), Law Enforcement in Data
protection according to the GDPR and the GDPR2018[2019]).
legal aid can be applied for (cf. § 63 ff ZPO). The party has



                                                                                  17 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              however, to effect the full or partial subsequent payment of the amounts, so
              far and as soon as they can do so without impairing the necessary maintenance
              (cf. more detail § 71 Abs. 1 ZPO). Legal aid is also only granted for the
              costs are granted, but in the event of defeat, the opponent's
              to pay the costs despite legal aid being granted (cf. M. Bydlinski in Fa-
              sching/Konecny II/1 before §§ 63 ff ZPO Rz 3 (as of September 1st, 2014, rdb.at). total
              are therefore the requirements for the person concerned when exercising the
              Right of appeal to the DSB to be regarded as lower.


              It also does not correspond to the will of the legislature to
              exclusively comply with the media law and the jurisdiction
              Rather, the (Union law) legislator Art.
              assumes that national legislators (only) take into account the basic
              rights to data protection and freedom of expression
              to be provided for by the GDPR. A requirement of jurisdiction
              of the national data protection authority is not apparent, let alone the need
              of a (non-equal) 'partial incompetence' for complaints
              gen particular actors such as media companies or media services.

              Furthermore, the exclusion of Chapter II GDPR 'Principles' would

              In the case of a substantive decision, the test standard of Art. 5 ff
              GDPR withdrawn, unless you already have this exclusion due to the Union
              unlawfulness considered inapplicable.

              It should be added that Art. 85 Para. 2 GDPR gives the Member States the task
              informs, 'deviations and exceptions' from certain chapters of the GDPR
              watch if this is necessary as a result of a balancing of interests ('um
              the right to protection of personal data with the freedom of
              freedom of expression and freedom of information', see also
              ErwG 153 DSGVO), whereby this balancing of interests in § 9 Abs. 1 DSG not

              forms (cf. Zöchbauer, Das'Medienprivileg'des§ 9Abs.1 DSGidFDatenschutz-
              Deregulation Act 2018, MR 2018, 102). Rather, after the (new) version
              of § 9 DSG, a consideration is not (or no longer) necessary, the essential parts of the
              GDPR and the DSG are therefore in any case not applicable to the
              processing of personal data by media owners, publishers,
              Media staff and employees of a media company or media
              service for journalistic purposes (Lehofer, adaptation of data protection
              sung - last-minute legislation accompanying the GDPR, ÖJZ 2018/55). to the general
              Exemption from all data protection regulations, such as § 9 Para. 1 DSG
              contains, see also critical Krempelmeier, Are the data protection privileges

              9 DSG contrary to Union law?, jusIT 2018/68.

              Among the other exceptions - affecting most chapters of the GDPR - is
              to record the following:

              Chapter VIII GDPR cannot be viewed in isolation from Chapter VI. Since the
              Provision on the competence of a supervisory authority in Art. 55 GDPR ex


     18 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



1 DSG would be excluded, the relevant authority could
not make a merit-based decision on the complaint. In addition, the
powers of assistance of Art. 58 Para. 2 lit c [GDPR] (the person responsible or the
instruct processors to comply with data subject requests for
exercising the rights to which it is entitled under this regulation).
of the data protection authority are not exercised (cf.Schmidl, DasMedienprivileg
in the case law of the data protection authority, jusIT 2020/20, 54 issue 2 v.
April 27, 2020). Finally, it should be noted that Section 9 (1) DSG also includes the entire
Chapter IX of the GDPR excludes, which also excludes the provision of Art. 85 Para. 2

GDPR is excluded, accordingly for the processing that leads to journalistic
scientific purposes or for scientific, artistic or literary purposes
If the Member States derogate from or make exceptions to Chapter II
(Principles), Chapter III (Rights of the data subject), Chapter IV (Responsibility
and processors), Chapter V (Transmission of personal data
to third countries or to international organizations), Chapter VI (Independent
ing supervisory authorities), Chapter VII (Cooperation and Consistency) and
Provide for Chapter IX (Regulations for special processing situations) if
this is necessary to exercise the right to protection of personal data
freedom of expression and freedom of information
bring. The exclusion of the applicability of Art. 85 Para. 2 GDPR, i.e. the

Union legal basis for the 'media privilege', however, would have the consequence that
the standard of § 9 para. 1 DSG would be deprived of its (union legal) basis.
Again, the Constitutional Court held in its decision of September 26, 2022 that
there is also an inseparable connection with the other provisions
of §9 para. 1 DSG, thus with the other exceptions mentioned in § 9 paragraph 1 DSG
from the GDPR.

With regard to these exceptions to the GDPR, the Federal Administrative Court has the
think that they are not in line with Union law in this general way,
especially since Art. 85 GDPR bases the exceptions on their 'necessity' and a

Excluding the possibility of complaints to the supervisory authority
is required. Likewise, an exclusion of the (entire) IX. Chapter GDPR
not only not necessary, but simply meaningless, since the
If the legal basis of Art. 85 GDPR were withdrawn in § 9 DSG.

2.2. The principle of equality is repeated in Austrian constitutional law,
namely in Art. 2 StGG and above all Art. 7 B-VG, anchored.
sentence also binds the legislature. He sets him content limits insofar as
it forbids the making of regulations that cannot be justified objectively (e.g.
VfSlg 14.039/1995; 16.407/2001). The Constitutional Court emphasized that the principle of equality

forms an essential part of the democratic principle and therefore
is also not at the disposal of the constitutional legislature
(VfSlg 15.373). According to the examination formula developed by the Constitutional Court, the
principle of equality only an objectively justified differentiation; such sets
Relevant differences in the field of facts (objective distinguishing
male) ahead. According to established case law, the legislature must
have the same legal consequences; substantially unequal facts


                                                                                  19 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              lead to correspondingly different regulations (e.g. VfSlg 2956, 11.190,
              11,641, 13,477, 14,521, 19,590; VwGH 2. 7. 1992, 90/16/0167 - sen; Administrative Court
              2000-03-23, 99/15/0202; cf. also VfSlg 8806, 11.190, 15.510 - on legal
              exemptions). The objectivity test of laws aims at a
              Evaluation of the relation of the facts covered by a regulation to the
              envisaged legal consequence.
              to carry out a comparison; it is necessary to ask whether the respective

              are so different that the different legal consequences become 'tra-
              gene' assets (VfSlg 16.635, 17.309).
              first such an examination of the relationship between facts and legal consequences
              gain weight. It can lead to the result that this relation is already in itself
              based on no 'reasonable' reason; in this case the law is
              to be regarded as contrary (e.g. VfSlg 13.975) [Muzak, B-VG Art 2 StGG (as of October 1st, 2020,
              rdb.at]. In the present case, no objective reasons are apparent in application
              cases of § 9 para. 1 DSG compared to cases in which this is not the
              It is important not to assert the fundamental right to secrecy at all

              be able. If one speaks of the non-application of the exception of Chapter VI
              GDPR, but without the provision of § 24 DSG of the DSB, a fixed
              a past encroachment on fundamental rights is denied.
              Even if one assumes (sole) jurisdiction of the civil courts,
              if it would constitute unequal treatment for the persons concerned, it would not
              (also) to provide for official responsibility which – as explained above –
              is available to them more easily. The principle of equality appears in
              to be injured in the present case because it treats the same unequally (cf.
              VfSlg 5737 and others).


              2.3.Art
              Judge. The 'legal judge' means any state authority
              (VfSlg 1443, 2048); from this follows a constitutionally guaranteed right
              on the protection and maintenance of the legally justified authorities responsible
              ability par excellence (VfSlg 2536, 12.111). This applies to administration
              Right to a procedure before the statutory judge at the competent authority
              as such. It is consistent case law that Art. 83 Para
              binds (VfSlg 6675; otherwise VfSlg2470); the legislature must

              responsibility based on objective criteria (VfSlg 3156, 8349), exact (VfSlg 9937,
              10,311; VwGH September 5, 2008, 2007/12/0078), clear and unambiguous (VfSlg 11.288) 6estle-
              (VfSlg 10.311,12.788; VwGH 7. 7. 2011, 2009/15/0223) [Muzak, B-VG Art.83
              (Status 1.10.2020, rdb.at].

              If the exceptions from the GDPR mentioned in § 9 Para. 1 DSG were not considered
              to be considered applicable, the DPO would generally be any merit decision
              about a complaint involving 'media privilege' processing

              concerned, denied.

              It should also be taken into account that within the scope of §9 DSG for a
              Violation of § 1 DSG no jurisdiction of an authority or a court



     20 of 71 G 287/2022-16,
                                                                                   G 288/2022-14
                                                                                   14.12.2022



exists, since Art. 77 DSGVO (only) the right to complain to a supervisory
hearing denormalized if the data subject believes that the processing
of the personal data concerning them 'against this regulation' - precisely
the GDPR – violates. An alleged violation of the domestic § 1 DSG
however, it cannot be asserted via Art. 77 or Art. 79 GDPR
[…].

As shown above, in the application of § 9 Para. 1 DSG the data
protection authority (at least in the event of a complaint about violation of the

Fundamental right to data protection) no merit decision-making authority to and
this regulation - for the reasons mentioned - is irrelevant. Accordingly would be
also no authority provided according to objective criteria, why
in the present case also a conflict with the right to the statutory judge
according to Art. 83 Para. 2 B-VG and also with Art. 6 EMRK.

2.4. Art. 8 GRC also guarantees the data subject the protection of the
applicable personal data and provides that compliance with these
writings is monitored by an independent body. Compliance with the
Art. 8 para. 1 and 2 standardized guarantees – in accordance with Art. 16 para. 2
Sentence 2 TFEU and Art. 39 last sentence EUV - is by an independent body

monitor. The procedural protection that is thereby achieved at the same time is specified
the legal guarantees of Art. 47 GRC for the area of data protection. the
Art. 51 f GDPR regulates independence (in a legally unifying manner).
of supervisory authorities at Member State level in a comprehensive manner and
in accordance with the case law of the ECJ that specifies this postulate, which
cheinsb.in explicit congruence withArt.8para.3GRC.'Independent
Body' are both the European data protection officer (according to Art. 41 ff VO
[EU] 2001/45), the official (community) data protection officers
(Art. 24 leg. cit.) and (above all) the supervisory authorities in the Member States
(Art. 51 f GDPR; formerly control bodies according to Art. 28 GDPR). According to the

The ECJ applies the establishment of independent control bodies in the Member States (such as
of course also in the Union itself) as an essential element of protection
of persons in the processing of personal data (ECJ 9.3.2010,
C-518/07, Commission/Germany margin no. 23; ECJ 16.10.2012, C-14/10, Commission
sion/AustriaRz37; ECJ8.4.2014, C-88/12, Commission/HungaryRz48; et al (cf.
also recital 62 DRSL and recital 117 GDPR).

The fact that this is not only secondary law (Art. 51 para. 1 and Art. 52
GDPR), but also explicitly by Art.8 Para.1 GRC (as well as Art.16 Para.1 TFEU).
is protected, speaks in favor of a kind of institutional guarantee in Art. 8 Para. 3 CFR

see. This conclusion is also confirmed by the provisions of
Secondary law, which statute a legal order to set up. On
Right of the person concerned to lodge a complaint with the national control bodies
judge, the ECJ also recently pronounced this reasoning (ECJ
December 21, 2016, related cases C-203/15 and C-698/15, Tele2 Sverige AB and others margin no. 123; before
already ECJ6. 10.2015, C-362/14, Schrems Rz 58 with reference to the decision
tion Digital Rights Ireland and Seitlinger and others).


                                                                                   21 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022




              Likewise, according to Art. 47 GRC, the person concerned has the right to object to a
              rejection decision of the control body regarding the protection of his personal
              personal data to appeal to the national courts. the
              In this context, the control body itself is inter alia through Art. 8 Para. 3
              GRC - when you receive a complaint from a person dealing with an input to you
              has turned to be correct - an appeal before the (national) authorities

              len/courts to. In addition, the control body/supervisory authority receives more
              Investigation and intervention powers within the meaning of Art. 58 GDPR
              comprehensive listing so that it can fulfill its role as 'guardian of fundamental rights'
              can exercise effectively (Riesz in Holoubek/Lienbacher, GRC comment Art. 8 2
              (Status April 1, 2019, rdb.at).

              This alone shows that the mere possibility of directly asserting a
              Data protection violations in the courts (which, however, in the present case also
              is not given) the institution of a supervisory authority and legal protection

              cannot be replaced by this authority, but can only be seen as an alternative,
              whereby, as explained above, in the present case the fundamental right
              Confidentiality cannot be asserted via Art. 79 GDPR.

              In the decision of the VfGH VfSlg 19.632/2012 it was already stated that
              due to the principle of equivalence also the rights guaranteed by the GRC
              before the Constitutional Court as constitutionally guaranteed rights according to Art. 144
              B-VG can be invoked and they are within the scope of the GRC
              a test standard in procedures of general norm control, above all

              according to Art. 139 and Art. 140 B-VG. This applies if the relevant
              Guarantee of the GRC in its wording and certainty constitutional
              guaranteed rights same. The intervention goals of Art. 52 Para. 1 GRC, in con-
              creto 'objectives for the common good recognized by the Union', he-
              allow more far-reaching encroachments on Art. 8 GRC than those permitted in Art. 8 para. 2 ECHR
              are exhaustively mentioned (on which § 1 para. 2 DSG with regard to state intervention
              explicitly recursed), whereby this divergence, considering the same limitations
              test (proportionality) practically no significant differences
              which will lead to the admissibility of interventions. In view of this

              it is assumed that Art. 8 GRC 'does not contain any
              the provision of § 1 DSG has a protective content that goes beyond the
              However, the areas of application of the two fundamental rights provisions are not
              (Completely) congruent
              Overall connection but still existing comparability between § 1
              DSG and Art. 8 GRC, this provision can in any case be considered a fundamental right before the
              VfGH (Riesz in Holoubek/Lienbacher, GRC comment 2
              Art 8 (as of April 1, 2019, rdb.at)).


