BVwG - W137 2278780-1
From GDPRhub
| BVwG - W137 2278780-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 15 GDPR § 4 Z 6 DSG 2000 |
| Decided: | 08.07.2024 |
| Published: | 01.08.2024 |
| Parties: | |
| National Case Number/Name: | W137 2278780-1 |
| European Case Law Identifier: | |
| Appeal from: | DSB (Austria) D124.1273/22, 2023-0.626.453 |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (in German) |
| Initial Contributor: | ec |
A court found that the controller's interest in protecting its litigation position outweighed the data subject's right of access.
English Summary
Facts
The data subject was a department head at the Department of Education (the controller).
On 20 January 2022, the data subject sent an access request under Article 15 GDPR to the controller regarding his stored personal data. On 25 May 2022, the data subject sent another request.
At the same time, two proceedings were pending before the Labour and Social Court (“Arbeits- und Sozialgericht”) between the data subject and the controller.
On 30 June 2022 and 17 August 2023, the controller responded to the request and provided the data subject with information. This included a total of 187 documents relating to the data subject and his personal file. However, the controller refused to provide information to certain emails and statements, claiming it relied on overriding confidentiality interests, which would outweigh the data subject’s interest in receiving this information. As there were labour and social court proceedings pending, these emails and statements were part of these proceedings. Providing this information would therefore mean a deterioration of the controller’s litigation position.
On 27 September 2022, the data subject lodged a complaint at the Austrian DPA (“Datenschutzbehörde - DSB”) against the controller for violating their right of access under Article 15 GDPR. According to the data subject, the controller provided the data subject with incomplete information. The data subject argued that he was still missing the following documents: the extensive volume of written complaints against the data subject at the controller’s personnel department, the written requests for dismissal from the data subject’s function as appointed department head, statements on the data subject to the controller and other relevant files.
The DPA rejected the complaint, because there were no indications that the information provided by the controller was incomplete. The DPA also held that the controller was cooperative throughout the proceedings and had been able to demonstrate in a comprehensible manner that no data existed regarding the other information the data subject requested. Apart from the data subject's mere speculation, they had not provided any substantiated evidence of incomplete information.
The data subject appealed this decision at the Federal Administrative Court (“Bundesverwaltungsgericht – BVwG”), arguing that the controller had not yet provided the data subject with complete information regarding his processed data. The claim that the requested data no longer existed was incorrect, because it was suddenly introduced as evidence in the labour court proceedings by the controller in 2022 and 2023. According to various statements in these proceedings, there were also other files that still needed to be given to the data subject. The data subject also rejected the claim that certain information could not be shared due to the ongoing labour court proceedings, as this legal view of the controller overlooks the principle of immediacy in personnel matters under labour law.
Holding
The court agreed with the controller that it had a confidentiality interest. As the data subject was provided with extensive information and that the controller’s refusal to provide information was only limited to the emails and statements, the court held that requesting access to strengthen the data subject's case goes beyond the protective purpose of this right. Thus, the controller’s legitimate interest in confidentiality outweighed the interests of the data subject.
The court further held that the physical folders requested by the data subject are exclusively physical files located in the controller’s office. The court thus agreed with the DPA’s reasoning that these physical files did not qualify as a filing system.
With regard to the other information that the data subject claimed the controller had about them, the court found that these documents or files do not exist at all. By providing a negative answer to the data subject, the controller also complied in this regard with the access request.
The court therefore held that the data subject was provided with complete information by the controller. The data subject’s right of access was thus not violated.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Decision date
07/08/2024
Standard
B-VG Art133 Para4
DSG §1
DSG §24 Para1
DSG §24 Para5
DSGVO Art15
DSGVO Art4
VwGVG §28 Para2
B-VG Art. 133 today B-VG Art. 133 valid from 01/01/2019 to 05/24/2018 last amended by BGBl. I No. 138/2017 B-VG Art. 133 valid from 01/01/2019 last amended by BGBl. I No. 22/2018 B-VG Art. 133 valid from 05/25/2018 to 12/31/2018 last amended by BGBl. I No. 22/2018 B-VG Art. 133 valid from 01.08.2014 to 24.05.2018, last amended by BGBl. I No. 164/2013 B-VG Art. 133 valid from 01.01.2014 to 31.07.2014, last amended by BGBl. I No. 51/2012 B-VG Art. 133 valid from 01.01.2004 to 31.12.2013, last amended by BGBl. I No. 100/2003 B-VG Art. 133 valid from 01.01.1975 to 31.12.2003, last amended by BGBl. No. 444/1974 B-VG Art. 133 valid from 25.12.1946 to 31.12.1974, last amended by BGBl. No. 211/1946 B-VG Art. 133 valid from 19.12.1945 to 24.12.1946 last amended by StGBl. No. 4/1945 B-VG Art. 133 valid from January 3, 1930 to June 30, 1934
DSG Art. 1 § 1 today DSG Art. 1 § 1 valid from January 1, 2014 last amended by BGBl. I No. 51/2012 DSG Art. 1 § 1 valid from January 1, 2000 to December 31, 2013
DSG Art. 2 § 24 today DSG Art. 2 § 24 valid from July 15, 2024 last amended by BGBl. I No. 70/2024 DSG Art. 2 § 24 valid from May 25, 2018 to July 14, 2024 last amended by BGBl. I No. 120/2017 DSG Art. 2 § 24 valid from 01.01.2010 to 24.05.2018, last amended by BGBl. I No. 133/2009 DSG Art. 2 § 24 valid from 01.01.2000 to 31.12.2009
DSG Art. 2 § 24 today DSG Art. 2 § 24 valid from 15.07.2024, last amended by BGBl. I No. 70/2024 DSG Art. 2 § 24 valid from 25.05.2018 to 14.07.2024, last amended by BGBl. I No. 120/2017 DSG Art. 2 § 24 valid from 01.01.2010 to 24.05.2018, last amended by BGBl. I No. 133/2009 DSG Art. 2 § 24 valid from 01.01.2000 to 31.12.2009
VwGVG § 28 today VwGVG § 28 valid from 01.01.2019 last amended by BGBl. I No. 138/2017 VwGVG § 28 valid from 01.01.2014 to 31.12.2018
Saying
W137 2278780-1/4E
IN THE NAME OF THE REPUBLIC!
The Federal Administrative Court recognizes the judge Mag. Peter HAMMER as chairman and the expert lay judges Mag. Ursula ILLIBAUER and MMag. Jakob KALINA as assessors on the complaint of XXXX against the decision of the Data Protection Authority of September 4, 2023, GZ: D124.1273/22, 2023-0.626.453, rightly so: The Federal Administrative Court, through Judge Mag. Peter HAMMER as chairman and the expert lay judges Mag. Ursula ILLIBAUER and MMag. Jakob KALINA as assessors on the complaint of the Roman 40 against the decision of the data protection authority dated September 4, 2023, GZ: D124.1273/22, 2023-0.626.453, rightly:
A)
The complaint is dismissed as unfounded pursuant to Section 28 Paragraph 2 VwGVG in conjunction with Section 24 Paragraph 1 and Paragraph 5 DSG as amended.The complaint is dismissed as unfounded pursuant to Paragraph 28, Paragraph 2, VwGVG in conjunction with Paragraph 24, Paragraph one and Paragraph 5, DSG as amended.
B)
The appeal is not admissible pursuant to Article 133 Paragraph 4 B-VG.The appeal is not admissible pursuant to Article 133 Paragraph 4 B-VG.
