VwGH - Ra 2023/04/0042
From GDPRhub
| VwGH - Ra 2023/04/0042 | |
|---|---|
 | |
| Court: | VwGH (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 5(1)(e) GDPR Article 6 GDPR §25(9) AMSG |
| Decided: | 03.09.2024 |
| Published: | 01.10.2024 |
| Parties: | Arbeitsmarkservice Österreich |
| National Case Number/Name: | Ra 2023/04/0042 |
| European Case Law Identifier: | ECLI:AT:VWGH:2024:RA2023040042.L00 |
| Appeal from: | BVwG (Austria) |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | RIS (in German) |
| Initial Contributor: | ao |
A court deliberated whether a national provision can limit the storage of data processed lawfully under Article 6(1)(e) GDPR to a maximum of seven years.
English Summary
Facts
On 25 November 2019, the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde – DSB) against the controller, the Austrian unemployment office (“Arbeitsmarktservice Österreich”). The data subject received unemployment payments through the controller which is a body that helps people find employment. The controller had retained data on the data subject’s transactions relating to their unemployment between 1992 and 1994. Between 1992 and 1994, the data subject had received unemployment payments and emergency aid payments. When on the 16 November 2019 the data subject again wanted to apply for unemployment payments, his account included pre-saved information on him. It included the data subject’s address and family status as well as information on transactions between 1992 and 1994.
The DSB rejected the complaint on 3 February 2021, as it considered the processing of the data to be necessary for the execution of the controller’s current obligations.
The data subject appealed this decision to the Federal Administrative Court (Bundesverwaltungsgericht BVwG) which accepted that the processing was unlawful but rejected the claim in relation to the right to erasure. The BVwG reasoned that an Austrian law governing the actions of the controller (§25 Abs. 9 Arbeitsmarktservicegesetz – AMSG) set out a clear limit of seven years for the retention of this kind of data (as defined in paragraph 25(1) AMSG). When the data is needed after the seven year period, the data could be requested from social insurance agencies. Therefore, the BVwG concluded that the processing had been in violation of Article 5(1)(e) GDPR since 2018.
In relation to the erasure of the data, the BVwG held that the data from 1992-1994 is needed for the current unemployment payments therefore it rejected the argument that the data subject's right to erasure had been violated under Article 17 GDPR.
Both the data subject and the controller appealed the decision of the BVwG to the Higher Administrative Court of Austria (Verwaltungsgerichtshof – VwGH).
The controller argued that:
- The data supplied by the social insurance agencies is insufficient and unreliable
- That Article 6(1) (e) GDPR does not provide for such storage limitations as represented in paragraph 25(1) AMSG
- Paragraph 25(9) AMSG violates European Union law
- The BVwG with its reasoning is endangering the provision of services to unemployed persons
The data subject argued that the controller’s arguments would effectively mean that the controller could save their data forever and this is not in line with the objectives of the GDPR
Holding
The VwGH held that Article 6(2) and (3) GDPR provides for member states to be able to limit the applicability of Article 6(1)(c) & (e) GDPR and therefore the Austrian law is just a specification of European Union law. Further, recital 45 explicitly details that the general provisions on the lawfulness of processing can be made more precise, in terms of what type of data can be processed, for which purposes and how long it can be stored. Therefore, the GDPR clearly envisions purpose limitations or storage limitations to be set and the GDPR confirms this through Article 5(1)(e) GDPR. It therefore rejects the argument that paragraph 25(9) AMSG is contrary to Union law.
Further, regardless of whether tasks under paragraph 25 AMSG are carried out in the public interest or not, the storage period must be proportionate to the purpose of processing as per Article 6(3) GDPR. As paragraph 25(9) AMSG provides for the possibility of extending the seven year period in order to prepare legal claims, the court finds the storage limitation period adequate.
The VwGH held that when there are legitimate doubts as to the accuracy of a third party’s data, the principle of data minimisation can be limited. However, it rejects the argument that data provided by the social insurance agencies categorically justifies the extension of the seven year storage limitation. Social insurance agencies are equally bound by the accuracy principle, therefore it must be assumed that the data they provide is of sufficient quality.
The court therefore rejected the controller's appeal.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Ra 2023/04/0042
to 0043-16
September 3, 2024
IN THE NAME OF THE REPUBLIC!
The Administrative Court, through the Presiding Senate President
Dr. Pollak, the Court Councilor Dr. Mayr, the Court Councilor Mag. Hainz-Sator and the
Court Councilors Dr. Pürgy and Mag. Brandl as judges, with the participation of the
secretary Mag. Vonier, on the appeals 1. of the Austrian Employment Service
and 2. of the Employment Service, both represented by
Knyrim Trieb Rechtsanwälte OG in 1060 Vienna, Mariahilfer Straße 89A, against
the decision of the Federal Administrative Court of March 9, 2023,
No. W252 2242206-1/7E, concerning a data protection matter
(authority concerned before the administrative court: data protection authority; other
party: Federal Minister of Justice; co-participating party: DI E S in P),
I. passed the decision:
The appeal of the first appeal applicant is rejected.
II. rightly decided:
The appeal of the second appeal applicant is dismissed as unfounded.
Reasons for the decision:
I.
1 1. By letter dated November 25, 2019, the co-participant filed a data protection complaint with the
data protection authority (authority concerned). He
used the form of the authority concerned “Complaint to the
data protection authority (violation of the fundamental right to confidentiality pursuant to
Section 1 Paragraph 1 DSG, against the principles for the processing of personal
data pursuant to Art. 5 GDPR/the legality of the processing pursuant to Art. 6
or 9 GDPR)”, to which he attached a cover letter with further details.
2 In a further letter dated April 12, 2020 (issued in response to
the statement of the Public Employment Service [second appeal applicant] dated March 2, 2020), the co-defendant stated that his rights to erasure
and lawful processing had been violated, referring to Art. 6 GDPR with regard to the
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ra 2023/04/0042
to 0043-16
September 3, 2024
2 of 30
unlawful processing. He never complained about a "mistake in
confidentiality". This point is only due to the
“wording on the DSB form => irrelevant.”
3 2. By decision of February 3, 2021, the authority concerned rejected the
data protection complaint of the co-participant against the “Austrian Employment Service”
(first appeal applicant), which it referred to as the
respondent, as unfounded due to alleged violation of the rights to
confidentiality and deletion.
