DSB (Austria) - D123.921/0005-DSB/2019

DSB - DSB-D123.921/0005-DSB/2019
Authority:	DSB (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 1(2) GDPR Article 12(3) GDPR Article 12(4) GDPR Article 15 GDPR Article 77(1) GDPR §4 (6) DSG §2 WTBG 2017 §3 WTBG 2017 §80 WTBG 2017
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:	26.07.2019
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	DSB-D123.921/0005-DSB/2019
European Case Law Identifier:	ECLI:AT:DSB:2019:DSB.D123.921.0005.DSB.2019
Appeal:	n/a
Original Language(s):	German
Original Source:	Rechtsinformationssytem des Bundes (in DE)
Initial Contributor:	Agnieszka Rapcewicz

The Austrian DPA stated that the right to access does not always apply in absolute terms and that it may be restricted by third-party interests such as secrecy obligations. However, in order for such a restriction to apply, a data controller must properly substantiate their arguments for denying the right to access.

English Summary

Facts

The complainant had received the information that "N*** Austria" would process her personal data. In a letter she requested general information in this regard. There was no reaction, which is why she urged corresponding information in another letter. Both letters were addressed to N*** Wirtschaftsprüfungsgesellschaft mbH. Originally, the complainant did not know which company had processed her data. "N*** Austria" was not clear in this regard.

The company refused to provide information with reference to the provision of Article 15(4) GDPR as well as business secrets, copyrights and professional secrets (according to the Act on the Profession of Chartered Accountant). After several exchanges of correspondence the Respondent provided very general information. Information about the specifically processed data and a copy of this data was expressly refused. The data subject lodged a complaint with the data protection authority. The complainant requested the DPA to impose a fine on the respondent.

Holding

The DPA partly upheld the complaint and found that the respondent had violated the complainant's right to access by not providing her with any information about the specific entries of the categories of personal data (such as names, tax-relevant information). The DPA obliged the respondent to provide the relevant information to the data subject. Regarding other aspects the supervisory authority held that the complaint was unfounded and rejected the complainant's request for a fine for the respondent.

Regarding the allegations of the bank, with grounds on their secrecy obligation, the DPA also stated that the right to access does not always apply in absolute terms and that it may be restricted by third-party interests such as secrecy obligations. However, in order for such a restriction to apply, a data controller must properly substantiate their arguments for denying the right to access.

Comment

Both parties lodged complaints with the Federal Administrative Court (BVwG) against this decision (in some cases against the complaint points) (related proceedings Zlen W214 2223914-1 and W214 2224398-1). To this end, an oral hearing was held before the BVwG on July 2, 2020, and witnesses were subsequently interrogated in non-public meetings of the BVwG's decision-making Senate. In a joint pleading dated November 25, 2020, both parties withdrew their respective complaints against the contested decision. The BVwG thereupon discontinued the administrative court proceedings by resolution of December 11, 2020, GZlen W214 2224398-1 / 41E and W214 2223914-1 / 39E. The decision is therefore legally binding.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Decisive authority
Data protection authority


Decision date
07/26/2019


Business number
DSB-D123.921 / 0005-DSB / 2019


Appeal at the BVwG / VwGH / VfGH
Both parties have lodged complaints with the Federal Administrative Court (BVwG) against this decision (in some cases against the complaint points) (related proceedings Zlen W214 2223914-1 and W214 2224398-1). To this end, an oral hearing was held before the BVwG on July 2, 2020, and witnesses were subsequently interrogated in non-public meetings of the BVwG's decision-making Senate. In a joint pleading dated November 25, 2020, both parties withdrew their respective complaints against the contested decision. The BVwG thereupon discontinued the administrative court proceedings by resolution of December 11, 2020, GZlen W214 2224398-1 / 41E and W214 2223914-1 / 39E. The decision is therefore legally binding.




text
GZ: DSB-D123.921 / 0005-DSB / 2019 of July 26, 2019
[Note processor: Names and companies, legal forms and product names, addresses (incl. URLs, IP and e-mail addresses), file numbers (and the like), etc., as well as their initials and abbreviations can be abbreviated and / or changed for reasons of pseudonymisation be. Obvious spelling, grammar, and punctuation errors have been corrected.]

