OGH - 6Ob129/21w

OGH - 6Ob129/21w
Court:	OGH (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 4(1) GDPR Article 6(1)(f) GDPR Article 17(1)(d) GDPR Article 79 GDPR Article 85 GDPR § 9 Austrian Data Protection Act (Datenschutzgesetz - DSGV) § 1330 Austrian Civil Code (Allgemeines Bürgerliches Gesetzbuch - ABGB) § 16 Austrian Civil Code (Allgemeines Bürgerliches Gesetzbuch - ABGB)
Decided:	02.02.2022
Published:	21.02.2022
Parties:	unknown teacher (claimant) developer of a platform to rate teachers (first defendant) company providing a platform to rate teachers (second defendant)
National Case Number/Name:	6Ob129/21w
European Case Law Identifier:	ECLI:AT:OGH0002:2022:0060OB00129.21W.0202.000
Appeal from:	OLG Wien (Austria) 11 R 51/21g-31
Appeal to:	Not appealed
Original Language(s):	German
Original Source:	Rechtsinformationssystem des Bundes (RIS) (in German)
Initial Contributor:	n/a

The Austrian Supreme Court held that data processing of an app created to rate school teachers is not exempt from any provisions of the GDPR under national law implementing Article 85 GDPR. Processing can be based on legitimate interests under Article 6(1)(f) GDPR.

English Summary

Facts

In 2019, the first defendant (the "developer") developed an app for students to rate school teachers (the "app"). In December 2019 the developer founded the second defendant (the "platform"), a limited liability company, and offered the app for download using the platform.

In early 2020, the Austrian Data Protection Authority conducted an ex officio investigation into the platform's data protection conduct. This investigation was later ceased without a formal decision.

The claimant was a school teacher whose name and school could be seen in the app, making him subject to ratings by users of the app. They argued that the data processing on the app violated their rights to data protection. They never consented to be subject to ratings on the app and argued that there was also no other legal basis under Article 6(1) GDPR that the app could rely on to make the data processing lawful. They further argued that the app didn't provide sufficient safeguards to prevent people other than their students to rate them. In their lawsuit, the teacher demanded the first instance court, Landesgericht Wien (LG Wien), to disallow the possible future processing of his personal data by the defendants and to order the defendants to erase the data relating to the teacher under Article 17 GDPR.

The LG Wien dismissed the lawsuit, holding in essence that the legitimate interests to provide ratings on the teacher outweighed their interests under Article 6(1)(f) GDPR. Hence the court considered the processing to be lawful. The teacher filed an appeal.

The second instance court, Oberlandesgericht Wien (OLG Wien), upheld the lawsuit and ordered the developer and the platform to stop the processing until it was ensured that only actual students of the teacher could rate them. It argued that, as the app offered no safeguards against unjustified ratings by random strangers, the teacher's interest under Article 6(1)(f) overrode that of the developer and the platform and the data were to be deleted under Article 17(1)(d) GDPR.

The developer and the platform filed an appeal in which they also argued - for the first time - that the rating of teachers served journalistic purposes within the meaning of Article 85 GDPR and that § 9 Austrian Data Protection Act (Datenschutzgesetz - DSG) exempted them from the necessity of a legal basis under Article 6 GDPR (note: Under § 9 DSG, Chapters II to VII and Chapter IX of the GDPR are supposed to not apply on processing activities for journalistic purposes).

Holding

The Supreme Court (Oberster Gerichtshof - OGH) overturned the OLG Wien's decision.

First, it assessed in detail, whether § 9 DSG - which was adopted under the opening clause of Article 85(2) GDPR - applied on the processing of the teacher's data in the app. It held that the mere provision of a rating for each teacher - which is no more than calculating the average of all ratings given - did not serve journalistic purposes. Processing for journalistic purposes would require a certain extent of journalistic editing and possible effect on the public's opinion which the mere rating of individual teachers did not have. Hence, the GDPR fully applied to the app.

Second, the OGH disagreed with the OLG's assessment of the balancing of interest under Article 6(1)(f) GDPR. According to the OGH, there might be a certain risk of unjustified ratings by strangers but the rated teacher must accept this to a certain extent as the ratings only concerned the teacher's professional activities and not their personal life. Hence, the OGH saw no necessity to require students to create accounts with their actual names in order to prevent ratings by people who are no students of the teacher.

This reasoning is also backed by the German Supreme Court's case law, which considered the rating of a teacher on an online platform lawful (BGH VI ZR 196/08, www.spickmich.de). In essence, the OGH held that the legitimate interests of the defendants and the users of the app override those of the teacher under Article 6(1)(f) GDPR and upheld the appeal.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

head

The Supreme Court, as a court of appeal, has been appointed by Senate President Hon.-Prof. dr Gitschthaler as chairman, the privy councilors Univ.-Prof. dr Kodek and Dr. Nowotny, the privy councilor Dr. Faber and the Hofrat Mag. Pertmayr as further judges in the case of the plaintiff Ing. Dipl.-Päd. F*, represented by Sacha Katzensteiner Blauensteiner Rechtsanwälte GmbH in Krems an der Donau, against the defendants 1. B*, 2. L* GmbH, *, represented by Dr. Florian Knaipp, lawyer in Vienna, for omission and deletion, on the appeals of all parties against the judgment of the Vienna Higher Regional Court as a court of appeal of April 26, 2021, GZ 11 R 51/21g-31, with which the judgment of the Vienna Regional Court for Civil Law Matters of January 29, 2021, GZ 26 Cg 16/20v-23, partially modified, rightly recognized in a closed session:

saying

The appeal of the plaintiff is not followed.

On the other hand, the appeal of the defendant parties is granted. The judgment under appeal is amended to restore the judgment of the trial court.

The court of first instance shall decide on the costs of the appeal proceedings.

text

Reasons for decision:

[1]                    In 2019, the first defendant developed the app "*", a platform for the evaluation of schools and teachers (hereinafter: the app). On November 15, 2019, he made it available for download on the Internet, but blocked access again a few days later.

