DSB (Austria) - D123.768/0004-DSB/2019

DSB - DSB-D123.768/0004-DSB/201
Authority:	DSB (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 4(4) GDPR Article 4(7) GDPR Article 85(1) GDPR Article 85(2) GDPR Art. 10 (XI) European Convention of Human Rights - ECHR Article 8 (XI), 11 (I) Charta of Fundamental Rights - CFR §§ 1 (I), (II), 9 (I) Data Protection Law (DSG - Datenschutzgesetz) § 1 no. 6, 7, 8, lit. c Mediengesetz (MedienG) - Media Law
Type:	Complaint
Outcome:	Rejected
Started:
Decided:	18.12.2019
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	DSB-D123.768/0004-DSB/201
European Case Law Identifier:	ECLI:AT:DSB:2019:DSB.D123.768.0004.DSB.2019
Appeal:	Unknown
Original Language(s):	German
Original Source:	Rechtsinformationssystem (in DE)
Initial Contributor:	ML

The data protection authority had to weigh up the right to secrecy against the right to freedom of expression.

English Summary

Facts

The complainant belongs to a political party and is a member of the city council of an Austrian municipality. In November, the municipality held a meeting on the "parking space concept", to which a certain group of addressees, including the complainant, was invited. The complainant did not take part in this discussion because of an incorrect delivery of the invitation. The respondent, another political party, then posted an entry on her public Facebook page in which, to put it bluntly, criticism was made of the complainant's failure to appear.

Dispute

Is this Facebook post processed for journalistic purposes or a contribution to a debate of public interest, namel whether the complainant, as a polititcian and a person in the public interest, would be entitled to his or her tasks or requirements as a city councilor.

Holding

The limits of permissible criticism in relation to a politician acting in his public function must be interpreted more broadly than in relation to a private individual. Moreover, the use of the complainant's data in the proceedings was not unlawful because this form of political work is covered by § 1.2 of the PartG, and thus has a legal basis in the meaning of § 1.2 of the DSG.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Deciding authority
Data Protection Authority
Document type
Decision text
Decision type
Notice of appeal
Business figures
DSB-D123.768/0004-DSB/2019
Decision date
18.12.2019
Contestation with the BVwG/VwGH/VfGH
This decision is final.
Standard
Data Protection Law §1 para 1
Data Protection Law §1 para 2
Data Protection Law §9 para 1
Media Law §1 no 6
Media Law §1 no 7
Media Law §1 Z8 lit c
Law of Parties §1 para 2
Municipal Code of Styria §59 para1
CFR Art8 para 11
CFR Art11 para 1
ECHR Art10 para 1
GDPR  Art4 no 2
GDPR Art4 no 7
GDPR Art85 para 1
GDPR Art85 para 2
Text

GZ: DSB-D123.768/0004-DSB/2019 of 18.12.2019

Note Processor: Names and companies, legal forms and product names, addresses (including URLs, IP and e-mail addresses), file numbers (and similar), etc., as well as their initials and abbreviations may be abbreviated and/or changed for reasons of pseudonymisation. Obvious spelling, grammar and punctuation errors have been corrected].

DECISION

RULING

The data protection authority decides on the data protection complaint of Bruno A*** (complainant) of 9 November 2018, improved by submission of 19 November 2018, against the N*** party E***stadt (respondent), represented by Erich R***, for violation of the right to secrecy as follows

- The complaint is dismissed as unfounded.

Legal basis: Sections 1(1) and (2), 24(1) and (5) of the Data Protection Act (Datenschutzgesetz - DSG), Federal Law Gazette I No 165/1999 as amended, Articles 8 and 11 of the Charter of Fundamental Rights of the European Union (EU-CFR), OJ No C 326 of 26 October 2012, p. 39, Article 12 of the Convention for the Protection of Human Rights and Fundamental Freedoms, Federal Law Gazette No 210/1958, Section 1(2) of the Political Parties Act 2012 (PartG), Federal Law Gazette I No 56/2012 as amended.