NOTIFICATION
SPEECH
The data protection authority decides on the data protection complaint made by Jutta A *** (complainant), represented by X *** Y *** Rechtsanwälte GmbH, against N *** Steuerberatungsgesellschaft mbH on December 13, 2018. (Respondent), represented by Z *** Rechtsanwälte GmbH, due to violation of the right to information as follows:
1. The complaint is granted in part and it is established that the respondent has violated the complainant's right to information by not providing her with any information about the specific entries of the categories of personal data (such as names, tax-relevant information).
2. The respondent is instructed to provide the complainant with information in accordance with Art. 15 (1) (b) GDPR on the specific entries of the categories of the processed personal data in accordance with point 1 within a period of two weeks, in the event of any other execution.
3. Otherwise, the complaint is rejected as unfounded.
4. The Appellant's request for a fine to be imposed on the Respondent is rejected.
Legal basis: Art. 1 Paragraph 2, Art. 12 Paragraph 3 and 4, Art. 15, Art. 77 Paragraph 1 of Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR), OJ No. L119 of 4.5. 2016; §§ 4 Paragraph 6, 24 Paragraph 1 and 5 of the Data Protection Act - DSG, Federal Law Gazette I No. 165/1999 as amended; Sections 2, 3, 80 of the Federal Act on Public Accountants (Wirtschaftstreuhandberufsgesetz 2017 - WTBG 2017) Federal Law Gazette I No. 137/2017 as amended.
REASON
A. Arguments of the parties and course of the procedure
1. In her complaint of December 13, 2018, the complainant, represented by a lawyer, essentially submitted that she had received the information that "N *** Austria" would process her personal data. In a letter dated October 5, 2018, she requested general information in this regard. There was no reaction, which is why she urged corresponding information in a letter dated October 23, 2018. Both letters were addressed to N *** Wirtschaftsprüfungsgesellschaft mbH. Originally, the complainant did not know which company had processed her data. "N *** Austria" was not clear in this regard.
In a letter dated October 29, 2018, the Respondent refused to provide information with reference to the provision of Art. 15 (4) GDPR as well as business secrets, copyrights and professional secrets. It emerged from this letter that the complainant was to be regarded as the person responsible for the processing of personal data.
In a letter dated November 7, 2018, the complainant pointed out that a blanket reference to confidentiality obligations did not constitute a reason for a complete refusal to provide information. In addition, she once again described the scope of the information requested and set a deadline of November 15, 2018. In a letter dated November 15, 2018, the Respondent stated that the letter of October 05, 2018 did not constitute a request for information in accordance with Art. 15 GDPR and that the deadline of Art. 12 Para. 3 GDPR did not end until November 23, 2018 . In addition, the respondent had made use of an extension of the deadline in accordance with Art. 12 (3) GDPR.
In terms of content, the respondent's representative had again pointed out that the complainant's data were available, but that they would not be released on the instructions of the respondent's client.
In a letter dated November 19, 2018, the complainant's representative pointed out that in the case at hand, the requirements for the application of the provisions of Art. 12 (3) 2nd sentence GDPR would not be met. In addition, it was pointed out that the respondent's client did not have any right to dispose of the complainant's rights as a data subject and that a corresponding instruction to refuse to provide information was irrelevant.
By letter of November 23, 2018, the Respondent provided very general information. Information about the specifically processed data and a copy of this data was expressly refused. After corresponding information from the complainant's representative, the respondent only referred to the existence of professional secrecy in the statements of November 15, 2018 and November 23, 2018 and, as an alternative, referred to the provision of Art. 15 (4) GDPR. With regard to the respondent's reference to the provision of Art. 15 (4) GDPR, however, it should be noted that, according to a completely unanimous view, this provision relates to the right to receive a copy of the processed data in accordance with Art. 15 (3) GDPR. In addition, the respondent had referred to a non-existent release from professional secrecy according to § 80 WTBG. A restriction of the complainant's right to information in accordance with Art. 15 GDPR through the professional secrecy obligation under the WTBG would only be permissible due to the direct applicability of the provisions of the GDPR and their priority of application if a specific provision corresponding to the requirements of Art. 23 GDPR provided for restrictions. Such a provision is not provided for in the WTBG, unlike, for example, in the RAO.
The information provided is incomplete and does not meet the requirements of Art. 15 GDPR.
In summary, the complainant stated as follows:
- Art. 15 para. 1 lit. a GDPR
The respondent had not given any information about the legal basis for the processing of the complainant's personal data. Such information would in any case be necessary for the respondent to assess the legality of the data processing, even if this is not expressly mentioned in Art. 15 (1) GDPR.
- Art. 15 para. 1 lit. b GDPR
The general information on the data categories processed by the Respondent would not comply with the legal requirements, so that the Respondent's information remains incomplete on this point as well.
- Art. 15 para. 1 lit. c GDPR
The general information provided by the respondent on any transmission of the complainant's data would not comply with the legal requirements and the information would also remain incomplete on this point.
- Art. 15 para. 1 lit.d GDPR
