DSB (Austria) - 2021-0.816.492

DSB - 2021-0.816.492
Authority:	DSB (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 9(1) GDPR Article 12(1) GDPR Article 12(3) GDPR Article 15 GDPR Article 12(1) LED § 42(4) DSG
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	16.12.2021
Published:	05.06.2024
Fine:	n/a
Parties:	n/a
National Case Number/Name:	2021-0.816.492
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	German
Original Source:	RIS (in DE)
Initial Contributor:	ec

The DPA held that EU law or national law did not require that the controller needs to send information for an access request that may contain "criminal data" or even special categories of personal data in accordance with Article 9(1) GDPR by hand and under no circumstances by email.

English Summary

Facts

On 10 October 2020, the data subject requested access from the controller, the Federal Minister of the Interior, to all police entries and all queries in the Electronic Criminal Police Information System and Border Control Points. The data subject expressly stated on the application form that she wanted to receive the information by e-mail as they were living abroad for an indefinite period of time. Moreover, as proof of their identity, the data subject had sent a copy of a passport, but had not proven thier identity by means of a citizen card.

On 19 October 2020, the controller completed the access request and arranged for the copy to be send to the registered address of the data subject. The post office informed the data subject that the copy was sent back, as the data subject was absent at the address. The controller tried again and sent a copy to a different address which was the main residence of the data subject, but the copy was returned again as the data subject was absent at this address, too. The controller did not send the requested information to the data subject by email. Despite the controller’s request, the data subject did not appoint an authorised representative in Austria.

On 22 October 2020, the controller replied that the access request could not be complied with, because the data subject was living abroad and no longer had a place of residence in Austria.

On 30 December 2020, the data subject lodged a complaint against the controller at the Austrian DPA (“Datenschutzbehörde”).

Holding

Article 12(1) of the Law Enforcement Directive (LED), which regulates the processing of “criminal data”, states that the controller shall provide the information in the same form as the request. According to the DPA, this goes beyond the wording of Article 12(1) GDPR which state that information must be provided in writing or in another form, including electronically where appropriate. Article 12(3) GDPR, similarly to Austrian national law (§ 42(4) DSG), also states that when a data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.

The DPA concluded that the EU legislator not merely gave the option, but deliberately opted for the principle of transmission by the same means - in this case electronic means - even though it is by nature concerned with the processing of "more sensitive information" - namely information on criminal offences.

The DPA also took into account that the delivery by email of “special categories of data” under Article 9(1) GDPR is also permitted. In reality, neither EU law nor national law require that information, which may also contain "criminal data" or even special categories of personal data in accordance with Article 9(1) GDPR, must be sent by hand and under no circumstances by email.

Although the controller can request additional information necessary to confirm the identity of the person, the DPA held that since the controller had made two attempts to deliver the information to the data subject himself, the controller had obviously no doubt about the data subject’s identity. This is why the DPA found that the copy could have also been sent by email. The DPA also noted that according to the case law of the Austrian Administrative Court (VwSlg. 17.515 A/2008), hand delivery cannot replace the requirement of a prior identity check.

The DPA, taking into account that the data subject requested access electronically by email and expressly wished to receive the copy electronically, stated that the data subject should have received the copy electronically. The DPA held that by not sending the copy electronically, the controller violated the data subject’s right to access.

Comment

Article 12(1) of the Law Enforcement Directive states: “Member States shall provide for the controller to take reasonable steps to provide any information referred to in Article 13 and make any communication with regard to Articles 11, 14 to 18 and 31 relating to processing to the data subject in a concise, intelligible and easily accessible form, using clear and plain language. The information shall be provided by any appropriate means, including by electronic means. As a general rule, the controller shall provide the information in the same form as the request.”

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Text

GZ: 2021-0.816.492 of December 16, 2021 (case numbers: DSB-D124.3435 and DSB-D062.968)

[Editor's note: Names and companies, legal forms and product names, addresses (including URLs, IP and email addresses), file numbers (and the like), statistical information, etc., as well as their initials and abbreviations may be abbreviated and/or changed for pseudonymization reasons. Obvious spelling, grammatical and punctuation errors have been corrected.]