4 In its justification, the authority concerned stated in summary that the
processing of the co-participant’s data relating to his registration and reference periods, which was the subject of the proceedings, was necessary to fulfill the
respondent’s tasks. For this reason, there was also
no violation of the right to deletion.
5 3. With the contested decision (in which the applicant for the first appeal was named as a co-participating party before the administrative court), the Federal Administrative Court (BVwG) partially upheld the appeal filed by the co-participant and found that the respondent had violated the complainant's right to confidentiality by continuing to process the data from the 1992 to 1994 business transaction, such as the complainant's address and marital status, without legal basis until the new business transaction on November 16, 2019. The complaint regarding the violation of the right to erasure was dismissed. The appeal was declared inadmissible pursuant to Article 133, paragraph 4 of the Federal Constitutional Law. 6 In summary, the BVwG found that the "Austrian Employment Service" was a service company under public law with its own legal personality, which was responsible for implementing the federal labor market policy. The co-participant received unemployment benefit or emergency assistance between 1992 and 1994 and applied for unemployment benefit again on November 16, 2019. When setting up the eAMS account, the co-participant's marital status and address were pre-filled with data from the business case Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ra 2023/04/0042 to 0043-16 September 3, 2024 3 of 30 from 1992-1994. On November 19, 2019, the co-participant was awarded unemployment benefit for 364 days. 7 In its legal assessment, the BVwG stated under the heading "On the legality of processing" that the legislator had set a clear deadline of seven years for the retention of the data specified in Section 25 Paragraph 9 of the Employment Service Act (AMSG). As can be seen from the explanations to the Material Data Protection Adaptation Act 2018 (RV 65 BlgNR 26. GP 27), the deadline begins with the termination of a business transaction, thus in this specific case with the deregistration of the co-participant as a job seeker; if data from a long time ago on a benefit receipt or a preliminary registration for a later benefit application is required, this data could be transferred via the insurance file held by the main association (now umbrella organization) of the social insurance providers. The fact that the purely hypothetical reconstruction of facts (after more than seven years) from the data in the insurance file - as put forward by the respondent - appears to be more complex is irrelevant. The exception to the deletion period for asserting, exercising or defending legal claims under Section 25 Paragraph 9 AMSG or Article 17 Paragraph 3 Letter e of GDPR put forward by the respondent does not apply in the present case because no legal claims - to which the respondent as the (data protection) controller is entitled - have been demonstrated. The respondent cannot use this exception for the possible assertion of legal claims by the co-participant. The purely hypothetical case constellations put forward by the respondent did not need to be discussed in more detail because they do not apply to the case of the co-participant. The same applies to the respondent's argument regarding the framework period under Sections 14 and 15 of the Unemployment Insurance Act (AlVG). Finally, in this case, there is no "other legal provision" that provides for a longer storage period. Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ra 2023/04/0042
to 0043-16
September 3, 2024
4 of 30
The further processing or storage of the co-participant's data from the business transaction from 1992-1994 until the new business transaction in 2019 has thus violated - since the entry into force of the 2018 Data Protection Adaptation Act on May 25, 2018 - the principle of storage limitation (according to Art. 5 para. 1 lit. e GDPR). The co-participant's data should therefore have been deleted. The processing was therefore unlawful and the co-participant's right to confidentiality was violated. The current
processing of the data from the current business case, however, is unproblematic in
terms of Section 25 Paragraph 1 AMSG in conjunction with Article 6 Paragraph 1 Letter e of GDPR.
Under the heading “On the right to deletion”, the BVwG stated that the data
of the co-participant regarding the periods of receipt of emergency aid as well as the
data on employment relationships that were more than seven years ago were to be processed
on the basis of the current business case. This data, as provided for by law, would be derived from the database of the
umbrella association of social insurance providers. Since the deletion period
for this data had not yet expired at the time of the decision, the co-participant currently has no right to deletion - regardless of the unlawful
processing that has taken place in the meantime. The same applies to the name and title of the co-participant. A (possible)
determination of a past violation of the right to
deletion is not covered by the (relevant here) right of appeal of the
co-participant under Art. 17 GDPR. The complaint about a
violation of the right to deletion was therefore to be rejected. A
possible violation of the right to rectification under Art. 16 GDPR or the
right to information under Art. 15 GDPR is not covered by the subject matter of the
proceedings.
8 4. The present extraordinary appeals, which were carried out jointly, are directed against this finding.
9 The authority concerned and the co-participant each submitted a response to the appeal (without a request for reimbursement of expenses). The
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ra 2023/04/0042
to 0043-16
September 3, 2024
5 of 30
co-participants object to the
position represented in the appeal. The authority concerned, which considers the appeal (at least in part)
admissible, in turn argues that it is sticking to its legal
statements in the decision of February 3, 2021.
II.
The Administrative Court considered:
1. Rejection of the appeal by the first appeal applicant
10 According to Article 133, Paragraph 6, Item 1 of the Federal Constitutional Court Act, anyone who claims that their rights have been violated by the decision of an administrative court can appeal against it on the grounds of illegality.
11 The appeal initially argues that the “Austrian Employment Service” (first appeal applicant) has no legal personality under Section 1, Paragraph 1 of the AMSG in connection with the legislative materials.
Only the “Austrian Employment Service” (second appeal applicant) has legal personality; this is therefore also the data protection officer and bears the rights and obligations arising from it.
“Out of legal caution”, however, an appeal is being lodged by both the “Austrian Employment Service” and the “Austrian Employment Service”.
12 In this regard, reference should first be made to the case law of the
Administrative Court, according to which in cases in which
the administrative authority or now the administrative court merely makes a mistake in the
designation of the addressee of its decision, but it is obvious from the
entire settlement who was meant, the incorrect designation does not cause any harm; in such a case, there is a correctable
error, in which, as long as a correction has not been made, it must be clarified by
interpreting the decision to whom it is addressed (see, for example,
VwGH 3.2.2022, Ra 2020/17/0095, para. 13; VwGH 25.2.2019,
Ro 2017/08/0035, para. 10, each with further references).
13 According to Section 1 Paragraph 1 AMSG, the implementation of the federal labor market policy is the responsibility of the
“Labor Market Service”. The Public Employment Service is a
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ra 2023/04/0042
to 0043-16
September 3, 2024
6 of 30
service company under public law with its own
legal personality. According to Section 1 Paragraph 2 of the AMSG, the Public Employment Service is divided into
a federal organization, into state organizations for each federal state and
within the federal states into regional organizations. According to
Paragraph 3 of this provision, the federal organization is called
“Austrian Public Employment Service”. The explanations to the original version of the
AMSG make it clear in this regard that these provisions establish the Public Employment Service as a public corporation. Only the “Public Employment Service” fund has legal personality, but the
individual organizations do not (RV 1468 BlgNR 18. GP 32).