With regard to the storage period of the data concerning the complainant, the respondent generally refers to the retention periods according to § 132 BAO, § 212 UGB and § 98 WTBG.
It was undisputed that the complainant had no contractual relationship with the respondent, that the respondent was not entrusted with accounting or tax declaration tasks for the complainant, and that the complainant was also not the client of the respondent or was involved in a transaction within the meaning of Section 90 of the WTBG .
Insofar as the information provided by the Respondent on the duration of the storage would therefore be ineffective, the Respondent also provided incomplete information with regard to this point.
- Art. 15 para. 1 lit. g GDPR
In particular with regard to the origin of the data, the Respondent refers to the provision of Art. 15 (4) GDPR, according to which the information is to be restricted if the rights of third parties are opposed.
However, this reference is irrelevant because this provision relates in particular to the right of the data subject to receive a copy of the processed data in accordance with Art. 15 (3) GDPR.
2. The respondent, who was represented by a lawyer, put forward in a summarized statement of 15 January 2019 that the complainant was the wife of a later marriage of Josef A ***, who died in May 2017. There are at least two probate proceedings open. The complainant was a party in these proceedings. A central legal question is whether the testator had his last place of residence and habitual residence in Austria or Switzerland. The respondent had passed on information to the B *** tax * research company on behalf of her client, from which the tax residence could be inferred. This information also includes cornerstones of the family and social situation of the deceased, and therefore also some information about the complainant as his wife. This information is also important for legal issues pending in court.
On October 23, 2018, the complainant submitted a request for information to the respondent for the first time. The respondent's client categorically refused to pass on all information. The client would have good reason to fear that the complainant was not interested in data protection, but that she was trying to gain an advantage in civil proceedings and to exert pressure. The Respondent explained this to the Complainant in a letter dated November 15, 2018. The Respondent had received information from the Chamber of Tax Advisors and Auditors that compliance with the duty of confidentiality was expected.
After the partial release from the duty of confidentiality by her client, the respondent prepared a GDPR-compliant information and provided the complainant with information in a letter dated November 23, 2018. The information was given in good time. The complainant's letter of October 5, 2018 was addressed to the wrong person and contained no reference to data protection law.
Art. 15 GDPR restricts the data subject's right to information in paragraph 4 whenever the rights and freedoms of other persons are affected. This applies not only to the distribution of copies, but also restricts the provision of information in accordance with Paragraph 1.
The right to secrecy in the RAO and in the WTBG should be regarded as equivalent.
The complainant was a party to various proceedings and she was aware of other proceedings. For this reason, after careful consideration and consultation with the client, certain facts were disclosed, but other facts were not disclosed.
In summary, the Respondent stated as follows:
- Art. 15 para. 1 lit. a GDPR
In the information provided by the respondent, information is provided about the purpose of the processing so that the data subject can review the purpose limitation. It is not necessary to provide information on every category of personal data.
- Art. 15 para. 1 lit. b GDPR
The data categories were chosen in such a way that they provide a quick and understandable overview and at the same time the client or his informants and whistleblowers remain protected and unidentifiable. A more precise presentation could curtail the rights of third parties and give the complainant an unreasonable advantage in the pending civil proceedings.
- Art. 15 para. 1 lit. c GDPR
The specification of recipients and recipient categories are alternatively side by side. It was decided to provide information about the categories of actual recipients of personal data.
- Art. 15 para. 1 lit.d GDPR
According to § 98 WTBG, a tax advisor has to keep documents for at least five years after the last transaction, which serve the fulfillment of duties of care towards clients. It is correct that the complainant has no contractual relationship. However, your data is relevant in the context of a client relationship.
With regard to the BAO, reference is made to the stRsp, according to which the data to be kept would also include basic records that would help to reconstruct the business case precisely (e.g. VwGH 3.6.1992, 87/13/0128).
- Art. 15 para. 1 lit. g GDPR
The origin of the data is one of the critical pieces of information that could give the complainant an unreasonable advantage in civil proceedings.
The restriction of information on the origin of the data is necessary in view of the conflicting rights and obligations of third parties.
3. In the context of the hearing of the parties granted by the data protection authority to the results of the investigation, the complainant essentially stated that the complainant in the present proceedings is not concerned with the enforcement of her rights under the GDPR, but that she is pursuing and implementing other goals the complaint exerts undue pressure on the client or others, is strictly rejected.
The attached statement of the Chamber of Tax Advisors and Public Accountants is not binding for the proceedings in question. A restriction of the rights of the data subject is only permissible if a regulation corresponding to the requirements of Art. 23 GDPR provides for such restrictions. The respondent's client has no authority to dispose of the complainant's rights.
