BVwG - W214 2233132-1/13E

BVwG - W214 2233132-1/13E and W214 2233132-1/27E
Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 15(1)(c) GDPR § 38 AVG Article 133(4)
Decided:	29.11.2023
Published:	09.01.2024
Parties:
National Case Number/Name:	W214 2233132-1/13E and W214 2233132-1/27E
European Case Law Identifier:
Appeal from:	DSB (Austria) DSB-D205.157/0005-DSB/2019
Appeal to:	Unknown
Original Language(s):	German
Original Source:	RIS (in German)
Initial Contributor:	MW

The Austrian Federal Adminstrative Court partially reversed a decision by the Austrian DPA because it ordered a controller to provide more information than the data subject had requested.

English Summary

Facts

A data subjectmade an access request with an address publisher and direct marketing company, as a controller, asking it specifically to provide him with information about his data stored in relation to "political preference" and about the recipients his "target group" data.

As the controller only partially complied with the access request, the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde, DSB) claiming a violation of his right to access under Article 15 GDPR. The DSB partially upheld the complaint of the data subject, ordering the controller to disclose to the data subject information about the target groups of personal data about him and the names of the recipients of such data as it failed to fully comply with the access request.

In the contested decision, the data subject's complaint was partially upheld, and the controller was found to have violated the data subject's right of access by providing incomplete information. The controller was ordered to (a) inform the data subject of the specific recipients of his personal data, (b) provide generally comprehensible information on the terms of the possible advertising groups, in particular about the key terms used, relevant parameters, and their allocation to the data subject, and (c) to provide generally understandable information about the term "possible target group - academics."

The controller then appealed the decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht, BVwG), claiming that it is not obliged to disclose the names of the recipients of the data subject's personal data, as that would mean disclosing the controller's distribution channels and its individual customer relationships. Further the controller claimed that it tried to retreive data about the recipients but was unable to.

The BVwG started evaluating the case but then suspended the proceedings, pending the decision of the CJEU in case C-154/21 and issued only a partial decision on 17 May 2022.

Holding

In the first partial decision n. W214 2233132-1/13E, the BVwG agreed with the arguments presented by the controller regarding the scope of the complaint; the DSB had gone beyond the subject matter of the complaint before it, and so points (b) and (c) of its decision were reversed without replacement.

The data subject, the BVwG observed, had outlined specific deficiencies in the controller's response to his access request: On the one hand, no information had been provided about the stored data concerning "political preference," and on the other hand, no information had been provided about the recipients of "target group" data. These deficiencies clearly delimited the subject of the complaint.

In contrast, the data subject had not complained that his right under Article 12 GDPR and Article 15 GDPR had been violated generally. The data subject did not make any submissions regarding a lack of information within the meaning of Article15(1)(h) GDPR or regarding the comprehensibility (Article 12(1) GDPR) of the information provided. He did not make any further requests in this regard, nor could such requests be derived from his complaint to the data protection authority.

Further proceedings were stayed pending the resolution of the question posed in CJEU - C-154/21 - Österreichische Post AG. In January 2023, the CJEU delivered its judgment and the BVwG reopened the case in May 2023 and, upon hearing further submissions by the parties, the BVwG issued its second partial decision n. W214 2233132-1/27E on 29 November 2023.

In the second partial judgment the court considered the two parts of the DSB’s decision that had not already been decided, namely: the order to the controller to disclose the names of all recipients of the data subject’s personal data and the declaration that the controller violated the data subject’s right to access as it failed to fully comply with his request under Article 15 GDPR.

The Court first of all held that, the first part of the DSB’s decision should be dismissed, as the controller sufficiently proved that it was impossible for it to identify all recipients of the data subject’s personal data and thus it could and can not comply with the order to disclose their names.

As regards the second part of the DSB’s decision, the BVwG held that, in light of the CJEU judgment, it is clear that controllers are obliged to disclose the names of recipients of personal data to the data subject under Article 15(1)(c) GDPR, unless it is impossible to identify them. In this case, the court underlined the fact that it was indeed impossible for the controller to identify the recipients but that was due to the fact that it did not save such data and it could also not retrieve them, even though controllers are generally obliged to save information about the transmission of personal data to recipients. This, resulted in the data subject not being able to exercise its other rights under the GDPR and the controller could not comply with its obligation under Article 19 GDPR. For this reason, the court held that the GDPR violation did not just take place in the past but was still ongoing and the data subejct's request was still not complied with.