[2] In December 2019, the second defendant was founded. The first defendant is their managing director and one of several shareholders. When the second defendant was founded, he brought his unregistered sole proprietorship "*-App" into the second defendant.

[3]                                                                    Beg The second defendant then made the app available for download again in the same month.

[4] The plaintiff is employed as a teacher at the HTL *. In the app, as a teacher at this school, he is identified by his first name, his family name and his degrees "Ing. Dipl. Päd." and allows users to rate his work as a teacher.

[5]                                                                                                                                                 Request and to prohibit similar such acts. Furthermore, he requests that the second defendant be obligated to delete his stored personal data, namely his first and last name including engineering title, as well as linking them to an opportunity to evaluate the plaintiff as a teacher at the HTL *.

[6] Through data processing in its right to privacy and its personality rights, it is injured to respect for private and family life, on name anonymity, for the protection of the honor and professional advances. The data processing is inadmissible because he has neither given his consent nor have the other requirements for the lawfulness of the processing according to Art 6 Paragraph 1 GDPR been fulfilled.

[7] The authentication provided in the app by means of the mobile phone number was not suitable to keep abuse by the application of non-valuation-legitimized persons. In cases of organized, unobjective bad evaluation, there is a risk of being pilloried as a bad teacher. With a low total number of ratings, individual negative ratings have a particularly strong impact. There was a lack of feedback from the reviewee and an easily accessible complaints mechanism.

[8] Within the framework of the necessary balancing of interests, the interests of the teachers concerned would prevail. To the detriment of the defendant, the insufficient authentication and the unsuitability of the app to achieve the stated purposes of transparency, quality improvement and improvement of the development opportunities for students should be taken into account. The data are of little significance. In the case of assessment content that relates to facts - such as punctuality - the interest of the person concerned outweighs incorrect information. Other evaluation criteria - such as "fair/unfair" - are not meaningful. There is no legitimate public interest in knowing an identifiable rating because students cannot choose their teachers. Disclosing the evaluations to the teachers and their superiors is enough to improve the quality of teaching. The public's interest in information would be satisfied by a non-identifying evaluation of the lessons, for example at subject or school level, or a pseudonymised evaluation (e.g. "Physics teacher A"), because the identification of the individual teachers is not necessary for the choice of school. In the case of employees such as teachers, there is only a public interest in an evaluation of the employer, not the employee. The app satisfies an entertainment interest and serves commercial purposes. On the other hand, the plaintiff's overriding interest, which deserves protection, is not to be dragged into the Internet public and exposed to an anonymous assessment with his work as a teacher without his consent.

[9] The risk of repetition is also available in the first-class. The second defendant, as the person responsible under data protection law, is obliged to delete it due to the illegal data processing.

[10]                                                                                                                                                   . With regard to the "basic" legality of the app, the court is bound by this assessment because the authority has discussed a relevant preliminary question. The platform serves the interests of the public, especially students, parents and schools, in transparency and quality assurance in the field of education.

[11]                                                                                                 Because of an The app serves to exercise the right to freedom of expression and information. This requires the processing of teacher data. The basic rights and freedoms of teachers would not prevail. There is no interference with private and family life. A possibility of misuse through unobjective evaluations is inherent to all evaluation platforms. Here, however, this danger is mitigated by a number of measures - verification of the telephone number, no possibility of making open comments to avoid slander, the possibility of rating only one school, the requirement of a minimum number of ratings, no inclusion of elementary and special schools , the implementation of a "Request changes" button and the regular updating of the data sets - counteracted. Whether the second defendant pursues a commercial interest is irrelevant. The balance of interests therefore turns out in favor of the defendants.

[12]     In addition, the first defendant brought his company into the second defendant, so that there was no longer any risk of repetition.

[13] The First Court dismissed the claim and set the following further facts beyond the preceding findings:

[14] To evaluate teachers in the app, it is first necessary to download the app to the smartphone via an online store and to verify by entering the phone number. As a result, the user receives a message on his mobile phone, to which he must answer from the entered number. If the user complies and the number and device match, the verification is complete. Only one verification is possible for a phone number.

[15] Then the user must select a school. Only the selected school and its teachers can be rated. It is possible to change schools in the app, but this involves deleting all ratings from the old school. There is no check as to whether a user actually attends the selected school or is taught by the rated teachers.

[16] For the evaluation, the user selects a teacher from a list of teachers working at the selected school, in which the names and academic titles of the teachers are displayed. The rating itself is based on individual, specified criteria, for which the user can give a partial rating of one to five stars. He can then justify these partial evaluations in more detail by selecting sub-criteria that are decisive for the evaluation.

[17] The following criteria are queried:

Lessons with the sub-criteria explanations, documents, variety or others;

fairness with the sub-criteria grading, early warning, opportunities for improvement or other;

respect with the sub-criteria politeness, conversations as equals, empathy or others;

Ability to motivate with the sub-criteria praise, encouragement, support or others;

patience with the sub-criteria repetition, pace of instruction, time for questions and others;

Preparation with the sub-criteria documents, knowledge, topicality of the lesson and others;

Assertiveness with the sub-criteria Class Discipline, Calmness, Attention and Others;

Punctuality with the sub-criteria start of class, end of class, frequency or others.

[18] An overall rating is then calculated from the partial ratings. Free text evaluations are not possible.

[19] The rating is based on a star system (one to five stars, with one star for "insufficient" and five stars for "very good"). The evaluation is carried out without displaying a user name and without displaying the telephone number (therefore anonymous from the point of view of the public), however, due to the verification based on the telephone number, the second defendant is able to identify any cases of abuse.

[20] Ratings can be changed by users afterwards.

[21] Reviews will only appear publicly after a count of five reviews. If the originally submitted rating is deleted by the user and the minimum number of ratings is no longer reached as a result of this deletion, the rating will no longer be displayed publicly until this minimum number is reached again. Only the average rating of a teacher is displayed.