Once again it is expressly stated that the prerequisites for a restriction of the obligation to provide information with regard to the respondent in the present proceedings are not met. The complainant again stated that the information provided was incomplete and did not meet the legal requirements.
B. Subject matter of the complaint
Based on the submission of the complainant, it emerges that the subject of the complaint is the question of whether the respondent has violated the complainant's right to information by providing incomplete information.
C. Factual Findings
The complainant is the spouse from a later marriage of Josef A ***, who died in May 2017. The complainant is a party in the probate proceedings before the district court V *** to GZ 3 A 1 * 8 / * v and before the Swiss division office of the city *** as inheritance authority for the inheritance E.201 * .2 * 3. The Respondent has transmitted information to the B *** tax * research company on behalf of her client. This information also includes cornerstones of the family and social situation of the deceased and therefore also some information about the complainant as his wife.
The complainant brought in the context of the ho. Procedure to Zl. DSB-D123.224 in experience that the respondent processes her personal data. The Respondent was referred to in these proceedings as "N *** Austria". In a letter dated October 5, 2018, the complainant requested the following information:
- Who has commissioned N *** Steuerberatungsgesellschaft mbH to provide information on Mr. Josef A *** (as general partner of Q. A *** KG) to B *** tax * forschungsgesellschaft?
- What information was given to the B *** tax * research company about Mr. Josef A *** and his family?
- Why was the permission of the estate according to Mr. Josef A *** to pass on information about the testator not obtained?
The letter was addressed to N *** Wirtschaftsprüfungsgesellschaft mbH. At the time, the complainant did not know which company was processing her data. In a letter dated October 23, 2018, the complainant urged corresponding information as follows:
I refer to the attached letter from our law firm dated October 5, 2018, which I attach again for information. Since N *** Steuerberatungsgesellschaft mbH did not respond within the deadline set by us, I am sending you this letter again with the polite request to take care of this matter.
This is also a request within the meaning of Art 15 GDPR.
Should we remain without a reaction from N *** Steuerberatungsgesellschaft mbH by the end of October 2018, we are instructed by our clients to initiate the necessary legal steps.
In a letter dated October 29, 2018, the Respondent announced that it had not been released from its duty of confidentiality by its client and that it could not provide any information on points 1 and 2. Regarding point 3, the Respondent stated that there was no reason to obtain approval due to the lack of a contractual relationship.
In a letter dated November 7, 2018, the complainant once again described the scope of the information requested as follows and set the respondent a deadline of November 15, 2018:
For clarification, we would like to point out once again that the information to be provided in accordance with Art 15 GDPR also includes the following information in addition to the information about the specifically processed personal data:
- Processing purposes and legal bases for processing;
- categories of personal data that are processed;
- Recipients to whom the personal data has been disclosed (including processors in accordance with Art 28 GDPR and joint controllers in accordance with Art 26 GDPR, as well as recipients in third countries);
- Categories of recipients to whom the data may still be disclosed;
- planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration;
- all available information about the origin of the personal data;
- The possible existence of automated decision-making including profiling in accordance with Art 22 Paragraph 1 GDPR and meaningful information about the logic involved and the scope and intended effects of such processing for the person concerned.
 In a letter dated November 15, 2018, the Respondent informed that the complainant's request for information had been received on October 23, 2018 and that the deadline expired on November 23, 2018.
With a letter dated November 19, 2018, a deadline of November 23, 2018 was granted for the last time.
In a letter dated November 23, 2018, the Respondent communicated as follows with regard to the complainant's request for information:
We take note of your statements that our client could have anticipated the will of your lawyer represented client with regard to a request for information in accordance with Art 15 GDPR and should have instructed her accordingly - with some astonishment. In any case, we deny that this will, if it existed at all, was apparent before October 23, 2018.
We have meanwhile worked with the Chamber of Tax Advisors and Auditors ("KSW")
Held in consultation and learned from the deputy chamber director that it is the legal view of the KSW's DSGVO working group that no data may be released, especially not if the tax advisor has been advised of an ongoing procedure.
It is of course the case that KSW cannot provide a legally binding interpretation of the GDPR, but our client has to face the reality that if they violate them, they sometimes have to face serious legal consequences.
We are not of the opinion that Art.15 GDPR can be interpreted in this way: In our opinion, your client has the right to information about information in accordance with Art.15 Paragraph 1 GDPR. Based on the aforementioned professional law and factual considerations, our client has now received the consent from their clients to disclose the following information:
- Processing purposes: N *** Steuerberatungsgesellschaft mbH carries out data processing in relation to Ms. Jutta A *** for the purpose of tax advice and auditing on behalf of her clients. The activities result directly from § 2 and § 3 Public Accountants Act ("WTBG").

