BVwG - W274 2246166-1: Difference between revisions
From GDPRhub
No edit summary |
No edit summary |
||
| (14 intermediate revisions by 3 users not shown) | |||
| Line 56: | Line 56: | ||
}} | }} | ||
The Federal Administrative Court held that a data subject | The Federal Administrative Court held that the Austrian DPA rightfully rejected a complaint by a data subject regarding an access request that was responded late but during the administrative proceedings. It also held that when large amounts of data are processed, access requests may be answered in a two-step approach. | ||
== English Summary == | == English Summary == | ||
=== Facts === | === Facts === | ||
The data subject has requested access to | The data subject has requested access to their personal data under [[Article 15 GDPR|Article 15 GDPR]]. The controller (Arbeitsmarktservice Österreich) did not fulfill the request at first. Later – during the administrative proceeding – the controller, however, did. Thereupon, the DSB (Austria) informally closed the proceeding. The data subject objected to the termination of the proceedings on the grounds that the answer to their request was too late and was insufficient. The DSB maintained its decision arguing that the data subject has no right to have a past violation of the GDPR determined and that the assertion of insufficiency is be regarded as a new submission under § 13(8) AVG since it changes the substance of the matter. | ||
=== Holding === | === Holding === | ||
The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision and reasoning of the DSB. | The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision and reasoning of the DSB. | ||
First, the court elaborated on [[Article 15 GDPR|Article 15 GDPR]] though these statements were not necessary for the decision of the case. | First, the court elaborated on [[Article 15 GDPR|Article 15 GDPR]] though these statements were not necessary for the decision of the case. It held that a data subject has no general duty to cooperate, but at most an obligation to specify if the controller processes a large amount of data and the data subject makes a very general request or is only interested in specific information or data processing. In these cases, the controller can request clarification from the data subject, but has no right to do so. The data subject may nevertheless insist that all data be disclosed. This means that the two-stage information procedures that occur in practice, in which the data controller initially only provides information on master data and only provides comprehensive information at the express request of the applicant, are perfectly permissible, <u>provided that the applicant is made aware of this fact</u>. | ||
It held that a data subject has no general duty to cooperate, but at most an obligation to specify if the controller processes a large amount of data and the data subject makes a very general request or is only interested in specific information or data processing. In these cases, the controller can request clarification from the data subject, but has no right to do so. The data subject may nevertheless insist that all data be disclosed. This means that the two-stage information procedures that occur in practice, in which the data controller initially only provides information on master data and only provides comprehensive information at the express request of the applicant, are perfectly permissible, provided that the applicant is made aware of this fact. | |||
Second, the court determined that the DSB was not allowed to close the proceedings informally but should have issued a formal notice according to § 24(6) BDSG because the data subject had objected with reasons against the termination of the proceedings. | Second, the court determined that the DSB was not allowed to close the proceedings informally but should have issued a formal notice according to § 24(6) BDSG because the data subject had objected with reasons against the termination of the proceedings. | ||
Third, the court stipulated that the complaint about the delayed response by the controller does not amount to a new complaint under § 13(8) AVG but is encompassed | Third, the court stipulated that the complaint about the delayed ([[Article 12 GDPR#3|Article 12(3) GDPR]]) response by the controller does not amount to a new complaint under § 13(8) AVG but is encompassed by the original complaint as a minus to it. However, it reasoned that a data subject has no right to have a past infringement of the GDPR determined by the data protection authority since § 24(1) BDSG and [[Article 77 GDPR#1|Article 77(1) GDPR]] refer to “infringes” in the present tense and not “has infringed”. Moreover, the court referred to Recital 63 according to which the right of access is intended to enable data subjects to be aware of the processing of personal data concerning them and to verify its lawfulness. In order to achieve this goal, it is not necessary for data subjects to have infringements which have been remedied in the meantime declared as unlawful. It also cited the decisions of the Supreme Administrative Court of Austria (Verwaltungsgerichtshof – VwGH, 2006/06/0330) and of the Austrian Constitutional Court (Verfassungsgerichtshof – VfGH, VfSgl. Nr. 12.768). | ||
At last, the court determined that the "matter" of a proceeding (§ 13(8) AVG) which alleged non-disclosure under [[Article 15 GDPR|Article 15 GDPR]] cannot be entirely severed from the question of the completeness of the answer to the request. The core of the right of access is that the controller must disclose the specific content of all data being processed. However, the objective of [[Article 15 GDPR|Article 15 GDPR]] to enable the data subject to exercise their other rights must be considered as well. Therefore, if this objective is achieved by the answer, disputes about the sufficiency of specific parts of the answer may be considered as a different matter. This does, naturally, not apply to expressly limited requests of confirmation as to whether data about the data subject is being processed under the first part of [[Article 15 GDPR#1|Article 15(1) GDPR]]. Such matters are resolved with a simple yes or no answer. | |||