PRECIATIONAL DECISION ON COMPLAINT

RULING

The Data Protection Authority decides on the data protection complaint [Editor's note: means: complaint, decision complaint or official complaint] of the Federal Ministry of the Interior (complainant) of October 27, 2021 against the decision of the Data Protection Authority of October 5, 2021, GZ D124.33435, 2021-0.658.855 (contested decision), as follows:

-    The ruling of the contested decision is amended to read as follows:

1. The complainant's complaint is upheld and it is determined that the respondent violated the complainant's right to information by not sending the information of October 19, 2020 by email to the has served on the complainant.

2.   The respondent is instructed to comply with the complainant’s request for information within a period of two weeks by sending the information to her electronic delivery address.

Legal basisSection 18 paragraph 1, Section 24 paragraphs 1 and 5, Section 33 paragraph 2 item 2 and Section 44 of the Data Protection Act (DSG), Federal Law Gazette I no. 165/1999 as amended; Sections 2, 8, 21, 23, 28, 30, 37a of the Service of Documents Act (ZustG), Federal Law Gazette 1982/200 as amended.Legal basisSection 18 paragraph one, paragraph 24 paragraph one and paragraph 5, paragraph 33 paragraph 2, number 2 and paragraph 44 of the Data Protection Act (DSG), Federal Law Gazette Part one, No. 165 of 1999, as amended; paragraphs 2, 8, 21, 23, 28, 30, 37a of the Service of Documents Act (ZustG), Federal Law Gazette 1982/200 as amended.

REASONING

A. Arguments of the parties and course of proceedings

1. The now co-participating party and complainant in the main proceedings, Dr. Sonja A***, stated in her complaint of December 30, 2020 (addressed to the data protection authority) that she had submitted a request for information to the now complainant, the Federal Minister of the Interior (BMI), on October 10, 2020. On October 22, 2020, she was informed by the complainant that "no delivery could be made at the delivery point you announced in **** P***hausen, B***straße 4* due to absence from the area." The co-participating party further argued that it was correct that she was registered as being absent from the area because she was abroad and no longer had a residence in Austria. However, she had expressly stated on the application form that she wanted to receive the information by email. Together with the complaint, the co-participating party submitted the email correspondence with the complainant that preceded the complaint.