              The ECtHR has also recognized the need for protection of personal data
              known by having the processing, transmission and storage correspond-
              of the data regularly as an infringement of the privacy protected by Art. 8 Para. 1 ECHR
              vatsphere (esp. in general personal rights). Art. 8 GRC


     22 of 71 G 287/2022-16,
                                                                                   G 288/2022-14
                                                                                   14.12.2022



ties in with the existing comprehensive protection guarantees of Art. 8 Para. 1 ECHR
and writes the aspect of the protection of personal data in a
independent fundamental right. Indirectly, an incorporation takes place in the
range of data protection, however, through the explicit reference to Art. 8
ECHR in the explanations of Art. 8 GRC, which according to Art. 52 Para. 7 GRC in conjunction
Art. 6 para. 1 subparagraph 3 TEU must be observed in the interpretation, from which the
close linking of both systems – also underlined by primary law –

This is also evident by following the Rsp of the EuGHhandieRsp of the 2nd
ECHR confirmed (see again Riesz in Holoubek/Lienbacher, GRC comment
Art 8 (as of April 1, 2019, rdb.at).

Thus, Art. 8 ECHR also represents a test standard and the contested
The following parts of Section 9 (1) DSG are - for the reasons given above - in
Conflict with provision of Art. 8 ECHR.

3. A constitutional interpretation of the contested provision came

in the present case, at least with regard to the exception of ordinary law
Regulations of the DSG are not considered, since these - like any other interpretation
tion method - finds its limit in the unambiguous wording of the law (VwGH
March 13, 2009, 2005/12/0240, with reference; 06/29/2011, 2009/12/0141).

Even if one assumes that a word interpretation shows that § 9
Para. 1 DSG a responsibility of the data protection authority for the treatment of
Complaints against actors who are not mentioned in § 9 paragraph 1 DSG, not
closes, would a responsibility of a national supervisory authority for complaints

the against journalistic persons not mentioned in § 9 paragraph 1 DSG
part (keyword: citizen journalism) and a lack of competence of the DSB regarding
Complaints against the journalistic actors named in Section 9 (1) DSG
on the other hand, objectively not justifiable and therefore contrary to equality. § 9 paragraph 1
DSG is therefore not accessible to a constitutional interpretation.

An unlawful norm is not irrelevant, but rather to be applied for as long
until they have been examined and addressed by the Constitutional Court in the
(cf. VfGH 11.10.1955, V 15/55).


IV. Conclusion

The Federal Administrative Court has therefore decided that the
application to the Constitutional Court."


4. The application of the Federal Administrative Court in the case before the Constitutional Court 14
hof corresponds to number G 288/2022 - with adjustments

and the facts and procedure there – the one just reproduced
Legislative Review Request.




                                                                                   23 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              5. The Federal Government informed the Constitutional Court in briefs dated 15
              November 16, 2022, in the proto-

              collided proceedings to refrain from making a statement.


              6. The data protection authority reported in the 16th
              Number G 287/2022 procedures recorded a statement in which they raised the

              ken of the applicant court as follows (without the original
              included highlights):


                                       "I. Statement on the subject

              1. General information on admissibility:

              It is preceded that the question of whether and, if necessary, to what extent §9 para. 1
              DSG is in accordance with Union law, a matter for the ECJ
              Art. 267 TFEU is. Accordingly, in the opinion of the data protection authority, the
              no further introduction with regard to a potential violation of Union law
              go to


              In the course of its application, the BVwG is requesting the repeal of the following
              statement:

              '§ 9 (1) On the processing of personal data by media content
              Editors, media workers and employees of a media company
              mens or media service within the meaning of the Media Act - MedienG, BGBl.
              NO. 314/1981, for journalistic purposes of the media company or medi-
              endienstes find the provisions of this federal law as well as of the
              GDPR chapters II (principles), III (rights of the data subject), IV (responsibility
              literal and processor), V (transfer of personal data
              to third countries or to international organizations), VI (Independent Supervisory

              authorities), VII (cooperation and coherence) and IX (rules for special
              their processing situations) does not apply. The data protection authority has
              when exercising their powers towards the persons named in the first sentence
              to observe the protection of editorial secrecy (§31 MedienG).'

              in the version of the amendment BGBl.INr.24/2018 (Data Protection Deregulation Act
              2018).

              As a reason, it is essentially stated that an assertion of the
              Fundamental right to data protection according to § 1 DSG in the scope of § 9 paragraph 1

              DSG will actually be undermined because of the standardized in § 9 para. 1 DSG
              Exclusion of the simple legal provision of the DSG - and thus also the
              Inapplicability of Section 24 (1) DSG and the entire Chapter VI of the GDPR
              – no national supervisory authority is available to a data subject,


     24 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



to claim a violation of fundamental rights. The BVwG represents the
Opinion that a national supervisory authority also within the scope of § 9 para. 1
DSG must be responsible for dealing with complaints.

The data protection authority is of the opinion, to be further substantiated, that
§ 9 para. 1 DSG in the current version is not mandatory under constitutional law
contradicts specifications.

2. Regarding the specific constitutional concerns of the applicant

judge:

The court appealed to decides on the unconstitutionality of the
disputed legal provision (Art. 140 para. 1 B-VG). The motion has them against them
the constitutionality of the law in detail.
gen (§62 para. 1 second sentence VfGG). The Constitutional Court has to judge
whether the contested provision from the reasons presented in the application
given reasons is unconstitutional (VfSlg. 15.193/1998, 16.374/2001,
16.538/2002, 16.929/2003).

According to the established case law of the constitutional

Court of Justice only fulfilled if the reasons for the alleged violation of the constitution
rity - in a verifiable way - to be precisely spread, and therefore the application
it can be inferred with sufficient clarity by which legal regulation the
the norm requested for repeal is said to be inconsistent and what the reasons are
speak for this assumption (cf. e.g. VfSlg. 14.802/1997, 17.752/2006; specifically
on the party motion VfGH July 2, 2015, G 16/2015; 2.7.2015, G 145/2015; 2/18/2016,
G 642/2015).

Summarized to the essentials, the BVwG sees a constitutional
of § 9 Para. 1 DSG because


a) a violation of the fundamental right to data protection according to § 1 DSG not before
data protection authority can be asserted (see point 3.1.);

b) the exclusion of legal recourse to the data protection authority in violation of equality
7 B-VG and Art. 2 StGG (see point 3.2.);

c) the right to the statutory judge according to Art. 83 B-VG is violated and
(see point 3.3.);


d) a breach of the guarantee of protection provided for in Art. 8 EU-GRC
personal data is available (see point 3.4.).

The subject of the present proceedings is therefore exclusively the question of
(In)competence of the data protection authority. Whether § 9 para. 1 DSG from other
Reasons unconstitutional, however, is not the subject of the proceedings.



                                                                                  25 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              The data protection authority comments on this as follows:

              3.1. Concerning the concerns regarding the fundamental right to data protection in
              menhang with the 'media privilege'

              The so-called 'media privilege' is characterized in that in order to
              Basic right to protection of personal data according to Art. 8 EU-GRC and that
              on freedom of expression and information according to Art. 11 EU-GRC
              to reconcile partial deviations from the requirements of the GDPR

              dig, among other things, regarding the responsibility of the supervisory authority (here: data
              protection authority) according to Chapter VI GDPR. According to Art. 85 Para. 2 GDPR, it is a task
              of the Member States[,] these two basic
              to reconcile rights. A general priority of these two
              fundamental rights is not possible insofar as fundamental rights im-
              must be weighed against each other, with the ECJ in its previous
              Case law has indicated the fundamental right to protection of personal data
              Data against the right to freedom of expression and information
              to give priority to freedom of action (cf. most recently the judgment of September 24
              2019, C-136/17, para. 66).


              The data protection authority is of the opinion that the simple legal provisions
              9 paragraph 1 DSG, in any case not the basic
              undermine the right to data protection according to § 1 DSG in the context of media privilege
              able and also within the scope of the 'media privilege' from the stock of
              § 1 DSG as well as a limited competence of the data protection
              according to § 24 DSG.

              It should already be noted at this point that neither § 1 DSG nor
              Art. 7 B-VG in conjunction with Art. 2 StGG and from Art. 83 B-VG a responsibility of the data
              protection authority can be derived. Art. 8 EU-GRC also reveals how more precisely

              is to add that no unrestricted competence of the data protection authority
              guide.

              Irrespective of this, according to the case law of the Supreme Court, what is even closer
              will have to be addressed, the basic right to data protection according to § 1 DSG immediately
              be asserted before the civil courts, so that in any case a legal
              protective route is opened.

              According to the data protection
              authority therefore whether the (partial) exclusion of the competence of the data protection

              authority within the scope of Section 9 (1) DSG is contrary to equality because this
              if only the (chargeable) legal protection route to the civil courts is opened.

              a) On the wording of Section 9 (1) DSG

              § 9 para. 1 DSG reads 'freedom of expression and information'
              as follows (emphasis added by data protection authority):


     26 of 71 G 287/2022-16,
                                                                                 G 288/2022-14
                                                                                 14.12.2022




On the processing of personal data by media owners, he-
Publishers, media workers and employees of a media company
or media service within the meaning of the Media Act – MedienG, BGBl.
No. 314/1981, for journalistic purposes of the media company or
Media service can find the provisions of this federal law as well as of the
GDPR chapters II (principles), III (rights of the data subject), IV
(Responsible and processor), V (Transfer of personal
Data to third countries or to international organizations), VI (Independent

Regulatory Authorities), VII (Cooperation and Consistency) and IX (Regulations for
special processing situations) no application. The data protection authority
exercise their powers over those named in the first sentence
persons to observe the protection of editorial secrecy (§ 31 MedienG).

In § 9 para. 1 DSG, the previous data protection law 'media privilege' is replaced
Section 48 DSG 2000, Federal Law Gazette I No. 165/1999 as amended to Federal Law Gazette I No. 132/2015, with an expanded version
Scope transposed into the GDPR system. The national reg-
The provision in § 9 DSG is linked to Art. 85 GDPR, a basic provision including
Opening clause, to (see Suda/VeiglinGantschacher/Jelinek/Schmidl/Spanberger,
Data Protection Act, § 9 Rz 1, still with reference to § 9 DSG in the version of Federal Law Gazette I No. 120/2017

[Data Protection Amendment Act 2018]).

recital 153 of the GDPR, which refers to Art. 85, reads as follows […]:

'In Member State law, the rules on freedom of expression should
and freedom of information, also by journalists, scientists, artists
learners and/or writers, with the right to protection of personal data
data are reconciled in accordance with this regulation. For processing
use of personal data exclusively for journalistic purposes or
for scientific, artistic or literary purposes, deviations should

modifications and exceptions to certain provisions of this regulation apply,
if this is necessary to exercise the right to protection of personal data
with the right to freedom of expression and information, such as
it is guaranteed in Article 11 of the Charter to reconcile. This should
special for the processing of personal data in the audiovisual field
as well as in news and press archives. Member States should
forth Legislative measures to regulate derogations and exceptions
enacted, which are necessary for the purpose of weighing up these fundamental rights
are done. Member States should make such derogations and exceptions in
reference to the general principles, the rights of the data subject, the

responsible and the processor, the transmission of personal
collected data to third countries or to international organizations that are independent
pending supervisors, cooperation and consistency and special
data processing situations. Should these deviations or
vary from Member State to Member State should the law
of the Member State to which the controller is subject. Around
the importance of freedom of expression in a democratic


                                                                                 27 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              Society must take into account terms such as journalism, which relate to
              this liberty be construed broadly.'

              First of all, it is noticeable that § 9 Para. 1 DSG contains a restriction to a certain
              professional group ('classic media companies'), although Art. 85 para. 2
              DSGVO such a restriction is foreign and only to a 'processing
              journalistic purposes'.

              The restriction to a specific professional group standardized in Section 9 (1) DSG

              was in the originally planned implementation of Art. 85 Para. 2 GDPR by § 9
              idF BGBl. I No. 120/2017 also not provided (cf. RV 1664 dB XXV. GP, at that time
              still § 27).

              The ECJ follows settled case law in relation to the former Art. 9 of the
              Directive 95/46/EG - the counterpart provision of now Art. 85 DSGVO - da-
              assumes that the exemptions provided for in Article 9 of Directive 95/46/EC and
              Exceptions apply not only to media companies, but to anyone who
              works as a journalist (cf. the judgment of the ECJ of February 14, 2019, C-345/17,
              Rn 52 and the Rsp cited there).


              A direct application of Art. 85 Para. 2 GDPR with non-application
              of § 9 Para. 1 DSG is excluded, however, since the former provision does not
              any provision, but only to the instructions addressed to the Member States
              contract contains, corresponding legal provisions for certain processing situations
              ations (cf. Schiedermair in Ehmann/Selmayr, data protection
              Basic Regulation Comment [2018] Art. 85 margin nos. 1 and 9). Apart from that is
              Art. 85 para. 2 GDPR - unlike Art. 58 para. 5, to which the ECJ has a direct
              Applicability Acknowledged - Not Sufficiently Determined To
              to ensure applicability (see the judgment of the ECJ of June 15
              2021, C-645/19, from paragraph 106, in particular paragraph 112).


              An interpretation of Section 9 (1) DSG in the light of the case law mentioned
              of the ECJ would - by implication - lead to any data processing
              for 'journalistic purposes' of the verification by the data
              protection authority. According to the stRspdesEuGH, exceptions and
              Reduce privacy restrictions to what is absolutely necessary
              limit (cf. again the judgment of the ECJ of February 14, 2019, C-345/17,
              Rn 64 and the Rsp cited there).

              For this reason, the data protection authority - after an initially very broad

              Interpretation of § 9 Para. 1 DSG (see Blocher/Wieser, Von privilege-
              journalists and data in (almost) a legal vacuum, in Jahnel (ed.), Da-
              data protection law. Yearbook 19 (2019), p. 314 and the case law cited there)
              - in their jurisprudence to interpret § 9 para. 1 DSG 'narrower'
              and thus a limited competence to deal with complaints
              affirm.



     28 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



A 'privilege' in the sense of the incompetence of the data protection authority can
accordingly, only certain actors, namely 'media owners, publishers,
servants and employees of a media company or media
service within the meaning of the MedienG', and only claim it if
they personal data 'for journalistic purposes of the media company
mens or Mediendiensts' process.