[22]     The app must also be used to view reviews, but no registration is required. The ratings can only be accessed via the school entry. It is not possible to search for individual teachers by their names.

[23]     The "Request change" button in the app allows teachers to request a change or review of their data and a review of their overall rating for abuse. Regardless of this, the data records are checked every six months to ensure that they are up to date.

[24] The privacy statement of the second detailed and the terms of use for the app are available in the app and on your website. The terms of use in the version dated March 18, 2020 contain, among other things, the following provisions:

"3. reviews

[…] The submission of evaluations is only permitted for students of the selected school. Please note that you can only rate the school and its teachers that you are actually attending at the time of your rating. Rating a teacher is only permitted if you have had personal experience with the teacher yourself. [...]

Rating via the app by parents or teachers themselves is not allowed, as the purpose of the app is the rating of schools/teachers by their students. Ratings from parents or teachers can therefore be deleted by us and the affected accounts blocked or deleted. [...]

5. User Conduct and Obligations

[…] As an evaluator, you undertake to provide the information to the best of your conscience based on your own experiences with the school/teacher […].

6. Misuse

If your ratings are not true or if you violate these conditions when using the app, we expressly reserve the right to remove specific ratings and, in the event of a recurrence, to block or even delete your account for a specific/indefinite period. Misuse occurs, for example, when a rating is given by a non-student or when all ratings are given uniformly without differentiation, e.g. with only one star in all categories. [...]."

[25] Any future advertising interconnections should only be made for industries according to the current intentions, covering school-specific needs.

[26] From the applicant submitted by the defendant to its content after not disputed and therefore recovered by the Supreme Court (RS0121557 [T3]) Screenshots ./G is evident regarding the display of the reviews: For each rated teacher, a review will be reviewed Expressed in the form of a value between one and five stars in the "Overall Rating" category. The total number of ratings given is also listed. Furthermore, ratings with a value between one and five stars are displayed in each of the rating categories (teaching, fairness, respect, motivation, patience, preparation, assertiveness, punctuality).

[27] Legally discussed the First Court, there is no binding to the decision of the Data Protection Authority. However, the claim for injunctive relief against the first defendant should be dismissed simply because the risk of repetition ceased to exist as a result of the contribution of his sole proprietorship to the second defendant.

[28] The data processing by the second defendant is lawful. The reviews given are personal data. No inaccurate data was processed because user opinions were documented and kept up to date. The balancing of interests pursuant to Art 6 Para 1 lit f GDPR is in favor of the second defendant. The app serves the exercise of freedom of expression and information, and thus a legitimate interest. The processing and the public to which the data would be disclosed are limited to what is necessary. A further restriction by refraining from naming specific teachers or using pseudonyms and restricting the school to an overall assessment would not do justice to the objective of assessing the quality of teaching. With regard to the plaintiff's fundamental rights and freedoms, it should be borne in mind that this is data about his professional life, which is subject to less protection than data about his private life. There is an interest in information that goes beyond the defendants. The risk of misuse that exists with all rating platforms does not make the app unacceptable; rather, measures to prevent misuse should be included in the weighing of interests. The right to freedom of expression also includes anonymous statements. In the specific assessment of the plaintiff, no obvious abuse can be seen. The evaluation categories are suitable; the lack of the possibility of a free text evaluation reduces the informative value, but on the other hand serves to protect against misuse and to improve comparability. The right to freedom of expression is not limited to objectifiable, generally valid value judgements; it also includes statements of fact, for example in the “punctuality” rating category. The lack of a possibility for the teachers to react does not hurt. The data processing is lawful according to Art 6 Para. 1 lit. f GDPR, deletion is ruled out according to Art. 17 Para. 3 lit. a GDPR. Also with regard to the alleged invasion of the plaintiff's privacy, the balance of interests is in favor of the defendant.

[29] The Court of Appeal undertook the defendants to omission data processing, unless it is ensured that the plaintiff is valued only by persons he taught. It rejected the additional request for injunctive relief without the restrictive addition. In addition, the request for cancellation against the second defendant was granted. It allowed the appeal because there was no supreme court ruling on the question of whether and under what conditions teachers should be rated online by naming their names.

[30]                                                                                                          Bear Such evaluations do not correspond to scientific standards, but such expressions of opinion could provide the teacher concerned with feedback, initiate a discussion about potential for improvement and uncover grievances. The contribution to opinion-forming and quality assurance that can be achieved in this way weighs more heavily than the teacher's interest in unrestricted secrecy.

[31] However, these legitimate goals could not be achieved by the app because it is not checked whether a user who issues a valuation has actually been taught by the assessed teacher. There is no legitimate interest in assessments by people who were not students of the teacher concerned. There is a risk that students who feel they have been treated unfairly will persuade third parties from outside the school to register as users and give negative ratings in order to paint the unpopular teacher in a bad light. Third parties who have private conflicts with the teacher could also use an unrestrictedly accessible evaluation portal for denigration through negative evaluations. Since the app does not offer any means of preventing unobjective propaganda by outsiders, there is no legitimate interest in operating it in its current form according to Art 6 Para 1 lit f GDPR and in the light of Section 16 ABGB. The risk of repetition on the part of the first defendant is still there. The decision of the data protection authority has no binding effect on the present civil proceedings. The request for injunctive relief is therefore only justified with the restriction ordered. The request for deletion is justified in accordance with Art 17 Para 1 lit d GDPR because the data processing is based on an inadmissibly designed app.

Legal Assessment

[32] The revisions of all parties are permissible from the reason given by the Court of Appeal. The plaintiff's revision is not justified, but that of the defendant is justified.

To bind to decisions of the data protection authority

[33] 1.1. The binding of the seized civil courts to a decision of the supervisory authority - alleged by the defendants - is to be assessed according to national law (Leupold/Schrems in Knyrim, DatKomm [53. Lfg] Art 79 DSGVO Rz 31/2; Schwamberger, parallelism and binding effect of civil - and administrative procedures according to the GDPR, Yearbook Data Protection Law 2019, 259 [283]).