== Comment == | == Comment == | ||
Although the termination of the proceedings should have been formally pronounced by the DSB, the court did not annul the decision since the data subject requested the correction of the decision and not the annulment. | Although the termination of the proceedings should have been formally pronounced by the DSB, the court did not annul the decision since the data subject requested the correction of the decision and not the annulment. | ||
The reasoning behind the missing right of a data subject to have a past violation declared seems disputable. Past violations may be fined by DPAs under [[Article 83 | The reasoning behind the missing right of a data subject to have a past violation declared seems disputable. Past violations may be fined by DPAs under [[Article 83 GDPR]]. Such a fine would be an implicit decision on a past violation. | ||
== Further Resources == | == Further Resources == | ||
Latest revision as of 17:08, 2 February 2022
| BVwG - W274 2246166-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 12(3) GDPR Article 15 GDPR Article 77(1) GDPR § 13(8) AVG § 24(1), (6) BDSG |
| Decided: | 22.12.2021 |
| Published: | 18.01.2022 |
| Parties: | anonymous DSB (Austria) |
| National Case Number/Name: | W274 2246166-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2021:W274.2246166.1.00 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (RIS) (in German) (in German) |
| Initial Contributor: | Heiko Hanusch |
The Federal Administrative Court held that the Austrian DPA rightfully rejected a complaint by a data subject regarding an access request that was responded late but during the administrative proceedings. It also held that when large amounts of data are processed, access requests may be answered in a two-step approach.
English Summary
Facts
The data subject has requested access to their personal data under Article 15 GDPR. The controller (Arbeitsmarktservice Österreich) did not fulfill the request at first. Later – during the administrative proceeding – the controller, however, did. Thereupon, the DSB (Austria) informally closed the proceeding. The data subject objected to the termination of the proceedings on the grounds that the answer to their request was too late and was insufficient. The DSB maintained its decision arguing that the data subject has no right to have a past violation of the GDPR determined and that the assertion of insufficiency is be regarded as a new submission under § 13(8) AVG since it changes the substance of the matter.
Holding
The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision and reasoning of the DSB.
First, the court elaborated on Article 15 GDPR though these statements were not necessary for the decision of the case. It held that a data subject has no general duty to cooperate, but at most an obligation to specify if the controller processes a large amount of data and the data subject makes a very general request or is only interested in specific information or data processing. In these cases, the controller can request clarification from the data subject, but has no right to do so. The data subject may nevertheless insist that all data be disclosed. This means that the two-stage information procedures that occur in practice, in which the data controller initially only provides information on master data and only provides comprehensive information at the express request of the applicant, are perfectly permissible, provided that the applicant is made aware of this fact.
Second, the court determined that the DSB was not allowed to close the proceedings informally but should have issued a formal notice according to § 24(6) BDSG because the data subject had objected with reasons against the termination of the proceedings.
Third, the court stipulated that the complaint about the delayed (Article 12(3) GDPR) response by the controller does not amount to a new complaint under § 13(8) AVG but is encompassed by the original complaint as a minus to it. However, it reasoned that a data subject has no right to have a past infringement of the GDPR determined by the data protection authority since § 24(1) BDSG and Article 77(1) GDPR refer to “infringes” in the present tense and not “has infringed”. Moreover, the court referred to Recital 63 according to which the right of access is intended to enable data subjects to be aware of the processing of personal data concerning them and to verify its lawfulness. In order to achieve this goal, it is not necessary for data subjects to have infringements which have been remedied in the meantime declared as unlawful. It also cited the decisions of the Supreme Administrative Court of Austria (Verwaltungsgerichtshof – VwGH, 2006/06/0330) and of the Austrian Constitutional Court (Verfassungsgerichtshof – VfGH, VfSgl. Nr. 12.768).
At last, the court determined that the "matter" of a proceeding (§ 13(8) AVG) which alleged non-disclosure under Article 15 GDPR cannot be entirely severed from the question of the completeness of the answer to the request. The core of the right of access is that the controller must disclose the specific content of all data being processed. However, the objective of Article 15 GDPR to enable the data subject to exercise their other rights must be considered as well. Therefore, if this objective is achieved by the answer, disputes about the sufficiency of specific parts of the answer may be considered as a different matter. This does, naturally, not apply to expressly limited requests of confirmation as to whether data about the data subject is being processed under the first part of Article 15(1) GDPR. Such matters are resolved with a simple yes or no answer.
Comment
Although the termination of the proceedings should have been formally pronounced by the DSB, the court did not annul the decision since the data subject requested the correction of the decision and not the annulment.
