DSB (Austria) - 2020-0.303.727

DSB - 2020-0.303.727
Authority:	DSB (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 17(1) GDPR Article 85(1) GDPR Article 85(2) GDPR Article 11 CFR Article 10 ECHR § 1 Mediengesetz § 9 Datenschutzgesetz - DSG
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	01.09.2020
Published:	02.11.2020
Fine:	None
Parties:	Ulrike A*** (complainant) Verein N*** (respondent)
National Case Number/Name:	2020-0.303.727
European Case Law Identifier:	ECLI:AT:DSB:2020:2020.0.303.727
Appeal:	Not appealed
Original Language(s):	German
Original Source:	Rechtsinformationssystem des Bundes (RIS) (in DE)
Initial Contributor:	Marco Blocher

The Austrian Data Protection Authority (DSB) rejected a complaint on data erasure because the respondent was a media company processing data for journalistic purposes. The DSB considered itself not competent to handle such a complaint under § 9 of the Austrian Data Protection Act and Article 85 GDPR.

English Summary

Facts

In June 2019, the complainant requested erasure of her personal data from the respondent's website, claiming that an article on that website contained wrong statements about her. After the respondent’s refusal to do so, the complainant lodged a complaint with the DSB.

The respondent argued that publishing the article on its website qualified as processing carried out for journalistic purposes under Article 85 GDPR and § 9(1) of the Austrian Data Protection Act (Datenschutzgesetz - DSG). Due to the derogations in § 9(1) DSG, the DSB would hence not be competent to handle the complaint.

Dispute

• Is the DSB competent to handle the complaint or is the processing on the respondent's website subject to Article 85 GDPR and § 9(1) of the Austrian Data Protection Act?

• Did the respondent violate the complaint's right to erasure under Article 17 GDPR?

Holding

The DSB held, that the respondent qualifies as a media company under § 1(1)(6) of the Austrian Media Act, because it is a company which creates the content of the medium and handles the production, distribution, broadcasting and retrievability of the medium. It further held, that the data processing (publishing the complainant's personal data in an online article) was carried out for journalistic purposes. As the complainant is an former politician and the article revolved around legal procedures that she is involved in there was a public interest in mentioning the complainant's name.

Under Article 9(1) DSG, Chapter III and Chapter VI of the GDPR do not apply on data processing carried out by media companies for journalistic purposes. Such GDPR violations must be tried before civil courts. Hence, the DSB considered itself not competent, rejected the complaint and did not investigate the alleged violation of Article 17 GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Decisive authority
Data protection authority


Decision date
09/01/2020


Business number
2020-0.303.727


Appeal at the BVwG / VwGH / VfGH
This decision is final.




text
GZ: 2020-0.303.727 of September 1, 2020 (case number: DSB-D124.1342)
[Note processor: names and companies, legal forms and product names, addresses (incl. URLs, IP and e-mail addresses), file numbers (and the like), etc., as well as their initials and abbreviations can be shortened and / or changed for reasons of pseudonymisation his. Obvious spelling, grammar, and punctuation errors have been corrected.
The decision has been pseudonymised with particular care, but due to the reporting of related events, it cannot be ruled out that the complainant can be identified by readers with the appropriate knowledge and skill in questions of Internet research. The relevant confidentiality interest of both parties does not outweigh the public interest in the publication of the decision, which is legally required by Section 23 (2) DSG.]