- Categories of personal data that are processed: names, tax-relevant information about persons (e.g. habitual residence, living conditions of the person) in relation to Ms. Jutta A ***.

- Categories of recipients to whom the personal data have been disclosed or are still being disclosed: N *** Steuerberatungsgesellschaft mbH works with an external expert with regard to Ms. Jutta A ***. Personal data is only shared in exceptional cases. N *** Steuerberatungsgesellschaft mbH transmits data to IT service providers for storage. N *** Steuerberatungsgesellschaft mbH will, if necessary, disclose personal data to courts, authorities, tax consultants, auditors, lawyers or notaries if this is necessary for the performance of their tasks.

- N *** Steuerberatungsgesellschaft mbH stores personal data for as long as required by professional, tax or company law provisions, i.e. five years according to Section 98 (1) WTBG or seven years according to Section 132 (1) Federal Fiscal Code ("BAO") or Section 212 (1) Corporate Code (“UGB”).

- There is no automated decision-making.

You also have the following rights:
- Your client can complain to the Austrian data protection authority.
- Your client has a right to deletion, correction, restriction of processing or a right to object to the processing of personal data by the person responsible.
Information on specifically processed personal data from files from N *** Steuerberatungsgesellschaft mbH (Art 15 Paragraph 1 GDPR) and a copy of this data in accordance with Art 15 Paragraph 3 GDPR cannot be made in view of the ongoing procedure. Likewise, no information can be given about certain information according to Art 15 Paragraph 1 GDPR, such as the origin of the data. In accordance with Art 15 (4) GDPR and Recital 63 GDPR, the information must be restricted if the rights of third parties conflict, which is the case here.