[34] 1.2. According to case law, courts are bound by final decisions of the administrative authorities (RS0036981). However, only the verdict of legal notices has a binding effect, but not the assessment of the legal question based on specific facts and its justification (RS0036981 [T8, T9, T14]). Third parties who were not involved in the administrative procedure can only be bound by the structural and factual effect of a notice (RS0036981 [T18, T40]; RS0036880 [T20]). In addition, the civil courts are bound by the decisions of the administrative authorities if they have decided on a preliminary question to be examined in civil proceedings as the main question (8 Ob 103/20k; RS0036880 [T10]).

[35] 1.3. The decision of the data protection authority of February 3, 2020, with which the official examination procedure was discontinued, is not a legal decision. It also has no effect as a fact, because the issuing of the decision is not used in a legal provision to be applied in the present proceedings as a fact for a legal consequence (cf. RS0114910). The ex officio examination carried out by the data protection authority does not deal with any preliminary question for the assessment of the present civil proceedings, because the legality of the data processing in the present proceedings must be carried out on the basis of the weighing of the personal rights specifically asserted by the plaintiff. It is therefore not necessary to discuss whether the termination of the ex officio examination procedure has the quality of a decision at all.

[36] 1.4. It was not alleged that the plaintiff himself had lodged a complaint with the data protection authority, which the data protection authority would have decided on. The reference for a preliminary ruling to the European Court of Justice for C-132/21 (BE v. Nemzeti Adatvédelmi és Információszabadság Hatóság), which is intended to clarify the question of whether the supervisory authority has primary jurisdiction to determine a breach of the GDPR, is therefore for the present case not relevant.

[37] 1.5. In the absence of binding to the submitted decisions of the data protection authority, the lower courts rightly carried out an independent examination of the objected data processing.

To "media privilege"

[38] 2.1. For the first time in the appeal proceedings, the defendant asserts that the data processing at issue falls under the so-called media privilege of Art 85 GDPR, so that Chapter II (including Art 6 GDPR) to VII and IX of the GDPR do not apply. The regulation of § 9 DSG, which is based on Art 85 GDPR, is based on an understanding of journalism that is too narrow and contrary to Union law.

[39] 2.2. Art 85 GDPR aims to create agreement or balance between fundamental rights and freedoms. The right to freedom of expression and information, including processing for (among other things) journalistic purposes, should be consistent with the protection of personal data (Öhlböck in Knyrim, DatKomm [18. Lfg] Art 85 GDPR Rz 1).

[40] 2.3. According to Article 85(1) GDPR, Member States legislate to reconcile the right to the protection of personal data under the GDPR with the right to freedom of expression and information, including processing for (among others) journalistic purposes. According to its wording, Art 85 Para 1 GDPR does not represent an exception to the applicability of the GDPR, but contains a programmatic mandate to the Member States (Öhlböck in Knyrim, DatKomm [18. Lfg] Art 85 GDPR Rz 9).

[41] 2.4. Art 85 (2) GDPR is an opening clause that enables the Member States to provide for deviations or exceptions from Chapters II to VII and IX of the GDPR (Öhlböck in Knyrim, DatKomm [18. Lfg] Art 85 GDPR margin no. 19). § 9 DSG represents the "implementation" of the opening clause of Art 85 (Öhlböck in Knyrim, DatKomm [18. Lfg] Art 85 DSGVO Rz 10).

[42] 2.5. Section 9 (1) DSG (as amended by Federal Law Gazette I 2018/24) exempts the processing of personal data by media owners, publishers, media employees and employees of a media company or media service for journalistic purposes of the media company or media service from the application of Chapters II to VII and IX GDPR. The understanding of “journalistic purposes” must be based on Union law. The defendants take the position that, if interpreted in accordance with Union law, operating the app is a journalistic activity, so that Art 6 GDPR does not apply (more on this below). For the sake of completeness, however, it should be made clear in this context that in the present case the application of the media privilege does not automatically result in the objectionable data processing being permissible. Section 9 (1) DSG is only intended to simplify the processing of personal data for journalistic purposes from a data protection perspective, but not to cut off a weighing of interests with other legitimate interests of the data subject (6 Ob 152/19z Mikaela S. ÖBl 2020, 133 [Guggenbichler] jusIT 2019, 231 [Thiele]).

[43] 2.6. According to the case law of the Court of Justice of the European Union (ECJ) on the previous provision of Art 9 DS-RL (Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 for the protection of natural persons with the processing of personal data and for free data traffic), the term “journalism” is to be interpreted broadly. Accordingly, journalistic activities are activities that have the purpose of disseminating information, opinions or ideas to the public, by whatever means of transmission (C-345/17, Sergejs Buivids, ECLI:EU:C:2019:122 Rz 51, 53; C-73/07, Satakunnan Markkinapörssi and Satamedia, ECLI:EU:C:2008:727 margin nos. 56, 61). According to the case law of the ECJ, the exemptions and exceptions from provisions of the GDPR apply not only to media companies, but to anyone who is active as a journalist (C-73/07, Satakunnan Markkinapörssi and Satamedia, ECLI:EU:C:2008:727, margin no. 58). With regard to data protection, the exceptions and limitations must be limited to what is absolutely necessary to reconcile freedom of expression with privacy, which is also protected by fundamental rights (C-73/07, Satakunnan Markkinapörssi and Satamedia, ECLI:EU:C: 2008:727 margin no. 56).

[44] 2.7. However, not all information published on the Internet that relates to personal data is to be subsumed under the term “journalistic activities” (C-345/17, Sergejs Buivids, ECLI:EU:C:2019:122, margin no. 58). For example, the ECJ did not qualify the data processing carried out by the operator of a search engine as processing for journalistic purposes (C-131/12, Google Spain ECLI:EU:C:2014:317 margin no. 85). However, the ECJ has not yet commented specifically on the qualification of operating an evaluation platform.

