BVwG - W258 2247028-1

BVwG - W258 2247028-1
Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 58(2) GDPR § 24 DSG
Decided:	29.04.2022
Published:	03.06.2022
Parties:	anonymous DSB
National Case Number/Name:	W258 2247028-1
European Case Law Identifier:	ECLI:AT:BVWG:2022:W258.2247028.1.00
Appeal from:
Appeal to:
Original Language(s):	German
Original Source:	Rechtsinformationssystem des Bundes (RIS) (in German)
Initial Contributor:	Heiko Hanusch

The Federal Administrative Court of Austria held that the Austrian Data Protection Authority only has the power to declare processing activities unlawful in proceedings following a complaint, and not when they were initiated by the DSB itself.

English Summary

Facts

The controller is an employer who allegedly surveilled its employees work phones and work email accounts from January until March 2021. The DSB (Austrian Data Protection Authority) heard of this conduct in media reports and initiated an ex officio investigation into the matter on 31 March 2021. On 29 July 2021 the DSB adopted an administrative act in which it declared the processing of the controller unlawful.

The controller initiated court proceedings against the act claiming that its conduct was lawful and that the DSB - neither under national law nor under the GDPR - had the power to declare the processing unlawful. It argued that Article 58(2) GDPR does not provide a DPA with such a power, because "declaring the unlawfulness" is not listed there. Moreover, § 24 DSG (Austrian Data Protection Act) which provides the DPA with the power to make such a declaration only applies to proceedings which were initiated by a complaint and not by the DSB itself.

Holding

The Federal Administrative Court (Bundesverwaltungsgericht – BVwG) decided in favour of the controller and set the administrative act aside. It found that there is no provision in national law or the GDPR that gave the DSB the power to declare the processing unlawful.

The court first established that § 24 DSG, which provides the DSB with such a power, only applies to complaint proceedings and not ex officio proceedings. The court also rejected an analogous application of § 24 DSG, because it found that the legislator purposefully regulated complaint and ex officio proceedings differently so that there is no room for an analogous application. Moreover, it reasoned that in a complaint proceeding there is a data subject who may have a legal interest in the declaration in order to pursue further individual claims against the controller like a claim for damages; in ex officio proceedings no such interest exists.

The court further found that there is no legal basis in the GDPR either, since Article 58(2) GDPR does not include a power to declare the processing unlawful, but only the power to issue a reprimand or to fine the controller.

Comment

The BVwG mainly based its holding on a decision (Ro 2020/04/0032-8) by the Supreme Administrative Court of Austria (Verwaltungsgerichtshof – VwGH) regarding the same subject matter. However, in my opinion, both Austrian courts were incorrect. German Courts and scholars (see Grittmann in Taeger/Gabel, DSGVO - BDSG – TTDSG, Art. 58 Para 24) are of the opinion that a reprimand under Article 58(2)(b) GDPR entails a declaration of unlawfulness. According to this view a reprimand consists of two parts: The declaration that the processing was unlawful and the warning that the controller should not violate the GDPR again. Therefore, by way of an argumentum a fortiori (a maiore ad minus), it may be concluded that a DPA actually has the power to declare the processing unlawful.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

                                                                               Postal address:
                                                                      Erdbergstrasse 192 – 196
                                                                                 1030 Vienna
                                                                         Phone: +43 1 601 49-0
                                                                  Fax: + 43 1 711 23-889 15 41
                                                               Email: einlaufstelle@bvwg.gv.at
                                                                            www.bvwg.gv.at


                    DECISIONS D A T U M

                                2 9 . 0 4 . 2 0 2 2

                           BUSINESS NUMBER




                      W 2 5 8 2 2 4 7 0 2 8 - 1 / 1 1 E



                I M N A M E N D E R E P U B L I K !


The Federal Administrative Court has judge Mag. Gerold PAWELKA-SCHMIDT as

Chairman and the expert lay judges Dr. Gerd TRÖTZMÜLLER and Gerhard RAUB
as assessor on the complaint of XXXX, represented by CERHA HEMPEL Rechtsanwälte

GmbH, 1010 Vienna, against the decision of the data protection authority of July 29, 2021, GZ DSB-
D213.1303 2021-0.412.072, in circulation on a data protection matter

rightly recognised:


A) The complaint will be followed and the notice will be removed without replacement.