The reasoning behind the missing right of a data subject to have a past violation declared seems disputable. Past violations may be fined by DPAs under Article 83 GDPR. Such a fine would be an implicit decision on a past violation.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Postal address:
Erdbergstrasse 192 – 196
1030 Vienna
Phone: +43 1 601 49-0
Fax: +43 1 711 23 – 889 15 41
Email: einlaufstelle@bvwg.gv.at
www.bvwg.gv.at
DECISIONS D A T U M
2 2 . 1 2 . 2 0 2 1
BUSINESS NUMBER
W 2 7 4 2 2 4 6 1 6 6 - 1/4 E
I M N A M E N D E R E P U B L I K !
The Federal Administrative Court recognizes Mag. LUGHOFER as chairman through the judge
as well as the expert lay judges Prof. KommR POLLIRER and Dr. GOGOLA about the
Complaint by Mag. XXXX against the decision of the data protection authority, Barichgasse 40-
42, 1030 Vienna, from July 26th, 2021, GZ: XXXX, involved labor market service Austria,
XXXX , due to violation of the right to information, rightly in a non-public session:
The complaint will not be followed.
The revision is not permitted according to Art. 133 Para. 4 B-VG.
Reasons for decision:
By e-mail dated June 10, 2020, Mag. XXXX (hereinafter: complainant, BF) filed a complaint
the labor market service Austria (participating party before the administrative court, MB).
the data protection authority (hereinafter: the authority concerned) Complaint pursuant to Art. 77
GDPR because of violation of the right to information (Article 15 GDPR) and claimed that he hadam
01/31/2020 submitted an application to the MB, in which he asked them to do so, - 2 -
to grant him this right. The MB did not respond to his request within a month
reacted. He therefore raises a complaint because of the failure to provide information on the part of the
MB according to DSGVO or DSG.
In the attachment, the BF sent the application dated to the MB (by e-mail).
01/31/2020:
"Re: Data information according to DSG/DSGVO about my person
I now ask you to send me all in your system about me in accordance with DSG/DSGVO
stored data, including the information (as specified by your ombudswoman in XXXX
executed) also who entered, saved, changed, retrieved as well as
passed on.
Furthermore, I ask you to transmit all information which is within the
AMS and between the AMS and third parties about my person.
Ideally, I would ask you to transmit the data in electronic form by email or
Download."
The official file does not indicate whether the request by the relevant authority to
Statement of 13.7.2020 which MB reached.
On December 18, 2020, the MB returned a request of the same content dated December 2, 2020
Statement in which she stated that the BF had by copying the MB in the mail dated
06/10/2020 (complaint filing) the team of the data protection officer of the MB about the
information not received. The necessary steps are to be taken on the same day
been arranged to send the relevant information to the BF. At the
On June 15, 2020, the office completed the IT-supported creation and transmission of the
data printout confirmed.
The information was therefore provided within the complaint procedure, which is why
requested that the appeal be dismissed as unfounded.
In a letter dated December 22, 2020, the authority concerned sent the statement to the BF
the MB from December 18th, 2020 with the note that due to the reaction of the MB the complaint in
To be regarded as completed within the meaning of Section 24 (6) DSG. If the BF fails to do so within a period of
two weeks justify why he originally claimed infringement (none, - 3 -
response to the request for information) at least partially still as not eliminated
consider that the authority concerned will discontinue the procedure informally.
In a letter dated January 11, 2021, the BF stated that the MB’s statement was correct
Review of the information sent to him by the MB from 06/15/2020 and 12/04/2020
(Providing information) surprising. The reason for their delay seems that this
Information was crucial in a procedure and therefore by the MB
not communicated within the period of one month from his request for information
had been.
In addition, the MB can be seen in the information provided in the meantime
sent requests for correction ignored and only incomplete and partial
incorrect information submitted. In addition, the XXXX branch also has data
forwarded by him, for which he expressly gave no authorization.
The MB has in the processing, collection, processing and forwarding of his data in
the following points in data processing or disclosure demonstrably not the
GDPR Compliant:
"1. Delayed information (1st information on 15.6.2020, 2nd information on
4.12.2020)
2. Incomplete submission of information (only titles of attachments and no copies
e.g. 2. information page 38 final report_ XXXX )
3. Missing information in the first report (e.g. 1st report page 1 etc.
Information on the right to information and the basis for collecting data)
4.Missing information in the second disclosure (e.g. 2nd disclosure page 101ff.none
Information on information from third parties, for example companies, no information on
automatic decision-making based on stored data)
5. Correction not made (e.g. 2nd information page 44 transcript)
6. Incorrect information (e.g. 2nd information page 4 point dates)
7. Missing information to pass on information to third parties (e.g. 2. disclosure
Page 44 private phone number and social security number to Mr. XXXX and
Ms. XXXX has been demonstrably transmitted by the job market service XXXX), - 4 -
8. Missing information for personal appointments (e.g. request for an extension of
support measure ItWorks)
9. Unauthorized obtaining of information from third parties (e.g. 2nd disclosure page 31
XXXX )”
On the basis of the demonstrably incomplete, uncorrected and incorrect or non-GDPR
compliant collection of information in the information provided by the MB
data, he was convinced that his right to information was neither timely nor
fully answered and corrected. He therefore asks for appropriate
Response of the authority concerned due to violation of the DSG/GDPR to the MB.