NOTIFICATION
SPEECH
The data protection authority decides on Maga's data protection complaint. Ulrike A *** (complainant) of August 26, 2019 against the association N *** (respondent), seat: O *** straße ** 32, 1 *** Vienna, ZVR: 4 * 27 * 541 *, due to violation of the right to erasure as follows:
- The complaint is rejected.
Legal basis: Art. 85 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), ABl. No. L 119 of 4.5.2016 p. 1; § 9 Paragraph 1 of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999 as amended [Note by the editor: In the original due to an obvious editorial error: § 9 Paragraph 2 DSG]; Section 1, Paragraph 1, Item 1 and Item 6 of the Media Act (MedienG), Federal Law Gazette No. 314/1981 as amended.
REASON
A. Arguments of the parties and course of the procedure
1. In its submission of August 26, 2019, the complainant alleged a violation of the right to erasure. In summary, it was submitted that she was named in a contribution by the respondent at https: //verein-n***.at/presse/news/201*/berichteneu*3*1*8*.php. In addition to many misrepresentations, she is also referred to as a "spy". With a request dated June 28, 2019, she requested the deletion of her data, the respondent rejected the deletion with a letter of July 25, 2019.
2. In a statement dated October 10, 2019, the respondent summarized the fact that the relevant article realizes a journalistic purpose of a media company and therefore the media privilege according to Art. 85 GDPR in conjunction with Section 9 GDPR applies.
3. At the request of the data protection authority, the Respondent disclosed its structure and the internal procedure for the publication of new articles in the news area at https://verein-n***.at/presse/news/ with a further statement of March 18, 2020 .
4. The complainant replied - after hearing the parties to the results of the preliminary proceedings - with statements on November 6, 2019 and summarized on May 12, 2020 that the respondent's misrepresentations would clearly show that it was his intention to have her as a witness in a disparage ongoing proceedings. Furthermore, the statements on the editorial work of the respondent were inflated and she could not remember any editorial meeting.
B. Subject of the proceedings
Based on the submissions of the parties, it emerges that the subject of the complaint is the question of whether the complainant's right to cancellation was violated by the respondent.
It is necessary to check in advance whether the data protection authority is responsible for handling the complaint in question.
C. Factual Findings
1. The respondent is an association which, among other things, is committed to animal and environmental protection.
2. The respondent also operates a news area on his webpage at https: //verein-n***.at/presse/news/ (accessed on August 31, 2020). In this news area, articles on topics related to animal welfare are regularly published. This should raise awareness among the population for animal welfare and environmental protection
3. Two people share content management / publishing for the maintenance of the news area mentioned. In the news area, two people work in a managerial position as editor-in-chief, and there are five people who work as editors. An editorial meeting takes place once a week in which it is discussed which articles will be published in the next seven days and who is responsible for what. The creation of a content is requested by the chief editor. The content is then passed on to content management / publishing, who graphically design the content for the webpage and correct the text. All contributions must be approved by the chief editor. Around 68 hours per week are invested in the operation of the news area.
Assessment of evidence: The findings are based on the respondent's statement of March 18, 2020. The complainant submitted to this respondent's statement that the statements appeared to her to be "inflated", but this statement was not expressly disputed. From the point of view of the data protection authority, the aforementioned statement is conclusive and there is no reason to doubt the statement.
4. The publicly available article at https: //verein-n***.at/presse/news/201*/berichteneu*3*1*8*.php from May 11, 2017 reads as follows (formatting not 1: 1 reproduced, accessed on August 31, 2020):
[Editor's note: The article, reduced in size but completely and in the original web design, cannot be pseudonymized and has therefore been removed. It claims that the complainant, who is named by her name and her function as area spokeswoman for the D *** party, was also an "informant" for an opponent of the N * association during a political campaign against certain forms of hunting. ** (and the chairman of the association) were active from circles of the hunters.]
Evidence assessment: The findings are based on the respondent's statement of October 10, 2019 and on an official search of the webpage at https: //verein-n***.at/ (accessed on August 31, 2020) and are therefore undisputed.
5. In the past, the complainant was on the board of directors of the D *** party (D *** - P) and as a **** spokesperson for the D *** - P. In this role she also appeared in public. She ran for the National Council in 201 * on a list of D *** - P. In addition, she worked as an activist in the N *** association from March 2015 to the end of January 2016.