Further, the court rejected the argument that the list of recipients of the controller is covered by trade secret protection. As a matter of fact, the court considered that this would lead to the impossibility to ever apply Article 15(1)(c) GDPR, and the interpretation of a law leading to its disapplication is unlawful according to higher Austrian case-law. Also, in this specific case, the existence of trade secret protection was ruled out at the oral hearing.

In light of the above, the BVwG concluded that the controller violated the data subject’s right to access under Article 15(1)(c) GDPR as it failed to store or retrieve information about the recipients of his personal data.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

decision date

05/17/2022

standard

AVG §38
B-VG Art133 Para.4
DSG §24
GDPR Art12
GDPR Art15
DSGVO Art15 Abs1 litc
GDPR Art77
VwGVG §17

saying

W214 2233132-1/13E

I. ON BEHALF OF THE REPUBLIC!

PARTIAL KNOWLEDGE

The Federal Administrative Court, through the judge Dr. Eva SOUHRADA-KIRCHMAYER as chairwoman and the expert lay judges Mag. Huberta MAITZ-STRASSNIG and Mag. Claudia KRAL-BAST as assessors on the complaint of XXXX, represented by Schönherr Rechtsanwälte GmbH, against points 2. b and c of the decision of the data protection authority of February 13, 2020, Zl. DSB-D205.157/0005-DSB/2019, rightly recognised:

a)

Points 2. b and c of the contested decision are resolved without replacement.

b)

The revision is not permitted according to Art. 133 Para. 4 B-VG.

II. RESOLUTION

The Federal Administrative Court, through the judge Dr. Eva SOUHRADA-KIRCHMAYER as chairwoman and the expert lay judges Mag. Huberta MAITZ-STRASSNIG and Mag. Claudia KRAL-BAST as assessors on the complaint by XXXX, represented by Schönherr Rechtsanwälte GmbH, against points 1 and 2 a of the decision of the data protection authority dated February 13, 2020, Zl. DSB-D205.157/0005-DSB/2019, decided:

a)

According to § 17 Administrative Court Procedure Act, Federal Law Gazette I No. 33/2013 as amended (VwGVG) in conjunction with § 38 General Administrative Procedure Act 1991 (AVG) with regard to points 1 and 2 a of the contested decision until the preliminary ruling by the Court of Justice of the European Union (ECJ) on the question submitted by the decision of the Supreme Court (OGH) of February 18, 2021, Zl. 6 Ob 159/20f (pending at the ECJ under C-154/21).

b)

The revision is not permitted according to Art. 133 Para. 4 B-VG.

text

Reasons for the decision/justification:

I. Procedure:

1. In his complaint to the data protection authority (DSB, competent authority before the Federal Administrative Court) of May 30, 2019, XXXX (participant in the proceedings before the Federal Administrative Court, former complainant before the competent authority) alleged a violation of the right to information pursuant to Art. 15 GDPR by the complainant (respondent in the proceedings before the relevant authority). In summary, he submitted that the complainant had not given him any information about the stored data relating to "political preferences" or any information about the recipients of target group data.

2. At the request of the authority concerned, the complainant submitted a statement on August 27, 2019 and October 14, 2019 and summarized that "affinities to parties" of the co-participant had not been extrapolated, which is why information about these marketing classifications could not be given. It was informed that data had been passed on to business customers for marketing purposes. There is no obligation to provide information about specific recipients, as this would mean disclosing the complainant's distribution channels and their individual customer relationships.

3. The complainant was informed of the complainant's comments by the relevant authority in a letter dated October 18, 2019. The co-participant replied to this with a statement dated November 5th, 2019 and summarized (insofar as relevant to the proceedings) that the pretended need to protect business secrets was no reason not to pass on the information about individual recipients of data, since otherwise no company would be obliged to to provide such information and such a view would largely eliminate the obligation under Article 15(1)(c). In addition, the complainant did indeed name the individual recipients of marketable data in response to earlier inquiries.

4. With the contested decision, the complaint of the co-participant was partially upheld and it was found that the complainant had violated the co-participant's right to information by providing incomplete information on April 3, 2019 (point 1). The complainant was instructed to inform the co-participant within a period of four weeks, otherwise execution, a) to designate the specific recipients of the personal data of the co-participant, b) generally understandable information about the terms of the possible advertising target groups "organic advertising", "self-employment" , "Advertising Investment", "Target Group Characteristics", "Phase of Life", "Advertising Donations" and "Advertising Relocation", in particular about the meaning of the key terms used, as well as information about the relevant parameters for the evaluation and the assignment to the participants and c) to provide generally understandable information about the term "possible target group of academics" (point 2). Otherwise, the complaint was dismissed (point 3).