In other words: Only this strict double bond - namely certain
expensive and specific purpose - which is expressly provided for in § 9 Para. 1 DSG,

causes 'the provisions of this federal statute and' certain chapters
of the GDPR do not apply.

A word interpretation thus shows that § 9 para. 1 DSG is a responsibility of
Data Protection Authority not fully responsible for handling complaints
closes.

b) For data processing for journalistic purposes

Apart from that, both the CJEU and the ECtHR have certain criteria
rien developed to define journalistic activities, leading to that

not any data processing in the journalistic context also a data processing
work for journalistic purposes.

A processing of personal data for 'journalistic purposes' lies
according to the understanding of the ECJ only if the processing exclusively
has the objective of disseminating information, opinions or ideas to the general public
spread (cf. judgments of the ECJ December 16, 2008, C-73/07, para. 61, and dated
14 February 2019, C-345/17, paragraph 53). Although this Rsp. still on Art. 9
of Directive 95/46/EC, which - as already mentioned - as a pendant
consent to Art. 85 GDPR is to be understood.


It can therefore not be assumed that any (on the Internet) published
public information relating to personal data, under the
Term of 'journalistic activities' would fall and therefore for them in Art. 9 of
Directive 95/46/EG (now Art. 85 Para. 2 DSGVO) intended deviations
Exceptions apply (see again the judgment of the ECJ of
14 February 2019, C-345/17, paragraph 58).

Rather, publications must meet a minimum level of journalistic processing
exhibit. Of importance is the hurdle of minimum processing

especially for online information offers. In its jurisprudence on assessment-
sports, the German BGH has a sufficiently journalistic-editorial ni-
veau, which could justify its data protection privilege, only
then accepted 'if the opinion-forming effect for the general public
is a defining part of the offer and not just a decorative accessory'. at
the specific demarcation from when information on a website



                                                                                  29 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              crossing the threshold of journalism is a decision
              which is to be made on a case-by-case basis using the criteria developed by the ECJ.

              These are cumulative criteria and in the case of the 'no'
              one of the mentioned criteria of the inapplicability of the 'media privilege'
              and thus to assume that the data protection authority is responsible for what the
              Data protection authority taken into account in their case law (cf. notice of
              DSB of August 19, 2019, GZ DSB-D123.957/0003-DSB/2019).


              c) On the (limited) competence of the data protection authority

              The wording of § 9 Para. 1 DSG includes a responsibility of the data protection
              hear only in the presence of the already mentioned 'double bond'.

              The data protection authority therefore considers - in the absence of these prerequisites
              stipulations - for the content treatment as responsible, but within the framework of
              balancing the right to freedom of expression and freedom of information
              Art. 11 EU-GRC or Art. 10 ECHR to be taken into account.

              For this purpose, the ECtHR has developed relevant criteria that are used for this goods weighing

              are to be tightened (see again the judgment of the ECJ of 14 February 2019,
              C-345/17, para. 66 with reference):

              - contribution to a debate of general interest,
              - degree of familiarity of the data subject,
              - subject of reporting,
              - previous behavior of the data subject,
              - Contents,
              - form and impact of publication,
              - way as well

              - circumstances under which the information was obtained,
              - correctness

              This is to be illustrated using the following examples:

              - The data protection authority stated in its decision of September 9, 2019, DSB-
              D124.274/0007-DSB/2019, stated that a Facebook post by a fellow
              worker of a media company does not fall under Section 9 (1) DSG if the
              Facebook posting is written on the employee's private Facebook profile
              and this Facebook posting also has no recognizable reference to the media

              company. In recognition of the BVwG of November 20, 2020, W274
              2224363-1/18E, this has the statements of the data protection authority on the
              enprivileg confirms and records that postings by a private person (himself
              if she is a journalist) who publishes on her private Facebook profile
              are not included in the scope of media privilege.
              - The data protection authority also explained itself in this sense in its decision
              of December 2, 2019, DSB-D124.352/0003-DSB/2019 (RIS), for the decision


     30 of 71 G 287/2022-16,
                                                                                   G 288/2022-14
                                                                                   14.12.2022



about the production of photographs of a police official act and
the subsequent publication of these recordings on a private Facebook
book account because there was no 'double bond' in the above sense.
- Furthermore, the data protection authority held in its decision of 19 February
2021, D124.3022, 2021-0067945, states that for attribution of a posting
to the media company a necessary connection with the journalistic
cal activity is to be assumed and this is therefore not available when postings
completely without journalistic control and editing and solely from your own
Drive the user to be published.

- In the notification of December 18, 2019, DSB-D123.768/0004-DSB/2019 (RIS).
the data protection authority stated that the fact that a Facebook
site is maintained by a media worker from a political party
inevitably leads to processing for journalistic purposes. Because that
The aim here is not the content of the medium, but much more
extensively influencing state decision-making through political activity
senior In this context, media activity can therefore only be viewed as a 'ne-
'phenomenon' in the course of the intended achievement of these goals
will.
- Also the note that an editor no longer works for a media company
company may be of 'interest' to individual readers and in

of a person's natural 'curiosity', but must under no circumstances
be mistaken for a certain 'interest in a certain topic' and
therefore does not fall under 'processing for journalistic purposes' (cf. the
Decision of the Data Protection Authority of February 19, 2021, D124.3022, 2021-
0,067,945).
-In this context, the BVwG in its finding of December 15th
2021, W176 2245370-1, already stated that rating platforms
do not fall under the term 'journalistic purposes'.

It also follows from the above statements that § 9 Para. 1 DSG does not include a total

exclusion of certain rights and the competence of the data protection authority
works.

Ultimately, the legislature itself seems to have a 'residual responsibility' for the data
protection authority than is stated in the last sentence of Section 9 (1) DSG,
that 'the Data Protection Authority, when exercising its powers vis-à-vis the im
persons mentioned in the first sentence the protection of editorial secrecy (§ 31
MediaG) to be observed'. However, the legislature assumed that
that no competence of the data protection authority within the scope of § 9
Para. 1 DSG existed, the last sentence of Para. 1 would be completely meaningless, what the

However, the legislature cannot be assumed.

This can be confirmed in particular from the overall constellation of Section 9 (1).
DSG. In the first sentence, both the jurisdiction and the powers of the
Data Protection Authority under the conditions of application explained above




                                                                                   31 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              excluded and therefore the second sentence can logically only be based on those
              refer rich, in which the 'media privilege' does not apply
              comes.

              The BVwG also seems to have followed this view by
              trag points out that 'the last sentence of § 9 paragraph 1 DSG assume
              seems that the data protection authority is very comfortable with complaints against
              Media companies and owners have powers.'


              d) On previous case law of the Constitutional Court

              The Constitutional Court has already in its decision of 8 October
              2015, G 264/2015, with the - with § 9 Abs. 1 DSG comparable - § 48 DSG 2000
              (Federal Law Gazette I No. 165/1999 as amended to Federal Law Gazette I No. 132/2015).

              In this regard, the Constitutional Court has stated that 'even with a [...]
              extensive area of application of § 48 DSG 2000 […] the standard therein
              Media privilege [...] not all cases of communications protected by Art. 10 ECHR
              tion and freedom of information[recorded].[…]There[are]case constellations in which
              - in the absence of applicability of § 48 DSG 2000' - thus the simple legal

              provisions of the DSG 2000 apply.

              The data protection authority does not overlook the fact that the said decision
              basically the unconstitutionality of § 28 para. 2 DSG 2000
              and § 48 DSG 2000 was only peripherally affected.

              Nevertheless, the Data Protection Authority takes the view that in the
              mentioned knowledge is expressed with sufficient clarity that § 48
              DSG2000 through exceptional case constellations, in which the simply statutory
              Provisions of the DSG 2000 - and thus also the provisions on the

              authority of the data protection commission/data protection authority – to apply
              ten.

              Thus, the Constitutional Court went from a limited jurisdiction
              the Data Protection Commission/Data Protection Authority within the framework of media privacy
              lay out

              In the opinion of the data protection authority, these considerations are based on Section 9 (1) DSG
              transferable.


              e) Summary considerations

              In summary of what has been said, the data protection authority therefore represents the
              view that § 9 para. 1 DSG cannot be qualified a limine as unconstitutional:

              A lack of competence of the data protection authority to handle complaints
              according to § 24 DSG in conjunction with Art. 77 DSGVO because of an alleged violation in


     32 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



The right to secrecy according to § 1 Para. 1 DSG therefore only exists if
personal data used by certain actors for certain purposes
be worked. § 9 DSG is therefore doubly narrower than the specification of the
DSGVO (cf. Forgó, data protection assessment of publicly accessible
Evaluation platforms of teachers using the example of 'learning victory',
2020, p. 15). The privilege is thus technology-neutral and can be dynamic
Developments in the market including newly created journalistic offers
(cf. [Forgó], ibid., p. 21).


A competence of the data protection authority is to be affirmed if this prerequisite
not apply (e.g. processing of personal data in the
men of an Internet blog operated by a private person, etc.).

A competence of the data protection authority is also to be affirmed if the
processing of personal data takes place in a context that is not considered 'journal
nalistical activity' can be viewed (e.g. subscription management).

It can therefore not be said that § 9 para. 1 DSG the assertion of the
Fundamental right to data protection according to § 1 DSG before the data protection authority
'[undercuts]'.


3.2. Regarding the concerns regarding the principle of equality according to Art. 2 StGG
and Art. 7 B-VG

As the BVwG explains, the objectivity check of laws aims at
evaluation of the relation of the facts covered by a regulation to the
legal consequences. If there are different regulations, a nor-
to carry out a comparison, it must be asked whether the
Facts are so different that they have different legal consequences
able to 'carry' (VfSlg. 16.635/2002, 17.309/2004).


Within these limits, however, the legislature is constitutionally free to do so
not prevented from adapting his political objectives to those he deems appropriate
to be pursued in this way (cf. VfSlg. 13.576/1993, 13.743/1994, 15.737/2000,
16.504/2002).

From the point of view of the principle of equality, it is therefore not possible to judge whether
a regulation is expedient or whether it is the optimal way to achieve the goal
is taken (cf. VfSlg. 11.288/1987), but it is subject to the legislature
to oppose the aspect of the principle of equality only if this

when determining the means to be used, the constitutional ones
exceeds barriers. This is particularly the case when he
The principle of equality violates the resulting objectivity requirement, so if he to
goal attainment provides completely unsuitable means or if the provided ones
appropriate means to an objectively unjustifiable differentiation
ren (cf. e.g. VfSlg. 12.227/1989).



                                                                                  33 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              In the light of the case law of the Constitutional Court, it is the legislature
              But also not prevented from making simple and easily manageable regulations,
              serving administrative economy (cf. VfSlg. 9645/1983 and 11.775/1988).
              The legislature may use an average
              go out and typify his regulations (cf. VfSlg. 11.469/1987
              and 13.726/1994).

              In the opinion of the data protection authority, however, in the present case there are very
              factual reasons that justify a differentiation:


              § 9 para. 1 DSG privileges 'classic media' (in the sense of 'institutionalized
              Form 'of freedom of expression') to the effect that the ordinary legal
              Provisions of the DSG and certain chapters of the GDPR - and thus the
              permanent of the data protection authority - do not apply.

              From the point of view of the principle of equality, it must therefore be assessed whether this difference
              differentiation between 'classical media' and 'other media' justified
              is.

              a) On the case law of the Constitutional Court


              The Constitutional Court itself, in its decision of March 4, 2021,
              GZ E 4037/2020, referring to the 'special importance' of the 'classic media'
              reported, because in a democratic society they have the role of a 'guard
              dogs' come.

              It follows, according to the DPA, that due to the role that
              'classical media', a privilege in the sense that the processing
              processing of personal data is not under the control of the data protection
              authorities - but only the courts - is quite objectively justifiable

              may be necessary.

              b) On the historical development of 'media privilege'

              Furthermore, it corresponds to the historical will of the legislature to
              legal matters exclusively to the MedienG - and thus the judicial
              chen jurisdiction – to submit:

              The 'media privilege' was in its original version in Section 54 of the Data Protection Act
              zes, Federal Law Gazette No. 565/1978. In the stenographic record of the 104th session

              of the National Council in the XIV legislative period on October 18, 1978
              is stated in this regard:

              'First, we limit the effectiveness of the Data Protection Act to the
              version of this law for the media and we say something else: But
              this media privilege, which only applies until a media law is passed



     34 of 71 G 287/2022-16,
                                                                                   G 288/2022-14
                                                                                   14.12.2022



only apply to companies that are dedicated exclusively to media purposes
men' (p. 36).

The Committee Report 1978, 1024 dB XIV. GP, states the intention that
during the deliberations on the government bill for a media law, the
ken of data protection would receive due attention.

In the stenographic protocol of the 91st session of the National Council in the XVI. sex
legislative period on May 22, 1985, the media privilege is as follows

passage:

'We have the media privilege in passing the Data Protection Act
granted, a so-called media privilege. We said: Yes, the basic right of the
Data protection, the human right standardized by the Council of Europe, is intended for
the media already apply, but otherwise the media legislator in the media
setindividualruleshowitshouldappearinthemediaarea.Andhavethat
we then overlook. Therefore, the media are exempt from the fundamental right, and
there are no special regulations for this in the Media Act. […] I believe that
was a mistake by the legislature, and it actually raises a characteristic
light on the situation.' (p. 51).


Incidentally, the stenographic minutes of the 151st session of the National
nalrates in the XVI. Legislative session on June 27, 1986 on media privilege
the following passage:

'I'll just give the example of the Media Act. We have the Data Protection Act
decided and said that for the media sector only the constitutional
apply, we leave the simple legal provisions to the
enlegislators, the media law should regulate that. Then what happened? - We
have mutually agreed on the regulation of data protection in the Media Act

waives! Therefore, there is now a media privilege in Austria, and it says that
data protection for the media sector only with its constitutional provision
applies, nothing else' (p. 33).