14 In the header of the contested decision, the "Austrian Employment Service" was indeed named as a co-participating party or respondent - as was already the case in the header of the decision of the authority concerned. However, in its findings, the Federal Administrative Court, based on the wording of Section 1 (1) AMSG, clearly assumed that the co-participating party (named in the proceedings before the Federal Administrative Court) was a service company under public law with its own legal personality, which was responsible for implementing the federal labor market policy. However, this finding does not apply to the first appeal applicant ("Austrian Employment Service"), but to the second appeal applicant ("Austrian Employment Service"). Nor did the Federal Administrative Court refer at any other point in the contested decision to circumstances that only concern the federal organization "Austrian Employment Service". The Administrative Court therefore has no doubt that the Federal Administrative Court made a mistake in its decision in naming the party involved in the administrative court proceedings and clearly meant the "employment service" within the meaning of Section 1 Paragraph 1 AMSG (for such a mistake in the expression in connection with the employment service, see also VwGH 21.12.2023, Ro 2021/04/0010, para. 2). 15 This assessment is not affected by the fact that the co-participant in his data protection complaint referred to the applicant for the first appeal as the respondent. The Administrative Court has already ruled that the data protection complaint only has to contain the name of the respondent pursuant to Section 24 Paragraph 2 Item 2 of the Data Protection Act if this is reasonable. If, according to the Data Protection Act, there may be cases in which it may be unreasonable for the person affected by the data processing to find out who is responsible themselves and to name them accordingly in the data protection complaint, then constellations must also be recognized in which the person affected names the person responsible inaccurately or even incorrectly (without this necessarily leading to the data protection complaint being rejected). Therefore, the correction of a designation of the respondent may be permissible within the framework of a justifiable interpretation of the party's declaration (see on all this VwGH June 27, 2023, Ro 2023/04/0013, marginal no. 34, with further references). 16 According to the established case law of the Administrative Court, only the addressee of the contested decision can assert a possible violation of law. Since the contested decision was not issued to the first appeal applicant, the latter lacks the right to file an appeal (see, for example, VwGH March 21, 2024, Ra 2024/06/0034 to 0041, marginal no. 9; with further references). 17 The appeal of the first appeal applicant was therefore rejected in accordance with Section 34 paras. 1 and 3 VwGG. 2. Rejection of the appeal by the second appeal applicant
18 2.1. In its grounds for admissibility, the second appeal applicant points out several legal questions that are considered to be fundamental and have not yet been answered by the Administrative Court in connection with the application or interpretation of Section 25 (9) AMSG and Article 6 (1)(e) GDPR.
19 The appeal is admissible to clarify the legal situation; however, it is not justified for the following reasons.
20 2.2.1. The relevant recitals and provisions of
Regulation (EU) 2016/679 of the European Parliament and of the Council of
27 April 2016 on the protection of natural persons with regard to the processing
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ra 2023/04/0042
to 0043-16
3 September 2024
8 of 30
of personal data, on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation [GDPR])
read in extracts:
“[Recitals]
(45) Where processing by the controller is carried out on the basis of a legal obligation incumbent on him or her, or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, there must be a basis for this in
Union law or in the law of a Member State. This Regulation does not require a specific law for each individual processing operation. A law as the basis for several processing operations may be sufficient if the processing is based on a legal obligation incumbent on the controller or if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. Likewise, Union or Member State law should specify the purposes for which the data may be processed.Furthermore, that right could specify the general conditions of this Regulation governing the lawfulness of the processing of personal data and could specify how the controller is to be determined, what type of personal data are processed, the data subjects concerned, to which entities the personal data may be disclosed, for what purposes and for how long they may be stored and what other measures are to be taken to ensure that the processing is lawful and fair. [...] [...][...](52) Exceptions to the prohibition on processing special categories of personal data should also be allowed where they are provided for by Union or Member State law and, subject to appropriate safeguards to protect personal data and other fundamental rights, where justified by the public interest, in particular for the processing of personal data in the field of labour law and social security law, including pensions, and for the purposes of health protection and monitoring and health alerts, prevention or control of communicable diseases and other serious threats to health. Such an exception may be made for health-related purposes, such as ensuring public health and the administration of health care services, in particular if this is to ensure the quality and cost-effectiveness of the procedures for billing for services in social health insurance systems, or if the processing is in the public interest for archiving purposes, scientific or historical research purposes or statistical purposes. The processing of such personal data should also be permitted by way of exception if it is necessary to assert, exercise or defend legal claims, whether in court proceedings or in an administrative procedure or an out-of-court procedure. [...]
Article 5
Principles for the processing of personal data
(1) Personal data must
[...]
c) be adequate, relevant and limited to what is necessary for the purposes of the
processing ('data minimisation');
d) be accurate and, where necessary, kept up to date;
all reasonable measures must be taken to ensure that personal
data which are inaccurate, having regard to the purposes of their processing,
are erased or rectified without delay ('accuracy');
e) be kept in a form which permits identification of data
subjects for no longer than is necessary for the purposes for which they are
processed; personal data may be stored for a longer period provided that the personal data are processed exclusively for archiving purposes in the public interest or for scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to the implementation of appropriate technical and organisational measures required by this Regulation to protect the rights and freedoms of the data subject ('storage limitation');
[...]
(2) The controller shall be responsible for compliance with paragraph 1
and shall be able to demonstrate compliance ('accountability').
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ra 2023/04/0042
to 0043-16
September 3, 2024
10 of 30
Article 6
Legality of processing
(1) Processing shall only be lawful if at least one of the following conditions is met:
[...]
e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
[...]
(2) Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing to fulfil points (c) and (e) of paragraph 1 by specifying more precisely specific requirements for processing and other measures to ensure lawful and fair processing, including for other specific processing situations as set out in Chapter IX.
(3) The legal basis for processing operations referred to in points (c) and (e) of paragraph 1 shall be determined by: (a) Union law; or (b) Member State law to which the controller is subject. The purpose of the processing must be specified in that legal basis or, as regards processing referred to in point (e) of paragraph 1, it must be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of the rules of this Regulation, including provisions on the general conditions governing the lawfulness of processing by the controller, the types of data processed, the data subjects concerned, the entities to which and for which purposes the personal data may be disclosed, the purpose limitation, the storage period and the processing operations and procedures that may be applied, including measures to ensure lawful and fair processing, such as those for other specific processing situations referred to in Chapter IX. Union law or the law of the Member States must
pursue an objective in the public interest and be proportionate to the legitimate aim pursued."