Text
Reasons for the decision:
I. Procedure: Roman one. Procedure:
1. On September 27, 2022, XXXX (= complainant before the Federal Administrative Court and applicant before the data protection authority) filed a data protection complaint with the authority concerned against the Education Directorate for XXXX (= co-involved party before the Federal Administrative Court and respondent before the data protection authority), among other things, for violating the right to information pursuant to Art. 15 GDPR, because the co-involved party had provided him with incomplete information. 1. On September 27, 2022, roman 40 (= complainant before the Federal Administrative Court and applicant before the data protection authority) filed a data protection complaint with the authority concerned against the Education Directorate for roman 40 (= co-involved party before the Federal Administrative Court and respondent before the data protection authority), among other things, for violating the right to information pursuant to Article 15 GDPR, because the co-involved party had provided him with incomplete information.
2. After being granted the right to be heard, the co-participating party stated in a statement dated October 14, 2022 that it had already provided the complainant with extensive data and contact details. However, the disclosure was restricted with regard to data whose transmission would interfere with the rights and freedoms of other persons or that would lead to an obstruction of the administrative procedure. Two labor and social court proceedings are currently pending against the complainant, with any email histories and statements being part of these proceedings.
3. In a letter dated December 14, 2022, the complainant essentially stated that the following documents still had to be released by the co-participating party:
"1. That the human resources department of XXXX expressly claimed on July 16, 2020 in the presence of a witness that there was an extensive bundle of written complaints stacked up in the human resources department of the education directorate for XXXX (quote from XXXX: "starting in 2014 by Ms. XXXX, an extensive bundle of files containing complaints about me was accumulated at the state school board, ... a meter-long row of very many file folders ..."). "1. That the human resources department of roman 40 expressly claimed on July 16, 2020 in the presence of a witness that there was an extensive bundle of written complaints stacked up in the human resources department of the education directorate for roman 40 (quote from roman 40: "starting in 2014 by Ms. Roman 40, an extensive bundle of files containing complaints about me was accumulated at the state school board, ... a meter-long row of very many file folders ...").
[…]
2. The written request dated XXXX dated December 12, 2013, which has been confirmed several times in official documents, for my dismissal from my position as provisionally appointed department head, since provisional appointments and dismissals from provisional positions are original official duties of the human resources department of the state school board/education directorate.2. The written request dated Roman 40 dated December 12, 2013, which has been confirmed several times in official documents, for my dismissal from my position as provisionally appointed department head, since provisional appointments and dismissals from provisional positions are original official duties of the human resources department of the state school board/education directorate.
3. The memo with the heading “AV XXXX Employment” sent to the education directorate by the director XXXX on June 12, 20173. The memo sent to the Education Directorate by Director Roman 40 on June 12, 2017 with the heading “AV Roman 40 Employment”
4. The memo from XXXX as Head of the Human Resources Department regarding the further procedure regarding the written submission/applications from Attorney XXXX dated September 21, 2017.4. The memo from Roman 40 as Head of the Human Resources Department regarding the further procedure regarding the written submission/applications from Attorney Roman 40 dated September 21, 2017.
5. Statement from Director XXXX regarding myself to the Education Directorate dated July 10, 2017.5. Statement from Director Roman 40 regarding myself to the Education Directorate dated July 10, 2017.
6. Statement from Director XXXX regarding myself to the Education Directorate dated February 6, 20186. Statement from Director Roman 40 about me to the Education Directorate dated February 6, 2018
7. Statement from Director XXXX about me to the Education Directorate dated February 8, 20187. Statement from Director Roman 40 about me to the Education Directorate dated February 8, 2018
8. Statement from Director XXXX about me to the Education Directorate dated February 9, 20188. Statement from Director Roman 40 about me to the Education Directorate dated February 9, 2018
9. At the hearing before the XXXX Labor Court on December 15, 2020, the head of the Human Resources Department of the Education Directorate for XXXX stated verbally to the High Court in my presence that prior to my dismissal as head of department, there had been numerous correspondences between his Human Resources Department and XXXX at the Ministry of Education about me and that my dismissal had previously been legally reviewed and approved by the Head of Department XXXX. These correspondences from the Human Resources Department of the Education Directorate for XXXX about me with the Ministry of Education containing my personal data, confirmed by XXXX, have also not yet been released.9. At the hearing before the Roman 40 Labor Court on December 15, 2020, the Head of the Human Resources Department of the Education Directorate for Roman 40 explained verbally to the High Court in my presence that prior to my dismissal as head of department, there had been numerous correspondences from his Human Resources Department to Roman 40 at the Ministry of Education about me and that my dismissal had previously been legally reviewed and approved by the Head of Department Roman 40. These correspondences from the Human Resources Department of the Education Directorate for Roman 40 about me with the Ministry of Education containing my personal data, confirmed by Roman 40, have also not yet been released.
[…]
10. All of the Ministry of Education's interview records available to the respondent with my personal information in the respondent's "Beilage_2_Auskunft_vom_09.05.2022.pdf" have not been released."
4. With a partial decision dated March 21, 2023, GZ. D124.1273/22, 2023-0.177.159, the data protection authority ruled on the question of whether the co-participating party had violated the complainant's right to information under Art. 15 Para. 1 GDPR and recognized that the information provided was partially incomplete.4. With a partial decision dated March 21, 2023, GZ. D124.1273/22, 2023-0.177.159, the Data Protection Authority ruled on the question of whether the co-participating party had violated the complainant's right to information under Article 15, paragraph one, GDPR and found that the information provided was partially incomplete.
5. By decision of March 21, 2023, GZ. D124.1273/22, 2023-0.223.207, the data protection authority suspended the proceedings regarding the question of whether there was a violation of Art. 15 (3) GDPR until the ECJ had decided on the preliminary ruling procedure C-487/21.5. By decision of March 21, 2023, GZ. D124.1273/22, 2023-0.223.207, the data protection authority suspended the proceedings regarding the question of whether there was a violation of Article 15 (3) GDPR until the ECJ had decided on the preliminary ruling procedure C-487/21.
6. By decision of May 16, 2023, GZ. D124.1273/22, 2023-0.371.784, the data protection authority revoked its decision of March 21, 2023, GZ. D124.1273/22, 2023-0.223.207, and continued the proceedings.
7. In a statement dated August 17, 2023, the co-participating party stated that the data processed on the complainant had been transmitted in a letter dated April 28, 2023. With regard to the complainant's statement of December 14, 2022, the co-participating party stated as follows:
"Written complaint package ("meter-long row"):
It is correct that there is a long row of file folders, but this only contains all the documents relating to the two processes (written submissions, documents, etc.). These are not part of the personnel file. These are court files for the purpose of preparing for court hearings in which the applicant is a party and which were submitted to the court as evidence with ON.
Written request from XXXX: Written request from Roman 40:
Negative information
No written request from XXXX from 2013 is known or part of Mr. XXXX's personnel file. A query in the electronic file system VDesk was unsuccessful. XXXX is also already retired and his email account was deleted when he retired.No written request from Roman 40 from 2013 is known or part of Mr. Roman 40's personnel file. A query in the electronic file system VDesk was unsuccessful. XXXX is also already retired and his email account was deleted when he retired.
File note "AV XXXX employment" File note "AV roman 40 employment"
Negative information
A file note from XXXX on the further procedure regarding the written submissions/applications from lawyer XXXX dated September 21, 2017 is neither known in XXXX nor part of XXXX's personnel file.A file note from roman 40 on the further procedure regarding the written submissions/applications from lawyer roman 40 dated September 21, 2017 is neither known in roman 40 nor part of roman 40's personnel file.