With regard to points 2. b and c, the authority concerned explained that the person involved had generally referred to a violation of the right to information in accordance with Article 15 GDPR, which is why the present complaint by the data protection authority comprehensively referred to possible violations of the law check had been. With regard to the information provided, it should be noted that the complainant, as the person responsible for the profiling, neither explained a complete list of the other advertising target groups under which the participant was classified, nor disclosed the underlying input values or provided meaningful information about the logic involved, although there is a clear legal obligation to do so. As part of the duty to provide information, the complainant had to provide information in a comprehensible manner and in precise, transparent and understandable language. The information regarding the "possible target group academics" does not correspond to the principles inherent in the GDPR.

5. The complainant filed a timely complaint with the Federal Administrative Court against points 1 and 2 of this decision.

Among other things, the complainant summarized that the legal opinion of the authority concerned, that it should have comprehensively checked the information provided, was misguided. The co-participant had expressly stated the reasons for which he considered his right to information to be violated. Any deviation from this complaint by the authority concerned is opposed to Section 24 (2) DSG. The case law of the Constitutional Court also shows that the data protection authority's complaints procedure is limited by the complaints submitted. If the right to information is interpreted in accordance with Article 15 GDPR in accordance with the Union and the Constitution, it must first be permissible to provide information about the personal data about which the person responsible believes the person concerned wants to be informed, otherwise the person responsible would be burdened with a disproportionate and unjustified effort . The authority concerned had supplemented the complaint of the other party in an inadmissible manner, the other party had never stated that the information provided was not formulated in a sufficiently understandable way. The service mandate to provide generally understandable information about marketing classifications is not based on an application by the party involved, which is why the decision is unlawful for this reason alone.

6. The authority concerned did not make use of the possibility of a preliminary decision on the complaint and submitted the complaint together with the relevant administrative act to the Federal Administrative Court for a decision by letter dated July 16, 2020.

7. With its decision of February 18, 2021, line 6 Ob 159/20f, the Supreme Court submitted the following question to the ECJ, which is pending line C-154/21, for a preliminary decision:

"Is Art 15 Para 1 lit c of the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data, on the free movement of data and on the repeal of Directive 95/46/EC (General Data Protection Regulation, OJ L 119/1 of May 4, 2016, p. 1; hereinafter "GDPR") to be interpreted in such a way that the right to information on recipient categories is limited if specific recipients have not yet been determined for planned disclosures, the However, the right to information must also extend to recipients of these disclosures if data have already been disclosed?"

8. In a letter dated March 22, 2021 (received at the Federal Administrative Court on March 23, 2021), the complainant applied for the suspension of the complaint proceedings in question pursuant to Section 17 VwGVG in conjunction with Section 38 AVG until the ECJ made its decision on the Supreme Court’s order for reference of February 18, 2021, 6 ob 159/20f.

The reason given was that according to the established case law of the Administrative Court, the question of how Union law is to be interpreted is a preliminary question within the meaning of Section 38 AVG. According to the equally consistent case law of the Supreme Court, it is expedient and necessary in terms of procedural economy to interrupt proceedings until the decision of the ECJ, for the settlement of which the same legal question has to be clarified that the ECJ was asked to answer. Since the legal question to be resolved in the preliminary ruling procedure is also relevant to the decision in the present procedure, the suspension of the procedure is requested.

9. With ed. In a letter dated June 17, 2021, the complainant was asked to announce whether the claims in points 2.b and c. mentioned marketing classifications or (key) terms that are or were ascribed to the data record of the co-participant are still available or whether they have already been deleted.

10. The complainant then submitted a statement on July 5, 2021 and stated that all marketing classifications in 2019 had been gradually (= physically) deleted from the marketing database, at least up to and including November 13, 2019 and could not be restored. The complainant is currently not processing any marketing classifications, except for the marketing classifications listed in the information provided for the purpose of asserting, exercising or defending legal claims. With the deletion of the marketing classifications mentioned in point 2. b, all information about the calculation of these marketing classifications was also deleted, so that the complainant no longer had any information. The "possible target group of academics" mentioned in paragraph 2. c had not been calculated. Affected persons were assigned to her if, to the complainant's knowledge, they had an academic degree. The term "possible" was used because the existence of an academic degree could not be verified. The attribution feature “Dkfm. Dr.” was informed to the person involved.

11. On July 15, 2021, the co-involved party also submitted a statement on this statement by the complainant and stated that the statement on points 2. b and 2. c of the decision was noted. With regard to point 2.a of the decision in question, it is stated that the complainant has still not complied with the request. Since the information obligation on the part of the recipient of data according to Art. 14 [GDPR] is hardly fulfilled, it is absolutely necessary for the protection of the rights according to Art. 15 GDPR that the data subject is given information about which other recipients the data subject is sent to had been passed on. This requires the naming of each individual recipient and not just the naming of the category. The mostly claimed endangerment of trade secrets according to Art. 23 Para. lit. i GDPR in connection with § 4 Para Those affected could not be located at all.