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ra 2023/04/0042
to 0043-16
September 3, 2024
11 of 30
21 2.2.2. The relevant provisions of the Federal Law on the
Labor Market Service (Labor Market Service Act - AMSG),
Federal Law Gazette No. 313/1994, namely Section 1 in the original version and Section 25 in the
currently relevant version, Federal Law Gazette I No. 32/2018, read in extracts:
"Labor Market Service
Section 1. (1) The implementation of the federal labor market policy is the responsibility of the
'Labor Market Service'. The Public Employment Service is a
service company under public law with its own
legal personality.
(2) The Public Employment Service is divided into a federal organization,
state organizations for each federal state and, within the federal states,
regional organizations.
(3) The federal organization is called ‘Public Employment Service
Austria’.
(4) The state organizations are called ‘Public Employment Service’
with the addition of the name of the respective federal state.
[...]
Data processing
§ 25. (1) The Public Employment Service, the Federal Administrative Court and the
Federal Ministry of Labor, Social Affairs, Health and Consumer Protection
are authorized to process personal data within the meaning of the
Data Protection Act, Federal Law Gazette I No. 165/1999, insofar as these are an essential prerequisite for
fulfilling the statutory tasks. The
types of data in question are:
1. Master data of job seekers:
a) Names (first names, last names),
b) Social security number and date of birth,
[...]
3. Data on economic and social framework conditions:
[...]
h) Insurance periods,
i) Assessment bases,
j) Amount of benefits and allowances,
k) Periods of receipt of benefits and allowances,
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ra 2023/04/0042
to 0043-16
September 3, 2024
12 of 30
l) Periods of job search.
[...]
(9) The data pursuant to paragraph 1 must be retained for seven years after the end of the respective
business transaction. The retention period is extended by periods in which the data is still required to assert, exercise or defend legal claims or other legal provisions stipulate longer periods. For economic and technical reasons, the deletion of data must be concentrated on one or two dates per year. Until then, there is no right to early deletion.
[...]“
2.3. On the subject matter of the complaint
22 The second appeal applicant argues that the Federal Administrative Court has ruled on a violation of the
right to confidentiality and thus on a request that was not the subject matter of the proceedings. The Federal Administrative Court - like the
authority concerned - did not take into account that the co-participant had stated in the administrative
procedure that he had never complained about a "mistake in confidentiality" and had thus legitimately restricted his application. The
Federal Administrative Court thus exceeded its decision-making authority.
23 In his data protection complaint (submitted using the form of the authority concerned that he used), the co-participant generally claimed a
violation of the right to confidentiality and of Art. 5 GDPR,
and the accompanying letter also stated a violation of the right to deletion. In his letter of April 12, 2020, the co-participant then argued that "no error in confidentiality" had ever been complained about (this point was only due to the "wording on the DSB form" and was therefore "irrelevant"). His rights to erasure and lawful processing had been violated, with reference to the provisions of Art. 6 (1) GDPR with regard to the latter. 24 It is clear from the ruling of the decision of the authority concerned of February 3, 2021 that the co-participant's data protection complaint was dismissed as unfounded due to an alleged violation of the rights to confidentiality and erasure. In the legal bases cited in the ruling
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ra 2023/04/0042
to 0043-16
September 3, 2024
13 of 30
the authority concerned did not rely on Section 1 Paragraph 1 DSG, but
(in particular) on Article 6 Paragraph 1 Letter e GDPR and Section 25 Paragraphs 1 and 9 AMSG
.
25 If the ruling of a decision requires interpretation in the sense that
considered on its own, it raises doubts about its content, then
its reasoning can and must be used to interpret - i.e. not to supplement or
expand - the meaning and content of the individual norm embodied therein. In this case, the principle applies that the
decision of an administrative authority is to be assessed as a whole and that the ruling
and the reasoning behind the decision form a unit (see, for example,
VwGH 3.8.2023, Ro 2020/04/0035, para. 32, with further references).
26 In the reasoning behind its decision, the authority concerned clearly assumed - based on
the legal bases cited in the ruling - that the processing of the data (from the
1992-1994 business case) relating to the reservation and reference periods was lawful on the basis of
Art. 6 (1) lit. e GDPR in conjunction with Section 25 (1) and (9) AMSG. Given that the co-participant has argued both in the data protection complaint and in the statement of 12 April 2020 that he had been injured by the unlawfulness of the data processing, it is therefore not apparent to the Administrative Court that the authority concerned - as complained of by the second appeal applicant - agreed on a request that was no longer the subject of the proceedings. 27 The same applies to the ruling of the contested decision. From the reasoning and in particular point “3.2. Regarding the legality of the processing, it is sufficiently clear that the BVwG - as requested by the co-participant - has come to the conclusion that the further processing of the co-participant's data from the business case from 1992 to 1994 (since the entry into force of the 2018 Data Protection Adaptation Act until the new business case in 2019) has proven to be unlawful with regard to Art. 5 Para. 1 lit. c and e and Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ra 2023/04/0042 to 0043-16 September 3, 2024 14 of 30 Art. 6 Para. 1 lit. e GDPR in conjunction with Section 25 Para. 9 AMSG. 28 The Administrative Court therefore does not share the view of the second appeal applicant that the Federal Administrative Court exceeded its decision-making authority.
2.4. Applicability of Section 25 (9) AMSG
29 2.4.1. In the contested decision, the Federal Administrative Court assumed that the second appeal applicant was in principle authorized to process the co-participant’s data in question here on the basis of Article 6 (1)(e) GDPR in conjunction with Section 25 (1) AMSG, but that Section 25 (9) AMSG sets a clear time limit of seven years for the retention of the data, which has been exceeded in this case.