In the appendix, the BF sent the information provided by the AMS XXXX of June 15, 2020 (50
pages) and from December 4th, 2020 (109 pages) as well as an e-mail sent to the MB dated
01/27/2020:
This is excerpt:
"Violations of the GDPR/DSG by AMS XXXX:
[…] As discussed over the phone, there are currently three violations of the
Data protection regulation or your internal guidelines of employees of the AMS XXXX in
specifically my supervisor Ms. XXXX, your supervisor Mr. XXXX and the
Head of department Mr. XXXX :
1. Disclosure of my phone number to third parties (see attachments and
statement of facts telephone number)
2. Disclosure of social security numbers to third parties (see Appendices and
statement of facts social security number)
3. Failure to verify PIN number when calling AMS XXXX
(see statement of facts PIN number)
[…] it would be ideal if you […] manage the respective people to comply with the
to ask for data protection rules […].”
With a notification dated January 25, 2021, the relevant authority informed the BF of the (informal)
Discontinuation of the proceedings and stated in summary that the MB - like the BF in
carried out his submission of January 11, 2021 himself - their obligation to provide information, - 5 -
complied. You have the request of the BF for information (refusal to provide information) in
Complyed with the meaning of § 24 Para. 6 DSG and thereby the alleged infringement
subsequently eliminated.
At the same time, however, the BF stated that he considered this information to be inadequate.
According to § 24 paragraph 6 DSG is by law from the withdrawal of the original
complaint and the simultaneous filing of a new complaint if
a statement by the complainant would change the essence of the matter.
In this case, the original complaint procedure should be discontinued informally and the
to inform the complainant.
This is the case here. In the original complaint, the BF violated the law
requested information due to information that was not provided. Since he is now a
claims that the information provided is inadequate, the nature of the procedural matter changes as a result
after. The complaints procedure should therefore be discontinued informally in accordance with Section 24 (6) DSG
been.
At the same time, the BF's submission of January 11, 2021 due to alleged infringement is in the right
for information (inadequate information) as a new complaint about a new reference number
been logged.
With a submission dated February 10, 2021, the BF submitted that the termination of the proceedings was for him
neither understandable nor does he agree with it. The MB got me their late
Feedback violate the DSG or the GDPR. Furthermore, they also have against it
Section 229 or Section 295 of the Criminal Code is violated because it gives the BF access to evidence in
denied court proceedings. He therefore asks for the "cancellation of the setting" of the
Procedure and creation of a decision, which the violations of the MB against the GDPR
or against § 229 or § 295 StGB.
With the contested decision, the authority concerned rejected the complaint of the BF as
unfounded and stated that due to the application of the BF, despite the
Provision of information is a violation of the right to information in accordance with Art. 15 GDPR
to be determined, with a decision on his application to be discussed.
The BF essentially argued that the information from the MB was late and
incomplete., - 6 -
Regarding the delay, it should be noted that Art. 77 GDPR (in conjunction with Section 24 DSG) only gives the right
can be deduced to lodge a complaint with a supervisory authority and thereby
Enforcement of subjective rights - if necessary by means of an official performance mandate
enable. A right to ascertain that the information was provided too late
cannot be taken from this provision.
The input of the BF from January 11th, 2021 is the alleged incompleteness of the information
in this regard as a new entry in a separate data protection procedure
been judged because the substance of the matter had changed. A complaint about
information that is not provided is fundamentally different from information that was provided inadequately
differentiate. The complaint regarding the alleged defectiveness will be
Procedure XXXX treated.
The BF filed a timely appeal against this decision with the application that
contested decision "to improve, supplement and correct the violations of
Respondent (here MB) against the GDPR to be included accordingly”. the
The MB was late in answering the request for information and correction
and violate the GDPR. The decision does not mention that the MB against the
have violated the statutory obligation to provide information within the statutory period of time in accordance with the GDPR.
Moreover, in spite of repeated requests, he was given part of what was demanded of him
Information has not been provided to date. The MB have therefore
to comply with his orders to remedy defects and it is the verifiable
to include withholding of information in the decision.