EXPLANATIONS

A.    Arguments of the parties and procedure

1 By letter of 9 November 2018, as improved by submission of 19 November 2018, the complainant submitted that on 7 November 2018, the defendant had published on Facebook the list of participants in a non-public meeting, which included his name. The defendant had intended to publicly pillory him for not attending the meeting on the parking concept. It subsequently emerged that the municipality had forgotten to send an invitation to the meeting to the correct e-mail address or to the address known to the municipality. Nevertheless, the respondent had published the list of participants in the meeting, which was not open to the public, together with his data.

2 In its observations of 3 December 2018, the respondent submitted that a public meeting of the municipality of E***stadt on the E***stadt parking concept had taken place on 7 November 2018. In addition to municipal representatives, other representatives of the target group had also been invited to this meeting. The complainant had also been invited, but had not participated. A copy of the list of participants had been posted on the complainant's Facebook page. After the complaint had become known, the posting had been removed, although this was not considered necessary.

The respondent submitted that, according to § 59 (1) of the Styrian Municipal Code (Steirische Gemeindeordnung - GemO), meetings of the municipal council were public. Pursuant to § 60.1 GemO, a record of proceedings was to be made of every meeting of the municipal council (public or non-public). According to no. 3 leg. cit. it must contain the name of the chairman and the members of the municipal council who are present and absent. The controller processing the data contained therein is the municipality of E***stadt.

The attendance lists of municipal council meetings are in any case public, since even at non-public meetings only the deliberations are to be treated confidentially. This data was generally available, which meant that an interest worthy of protection could be excluded.

Neither name, function nor absence from the meeting were data worthy of protection. On the one hand, there was an overriding public interest in knowing these data of the complainant as a politician and as a person of public interest and, on the other hand, there was also an overriding public interest in knowing whether he fulfilled the requirements of this position in his public role as a city councillor.

The Facebook page of the N*** party E***stadt constituted, in the same way as the homepage of the City Party, a periodic electronic medium within the meaning of the Media Act (§ 1.1 no. 5a of the Media Act) and was maintained by the media employees of the N*** party. § 9 DSG is applicable.

Both the DSG and the GDPR restrict their scope of application to the wholly or partially automated processing of personal data of natural persons and to the non-automated processing of personal data of natural persons which are or are to be stored in a file system. Processing of personal data which is or is to be stored in a file system is not apparent.

(3) In his letter of 28 March 2019, the complainant submitted, in summary, that this was not a public meeting in accordance with the GemO, given that only a certain group of addressees had been informally invited by e-mail and that the fact that this meeting had not been properly publicised was sufficient to prevent it from becoming public. The GemO provides for three committees for a local politician. This meeting would not fall into any of these bodies.

It was subsequently confirmed by the municipality by e-mail that the invitation had "unfortunately" been sent to the old e-mail address. The posting had deliberately been online for a few days after it had become known. The Facebook page of the N*** party E***stadt is not a media company or a media service.

4 The respondent was asked by letter of 21 May 2019 to submit a supplementary statement and to send the invitation to the meeting at that time. By letter of 3 June 2019, this letter was sent to the data protection authority.

5 In his letter of 1 July 2019, the complainant submitted, in the context of his hearing, that the annex clearly indicated that the meeting had been a non-public meeting without binding character. None of the three bodies of the GemO had been submitted that it had been an "interim presentation of a report" on the new "parking space concept" to which a specific group of addressees had been informally invited by e-mail. Furthermore, it was clearly recognizable that the invitation had been sent to the wrong e-mail address.

B. Reasoning

The question arises as to whether the respondent infringed the complainant's right to confidentiality by posting the list of participants of the "Zwischenpräsentation Parkraumkonzept E***stadt" ("Interim Presentation Parking Concept E*** City") on its Facebook page on 7 November 2018, on which the name of the complainant also appears, together with comments that the complainant did not attend this meeting.