Assessment of evidence: The findings are based on the complainant's statement of November 6, 2019, which are therefore undisputed.
6. With a request dated June 28, 2019, the complainant requested the deletion of her data from the above-mentioned article of May 11, 2017. The Respondent informed her in a letter dated July 25, 2019 that it would not comply with the request. The complainant then lodged a complaint with the data protection authority. The above-mentioned article from May 11, 2017 is still available online at the time the complaint procedure in question is concluded.
Assessment of evidence: The findings are based on the complainant's submission of August 26, 2019 and on an official search of the link https: //verein-n***.at/presse/news/201*/berichteneu*3*1*8 * .php (accessed August 31, 2020).
D. In legal terms it follows:
1. General information on the "media privilege" and the competence of the data protection authority
a) On Art. 85 GDPR
According to Art. 85 Para. 1 GDPR, the member states introduce legal provisions - in compliance with the requirements of Paragraph 2 and Paragraph 3 leg. Cit. - the right to the protection of personal data under this Regulation in accordance with the right to freedom of expression and information, including processing for journalistic purposes and for scientific, artistic or literary purposes.
b) For the Austrian implementation of Art. 85 GDPR
In Section 9 (1) DSG, the previous data protection law "media privilege" according to Section 48 DSG 2000, Federal Law Gazette I No. 165/1999 as amended by Federal Law Gazette I No. 83/2013, is transposed into the GDPR system with an expanded scope. The national regulation in § 9 DSG is linked to Art. 85 DSGVO, a basic provision including an opening clause (see Suda / Veigl in Gantschacher / Jelinek / Schmidl / Spanberger, Data Protection Act1 § 9 Rz. 1, still with reference to § 9 DSG as amended by BGBl. I No. 165/1999 as amended by BGBl. I No. 120/2017 [Data Protection Amendment Act 2018]).
According to the express legal text of Section 9 (1) DSG, two requirements must be met in order to gain access to the privileged area of application:
Firstly, there must be processing of personal data by media owners, publishers, media employees and employees of a media company or media service within the meaning of the MedienG and, secondly, this processing must take place for journalistic purposes of the media company or media service.
It is noticeable that Section 9 (1) GDPR contains a restriction to a certain professional group (“classic media companies”), although Article 85 (2) GDPR does not include such a restriction and leg. Cit. is only linked to "processing for journalistic purposes".
According to the StRsp, the ECJ assumes that the exemptions and exceptions provided for in Article 9 of Directive 95/46 / EC are not applicable to the former Article 9 of Directive 95/46 / EC - the counterpart provision of now Article 85 GDPR only apply to media companies, but to anyone who works as a journalist (see the judgment of the ECJ of February 14, 2019, C ‑ 345/17 [Buivids] Rn 52 and the case cited there).
A direct application of Art. 85 (2) GDPR in the absence of § 9 (1) GDPR is ruled out, however, since the first provision is not a material provision, but merely contains the mandate addressed to the member states to issue corresponding legal provisions for certain processing situations ( see Schiedermair in Ehmann / Selmayr, General Data Protection Regulation Comment2 [2018] Art. 85 Rz 1 and 9).
However, an interpretation of Section 9 (1) DSG in the light of the aforementioned case law of the ECJ would - on the contrary - lead to any data processing for "journalistic purposes" being withdrawn from the review by the data protection authority. According to the CJEU's CSR, exceptions and restrictions with regard to data protection must be limited to what is absolutely necessary (cf. the ECJ's judgment of February 14, 2019, loc. Cit. No. 64 and the case cited there).
The analogous application of Section 9 (1) DSG to the present facts is also ruled out; the restriction to a specific professional group standardized in Section 9 (1) DSG was not provided for in the originally planned implementation of Art. 85 (2) GDPR (cf. RV 1664 dB XXV. GP, 14.), which is why it is a deliberately restrictive approach of the Austrian legislator (see VwGH 10.10.2018, Ra 2018/08/0189 Rs 4 mwN, according to which the analogy is generally permissible in public law, but the existence of a real legal loophole is assumed).
c) Intermediate result
It can therefore be assumed that legal protection is only possible through the ordinary courts under the Media Act and that the data protection authority does not have jurisdiction (see the decision of the DSB of August 13, 2018, only if the two requirements of Section 9 (1) DSG are met. GZ: DSB-D123.077 / 0003-DSB / 2018).
In all other cases, the data protection authority is responsible for handling the content, but has to take into account the right to freedom of expression according to Art. 11 EU-GRC and Art. 10 ECHR.
2. In the matter
a) The respondent as a "media company"
Pursuant to Section 1, Paragraph 1, Item 1, a “medium” is understood to mean any means of disseminating messages or performances with intellectual content in word, writing, sound or image to a larger group of people by way of mass production or mass distribution.