2. The current complainant (and respondent in the main proceedings) stated - reproduced here where relevant - that the co-participating party had submitted a request for information to him by email dated 10 October 2020. As proof of their identity, the co-participating party had submitted a copy of a passport, but had not proven their identity by means of a citizen card. The complainant then processed the co-participating party’s request for information and arranged for the substantive information to be delivered to the co-participating party’s registered address by RSa letter. The complainant was subsequently informed that the co-participating party was deemed to be absent from the address it had provided, “**** P***hausen, B***straße 4*”. The complainant subsequently asked the co-participating party by email dated 22 October 2020 to provide a delivery point within the meaning of Section 2 No. 4 of the Delivery Act or to name an authorized representative. In an email dated November 9, 2020, the complainant once again drew the attention of the other party involved to the fact that the delivery of information under data protection law is only permissible with proof of delivery to the recipient’s own hand in accordance with Section 21 of the Delivery Act or electronically with proof of delivery through delivery systems in accordance with Section 28, Paragraph 3, Item 1 (approved delivery service in accordance with Section 30 of the Delivery Act) and Item 3 (electronic legal transactions in accordance with Sections 89a of the Delivery Act) as well as in accordance with Section 37a, second sentence, of the Delivery Act. In this context, the complainant also referred to Section 5, Paragraph 1a of the Ordinance of the Federal Minister of Justice on Electronic Legal Transactions (ERV 2006), according to which “fax and e-mail (…) are not permissible forms of electronic legal transactions within the meaning of this Ordinance”. According to the second sentence of Section 37a, in the case of delivery to the recipient’s own hand, identity must be proven by means of a citizen card. However, since the co-participating party did not prove its identity by means of a citizen card, electronic delivery could not take place in accordance with Section 28, Paragraph 4 in conjunction with Section 37a, second [Editor’s note: add: “sentence”] of the Delivery Act. The complainant had arranged for the substantive information to be delivered by RSa letter to the delivery address of the co-participating party, but the party was deemed to be “absent” at the address it had provided. The complainant therefore requests that the complaint be dismissed. 2. The current complainant (and respondent in the main proceedings) stated - reproduced here where relevant - that the co-participating party had submitted a request for information to him by email dated October 10, 2020. As proof of its identity, the co-participating party had submitted a copy of a passport, but had not proven its identity by means of a citizen card. The complainant then processed the co-participating party's request for information and arranged for the substantive information to be delivered to the co-participating party's registered address by RSa letter. The complainant was subsequently informed that the co-participating party was deemed to be absent from the address it had provided, "**** P***hausen, B***straße 4*". The complainant subsequently asked the co-participating party by email on October 22, 2020, to provide a delivery point within the meaning of Paragraph 2, Item 4, of the Delivery Act or to name an authorized representative. In an email dated November 9, 2020, the complainant once again drew the attention of the other party involved to the fact that the delivery of information under data protection law is only permissible with proof of delivery to the recipient’s own hand in accordance with Paragraph 21, ZustG, or electronically with proof of delivery through delivery systems in accordance with Paragraph 28, Paragraph 3, Number one (approved delivery service in accordance with Paragraph 30, ZustG) and Number 3 (electronic legal transactions in accordance with Paragraphs 89a, GOG) as well as in accordance with Paragraph 37a, second sentence, ZustG. In this context, the complainant also referred to Paragraph 5, Paragraph one a, of the Ordinance of the Federal Minister of Justice on Electronic Legal Transactions (ERV 2006), according to which “fax and e-mail (…) are not permissible forms of electronic legal transactions within the meaning of this Ordinance”. According to Paragraph 37a, second sentence, in the case of delivery to the recipient’s own hand, identity must be proven by means of a citizen card. However, since the co-participating party did not prove their identity by means of a citizen card, no electronic delivery could be made in accordance with paragraph 28, paragraph 4, in conjunction with paragraph 37 a, second [editor's note: add: "sentence"] of the Delivery Act. The complainant had arranged for the content information to be delivered by RSa letter to the delivery address of the co-participating party, but the party was deemed to be "absent" at the address it had provided. The complainant therefore requested that the complaint be dismissed.