C.    Findings of the facts

The complainant is a councillor in the municipality of E***stadt and belongs to the W*** party. On 7 November 2018, the municipality of E***stadt held a meeting on the "Parking Concept E***stadt". The invitation to this meeting was sent out on 23 October 2018 and a specific group of addressees was invited. The e-mail was sent to the wrong (old) e-mail address of the complainant.

Editor's note: The original invitation letter and distribution list (with the complainant's old e-mail address) reproduced here as a graphic file cannot be pseudonymised with reasonable effort].

The complainant did not take part in this meeting.

The respondent posted the following entry on her public Facebook page on 7 November 2018:

Editor's note: The respondent's Facebook posting, which is reproduced here in its original form as a graphic file, cannot be pseudonymised with reasonable effort. In addition to a picture of the list of participants with missing signature of the complainant, it consisted of the following text (spelling mistake in the original):

"Once again, cooperation Not enough for W*** party city council A***. Or is a parking concept for the city E***stadt not an issue for the traffic representative? Or is the well paid city city council just working on the next leaflet?"]

Evaluation of evidence: The findings result from the undisputed submissions of the parties as well as from the submitted enclosures.

D.    From a legal point of view, it follows that

I.           Jurisdiction of the data protection authority

First of all, it must be examined whether the media privilege in the sense of § 9 para. 1 DSG is relevant and whether subsequently the competence of the data protection authority is to be negated.

The data protection authority dealt with Section 9 para. 1 FADP in the notice of 2 December 2019, GZ DSB-D124.352/0003-DSB/2019, among others, and explained the following:

1 In Article 9 (1) DSG, the previous "media privilege" under data protection law under Article 48 DSG 2000, Federal Law Gazette I No. 165/1999 as amended by Federal Law Gazette I No. 83/2013, is transposed into the system of the DSGVO with an extended scope of application. The national provision in § 9 DSG ties in with Art. 85 DSGVO, a provision of principle including an opening clause (see Suda/Veigl in Gantschacher/Jelinek/Schmidl/Spanberger, Datenschutzgesetz1 § 9 Rz. 1, still with reference to § 9 DSG as amended by Federal Law Gazette I no. 165/1999 as amended by Federal Law Gazette I no. 120/2017 [Datenschutz-Anpassungsgesetz 2018]).

According to the express legal text of Article 9.1 of the DSG, two conditions must be cumulatively fulfilled in order to qualify for the privileged scope of application:

Firstly, there must be processing of personal data by media owners, publishers, media employees and employees of a media company or media service within the meaning of the Media Act and, secondly, this processing must be for journalistic purposes of the media company or media service.

It is noticeable that Section 9 (1) DSG contains a restriction to a specific professional group ("classical media companies"), although Art. 85 (2) GDPR does not contain such a restriction and is legally binding. (Kunnert in Bresich/Dopplinger/Dörnhofer/Kunnert/Riedl, Datenschutzgesetz Kommentar, margin no. 9 to § 9, also critical of Blocher/Wieser in Jahnel (ed.), Datenschutzrecht. Jahrbuch 19, p. 303 ff, who consider the restriction to be contrary to equality or the principle of legality).

2 It should be noted that - despite the concerns about the restriction of the media privilege under § 9.1 of the DSG - a direct application of Art. 85.2 GDPR does not appear to be expedient because of the primacy of Union law regulations, since Art. 85.2 GDPR does not provide for a direct application of Art. 2 GDPR is not a substantive provision, but - as mentioned above - contains the mandate addressed to the Member States to enact corresponding legal provisions for certain processing situations (see Schiedermair in Ehmann/Selmayr, Datenschutz-Grundverordnung Kommentar2 [2018] Art. 85 marginals 1 and 9).

3 The analogous application of § 9.1 of the DPA to the present case is also ruled out, because the restriction laid down in § 9.1 of the DPA was not included in the originally planned implementation of Article 85.1 of the DPA. 2 GDPR in the version of the Data Protection Adaptation Act 2018, which is why this is a deliberately restrictive approach by the Austrian legislature (see VwGH 10.10.2018, Ra 2018/08/0189 Rs 4 mwN, according to which the analogy is in principle permissible in public law, but the existence of a genuine legal loophole is presupposed).