On September 1st, 2021, the authority concerned submitted the complaint, following the
electronic administrative file with the request to dismiss the complaint.
The Federal Administrative Court bases its decision on the just presented -
undisputed and covered by the content of the file - the course of the procedure is based and supplemented
these as follows:
With regard to the BF's request for information of January 31, 2020 and after "Copying the
MB through the email from the BF of June 10, 2020, the MB sent the BF 2 a letter of information:
The one from June 15th, 2020 with a total of 50 pages (hereinafter: "Information 1") and the one from
December 4, 2020, 109 pages ("Information 2").
Both pieces of information provide information on the first page about the content and the legal basis of the
Information., - 7 -
"Information 1" includes, as far as can be seen, essentially the history of the
Mediation efforts regarding the BF, "Information 2" also includes
“Employment and Insurance Data” and Benefit (Payout) Data.
Among other things, the following circumstances are presented in the information:
In "Information 2" p 38 as part of a chronological multi-page table, referred to
S 19 as “chronological documentation”, the following entry on June 5th, 2020:
"Report of a training session
The following attachments are available for this document:
Final Report XXXX." (Fact 1)
In "Information 2" p 44 (reproduced without correction):
"Date created: 24.1.2020
Information/conversation notes/notes
Mr XXXX :
I phoned Mr. XXXX and asked if he was on 3.2. could start to work.
Mr. XXXX has said he still has court hearings due on 04/02/20 and he also has
on a loan that he can't service with the salary we pay
Ms XXXX :
Customer comes to the interview (23/01/20) does not give any personal data
the private is also Mr. XXXX wrote down everything I said. Mr XXXX
would like to work at home because he lives in XXXX would like to please say that he does
I can probably start working on February 3rd, 2020, but I have to go to Vienna on February 4th
a witness statement. Finally, Mr. XXXX wanted a confirmation from me that I had one
His private phone number was transmitted from the office and I his private number
called even though he indicated a different one for job interviews. I him
said he didn't get it. Then Mr XXXX said he would take me in
because I refused him a confirmation. I rejected that, whether he still wanted me
I can't tell because he held his cell phone in his hand for a while..., - 8 -
Due to the behavior of the customer, no possibility of an AA" (Fact 2)
In "Information 2" on page 101 under "Where does the processed data come from (origin)?"
"The AMS processes personal data that it receives from you, e.g. as part of the
Applying for services and funding or as part of the advisory or
mediation process receives.
The AMS also processes personal data that it receives from other bodies for the
Fulfillment of its tasks and legal obligations
provided by the following institutions:
umbrella organization of social security institutions
Central register of residents
tax offices
pension insurance institution
competent federal ministry
In general, other authorities, courts, social security institutions and
Social assistance, the Ministry of Social Services and institutions for which the tasks of the AMS
have been transmitted, transmit personal data to the AMS, insofar as this is necessary for
the execution of the statutory duties are essential. Within the framework of administrative assistance
Regional authorities, municipal associations and other self-governing bodies
transmit personal data to the AMS.
...
Who receives your data (categories of recipients)?
The AMS transmits to other authorities, courts, social security institutions and the
Bundesanstalt Statistics Austria personal data, insofar as this is necessary for the execution
of the statutory duties are essential
..., -9-
Employers receive data from the AMS in connection with the establishment of a
employment relationship and the assessment of professional suitability or the implementation of the
application process are required.
.." (Fact 3)
The supplementary statements are based on the ones specified in the file
Bundles with which the MB provided information.
Legally follows:
According to Art. 15 Para. 1 GDPR, the person concerned has the right to be informed by the person responsible
to request confirmation as to whether personal data concerning you
are processed; if this is the case, she has a right to information about this
personal data or the following information:
a) the processing purposes;
b) the categories of personal data being processed;
c) the recipients or categories of recipients to which the personal
data has been or will be disclosed;
d) if possible, the planned duration for which the personal data will be stored
or if that is not possible, the criteria used to determine that duration;
e) the existence of a right to rectification or erasure of data concerning them
personal data or restriction of processing by the
controller or a right to object to this processing;
f) the existence of a right of appeal to a supervisory authority;
g) if the personal data are not collected from the data subject, all
available information about the origin of the data;
f) the existence of automated decision-making including profiling pursuant to Art.