[45] 2.8. The German Federal Court of Justice, on the other hand, has repeatedly ruled that the operation of rating platforms is not data processing for journalistic purposes (recently VI ZR 488/19, Ärztebewertung IV, Rz 12 ff on Art 85 Para 2 GDPR; also on the previous provision VI ZR 196/08, www. spickmich.de, margin no. 21 f; VI ZR 358/13, medical evaluation II).

[46] 2.9. In the literature, for the existence of data processing for journalistic purposes - following the decision of the BGH VI ZR 196/08 (www.spickmich.de, Rz 21 f) - a minimum level of journalistic processing and opinion-forming effect for the general public is required ( Öhlböck in Knyrim, DatKomm [18.Lfg] Art 85 DSGVO margin no. 16; Buchner/Tinnefeld in Kühling/Buchner, DS-GVO/BDSG³ [2020] Art 85 DSGVO margin no. 17a, 24 f; Jahnel, DSGVO [2021] Art 85 margin no 15; Specht/Bienenmann in Sydow, European General Data Protection Regulation² [2018] Art 85 Rz 13). The mere provision of a review portal is not considered sufficient (Jahnel, GDPR [2021] Art 85 margin no. 15; implicitly Buchner/Tinnefeld in Kühling/Buchner, DS-GVO/BDSG³ [2020] Art 85 GDPR margin no. 25; without own statement, for example Öhlböck in Knyrim, DatKomm [18.Lfg] Art 85 GDPR margin no. 16; Pauly in Paal/Pauly, General Data Protection Regulation³ [2021] Art 85 margin no. 8).

[47] 2.10. The decision of the data protection authority DSB-D123.077/0003-DSB/2018 cited by the defendants in their revision does not deal with a rating portal.

[48] 2.11. Taking into account the interests highlighted in the case law of the ECJ on so-called media privilege, which must be reconciled when interpreting Art 85 (2) GDPR - the protection of personal data and privacy on the one hand, the protection of freedom of expression and information in connection with journalistic activities on the other hand (see only ECJ C-73/07, Satakunnan Markkinapörssi and Satamedia, ECLI:EU:C:2008:727 Rz 54 ff) - the Senate agrees with the view represented in the literature that the Privileging data processing for journalistic purposes requires a certain degree of journalistic processing and opinion-forming effect for the general public, because otherwise the protection of the personal data of those affected would all too easily be undermined.

[49] The mere compilation of the average of the assessments made in the present case and the accessibility of these average evaluations is not sufficient in the light of this consideration to privileged the privileging of data processing in the case of Article 85 (2) DSGVO. of the defendant by the exception from Chapters II to VII and IX of the GDPR.

[50] 2.12. The ECJ assigned the assessment of whether specific processing of personal data was carried out "solely for journalistic purposes" within the meaning of the opening clause under Union law to the national courts (C-73/07, Satakunnan Markkinapörssi and Satamedia, ECLI:EU:C:2008:727 margin no. 62). For this reason, the Senate sees no reason to appeal to the ECJ for a preliminary ruling in accordance with the suggestion made by the defendant in accordance with Art 267 TFEU.

On the admissibility of data processing

[51] 3.1. It is undisputed that the name of the plaintiff, his academic degree and the assessments relating to him are personal data within the meaning of Art 4 Z 1 DSGVO. By collecting, recording, organizing, storing and disclosing this data to the users of the portal, the second defendant processes the data within the meaning of Art 4 No 2 GDPR (cf. BGH VI ZR 488/19, Ärztebewertung IV, Rz 26).

[52] 3.2. Art 6 GDPR regulates those facts that justify the processing of data (6 Ob 56/21k [request for a preliminary ruling]). The defendants rely on the legal basis of Art 6 Para 1 lit f GDPR. According to this provision, processing is lawful if it is necessary to safeguard the legitimate interests of the person responsible or a third party, provided that the interests or fundamental rights and freedoms of the data subject which require the protection of personal data do not prevail, in particular if it is the data subject is a child.

[53] 3.3. According to Article 6 (1) (f) GDPR, the processing of personal data is permitted under three cumulative conditions: First, the controller (here the second defendant) or a third party (here the users of the app) must have a legitimate interest, secondly, the processing of personal data must be necessary to realize the legitimate interest and thirdly, the interests or fundamental rights and freedoms of the person whose data is to be protected must not prevail (ECJ C-597/19, Mircom vs Telenet, ECLI:EU: C:2021:492 Rz 106; C-13/16, Rīgas satiksme, ECLI:EU:C:2017:336 Rz 28; 6 Ob 150/19f – neighbor’s dome camera, [recital 6] justIT 2020, 75 [Thiele] = ImmoZak 2020, 23 [Prader] = immolex 2020, 194 [Löffler] = EvBl 2020/103 [Gruber]; Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm [39th Lfg] Art 6 DSGVO margin number 51 [39. Lfg]; Frenzel in Paal/Pauly, DS-GVO/BDSG³ [2021] Art 6 DSGVO margin no. 27).

[54] 4.1. The interest in data processing is to be understood broadly (Frenzel in Paal/Pauly, DS-GVO/BDSG³ [2021] Art 6 DSGVO Rz 28). Legal, economic and non-material interests come into consideration (Schulz in Gola, General Data Protection Regulation² [2018] Art 6 GDPR Rz 57).

[55] 4.2. A legitimate interest in data processing can result from exercising the right to freedom of opinion and information (Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm [39.Lfg] Art 6 DSGVO Rz 54). It should be noted that Art 10 ECHR protects both the receipt of information and ideas and their transmission (cf. 6 Ob 236/19b - Ibiza video, [ErwGr B.5.1.] MR 2020, 72 [Frauenberger] = ecolex 2020 , 617 [Hofmarcher]). According to the wording of the provision, this also applies to freedom of expression and information under Art 11 GRC.