4 In addition, the complainant objectively claims a violation of the fundamental right to data protection under § 1 of the German Data Protection Act, i.e. a constitutional provision. The wording of the simple-law provision of § 9.1 of the DSG, according to which "the provisions of this Federal Act and of the GDPR shall be interpreted in accordance with Chapters II (Principles), III (Rights of the Data Subject), etc. of the GDPR" is not applicable. (...) do not apply", can probably not refer to § 1 of the DSG if interpreted in conformity with the constitution, since a provision of simple law cannot derogate from any constitutional provision (similar to Kunnert in Bresich/Dopplinger/Dörnhofer/Kunnert/Riedl, Datenschutzgesetz Kommentar, margin no. 9 to § 9).

5 It must therefore be assumed that only if the (narrow) requirements of § 9.1 of the Data Protection Act are met, legal protection can be obtained exclusively by way of the ordinary courts under the Media Act and that the data protection authority has no jurisdiction.

6) In all other cases, the data protection authority is responsible for dealing with the content, but must take into account the right to freedom of expression under Article 11 EU FRC and Article 10 ECHR when weighing the merits of the case (cf. the ruling of 9 September 2019, GZ DSB-D124.274/0007-DSB/2019).

The same must apply to the present case.

Admittedly, the respondent can by definition be regarded as a media owner within the meaning of § 1 item 8 letter c of the Media Act. However, § 9.1 DSG requires that the processing of data must be carried out "for journalistic purposes of the media company or media service".

By definition, however, the respondent is not a media company (§ 1 item 6 MedienG) or a media service (§ 1 item 7 MedienG).

Furthermore, in the present case, "journalistic purposes" cannot be assumed in the following reasons:

It cannot be assumed that any information published on the Internet which refers to personal data would fall under the concept of "journalistic activities" and would therefore be subject to the derogations and exceptions provided for in Art. 9 of Directive 95/46 (see ECJ 01.06.2017, C-345/17, Rz 58 [Sergejs Buivids and Datu valsts inspekcija]). Although the present case refers to the old legal situation, Art. 9 of Directive 95/46 is to be understood as a counterpart provision to Art. 85 GDPR.

Even with a broad interpretation of the term "journalism", no processing for journalistic purposes can be recognized in the present proceedings. Even the fact that the Facebook page is maintained by media employees of the N*** party cannot change this. Political parties are often active in the field of journalism and have editorial staff and employees who often work exclusively in public relations. However, the aim of political parties is not to shape the content of the medium, but rather to influence state decision-making comprehensively - especially through public relations work - through political activity. Media activity can only be understood as a "side effect" in the course of the intended achievement of these goals.

Since Section 9 (1)  Data Protection Act does not apply, the data protection authority is therefore competent to deal with the complaint.

According to Art. 4 No. 7 GDPR, "controller" is the natural or legal person, authority, institution or other body which alone or jointly with others decides on the purposes and means of processing personal data.

In the present case, as the operator of a publicly accessible Facebook profile, the respondent to the complaint is to be qualified as the data protection officer in accordance with Art. 4 Z 7 GDPR, as it decides on purposes (sharing of content) and means (use of a publicly accessible Facebook profile).

II. on the alleged violation of the right to secrecy in the sense of § 1 paragraph 1 DSG:

1. general

§ Section 1 (1) of the DSG stipulates that everyone has the right to the confidentiality of personal data concerning him or her, in particular with regard to respect for his or her private and family life, insofar as there is an interest worthy of protection. A limitation of this right is basically derived from paragraph 2 of the Data Protection Act. However, the GDPR and in particular the principles enshrined therein must be taken into account in any event when interpreting the right to secrecy (see the DSB's decision of 31 October 2018, GZ DSB-D123.076/0003-DSB/2018).

The data contained therein are undoubtedly personal data of the complainant and there is in principle also a legitimate interest in the confidentiality of these personal data.