22 para. 1 and 4 and - at least in these cases - meaningful information about the
logic involved, and the scope and intended impact of any such
Processing for the data subject., - 10 -
According to Art. 15, only the data subject has a right to information, which they assert
have to do. A general obligation to cooperate cannot be derived, but at most one
Obligation to specify if the controller processes a large amount of data
and the data subject submits a very general request or only on specific ones
information or data processing is interested. In these cases, the
Controller entitled to request clarification from the data subject, he has
but not entitled to it. The person concerned can nevertheless insist that all
data are disclosed. This means that the two-stage ones that occur in practice are
Information procedures in which the person responsible initially only discloses master data
and only provides comprehensive information at the express request of the applicant,
entirely permissible provided the applicant is informed of this fact (Haidinger
in Knyrim, DatKomm, Art. 15 GDPR, margin no. 11).
According to § 27 VwGVG, the administrative court issued the contested decision on the basis of the
Complaint (§ 9 Para. 1 Z 3 and 4) or on the basis of the declaration of the scope of the
challenge (§ 9 Para. 3) to review.
According to the judicature, the VwG is responsible for examining the matter before it on the basis of the
In its legal assessment, the complaint is not bound by the complaint.
However, if the complainant bears a certain burden of allegation, then
the relevant factual statements limit the facts to be ascertained
and thus the authority to examine the VwG (Fister/Fuchs/Sachs, administrative court proceedings²
(2018) § 27 VwGVG S 190).
In the matter:
The following must be sent in advance:
As shown in the course of the procedure, the authority concerned sent the BF the
Statement of the MB with letter dated December 22nd, 2020
§ 24 para. 6 DSG and expressly stated that if the BF did not justify within a period,
why he still considers the originally claimed infringement at least in part
not eliminated, the data protection authority will informally discontinue the procedure. When
"Originally alleged infringement" of the BF expressly stated the authority concerned
"No response to the request for information".
The fact that there has been a response to the request for information in the meantime (a transmission
of a data printout) results from the statement of the MB from December 28th, 2020., - 11 -
The BF also confirms this fact in his letter to the relevant authority dated
01/11/2021 ("... after reviewing the information sent to me by the
15.06.2020 and 04.12.2020 ..."). It follows from this letter that the
BF criticizes the delay in the information, but also states that
this is incomplete(and partly incorrect).
on "Page 38 final report_ XXXX", "Page 101 ff. no information for the information of
Third parties, e.g. companies, do not provide any information for automatic decision-making
on the basis of stored data" and regarding "Page 44" for the transfer of
information to third parties.
The authority concerned then initiated the procedure for the reference number at issue here
informally according to §24 Abs
and stated that the BF reported in his submission of January 11, 2021 that the MB was her
complied with the obligation to provide information, but at the same time he submitted that he considered this
information as insufficient. In relation to a non-provided information put a
Insufficient information represents a change in the nature of the matter in accordance with Section 13 (8) AVG,
which is why the subject procedure for information is to be discontinued informally and the input
dated January 11, 2021, due to insufficient information, is to be regarded as a new complaint and in
had been recorded in an independent procedure for a new reference number.
After the BF then, in a letter dated February 10, 2021, “repealed the suspension of the
Procedure and preparation of a notice” sought, the authority concerned rejected
Complaint of violation of the right to information as detailed above.
To do this:
Pursuant to Section 24 (6) DSG, a respondent can
Data protection authority subsequently eliminate the alleged infringement by
corresponds to the requests of the BF. If the complaint appears to the data protection authority to the extent that
pointless, she has to hear the BF about it. At the same time he is paying attention to it
make sure that the data protection authority will informally discontinue the procedure if he does not
within a reasonable period of time why he originally claimed that
Violation of the law is at least partially still considered not to have been remedied. Will through
such a statement by the complainant changed the essence of the matter (§ 13
Para. 8 AVG), the original complaint and the
simultaneous filing of a new complaint. Also in this case it is - 12 -
to informally discontinue original complaint procedures and the complainant thereof
to agree.
The purpose of this provision is that the BF has the opportunity to respond to the
Respondent to comment and to give reasons why he originally
alleged violation of rights is still considered not to have been remedied. Does he
Those responsible have the option of pursuing the alleged infringement until the conclusion
of the procedure before the data protection authority, e.g. by providing information
of the complainant is met, this is if no arguments according to which the
information has been provided inadequately and this is not inferred from the complaint
can be made harmless or the data protection authority has the asserted
violation of his right to information informally cease (Thiele/Wagner,
Practical commentary on the Data Protection Act (DSG) § 24, margin nos. 259, 260 mwN, rdb.at)
In general, the setting not expressly provided for in the AVG becomes one
Administrative procedure then considered admissible if no party
has more entitlement to settlement. This can also be expressly stated in the administrative regulations
be provided (e.g. § 24 Para. 6 DSG). An outwardly appearing form,
in particular the form of notification of the termination of proceedings, is not provided for in the AVG. To it
according to the judicature of the VwGH, the fact that with the setting
certain legal consequences are associated with the procedure, such as the termination of the
pending proceedings. Proceedings can be discontinued simply by making a memorandum to the file
be certified.