Statements 10.7.17, 6.2.18, 8.2.18, 9.2.18
Negative information
A statement from XXXX dated 6.2.2018 is known, but not as part of XXXX's personnel file, but rather as a document that was submitted in the procedure 34 Cga 42/18el.A statement from roman 40 dated 6.2.2018 is known, but not as part of roman 40's personnel file, but rather as a document that was submitted in the procedure 34 Cga 42/18el.
E-mail correspondence between XXXX and the HR department E-mail correspondence between roman 40 and the HR department
It is no longer possible to determine whether further action was agreed/ as the people involved at XXXX are already retired. In any case, such e-mails are not on record at XXXX and are in no way part of Mr. XXXX’s personnel file. “It is no longer possible to determine whether further action was agreed/ as the people involved at roman 40 are already retired. In any case, such e-mails are not on record at roman 40 and are in no way part of Mr. Roman 40’s personnel file.”
8. In the course of the administrative procedure, the data protection authority obtained further written statements from both parties.
9. With (final) decision dated September 4, 2023, GZ. D124.1273/22, 2023-0.626.453, the authority concerned rejected the complaint of September 27, 2022.
In this decision, the data protection authority essentially made the following findings of fact:
The complainant was the head of department at XXXX and thus an employee of the co-involved party. The complainant was the head of department at Roman 40 and thus an employee of the co-involved party.
On January 20, 2022, the complainant sent a request for information regarding his stored personal data to the co-involved party.
In a letter dated May 25, 2022, the complainant submitted a further request to the co-involved party for the release of his personal information in accordance with the GDPR.
In letters dated June 30, 2022 and August 17, 2023, the co-participating party sent the complainant a total of 187 documents concerning him as well as parts I to III of his personnel file. In letters dated June 30, 2022 and August 17, 2023, the co-participating party sent the complainant a total of 187 documents concerning him as well as parts Roman I to Roman III of his personnel file.
In addition to the copies sent by the co-participating party, the co-participating party only has a "meter-long" row of file folders in the office, which contain all documents (briefs, documents, etc.) relating to the ongoing legal proceedings, No. 34 Cga 42/18el.
On the basis of these findings of fact, the data protection authority concluded the following in legal terms:
According to Article 15, paragraph 3, GDPR, the controller must provide a copy of the personal data that are the subject of the processing. According to Article 15, paragraph 3, GDPR, the controller must provide a copy of the personal data that are the subject of the processing.
The co-involved party had already sent the complainant copies of numerous documents. Accordingly, it was subsequently necessary to check whether the copies sent by the co-involved party were incomplete in these points.
a) “meter-long row” of file folders
In principle, data copies outside the personnel file would also have to be disclosed. However, as can be seen from the findings, the file folders requested by the complainant are exclusively physical file folders that are located in the co-involved party’s office. With regard to data stored in paper files, the Supreme Court, like the highest courts under public law, assumes that paper files, due to their structure, cannot be qualified as files within the meaning of Section 4, Item 6, DSG 2000. In principle, data copies outside the personnel file must also be disclosed. However, as can be seen from the findings, the file folders requested by the complainant are exclusively physical file folders located in the office of the party involved. With regard to data stored in paper files, the Supreme Court, like the highest courts under public law, assumes that paper files, due to their structure, cannot be qualified as files within the meaning of Section 4, Item 6, DSG 2000.
Furthermore, the right to information under Art. 15 Para. 3 GDPR is restricted by Art. 15 Para. 4 GDPR. The right to receive a copy of the data must not affect the rights and freedoms of other persons. The refusal to provide a copy of the data would therefore be justified if the confidentiality interests of the co-participating party or third parties outweighed the complainant's interest in information. As can be seen from the findings, civil proceedings are currently pending and the co-participating party must be granted an interest in keeping any evidence confidential, especially since this would worsen their position in the proceedings. A copy of the file is therefore not covered by the right to information. Furthermore, the right to information under Article 15, Paragraph 3, GDPR is restricted by Article 15, Paragraph 4, GDPR. The right to receive a copy of the data must not affect the rights and freedoms of other persons. The refusal to provide a copy of the data would therefore be justified if the confidentiality interests of the co-participating party or third parties outweighed the complainant's interest in information. As can be seen from the findings, civil proceedings are currently pending and the party involved has an interest in keeping any evidence confidential, especially since this would result in a deterioration in their position in the case. A copy of the file is therefore not covered by the right to information.
b) Written request dated XXXX b) Written request dated roman 40
c) File note "AV XXXX employment" c) File note "AV roman 40 employment"
d) Statements from Ms XXXX d) Statements from Ms roman 40
e) E-mail correspondence
f) Interview records from the Ministry of Education
The data protection authority found no indication that the information provided by the party involved was incomplete on these points. The party involved was cooperative throughout the proceedings and was able to explain in a comprehensible manner that no data was available in this regard. The complainant was also unable to provide any solid evidence of incomplete information other than his mere assumption.
10. The complainant lodged the present complaint against this decision within the deadline. In support of this, the complainant essentially stated the following:
The co-participating party had not yet provided the complainant with complete information regarding the data it processed. The claim that the data he had requested was no longer available was incorrect because it was suddenly introduced as evidence in the labor court proceedings by the bodies of the co-participating party in 2022 and 2023, the release of which he had already unsuccessfully requested from the co-participating party in 2019.
Furthermore, certain data that was to be released is no longer available to the co-participating party because the complainant's personal data was allegedly automatically deleted when XXXX retired. According to XXXX and the Ministry of Education, this data was actually processed and therefore must also be disclosed. Furthermore, certain data that was to be released to the co-participating party because the complainant's personal data was allegedly automatically deleted when roman 40 retired. According to roman 40 and the Ministry of Education, this data was actually processed and therefore must also be disclosed.
In addition, the complainant's personal data that was created by Director XXXX every 14 days and, according to her statement on December 12, 2017, was also passed on to the co-participating party and the Ministry of Education, must also be disclosed. In addition, the personal data of the complainant, which were created by the director Roman 40 at 14-day intervals and, according to her statement on December 12, 2017, were also handed over to the other party involved and the Ministry of Education, must also be released.
Finally, the view that the data in question should be released because of the alleged secrecy in the labor court proceedings is legally untenable, because this legal view of the other party involved overlooks the labor law principle of immediacy in personnel matters.
11. The authority concerned submitted the complaint to the adjudicating court, attaching the administrative act, with a written submission dated September 28, 2023, received on September 29, 2023, and requested that the complaint be dismissed.
II. The Federal Administrative Court considered: Roman II. The Federal Administrative Court considered:
1. Findings:
1.1. The complainant was the head of department at XXXX and an employee of the co-involved party. 1.1. The complainant was the head of department at roman 40 and an employee of the co-involved party.
1.2. On January 20, 2022, the complainant sent a request for information pursuant to Art. 15 GDPR to the co-involved party regarding his stored personal data. 1.2. On January 20, 2022, the complainant sent a request for information pursuant to Article 15 GDPR to the co-involved party regarding his stored personal data.
In a letter dated May 25, 2022, the complainant submitted a further request to the co-involved party for the release of his personal data pursuant to Art. 15 GDPR. In a letter dated May 25, 2022, the complainant submitted a further request to the co-involved party for the release of his personal data pursuant to Article 15 GDPR.