From a synopsis of the materials it can be concluded that
the historical legislator the matter of the (classical) 'media' as well as the
with associated data protection regulations only the MedienG
wanted to submit.

c) Jurisdiction


The data protection authority does not overlook the fact that an action is probably not based on Art. 79
DSGVO could be supported because § 9 Abs. 1 DSG expressly certain ca-
chapter of the GDPR, in particular Chapters II and III, and thus the assumed
called court the standard of assessment for an alleged violation of
GDPR would be withdrawn.



                                                                                   35 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              However, this does not change the fact that a legal protection option after
              MedienG in connection with § 1 DSG or merely based on § 1 DSG and a
              affected person is not completely unprotected.

              In particular, it is pointed out that a civil law injunction
              according to the judicature of the OGH always directly to the immediately applicable
              Constitutional provision of § 1 para. 1 DSG can be supported (cf.
              6 Ob 148/00h; 9 ObA 73/03f; Ennöckel, The protection of privacy in the electronic
              electronic data processing[,] 211).


              Furthermore, the OGH - with regard to § 48 DSG 2000 - expressly
              said that despite the broad wording of this provision, a
              there is legal jurisdiction to assert claims and § 48
              DSG 200[0] must therefore be 'teleologically reduced' (decision of 17 January
              ner 2018, 6 Ob 144/17w).

              These considerations can be transferred to § 9 Para. 1 DSG:

              Accordingly, in cases in which the data protection
              authority exists, in any case a jurisdiction of the civil courts.


              The third section of the MedienG in particular contains provisions on personal
              privacy protection. These provisions, which, among other things, in § 7 regulations for
              'Violation of the highly personal sphere of life' as well as in § 7a the
              'Protection against disclosure of identity in special cases', can
              here at least as a kind of 'special data protection law' and as a (further) outflow of the
              § 1 para. 1 DSG.

              Thus, the provisions of the Media Act for the interpretation of § 1 DSG can
              get dressed by.


              This results in particular from the repeatedly mentioned 'interests worthy of protection
              eat' of the person concerned and does not allow any other conclusion than that it
              it is an explicitly ordered balancing of interests that forms the basis for
              offers a balance between Art. 8 and Art. 10 ECHR (more on this in Rami
              in Höpfel/Ratz, WK MedienG § 7).

              But also the assertion of other civil law provisions - in particular
              special according to the ABGB - in conjunction with § 1 DSG comes into consideration.


              Likewise, the exclusive possibility of appeal to a court appears in the
              In the event of data processing by 'media owners, publishers, media staff
              Workers and employees of a media company or media service in
              within the meaning of the MedienG for journalistic purposes of the media company or
              Mediendiensts' by no means as unobjective.




     36 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



On the one hand, civil law regulations, in particular the MedienG, allow a
comprehensive weighing of interests, which includes the fundamental right to data protection
pulls.

On the other hand, a court of jurisdiction in media matters can
could hardly be accused of state censorship, which, however,
a responsibility of a - albeit independent and free of instructions -
administrative authority such as the data protection authority would be entirely conceivable.


A claimed 'lack of redress' for those narrow areas that
Prerequisites for the applicability of the 'media privilege' are accordingly
in the opinion of the data protection authority, while maintaining the current
mood at least not apparent.

In addition, it is pointed out that the (rudimentary) data subject rights on
Information, correction and deletion, as provided for in Section 1 (3) DSG,
are in any case not excluded by § 9 DSG (cf. Ehrnberger, Das
Media privilege: Media companies between data protection and information
freiheit, jusIT 2018, 148 (149)) and can therefore be asserted in court
be able.


Therefore, the assertion of the fundamental right to data protection is also within the scope
of media privilege secured.

Furthermore, it must not be overlooked that the procedure before a civil
court - in comparison to the official procedure - definitely for the person concerned
person can be beneficial:

- While the data protection authority only based on the GDPR and the DSG
can divorce, there is no such restriction in courts. § 227 ZPO allowed

tet - subject to the conditions - that multiple claims are asserted in one action
can be made (cf. Schmidl, The dual legal protection in data
protection matters, VbR 2020/104). In this regard, for example, when taking pictures or
Evaluation platforms the general right of personality according to § 16 ABGB, Eh-
Ren insult and damage to reputation according to §1330 ABGB as well as the right to your own
Image under § 78 UrhG under consideration. In addition, any claim for damages
replacement (see Art. 82 GDPR) only in the civil court at the same time as an
requests for release are asserted [...] (cf. Jahnel, comment on the
General Data Protection Regulation, Art. 79 GDPR). In particular, this looks forward
the mere determination competence according to § 24 DSG an extended one

area of legal protection.

- A civil court procedure is always associated with a risk of costs
However, the prevailing party has a comprehensive claim in accordance with § 41 ZPO
for reimbursement of costs by the opposing party (cf. Schmidl, Der double tracked
Legal protection in data protection matters, VbR 2020/104).



                                                                                  37 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              - Unlike the DSG, the ZPO knows the legal institution of the comparison in §§ 204 f
              ZPO, which a comprehensive settlement of the legal dispute, including the
              Bearing the costs, enables and according to § 1 Z 5 EO also an execution title
              provides (Schmidl, The dual legal protection in data protection matters, VbR
              2020/104).

              - It is true that from a value in dispute of more than EUR 5,000 and before the court
              1st instance absolute obligation to have a lawyer (§ 27 Para. 1 ZPO), which involves costs
              is bound, however, legal representation can also prove to be advantageous

              point. Unlike in proceedings under the AVG, the following applies in proceedings under the ZPO
              namely the maxim of the parties, so that only what is used by the courts is used in court
              parties and offered as evidence. Also exists on the part
              of the court in these proceedings no (extended) obligation to Manudu-
              tion (§ 182a vs § 432 ZPO). Lawyers can therefore, by virtue of their training and
              their professional obligations (§ 9 Abs. 1 RAO) tend to follow these requirements
              come as unrepresented and legally ignorant parties. A representation by
              a lawyer can also make a significant contribution to an efficient
              lead the race. Also not to be neglected is the fact that
              as a rule, lawyers are better 'trained' for civil court proceedings than for
              the procedure before an administrative authority (cf. Schmidl, Der doppelgleisige

              Legal protection in data protection matters, VbR 2020/104).

              In summary, it can therefore be stated that, even if the civil court
              procedure is associated with costs and risk, it is due to the above considerations
              which cannot yet be regarded as irrelevant, this burden affects
              to hand over to a person.

              d) The competence of the data protection authority is generally not absolute

              The competence of the data protection authority – also and especially under disregard-

              solution of 'media privilege' – is by no means unrestricted.

              For example, Art. 55 Para. 3 GDPR provides that the 'supervisory authorities [...] shall not
              constantly [are] responsible for the supervision of courts in the context of their judicial
              activity carried out' and enables precisely Art. 85 para. 2
              an exception of Chapter VI (Independent Regulatory Authorities).

              In view of the latest developments, reference is made in this context to
              Current preliminary ruling requesting Administrative Court of 14 January
              ner 2022 in case C-33/22. In this case,

              approached the ECJ with the following preliminary question:

              1. Concerns activities carried out by a Parliament of a Member State
              committee of inquiry set up by his right to control
              depending on the object of investigation in the scope of the Union
              right within the meaning of Art. 16 (2) first sentence TFEU, so that the Regulation (EU)



     38 of 71 G 287/2022-16,
                                                                                   G 288/2022-14
                                                                                   14.12.2022



2016/679 (1) on the processing of personal data by a parliament
mental committee of inquiry of a Member State is applicable?

If question 1 is answered in the affirmative:

2. Concerns activities carried out by a Member State Parliament
committee of inquiry set up for his right to control the execution,
of the activities of a police state security authority, thus the protection of
activities related to national security within the meaning of recital 16

the General Data Protection Regulation has as the object of investigation, under the
Exception in Article 2(2)(a) of this regulation?

If question 2 is answered in the negative:

3. If - as in the present case - a Member State has only one single supervisory authority
according to Art. 51 Para. 1 of the General Data Protection Regulation
their responsibility for complaints within the meaning of Art. 77 Para. 1
with Art. 55 Para. 1 of the General Data Protection Regulation already directly from this
this regulation?


It is therefore also fundamentally disputed whether the data protection authority in the event of alleged violations
Last, which are attributable to the state power 'legislature', are invoked
can.

With regard to the DSG 2000, the Constitutional Court has already
kennVfSlg.15.130/1998 clarified that his responsibility of the data protection
Commission under no circumstances vis-à-vis the legislature and its auxiliary bodies
stands (cf. also decision of the Constitutional Court of October 3, 2013; B 683/2013) and
a legal recourse to the data protection commission (or another authority)
is excluded (cf. VfSlg. 19.112/2010).


Apart from that, § 32 DSG 2000 already saw no limitless jurisdiction
area of the data protection commission/data protection authority:
affected person generally alleged violations of the DSG 2000 - with
exercise of the right to information – vis-à-vis a client of the private
area before the ordinary courts [enforce ], resulting in a
resulted in a much greater restriction of legal protection than in Section 9
Para. 1 DSG is currently the case.

In summary, it can therefore be stated that even the DSG 2000

No comprehensive competence of the Data Protection Commission/Data Protection
heard. The GDPR does not provide for this either.

Also from Art. 8 EU-GRC no comprehensive competence of the supervisory
derive authority.




                                                                                   39 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              e) On the legal situation in other Member States

              In addition, it is pointed out that such an exclusion of the
              consistency of the supervisory authorities in accordance with Art. 85 GDPR also from other members
              member states has been implemented.

              In order to be able to create a comparison, the objective combination
              initially referred to the German legal enactment. So the da-
              data protection laws of the German federal states - the legal competence for this

              are responsible - for example the following provisions:

              - Bavarian [Data Protection Act] (BayDSG):

                  Art. 38 Processing for journalistic, artistic or literary purposes
                                         Purposes (to Art. 85 GDPR)

              (1) If personal data is used for journalistic, artistic or li-
              processed for teric purposes, the data subjects are only entitled to the
              Para. 2 rights mentioned. For the rest, the processing within the meaning of Art
              Sentence 1 Chapter I, Art. 5 Para. 1 Letter f, Art. 24 and 32, Chapter VIII, X and XI

              GDPR. Art. 82 GDPR applies with the proviso that only for insufficient measures
              according to Art. 5 Para. 1 Letter f, Art. 24 and 32 DSGVO.
              (2) Does the journalistic, artistic or literary processing of personal
              personal data for the dissemination of counter-notifications, for
              declarations, judicial decisions or revocations, are these to the
              stored data to keep there for the same length of time as the
              data itself and in the case of a transmission of the data together with this
              average

              - Law on the protection of personal data in the Berlin administration (Berlin

              ner data protection law - BlnDSG):

               § 19 Processing of personal data for purposes of freedom of expression
                                    expression and freedom of information

              (1) Insofar as personal data are processed in exercise of the right to freedom of expression
              freedom of expression and information on journalistic, artistic or literary
              ric purposes, including lawful processing based on
              Sections 22 and 23 of the law relating to copyright in works of the visual arts
              arts and photography in the Federal Law Gazette Part III, classification

              number 440-3, revised version published, last amended by Article 3
              § 31 of the law of February 16, 2001 (BGBl. I p. 266) has been changed,
              work, apply from Chapters II to VII and IX of the Regulation (EU)
              2016/679 only article 5 paragraph 1 letter f and article 24 and 32. article 82 of
              Regulation (EU) 2016/679 applies with the proviso that liability only damages




     40 of 71 G 287/2022-16,
                                                                                 G 288/2022-14
                                                                                 14.12.2022



includes, through a violation of data secrecy or through inadmissible
sufficient technical or organizational measures within the meaning of Article 5
Paragraph 1 letter f of Regulation (EU) 2016/679.
(2) Leads to the processing of personal data in accordance with paragraph 1 sentence 1
Dissemination of counter-statements by the data subject or to
declarations, resolutions or judgments on the omission of the dissemination
tion or about the revocation of the content of the data, these are among the stored
ten data and keep it there for the same length of time as the
to transmit data itself, and when transmitting the data together.


- Hessian Data Protection and Freedom of Information Act (HDSIG):

                            § 1 Scope

(1) The provisions of this law, with the exception of Section 28, do not apply
notification, insofar as Hessischer Rundfunk uses personal data for journalistic
processed for public purposes.


Similar provisions can be found in

- Data protection law for the state of Mecklenburg-Western Pomerania (state data protection
law - DSG M-V) and in the
- Law on the protection of personal data in the state of Brandenburg (Branden-
Burgisches Data Protection Act - BbgDSG)

At the same time, Art. 11 of the Bavarian Press Act standardizes regulations on
protection of personal data and the possibility of a complaint
Art. 77 GDPR to the institutions of voluntary self-regulation (and thus
not to the supervisory authority according to the GDPR).


Something similar is in § 22a of the Berlin Press Act and § 10 of the Hessian Press
provided for by law, however without express reference to the legal
protection options.

The comparison with the German legal situation shows that it is by no means unusual
is, in the respective data protection laws no responsibility of the data
protection supervisory authorities and parallel to this in the respective press
laws to standardize corresponding protective provisions.


The Dutch Data Protection Act ('Act of 16 May 2018 with Enforcement
provisions of Regulation (EU) 2016/679 of the European Parliament
and of the Council of 27 April 2016 on the protection of natural persons in the
processing of personal data, free data movement and cancellation
of Directive 95/46/EG (General Data Protection Regulation) (OJ EU 2016, L 119)
(General Data Protection Regulation)') contains Art. 43 the following regulation [in-
formal translation of the data protection authority]:



                                                                                 41 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



                 Exceptions for journalistic purposes or academic, artistic or
                                         literary forms of expression

               (1) With the exception of Articles 1 to 4 and 5 paragraphs 1 and 2, this Act does not apply
               for the processing of personal data to exclusively journalistic
               purposes and for the benefit of academic, artistic or literary
               shear forms of expression.
               (2) The following chapters and articles of the regulation do not apply to the processing
               processing of personal data for purely journalistic purposes and for academic

               mixed, artistic or literary forms of expression:
               a. Article 7(3) and Article 11(2);
               b. CHAPTER III;
               c. Chapter IV, with the exception of Articles 24, 25, 28, 29 and 32;
               i.e. CHAPTER V;
               e. CHAPTER VI; and
               f. CHAPTER VII.
               (3) Articles 9 and 10 of the Regulation shall not apply to the extent that the
               processing of the data referred to in these articles for journalistic purposes or
               required for academic, artistic or literary expression
               is.