In any event, the commented publication of the list of participants on the respondent's Facebook profile constitutes processing within the meaning of Article 4 no. 2 of the GDPR.

Pursuant to Art. 1 para. 2 GDPR, restrictions of the right to confidentiality are only permissible if the use of personal data is in the vital interest of the person concerned or with his or her consent, or in the case of overriding legitimate interests of another person or if there is a qualified legal basis.

It is undisputed that there is no vital interest of the complainant or his or her consent, and nothing has been brought forward in this respect.

It must therefore be examined whether a qualified legal basis or predominant legitimate interests of another would justify the restrictions of the claim to secrecy in the case at hand.

2. the right to freedom of expression

In the present case, the respondent refers to the fact that municipal council meetings are public under Section 59(1) of the GemO. The lists of attendance at municipal council meetings are also public in any event, since even at meetings that are not public only consultations are to be treated confidentially. However, it is already clear from the letter dated 17 October 2018 that this is neither a local council meeting nor any other body (town council/committee board or committees) covered by the GemO. Rather, it is a non-public, extra-natural meeting (invitation to an interim presentation of the parking concept) to which municipal mandataries, business people and other representatives were invited. An appeal to the GemO and a justified publication based on it is therefore in vain.

For the sake of completeness, it is also pointed out that the very general assumption of the non-existence of a violation of confidentiality interests worthy of protection for permissibly published data is not compatible with the provisions of the DSGVO (cf. DSB 31.10.2018, GZ DSB-D123.076/0003-DSB/2018 mwN).

However, the respondent's overriding legitimate interests in the use of the complainant's data which are the subject of the proceedings are in question.

The respondent's legitimate interests lie in the freedom of expression in accordance with Article 10 ECHR and Article 11 EU CFR, whereas the complainant's legitimate interests lie in the protection of his or her personal data in general and also in protection against discrediting by the respondent.

Article 11 EU-CFR reads as follows:

Article 11 of the EU CFR reads as follows

Freedom of expression and information

1. Everyone has the right to freedom of expression. This right includes freedom of expression and freedom to receive and impart information and ideas without interference by public authority and regardless of frontiers.

(2) Freedom of the media and their plurality shall be respected.

Art. 10 ECHR reads as follows [Editor's note: due to an editorial mistake, the text of Art. 11 ECHR is reproduced here in the original under the heading]:

Article 10

freedom of expression

(1) Everyone has the right to freedom of expression. This right includes freedom of opinion and expression and freedom to receive and impart information and ideas without interference by public authority and regardless of frontiers. Nothing in this Article shall prevent States from subjecting radio, cinema or television broadcasting organisations to an authorisation procedure.

Since the exercise of these freedoms carries with it duties and responsibilities, it may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are in keeping with the requirements of a democratic society in the interests of national security, territorial integrity or public safety, are indispensable to the maintenance of law and order and the prevention of crime, the protection of health and morals, the protection of the reputation or rights of others, to prevent the dissemination of confidential information or to ensure the prestige and impartiality of justice.

Art. 11 EU CFR defines two interrelated areas of protection: on the one hand, the (active) freedom of expression of the spokesperson and, on the other hand, the (passive) freedom of information of the recipient. The interaction of these two elements guarantees an exchange of information and opinions in the sense of a comprehensive freedom of communication. Although the applicability to legal persons is not explicitly ordered, this provision is open to both natural and legal persons (see Stangl in Kahl/Raschauer/Storr (Ed.), Grundsatzfragen der Grundrechtecharta as well as Bezemek in Holoubek/Lienbacher (Ed.), CFR Commentary Art. 11).

Likewise, Art. 10 ECHR applies equally to natural and legal persons (see Öhlinger/Eberhard, Verfassungsrecht Rz 914).

The complainant is a councillor of the municipality of E***stadt and thus a politician. In this role as a city councillor, he was invited, albeit wrongly to the wrong e-mail address, to give an interim presentation of the parking space concept. In this respect, it can be disregarded whether this meeting is a committee of the GemO. The complainant plays a role as a city councillor (of the W*** party) in the public life of the municipality, and there is also an interest, albeit only regional, in his work in the municipality.