B) The revision is not permitted according to Art. 133 Para. 4 B-VG.







                                Reasons for decision:


I. Procedure:


1. Based on media reports that the complainant (in the proceedings before the
Data protection authority "responsible") company mobile phones and company e-mail accounts

some of their employees is said to have been monitored by the relevant authority on March 31, 2021
ex officio investigation proceedings initiated against the complainant and asked her, - 2 -


within three weeks, various questions about the procedure and the extent of the monitoring as well as
to answer about a obtained consent and to present related documents.


2. In a letter dated April 28, 2021, the complainant submitted various documents

Declarations of consent and non-disclosure clauses and answered the questions
summarized as follows: In the course of the sale of a business unit, a

competitive bidding process lasting several months. Just before the end of

Negotiations there was a "leak" in which strictly confidential information of the
bidding process had become public, causing the complainant damage in

millions had been created. The board of the complainant then had a

internal investigation initiated. The purpose of the investigation is to clarify the facts and
the relief of the suspected employees. For this are the

official e-mail accounts - after obtaining the consent of the persons concerned

certain keywords, as well as in the partially anonymous
Individual call records of the employees involved have been inspected. the

Complainant was under company law to an investigation of the facts

been obliged to comply with data protection regulations
have performed.


3. With a decision dated July 29, 2021, the relevant authority stated that "the ex officio
Inspection method was authorized and it is found that processing

personal data of 73 individuals between January and March 2021 for purposes

internal investigations based on the stated justification facts (§1 Abs.2 DSG,
Article 6 paragraph 1 lit. a and alternatively lit. f GDPR) was unlawful.”


As a reason, the relevant authority summarized the consent obtained

was due to the imbalance between the complainant as an employer and
the employees as their employees is not made voluntarily and is therefore invalid. Since the

If the legal basis for the processing cannot be changed later, the

Complainant also does not base the data processing on the permission of the
"legitimate interest" according to Art 6 Para 1 lit f GDPR. The data processing can

but in any case not based on Art. 6 Para. 1 lit f GDPR, because relevant

Legislation should have been complied with, which was not the case. So
is subject to the investigation carried out as a control measure which the

touch human dignity, the consent of the works council, which the complainant
have not caught up., - 3 -


4. The present complaint of August 27, 2021 is directed against this decision
Procedural errors and substantive illegality in which the complainant

requested that the Federal Administrative Court decide in the matter itself and

determine that the processing by the complainant was lawful, in eventu
revoke the contested decision and issue a new decision

referred back to the relevant authority.


In essence, the complainant submitted that the authority concerned had the
Facts insufficiently determined and incorrectly legally assessed, especially in relation

on the voluntariness of the consent obtained from the employees. Also have the

competent authority violated the surprise ban because for the
Complainant had not been foreseeable that the last of 18

questions asked will be particularly relevant to the decision and they also have

the proceedings are expected to be discontinued after the questions have been answered. About that
Furthermore, the verdict of the notice was too vague. Contrary to the view of those concerned

Authority it is also permissible to process data with several permissions

to secure. There was also no company agreement or
The works council's consent is required, which the complainant claims with a

have substantiated legal opinions. Regarding the admissibility of several
Justification reasons, the necessity of a works agreement and the admissibility

of consent to data processing in employment relationships encourage them to do so

to request a preliminary ruling from the ECJ.

5. The data protection authority submitted the complaint to the adjudicating court

Connection of the administrative act with a brief dated October 4th, 2021, received on

05.10.2021, and stated in summary that the complainant had
relevant time of data collection from the staff exclusively on the

Justification of the consent under Art 6 Para 1 lit a GDPR supported. the

Officials could not have expected that the consent would only be "pro forma"
will be obtained and processing, regardless of consent - based on a

legitimate interest according to Art 6 Para 1 lit f GDPR -, nevertheless takes place. It is inadmissible

in the event of problems with the consent, subsequently refer to other justifications
to support. In this respect, the complainant's arguments are justified

Interest according to Art 6 Para 1 lit f GDPR and the explanations of the submitted
legal opinion into emptiness. Furthermore, the Respondent is all

investigation results essential to the decision have been disclosed and they have to do so

be able to comment on why the objection of the ban on surprises is misguided., - 4 -


6. In a brief dated November 18, 2021, the complainant summarized that
not all affected employees would be subject to the ArbVG. The authority concerned

have the decision-relevance of the existence of a works agreement is not sufficient

communicated, as a result of which the complainant had been deprived of the opportunity to
to submit an expert opinion on this subject, which was already available before the decision was issued.