               The Irish 'Data Protection Act 2018' provides in its Section 43 the following provisions
               statement before [informal translation of the data protection authority]:

                         Data processing and freedom of expression and
                                              Freedom of Information

               (1) The processing of personal data for the purpose of exercising the
               Right to freedom of expression and information, including processing
               for journalistic purposes or for purposes of scientific, artistic

               eral or literary expression, is subject to compliance with a
               mentioned provision of the data protection regulation except if the
               Compliance with the provision given the importance of the right to free speech
               expression of opinion and information in a democratic society with these
               purposes would not be compatible.
               (2) The provisions of the data protection law mentioned for the purposes of paragraph 1
               Regulation are Chapter II (Principles), with the exception of Article 5(1).
               Letter f, Chapter III (Rights of the data subject), Chapter IV (Responsibility
               chers and processors), Chapter V (Transfer of personal data
               to third countries or international organizations), Chapter VI (independent

               supervisory authorities) and Chapter VII (Cooperation and coherence).
               (3) […]

               Accordingly, this international comparison also confirms that the
               Exclusion of the competence of the supervisory authority is outdated and thus
               subject to objective justification […].



     42 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



A violation of the principle of equality is therefore in the opinion of the data
protection authority not visible.

3.3. On concerns about the right to a statutory judge
(Art. 83 para. 2 B-VG)

The right to a procedure before the statutory judge is determined by the decision
of an administrative authority if the authority violates a
coming jurisdiction claims (e.g. VfSlg. 15.372/1998,

15.738/2000, 16.066/2001, 16.298/2001 and 16.717/2002) or if they are
unlawfully rejects their jurisdiction, for example by wrongly accepting a
Substantive decision refused (e.g. VfSlg[.]15.482/1999,15.858/2000,16.079/2001
and 16.737/2002).

This constitutional norm binds not only the enforcement, but also the
giving. This means that the substantive jurisdiction of an authority in law
must be determined (cf. decision of the Constitutional Court of September 25, 2020,
G 222/2020). The legislature has to ensure that one thing is not both
can be dealt with by the court as well as by an administrative authority (cf.
Decision of the Constitutional Court of June 19, 1989, B 1874/88).


Jurisdiction shall not depend on circumstances
unforeseeable and an arbitrary change of jurisdiction
(VfSlg. 14.192/1995; VwGH October 4, 2018, Ro 2018/22/0001). the
Boundaries must be clearly and unambiguously recognizable for them (VfSlg. 19.991/2015
regarding legal protection in the field of criminal police; Muzak, B-VG Art. 83, margin no. 3).

Basically, 'shared' responsibilities are unproblematic in the sense that the
legislature in a particular matter part of a procedure of the
one and the following part of the procedure by another administrative authority

authority (or a court) can be carried out (VfSlg. 4693/1964). So there is
In other words, because of Art. 83 Para. 2 B-VG even then no right to that
the legislature a single authority to decide on a particular
circumstances of life if he is under the jurisdictional perspective
points would be possible (cf. Zußner in Kahl/Khakzadeh/Schmid, commentary on
Federal constitutional law B-VG and fundamental rights Art. 83 B-VG, margin no. 13).

As the BVwG explains, if there is a 'double bond' in § 9 Para. 1 DSG
no competence of the data protection authority.


A civil court jurisdiction to assert the fundamental right to data
However, data protection is given, as explained above.

In the opinion of the data protection authority, the regulation of the (in)competence of
Data protection authority in § 9 para. 1 DSG also foreseeable and factually concrete
compared to the jurisdiction of the civil courts. This also illuminates an
international comparison as above.


                                                                                  43 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022




               3.4. Regarding the concerns regarding 'Art. 8 EU GRC'

               Art. 8 EU-GRC guarantees the data subject the protection of those concerned
               personal data and provides that compliance with these regulations

               is monitored by an 'independent body'.

               However, this does not mean that Art. 8 EU-GRC creates a comprehensive
               ability of the supervisory authorities can be derived: Whether namely from the order
               8 Para. 3 EU-GRC an objective legal component of the data
               protection or (beyond the organizational-legal character of the regulation)
               an institutional guarantee results, given the abstract formulation of the
               Para. 3 unclear (cf. Riesz in Holoubek/Lienbacher, GRC comment Art. 8, para. 80).


               A synopsis with Art. 52 Para. 1 EU-GRC also makes it clear that from
               Art. 8 para. 3 EU-GRC can be deviated from.

               It is pointed out that Art. 8 EU-GRC does not go beyond the constitutional
               mood of § 1 DSG has protective content (cf. the dg. cognition
               of September 29, 2012, B 54/12 etc.) and the wording of Art. 8 Para. 3

               [EU-GRC] it also cannot be inferred that a right to treatment of
               by a subordinate agency (cf. Riesz in Holoubek/Lienba-
               cher, GRC comment Art. 8, para. 81).

               Art. 51 f GDPR (in a legally unifying manner) now regulates the
               dependency of the supervisory authorities at member state level and in de-
               the judicature of the ECJ that specifies this postulate, which in particular
               particular in explicit congruence with Art. 8 Para. 3 EU-GRC (cf.
                                                               2
               Riesz in Holoubek/Lienbacher, GRC comment Art. 8, para. 78).

               In this context, reference is again made to what was said above (item 3.2.).
               grasslands.

               4. Summary

               According to the data protection authority, Section 9 (1) DSG is currently in force

               Version accessible to a constitutional interpretation. In particular is
               no complete exclusion of the competence of the data protection authority.

               An exclusive jurisdiction of the ordinary courts according to § 1 DSG in
               scope of § 9 para. 1 DSG in those cases in which no jurisdiction
               given by the data protection authority, is not to be regarded as irrelevant and can
               moreover no violation in the right of the legal judge and in view
               be seen on Art. 8 EU-GRC."






     44 of 71 G 287/2022-16,
                                                                                    G 288/2022-14
                                                                                    14.12.2022



7. In the Ver- 17
drive returned the data protection authority a statement in which they first on

the statement just reproduced in the proceedings G 287/2022. dar
In addition, the DPA carries out the following (without the original

included highlights):

"Since one of the parties involved is a legal entity [...]
delt, the following is added:
The Union law provisions on the protection of personal data

(Art. 8 EU-GRC, Art. 16 TFEU and the GDPR) only apply to the processing
processing of personal data of natural persons. Legal persons
are only protected insofar as their designation is the name of a natural
person appears (see the judgment of the ECJ of November 9, 2010,
C-92/09 and C-93/09, margin nos. 52 and 53).

This is not the case with the legal entity with the company […].

Consequently, it cannot rely on the protection of Art. 8 EU-GRC and the GDPR
and disregard considerations under Union law in this regard

to stay.

It is therefore a matter that exclusively belongs to the Austrian
is subject to national law.

3. Since § 1 DSG does not distinguish between natural and legal persons
separates, a legal entity is still protected within the scope of § 1 DSG.

As explained in the initial decision, the data protection authority takes the view that
that within the scope of § 9 Para. 1 DSG, considered in the light of § 1 DSG,
even if it is a case that is not covered by Union law

is recorded, nevertheless no responsibility for the treatment of complaints
of ristic persons (emphasis in the original):

D.1. For the application legitimacy of legal entities

[...]

According to the will of the legislature, the simple statutory provisions
of the DSG, including the complaint according to § 24 DSG, therefore on the protection of
limited to natural persons.


However, the data protection authority has already stated several times that § 1
DSG also protects legal persons. An interpretation of the ordinary law
Provisions - in particular §§ 4 and 24 DSG - to the effect that only natural



                                                                                    45 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              persons the possibility of lodging a complaint before the data protection
              authority, but not to legal persons, would
              against the background of § 1 DSG an equal and thus incompatible
              impute unconstitutional content. The legislature cannot
              that this is a legal entity without any comprehensible reason
              in pursuit of their constitutionally guaranteed rights
              wanted to treat grossly disadvantageously differently than natural persons (see the
              Scheid from May 25, 2020, GZ 2020-0.191.240, with further reference).


              That it is possible for the national legislature to adopt a purely national concept of
              Protection of personal data of legal entities has been
              ECJ affirmed (judgment of December 10, 2020, C-620/19, margin no. 47), so that the above
              The case law of the data protection authority does not conflict with this.

              As a result, this means that legal persons - to the extent of them through
              § 1 DSG granted rights - are entitled to complain.

              However, in order not to impose any unequal and therefore unconstitutional content under § 1 DSG
              the data protection authority can exercise its jurisdiction over legal
              only to the extent that you perceive natural

              certain persons in the same circumstances. § 1 DSG cannot
              be interpreted in such a way that the data protection authority can
              of persons has to deal with in terms of content, those of natural persons with the same
              Chem facts, however, not. This would result in a non-objective justifiable
              Better position of legal entities and thus § 1 DSG an equal
              impute inappropriate content.

              As a result, it can be stated that the second complainant as a legal
              cal person is in principle actively legitimized, a complaint under Section 24
              GDPR before the data protection authority if they claim a violation of the

              § 1 DSG guaranteed rights asserted, but only to the extent to which
              chem this would also be possible for a natural person.

              D.2. On the Competence of the Data Protection Authority and 'Media Privilege'

              On the processing of personal data by media owners, he-
              Publishers, media workers and employees of a media company
              or media service within the meaning of the MedienG for journalistic purposes of media
              The company or media service find the provisions in accordance with Section 9 (1) DSG
              provisions of the DSG and of the GDPR Chapter II (Principles), III (Rights of the

              data subject), IV (responsible person and processor), V (transmission
              transfer of personal data to third countries or to international organizations
              onen), VI (Independent supervisory authorities), VII (Cooperation and coherence)
              and IX (Regulations for Special Processing Situations) do not apply.

              Due to the explicit exclusion of the application of the provisions of
              Chapter III GDPR ('Rights of data subjects') also applies to the exercise of the right


     46 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



Deletion in accordance with Art. 17 GDPR and the exercise of the right to information
according to Art. 15 DSGVO not considered. Legal protection is due to this legal
only according to the provisions of civil law (in particular according to the
enG) possible.

Since § 9 DSG is a simple statutory provision of the DSG,
which, according to the clear wording of § 4 DSG, is not limited to legal persons
is to be applied, it seems at first that the media privilege in connection
dealings with legal persons - thus for the second complainant -

would not apply. In this regard, the data protection
but listen to the explanations under point D.1. As can be seen in this
the explanations given in this point opens up the possibility of de-
Aggravation of legal entities only from an equality conclusion
with natural persons. But if the data processing of the complainant
ners falls under the 'media privilege' and the data protection authority is therefore not responsible
responsible for the decision, then it cannot make any difference whether a
complainant is a natural person or [a legal] person. A lot of-
the data protection authority is therefore incompetent because the data processing
of the Respondent falls under the media privilege."


8. The - as a respondent in the proceedings before the Federal Administrative 18

judge - party involved in the number at the Constitutional Court G 287/2022
recorded proceedings made the following statement (without the original
included highlights):


"A. On the facts

[…]

B. On the application of the Federal Administrative Court


1.
The Federal Administrative Court is of the opinion that Section 9(1) of the Data Protection Act is
unconstitutional. Therefore, an application is made to the Constitutional Court
repeal that provision as unconstitutional.

2.
Contrary to the opinion of the Federal Administrative Court, Section 9 (1) DSG is one
accessible to constitutional interpretation:


[...]

In the opinion of the data protection authority (see the in the present
Proceedings for the first application of the Federal Administrative Court
of the data protection authority of July 26, 2022, page 4 ff) - does not leverage § 9 para. 1 DSG


                                                                                  47 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              the (constitutional) fundamental right to data protection within the framework of the
              Media privileges completely off. We agree with this view. Thus is
              also in the area of application of the media privilege from a restricted access
              consistency of the data protection authority according to § 24 DSG.

              3.
              A lack of competence of the data protection authority to handle complaints
              according to § 24DSGiVmArt77DSGVO because of an alleged violation of the law
              secrecy according to § 1 paragraph 1 DSG only exists if personal

              gene data are processed by certain actors for certain purposes
              the:

              to the privileged actors:
              A lack of competence of the data protection authority can only 'media owners,
              Publishers, media workers and employees of a media company
              or media service within the meaning of the Media Act' (see also
              Application of the Federal Administrative Court W214 2235037-1/21Z of November 3rd
              2022, page 24).

              for the privileged purposes:

              The actors mentioned above are only privileged if they have the personal
              data 'for journalistic purposes of the media company or media
              process services'.

              5.
              Therefore, it is not true that Section 9 (1) DSG enshrines the fundamental right to data protection
              § 1 DSG factually undermined (however, according to the application of the Federal Administrative Court W214
              2235037-1/21Z of November 03, 2022, page 15).

              6.

              Art83Abs2B-VG standardizes the right to a procedure before the statutory
              ter (the Federal Administrative Court also refers to this in its application W214
              2235037-1/21Z of November 03, 2022 on page 20). The Bun
              However, the administrative court fails to recognize that legal protection during processing
              of personal data by 'media owners, publishers, media
              workers and employees of a media company or media service in the
              Within the meaning of the MedienG (...) for journalistic purposes of the media company
              or media services', even without the competence of the data protection authority
              is entirely excluded. Rather, there is a legal protection option
              according to the MedienG in conjunction with § 1 DSG and thus a court of jurisdiction (see

              again the in the present procedure for the first application of the federal administration
              statement by the data protection authority of July 26, 2022, reported to the court,
              page 14ff).






     48 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



Conclusion:

➢ A lack of competence of the data protection authority to deal with complaints
    according to § 24 DSG in conjunction with Art 77 DSGVO because of an alleged violation
    the right to secrecy according to § 1 para. 1 DSG is correct
    when personal data is processed by certain actors ('media
    owners, publishers, media workers and employees of a media
    company or media service within the meaning of MedienG').
    purposes ('for journalistic purposes of the media company or media

    service') are processed.

➢ The exclusive jurisdiction of the ordinary courts according to the
    enG in conjunction with § 1 DSG within the scope of § 9 Para. 1 DSG in those cases in
    which the data protection authority has no jurisdiction is not considered
    unobjective."