12. In a letter dated March 25, 2022, the Federal Administrative Court granted a hearing to the complainant's application for suspension and to the statement of the co-participant.

13. In a letter dated April 4, 2022, the authority concerned submitted a statement in which it stated that in the present case a suspension pursuant to Section 38 AVG was not permissible. The prerequisite for being able to order a suspension of the proceedings is that the decision period has not (yet) expired. At the time the request for a preliminary ruling was received by the ECJ, there had been no meritous decision by the responsible Senate of the BVwG in the pending appeal proceedings at the Federal Administrative Court regarding the alleged violation of the right to information. According to the established case law of the Higher Administrative Court, the suspension of proceedings by means of a procedural decision or notification is not legally required if the general decision period pursuant to Section 73 (1) AVG has already expired. On the contrary, if the prerequisites are met, the authority or the court merely has to wait for the decision on the preliminary questions. In addition, all other points of the ruling that do not relate to 2. a of the contested decision could also be answered unaffected without the answer to the question referred.

14. In a reply dated April 8, 2022, the complainant explained that points 2. b and c in the ruling should be remedied because the other party involved had already been provided with all available information about the marketing classifications mentioned in the ruling. The complainant was also unable to see that the person involved in the proceedings before the relevant authority had requested information about the marketing classifications mentioned in the notification. The authority concerned had therefore exceeded the subject matter of the proceedings pending with it and points 2. b and c should also be remedied for this reason. Regarding point 1, it should be stated that there is no independent claim for assessment, the authority concerned had decided the same legal issues as in point 1 through the performance mandates in point 2, which is why this should be remedied as unlawful.

15. The co-participant submitted no further comments.

II. The Federal Administrative Court considered:

1. Findings:

The procedure outlined under point I is used as a basis for the findings.

This means in particular that:

On May 30, 2019, the co-involved party lodged a complaint with the relevant authority about a violation of the right to information pursuant to Art. 15 GDPR by the complainant. The person involved used a form provided by the relevant authority for this purpose. Under point 4.4. of the form and the heading "I consider this response to be defective and believe that my rights have been violated because of the following:" the co-participant submitted the following:

"Although it is known that Swiss Post also saves or has saved political preferences in the personal data, Swiss Post refuses to provide information on this with the protective claim that there is no data on my person on political preferences, although all possible other target group data was collected became.

 Even the possible prior deletion of the data regarding political preference does not allow to justify being unadorned.

 Similarly, no information was provided about the recipients of target group data, although this was expressly requested.

 The authorization cited for storing the data is void because it is differentiated to the customer in the course of the granting of a re -sending order by crossing the corresponding box. ”

The co-participant in the administrative procedure did not make any further arguments regarding the alleged inadequacy of the information provided.

2. Evaluation of Evidence

The findings result from the submitted administrative act and the relevant court act and are undisputed.

3. Legal Assessment

3.1. To I

to A)

3.1.1. Legal situation:

Art. 12 of Regulation (EU) 2016/679 of the European Parliament and of the Council

from April 27th, 2016 on the protection of natural persons in the processing of personal data

Data, on the free movement of data and on the repeal of Directive 95/46/EC (General Data Protection Regulation) - GDPR reads:

"Art. 12 GDPR

Transparent information, communication and modalities for exercising the rights of the data subject

1. The controller shall take appropriate measures to provide the data subject with any information referred to in Articles 13 and 14 and any communication referred to in Articles 15 to 22 and Article 34 relating to the processing in a concise, transparent, understandable and easily accessible manner submit the form in clear and plain language; this applies in particular to information that is specifically aimed at children. 2The information is transmitted in writing or in another form, possibly also electronically. 3If requested by the data subject, the information can be given orally, provided that the identity of the data subject has been proven in some other way.

(2) The controller shall facilitate the exercise of the data subject's rights under Articles 15 to 22. 2In the cases referred to in Article 11(2), the controller may refuse only on the basis of the data subject's request to exercise their rights under Articles 15 to 22 to take action if he can show that he is unable to identify the person concerned.

3. The controller shall provide the data subject with information on measures taken on a request pursuant to Articles 15 to 22 without undue delay and in any event within one month of receipt of the request. 2This period can be extended by a further two months if this is necessary taking into account the complexity and the number of applications. 3The controller shall inform the data subject of an extension of the deadline within one month of receipt of the request, together with the reasons for the delay. If the data subject submits the application electronically, they are to be informed electronically if possible, unless they state otherwise.