Furthermore, neither the verdict nor the reasoning indicated “which

Processing(s) of which personal data […] with regard to which employees
due to which specific circumstances should have been unlawful”, whereby this

be too vague.


With the consent obtained from the employees, the relevant authority only
selectively and in a generalizing manner, without considering the circumstances of the

to enter into individual cases that would speak in favor of the voluntary nature of the consent.


The complainant does not have the legal basis for the use of the data
later changed, rather all employees are the internal ones

Data protection guidelines known, which inform that the complainant at

Violations of laws or company policies Inspection of documents and
can take correspondence.


7. The authority concerned responded with a brief about hearings from the parties on November 26, 2021
December 20, 2021, essentially as before.


8. Based on the decree of the hg business allocation committee of December 16, 2021

the case was taken from Judicial Division W211 and Judicial Division W258
reassigned as of 01/03/2022.


9. With a hearing of April 11, 2022, the authority concerned was informed of the

decision of the Administrative Court of December 14, 2021, Ro
2020/04/0032, that she did not have any in an officially initiated examination procedure

Competence to determine infringements in a manner capable of having legal force, why

the notice would have to be remedied without replacement.

9. In a brief dated April 25, 2022, the authority concerned submitted that

The finding cited is not applicable to the case in question because the

decision of the data protection authority on an ongoing infringement
reason. In the present case, however, the infringement has already been completed and

thus (also) a violation of § 1 DSG has been agreed. It is not justifiable,, - 5 -


which is why, in the case of identical facts, one in the past and already
Completed violation of rights in the case of an individual complaint according to § 1 in conjunction with § 24 DSG,

cannot, however, be determined in an official examination procedure.


It is typical for violations of the fundamental right to data protection according to § 1 DSG that they already
Are completed. However, the Austrian (constitutional) legislature could not

be assumed to issue a provision that cannot be enforced ex officio,

because Article 58 (2) GDPR does not provide for a corresponding right to remedy the situation. Therefore have the
Decision of the competent authority - in contrast to the decision, which said knowledge

of the Administrative Court is based - also contain only one ruling

and not several. In general, Art 58 GDPR only applies to currently existing or
to interpret possible legal infringements in the future.


Ultimately, a violation of the GDPR should be discussed in the form of a notification, so that

both in official proceedings and in individual proceedings for those subject to the law
the possibility of an appeal in the sense of legal protection is open.


Evidence was collected by inspecting the administrative file.


II. The Federal Administrative Court considered:

1. The following facts are established:


With a decision dated July 29, 2021, the relevant authority spoke in an officially initiated manner
Examination procedure on the admissibility of data use by the complainant

away.


The statement of the notice reads:

       "The official examination procedure was justified and it is determined that the

       Processing of personal data of 73 individuals between January and March

       2021 for the purposes of internal investigations based on the information provided
       Justification facts (§ 1 Abs. 2 DSG, Art. 6 Abs. 1 lit. a and alternatively lit. f

       GDPR) was unlawful."


2. The findings result from the following assessment of evidence:

The findings are based on the harmless administrative act., - 6 -


3. Legally it follows:

The admissible complaint is justified.