9. The - as a complainant in the proceedings before the Federal Administrative Court - 19
parties involved in the number G 288/2022 pro-

tocollated procedures returned the following statement (without the in the original
included highlights):


"1. Facts

[...]

2. Application of the Federal Administrative Court

The BVwG followed the suggestion of the complainants and for its part brought the following
serious concerns about the constitutionality of Section 9 (1) DSG
Before:


− The fundamental right to data protection according to § 1 Para. 1 DSG is enforced by the media
privilege effectively undermined because a person concerned has no national
supervisory authority is available to assert a violation of the fundamental right
more correctly, a national supervisory authority for the treatment
be responsible for handling complaints against media companies. Any deviating
The relevant legal situation would be in conflict with Art. 8 ECHR, Art. 8 para. 1 GRC and
Article 16 (1) TFEU.

−Due to the media privilege, the data protection authority could

gen media companies do not meritically decide what the right to a
procedure before the lawful judge. This also violates the provisions of Article 8
Para. 3 GRC securitized institutional and the legal
protection guarantee.



                                                                                  49 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              − The institutional guarantee of Art. 8 Para. 3 GRC is also violated by the fact that
              the data protection authority does not make use of its remedial powers
              can.

              − The media privilege violates the principle of equality because there are no objective reasons
              can be seen, access to the data protection authority and the civil courts
              to refuse data processing by media companies across the board.

              The BVwG thus recognizes several reasons for an incompatibility of § 9 paragraph 1

              DSG with the Federal Constitution. The complainants agree with this legal view
              and subsequently add the following to the arguments of the BVwG
              the end:

              3. Regarding the prejudice of § 9 para. 1 DSG in the present case

              Do the complainants succeed in their legal view that the media
              vilegal is to be repealed as unconstitutional, this is not to be applied, so that the
              Authority responsibility would lie with the data protection authority and the BVwG
              to revoke the rejection notice as part of the notice of appeal
              would have.


              On the other hand, the Constitutional Court sees this in the provision of Section 9 (1) DSG
              no constitutional incompatibility if the legal view of the data
              protection authority regarding the lack of jurisdiction confirmed by the Court of Justice
              and the BVwG would have to reject the complaint.

              The quoted provision is therefore prejudicial within the meaning of Art 89 Para 2 in conjunction with Art 135
              Para 4 in conjunction with Art 140 Para 1 Z 1 lit. a B-VG.

              4. The fundamental right to data protection is effectively undermined


              4.1 The constitutional provision of Section 1(2) DSG standardizes a substantive
              reservation in such a way that restrictions on the right to secrecy
              only on the basis of laws resulting from those mentioned in Art. 8 Para. 2 EMRK
              reasons are necessary.

              Such laws permit the use of data that is particularly
              are worthy of protection only to safeguard important public interests
              and at the same time appropriate guarantees for the protection of confidentiality
              determine the interests of those affected. Even in the case of a permissible restriction

              the encroachment on the fundamental right of § 1 DSG may therefore only be in the mild
              ten, still leading to the goal can be made.

              However, Section 9 (1) provides for a general exclusion of all rights of those affected,
              by not only complying with the relevant provisions of the GDPR, but even
              § 1 DSG itself is declared inapplicable. This satisfies the requirement
              Restrictions on rights only by establishing appropriate guarantees for the


     50 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



to protect the confidentiality interests of those affected, not in accordance
chen. Not only no reasonable, but no guarantees at all
tien set. However, with regard to the
Proportionality principle only on the basis of a weighing decision
between a justified public interest (here: media report
reimbursement) and the fundamental right to data protection.

The encroachment on the fundamental right to data protection must therefore be suitable, necessary
and be adequate. This may be the case in individual cases; § 9 paragraph 1 DSG permitted

a case-by-case decision, however, by the blanket exclusion of those affected
not right now. Accordingly, the norm applies in disproportionate
ger way in the fundamental right to data protection, because it is the fundamental right in its
Entirely simply undermined.

4.2 As the BVwG explains, the media privilege excludes access for those affected
to the data protection authority according to § 24 paragraph 1 DSG. This with the result that
for data protection-related determination requests and within the scope of the
§ 1 DSG no national supervisory authority for the legal protection against
company is available.


Access to the civil courts according to Section 29 DSG is also restricted due to the media
vilegs excluded. While this the 2nd complainant due to the
personal scope of application of the GDPR is denied from the outset
the 1st complainant the civil courts to deal with the declaratory
and performance requests via the 'detour' of Art. 79 Para. 1 GDPR are not
reasonable because according to this provision also an administrative law
legal remedy must be available. Furthermore, it would be up to the 1st complainant
due to the exclusion of the fundamental right iSd § 1 DSG and the rights of those affected
iSdArt12ffDSGVO by the media privilege also in front of civil courts
possible to enforce these claims.


The complainants is therefore within the scope of media privilege
denied any determination of an infringement.

4.3 However, the complainants must be able to object to any type of processing
personal data checked by an independent body within the meaning of Art 8 Para 3 GRC
to let fen. The legislator ignores this right to access to a
dependent supervisory authority, however, by way of media privilege, and admits
thereby inadmissibly the public interest in the protection of
Freedom of communication, information and the press have completely undifferentiated priority

against the fundamental right to data protection.

Contrary to what is provided for in Art. 52 para. 1 GRC and Art. 8 para. 2 ECHR and Art. 85
Paragraph 1 GDPR as an order to the Austrian legislature
in media privilege just created no legislation that the right to
Protection of personal data with the right to freedom of expression and
reconcile freedom of information. The now anchored in § 9 para. 1 DSG


                                                                                  51 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              Blanket exception does not reconcile the rights mentioned, but concedes them
              Media companies the unobjective privilege, about the fundamental right to
              Data protection and the inspection and defense rights of data subjects simply
              to be able to put away.

              By designing the media privilege as a completely undifferentiated priority
              the public interest in maintaining the rights of opinion, information and
              freedom of the press, the legislature also deprives the complainants of their independent
              mandatory right, processing of personal data by an independent

              pending body to be examined.

              4.4 It may be that the legislature for the processing of personal
              data for journalistic purposes a wide scope of action with the goal
              wanted to put the work of the free press and other journalistically active people
              not to make it unreasonably difficult or even to
              impossible.

              The question of whether the interest in the processing of personal data
              nalistical purposes outweighs the interests of data subjects
              checking the legality of the processing of personal data,

              must, however, be checked and decided by a supervisory authority in individual cases,
              and cannot be imposed across the board by the legislature in the form of media privilege
              be normalized. The last sentence of § 9 Para. 1 DSG is probably in this sense
              read, which the data protection authority in the exercise of its powers to
              Obliged to maintain editorial secrecy in accordance with § 3 MedienG.

              The possibility of a constitutionally required weighing - between the
              Interest of media companies in reporting on the one hand and the
              Interest of data subjects in the secrecy and examination of the
              Legality of the processing of personal data on the other hand -

              The complainants are subject to official or judicial review
              not because of the media privilege.

              5. No trial before the statutory judge

              5.1 The legislature has authority according to objective criteria and
              also to be defined precisely, clearly and unambiguously. This is present by
              instruction to the data protection authority in Art 77 in conjunction with 4 Z 21 GDPR (for the 1st
              complainant) and § 24 para. 1 DSG (for both complainants) in principle
              he follows.


              5.2 However, the media privilege gives the data protection authority the meritorious
              Technical authority to decide on the violation of the fundamental right according to § 1 paragraph 1
              DSG and any other determination and remedy just withdrawn.A
              The legislature has not provided for any other authority
              expectation or impossibility of recourse to the civil courts see point 4.1).



     52 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



The complainants have the right to
In addition, no access to a trial before (any) statutory judge.
This exclusion of access is irrelevant.

5.3 As a result of the media privilege, the Complainants have accordingly in
Austria neither the possibility of compliance with the right to protection of
Appropriate personal data iSdArt8Abs3GRC by an independent
body to be examined, nor can the complainants relinquish their right to
Complaint to the supervisory authority (in the case of the 1st complainant from his

nem according to Art. 77 GDPR or the 2nd complainant according to § 24 para. 1 DSG)
Make use.

Any examination of the processing of personal data by media under
is withdrawn from an examination by an independent body from the outset,
which of course also excludes the question of whether in individual cases in practice
any journalistic activity is pursued with the processing at all.

As the rejection decision of the data protection authority shows, the Medi-
enprivileged to data protection immunity of media companies,
if even a rudimentary journalistic activity can be assumed or

at least this cannot be ruled out. This legal consequence is improper
lich and deprives the complainants of their lawful judge.

6. Breach of Institutional Guarantee

6.1Art8iVm47GRCguarantees an independent body that
for monitoring and checking compliance with regulations for the protection of
ment-related data is ordered and their negative decision by the
national courts can be examined.


Accordingly, the legislature has mandatory - possibly in addition to a civil court
legal protection – to provide for the institution of a supervisory authority.

6.2 As already explained in point 4.1, the procedure before the civil
judge unreasonable or impossible for the complainant. Art 8 para 3 GRC
requires that compliance with the right to protection of personal data
is monitored by an independent body. The responsibility of the data
protection authority as an independent supervisory authority is protected by the media privilege
however excluded.


Accordingly, the Austrian legislature violates media privacy
lay the institutional guarantee set forth in this provision and denies the
Complainants with legal protection interests against media companies
Access to such an independent body.

6.3 With regard to the 1st complainant, this is also reinforced by Art. 77
Para. 1 GDPR, which, without prejudice to any other administrative law


                                                                                  53 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              or judicial remedy, the right to lodge a complaint with a supervisory
              heard guaranteed.

              This right to complain to the Austrian data protection authority
              does not require national implementation and is the regulatory power of the member
              States withdrawn. Art 77 GDPR is only applicable to current, i.e. future
              permanent violations of rights.
              for the 1st complainant are therefore about the direct
              Application of Art 77 GDPR not enforceable at all. Although the data

              protection authority in principle from their remedial powers according to Art 58 DSGVO
              make use of and can, for example, order the information and
              to comply with the complainants' requests for research, but any
              relevant powers in the opinion of the data protection authority by the Me-
              privilege of service excluded.

              As a result, the 1st complainant cannot appeal to his
              anchored right of appeal according to Art. 77 GDPR and the remedial powers of the data
              data protection authority according to Art. 58 GDPR, because the media privilege
              denies access to the institution which, in particular according to Art. 8 para. 3 GRC
              is guaranteed.


              7. Violation of the principle of equality

              7.1 Section 1 (1) DSG stipulates that everyone has the right to secrecy
              relevant personal data, provided that there is a legitimate interest in
              interest in secrecy exists. This right to secrecy comes with it
              benefit not only natural but also legal persons. The 2nd
              Schwerdeführerini is a company established under Austrian law
              limited liability and thus from the personal application and protection
              range of § 1 DSG.


              7.2 Subsequent judiciary, the legislature must equalize the same facts
              create legal consequences. Significantly dissimilar facts, on the other hand, must be allowed
              according to different regulations. Are there different
              successful, the question must be asked whether the facts recorded in each case are so different
              are different in that they justify the different legal consequences. Under-
              different regulations that are not apparent for any reasonable reason
              contrary to equality.

              The media privilege now means that complaints against media companies

              are treated differently than those who oppose other data protection
              direct legal persons responsible. While the latter both an admin
              tive proceedings in the course of a complaint in accordance with Article 77 GDPR or Section 24 DSG
              also a civil proceeding as a result of a lawsuit under Art. 79 GDPR or § 29 DSG
              are exposed, media companies enjoy in the scope of the
              dienprivilegs complete data protection immunity from the data protection
              hörde and the civil courts.


     54 of 71 G 287/2022-16,
                                                                                   G 288/2022-14
                                                                                   14.12.2022




7.3 It is incomprehensible why § 24 Para. 1 DSG, which every person concerned
son - and thus also the 2nd complainant as a legal entity - a right
on complaint, and § 29 para. 1 DSG, which every data subject the
Access to the civil courts opened, in principle for complaints or
Lawsuits should apply against everyone responsible, but not when it is
the person responsible is a media company.

The media privilege means that legal rights directed against media companies

requests for protection without recognizable reasonable reason are treated differently than this
would be the case with other responsible persons. The regulation is accordingly
unobjective and therefore to be repealed as contrary to equality.

7.4 Data subjects have no national supervisory authority
a violation of a fundamental right, another request for a determination or
to assert remedial action. However, this limitation would only apply to
based on the principle of proportionality and only on the basis of a value
constitutionally permissible.

The blanket exception of § 9 Para. 1 DSG privileges journalistic activities

of media companies or media services, however, a priori in the negation of any
cher data subject rights and thus takes disproportionate and consequently wrong
in an unconstitutional manner into data protection law.

This is irrelevant and therefore contrary to equality. Data protection law knows
Verse special regulations for branches, in order to protect their legitimate (economic)
to safeguard or protect interests. This regularly on individual aspects in the
in connection with the processing of personal data and as a result
a weighing of interests anticipated by the legislator in detail.
Media privilege negates the right to protection of personal data and

However, any inspection and remedial authorizations of data subjects are fully granted.

[...]"


10. The Federal Administrative Court returned in the case before the Constitutional Court 20
one procedure each for the numbers G 287/2022 and G 288/2022
Reply, in which the arguments of the data protection authority with more justification

tion counteracts.










                                                                                   55 of 71G 287/2022-16,
G 288/2022-14
    14.12.2022



              IV. Considerations


              The Constitutional Court ruled on the analogous application of § 187 21
              and § 404 ZPO in conjunction with § 35 para. 1VfGG for joint consultation and decision

              related applications under consideration:


              1. Admissibility 22


              1.1. The Constitutional Court is not authorized by its prejudiciary 23
              the requesting court decides on a certain interpretation of the law

              bind, because he thereby indirectly the decision of this court in the main
              che would anticipate. According to the established case law of the constitutional

              richtshofes may therefore apply for Sd Art. 140 para. 1Z 1lit. aB-VG only because of that
              be rejected in the absence of prejudice if it is manifestly incorrect
              (impossible) that the – contested – general norm is a prerequisite

              basis of the decision of the applicant court in the event of a case (cf.
              about VfSlg. 10.640/1985, 12.189/1989, 15.237/1998, 16.245/2001 and

              16.927/2003).