However, it is also argued that the hiring will be recognized in the form of a notification
must if the existence of a reason for hiring is disputed (Hengstschläger/Leeb, AVG §
56 margin nos. 87 and 88 with further references). According to Walter/Mayer, Grundriss des Österreichisches
Administrative Procedure Law, margin no. 374, has the setting in undisputed cases without
to issue a notice.
Already according to the legal text of § 24 paragraph 6 DSG, which is also used by the authority concerned in
Letter dated December 22nd, 2020, will only be discontinued informally if not
reasons are given as to why the originally alleged violation of the law was at least partly justified
is still considered unresolved. A reaction (of whatever kind) to
the request for information in no way excludes that the initially claimed
Violation of the right to withhold information also subsequently, at least partially
is not eliminated. The same follows from the presentation in Thiele/Wagner, margin no. 260, as above., - 13 -
It would be conceivable that the person concerned, in accordance with the wording of Art. 15 para. 1
GDPR only requires confirmation as to whether data relating to him is being processed
will. However, the request for information on which this is based also includes that
Request for information on the content.
It is certainly permissible in the case of a very general request for information and a
large amount of processed data in the sense of a two-stage information procedure
initially only to provide information about the master data and only upon express request
to provide comprehensive information, in this case the applicant would have to refer to this circumstance
but be advised (Haidinger in Knyrim, DatKomm Art. 15 GDPR, margin no. 11).
This was obviously not the case here, especially since - albeit only during the course of the proceedings -
extensive content-related information was given to the BF on the basis of the first application.
Based on the unequivocal statement of the BF in his letter dated January 11, 2021,
(in response to the authority's notification of the intended cessation) according to which i.a.
the information is incomplete and in this regard also individual specific circumstances
were executed incompletely (see above), the relevant authority within the meaning of the
The legal situation presented does not assume that there are reasons within the meaning of Section 24 (6) GDPR that the
Authority to entitle the hiring, were undisputedly present. The authority concerned was therefore to
informal cessation of proceedings is not justified.
Apparently, the authority concerned considered due to the further input of the BF from
10.02.201 the procedure is not considered discontinued anyway, otherwise it would be
application in this regard due to the lack of pendency of the proceedings as a result of the termination
not to be done in terms of content but to be rejected.
For the content of the notification:
Regarding the alleged delay in providing information:
In the complaint, the BF complains that the MB violated its obligation to provide information
violate the legal deadline, whereby also a violation of §§ 229 and 295 StGB
present.
First of all, it should be noted that the submission of the late provision of information - as a minus
to the non-disclosure of the information - at least of the matter of the data protection complaint as
is to be considered included and does not lead to a significant change in the attachment of the BF
led., - 14 -
§ 24 DSG is intended to grant a data subject the right to object to any violations of
to enforce rights arising from the DSG or the GDPR
(Bresich/Dopplinger/Dörnhöfer/Kunnert/Riedl, DSG (2018) Section 24 margin no. 7). A statement of
Violations of the law, which no longer exist at the time of the decision of the data protection authority
exist, but is expressly not intended, especially since § 24 paragraph 6 DSG in such a case
basically provides for the informal discontinuation of the proceedings. For such an interpretation
The present tense provisions of § 24 Para. 1 DSG and Art. 77 Para.
1 GDPR - "violates" and not "has violated" - as well as § 24 Para. 5 DSG, according to which a
legitimate complaint about an infringement by those responsible for the private sector
a performance notice must be issued. Such would already be in the case of one
adjusted infringement not possible. In addition, according to recital 63 of the
GDPR, the right to information serves to enable data subjects to
to be aware of the processing of personal data concerning them and their
verify legality. For the achievement of this goal it is for data subjects
not necessary, infringements of rights that have been remedied in the meantime
to be notified.
The Administrative Court also ruled on the Data Protection Act 2000 (DSG 2000) Federal Law Gazette I No.
1999/1965, in the version of Federal Law Gazette I No. 13/2005, denied such a right (VwGH
09/27/2007, 2006/06/0330 with reference to the landmark decision VwGH 03/28/2006,
2004/06/0125).
is not directly transferrable to the new legal situation, the supporting ones can
Considerations of the Higher Administrative Court – essentially those outlined above
Considerations correspond - be transferred to the new legal situation.
Finally, the Constitutional Court also ruled on the legal situation before the DSG 2000, viz
to the right to information according to §14 paragraph 1 of the Data Protection Act idFBGBlNr
denied on the determination of past violations of the law that have since been remedied (VfGH
June 26, 1991, VfSgl. No. 12,768). In particular, it follows that the fundamental right to
Data protection, that in relation to the right to information - as far as relevant to the decision here
- has not changed (§ 1 Para. 3 Data Protection Act as amended by Federal Law Gazette No. 565/1978 or § 1 Para. 3 Z 1
DSGidFBGBlINr.165/1999 last changed by BGBlINr.51/2012) does not show that his
data subject has the right to a notification of the past
violations of the law must be acknowledged.