3.1. Regarding the relevant legal provisions:


Article 58 GDPR entitled “Powers” reads:

       “[…] (2) Each supervisory authority shall have all of the following remedial powers that

       allow her


       a) to warn a controller or a processor that
       intended processing operations are likely to violate this regulation

       violate


       b) to warn a controller or a processor if he is using
       processing operations has violated this regulation,


       c) instruct the controller or the processor to comply with the requests of the

       data subject to exercise the rights to which they are entitled under this regulation
       correspond to,


       d) instruct the controller or the processor to
       Processing operations, if necessary, in a specific way and within a

       to bring them into line with this regulation within a certain period of time,


       e) to instruct the person responsible of a breach of protection
       to notify the data subject of personal data accordingly,


       f) a temporary or permanent restriction of processing, including

       a ban on imposing

       g) the correction or deletion of personal data or the

       Restriction of processing pursuant to Articles 16, 17 and 18 and the

       Informing the recipients to whom these personal data pursuant to Article
       17 paragraph 2 and Article 19 were disclosed to order such measures,


       h) to revoke a certification or to instruct the certification body to

       revoke the certification granted in accordance with Articles 42 and 43, or the
       instruct certification bodies not to issue certification if the

       Requirements for certification are not or no longer met, - 7 -


       i) to impose a fine pursuant to Article 83, in addition to or instead of in
       measures referred to in this paragraph, depending on the circumstances of the individual case,


       j) the suspension of the transfer of data to a recipient in a third country

       or to an international organization. […]

       (6) Any Member State may provide by law that its

       Supervisory authority in addition to the powers listed in paragraphs 1, 2 and 3

       has additional powers. The exercise of these powers shall not be effective
       impair the implementation of Chapter VII.”


Section 24 DSG entitled “Complaint to the data protection authority” reads:


       "Section 24. (1) Every data subject has the right to lodge a complaint with the
       Data Protection Authority when it considers that the processing of you

       personal data concerned against the GDPR or against § 1 or article

       2 1. Chapter violates.

       (2) The complaint must contain:


       […]

       5. the desire to determine the alleged infringement [...]


       (5) If a complaint proves to be justified, it must be followed. Is a

       Injury to be attributed to a person responsible for the private sector, so is this
       to comply with the complainant's requests for information, correction,

       deletion, restriction or data transfer to the extent

       which is required to eliminate the identified infringement. As far as the
       If the complaint proves to be unjustified, it must be dismissed."


3.2. Applied to the situation, this means:


The authority concerned has to deal with the challenged decision in an ex officio manner
initiated test procedure agreed that the ex officio test procedure is justified

had been and established that the processing of personal data by 73

Persons between January and March 2021 for the purpose of internal investigations based on various
stated facts of justification was unlawful., - 8 -


However, the authority concerned has no legal basis for a self-employed person
Objection to the possible authorization to carry out a procedure within the meaning of

Art 58 para 2 GDPR or the possible illegality of the respective cause

Processing operation: Art 58 DSGVO contains no express legal basis for
an independent determination of the possible illegality of a data protection law

relevant processing operation in a procedure initiated ex officio by the

Data Protection Authority. § 24 DSG in turn regulates what you think in your opinion
Right to protection of the personal data concerning them

Individual complaint and is thus officially on the of the data protection authority

initiated proceedings not directly applicable. (VwGH 14.12.2021, Ro 2020/04/0032)

Also an analogous application of § 24 DSG, which the data protection authority

Competence grants, in the case of individual complaints, violations of data protection law

legally binding, on examination procedures initiated ex officio, separates
in the absence of an unplanned gap, because the legislature has the powers of

Data protection authority aware of individual complaints and official intervention

has regulated differently (see also VwGH 14.12.2021, Ro 2020/04/0032 mwN).

3.3. The objections of the authority concerned are not convincing.


3.3.1. If the authority concerned believes that the previously cited finding of
Administrative Court of December 14, 2021, AZ Ro 2020/04/0032, on the subject matter

case is not applicable because the Administrative Court in this decision only

has dealt with ongoing violations of the law, which
Infringements of rights in the case in question have already been completed is her

to counter that the Verwaltungsgerichtshofin the above-mentioned decision also

dealt with infringements that had already been completed, namely with
the transfer of personal data to third parties (margin no. 3).