              1.2. If the provision is in obvious contradiction with directly 24
              applicable Union law, the primacy of Union law is also in the

              140 Para. 1 Z 1 lit. a B-VG must be observed
              (VfSlg. 15.215/1998, 15.368/1998, 16.293/2001; VfGH 12.12.2018, G 104/2018

              et al.) and a request under this constitutional provision for lack of
              to reject prejudice.


              A violation of Union law is then to be considered obvious if it is of the kind 25
              obvious that there is no room for reasonable doubt ("acte-clair-

              doctrine"; cf. ECJ October 6, 1982, case 283/81, CILFIT, ECR 1982, I-3415, margin no. 16; VfGH
              December 12, 2018, G 104/2018 etc.).


              1.3. In the literature, there are considerable doubts about the conformity of the 26th

              § 9 para. 1 DSG expressed (e.g. Krempelmeier, Are the data protection regulations
              Privileges of § 9 DSG contrary to Union law?, jusIT 2018, 188 [189 ff.];

              Blocher/Wieser, Of privileged journalists and data in (almost) lawless
              Raum - For a unilateral solution to the conflict of fundamental rights between data protection


     56 of 71 G 287/2022-16,
                                                                                 G 288/2022-14
                                                                                 14.12.2022



and freedom of expression through § 9DSG, in: Jahnel [ed.], yearbook data protection law

2019, 2019, 303 [305 ff.]; Jahnel, photo reporting and data protection, in:
Berka/Holoubek/Leitl-Staudinger [eds.], Privacy and Media, 2019, 73 [84 ff.];

Jahnel/Krempelmeier, Media and data protection in Austria, in: Lachmayer/von
Lewinski [ed.], Data Protection in Legal Comparison, 2019, 179 [186 ff.]). the

Objection to § 9 para. 1 DSG with Union law is in relation to Art. 85
Paragraph 2 GDPR justified.


The Federal Administrative Court follows the opinion of the Constitutional Court 27

conceivable that Art. 85 Para. 2 GDPR is not the
Application of § 9 paragraph 1 DSG. The Federal Administrative Court has
moreover - due to the inseparable connection of all provisions in

§ 9 para. 1DSG (cf. VfGH26.9.2022, G 200/2022 etc.) - the contested regulation
to be applied in its entirety in the tempering process.


1.4. Since there were no other obstacles to the process either, 28

the applications of the Federal Administrative Court as admissible.


2. In case 29


The Constitutional Court decided in a procedure initiated upon application 30
to examine the constitutionality of a law in accordance with Art. 140B-VGonthe

to limit the discussion of the concerns raised (cf.
VfSlg. 12.691/1991, 13.471/1993, 14.895/1997, 16.824/2003). So he has

Finally, to assess whether the contested provision reflects the
given reasons is unconstitutional (VfSlg. 15.193/1998, 16.374/2001,

16.538/2002, 16.929/2003).


The requests are justified. 31

2.1. The applying court lays down the reasons it needs to file the application on 32

Constitutional Court, summarized as follows:


The assertion of the basic right to data protection according to § 1 DSG will be in the 33
Scope of application of § 9 Para. 1 DSG actually "undermined". The one in this




                                                                                 57 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              envisaged exclusion of the applicability of the provisions of the

              Data Protection Act - and thus in particular § 24 DSG - as well as certain
              Chapter of the GDPR has the effect that a data subject is not subject to national
              supervisory authority is available to investigate a violation of the fundamental right to data

              to assert data protection. It is a "flat rate" or "total
              acceptance" of the applicability of data protection regulations. A

              constitutional interpretation is due to the unambiguous wording
              te of § 9 Abs. 1 DSG out of consideration. The processing

              situations data subjects would have the rights to assert a
              breach of data protection law in its entirety.


              According to the case law of the Administrative Court, only 34

              § 24 DSG a person whose basic right to data protection has been violated
              her ability to establish an infringement of rights that has happened to her.
              In the cases mentioned in § 9 para. 1 DSG there is no possibility to

              determine a data protection violation, why the provision
              unconstitutional. Even a judicial assertion is not

              not because Art. 79 GDPR only refers to violations of the GDPR
              but for violations of national legislation. For this reason be the

              Legal protection in the present constellations completely excluded.


              Even if one assumes that the ordinary courts have jurisdiction, 35
              § 9 paragraph 1 GDPR unobjective, because the right to complain to the data protection authority

              can be perceived more easily than when a lawsuit is filed
              the ordinary courts
              the exercise of the right to lodge a complaint with the data protection authority is less than

              in the event of a judicial assertion. In addition, be (also) the ordinary
              chen courts by excluding the applicability of Chapter II of

              GDPR withdrawn from the substantive legal test standard of Art. 5 et seq. GDPR,
              unless one judges this exclusion to be contrary to Union law.


              The blanket exclusion of the applicability of chapters of the GDPR is entitled- 36

              which is not in line with Art. 85 GDPR, which only allows such exceptions if
              as far as this is necessary. An exclusion of any possibility of complaint to the

              However, a supervisory authority is by no means necessary. The data provided for in Section 9 (1) DSG
              any exceptions to the applicability of data protection regulations


     58 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



therefore violated the fundamental right to data protection according to § 1 DSG, the

Principle of equality according to Art. 7 B-VG and Art. 2 StGG, the right to a
drive before the statutory judge according to Art. 83 Para. 2 B-VG, the right to
Protection of personal data according to Art. 8 GRC and the right to privacy

according to Art. 8 ECHR.


2.2. The data protection authority whose decisions were the subject of the complaint before 37
are applying to the Federal Administrative Court, considers this constitutional

The following summarizes the concerns of the Federal Administrative Court
opposite:


The statutory provision of § 9 Para. 1 DSG supersedes the constitutional 38

ranked basic right to data protection according to § 1 DSG not. Also in
Scope of application of the media privilege is of a limited jurisdiction
authority of the data protection authority according to § 24 DSG. § 9 para. 1 DSG

believe that media privileges should be limited to "classic media companies
men", although Art. 85 DSGVO is actually foreign to such a restriction,

because this provision refers to "processing for journalistic purposes"
will tie. The data protection authority is therefore in its case practice to

gone, § 9 para. 1 DSG to be interpreted narrowly and a limited jurisdiction
accept to deal with complaints. Only the in are privileged

Section 9 (1) DSG named actors.


In addition, only data processing that is part of journalistic 39
purposes. According to the case law of the European Court of
European Union is only the case if the processing is solely for the purpose

pursuing to disseminate information, opinions or ideas to the public
ten.For this reason, not every information published on the Internet that

refer to personal data, under the notion of journalistic
Task. Corresponding publications would have to have a minimum level of journalistic

cal editing and a sufficiently journalistic-editorial level
point out. From the ruling practice of the data protection authority it follows that § 9 para. 1

DSG does not lead to a "total exclusion" of the competence of the data protection authority
lead.





                                                                                  59 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              For the reasons mentioned, Section 9 (1) DSG is not unconstitutional; the loading 40

              Mood is also amenable to a constitutional interpretation. It
              only then there is no competence of the data protection authority according to § 24 DSG,
              if personal data by the in § 9Abs. 1 DSG

              would be processed for journalistic purposes. Otherwise it is a responsibility
              given by the data protection authority, for example when processing personal data

              ten as part of a private internet blog. Therefore it cannot be said
              that § 9 Para. 1 DSG completely "off-

              pry".


              2.3. The legal development relevant here and the applicable legal situation represent 41
              are as follows:


              2.3.1. Already § 48 DSG 2000, Federal Law Gazette I 165/1999, which is Art. 9 of Guideline 42
              95/46/EC for the protection of natural persons in the processing of personal

              general data and the free movement of data, OJ 1995 L 281, 31, as amended OJ 2003
              L 284, 1 ("Data Protection Directive"), saw a data protection

              che Special regulation for data processing for journalistic purposes before: So-
              far media companies, media services or their employees data directly

              cash used for their journalistic activities within the meaning of the Media Act,
              were in accordance with § 48 para. 1 DSG 2000 of the ordinary legal provisions

              of the Data Protection Act 2000 only sections 4 to 6, 10, 11, 14 and 15 apply.
              Linked to this, § 48 Para. 2 DSG 2000 stipulated that the use of data

              for activities according to paragraph 1 leg.cit. was only permissible insofar as this was necessary for fulfilment
              the information task of media entrepreneurs, media services and their
              workers exercising their fundamental right to freedom of expression

              Art. 10 para. 1 ECHR was required.


              2.3.2. A new regulation was initially introduced in Section 9 of the Data Protection Adaptation Act 43
              2018, Federal Law Gazette I 120/2017. This regulation had the following wording: "So-

              far this is necessary to exercise the right to protection of personal data
              consistent with freedom of expression and freedom of information

              to bring, in particular with regard to the processing of personal
              data by media companies, media services or their employees

              indirectly for their journalistic activities within the meaning of the Media Act [...]
              of the GDPR Chapter II (Principles), with the exception of Art. 5, Chapter III


     60 of 71 G 287/2022-16,
                                                                                 G 288/2022-14
                                                                                 14.12.2022



(Rights of the data subject), Chapter IV (Responsible and

workers), with the exception of Art. 28, 29 and 32, Chapter V (transmission of personal
related data to third countries or to international organizations), Chapter VI
(Independent Regulators), Chapter VII (Cooperation and Consistency)

and Chapter IX (Regulations for special processing situations) on the
work that is used for journalistic purposes or for scientific, artistic

technical or literary purposes, no application.
In accordance with this federal law, § 6 (data secrecy) is to be applied in such cases.

den." However, this legal regulation never came into force. In its place
the now (partially) contested § 9 DSG, which with the data protection de-

Regulation Act 2018, Federal Law Gazette I 24/2018.


2.3.3. § 9 para. 1 DSG, which goes back to an amendment request in the Nationalrat- 44
goes, sees - in implementation of the Union legal obligation according to Art. 85
Para. 1 DSGVO - that on the processing of personal data by

Media owners, publishers, media employees and employees of a media
service company or media service within the meaning of the Media Act to journal

listic purposes of the media company or media service, the provisions
provisions of the Data Protection Act and Chapters II (Principles), III (Rights of the

data subject), IV (responsible person and processor), V (transmission
transfer of personal data to third countries or to international organizations

tion), VI (Independent supervisory authorities), VII (Cooperation and cohesion
renz) and IX (regulations for special processing situations) of the GDPR

not apply.

2.3.4. Section 9, paragraph 1, first sentence of the DSG stipulates a complete exception in the 45th

Sense that data processing by certain specified in the provision
Stakeholders (media owners, publishers, media workers and employees

nes media company or media service within the meaning of the Media Act).
journalistic purposes of the media company or media service

Entirely from the provisions of the Data Protection Act and from the provisions in § 9
Paragraph 1 DSG designated chapters of the GDPR are excluded.


2.3.5. The current and now contested version of Section 9 (1) DSG deviates from Section 46

(the one that has been decided but has not entered into force) § 9 data protection
Amendment Act, Federal Law Gazette. I120/2017, insofar as this does not contain any categorical,


                                                                                 61 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              absolute priority to freedom of expression and information
              freedom of action, particularly with regard to the processing of personal

              data by media companies, media services or their employees
              indirectly for their journalistic activities within the meaning of the Media Act

              journalistic purposes of the media company or media service,
              but only the primacy of freedom of expression and the right to information

              stipulated "to the extent necessary" to protect the right to the protection of personal
              collected data with freedom of expression and information
              to reconcile. This so-called requirement of necessity applies

              now only in § 9 Abs. 2 DSG.


              2.4. In view of the fact that the legislature with § 9 Abs. 1 DSG its 47th
              Obligation according to Art. 85 para. 2DSGVO, it is initially obvious to

              Interpretation of the term "for journalistic purposes" approaches those criteria
              which the Court of Justice of the European Union in its
              in accordance with Art. 9 of the Data Protection Directive, the previous provision of Art. 85

              GDPR, in connection with the concept of "journalistic activity"
              has developed. Accordingly, the term is to be interpreted broadly, according to the judgment

              of the Court of Justice of the European Union of December 16, 2008, Case C-73/07,
              SatakunnanMarkkinapörssiund Satamedia to consider the following criteria

              are: The concept of data processing (solely) for journalistic purposes
              refers in personal terms not only to institutionalized mass
              media, but to all citizens who are journalists; it is immaterial

              whether there is a profit to be made from the journalism in question; it is not
              decisive whether the data is processed in a conventional manner and

              are transmitted or whether the processing is carried out by a modern method (e.g
              by uploading data to the Internet); finally can acts

              be regarded as journalistic activities in the light of these criteria if
              they have for the purpose of publicizing information, opinions or ideas
              to spread. When asked whether the activity aims to obtain information,

              Disseminating opinions or ideas in public is after the verdict
              of the Court of Justice of the European Union of February 14, 2019, Case C-345/17,

              Buivids, as criteria of contribution to a debate of general interest, of
              level of awareness of the data subject, the subject of the reporting,

              the previous conduct of the data subject, content, form and
              Effects of publication, the manner and circumstances under which


     62 of 71 G 287/2022-16,
                                                                                G 288/2022-14
                                                                                14.12.2022



which the information was obtained and its accuracy

into account (cf. e.g. Jahnel, picture reporting and data protection, in:
Berka/Holoubek/Leitl-Staudinger [eds.], Privacy and Media, 2019, 73 [80]).