1.3. In his data protection complaint of September 27, 2022, the complainant claimed that his right to information under Article 15 of the GDPR had been violated because the party involved had provided him with incomplete information. 1.3. In his data protection complaint of September 27, 2022, the complainant claimed that his right to information under Article 15 of the GDPR had been violated because the party involved had provided him with incomplete information.
In his submission of December 14, 2022, the complainant essentially stated that the following documents still had to be provided by the party involved:
"1. That the human resources department of XXXX expressly claimed on July 16, 2020 in the presence of a witness that there was an extensive bundle of written complaints stacked up in the human resources department of the education directorate for XXXX (quote from XXXX: "starting in 2014 from XXXX, an extensive bundle of files containing complaints about me was accumulated at the state school board, ... a meter-long row of very many file folders ..."). "1. That the human resources department of roman 40 expressly claimed on July 16, 2020 in the presence of a witness that there was an extensive bundle of written complaints stacked up in the human resources department of the education directorate for roman 40 (quote from roman 40: "starting in 2014 from XXXX, an extensive bundle of files containing complaints about me was accumulated at the state school board, ... a meter-long row of very many file folders ...").
[…]
2. The written request dated XXXX dated December 12, 2013, which has been confirmed several times in official documents, for my dismissal from my position as provisionally appointed department head, since provisional appointments and dismissals from provisional positions are original official duties of the human resources department of the state school board/education directorate.2. The written request dated Roman 40 dated December 12, 2013, which has been confirmed several times in official documents, for my dismissal from my position as provisionally appointed department head, since provisional appointments and dismissals from provisional positions are original official duties of the human resources department of the state school board/education directorate.
3. The memo with the heading “AV XXXX Employment” sent to the education directorate by the director XXXX on June 12, 20173. The memo sent to the Education Directorate by Director Roman 40 on June 12, 2017 with the heading “AV Roman 40 Employment”
4. The memo from XXXX as Head of the Human Resources Department regarding the further procedure regarding the written submission/applications from Attorney XXXX dated September 21, 2017.4. The memo from Roman 40 as Head of the Human Resources Department regarding the further procedure regarding the written submission/applications from Attorney Roman 40 dated September 21, 2017.
5. Statement from Director XXXX regarding myself to the Education Directorate dated July 10, 2017.5. Statement from Director Roman 40 regarding myself to the Education Directorate dated July 10, 2017.
6. Statement from Director XXXX regarding myself to the Education Directorate dated February 6, 20186. Statement from Director Roman 40 about me to the Education Directorate dated February 6, 2018
7. Statement from Director XXXX about me to the Education Directorate dated February 8, 20187. Statement from Director Roman 40 about me to the Education Directorate dated February 8, 2018
8. Statement from Director XXXX about me to the Education Directorate dated February 9, 20188. Statement from Director Roman 40 about me to the Education Directorate dated February 9, 2018
9. At the hearing before the XXXX Labor Court on December 15, 2020, the head of the Human Resources Department of the Education Directorate for XXXX stated verbally to the High Court in my presence that prior to my dismissal as head of department, there had been numerous correspondences between his Human Resources Department and XXXX at the Ministry of Education about me and that my dismissal had previously been legally reviewed and approved by the Head of Department XXXX. These correspondences from the Human Resources Department of the Education Directorate for XXXX about me with the Ministry of Education containing my personal data, confirmed by XXXX, have also not yet been released.9. At the hearing before the Roman 40 Labor Court on December 15, 2020, the Head of the Human Resources Department of the Education Directorate for Roman 40 explained verbally to the High Court in my presence that prior to my dismissal as head of department, there had been numerous correspondences from his Human Resources Department to Roman 40 at the Ministry of Education about me and that my dismissal had previously been legally reviewed and approved by the Head of Department Roman 40. These correspondences from the Human Resources Department of the Education Directorate for Roman 40 about me with the Ministry of Education containing my personal data, confirmed by Roman 40, have also not yet been released.
[…]
10. All of the Ministry of Education's interview records available to the respondent with my personal information in the respondent's "Attachment_2_Information_from_09.05.2022.pdf" have not been released."
1.4. At least one case under No. 33 Cga 24/20b is pending before the Labor and Social Court between the complainant and the co-participating party.
1.5. The complainant's request for information was answered by the co-participating party with comprehensive letters dated June 30, 2022 and August 17, 2023 (a total of 187 documents concerning the complainant as well as parts I to III of his personnel file). 1.5. The complainant's request for information was answered by the co-participating party with comprehensive letters dated June 30, 2022 and August 17, 2023 (a total of 187 documents concerning the complainant as well as parts Roman I to Roman III of his personnel file).
This information turns out to be complete.
2. Assessment of evidence:
The findings on the relevant facts arise from the administrative act, the complaint and the court file.
2.1. The fact that the complainant was once an employee of the co-participating party is based on the consistent statements of the complainant and the co-participating party.
2.2. The findings on the request for information to the co-participating party arise from the administrative act, in particular from the requests for information dated January 20, 2022 and May 25, 2022.
2.3. The information considered incomplete by the complainant and specifically requested from the co-participating party can be seen in the letter dated December 14, 2022.
2.4. The fact that at least one case is pending before the Labor and Social Court between the complainant and the co-participating party follows from the administrative act and is undisputed.
2.5. The finding that the co-participating party has (now) provided the complainant with complete information follows from the letters from the co-participating party dated June 30, 2022 and August 17, 2023 sent to the complainant, but in particular from the fact that the co-participating party has consistently been cooperative with both the complainant and the authorities in the present proceedings and has endeavored to provide information that is as detailed as possible and complies with the requirements of the GDPR.
To the extent that the complainant believes, in connection with the interview of XXXX dated December 13, 2017, presented in the complaint, that a written request from the person named on December 12, 2013 exists, it must be countered that there is no evidence of the existence of such a letter. In this regard, the co-participating party has credibly argued that a written request from XXXX dated December 13, 2017 is not stored with them and, in the opinion of the Federal Administrative Court, there is also no reasonable reason for them to withhold individual documents from the complainant. To the extent that the complainant believes, in connection with the interview of Roman 40 dated December 13, 2017, presented in the complaint, that a written request from the person named on December 12, 2013 exists, it must be countered that there is no evidence of the existence of such a letter. In this regard, the co-participating party has credibly argued that a written request from Roman 40 dated December 13, 2017 is not stored with them and, in the opinion of the Federal Administrative Court, there is no reasonable reason for them to withhold individual documents from the complainant.
The same applies to the other information requested (file note "AV XXXX employment", statement from XXXX, email correspondence, interview records from the Ministry of Education). With regard to the other information requested, the complainant merely states in general terms that these documents or data must be available to the co-participating party. These are merely allegations by the complainant without any concrete evidence that these documents actually exist. Therefore, the co-involved party's argument that the documents do not exist at all was to be followed on this point as well. The same applies to the other information requested (file note "AV roman 40 employment", statement from roman 40, e-mail correspondence, interrogation records from the Ministry of Education). With regard to the other information requested, the complainant merely makes a general statement that these documents or data must be available to the co-involved party. These are only allegations by the complainant without any concrete evidence that these documents actually exist. Therefore, the co-involved party's argument that the documents do not exist at all was to be followed on this point as well.
The data protection authority has carried out a comprehensive investigation in this context, and in the meantime (in March 2023) it has also been established that the information was not complete. This was subsequently added by the co-involved party. The data protection authority could no longer understand the subsequent alleged incompleteness of the information and has also provided a convincing justification for this.