In the present case, specific content from the files and information on the origin of the data are subject to professional secrecy in accordance with Section 80 (1) WTBG. Accordingly, tax consultants and auditors are bound to secrecy in all matters entrusted to them. The duty of confidentiality would only be waived if the client expressly released our client from their obligation (Section 80, Paragraph 4, Item 2 of the WTBG). Other reasons according to § 80 Abs 4 WTBG would not be considered in your case anyway.

N *** Steuerberatungsgesellschaft mbH does not process any data from your client for whom there is a further release from the obligation of confidentiality. For this reason, only general information as given above can be provided.

Assessment of evidence: The findings are based on the undisputed submissions of the parties as well as on the documents submitted in the letters to the data protection authority.
D. From a legal point of view, it follows:
1. General information on the right to information
According to Art. 15 GDPR, the person concerned has the right to request confirmation from the person responsible as to whether personal data concerning them are being processed and, if this is the case, information about this personal data and about the information specified in Art. 15 Para. 1 lit. a to h leg. cit. to receive the information listed.
According to Art. 12 Para. 3 GDPR, the person responsible must then provide the applicant with corresponding information within the standard period of one month from receipt of a request for information or provide them with the relevant information in accordance with Art. 12 Para. 4 leg. Cit. to inform about the main reasons for not taking action.
In the present case, the complainant undisputedly sent a request for information to the respondent no later than October 23, 2018. The standard period of one month is therefore calculated from October 23, 2018. The Respondent provided information in a letter dated November 23, 2018. The complainant does not object to late information and is therefore undisputed.
The right to information is important for the data subject in several ways. First of all, it should ensure that they are aware of whether any data concerning them are being processed at all. If this is answered in the affirmative, she should be able to find out which data is involved. This knowledge of the processing forms the basis for the data subject to be able to check the lawfulness of the processing. The right to information is also required so that the person concerned can assert their rights to correction, deletion and blocking, and the right to object to processing (cf. Ehmann / Selmayr [Hrsg], General Data Protection Regulation, Art. 15, 1; see also the judgment of the ECJ of May 7, 2009, C-553/07 margin nos. 49 to 51).
According to the jurisprudence of the Administrative Court on § 26 DSG 2000, which can also be transferred to the currently applicable legal situation, the legislature has recognized the person affected by data processing to have no further justification in the information to the extent provided for in this provision. The information must be so specific that the data subject can enforce his rights to rectification and erasure both against the source of the data and against the recipients of the transmission (VwSlg. 17.706 A / 2009 with further references).
2. To restrict the right to information through the professional confidentiality obligation
In its response to information dated November 23, 2018, the Respondent refers to the provision of Art. 15 (4) GDPR, to Recital 63 of the GDPR and to the confidentiality obligation standardized in Section 80 of the WTBG.
According to Art. 15 Paragraph 4 GDPR, the right to receive a copy in accordance with Paragraph 3 must not impair the rights and freedoms of other persons.
The statement in Recital 63, 5th sentence, that the rights and freedoms of other persons should not be impaired by the right of information, can only be related to the wording of Art. 15, Paragraph 4, i.e. the right to copy, but should not be understood as a general exception to the right to information (Haidinger in Knyrim, DatKomm Art. 15 GDPR margin no. 50, as of October 1, 2018, rdb.at).
Insofar as the Respondent relies on Article 15 Paragraph 4 GDPR in conjunction with Recital 63 of the GDPR with regard to information about the processed personal data, it must be countered that this provision is only understood as an exception to the right to copy within the meaning of Article 15 Paragraph 3 GDPR can be.
However, this does not mean that a restriction of the right to information is not possible, as will be explained below.
Furthermore, the Respondent relies on the obligation of confidentiality set out in Section 80 of the WTBG. It should be noted that the old legal situation within the framework of the DSG 2000 already provided for professional secrets to be taken into account when providing information, but a blanket invocation of professional secrets without further justification cannot effectively be countered to a request for information (cf. Decision of the Federal Administrative Court of September 27, 2018, Zl. W214 2127449-1 with further references). In addition, the provision of information cannot be made dependent on whether a responsible person is released from the obligation of confidentiality by a client.