30 The second appeal applicant claims that Section 25 (9) AMSG contains a time limit on data processing which is not provided for in the GDPR. Art. 5 para. 1 lit. e GDPR merely provides that data can only be stored for as long as it is necessary for the purposes for which it is processed. The GDPR does not stipulate specific storage periods. It is therefore questionable whether Section 25 para. 9 AMSG applies at all or whether it is a "specific provision" to adapt the application of the provisions of the GDPR within the meaning of Art. 6 paras. 2 and 3 GDPR. According to the case law of the Court of Justice of the European Union (ECJ) on the Data Protection Directive 95/46/EC (reference to ECJ 19.10.2016, C-582/14, Breyer), a more specific (national) provision may not restrict processing permitted under Art. 6 GDPR. The level of protection provided for in the GDPR may neither be exceeded nor undercut by a member state regulation. In the interpretation by the BVwG, however, Section 25 Para. 9 AMSG restricts the legality of data processing by the second appeal applicant in an inadmissible manner and endangers the fulfillment of the second appeal applicant's legal mandate (due to the impending non-availability of the personal data of the potential benefit recipients necessary for processing applications as a result of the obligation to delete data after seven years). The second appeal applicant is also not aware of any public interest (as required in Art. 6 Para. 3 GDPR) in the regulation of Section 25 Para. 9 AMSG. According to the second appeal appellant, Section 25 (9) AMSG is therefore contrary to EU law and, due to the primacy of EU law, is not applicable, which is why the data processing at issue in the proceedings is permissible pursuant to Section 25 (1) AMSG in conjunction with Article 6 (1)(e) GDPR.
31 2.4.2. The second appeal appellant’s argument is based on the premise that the (maximum) seven-year retention period provided for in Section 25 (9) AMSG, first sentence, impermissibly restricts data processing that is permissible under the GDPR. However, the Administrative Court is unable to agree with this premise for the following reasons: 32 According to Article 6 (1) (e) GDPR, the processing of personal data is lawful if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 33 Article 6 (2) and (3) of the GDPR gives Member States the possibility of adopting specific provisions to adapt the application of the provisions with regard to the justifications of Article 6 (1) (c) and (e) GDPR (see in this context Jahnel, Commentary on the GDPR [2021] Article 6, para. 82, and Kastelitz/Hötzendorfer/Tschohl in Knyrim [ed.], DatKomm Article 6, para. 56). It is therefore a matter of specifying the application of a Union law provision for certain processing situations within the framework set by the GDPR (cf. Heberlein in Ehmann/Selmayr [ed.], 3 GDPR [2024] Art. 6 para. 58). 34 Contrary to the view of the second appeal appellant, the fact that
the justifications of Art. 6 GDPR do not provide for a specific time limit for data processing
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ra 2023/04/0042
to 0043-16
3 September 2024
16 of 30
cannot lead to the conclusion that a time limit on data processing provided for in the law of the Member States (as here in Section 25
Paragraph 9, first sentence AMSG) cannot, in principle, be brought into line with the
provisions of the GDPR.35 Firstly, Recital 45 of the GDPR expressly states that the general conditions of the GDPR for regulating the lawfulness of the processing of personal data can be specified in the law of the Member States (or in Union law) and can specify, among other things, what type of personal data is processed, for what purposes and for how long it may be stored. The GDPR therefore assumes that more specific provisions in the law of the Member States can include, for example, purpose limitations or storage periods (see, for example, Roßnagel in Simitis/Hornung/Spiecker gen. Döhmann [ed.], Datenschutzrecht [2019] Art. 6 para. 2 para. 29, referring to Recital 45). 36 On the other hand, according to the case law of the ECJ, any processing of personal data must be consistent with the principles for the processing of data set out in Article 5(1) GDPR and meet the requirements for the lawfulness of the processing set out in Article 6 GDPR (see VwGH 9.5.2023, Ro 2020/04/0037, para. 23 with reference to ECJ 4.5.2023, C-60/22, Federal Republic of Germany [Electronic Court File], paras. 50, 52, 57, with further references). In addition to the condition of necessity provided for in
Article 6 (1)(e) GDPR
or the principle of data minimization pursuant to Article 5 (1)(c) GDPR
(cf. VwGH 3.9.2024, Ro 2022/04/0031, point II.5.3.), it is particularly important for the
present case that the GDPR, with the
principle of storage limitation pursuant to Article 5 (1)(e) GDPR,
standardizes a time limit for the processing of personal data
(cf. again VwGH 9.5.2023, Ro 2020/04/0037, para. 63).
37 With regard to the judgment of the ECJ C-582/14 cited by the second appeal applicant, it should again be pointed out that this decision was not made on the "predecessor regulation" of the relevant Art. 6 (1)(e) GDPR (namely Art. 7 (e) of Directive 95/46/EC) and thus not on data processing in connection with the performance of a task in the public interest, but on the "predecessor regulation" of Art. 6 (1)(f) GDPR (namely Art. 7 (f) of Directive 95/46/EC). or specifically to the balancing of the rights and interests that are in conflict in the individual case. Since no such balancing was required in this case, no general statements can be derived from this judgment for the case at hand. 38 2.4.3. Insofar as the applicant for the second appeal, with regard to Article 6 (2) and (3) GDPR, points out that it cannot be determined which
public interest is being pursued with the provision of Section 25 (9) AMSG, the following must be noted:
39 The Administrative Court has already stated that
Article 6 (1)(e) GDPR is closely related to
paragraphs 2 and 3 of Article 6 GDPR, which contain more detailed requirements for the
legal basis for the processing pursuant to Article 6 (1)(e) GDPR, which, pursuant to Article 6 (3) GDPR, are determined by Union law or the law
of the Member States to which the controller is subject. The justification is met if the task to be performed is sufficiently described in the legal basis and the data processing in question serves the purpose of fulfilling this task (cf. VwGH December 21, 2023, Ro 2021/04/0010, paras. 56, 58, with further references). 40 The requirement of Section 25 (9) AMSG, according to which data must be retained for seven years after the termination of the respective business transaction, is related to the regulation of Section 25 (1) AMSG, which authorizes the Public Employment Service to process personal data insofar as this is an essential prerequisite for fulfilling the statutory tasks and which lists the types of data in question. It is undisputed that the purpose of Section 25 AMSG - which is in the public interest - is to enable the employment service to fulfill its statutory tasks. The explanations also state in this context that the fulfillment of the large number of tasks assigned by law requires a correspondingly extensive processing of data types, both from data subjects and from companies (employers). For this reason, Section 25 AMSG enables the employment service to process a large number of data types in order to fulfill its statutory tasks (RV 65 BlgNR 26. GP 26). 41 Contrary to the view apparently held by the second appeal applicant, the regulation in paragraph 9 of Section 25 AMSG does not require any (further) independent public interest. Rather, the regulation in Section 25 AMSG as a whole is based on the objective in the public interest of enabling the Public Employment Service to retain the data specified in more detail in order to fulfil its statutory tasks - in principle limited to seven years. According to the above, the standardisation of such a period does not contradict the provisions of the GDPR. The fact that personal data may not be retained indefinitely under Section 25 AMSG, but rather a general retention period of seven years is provided for, which can be extended in individual cases (e.g. to defend legal claims), must also be seen against the background that Article 6 (3), fourth sentence, GDPR provides for processing under Article 6 (1) (e) GDPR that the legal provisions must be proportionate to the legitimate purpose pursued (see again VwGH 21.12.2023, Ro 2021/04/0010, para. 58, with further references). 42 As a result, the argument of the second appeal applicant that Article 25 (9) AMSG is contrary to the Union and therefore not applicable in the present case cannot be followed. 2.5. Interpretation of Section 25 (9), second sentence AMSG