(4) If the person responsible does not act upon the request of the data subject, he shall inform the data subject without delay, but no later than one month after receipt of the request, of the reasons for this and of the possibility of lodging a complaint with a supervisory authority or to lodge a judicial remedy.

5. Information pursuant to Articles 13 and 14 and all communications and actions pursuant to Articles 15 to 22 and Article 34 shall be provided free of charge. In the case of manifestly unfounded or - especially in the case of frequent repetition - excessive requests from a data subject, the person responsible can either

(a) charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested, or

b) refuse to act on the application.

The Controller shall provide evidence of the manifestly unfounded or excessive nature of the request.

6. Without prejudice to Article 11, if the controller has reasonable doubts as to the identity of the natural person submitting the request pursuant to Articles 15 to 21, he may request additional information necessary to confirm the identity of the data subject.

7. The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardized icons to give a meaningful overview of the envisaged processing in an easily perceptible, understandable and clearly traceable form. 2If the icons are presented in electronic form, they must be machine-readable.

8. The Commission is empowered to adopt delegated acts in accordance with Article 92 specifying the information to be represented by icons and the procedures for the provision of standardized icons."

Art. 15 GDPR reads:

"Art. 15 GDPR

Right of access of the data subject

(1) The data subject has the right to request confirmation from the person responsible as to whether personal data relating to them are being processed; if this is the case, you have the right to information about this personal data and the following information:

a) the processing purposes;

b) the categories of personal data being processed;

c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;

d) if possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period;

e) the existence of a right to correction or deletion of the personal data concerning you or to restriction of processing by the person responsible or a right to object to this processing;

f) the existence of a right of appeal to a supervisory authority;

g) if the personal data are not collected from the data subject, all available information about the origin of the data;

h) the existence of automated decision-making including profiling in accordance with Article 22 paragraphs 1 and 4 and - at least in these cases - meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

(2) Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards referred to in Article 46 relating to the transfer.

(3) The person responsible provides a copy of the personal data that are the subject of the processing. For all further copies requested by the person concerned, the person responsible can demand a reasonable fee based on the administrative costs. If the data subject submits the application electronically, the information must be made available in a common electronic format, unless otherwise specified.

(4) The right to obtain a copy under paragraph 3 shall not prejudice the rights and freedoms of any other person."

Art. 77 GDPR reads:

"Art. 77 GDPR

Right to lodge a complaint with a supervisory authority

(1) Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement, if the data subject believes that the processing of the personal data concerning you violates this regulation.

2. The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78."

Section 24 of the Federal Act for the Protection of Natural Persons in the Processing of Personal Data (Data Protection Act - DSG), Federal Law Gazette I No. 165/1999 as amended reads as follows:

"3. section

Remedies, Liability and Penalties

Complaint to the data protection authority

Section 24. (1) Every data subject has the right to lodge a complaint with the data protection authority if they believe that the processing of their personal data violates the GDPR or Section 1 or Article 2, Part 1.

(2) The complaint must contain:

1. the designation of the right deemed to have been infringed,

2. as far as this is reasonable, the designation of the legal entity or body to which the alleged infringement is attributed (respondent party),

3. the facts from which the infringement is derived,

4. the grounds on which the allegation of illegality is based,

5. the desire to determine the alleged infringement and

6. the information required to assess whether the complaint was filed in a timely manner.

(3) A complaint may be accompanied by the application on which it is based and any response by the respondent. The data protection authority shall provide further assistance in the event of a complaint at the request of the data subject.

(4) The right to have a complaint dealt with shall lapse if the intervener does not file it within one year of becoming aware of the event giving rise to the complaint, but at the latest within three years after the event allegedly took place. Late complaints are to be rejected.

(5) If a complaint proves to be justified, it must be followed. If an infringement is attributable to a person responsible for the private sector, the person responsible must be instructed to comply with the complainant's requests for information, correction, deletion, restriction or data transfer to the extent necessary to eliminate the identified infringement. If the complaint proves to be unjustified, it must be dismissed.

(6) Until the proceedings before the data protection authority have been concluded, a respondent may subsequently remedy the alleged infringement by complying with the complainant's requests. If the data protection authority considers the complaint to be unfounded, it must hear the complainant. At the same time, he should be made aware that the data protection authority will informally discontinue the procedure if he does not explain within a reasonable period of time why he still considers the originally alleged infringement to be at least partially not remedied. If the essence of the matter is changed by such a statement by the complainant (Section 13(8) AVG), it is to be assumed that the original complaint will be withdrawn and a new complaint will be filed at the same time. In this case, too, the original complaint procedure is to be discontinued informally and the complainant to be informed. Late statements are not to be considered.