The European legislator assumes that the rights and freedoms granted by the GDPR do not apply without restriction and must be weighed against other fundamental rights while observing the principle of proportionality (cf. Art. 1 (2) and Recital 4, second sentence, GDPR). To achieve this goal, corresponding restrictions of the fundamental right to data protection and the associated rights of data subjects are provided, either in the GDPR itself (cf. for example Art. 1 Para. 2 itself, Art. 12 Para. 5 and, in connection with the right to Receipt of a data copy, Art. 15 Para. 4 GDPR) or through a correspondingly granted scope ("opening clauses"), which enables the national legislator to provide for corresponding restrictions in national provisions under the conditions specified in Art. 23 GDPR.
It should be noted that in the decisive amendment of the WTBG, unlike in the RAO, no use was made of Art. 23 GDPR (see Federal Law Gazette I No. 32/2018). A restriction of the right to information can therefore only be justified by taking into account a weighing of interests in accordance with Art. 1 Para. 2 GDPR.
Taking these considerations into account, it should be noted that the right to information does not apply in absolute terms and that data protection rights of third parties must also be protected in this context. Due to the pending probate proceedings, with regard to the granting of effective litigation and to safeguard the litigation interests of the client of the respondent, it can be assumed that the client's interest in secrecy and the respondent's interest in a full claim to information by the complainant was rightly held against.
In any case, a justified refusal exists if the client would weaken his own litigation situation if the order was placed in full, for example in a pending legal dispute with the information applicant; also with regard to a third party, if his business relationship would have to be disclosed (see also the already cited decision of the Federal Administrative Court of September 27, 2018 on the refusal to provide information according to Art. 15 GDPR).
The Respondent's refusal to provide full information is therefore considered permissible. The respondent has a legitimate interest in secrecy that the complainant's interest in information outweighs.
For the present procedure, this means the following:
3. Information about processing purposes (Art. 15 Para. 1 lit. a GDPR)
According to Art. 15 Para. 1 lit. a GDPR, the person responsible must provide the data subject with information about his processing purposes. This information enables verification of the purpose limitation in accordance with Art. 5 Para. 1 lit. b GDPR.
In its information to the complainant dated November 23, 2018, the Respondent names tax advice and auditing on behalf of its clients as the purposes of processing and refers to the activities listed in Sections 2 and 3 of the WTBG.
A deficiency of the information regarding the processing purposes cannot be recognized.
4. Information about data categories (Art. 15 Para. 1 lit. b GDPR)
According to Art. 15 Para. 1 lit b GDPR, there is a right to information about the categories of personal data that are being processed.
The Respondent's response to information on November 23, 2018 shows that the Respondent lists the processed data categories “names” and “tax-relevant information about persons”. With regard to the mentioned category “tax-relevant information on persons”, the Respondent cites, for example, “habitual residence” and “living conditions of the person”.
According to the old legal situation, the "categories of data" that are the subject of processing had to be disclosed as part of the information (cf. Art. 12 Directive 95/46 / EC).
In the judgment of May 7, 2009 already quoted, the ECJ stated that this right to privacy requires that the data subject can ensure that their personal data is being processed correctly and that the processing is permissible, i. H. in particular that the basic data concerning them are correct and that they are addressed to recipients who are authorized to process them. This is necessary to enable the data subject, among other things, to exercise the right to correction (see margin nos. 49 and 51).
However, if the exercise of the right to correction is to be enabled, this requires information on the exact entries. Would the information be limited to abstract data categories such as “name”, “address” and the like. processed, a request for rectification could be asserted impossible (cf. in this sense the decision of February 13, 2018, GZ: DSB-D122.754 / 0002-DSB / 2018) from the constant case law of the data protection authority. An exception could only be seen if this is necessary from the point of view of a weighing of interests in favor of the rights of third parties.
In the provision of Article 15 (1) (b) GDPR ("Categories of personal data"), the European legislator adopted the previous wording on the right to information ("Categories of data") in Article 12 (a) of RL 95 / 46 / EC.
If the respondent only names abstract categories and not what the specific entries were, the complainant cannot check whether the personal data relating to her are correct.