It is evident that the respondent's aim was to disseminate information to the public or, by publishing the list of participants, to initiate a contribution to a debate of general interest, namely whether the complainant, as a politician and a person of the public interest, is fulfilling his or her tasks or requirements as a city councillor.

According to the decision of the Supreme Court, the limits of admissible criticism are wider in relation to a politician acting in his or her public function than in relation to a private individual. Every politician inevitably and willingly exposes himself or herself to a precise assessment of each of his or her words and actions, not only by journalists and the wider public, but especially by the political opponent (cf. OGH 28.01.1997, 4 Ob 2382/96i).

With regard to the manner of publication (once again, cooperation Not enough for W*** Party City Council A***. Or is a parking space concept for the city E***stadt not an issue for the traffic officer? Or is the well paid city councilman working on the next leaflet right now? [sic]) it should be noted that the data protection authority cannot deny itself the impression that the present Facebook posting is not exclusively intended to trigger a contribution to a debate of general interest, but that the posting in question was formulated in a rather exaggerated manner.

According to the Supreme Court, an insulting statement towards a politician can still be covered by the right to freedom of expression, provided that there is a connection to a political debate or a debate of general interest. A deliberately defamatory statement, which does not focus on the discussion of the matter but on defaming the person, is not protected (see OGH 29.06.2011, 15 Os 81/11t). Art. 10 ECHR protects not only stylistically high-quality, factually presented and sophisticatedly executed evaluations, but also any unvalidated judgment that does not culminate in an excess of evaluation (cf. OGH 15.10.2012, 6 Ob 162/12k). Occasionally, Art. 10 ECHR also protects insulting language if this serves merely stylistic purposes (cf. ECtHR 17.04.2014, 20981/10).

With regard to the effects, it should be noted that these are not to be classified as material. Furthermore, the posting has already been deleted from the Facebook page. With regard to the manner and circumstances under which the information was obtained, it should be noted that the respondent did not unlawfully gain knowledge of the list of participants, and the data in the list are undoubtedly correct.

3. the existence of a legal basis

Furthermore, it should be noted that in view of the definition of a political party in (the constitutional provision of) § 1, Subsection 2, PartG, it is clear that the legislator sees the purpose of political parties primarily in the continuous "comprehensive influence on the state's decision-making process".

According to the case-law of the Constitutional Court, the existence of political parties and the possibility of changing the majority relationships are effects of the democratic principle underlying the B-VG. One of the essential aims of political parties is the realisation of their political ideas by means of the exercise of state functions by their representatives and trusted representatives in the various bodies of legislation and state administration, especially in the general representative bodies (see VfSlg. 14.803/1997 and VfSlg. 20.128/2016 mwN).

This also includes influencing the shaping of public opinion on political competitors. The use of the complainant's data by the respondent in the proceedings is thus also covered by the PartG.

III Result

The data protection authority therefore comes to the conclusion that, on the basis of the weighing of interests carried out, there is no violation of the right to secrecy, since the legitimate interests of the respondent (freedom of expression) outweigh the stated impairments of the complainant's legitimate interests (secrecy of the data subject of the proceedings) in accordance with Section 1 (2) of the Data Protection Act.

Even if this were to be denied, the publication together with the commentary would not be unlawful because this form of political work is covered by § 1.2 PartG, and thus has a legal basis in the meaning of § 1.2 DSG.

It was therefore to be decided in accordance with the Rules of Procedure.
Keywords
Confidentiality, posting, Facebook, social media, city council, political party, media, media companies, media privilege, freedom of expression, freedom of information, limits to permissible criticism
European Case Law Identifier (ECLI)
ECLI:AT:DSB:2019:DSB.D123.768.0004.DSB.2019
Last updated on
17.03.2020
Document number
DSBT_20191218_DSB_D123_768_0004_DSB_2019_00