3.3.2. However, the authority concerned must be agreed that the

Administrative Court in this decision only on violations of the GDPR, but not
- as here - referred to a violation of § 1 DSG. But that means nothing to her

win, because the main considerations of the Administrative Court also refer to violations

can be taken over against § 1 DSG:

Regarding the procedural rules and the competence of the data protection authority

the Data Protection Act makes no difference whether a breach of the GDPR or the
§ 1 DSG is objective. With regard to violations of § 1 DSG, there is no - 9 -


express legal basis for the authority concerned, infringements in one
officially initiated procedures in a legally binding manner.


An analogous application of § 24 DSG (only there - apart from the one here not

relevant § 22 para. 6 DSG - a determination competence of the data protection authority standardized)
is excluded in the case of violations of § 1 DSG, because the statements of the VwGH, according to which the

Legislators of the possibility of Art. 58 Para. 6 GDPR, according to which each Member State through

Legislation can provide that its supervisory authority, in addition to the provisions of Art. 58 para
1, 2 and 3 GDPR has additional powers according to the

Materials on § 22 DSG deliberately not used (cf. AB 1761 BlgNR 25. GP, 14),

which is why he extends the powers of the data protection authority to individual complaints and
official intervention deliberately regulated differently, which is why an analogy

due to a lack of gaps contrary to the plan, also apply to procedures that refer to § 1 DSG

support.

With the same justification, the Administrative Court also has that in this decision

- argument now used by the authority concerned that it is not comprehensible

why the authority concerned in proceedings on individual complaints, but not
has a determination authority in procedures initiated ex officio.


If the authority concerned argues that it is typical for violations of § 1 DSG that they
have already been completed and it can be submitted to the Austrian (constitutional) legislature

not be assumed to enact a provision that is not carried out ex officio

can, it starts from the incorrect assumption that data protection law - here this
Fundamental right to data protection according to § 1 DSG - would only be enforceable if

Violations of rights can be determined in a way that is legally binding.


On the contrary, the determination competence of the data protection authority in
Complaints procedure according to §24DSG has not been standardized to a person responsible or

to cause a processor to behave in accordance with the law or to

to help enforce data protection law itself, but to allow those affected to do so
enable illegality in an official procedure that is simple for them

to have a binding determination of data processing in order to inform the data subject

based on this finding to allow further individual claims - about
Claims for damages - to be pursued (VwGH 14.12.2021, Ro 2020/04/0032 Rz 38 f).


Rather, the enforcement of data protection law is carried out by other legal institutions, such as
Remedial powers of the authority, in particular according to Art. 58 GDPR, or fines, - 10 -


ensured
or a restriction of data processing in accordance with Art 58 Para 2 lit f GDPR

comes - the authority concerned has the competence to be responsible according to Art. 58 para. 2 lit b

GDPR to issue a warning or a fine pursuant to Art. 83 GDPR, if necessary
to impose administrative penalties in accordance with § 62 DSG. If profit or damage intent

In addition, a violation of § 1 DSG is even threatened with criminal penalties (§ 63 DSG).


Ultimately, the authority concerned may argue that violations of the GDPR
(probably also meant against § 1 DSG) is to be agreed in the form of a notification in order to

Enabling the addressee of a decision to appeal is a suitable justification

be sure that performance orders have to be issued in the form of a notification, but not that the
DSB has a determination authority.


3.4. The contested decision was therefore issued without a legal basis, which is why the

Complaints directed against him already for this reason and the decision
could be repaired without replacement.


3.4. It was therefore to be decided accordingly.


3.5. According to § 24 para. 2Z 1 2nd case
VwGVG are disregarded.


Regarding point B) Inadmissibility of the revision:

According to § 25a Abs 1 VwGG, the administrative court in its decision or

Pronounce a resolution as to whether the revision is permissible in accordance with Art. 133 Para. 4 B-VG. This

Statement must be briefly justified.

The revision is not admissible because there were no legal issues to be resolved, which were fundamental

importance within the meaning of Art. 133 Para. 4 B-VG. To answer the question of whether the

data protection authority in an ex officio initiated test procedure
is entitled to establish legal violations in a legally binding manner, or about the

To deny the authorization of the official examination procedure, that could be

Administrative Court based on the cited case law of the Administrative Court.
Although the citation cited did not expressly refer to violations of § 1 DSG, his

However, the underlying considerations could undoubtedly be transferred to violations of § 1 DSG

will.