There are no (new) convincing arguments in the complaint that indicate that the information is still incomplete. In essence, the complainant is only repeating his allegations to the authority.
3. Legal assessment:
3.1. According to Article 130, Paragraph 1, Item 1 of the Federal Constitutional Court Act, the administrative courts decide on complaints against the decision of an administrative authority on the grounds of illegality.3.1. According to Article 130, Paragraph 1, Item 1 of the Federal Constitutional Court Act, the administrative courts decide on complaints against the decision of an administrative authority on the grounds of illegality.
According to Section 6 of the Federal Administrative Court Act, the Federal Administrative Court decides by a single judge, unless federal or state laws provide for a decision by a senate.According to Section 6 of the Federal Administrative Court Act, the Federal Administrative Court decides by a single judge, unless federal or state laws provide for a decision by a senate.
According to Section 27, Paragraph 1 of the Data Protection Act, the Federal Administrative Court decides through a Senate on complaints against decisions due to violations of the duty to inform pursuant to Section 24, Paragraph 7, leg.cit. and the data protection authority's duty to decide. According to Section 27, Paragraph 2, first sentence of the Data Protection Act, the Senate consists of a chairperson and one expert lay judge from the circle of employers and one from the circle of employees. In this case, the Senate therefore has jurisdiction.According to Paragraph 27, Paragraph 1 of the Data Protection Act, the Federal Administrative Court decides through a Senate on complaints against decisions due to violations of the duty to inform pursuant to Paragraph 24, Paragraph 7, leg.cit. and the data protection authority's duty to decide. According to Paragraph 27, Paragraph 2, first sentence of the Data Protection Act, the Senate consists of a chairperson and one expert lay judge from the circle of employers and one from the circle of employees. In this case, the Senate therefore has jurisdiction.
The procedure of the administrative courts, with the exception of the Federal Finance Court, is regulated by the VwGVG, Federal Law Gazette I No. 33/2013 (§ 1 leg.cit.). According to § 59 paragraph 2 VwGVG, conflicting provisions that were already published at the time this federal law came into force remain in force.The procedure of the administrative courts, with the exception of the Federal Finance Court, is regulated by the VwGVG, Federal Law Gazette Part One, No. 33 of 2013 (paragraph one, leg.cit.). According to paragraph 59, paragraph 2 VwGVG, conflicting provisions that were already published at the time this federal law came into force remain in force.
According to Section 17 of the Administrative Court Act, unless otherwise provided for in this federal law, the provisions of the Administrative Court Act, with the exception of Sections 1 to 5 and Part IV, the provisions of the Federal Fiscal Code – BAO, Federal Law Gazette No. 194/1961, the Agricultural Procedure Act – AgrVG, Federal Law Gazette No. 173/1950, and the Civil Service Procedure Act 1984 – DVG, Federal Law Gazette No. 29/1984, and, in addition, those procedural provisions in federal or state laws that the authority applied or should have applied in the proceedings preceding the proceedings before the administrative court, shall apply mutatis mutandis to the proceedings on complaints pursuant to Article 130, Paragraph 1 of the Administrative Court Act.According to Section 17 of the Administrative Court Act, unless otherwise provided for in this federal law, the provisions of the Administrative Court Act, with the exception of Sections 1 to 5 and Part IV, the provisions of the Federal Fiscal Code – BAO, Federal Law Gazette No. 194/1961, the Agricultural Procedure Act – AgrVG, Federal Law Gazette No. 173/1950, and the Civil Service Procedure Act 1984 – DVG, Federal Law Gazette No. 29/1984, and, in addition, those procedural provisions in federal or state laws that the authority applied or should have applied in the proceedings preceding the proceedings before the administrative court, shall apply mutatis mutandis to the proceedings on complaints pursuant to Article 130, Paragraph 1 of the Administrative Court Act. one to 5 and Roman IV, the provisions of the Federal Fiscal Code - BAO, Federal Law Gazette No. 194 of 1961,, the Agricultural Procedure Act - AgrVG, Federal Law Gazette No. 173 of 1950,, and the Civil Service Procedure Act 1984 - DVG, Federal Law Gazette No. 29 of 1984,, and in addition those procedural provisions in federal or state laws that the authority applied or should have applied in the proceedings preceding the proceedings before the administrative court are to be applied accordingly.
3.2. According to Section 31 Paragraph 1 VwGVG, decisions and orders are made by resolution unless a ruling is to be made.3.2. According to Paragraph 31, Paragraph one, VwGVG, decisions and orders are made by resolution unless a ruling is to be made.
According to Section 28 Paragraph 1 VwGVG, the administrative court must settle the legal matter by decision, unless the complaint is to be rejected or the proceedings are to be discontinued. According to Section 28, Paragraph 1, VwGVG, the administrative court must settle the legal matter by decision, unless the complaint is to be rejected or the proceedings are to be discontinued.
According to Section 28 Paragraph 2 VwGVG, the administrative court must decide on complaints on the merits itself if the relevant facts are established or the determination of the relevant facts by the administrative court itself is in the interest of speed or is associated with significant cost savings. According to Section 28, Paragraph 2, VwGVG, the administrative court must decide on complaints on the merits itself if the relevant facts are established or the determination of the relevant facts by the administrative court itself is in the interest of speed or is associated with significant cost savings.
3.3. On A)
3.3.1. The relevant provisions of the GDPR
Article 4
Definitions
For the purposes of this Regulation, the following definitions apply:
1. ‘personal data’ means any information relating to an identified or identifiable natural person (hereinafter ‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
2. ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or linking, restriction, erasure or destruction;
3.-5. (…)
6. ‘filing system’ means any structured collection of personal data which is accessible according to specific criteria, regardless of whether the collection is centralised, decentralised or organised according to functional or geographical criteria;
7. ‘controller’ means the natural or legal person, public authority, agency or other body which alone or jointly with others decides on the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
8.-26. (…)
Article 15
Right of access of the data subject
(1) The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed; where that is the case, access to those personal data and the following information:
a) the purposes of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning him or her or to object to such processing;
f) the existence of the right to lodge a complaint with a supervisory authority;
g) where the personal data are not collected from the data subject, any available information as to their origin;
h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
(2) Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards in accordance with Article 46 relating to the transfer.
(3) The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on the administrative costs. Where the data subject makes the request electronically, the information shall be provided in a commonly used electronic format, unless the data subject indicates otherwise.
(4) The right to obtain a copy pursuant to paragraph 1b shall not adversely affect the rights and freedoms of others.
3.3.2. The relevant provisions of the DSG
Article 1
(Constitutional provision)
Basic right to data protection
§ 1. (1) Everyone has the right to keep personal data concerning him or her confidential, in particular with regard to the respect for his or her private and family life, provided that there is a legitimate interest in doing so. The existence of such an interest is excluded if data is not accessible to a claim of confidentiality due to its general availability or because it cannot be traced back to the person concerned.Paragraph one, (1) Everyone has the right to keep personal data concerning him or her confidential, in particular with regard to the respect for his or her private and family life, provided that there is a legitimate interest in doing so. The existence of such an interest is excluded if data is not accessible to a claim of confidentiality due to its general availability or because it cannot be traced back to the person concerned.