(7) The complainant will be informed by the data protection authority about the status and the result of the investigation within three months of filing the complaint.

(8) Any data subject may appeal to the Federal Administrative Court if the data protection authority does not deal with the complaint or has not informed the data subject of the status or the outcome of the complaint within three months.

(9) The data protection authority can - if necessary - involve official experts in the procedure.

(10) The decision period according to § 73 AVG does not include:

1. the time during which the proceedings are suspended until the final decision on a preliminary question;

2. the time during a procedure according to Articles 56, 60 and 63 GDPR.”

3.1.2. With its statement in points 2. b and 2. c of the contested decision, the authority concerned went beyond the subject of the pending proceedings:

In his complaint to the relevant authority, the person involved asserted that the complainant had not provided any information about the stored data regarding "political preferences" or the recipients of target group data, and (not relevant to the case) that the cited authorization for storage of the data is void.

That is why the subject of the proceedings before the authority concerned should have been whether the co-participant - in general and beyond the express submission - violated his right to information within the meaning of Art. 12 and Art. 15 (1) GDPR by providing "inadequate information". was, cannot be inferred from the clear and undoubted statements of the parties in this regard.

In application-related cases, the application not only obliges the authority to carry out the administrative procedure, but is also a prerequisite for the decision and at the same time creates the substantive legal basis for issuing the decision.

Accordingly, the content of such an application constitutes and limits the subject matter of the administrative procedure, i.e. the (administrative) "matter" within the meaning of Sections 8, 66 (4) and Section 68 (1) AVG.

The issuance of a decision requiring an application ex officio, i.e. without a clear application in this regard (or after its withdrawal), in any case burdens this decision with illegality. While the VwGH has overturned such a decision due to illegal content in numerous cases, it has also frequently assumed in more recent case law that the party violated the right to compliance with the rules of jurisdiction. At the constitutional level, the authority violates the right to a procedure before the statutory judge under Art. 83 Para it does not belong to it (see the two paragraphs above with more detailed evidence there Hengstschläger/Leeb, AVG § 13 (as of January 1st, 2014, rdb.at).

According to case law, when determining the legal quality and content of an attachment, it is not the designation by the intervener or "random verbal forms" that matters, but the content of the submission, i.e. the goal of the intervener that can be recognized and deduced from it.

In the case of administrative acts that require an application, it is inadmissible to give an interpretation to the request that cannot be directly deduced from the wording of the request against the declared will of the party [...] [cf. again to these two paragraphs with more detailed evidence there Hengstschläger/Leeb, AVG § 13 (as of January 1st, 2014, rdb.at)].

In the present case, the person involved made clear statements as to why he believed that the information given to him was inadequate: On the one hand, there was no information about the stored data relating to "political preferences", and on the other hand there was no information about the recipients of target group data been granted. In this way, the party involved very clearly outlined the reason for his complaint, which clearly defined the subject of the complaint and thus the application. On the other hand, the co-participant in the procedure to be dealt with here did not complain that his rights under Articles 12 and 15 GDPR had been violated in any way in general.

The right of appeal to the supervisory authorities standardized in Art. 77 GDPR does not permit any formal restrictions, such as are partially provided for in Section 24 DSG, but according to the literature it nevertheless provides that a data subject must provide sufficient information in a complaint that enable the supervisory authority to at least understand the manner in which the personal data is processed and the violation of the provisions (cf. Schweiger in Knyrim, DatKomm Art 77 GDPR (status 1.12.2018, rdb.at)). In any case, the party involved complied with these requirements in the present case if he unequivocally and to the extent still essential complained here that data relating to political preferences and recipients of his data had not been disclosed to him. In accordance with the provision mentioned, the authority concerned was thus able to define the object of the complaint (namely the lack of information on data relating to political preferences and recipients) and to examine the complaint made. Art. 77 GDPR also leaves no room for a “comprehensive” examination of the data protection complaint of the co-involved party “for possible violations of the law”. Finally, the wording of Section 24 (6) DSG also suggests that the subject matter of the complaint must be limited by the specific submissions of the (here) other party if it emerges that an opponent of a complaint before the data protection authority has until the end of the procedure before the latter can subsequently remedy the alleged infringement by complying with the requests of a data subject. However, such an elimination of alleged violations of the law is only possible if it results from the submissions or applications of a complainant to the data protection authority. Furthermore, it must also be brought to the attention of an opponent of such a complaint, since otherwise a removal cannot be expected either. The meaning as well as the wording of this provision therefore also indicate that the object of complaints before the data protection authority in cases such as the present one must be those submissions that were actually made by the (here) co-participant. The other party did not make any submissions regarding an alleged lack of information within the meaning of Art. 15 Para. 1 lit h GDPR or the comprehensibility (Art. 12 GDPR) of the information provided regarding some or all of the marketing classifications mentioned by the complainant. He did not submit any further applications, nor can any be derived from his complaint to the data protection authority.