[56] 4.3. The defendants see a legitimate interest in data processing in the fact that students are given the opportunity to evaluate their teachers and thus achieve greater transparency in the field of education for the general public, in particular for students, parents and schools, and the quality of education is comprehensible Control is made accessible, the quality of teaching is increased and students have a better opportunity for their development.

[57]                                          does not see any legitimate interest in this, because students could not choose their teachers and because the defendants were actually pursuing commercial interests with the app.

[58] 4.4. On the one hand, the app enables teachers to be evaluated using predefined categories and, on the other hand, the public can view the evaluation results. It thus serves a legitimate interest in information in the form of exercising the freedom of opinion and information of the evaluating students as well as the people who view the evaluations.

[59] 4.5. The fact that students cannot choose their teachers at a school does not preclude the assumption of a legitimate interest, because the right to express and receive opinions does not differentiate according to whether the opinions are relevant to any dispositions of the recipient of the information (e.g. choice of school ) are useful or not. Rather, in a democratic society, those affected must have the opportunity to express and find out about criticism of the people involved, even where they cannot make any or only an indirect selection decision.

[60] 4.6. The purpose approved by the legal system is therefore not to offer the interested public an overview of the services offered on a market - in which the BGH recognized a socially desirable function of rating platforms (cf. BGH VI ZR 488/19, Ärztebewertung IV, margin no 28; VI ZR 495, 496, 497/18, www.yelp.de, Rz 46; VI ZR 30/17, Ärztebewertung III, Rz 15) - but in a situation in which direct selection is not possible, nevertheless to enable an examination of the teaching quality of individual teachers by means of subjective assessments.

[61] 4.7. It cannot be inferred from the established facts that the app is in fact only pursuing commercial interests and that the entertainment aspect associated with the rating is only intended to attract users for commercial purposes.

[62] 5.1. The second step is to clarify whether the specific data processing is necessary to protect legitimate interests. The prerequisite for this is that no milder, equally effective means are available to achieve these interests (Buchner/Petri in Kühling/Buchner, DS-GVO/BDSG³ [2020] Art 6 DS-GVO margin no. 147a).

[63] 5.2. The plaintiff does not see the data processing as necessary to achieve the goal because the app is not suitable for increasing transparency and the quality of teaching as well as the chances of students. In order to satisfy the public's need for information with regard to a school choice, less intrusive data processing - for example with pseudonymous instead of naming the teachers evaluated or by summarizing the evaluations according to school subjects - would be sufficient.

[64] 5.3. The plaintiff does not doubt that for the assessment process itself the assessments have to be linked to the names of the assessed teachers. His objections to the necessity relate to the ability to view the reviews by naming his name. However, this does not result in the lack of suitability for achieving the goal. An evaluation of the teachers summarized according to subjects or presented pseudonymously is accompanied by a loss of information for the people who view the app. It is true that for feedback to the individual teacher being assessed, disclosure to him alone would suffice; it may also be true that a pseudonymised reproduction of the evaluations of individual teachers can offer a certain amount of help when choosing a school. However, there is no reason why the legitimate interest in information of the public interested in a particular school should end with the selection of the school. Rather, there is also a legitimate interest in learning how the teaching quality of individual teachers is evaluated by their students. The reproduction of the (average) ratings assigned by name is therefore suitable for achieving the legitimate information goals; the necessity of the data processing is to be affirmed.

[65] 5.4. The Court of Appeal denied the necessity on the grounds that the app would not prevent misuse by means of ratings by people who are not even taught by the teacher concerned. However, the risk of assessments that are unobjectively motivated or carried out by people from outside the school cannot be averted by processing the plaintiff’s data in a less intrusive manner – specifically by publishing the assessment results in a pseudonymous form or by publishing them aggregated by subject. The possibility of misuse therefore does not conflict with the finding that publication of the ratings associated with the names of the teachers is suitable for achieving the goal.

[66] However, the dangers associated with such abuses for the personality rights of the assessed teachers are to be deducted whether the fundamental rights and fundamental freedoms of the person concerned overweight the interests pursued by data processing.

[67] 6.1. In order to balance the conflicting interests, the plaintiff relies on his right to respect for private and family life, privacy, anonymity of name and good reputation. He asserts that he has not given cause for a publicly accessible assessment of his professional activity by naming his name; he is exposed to the risk of being pilloried, in particular by bad ratings that are not objectively motivated.

[68] These interests comply with the defendants the right to freedom of expression and freedom of information on the lesson quality and the measures they have taken against abuse of the app for the purposes of mood.

[69] 6.2. When weighing up the interests to be carried out, it must first of all be taken into account in general that excessive protection of personal rights would lead to an intolerable restriction of the interests of others and those of the general public (RS0008990).

[70] Within the framework of the balancing of interests, it is then necessary to differentiate which sphere of the personality was infringed upon (6 Ob 100/20d Confusion of Attitudes [Recital Gr 2.3.2.]). The highly personal area of life, which in any case includes health, sex life and life in and with the family, represents the core area of protected privacy (RS0008990 [T11]). The social sphere in which the person concerned, as a person standing in a community, communicates with outsiders does not enjoy such extensive protection (cf. 6 Ob 100/20d - confusion of mind). Here he has to adapt to the observation and evaluation of his behavior. This applies all the more, the more intensively a person is active in public and social life. In the social sphere, too, however, serious encroachments on personal rights, in particular stigmatization and exclusion, are in any case prohibited (6 Ob 100/20d - Confusion of minds [ErwGr 2.3.2.]).

[71] 6.3. The right to anonymity of name derived from the general right of personality (RS0008998) also does not grant a general right to refrain from the public "use" of the name of another, insofar as this is done by mere naming (RS0009319; RS0109217 [T3]). The possible illegality of such attribution only results from the content of the associated statement (RS0009319). In the course of the necessary balancing of interests, it must be taken into account whether the bearer of the name gave a factual reason for naming his name; if he has not done so, this does not necessarily lead to the inadmissibility of the attribution (6 Ob 266/06w [Recital 3.6.]). Rather, it is a matter of weighing up the conflicting interests.