However, § 9 Para. 1 DSG does not cover any journalistic activity in the above 48
cited meaning by whomever, but takes a closer

Restriction to a certain group of people. It's (only) about them
Processing of personal data by media owners, publishers,

Media staff and employees of a media company or
Media service within the meaning of the Media Act for journalistic purposes

media company or media service. According to § 1 Para. 1 Z 8 MedienG,
Federal Law Gazette 314/1981, as amended by Federal Law Gazette I 125/2022, is a media owner "who a) is a media

company or operates a media service or b) otherwise the content
Creation of a media work concerned and its production and distribution
either concerned or caused; or c) otherwise in the case of an electronic

Medium takes care of its content design and its charisma,
Retrievability or distribution either concerned or caused or d) otherwise the

content design of a medium for the purpose of the subsequent
radiation, retrievability or distribution". According to § 1

Para. 1 Z 9 MedienG, "who the basic direction of the periodic medium
determined". As a media company, § 1 Para. 1 Z 6 MedienG designates "a

Company in which the content design of the medium is taken care of as well as
a) its production and distribution or b) its broadcasting or retrievability

either be concerned or arranged". As a media service, § 1 para. 1
Z 7MedienGeincompany viewed,"the media company returns
provided with contributions in word, writing, sound or image". § 9 paragraph 1 DSG takes

i.e. data processing by the actors named in the provision only
then based on the data protection regulations mentioned below,

if these are for journalistic purposes for a media company or a
media service take place.


2.5. The GDPR does not regulate the relationship between data protection and freedom of the media 49

itself, but delegates this legislative task to the Member States.
According to Art. 85 Para. 1 GDPR, the Member States have legal provisions

the right to the protection of personal data in accordance with this regulation



                                                                                63 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              the right to freedom of expression and information, including
              of processing for journalistic purposes.


              For processing for journalistic (and other) purposes, the co- 50

              member states according to Art. 85 Para. 2 DSGVO "deviations or exceptions" from
              Chapter II (Principles), Chapter III (Rights of the data subject), Chapter IV (Ver-

              responsible and processor), Chapter V (Transfer of personal
              ner data to third countries or to international organizations), Chapter VI (Un-
              dependent supervisors), Chapter VII (Cooperation and Consistency) and

              Chapter IX (Regulations for special processing situations) of the GDPR
              see, "to the extent necessary to exercise the right to protection of personal

              data with the freedom of expression and freedom of information
              To reconcile". According to Art. 85 Para. 2 GDPR, the Member States may thus

              the applicability of Chapter I (General Provisions), Chapter VIII (Legal
              remedies, liability and penalties), Chapter X (Delegated Acts and Implementing
              legal acts) and Chapter XI (Final Provisions) neither exclude nor

              restrict. The legislator has in § 9 para. 1 DSG - for the regulated therein,
              limited personal and material scope (see

              Point IV.2.4.) - not only individual, but all in Art. 85 Para. 2 DSGVO
              named chapters of the GDPR without any limitation or differentiation

              closed (and not merely provided for deviations). In contrast, he has
              § 9 Para. 2 DSG - in contrast to the provision in § 9 Para. 1 DSG - for the
              included personal and factual scope no absolute exclusion

              conclusion of the mentioned chapters of the GDPR, but the exclusion of
              individual chapters of the GDPR subject to a reservation of necessity (in individual cases)

              posed. In doing so, the legislature obviously wanted to distinguish between
              cunning activity of media companies to that of scientific,

              artistic and literary purposes. This objective is
              fundamentally not objectionable and also stipulated by Art. 85 GDPR.


              2.6. According to the consistent case law of the Constitutional Court (VfSlg. 51
              15.106/1998, 15.204/1998, 15.683/1999, 20.209/2016 and many others) is an Austrian

              cal law, with which a Union legal regulation is executed and in Austria
              chinese law is implemented is legally doubly necessary: the legislature remains

              in the execution of Union law to the extent (also) related to the Federal Constitutional Law
              bound by legal requirements than an implementation of Union law requirements


     64 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



this is not inhibited. In these cases, the legislature is subject to a

double commitment, namely a commitment to EU law and a commitment
to the framework laid down by constitutional law.


Union law does not require the Austrian legislature to issue Decree 52
a provision according to which any data processing by media owners,

Editors, media workers and employees of a media company
mensor media service within the meaning of the Media Act for journalistic purposes

completely exempt from the application of the provisions of the Data Protection Act
and certain chapters of the GDPR are excluded. On the contrary

Article 85 (1) GDPR obliges the Member States to regulate the relationship between data
protection and freedom of expression (freedom of the media) by legislation

to develop more closely and in this way for a proper compensation of
to ensure conflicting fundamental rights positions (cf. on
Status of opinion already point IV.1.3.).


Since the regulatory content of Section 9 (1) DSG is not mandatory under Union law 53

is specified, the determination is subject to the control of the Constitutional
court as to their compliance with domestic constitution

right. Whether § 9 Para. 1 DSG complies with the requirements of Union law (completely)
speaks, the Constitutional Court does not have to judge and is for the

Decision of the Constitutional Court irrelevant (cf. e.g
VfSlg. 20.088/2016, 20.291/2018).


2.7. In the opinion of the Constitutional Court, Section 9 (1) DSG violates 54
the fundamental right to data protection in accordance with Section 1 (1) DSG.


2.7.1. § 9 para. 1 DSG initially orders undifferentiated that "the provisions 55

of this federal law" are not applicable. This is stated in parts of the literature
understood that the constitutional provision of § 1 DSG (by

the ordinary legislature) is declared inapplicable (see Jahnel, loc. cit., 86;
the same, Art. 85 GDPR, comment on the General Data Protection Regulation, rdb.at,

as of December 1, 2020, margin no. 42; Jahnel/Krempelmeier, loc. cit., 193 f.). Such an interpretation
prohibited because the simple legislator the constitutional provision as

Standard for the constitutional conformity of the contested § 9 Abs. 1 DSG not
able to rule out; the Constitutional Court has much more to examine whether the


                                                                                  65 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              contested provision in accordance with the constitution, including Section 1(1).

              DSG, stands.

              2.7.2. The basic right to data protection according to § 1 Para. 1 DSG guarantees every- 56

              man right to secrecy of personal data concerning him
              ten, insofar as he has an interest worthy of protection, in particular with regard to

              respect for private life.


              § 1 Para. 2DSG contains a substantive legal reservation. Apart from 57
              the use of personal data in the vital interest of the

              taken or with his consent are limitations of the claim
              Confidentiality therefore only to protect overriding legitimate interests

              s of another permitted.

              2.7.3. From § 1 para. 1 in conjunction with para. 2 DSG (and the related case law 58

              of the Constitutional Court) it follows that in principle - if not
              the consent or vital interests of the person concerned are present - a

              Intervention in the fundamental right to data protection according to § 1 Abs. 1 DSG by the
              legislature is only permissible if such an intervention to safeguard

              gender legitimate interests of another is necessary. The legislature is
              therefore on the basis of the fundamental right to data protection according to § 1 paragraph 1 in conjunction with paragraph 2

              DSG always kept a balance between the interests of the person concerned
              Protection of his personal data and the opposing (authorized)

              to provide for the interests of another. Only if the observance of the contrary,
              legitimate interests of another the right to data protection of the person concerned
              prevails, a legal intervention in the fundamental right to data protection is permitted.


              2.8. The absolute and complete - and thus undifferentiated - 59

              - Exclusion of the application of all (simple legal) regulations of the
              Data Protection Act and Chapter II (Principles), III (Rights of the data subject

              person), IV (responsible person and processor), V (transmission of personal
              personal data to third countries or to international organizations),

              VI (Independent Regulators), VII (Cooperation and Consistency) and
              IX (Regulations for special processing situations) of the GDPR in more detail

              defined data processing for journalistic purposes of a media company



     66 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



company or media service contradicts the provisions standardized in Section 1 (2) DSG
demand that the legislator recognize the interest in the protection of personal data

ten with the interest of media owners, publishers, media workers and
Employees of a media company or media service (within the meaning of

Media Act) in the context of their journalistic work to be properly
has gene.


2.8.1. In a democratic society, the media act as "public watch- 60
dog" plays a central role in the public interest (cf. EGHR 8.11.2016

[GK], Magyar Helsinki Bizottság case, Appl. 18.030/11; VfGH 4.3.2021,
E 4037/2020). The (special) regulation of Art. 85

Para. 1 GDPR bill, according to which the national legislator legislation
has to enact, through which "the right to protection of personal data

in accordance with this regulation with the right to freedom of expression and information
freedom of information, including processing for journalistic purposes […]
should be brought into line". For the processing of personal data

the national legislature has
accordingly deviations or exceptions from those in Art. 85 Para. 2

GDPR designated chapters of the GDPR insofar as this is for the
Perception of the tasks of the media and their corresponding journalistic

cal activity appears to be necessary.

2.8.2. In the opinion of the Constitutional Court, the right to 61

freedom of expression and information that the legislature of the
authorization of the order within the meaning of Art. 85 GDPR

and the applicability of certain privacy laws that
not compatible with the peculiarities of the exercise of journalistic activity

are excluded from data processing for journalistic purposes.
Limited applicability of all data protection regulations
on data processing for journalistic purposes by media companies

and media services would be suitable, journalistic activity in disproportionate
to impede or even make it impossible in a reasonable way. The legislator

is held, however, an appropriate, differentiated balance between the
Interests of individual persons in data protection also towards the media and the

requirements of journalistic activity protected by Art. 10 ECHR
see.


                                                                                  67 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              In this context, one should think about restrictions in personnel 62

              (as currently provided for in § 9 para. 1 DSG, e.g. with regard to media companies
              and media services), temporal (possibly only until publication
              of a report) or factual (e.g. with regard to certain data processing).

              or data subject rights) regard. Likewise, the legislature could - as compensation
              for the exclusion of (certain) data protection regulations - increased

              Requirements for internal organization, documentation and technical security
              provide for the processing of the data.


              2.8.3. However, the fundamental right to data protection according to Art. 1 Para. 1 DSG allows 63

              not that the legislature categorically
              fresh, ie. for the recorded activity for journalistic purposes par excellence

              freedom of expression and information takes precedence over the protection of personal
              of personal data by granting the applicability of all data
              protection regulations of a content and procedural nature

              of the GDPR and the Data Protection Act in its entirety. In the
              Categorical privileging of a fundamental right ordered under Section 9 (1) DSG,

              namely the right to freedom of expression and freedom of information against
              on the fundamental right to data protection does not correspond to the constitutional

              stipulations of § 1DSG and the related case law of the constitution
              sungsgerichtshof (cf. e.g. VfSlg. 16.986/2003, 18.643/2008, 19.892/2014,

              20.012/2015, 20.356/2019, 20.359/2019).


              2.9. For the constitutional conformity of § 9 para. 1 DSG can incidentally after Auf- 64
              version of the Constitutional Court also not be brought into the meeting that
              an assertion of data protection violations through processing

              journalistic purposes not before the data protection authority, but before the
              ordinary courts is possible.


              The jurisprudence of the Supreme Court as of the 65th

              earlier media privilege of § 48 paragraph 1 DSG 2000 interpret. saw this destiny
              before (cf. already point IV.2.3.1.) that when data is used by media

              companies, media services or their employees directly for their public
              Table activity within the meaning of the Media Act from the simple statutory provisions

              Provisions of the Data Protection Act 2000 only sections 4 to 6, 10, 11, 14 and 15
              were to be applied. The Supreme Court ruled that this provision


     68 of 71 G 287/2022-16,
                                                                                  G 288/2022-14
                                                                                  14.12.2022



to be reduced teleologically and the assertion of injunctive relief

on the basis of Section 1 (1) DSG 2000 (cf.
OGH January 17, 2018, 6 Ob 144/17w).


However, it is unclear whether this case law is based on what is now specified in Section 9 (1) DSG 66
regulated media privilege can be transferred: First, the last

mentioned provision - in contrast to § 48 para. 1 DSG 2000 - not just individual ones
ordinary legal provisions from the applicability to data processing

for journalistic purposes, but all provisions of the
Data Protection Act and the chapters of the GDPR mentioned in the provision.

Secondly, the opposing view would reflect the will of the legislature, the
ten provisions for data processing for journalistic purposes

To bring application, obviously undermined (cf. in this context
also recently OGH February 2, 2022, 6 Ob 129/21w).


2.10. In its statement, the data protection authority basically correctly points 67
point out that those affected - in addition to the provisions of the Data Protection Act -

zes and the GDPR - in certain constellations otherwise legal protection
is guaranteed. In this context, particular attention should be paid to the

§§ 7 ff. MedienG or provisions of the ABGB (e.g. § 16 in conjunction with § 1330 ABGB). in the
However, the present context is about which special data protection

Legal regulations of the legislature with regard to Art. 10 EMRK for journalism
can declare crafty activity not applicable or only applicable in a modified way, with which

Consequence that this activity is (merely) subject to the aforementioned media and civil law
succeeded, insofar as they are applied in the respective individual case.


2.11. Section 9 (1) DSG therefore proves to be constitutional for the reasons presented
illegal.


2.12. With this result, it is unnecessary to refer to the other concerns of the application 69

Federal Administrative Court in terms of other basic rights
enter into.








                                                                                  69 of 71G 287/2022-16,
 G 288/2022-14
    14.12.2022



              V. Result


              1. § 9 para. 1 DSG is therefore due to a violation of the constitutionally 70

              guaranteed right to data protection according to § 1 Abs. 1 DSG as unconstitutional
              cancel. With this result, it is not necessary to go into the further in

              concerns set out in the applications.


              2. Determination of a deadline for the repealed laws to expire. 71
              cession office is based on Art. 140 Para. 5 third and fourth sentence B-VG.


              3. The statement that previous legal provisions are not reinstated 72
              occur, is based on Art. 140 para. 6 first sentence B-VG.


              4. The Federal Chancellor's obligation to announce the 73rd

              repeal and the other related statements
              flows from Art. 140 Para. 5 first sentence B-VG and § 64 Para. 2 VfGG in conjunction with § 3 Z 3 BGBlG.


              5. This decision could be made in accordance with § 19 Para. 4 VfGG without oral hearings

              be made in closed session.


              6. The parties involved are not charged for the statement made. 75
              speak, because in the case of a legal action initiated at the request of a court

              examination procedure is a matter for the applicant court to decide on any costs
              claims for damages according to the regulations applicable to his procedure

              recognize (e.g. VfSlg. 19.019/2010 mwN).


                                        Vienna, December 14, 2022
                                             The Vice President:
                                                 dr MADNER


              Secretary:

              dr SELIM, BA








     70 of 71G 287/2022-16,
G 288/2022-14

14.12.2022


































































71 of 71
</pre>