3. In a further statement dated April 13, 2021, the complainant stated that he had made a new attempt to deliver the document with proof of delivery to his own hands at the co-participating party's main residence, "**** R***tal, I***weg *5/*7", which has existed since February 3, 2021. As soon as the return receipt is available, the complainant will inform the data protection authority whether the delivery was successful or whether the party involved is again considered "absent". It is undisputed that neither the DSG nor the GDPR require personal delivery or delivery using a citizen card, but deliveries by authorities are governed by Sections 21 and 22 of the AVG. Section 21 of the AVG stipulates that deliveries must be made in accordance with the ZustGesetz (Act for Delivery) and Section 22 of the AVG stipulates that if there are important reasons, delivery must be made with proof of delivery. If there are particularly important reasons or if it is provided for by law, delivery must be made by hand. In the data protection policy decree of May 23, 2018, GZ BMI-LR1200/0074-III/7/a/2018, under point 13.10, the complainant ordered: “The substantive processing of a request for information must be delivered to the person concerned in their own hands (‘RSa letter’) in accordance with Section 21 of the Processing Act in order to prevent violations of the fundamental right to data protection.” The complainant assumes that there is an important reason within the meaning of Section 22, first sentence, of the General Data Protection Regulations (AVG) if there is an increased need for proof of delivery, which is the case when providing data relevant to criminal law in accordance with Section 44 of the Data Protection Act and the related possibility of complaint in accordance with Section 32, Paragraph 1, Item 4 in conjunction with Section 24 of the Data Protection Act. Particularly important reasons within the meaning of Section 22, second sentence, AVG are that delivery to one's own hands would prevent a substitute recipient, who might be present at the delivery point - in the event of the recipient's absence at the delivery point - from gaining knowledge of the recipient's personal data relevant to criminal law.Electronic delivery by an Austrian authority may only be made within the meaning of Section 3 of the Delivery Act. According to Section 28 Paragraph 4 of the Delivery Act, electronic deliveries with proof of delivery are only permitted through delivery systems in accordance with Section 28 Paragraph 3 Items 1 and 3 and in the case of Section 37a, second sentence of the Delivery Act. According to Section 37a, second sentence of the Delivery Act, in the case of delivery with proof of delivery, identity must be proven using a citizen card. However, the co-participating party did not prove their identity using a citizen card, which is why the complainant was not permitted to transmit the information electronically. The complainant has so far made two delivery attempts to the delivery address of the co-participating party. A request is made to dismiss the complaint (directed to the data protection authority). 3. The complainant stated in a further statement dated April 13, 2021 that he had made a new attempt to deliver the document with proof of delivery to his own hand at the main residence of the co-participating party, "**** R***tal, I***weg *5/*7", which has existed since February 3, 2021. As soon as the return receipt is available, the complainant will inform the data protection authority whether the delivery was successful or whether the co-participating party is again considered "absent from the place of residence". It is undisputed that neither the DSG nor the GDPR necessarily provide for personal delivery or delivery by means of a citizen card, but deliveries by authorities are governed by paragraphs 21 and 22 of the AVG. Paragraph 21 of the AVG stipulates that deliveries must be made in accordance with the ZustGesetz and paragraph 22 of the AVG stipulates that if there are important reasons, delivery must be made with proof of delivery. If there are particularly important reasons or if it is provided for by law, delivery must be made to the person's own hand. In the data protection policy decree of May 23, 2018, GZ BMI-LR1200/0074-III/7/a/2018, under point 13.10, the complainant ordered: “The substantive processing of a request for information must be delivered to the data subject in his or her own hand (“RSa letter”) in accordance with Paragraph 21 of the Data Protection Act in order to prevent violations of the fundamental right to data protection.” The complainant assumes that there is an important reason within the meaning of Paragraph 22, first sentence, AVG if there is an increased need for proof of delivery, which is the case when providing data relevant to criminal law in accordance with Paragraph 44, DSG and the related complaint option in accordance with Paragraph 32, Paragraph one, Number 4, in conjunction with Paragraph 24, DSG. Particularly important reasons within the meaning of Paragraph 22, second sentence AVG are that delivery to one’s own hands would prevent a substitute recipient, who might be present at the delivery point - in the event that the recipient is absent from the delivery point - from gaining knowledge of the recipient’s personal data relevant to criminal law. Electronic delivery by an Austrian authority may only take place within the meaning of Section 3 of the ZustG. According to Paragraph 28, Paragraph 4, ZustG, electronic deliveries with proof of delivery are only permitted through delivery systems in accordance with Paragraph 28, Paragraph 3, numbers one and three, and in the case of Paragraph 37a, second sentence of the ZustG. According to Paragraph 37a, second sentence of the ZustG, when delivery is made with proof of delivery, identity must be proven using a citizen card. However, the co-participating party did not prove their identity using a citizen card, which is why the complainant was not permitted to transmit the information electronically. The complainant has so far made two delivery attempts to the delivery address of the co-participating party. The complaint (addressed to the data protection authority) is requested to be dismissed.