43 2.5.1. The BVwG initially assumes that the exception to the obligation to delete after seven years provided for in Section 25 (9) AMSG for the
assertion, exercise or defense of legal claims
is not relevant
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ra 2023/04/0042
to 0043-16
September 3, 2024
19 of 30
because the second appeal applicant has not demonstrated any legal claims to which he as the responsible party
is entitled and he cannot use this exception
with regard to the assertion of legal claims of the co-participant. In addition, the case scenarios put forward by the second appeal applicant are purely hypothetical and do not apply to the other party. 44 The second appeal applicant argues that the Federal Administrative Court's ruling is jeopardizing the legal granting of unemployed persons' entitlements to benefits under the AlVG. If the second appeal applicant no longer has data when submitting a new application because it has to be deleted after seven years, it will not be possible to grant these entitlements. Contrary to the BVwG's view, not all of the data required for the assessment are contained in the insurance file of the umbrella organization of social insurance providers. In this respect, these are not "purely hypothetical" scenarios either, especially since the second appeal applicant has to deal with such cases on a regular basis. In this context, the Federal Administrative Court is also to blame for not having made the necessary factual findings (for example, in how many cases recourse is made to data that dates back more than seven years). It should also be noted that the applicant for the second appeal - regardless of the obligation of unemployed persons to cooperate - is obliged to establish the relevant facts ex officio. Since the data stored by the umbrella organization is not sufficient, he must ensure that he has the necessary data. Furthermore, if the data is deleted - as required by the Federal Administrative Court - the applicant for the second appeal could not comply with the principle of equality because the processing of applications in accordance with the law depends on whether all the necessary data from previous processes are still available to him. If Section 25 Paragraph 9 of the AMSG were to be based on the BVwG's understanding, it would have to be repealed as unconstitutional. The second appeal applicant therefore suggests
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ra 2023/04/0042
to 0043-16
September 3, 2024
20 of 30
to submit an application to the Constitutional Court for the repeal of Section 25
Paragraph 9 AMSG.
In the opinion of the second appeal applicant, the processing of personal data based on Article 6
Paragraph 1 Letter e of GDPR is therefore lawful as long as its necessity for the performance of a task in the public interest cannot be excluded.
In this case, it is again relevant whether the data could be obtained from another source (which is not the case here). An ex-ante assessment must be made, but no probabilities must be weighed up for this (in the sense of a forecast of how likely a future assertion of legal claims is); rather, provision must be made for all conceivable constellations. The present case also differs from the constellation underlying the decision of the Constitutional Court of December 12, 2017, E 3249/2016, which is why the Federal Administrative Court deviated from this case law.
Finally, the second appeal applicant argues that, contrary to the opinion of the BVwG, the exceptional circumstances of Section 25 Para. 9 AMSG (assertion, exercise or defense of legal claims) also apply to legal claims of the person affected by the data processing (here, therefore, the applicant for unemployment benefit or emergency assistance - i.e. the co-participant). The provision of Section 25 Para. 9 AMSG cannot therefore stand in the way of data storage for more than seven years. Continued data processing can instead be based on the exceptional circumstances of assertion, exercise or defense of legal claims. 45 In its response to the appeal, the authority concerned expressly adheres to
its legal opinion expressed in the decision of 3 February 2021 (which is contrary to the opinion of the BVwG) and, in summary, argues that
there is a lack of case law from the Administrative Court on Section 25 (9) AMSG.
In addition, the BVwG has not made sufficient findings as to
which data concerning the co-participant is stored in the insurance file of the
umbrella association of social insurance institutions.
46 The co-participant objects that the view of the second appeal applicant amounts to the fact that he is allowed to keep the data stored by him “virtually for life” without the need for a current business case. This is neither proportionate nor consistent with the intentions of the GDPR. 47 2.5.2. According to Section 25 Paragraph 9 AMSG, the data must be kept for seven years after the end of the respective business case. The retention period is extended by periods in which the data are still required to assert, exercise or defend legal claims or other legal provisions stipulate longer periods. 48 The explanations (RV 65 BlgNR 26. GP, 27) to the relevant
Material Data Protection Adaptation Act 2018 (hereinafter: MDSAG 2018),
with which paragraph 9 was inserted into Section 25 AMSG, read in extracts:
“Paragraph 9 regulates the retention periods of the data processed in accordance with paragraph 1
and is intended to ensure that the data can be processed for a sufficiently long period of time in accordance with the needs of the authority. The retention period is
generally set at seven years after the end of the business transaction. The
end of a business transaction is to be understood as, for example, deregistration from the preliminary registration
as a job seeker, the end of the validity period of an
employment permit or the end of a job search order.
If data from a long time ago on a benefit receipt or a preliminary registration are required for a later benefit application,
this data can be transferred via the insurance file held by the Main Association of Social Insurance Institutions.
Longer retention periods exceeding seven years may arise
for the purposes of asserting, exercising or defending
legal claims or from other legal provisions. [...]
Longer retention periods also arise in an expiring
transitional phase for reference and pre-registration periods of formerly
unemployed persons, which relate to periods before the storage of pension-relevant
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ra 2023/04/0042
to 0043-16
September 3, 2024
22 of 30
reference and pre-registration data of unemployed persons in the insurance file
at the Main Association of Social Insurance Institutions (periods before 1976)
and cannot be taken from this, but are required for the assessment and
calculation of a new claim. These data do not have to be deleted
seven years after the end of the transaction if they can still
be required for the assertion of legal claims.”