The data protection authority thus exceeded the object of the complaint in the pending proceedings and thus its jurisdiction with its statements on points 2.b and 2.c, which is why these points had to be resolved without replacement.

Re B) Inadmissibility of the revision:

Pursuant to § 25a Para. 1 VwGG, the administrative court has to pronounce in its ruling or decision whether the revision is admissible according to Art. 133 Para. 4 B-VG. The statement must be briefly justified.

According to Art. 133 Para. 4 B-VG, the revision is not permissible because the decision does not depend on the solution of a legal question that is of fundamental importance. The present decision neither deviates from the previous case law of the Administrative Court, nor is there any case law; Furthermore, the case law of the Administrative Court is not to be judged as inconsistent. There are also no other indications of a fundamental importance of the legal question to be solved.

3.2. To II.

to A)

3.2.1. According to § 38 AVG, which according to § 17 VwGVG is also to be applied mutatis mutandis in administrative court proceedings, an authority can suspend proceedings until a final decision has been taken on preliminary questions that would have to be decided as main questions by other administrative authorities or by the courts, if the preliminary question already is the subject of pending proceedings before, inter alia, the competent court or such proceedings are pending at the same time.

3.2.2. According to the case law of the VwGH, proceedings can be suspended on the basis of § 38 AVG until the preliminary ruling (requested in another procedure) by the Court of Justice of the European Union; a question of Union law submitted to the ECJ for clarification can represent a preliminary question within the meaning of § 38 AVG, which, according to the ECJ's monopoly on interpretation in the area of Union law, is to be decided by the ECJ (VwGH 18.12.2020, Ra 2020/15/0059; 11.11. 2020, Ro 2020/17/0010; 12/19/2000, 99/12/0286). It entitles you to suspension according to § 38 AVG if it is prior to the administrative court proceedings (cf. e.g. VwGH 13.12.2011, 2011/22/0316).

3.2.3. In the present case, the complainant argues that there is no obligation to provide information to the specific recipient within the meaning of Article 15(1)(c) GDPR. She relies on the fact that in the specific case providing information to all specific recipients involves a disproportionate amount of effort, it is not legally necessary to provide information to specific recipients and providing information to specific recipients would even disclose business and trade secrets.

3.2.4. With the decision of February 18, 2021, Zl. 6 Ob 159/20f, the OGH submitted the following question to the ECJ for a preliminary decision:

"Is Art 15 Para 1 lit c of the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data, on the free movement of data and on the repeal of Directive 95/46/EC (General Data Protection Regulation, OJ L 119/1 of May 4, 2016, p. 1; hereinafter "GDPR") to be interpreted in such a way that the right to information on recipient categories is limited if specific recipients are not yet known for planned disclosures, the However, the right to information must also extend to recipients of these disclosures if data have already been disclosed?"

3.2.5. The wording of Article 15 (1) (c) GDPR does not allow for a conclusive assessment of the question.

3.2.6. The Supreme Court stated the following in its decision of February 18, 2021:

“The German version, by referring to the scope of the data subject’s right to information in Art. 15 para.

Nothing else emerges from the wording of the corresponding text section in the English version (arg: "[...] the right to obtain [...] access to [...] the following information: [...] the recipients or categories of recipients to whom the personal data have been or will be disclosed") and the French language version (arg: "[...] le droit d'obtenir [...] les informations suivantes: les destinataires ou catégories de destinataires auxquels les données à caractère personnel ont été ou seront communiquées [... ]").

In contrast to Art. 15 GDPR, Art. 13 Para. 1 lit e and Art. 14 Para.

In addition, the obligation to provide information provided for in Articles 13 and 14 GDPR is linked to the point in time at which the data is collected – which inevitably precedes data processing – so that the information must always be provided in advance, i.e. at a stage in which no actual disclosure of data has yet taken place third party may have come. The right to information according to Art. 15 GDPR, on the other hand, extends not only to the currently processed data of the data subject, but also to the data stock processed in the past according to its purpose (basically ECJ Case C-553/07, Rijkeboer, ECLI:EU:C: 2009:293, margin no. 51 ff; the convincing considerations of this decision based on the telos of the right to information are also to be transferred to the right to information according to Art level of protection compared to Directive 95/46/EC in general).