If the BF argues in the complaint that the contested decision is
unlawful because the MB did not respond to the request for information within the statutory, - 15 -
answered within one month or this circumstance is completely missing in the notification
therefore to reply that - as shown - neither the DSG nor the GDPR in relation to the
Right to information provides for the determination of past infringements, which is why the BF
in any case not in his right solely due to the delayed provision of information by the MB
information is violated.
Regarding the alleged incompleteness of the information:
Although the complaint is essentially the question of the late reply
dedicated, the BF states sufficiently clearly that, despite repeated requests, there is one
Part of the information requested by the MB not handed over until now
been. The question underlying this objection of the "incompleteness of the
Information” was dealt with very briefly by the authority concerned in the notice, in that it stated the second
Input of the BF, that of January 11th, 2021, regarded as a new input and executed it
circumstances to be dealt with in proceedings XXXX.
To do this:
As can already be seen from the above statements, the analogous reasoning is the
authorities concerned both in the decision and the notification of January 25, 2021, according to which
Circumstances concerning the completeness of information provided upon request
should under no circumstances be dealt with in a procedure which, due to the primary refusal of
Information was initiated not to follow: The "matter" of a complaint procedure
alleged non-disclosure of information can not be a priori in the question
exhaust whether at the latest by the end of the hearing any information, which
Whatever the content and scope, has been granted. A settlement will the circumstance of
Completeness of the information, based on the wording of the request for information, not
can be excluded entirely.
In any case, something else will apply if the request for information is initially expressly based on a
confirmation as to whether data about the data subject is being processed
(Art 15 para 1 1st case GDPR).
On the other hand, particularly in cases where the controller is very extensive
Data files of the data subject processed, not every conceivable issue of the
completeness of information until its final clarification, the termination of a
Information procedure, in which general information about the data of the person concerned
is desired, can prevent., - 16 -
The core content of the right to information is that the person responsible for the data subject
person must disclose the specific content of all data processed about them (Jahnel in
Jahnel, Commentary on the GDPR, Art. 15 Rz 18).
An explicit literary debate or judicature on the question of how far
the right to information is to be interpreted in the event of a general request for information and
to what extent in cases of very extensive and complex data sets the person obliged to provide information
may initially set a limit and it is reserved for the person seeking information to set further limits
There is no way to ask for additional information. As a principle, it can be assumed
that the data subject is in a position to continue his further processing by providing the information
to exercise the rights of data subjects.
As has been established, in the present case very extensive information was provided in two tranches
("Information 1" and "Information 2"). In his complaint, the BF left it at that
to state that part of the information requested from him is up to the present time
not been handed out. The complaint itself contains no clarifications in this regard.
Only from the letter of the BF of 11.01.2021 regarding specific circumstances
out to what extent the information was incomplete in the opinion of the BF.
Even if apparently only as an example, the BF only addresses three facts here, whereby
apparently once in the 109-page document "Information 2" a designated one
Appendix (page 38 "Final report XXXX ") is not printed.
Since this part of the file is mentioned, the BF is able to exercise further rights in this regard (also in
in the sense of further detailing the information).
Regarding page 44, entry from January 24th, 2020, the BF apparently complains that the
entries in this regard require that the persons named there
telephone number and social security number of the BF had been transmitted.
In this regard, the BF apparently has the information that he does not disclose
(“has been verifiably transmitted”).
Finally, the BF apparently wants more information about the origin and transmission of
Data beyond the information provided on pages 101 and 102.
Irrespective of the legal assessment of the scope of the “matter of the here
underlying administrative procedure" there is no objection to the result if
the authority concerned the last questions raised by the BF on, - 17 -
Incompleteness of the information or supplementary information no more than the subject
of the original request for information was recorded, but this was the subject matter anyway
of another procedure (to XXXX ), so that it will have to be dealt with there.
As a result, the complaint is therefore not justified.
An oral hearing within the meaning of § 24 VwGVG was not required, especially since the
relevant facts are established according to the file situation. A hearing was held
not requested. A factual submission that goes beyond the undisputed from the file
goes beyond the obvious facts, was not reimbursed.
Regarding the inadmissibility of the revision:
The question of how far the primary obligation to provide information in the case is very extensive
Databases in the case of a blanket information procedure, up to now in the highest court
not resolved. Due to the constellation of facts, there is none in this regard
procedure to be clarified legal question of fundamental importance.