In addition, the Respondent has not submitted any substantiated submissions that give rise to reasons that prevent full information regarding the specific entries of these data categories. In the opinion of the data protection authority, information on the specific entries cannot be objected to, especially since it is not clear why the provision of "basic data" could weaken one's own process situation.
The respondent is therefore required to provide sufficiently clear information with regard to the data categories and to inform the complainant of the actual entries (such as names, tax-relevant information).
5. Information about recipients or categories of recipients (Art. 15 Para. 1 lit. c GDPR)
According to Art. 15 Para. 1 lit. c GDPR, there is a right to information about the recipients or categories of recipients to whom the personal data have been disclosed or are still being disclosed, in particular for recipients in third countries or international organizations.
The ECJ has already stated that the right to information about the recipients or categories of recipients serves as an instrument to carry out the necessary verifications and in particular to be able to check whether the recipients are authorized to process (see the judgment of the ECJ of 7 May 2009, margin no.49).
In its response, the Respondent names an external expert and IT service provider as the recipient of the transmission. The respondent also names courts, authorities, tax advisors, auditors, lawyers and notaries as possible recipients.
The information can either be given about the recipients or only categories of recipients to whom the person responsible has disclosed or will disclose the data (cf. Haidinger in Knyrim, DatKomm Art. 15 GDPR margin no. 39, as of October 1, 2018, rdb.at) . Whether information is given to specific recipients or just categories of recipients must be assessed in an individual case, taking into account the rights of third parties and the proportionality of the effort (cf. the case law of the Constitutional Court, which is also applicable to the new legal situation, VfSlg. 18.230 / 2007, as well as that of the Administrative Court, VwSlg. 17.680 A / 2009).
In the present case, information was only given to categories of recipients. Against the background of the pending proceedings, where any recipients may be significant, the data protection authority does not believe that this raises any concerns.
A deficiency in the information can therefore not be seen.
6. Information about the storage period (Art. 15 Para. 1 lit. d GDPR)
According to Art. 15 para. 1 lit.d GDPR, there is a right to information about the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration.
The response to the information shows that the Respondent refers to the relevant professional, tax and company law provisions with regard to the storage period and states the specific statutory storage period.
If possible, information is to be given about the planned storage period for the data or, if this is not possible, about the criteria for determining this period (see Haidinger in Knyrim, DatKomm Art. 15 GDPR margin no. 42, as of October 1, 2018, rdb.at).
In the opinion of the data protection authority, the specification of the legally prescribed storage period is considered sufficient. A deficiency in the information regarding the storage period cannot be recognized.
7. Information about the origin of the data (Art. 15 Para. 1 lit. g GDPR)
If the personal data are not collected from the data subject, there is a right to information about all available information about the origin of the data in accordance with Art. 15 (1) lit. g GDPR.
The Respondent stated in its response to the information that it was unable to provide any information about the origin of the data.
In the opinion of the data protection authority, it appears clear that the complainant's knowledge of the origin of the data in the pending probate proceedings can strengthen her own litigation situation. The Respondent was entitled to refuse to provide information.
A deficiency in the information regarding the origin of the data cannot be recognized.
8. Application for a fine to be imposed on the Respondent
Finally, the complainant's express request for a fine to be imposed on the respondent had to be discussed.
It should be noted that a subjective right to initiate criminal proceedings against a certain person responsible cannot be derived from Art. 77 Paragraph 1 GDPR or Section 24 Paragraph 1 and 5 DSG and, furthermore, the principle according to Section 25 Paragraph 1 VStG the official access applies (cf. Fister in Lewisch / Fister / Weilguni [Hrsg, VStG Comment2 [2017] § 25 Rz 1).
A person concerned can therefore only initiate administrative criminal proceedings; there is no entitlement to initiate such proceedings.
Overall, therefore, a decision had to be made according to the ruling.


Decision on DPO document (BVwG)
By resolution of December 11, 2020, GZlen W214 2224398-1 / 41E and W214 2223914-1 / 39E, the BVwG discontinued the administrative court proceedings on the complaints raised by both parties after both complaints had been withdrawn.


European Case Law Identifier
ECLI: AT: DSB: 2019: DSB.D123.921.0005.DSB.2019