(2) To the extent that the use of personal data is not in the vital interest of the data subject or with his consent, restrictions on the right to confidentiality are only permissible to protect the overriding legitimate interests of another person, and in the case of interventions by a state authority only on the basis of laws that are necessary for the reasons set out in Article 8 paragraph 2 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210/1958. Such laws may only provide for the use of data which, by their nature, are particularly worthy of protection to protect important public interests and must at the same time establish appropriate guarantees for the protection of the data subject's interests in confidentiality. Even in the case of permissible restrictions, the interference with the fundamental right may only be carried out in the mildest way that achieves the objective. (2) To the extent that the use of personal data is not in the vital interest of the data subject or with his consent, restrictions on the right to confidentiality are only permissible to protect the overriding legitimate interests of another person, and in the case of interventions by a state authority only on the basis of laws that are necessary for the reasons set out in Article 8, paragraph 2, of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210 of 1958. Such laws may only provide for the use of data that are particularly worthy of protection by their nature to protect important public interests and must at the same time establish appropriate guarantees for the protection of the data subject's interests in confidentiality. Even in the case of permissible restrictions, the interference with the fundamental right may only be carried out in the mildest way that achieves the objective.
(…)
Complaint to the data protection authority
§ 24. (1) Any data subject has the right to lodge a complaint with the data protection authority if they believe that the processing of personal data concerning them violates the GDPR or paragraph 1 or Article 2, Chapter 1.Paragraph 24. (1) Any data subject has the right to lodge a complaint with the data protection authority if they believe that the processing of personal data concerning them violates the GDPR or paragraph 1 or Article 2, Chapter 1.
(2) The complaint must contain:
1. the designation of the right considered to have been violated,
2. as far as this is reasonable, the designation of the legal entity or body to which the alleged violation of law is attributed (respondent),
3. the facts from which the violation of law is derived,
4. the reasons on which the allegation of illegality is based,
5. the request to establish the alleged violation of law and
6. the information required to assess whether the complaint was submitted in time.
(3) A complaint must be accompanied by the underlying application and any response from the respondent. In the event of a complaint, the data protection authority must provide further support at the request of the person concerned.
(4) The right to have a complaint dealt with expires if the complainant does not submit it within one year of becoming aware of the event giving rise to the complaint, but no later than three years after the event allegedly occurred. Complaints that are submitted late must be rejected.
(5) If a complaint proves to be justified, it must be acted upon. If a violation is attributable to a person responsible in the private sector, he must be instructed to comply with the complainant's requests for information, correction, deletion, restriction or data transfer to the extent necessary to eliminate the violation of law identified. If the complaint proves to be unjustified, it must be rejected.
(6) Until the proceedings before the data protection authority have been concluded, a respondent can subsequently eliminate the alleged violation of law by complying with the complainant's requests. If the data protection authority considers the complaint to be irrelevant in this respect, it must hear the complainant on the matter. At the same time, the complainant must be informed that the data protection authority will discontinue the proceedings without formal notice if the complainant does not provide reasons within a reasonable period of time as to why the complainant still considers the originally alleged violation of law to have not been eliminated, at least in part. If such a statement by the complainant changes the nature of the matter (Section 13, Paragraph 8 AVG), it is assumed that the original complaint has been withdrawn and a new complaint has been lodged at the same time. In this case too, the original complaint procedure must be discontinued informally and the complainant must be informed of this. Late statements are not to be taken into account.(6) A respondent can subsequently remedy the alleged violation of law by complying with the complainant's requests until the proceedings before the data protection authority have been concluded. If the data protection authority considers the complaint to be irrelevant in this respect, it must hear the complainant on this. At the same time, the complainant must be made aware that the data protection authority will discontinue the proceedings informally if he does not provide reasons within a reasonable period of time as to why he still considers the originally alleged violation of law to have not been remedied, at least in part. If such a statement by the complainant changes the nature of the matter (Section 13, Paragraph 8 AVG), it is assumed that the original complaint has been withdrawn and a new complaint has been lodged at the same time. In this case, too, the original complaint procedure must be discontinued informally and the complainant must be informed of this. Late statements are not to be taken into account.
(7) The complainant will be informed by the data protection authority of the status and outcome of the investigation within three months of the complaint being lodged.
(8) Any person concerned can refer the matter to the Federal Administrative Court if the data protection authority does not deal with the complaint or has not informed the person concerned of the status or outcome of the complaint within three months.
(9) The data protection authority can - if necessary - call in official experts in the procedure.
(10) The decision-making period pursuant to Section 73 AVG does not include:(10) The decision-making period pursuant to Section 73 AVG does not include:
1. the time during which the procedure is suspended until a final decision on a preliminary issue is made;
2. the time during a procedure pursuant to Art. 56, 60 and 63 GDPR. 2. the time during a procedure according to Articles 56, 60 and 63 GDPR.
3.3.3. Physical file folders
As can be seen from Article 15 Paragraph 1 GDPR, every data subject has the right to request confirmation from the controller as to whether personal data concerning them are being processed. If this is the case, they have a right to information about this personal data. In addition, the information specified in Article 15 Paragraph 1 Letters a - h or Paragraph 2 GDPR must be provided. As can be seen from Article 15, Paragraph 1, GDPR, every data subject has the right to request confirmation from the controller as to whether personal data concerning them are being processed. If this is the case, they have a right to information about this personal data. In addition, the information specified in Article 15, Paragraph 1, Letters a - h or Paragraph 2, GDPR must be provided.
The information should enable the data subject to be aware of the processing of his or her personal data and to be able to check its legality (see Recital 63 of the GDPR). The information must comply with the transparency requirement of Art. 12 Para. 1 of the GDPR, which requires that information intended for the data subject is precise, easily accessible and understandable and written in clear and simple language (Recital 58 of the GDPR; see also Jahnel, Commentary on the General Data Protection Regulation Art. 15 GDPR Rz 33). The information should enable the data subject to be aware of the processing of his or her personal data and to be able to check its legality (see Recital 63 of the GDPR). The information must comply with the transparency requirement of Article 12, paragraph 1, GDPR, which requires that information intended for the data subject is precise, easily accessible and understandable and written in clear and plain language (Recital 58 of the GDPR; see also Jahnel, Commentary on the General Data Protection Regulation Article 15, GDPR para. 33).
According to Article 15(3) GDPR, the controller must provide a copy of the personal data that are the subject of the processing. According to Article 15(3) GDPR, the controller must provide a copy of the personal data that are the subject of the processing.
According to the case law of the European Court of Justice and the Administrative Court, Article 15(3) GDPR does not establish an independent right to receive a copy of the data alongside the right to information under Article 15 GDPR. Rather, Article 15(3) sentence 1 GDPR is to be interpreted as meaning that the right to receive a copy of the personal data that are the subject of the processing under Article 15 from the controller means that the data subject is provided with a faithful and intelligible reproduction of all of this data. This right may also include the right to receive a copy of extracts from documents or even entire documents or extracts from databases that, among other things, contain personal data. containing these data, if the provision of such a copy is essential to enable the data subject to effectively exercise the rights conferred on him or her by this Regulation, taking into account the rights and freedoms of others (see the case law of the ECJ 04.05.2023, C-487/21 and the VwGH, 03.08.2023, Ro 2020/04/0035 cited by the authority concerned). According to the case law of the European Court of Justice and the Administrative Court, Article 15, paragraph 3, GDPR does not establish an independent right to receive a copy of the data in addition to the right to information under Article 15, GDPR. Rather, Article 15, paragraph 3, sentence 1 of the GDPR is to be interpreted as meaning that the right to obtain from the controller a copy of the personal data that are the subject of processing pursuant to Article 15 means that the data subject is provided with a faithful and intelligible reproduction of all of these data. This right may also include the right to obtain a copy of extracts from documents or even of entire documents or extracts from databases containing, among other things, this data, if the provision of such a copy is essential to enable the data subject to effectively exercise the rights conferred on him or her by this Regulation, taking into account the rights and freedoms of others (see the case law of the ECJ 04.05.2023, C-487/21 and of the VwGH, 03.08.2023, Ro 2020/04/0035 cited by the authority concerned).