49 The legislator has therefore assumed that the data specified in Section 25 Paragraph 1 AMSG
can generally be retained for seven years and that
this retention period is extended by periods in which the data is still required
“for the assertion, exercise or defense of legal claims.”
50 It should be noted that this wording used in Section 25 Para. 9, second sentence AMSG - which refers to the necessity of data processing for the
assertion, exercise or defense of legal claims - can also be found in the GDPR (see, for example, Art. 9 Para. 2 lit. f, Art. 17 Para. 3 lit. e or Art. 18 Para. 1 lit. c GDPR) and in other
domestic data protection regulations (see, for example, Section 19 Para. 2 IEF-Service-GmbH Act or - before the Data Protection Deregulation Act 2018 came into force, Federal Law Gazette I No. 24 - the similar wording in Section 9 Z 9 DSG 2000). For the interpretation of Section 25 Para. 9 AMSG, the case law on these provisions
(or the relevant literature) can therefore also be used. 51 In this context, the GDPR is based on the idea that the
processing of personal data (among other things) should also be permitted if
it is necessary to assert, exercise or defend legal claims, be it in court proceedings
or in an administrative procedure or an out-of-court procedure (see in this regard
Recital 52 of the GDPR). The Supreme Court has again stated - in
connection with Art. 9 GDPR - that the
term legal claims is to be understood broadly and includes claims under public
and private law (see OGH 24.7.2019, 6 Ob 45/19i, point 4.2.,
with further references). The Administrative Court sees no reason to judge this differently in the case of the relevant provision of Section 25 Paragraph 9 AMSG.
52 2.5.3. The BVwG takes the view (in a first step) that no legal claims have been demonstrated to the applicant for the second appeal as the responsible party and that the applicant for the second appeal cannot use this exception to assert any legal claims of the co-participant.
53 Contrary to this view, however, neither the wording of Section 25 Paragraph 9 AMSG
(cf., in contrast, Section 9 Z 9 DSG 2000, which was based on the assertion,
exercise or defense of legal claims of the client) nor the underlying explanations indicate that
only the assertion of legal claims of the data protection
controller falls under this provision. Rather, the
term "defense of legal claims" can also be subsumed
under case constellations in which the controller
defends or contests legal claims of a third party (such as the applicant in an
administrative procedure). Therefore, the provision of Section 25 (9) AMSG does not necessarily have to concern legal claims of the controller (see in this context - on Article 17 (3) (e) GDPR - Herbst in Kühling/Buchner [ed.], GDPR [2020]3 Article 17 para. 83, and Dix in Simitis/Hornung/Spiecker gen. Döhmann [ed.], Data Protection Law [2019] Article 17 para. 37; see also Paal in Paal/Pauly [ed.], GDPR BDSG [2021] Article 17 para. 46, who speaks of the "defense against legal claims"; also Thiele/Wagner, DSG [2022] Section 24 para. 153).
54 The Federal Administrative Court was therefore wrong to assume that the exception in question under Section 25, Paragraph 9, second sentence of the AMSG was not applicable because no legal claims accruing to the applicant for the second appeal as the responsible party had been demonstrated.
55 2.5.4. However, the following considerations do not in themselves result in the contested decision being unlawful, because the Federal Administrative Court also assumed that the constellations raised by the second appeal applicant for the purpose of establishing the relevance of the exceptional circumstances lacked relevance for the present case. 56 First of all, it should be noted that the exception in Section 25 Paragraph 9
second sentence AMSG is worded (“required”) based on the fact that the
continued storage by the controller is necessary for the assertion
or defense of legal claims (see in this
context - on Art. 18 GDPR - Kamann/Braun in Ehmann/Selmayr
[ed.], GDPR [2024] Art. 18 para. 19). This would in any case be
affirmative if at the time of examining whether a possible
termination of storage (and thus deletion) of the personal
data is necessary, such a legal claim has already been asserted (or this is foreseeable).
57 The Constitutional Court stated in its decision VfGH 12.12.2017, E 3249/2016, para. 62 (in connection with the storage of paper files by a tax office) that the reference to the possibility of future proceedings before the ECHR cannot justify the storage of data taking precedence over the right to respect for private and family life pursuant to Art. 8 ECHR. In the opinion of the Administrative Court, no general statement can be derived from this on the question of the necessity of data processing for the purpose of asserting, exercising or defending legal claims (within the meaning of the GDPR or Section 25 Para. 9, second sentence, AMSG). However, it is not clear (and the second appeal appellant is also unable to explain this) why the Federal Administrative Court should have deviated from this finding of the Constitutional Court with its decision - as the second appeal appellant claims. 58 What is decisive in the present context is that the regulation on the extension of the retention period in Section 25(9) second sentence AMSG is designed as a deviation and thus an exception to the basic retention period of seven years provided for in the first sentence leg. cit. The explanations (quoted in para. 48) state that the period is “generally” set at seven years and that this processing is “sufficiently long” (RV 65 BlgNR 26. GP, 27). If one were to consider storage beyond seven years as permissible - as the second appeal applicant clearly has in mind - simply because the possibility of a future legal dispute cannot be completely ruled out, the relationship between the two provisions of Section 25 (9) first and second sentence AMSG would be reversed. In this case, the unlimited storage of data (over seven years) would be the rule and deletion (termination of storage) after seven years would be the exception. However, such an understanding of the provision presented cannot be assumed based on its wording, the system and the legislative materials. 59 The view of the second appeal applicant is also contradicted by the reference in the explanations that data from a longer period of time can be transferred via the insurance file (of the social insurance providers). This reference would not be understandable if the data could only be stored (over seven years) due to the possibility of a future legal dispute, which cannot be ruled out. The mere fact that recourse to the data stored by the umbrella organization of the social insurance providers would at most entail additional effort for the second appeal applicant cannot in itself justify longer storage of the data. The explanations (in connection with a more detailed "transitional phase") do state that certain data do not have to be deleted seven years after the end of the transaction if they "can still be needed" for the assertion of legal claims. This indicates that in such cases, the assertion or defense of legal claims does not have to be specifically foreseeable. However, since this statement is (only) found in connection with a ("expiring") "transitional phase", it cannot be concluded from this that the applicant for the second revision may in principle retain the data in question for more than seven years. Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ra 2023/04/0042
to 0043-16
September 3, 2024
26 of 30
60 The provision of Section 25, Paragraph 9, second sentence AMSG cannot therefore be understood as meaning that it automatically authorizes the applicant for the second appeal to generally retain the data specified in Section 25, Paragraph 1 AMSG for longer than seven years.