Pursuant to Section 1, Paragraph 1, Item 6 of the Media Act, a "media company" is a company in which the content of the medium is designed and its production and distribution (Item 1 leg. Cit.) Or its broadcasting or availability (Item 2 leg. Cit .) either concerned or arranged.
Pursuant to Section 1, Paragraph 1, Item 11 of the Media Act, a "media employee" is an employee who is involved in a media company or media service's journalistic content designing the content of a medium or the media service's communications, provided that he is an employee of the media company or media service or as a freelancer Constantly pursues journalistic activity and not just as an economically insignificant part-time job.
According to the StRsp of the Supreme Court, the concept of a media company is fulfilled if, in addition to the mere distribution of content, a company - with a minimum of entrepreneurial structures - is operated whose corporate purpose is the content design of the website, which is managed by an editorial team and a A large number of employed or freelance media workers is carried out (see RIS Justice RS0129847).
In the literature, it is stated that in the field of electronic media, the content provider (i.e. the operator of a platform on which information is posted on the Internet for use) is included in the term “media company”. Furthermore, it is based on the fact that "[...] the economic organizational unit whose company (main) purpose is the content design of the medium, namely (regularly) by an editorial team and a large number of employed or freelance media workers" is decisive (cf. . Koukaul in Berka / Höhne / Noll, media law: Praxiskommentar4 [2019] § 1 margin no. 25 with further references).
In a similar case, in which the respondent there - the respondent's chairman, Dr. Karl R *** - operated a private blog and published personal data of the complainant, denying the applicability of the media privilege. This is because, when operating the private blog, it could not be assumed that the standard required by the Supreme Court of a media company with regard to the structure would be met (cf. the decision of the DSB of March 4, 2020, GZ: DSB-D124.1340 / 0003 -DSB / 2019, not in RIS, but known to those involved).
As noted, there are five people regularly working as editors for the relevant news area at https: //verein-n***.at/presse/news/, there is a content / management / publishing team and two people as editor-in-chief, who approve each post. A total of 68 hours per week are invested in the news area by employees of the respondent.
In the sense of the cited stRsp of the Supreme Court, the respondent not only disseminates content in connection with animal and environmental protection, but has also established a minimum of structures in order to research and prepare this content in advance. The persons working for the Respondent are also regularly and not just occasionally entrusted with the dissemination of content in the news area.
It can remain irrelevant whether the respondent intends to make a profit by publishing content - including the complainant's personal data (cf. the judgment of the ECJ of December 16, 2008, C-73/07 [Satakunnan Markkinapörssi and Satamedia] Margin no. 59)
It can therefore be assumed that the respondent in the present case fulfills the concept of a “media company” in accordance with Section 1 (1) no. 6 MedienG.
b) Data processing for "journalistic purposes"
According to the understanding of the European Court of Justice, processing of personal data for journalistic purposes exists if the processing has the sole aim of disseminating information, opinions or ideas to the public (see the judgment of the European Court of Justice of December 16, 2008, C-73 / 07 [Satakunnan Markkinapörssi and Satamedia] margin no. 62).
For the applicability of the privilege according to § 9 Abs. 1 DSG, only the processing purpose is decisive.
Applied to the present case, these statements mean the following:
The relevant article is a report in connection with a court case between a hunter - who was also the subject of the respondent's report - and the respondent's chairman, Dr. Karl R ***.
Mentioning the complainant by name as a witness in this process is relevant to the public interest, as this is a (former) politician who (at least in the past) was on the board of the D *** - P and as * *** spokeswoman for this party and also worked for the respondent for a certain period of time (cf. on the public interest in private individuals entering the “political stage”, RIS Justice RS0115541).
It can therefore be assumed that the publication of the complainant's personal data in the relevant article pursued a journalistic purpose.
3. Result
As a result, it should be noted that it is the respondent
i) at least in the context of the operation of the news area at https: //verein-n***.at/presse/news/ it is a media company according to § 1 para. 1 no. 6 MedienG and that
ii) the relevant publication of the complainant's personal data in the news section at https: //verein-n***.at/presse/news/201*/berichteneu*3*1*8*.php for journalistic purposes.
The requirements of Section 9 (1) DSG are therefore met.
As stated above, the data protection authority is not responsible for handling complaints within the scope of Section 9 (1) DSG.
The complaint was therefore to be rejected according to the ruling.


European Case Law Identifier
ECLI: AT: DSB: 2020: 2020.0.303.727