According to Article 15, Paragraph 4 of the GDPR, the right to receive a copy pursuant to Paragraph 1b must not affect the rights and freedoms of other persons. According to Article 15, Paragraph 4 of the GDPR, the right to receive a copy pursuant to Paragraph 1b must not affect the rights and freedoms of other persons.
According to Recital 63 of the GDPR, the exception under Article 15, Paragraph 4 of the GDPR is intended to protect trade secrets and intellectual property rights, in particular copyright in software. However, it can be assumed that in principle all rights and freedoms recognized by Union or MS law will be relevant. If the controller had to provide information on an email in which other persons whose interests are to be ranked higher are also named, these documents are not covered by the right to information (cf. Haidinger in Knyrim, DatKomm Art. 15 GDPR [as of 1 October 2018, rdb.at] para. 49). According to Recital 63 of the GDPR, the exception under Article 15, paragraph 4, GDPR is intended to protect trade secrets and intellectual property rights, in particular copyright in software. However, it can be assumed that in principle all rights and freedoms recognised by Union or MS law will be relevant. If the responsible party had to provide information on an email in which other persons are also named whose interests are to be ranked higher, these documents are not covered by the right to information (cf. Haidinger in Knyrim, DatKomm Article 15, GDPR [as of October 1, 2018, rdb.at] margin number 49).
Article 15, paragraph 4 of the GDPR stipulates that the right to receive a copy "according to paragraph 3" must not affect the rights and freedoms of other persons. At first glance, this explicit reference to the right to a copy in paragraph 3 seems to contradict the system developed so far, because according to the wording it only refers to the right to a copy and not to the right to information on the content in accordance with Article 15, paragraph 1. However, this contradiction is resolved if one considers the right to a copy as a more detailed provision regarding the manner in which information about the personal data of the data subject is to be provided in accordance with Article 15, paragraph 1. Then the obligation to weigh up interests relates to the entire provision of information (see Jahnel, Commentary on the GDPR, Art. 15, Rz 42). Article 15, Paragraph 4, GDPR stipulates that the right to receive a copy "according to Paragraph 3" must not affect the rights and freedoms of other persons. This explicit reference to the right to a copy in Paragraph 3 seems at first glance to contradict the system developed so far, because according to the wording it only refers to the right to a copy and not to the right to information on the content in accordance with Article 15, Paragraph 1. This contradiction is resolved, however, if the right to a copy is viewed as a more detailed provision regarding the manner in which information on the personal data of the data subject is to be provided in accordance with Article 15, Paragraph . Then the obligation to weigh up interests relates to the entire provision of information (see Jahnel, Commentary on the GDPR, Article 15, Rz 42).
According to the provision of Section 4 Paragraph 6 of the Data Protection Act (issued on the basis of the opening clause of Article 23 of the GDPR), the right to information from a controller does not “as a rule” exist, without prejudice to other statutory restrictions, if the provision of information would endanger a business or trade secret of the controller or a third party. From the insertion "as a rule" it can be concluded that no absolute right of refusal has been created here, but that it will have to be carefully considered to what extent the provision of information actually affects this right (cf. Haidinger in Knyrim, DatKomm Art. 15 GDPR [as of 1 October 2018, rdb.at] paras. 50 - 51). According to the provision of paragraph 4, section 6 of the Data Protection Act (issued on the basis of the opening clause of Article 23 of the GDPR), the right to information from a controller does not "as a rule" exist, without prejudice to other legal restrictions, if the provision of the information would endanger a business or trade secret of the controller or a third party. From the insertion "as a rule" it can be concluded that no absolute right of refusal has been created here, but that it will have to be carefully considered to what extent the provision of information actually affects this right (cf. Haidinger in Knyrim, DatKomm Article 15, GDPR [as of October 1, 2018, rdb.at] paras. 50 - 51).
It should be noted that in his data protection complaint of September 27, 2022, which is the basis for the contested decision, the complainant submitted a violation of the right to receive complete information to the authority concerned. In doing so, he relied overall on the provision of Article 15 GDPR. It should be noted that in his data protection complaint of September 27, 2022, which is the basis for the contested decision, the complainant submitted a violation of the right to receive complete information to the authority concerned. In doing so, he relied overall on the provision of Article 15 GDPR.
The co-participating party based its refusal to provide information regarding the files essentially on overriding interests in confidentiality, which outweighed the complainant's interest in information. It argued that two labor and social court proceedings were pending against the complainant, with any email histories and statements being part of these proceedings (it is undisputed that at least one of the proceedings is still pending). Since this is precisely a contentious issue in pending civil proceedings, providing information would mean a deterioration in the procedural position of the co-participating party.
In the opinion of the Federal Administrative Court, the co-participating party thus also has a legitimate interest in confidentiality (see, for example, BVwG 22.02.2017, W214 2132040-1/15E), although it cannot be determined from the complaint to what extent the complainant's interest in the disclosure outweighs the co-participating party's interest in confidentiality. In addition, given that the complainant was provided with extensive data stored by the co-participating party (a total of 187 documents concerning the complainant as well as parts I to III of his personnel file) and that the refusal to provide information was limited to the email histories and statements in question, it must be concluded that obtaining information from the complainant that would strengthen the case goes beyond the protective purpose of the norm and that in the present case the co-participating party's interest in keeping the aforementioned email histories and statements confidential outweighs the complainant's interest. In the opinion of the Federal Administrative Court, the party involved thus has a legitimate interest in confidentiality (see, for example, BVwG 22.02.2017, W214 2132040-1/15E), although it cannot be determined from the complaint statements to what extent the complainant's interest in the disclosure outweighs the party involved's interest in confidentiality. In addition, given that the complainant was provided with extensive data stored by the co-participating party (a total of 187 documents concerning the complainant as well as parts Roman I to Roman III of his personnel file) and that the refusal to provide information was limited to the email histories and statements in question, it must be concluded that obtaining information from the complainant that would strengthen the case goes beyond the protective purpose of the norm and that in the present case the co-participating party's interest in keeping the aforementioned email histories and statements confidential outweighs the complainant's interest.
It should also be noted that the file folders requested by the complainant are exclusively physical file folders located in the office of the co-participating party. In this regard, the argument of the authority concerned that, with regard to data stored in paper files, the Supreme Court and the highest courts under public law would assume that paper files, due to their structure, cannot be classified as files within the meaning of Section 4 No. 6 DSG 2000 (cf. VfGH B 1187/2013 mwN; VwSlg 16.477 A/2004; cf. also Jahnel, Datenschutzrecht [2010] Rz 3/101) should be followed. It should also be noted that the file folders requested by the complainant are exclusively physical file folders located in the office of the co-participating party. In this regard, the argument of the authority concerned that, with regard to data stored in paper files, the Supreme Court and the highest courts under public law would assume that paper files, due to their structure and design, cannot be classified as files within the meaning of paragraph 4, item 6, DSG 2000 (cf. VfGH B 1187/2013 with further references; VwSlg 16.477 A/2004; cf. also Jahnel, Datenschutzrecht [2010] Rz 3/101), should be followed.