Recital 63 of the GDPR states that “each data subject should therefore have a right to know and be informed … who the recipients of the personal data are …”. So here we are not just talking about “categories of recipients”, which also suggests that the person responsible must name the individual recipients.

Against this background, the interpretation of Article 15 (1) (c) GDPR must primarily be based on the purpose of the norm: First of all, reference should be made to the previously explained telos of the right to information as an auxiliary claim for effective legal enforcement, in particular the rights of those affected under Article 16 ff GDPR . This purpose of the regulation clearly speaks for an understanding - which is covered by the wording of the provision - that the person responsible does not have discretionary powers with regard to the question of how specifically he wants to comply with the request for information about the recipients of personal data; rather, the data subject should in principle be able to choose whether he only requests information about abstract recipient categories or about the specific recipients of his data. The opposite understanding of the norm, on the basis of which the person responsible could ultimately always withdraw to merely providing information about the recipient category, led to a considerable impairment of the effectiveness of the legal remedies available to the data subject for the protection of his data, as intended by the European legislator: namely, if the person responsible - as the Court of Appeal and the defendant believe - the free choice, a person responsible will hardly ever provide detailed information about specific recipients, which involves considerable additional effort. In this case, the person concerned will usually only be informed about abstract recipient categories."

3.2.7. The answer to the question submitted by the OGH to the ECJ for a preliminary ruling is relevant to the case at hand in the sense of the case law cited above; it is also preliminary: the question of whether specific recipients are to be informed within the framework of Art. 15 Para. 1 lit c GDPR, or whether the person responsible has the right to choose to disclose specific recipients or categories of recipients, is the subject of the pending complaints procedure.

3.2.8. Contrary to the statements of the authority concerned, there is no supreme case law of the Administrative Court according to which the suspension of proceedings by means of a procedural decision or notification is not legally required if the general decision period pursuant to Section 73 (1) AVG has already expired. Rather, the VwGH (only) ruled that a suspension decision (possibly only issued during the procedure for setting a deadline) ends the decision-making obligation of the administrative court (VwGH January 14, 2020, Fr 2019/12/0042 with reference to VwGH July 2, 2019, Fr 2019/12/ 0028; 25.5.2016, Fri 2015/11/0007). Even if the VwGH does not explicitly deny the legality of a suspension decision in the procedure for setting a deadline (cf. e.g. VwGH 30.5.2017, Fr 2017/19/0009), it can be assumed that the drafting of a suspension decision is also permissible after the decision period has expired, Especially since § 38 AVG does not stipulate that - as a prerequisite for the suspension by resolution - the decision period must not have expired. According to the settled case law of the Administrative Court, it is at the discretion of the authority or the administrative court to either judge the preliminary question independently or to suspend the proceedings in favor of the proceedings already pending on the preliminary question (VwGH January 26, 1993, 92/07/0071; VwSlg 15.618 A/2001; VwGH 20 March 2014, Ro 2014/07/0046; VfSlg 9538/1982; VwGH 20 May 2015, Ra 2015/10/0023; see also VwSlg 19.081 A/2015; 18 March 2016 , Ra 2016/11/0040). The purpose of § 38 AVG is also to achieve the most correct and uniform decisions possible (VwGH November 9, 1994, 93/03/0202; VwSlg 15.618 A/2001) and thus to avoid re-admissions due to subsequent deviating preliminary questions (VwGH 12 3. 1999, 97/19/0066), which is why in the present case a suspension of the proceedings is ordered in the sense of a weighing of interests despite the fact that the decision period has already expired.

3.2.9. The suspension of the complaints procedure - with not just a procedural decision (cf. VwGH 20.12.2017, Ra 2017/12/0119) - until the preliminary decision by the ECJ on the decision of the Supreme Court of 18.02.2021, Zl. 6 Ob 159/20f (pending at the ECJ under C-154/21).

Re B) Inadmissibility of the revision:

Pursuant to § 25a Para. 1 VwGG, the administrative court has to pronounce in its ruling or decision whether the revision is admissible according to Art. 133 Para. 4 B-VG. The statement must be briefly justified. According to Art. 133 Para. 4 B-VG, the revision is not permissible because the decision does not depend on the solution of a legal question that is of fundamental importance. With regard to the application of § 38 AVG, the adjudicating court was able to rely on a well-established case law of the Administrative Court, which was cited in each case. An assessment of a legal question pending before another court as prejudicial to the proceedings at hand – as here – within the framework of these principles established by the Administrative Court, is not reversible (cf. VwGH September 13, 2017, Ra 2017/12/0068).