4. In a supplementary statement dated April 20, 2021, the complainant stated, with submission of the postal return receipt, that the substantive information dated October 19, 2020 could not be delivered to the party involved because they were considered to be absent at the address "**** R***tal, I***weg *5/*7". Finally, the complainant stated that the principle that, if possible, the information should be provided in the same form in which the application was made only applies if there are no special reasons to the contrary. However, these exist in the form of Section 54 DSG, Section 22 AVG and the ZustG.4. In a supplementary statement dated April 20, 2021, the complainant stated, with the submission of the postal return receipt, that the content information dated October 19, 2020 could not be delivered to the party involved because it was considered absent at the address "**** R***tal, I***weg *5/*7". Finally, the complainant stated that the principle that, if possible, the information should be provided in the same form in which the application was made only applies if there are no special reasons to the contrary. However, these exist in the form of Section 54, DSG, Section 22, AVG and the ZustG.

5. In the contested decision of October 5, 2021, the Data Protection Authority upheld the complaint initiating the proceedings by the co-participating party under ruling point 1 and found that the complainant had violated the co-participating party’s right to information by not exhausting all measures at his disposal to serve the information on the co-participating party. In ruling point 2, the Data Protection Authority instructed the complainant to serve the information of October 19, 2020 on the co-participating party by depositing it with the authority itself in accordance with Section 8 in conjunction with Section 23 of the Delivery Act.5. In the contested decision of October 5, 2021, the Data Protection Authority upheld the complaint initiating the proceedings by the co-participating party under ruling point 1 and found that the complainant had violated the co-participating party’s right to information by not exhausting all measures at his disposal to serve the information on the co-participating party. In ruling point 2, the data protection authority instructed the complainant to serve the information dated October 19, 2020 on the other party involved by depositing it with the authority itself in accordance with Section 8 in conjunction with Section 23 of the Delivery Act.

6. In a letter dated October 27, 2021, the complainant filed an appeal against this decision. In summary, he stated that the contested decision was unlawful for several reasons.

First, the complainant had indeed served the information by depositing it with the authority: In this context, the complainant referred to the decision of the Administrative Court of January 22, 2014, 2013/22/0313, according to which the authority may only make use of Section 8, Paragraph 2 of the Delivery Act if the authority has attempted to find a new delivery point using at least “simple means”. In accordance with this case law, the complainant initially attempted to deliver the information dated October 19, 2020 to the then registered address of the co-participating party in **** P***hausen, B***straße 4*. When the information was returned to the complainant as unresolved and with the comment that the co-participating party was absent from the address mentioned, the complainant used simple means - by obtaining information from the Central Register of Residents - to identify a new delivery point for the co-participating party in **** R***tal, I***weg *5/*7 and initiated a new delivery attempt at this address. Only after this second delivery attempt also failed - again due to absence from the location - did he make the information available for the co-participating party to pick up in the BMI (Department III/7/a). If the complainant had served the information dated October 19, 2020 on the co-participating party immediately after becoming aware of the new delivery point by depositing it with the authority itself in accordance with Section 8, Paragraph 2 in conjunction with Section 23 of the Delivery Act, he would not have exhausted all available means for lawful delivery. Firstly, the complainant did indeed serve the document by depositing it with the authority: In this context, the complainant referred to the decision of the VwGH of January 22, 2014, 2013/22/0313, according to which the authority may only make use of Paragraph 8, Paragraph 2, of the Delivery Act if the authority has attempted to find a new delivery point using at least “simple means”. In accordance with this case law, the complainant first attempted to serve the information dated October 19, 2020 on the co-participating party’s then registered address in **** P***hausen, B***straße 4*. When the information was returned to the complainant as unresolved and with the comment that the co-party was absent from the address given, the complainant used simple means - by obtaining information from the Central Register of Residents - to identify a new delivery point for the co-party in **** R***tal, I***weg *5/*7 in April 2021 and arranged for a new delivery attempt to be made to this address. Only after this second delivery attempt had also failed - again due to absence from the location - did he make the information available for the co-party to collect in the BMI area (Department III/7/a). If the complainant had served the information of October 19, 2020 on the co-participating party immediately after learning of the new delivery point by depositing it with the authority itself in accordance with Paragraph 8, Paragraph 2, in conjunction with Paragraph 23, of the Delivery Act, he would not have exhausted all available means for a legally compliant delivery.