3.3.4. Written request of XXXX , file note "AV XXXX Employment", statement from XXXX , email correspondence, interview records of the Ministry of Education3.3.4. Written request from roman 40, memo “AV roman 40 employment”, statement from roman 40, email correspondence, interview records from the Ministry of Education
With regard to the written request from XXXX of December 12, 2023 specifically requested by the complainant in the letter of December 14, 2022, the memo “AV XXXX employment” of September 21, 2017, the statement from XXXX of February 8, 2023 and February 9, 2023, any email correspondence and interview records from the Ministry of Education, the Federal Administrative Court assumes - as the authority concerned argues in the decision and explained in more detail above in the assessment of evidence - that these documents or files do not even exist. In this regard, the co-participating party had explained to the complainant that these documents were not stored by them and thus provided (negative) information in this regard. The fact that XXXX spoke in a 2017 protocol of having "reported" every 14 days in 2014 does not contradict this finding. With regard to the written request from roman 40 dated December 12, 2023, specifically requested by the complainant in the letter dated December 14, 2022, the file note "AV roman 40 employment" dated September 21, 2017, the statement from roman 40 dated February 8, 2023 and February 9, 2023, any email correspondence and interrogation records from the Ministry of Education, the Federal Administrative Court assumes - as the authority concerned argues in the decision and explained in more detail above in the assessment of evidence - that these documents or files do not even exist. The co-involved party had explained to the complainant that these documents were not stored by them and thus provided (negative) information in this regard. The fact that Roman 40 said in a 2017 report that they had "reported" every 14 days in 2014 does not contradict this finding.
3.4. Final assessment
The responsible Senate therefore comes to the conclusion that the complainant was given complete information by the co-involved party in the present case. The complainant's right to information was therefore not violated.
Since the contested decision is not illegal within the meaning of Article 130, paragraph 1, item 1 of the Federal Constitutional Court Act (B-VG) for these reasons, the appeal against it was to be dismissed in accordance with Section 28, paragraph 2 of the Administrative Court Act (VwGVG) in conjunction with Section 24, paragraph 1 and paragraph 5 of the Data Protection Act (DSG).Since the contested decision is not illegal within the meaning of Article 130, paragraph 1, item 1 of the Federal Constitutional Court Act (B-VG) for these reasons, the appeal against it was to be dismissed in accordance with Section 28, paragraph 2 of the Administrative Court Act (VwGVG) in conjunction with Section 24, paragraph 1 and paragraph 5 of the Data Protection Act (DSG).
3.5. Cancellation of the oral hearing
According to Section 24, Paragraph 1 of the Administrative Court Act (VwGVG), the administrative court must hold a public oral hearing upon request or, if it considers this necessary, of its own motion.According to Paragraph 24, Paragraph 1 of the Administrative Court Act (VwGVG), the administrative court must hold a public oral hearing upon request or, if it considers this necessary, of its own motion.
The complainant has requested such a hearing and has also requested the summons of a total of twelve people, although it is not specifically stated which witness should be heard on which evidence (specific request for information). The people are the complainant's former director, six employees of the Education Directorate XXXX and five employees of the Federal Ministry of Education - thus obviously people who were involved in some way in the processing of the complainant's data in the context of his service and the proceedings resulting from this. In some cases, their specific involvement/function is also explained in the complainant's submissions. The complainant has requested such a hearing and has also requested that a total of twelve people be summoned, although it is not specifically stated which witness should be heard on which evidence topic (specific request for information). The persons are the complainant's former director, six employees of the Roman 40 Education Directorate and five employees of the Federal Ministry of Education - thus obviously persons who were involved in some way in the processing of the complainant's data in the context of his service and the proceedings resulting from this. In some cases, their specific involvement/function is also explained in the complainant's submissions.
According to Section 24, Paragraph 4 of the Administrative Court Act (VwGVG), the administrative court can - unless otherwise provided by federal or state law - refrain from holding a hearing regardless of a party's application if the files show that the oral discussion is unlikely to provide any further clarification of the legal matter, and neither Article 6, Paragraph 1 of the ECHR nor Article 47 of the Charter of Fundamental Rights preclude the omission of the hearing.According to Section 24, Paragraph 4 of the Administrative Court Act (VwGVG), the administrative court can - unless otherwise provided by federal or state law - refrain from holding a hearing regardless of a party's application if the files show that the oral discussion is unlikely to provide any further clarification of the legal matter, and neither Article 6, Paragraph 1 of the ECHR nor Article 47 of the Charter of Fundamental Rights preclude the omission of the hearing.
In the present case, the waiver of an oral hearing can in any case be based on the fact that the facts of the case were clarified from the files. The requested witnesses have already participated extensively and cooperatively in the first instance proceedings (which has already been acknowledged by the data protection authority). The Federal Administrative Court had to rule exclusively on a legal issue (cf. ECHR 20.06.2013, Appl. No. 24510/06, Abdulgadirov/AZE, para. 34ff). According to the case law of the Constitutional Court, an oral hearing can also be omitted if the facts are undisputed and the legal issue is not particularly complex (VfSlg. 17.597/2005; VfSlg. 17.855/2006; most recently VfGH 18.06.2012, B 155/12). In the present case, the waiver of an oral hearing can in any case be based on the fact that the facts were clarified from the files. The requested witnesses have already participated extensively and cooperatively in the first instance proceedings (which has already been acknowledged by the data protection authority). The Federal Administrative Court had to rule exclusively on a legal question (see ECHR 20.06.2013, Appl. No. 24510/06, Abdulgadirov/AZE, para. 34ff). According to the case law of the Constitutional Court, an oral hearing can also be omitted if the facts are undisputed and the legal question is not particularly complex (VfSlg. 17.597/2005; VfSlg. 17.855/2006; most recently VfGH 18.06.2012, B 155/12).
It was therefore not necessary to hold an oral hearing in accordance with Section 24, Paragraph 1 and Paragraph 4 of the Administrative Court Act. It was therefore not necessary to hold an oral hearing in accordance with Section 24, Paragraph 1 and Paragraph 4 of the Administrative Court Act.
Regarding B) Inadmissibility of the appeal:
According to Section 25a, Paragraph 1 of the Administrative Court Act, the administrative court must state in its ruling or decision whether the appeal is admissible in accordance with Article 133, Paragraph 4 of the Administrative Court Act. The ruling must be briefly justified. According to Section 25a, Paragraph 1 of the Administrative Court Act, the administrative court must state in its ruling or decision whether the appeal is admissible in accordance with Article 133, Paragraph 4 of the Administrative Court Act. The ruling must be briefly justified.
The appeal is not admissible in accordance with Article 133, Paragraph 4 of the Administrative Court Act because the decision does not depend on the solution of a legal question of fundamental importance. The decision in question does not deviate from the previous case law of the Administrative Court, nor is there a lack of case law; furthermore, the current case law of the Administrative Court cannot be judged as inconsistent. There are also no other indications of a fundamental importance of the legal question to be resolved. The appeal is not admissible under Article 133, paragraph 4, B-VG because the decision does not depend on the resolution of a legal question that is of fundamental importance. The decision in question does not deviate from the previous case law of the Administrative Court, nor is there a lack of case law; furthermore, the current case law of the Administrative Court cannot be judged as inconsistent. There are also no other indications of a fundamental importance of the legal question to be resolved.