61 2.5.5. The applicant for the second appeal is unable to demonstrate that the BVwG has unreasonably denied a case-specific need for further storage of the data (after 25 May 2018 - entry into force of the MDSAG 2018): 62 The applicant for the second appeal claims - from the point of view that the contested decision endangers the fulfilment of the tasks assigned to him - that a claim to benefits (under the AlVG) is not limited to seven years and can - in particular in the case of circumstances that extend the framework period (such as self-employment or a stay abroad) or in the case of cross-border commuters - also be based on insurance periods or benefits that occurred more than seven years ago. In the opinion of the second appeal appellant, these are not purely hypothetical situations, because there are “between 670 and 1300 cases per year on average” of continued receipt of unemployment benefit, the basis of which goes back to a business transaction that took place more than seven years ago. A claim for repayment of wrongfully received benefits under the AlVG is also possible even after seven years have elapsed. In addition, the second appeal appellant claims that incorrect data may be stored in the insurance file, which is also evident in the present case, because it records receipt of unemployment benefit, while the co-participant actually received emergency assistance. 63 It must be acknowledged that the statements in the explanations on the admissibility of longer retention of data in the transitional situation presented there establish a connection to the (in these cases) lack of storage of data in the umbrella association’s insurance file. It could be deduced from this that the need for further storage of data by the second appeal applicant is also possible in other constellations in which the data contained in the insurance file cannot in principle be sufficient for the assertion or defense of legal claims. It should also be noted that further storage of data by the second appeal applicant with regard to any future assertion of legal claims (depending on the data set contained in the insurance file in this regard) may even serve the interests of the person concerned. The applicant for the second revision must also be granted that in such cases, the assessment of the necessity of further storage cannot depend on the probability that claims will be made again by unemployed persons after seven years have elapsed (and must therefore be examined and potentially rejected by the applicant for the second revision). Neither the wording of the law nor the legislative materials contain any indications as to which parameters such a probability should be used to assess (the explanations also state that the data may still be "needed" for the assertion of legal claims in the transitional case described).64 However, the second appeal applicant is unable to demonstrate the existence of such a situation in this case with his arguments. The second appeal applicant's reference to the absolute annual figures must be countered by the fact that in this case it is about storing (only) the data of the co-participant and that these absolute figures do not show any connection to the need for longer storage of this data in particular. The same applies to the second appeal applicant's references to those situations in which data from a business transaction that took place more than seven years ago may also be required to process an application. In this respect, too, the appeal does not indicate to what extent such a situation was foreseeable or had already occurred in this case (at the time of the deletion that was fundamentally required). According to the above, the second appeal applicant is not referring with this argument to the circumstances of the present individual case and the violation of the co-participant assumed by the BVwG through the unlawful processing in the period from May 25, 2018 (entry into force of the MDSAG 2018) to the new business case in November 2019. In this respect, the examples put forward in the appeal in this context are of no relevance to the present case. Rather, they are of a purely theoretical nature. However, the Administrative Court is not called upon to resolve abstract legal questions (see, for example, VwGH 6.3.2024, Ro 2021/04/0027, para. 25, with further references). 65 Even if the second appeal appellant specifically raises the inaccuracy of the co-participant's data stored in the insurance file, he does not explain to what extent this (possible) inaccuracy at the relevant time would have resulted in the second appeal appellant having to continue storing the co-participant's data for his purposes (assertion or defense of legal claims). 66 The second appeal applicant's argument regarding the alleged inadequacy of the investigation procedure or the lack of findings (with regard to the data contained in the insurance file and with regard to the number of processing of business cases with data from a longer time ago) must be countered by the fact that he does not explain to what extent these investigations or findings are relevant to the case or to what extent such findings in the present case - thus in connection with the retention of the data of the co-participant - would have led to a different result (see, for example, VwGH 16.10.2023, Ra 2023/07/0141, para. 18, with further references). 67 Based on this, the BVwG cannot be contradicted in the end if it has assumed on a case-by-case basis that the second appeal applicant, as the responsible party, has not demonstrated a need for further storage of the co-participant’s data from the 1992-1994 business case at the time the MDSAG 2018 came into force. Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ra 2023/04/0042 to 0043-16 September 3, 2024 29 of 30 68 Finally, the Administrative Court does not see itself as being compelled to comply with the second appeal applicant’s suggestion to apply to the Constitutional Court for the repeal of Section 25 (9) AMSG. The Administrative Court cannot regard the establishment of a basic seven-year retention period, from which deviations can be made under certain conditions (defined in more detail in the wording of the law in conjunction with the explanations presented), as unreasonable. 2.6. Data minimization and data accuracy 69 Finally, the second appeal appellant argues that the principle of data minimization (according to Art. 5 (1) (c) GDPR) used by the Federal Administrative Court as a justification must be reconciled with the principle of data accuracy (according to Art. 5 (1) (d) GDPR) (which is considered to be of higher value). Since the data from the umbrella organization's insurance file is not always reliable, there is a risk for the second appeal appellant of having to use incorrect data. The principle of data minimization must therefore give way if a controller (as here) has to have legitimate doubts about the accuracy of a third party's data. 70 In the present case, it is irrelevant whether there could generally be legitimate doubts about the accuracy of the data stored in the umbrella organization's insurance file. The principles for the processing of personal data set out in Art. 5(1) GDPR (including the principles of data minimization according to lit. c leg. cit. and accuracy according to lit. d leg. cit.) are aimed equally at all controllers and must be observed by them with regard to the data they process. Any inaccuracy of the data stored by the umbrella organization would therefore have to be asserted against the umbrella organization. In addition, the second appeal applicant is also unable to substantiate that the alleged inaccuracy (receiving unemployment benefit instead of emergency assistance) would have resulted in the need for the second appeal applicant to continue to store the co-participant's data on a case-by-case basis. Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ra 2023/04/0042 to 0043-16 September 3, 2024 30 of 30 The claim that this data from the umbrella organization is generally unreliable does not, however, generally justify longer storage by the second appeal applicant (beyond seven years). 2.7. Result
71 Since the appeal by the second appellant does not show any illegality of the contested decision based on the considerations presented, it was
to be dismissed as unfounded in accordance with Section 42 Paragraph 1 VwGG.
72 A denial of reimbursement of expenses could be omitted in view of the lack of
relevant applications from the co-participant and the authority concerned.
Vienna, September 3, 2024
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at