[72] 6.4. The assessment of whether an encroachment on the economic reputation and personal honor of a person is unlawful under § 1330 ABGB also requires a comprehensive weighing of interests (RS0008987). There is no interest covered by the freedom of expression in the dissemination of false reputation-damaging factual allegations (RS0008987 [T7]; cf. RS0107915) or excessive valuations (RS0054817 [T31, T42, T45]). In addition, the severity of the interference, the proportionality to the purpose pursued, the degree of protection of the interest, but also the purpose of the expression of opinion are decisive (RS0054817 [T30]).

[73] 6.5. The plaintiff's central argument for the outweighing of his interests is that the app allows people who were never his students to submit reviews.

[74] 6.5.1. The plaintiff agrees that such abuse is possible. According to the findings of the registration process, it is possible that a student, angry with a certain teacher, encourages his friends - even those who do not even know the teacher in question - to give bad reviews.

[75]          The terms of use of the app point out that an evaluation is only permitted if the person evaluating "[has] had personal experience with the respective teacher". The registration process does not ensure this, however, because (any) mobile phone number is required for this. Nor have the defendants argued that the app was programmed in such a way that, before submitting a rating, people had to answer the question of whether they had personal experience with the teacher being rated.

[76]     Misuse of the app in such a way that people who have never been taught by a certain teacher still rate this teacher is therefore not prevented by the design of the app and is also not made more difficult.

[77] 6.5.2 As far as the defendants are of the opinion that the "Request changes" button can be used to check for cases of abuse, this is not comprehensible. The second defendant app operator does not know the names of the reviewers, nor does she know whether they are students from a specific school or a specific teacher. Whether people who had no experience with the assessed teacher gave ratings or whether students - by registering with several mobile phone numbers - gave multiple ratings can only be recognized at all if the number of total ratings given is higher than the number of students who concerned teachers are taught.

[78]     In those cases in which misuse of the evaluation function does not result from the unrealistically high number of evaluations, the teacher concerned can object to the evaluations by people who have had no personal experience with him, according to the facts established therefore not effectively defend themselves, because there will be a lack of concrete indications of the existence of abuse.

[79] 6.5.3. If a person submits an evaluation of a teacher, they implicitly indicate that they have their own experiences with the person being evaluated as a basis for the evaluation. If this is not the case, the statement is likely to mislead the addressee on an important point (cf. 6 Ob 143/21d on the evaluation of a law firm on an online platform, omitting the fact that the person making the evaluation was not a client of this law firm). There is therefore no legitimate interest on the part of persons who have not had personal contact with a teacher to rate him or her. There is also no legitimate public interest in such reviews.

[80] 6.5.4. Whether this possibility of misuse makes the data processing of the plaintiff or other teachers and thus the operation of the app absolutely inadmissible depends on how intensively the measures conceivable to prevent misuse restrict all fundamental rights to be included in the weighing of interests.

[81] 6.6.1. Misuse of the app by people without their own experience rating a particular teacher could be prevented or at least prevented by imposing an obligation on the operator of the app to check. The Court of Appeal considers such an obligation to be legally necessary.

[82] 6.6.2. How such a review can be designed was not discussed in the proceedings. However, it is obvious that every review by the operator of the app is accompanied by a restriction of the anonymity of the reviewers.

[83] 6.6.3. The European Court of Human Rights (ECtHR) has consistently recognized that Internet users have a legitimate interest in not disclosing their identity. He starts from the consideration that anonymity has long been a means of avoiding reprisals and unwanted attention and as such is capable of promoting the free flow of ideas and information in important ways, especially on the Internet (16/6/2015, Bsw 64569/09, Delfi AS v. Estonia, Rz 147; December 7, 2021, Bsw 39378/15, Standard Verlagsgesellschaft mbH v. Austria, Rz 76, 95). The ECtHR states that different levels of anonymity are possible on the internet. Accordingly, an Internet user may be anonymous to the general public but identifiable to a service provider through an account or contact details that may be either unverified or subject to some form of verification, ranging from limited verification such as through account activation via email or through a Account in a social network to ensure authentication, for example through the use of national electronic identity cards or online banking authentication data that allow the user to be securely identified. However, the service provider can also allow its users full anonymity, with which the user does not have to identify himself at all and can only be traced back to a limited extent via the information kept by Internet access providers, the release of which usually requires an order from courts or investigative authorities ( cf ECtHR June 16, 2015, Bsw 64569/09, Delfi AS v. Estonia, margin no. 148; December 7, 2021, Bsw 39378/15, Standard Verlagsgesellschaft mbH v. Austria, margin no. 77). Although anonymity on the Internet is recognized as an important value, it must always be weighed against other rights and interests (ECtHR June 16, 2015, Bsw 64569/09, Delfi AS v. Estonia, Rz 149; December 7, 2021, Bsw 39378 /15, Standard Verlagsgesellschaft mbH v. Austria, margin no. 91 f).

[84] 6.6.4. In the case of anonymous statements, there is always the possibility that people will evaluate performance, although they should not honestly give a subjective assessment due to a lack of personal experience. From the case law of the ECtHR it can be concluded that the possibility of anonymous expression of opinion on the Internet must not be prevented per se, but that a weighing of interests must take place. This means that people affected by abusive reviews have to put up with some degree of such abuse.

[85] 6.7. In the present case, it is necessary to consider whether the applicant's interest in not being evaluated by persons who were not his students and in not having such evaluations published justify requiring the second defendant to provide the authentication required by the Court of Appeal. It must also be examined whether the plaintiff's interests in preventing abusive ratings justify prohibiting the processing of the plaintiff's data in the course of operating the app.

[86] 6.7.1. The starting point of the consideration is that a reliable check by the app operator - the Court of Appeal requires that it be "ensured" that a person was taught by a specific teacher - the real name of the person evaluating and the submission of evidence, students of a being a specific teacher requires. However, such a preventive measure would reduce the willingness to make assessments, especially among people who are actually students of the teacher concerned. Precisely because students are often taught by the same teachers for years and they cannot choose their teachers, they will be inclined, for fear of reprisals, not to combine a critical assessment with their real names - even if only to the platform operator . Even the obligation to register under real names would trigger self-censorship by a teacher's (actual) students.

[87] 6.7.2. On the side of the plaintiff, it must be taken into account that the assessments at issue here relate exclusively to his professional practice, i.e. the social sphere, which can only claim less protection than privacy. The naming in the present app can therefore only be prohibited if the associated, published content results in an infringement of personal rights of more than minor importance.

[88] 6.8. In this context, it should be noted that there are no legally relevant grounds for prohibiting assessments of the plaintiff's teaching quality by his own students.

[89] 6.8.1. Without exception, the available assessment categories relate to professional practice, not private or family life. They do not suggest an impairment of the personal dignity of the plaintiff (in the sense of § 1330 para. 1 ABGB). In addition, the limited rating option - only by awarding stars, i.e. without free text rating - excludes insults from the outset. The plaintiff has not raised any concrete fears with regard to his economic reputation (in the sense of Section 1330 (2) ABGB). It is also not obvious that a bad average rating on the rating portal of the second defendant threatens a teacher with professional disadvantages. Weak ratings in the categories available here do not affect the free development of personality. The danger of bad ratings is to be accepted in principle (cf. BGH VI ZR 488/19, physician assessment IV, margin no. 39; cf. ECtHR 24.11.2015, Bsw 72966/13 Kucharczyk v. Poland, on criticism of a lawyer), because any assessment would be meaningless , if bad ratings could already be objected to per se.

[90] 6.8.2. For the passive users of the app (i.e. those people who just read the ratings and do not submit their own ratings), it is also clear that the subjective assessments of several people were included in the overall rating of a teacher and in the ratings of the individual categories. You will therefore only attach importance to the respective star information to reflect a tendency or an average mood. Since the ratings can only be viewed without registration, but only by people who download the app and select a specific school, naming does not necessarily involve the risk of the plaintiff being dragged in front of a public that would otherwise would not have noticed him at all. A weak average rating published on the app is therefore not associated with a pillory effect.

[91] 6.8.3. Insofar as the plaintiff complains that, for example, in the assessment category punctuality, incorrect factual statements could be made that are not covered by freedom of expression (cf. RS0032201 [T2]), this is not the case. Even if the rating categories are based on facts, such as in the "punctuality" category, the individual ratings are not factual claims, but value judgments, because the subjective classification on a scale from one to five stars is not objectively checked for accuracy can (cf. RS0032212 [T11]). Neither can the published average ratings be qualified as factual claims.

[92] 6.8.4. Insofar as a risk of abuse is seen in the fact that the plaintiff's (own) students, for irrelevant reasons, such as anger, give worse ratings than their own assessment, this also does not lead to the plaintiff's interests in anonymity prevailing. Improper motivations of individual reviewers cannot be avoided through the design of the app. Rather, non-objectively motivated value judgments are also covered by freedom of expression, as long as there is no excess of judgment.

[93] 6.8.5. In summary, in the case of assessments made by the plaintiff's own students, the plaintiff has no overriding interest in the refraining from the objected processing of his personal data.

[94] 6.9. But even the risk that assessments will be made by people who were not students of the plaintiff does not make the data processing at issue here inadmissible.

[95] 6.9.1. It has already been stated that the individual interests of the persons who evaluate the plaintiff's teaching activities without having had personal experience with him take second place to the interests of the plaintiff. However, it must also be assessed whether the risk of abuse affects the interests of the plaintiff to such an extent that the restriction of the freedom of opinion and information of all app users is justified.

[96] 6.9.2. In this context, too, it is essential that the rating only affects the plaintiff's professional activity that is perceptible to the school public, but not his private life, that the published average ratings, due to the restriction to the awarding of stars, prevent encroachments on honor through insults or excessive formulations and that for passive Users of the app can see that the average ratings merely reflect a trend averaged from several ratings. In this context, particular weight is attached to the fact that the assessments of the plaintiff's teaching activities can only be viewed by people who download the app and select the specific school, so that it is not to be expected that the plaintiff would reach the general public through the app alone becomes known. The encroachment on his interests through the objected data processing is therefore - also taking into account the possibility of abuse - not to be rated higher than the interest of all app users in evaluating the plaintiff's teaching activities and being able to view the (average) ratings.

[97] 6.10. This result corresponds to the case law of the Federal Court of Justice, which - even before the GDPR came into force - judged the collection, storage and determination of personal data of a teacher in an online evaluation forum to be permissible (BGB VI ZR 196/08, www. spickmich.de).

Result

[98] 7.1. The processing of the plaintiff's personal data in the app is lawful in accordance with Article 6 (1) (f) GDPR. The plaintiff's request for an injunction against the second defendant operator of the app is therefore not justified.

[99] 7.2. Due to the legality of the data processing according to Art 6 Para 1 lit f GDPR, the claim for deletion asserted by the plaintiff, based on Art 17 Para 1 lit d GDPR, is also not justified.

[100] 7.3. Since the objected data processing is not unlawful, the complaint against the first defendant is also to be dismissed, without having to go into the question of the elimination of the risk of repetition by bringing his registered sole proprietorship into the second defendant.

[101] 7.4. There is no need to go into the defectiveness of the appeal procedure, which the plaintiff complained about in his appeal, because the claim for action must be dismissed in its entirety.

[102] 7.5. As a result, the decision of the court of first instance must be restored.

[103] 8. The statement on the costs of the appeal proceedings is based on Section 52 (3) ZPO. The Court of Appeal reserved the decision on costs in the second instance until the dispute was finally settled. The Supreme Court is also bound by this (cf. RS0129336).