Secondly, the data protection authority had unlawfully assessed a situation - namely the complainant's delivery attempt in April 2021 - which, however, only occurred after the complaint was lodged on December 30, 2020. However, in view of Section 34, Paragraph 5 in conjunction with Section 24, Paragraph 2, Item 3 DSG, the complainant can only violate the co-participating party’s right to information in connection with a matter that occurred before the complaint initiating the proceedings was filed on December 30, 2020.Secondly, the data protection authority unlawfully assessed a matter – namely the complainant’s attempted delivery in April 2021 – which, however, only occurred after the complaint was filed on December 30, 2020. However, in view of Section 34, Paragraph 5 in conjunction with Section 24, Paragraph 2, Item 3 DSG, the complainant can only violate the co-participating party’s right to information in connection with a matter that occurred before the complaint initiating the proceedings was filed on December 30, 2020.

Thirdly, the data protection authority did not discuss whether the complainant should have delivered the information by simple email, since the co-participating party had requested this.

7. The data protection authority requested the co-participating party to comment in a letter dated November 5, 2021, since it could be inferred from the complainant's complaint that the complainant had apparently already delivered the information in question dated October 19, 2020 by depositing it with the authority itself (according to Section 8, Paragraph 2 in conjunction with Section 23 of the ZustG). Since this was a fact or new evidence, the co-participating party was given the opportunity to comment on it in accordance with Section 10 of the VwGVG.7. The data protection authority asked the co-participating party to comment in a letter dated November 5, 2021, since it could be inferred from the complainant's complaint that the complainant had apparently already served the information in question dated October 19, 2020 by depositing it with the authority itself (according to paragraph 8, paragraph 2, in conjunction with paragraph 23, ZustG). Since this was a fact or new evidence, the co-participating party was given the opportunity to comment on it in accordance with paragraph 10, VwGVG.

8. The co-participating party stated in a letter dated November 8, 2021 that it had acted in accordance with the law at the time of a valid notification in Austria, as it was obliged to register its absence by post. Otherwise, an officially registered mail item would be considered delivered after the post office notification had been posted, regardless of whether it had been removed or no notification had ever been received from the post office. In addition, her right to information was violated because she did not receive the information by email as requested.

B. Subject matter of the complaint

The subject matter of the complaint is the question of whether the complainant violated the co-participating party's right to information by not exhausting all means to deliver the information dated October 19, 2020, including delivery by email.

C. Findings of fact

1. On October 10, 2020, the co-participating party sent the complainant a request for information dated October 1, 2020 in accordance with Section 44 of the Data Protection Act by email, which was to contain all police entries, EKIS queries (note: "Electronic Criminal Police Information System") and GREKO (note: "Border Control Points"). Together with the request, the co-participating party sent a copy of her passport. The co-participating party wished to receive the information electronically.1. On October 10, 2020, the co-participating party sent the complainant a request for information dated October 1, 2020 pursuant to Section 44, DSG, which was to contain all police entries, EKIS queries (note: "Electronic Criminal Police Information System") and GREKO (note: "Border Control Points"). Together with the request, the co-participating party sent a copy of its passport. The co-participating party wished to receive the information electronically.

Assessment of evidence: It is undisputed that the co-participating party submitted a request for information. The fact that the request for information should contain all police entries, EKIS queries and GREKO, that the co-participating party wishes the information to be transmitted electronically and that the co-participating party has submitted a copy of their passport is clear from the request for information from the co-participating party submitted by the complainant.

2. The complainant processed the co-participating party's request for information by letter dated October 19, 2020 and arranged for delivery to the registered address "**** P***hausen, B***straße 4*" provided by the co-participating party in its request for information by means of an RSa letter.

Assessment of evidence: This is clear from the consistent submissions of the parties. The fact that the address "**** P***hausen, B***straße 4*" was provided by the co-participating party is clear in particular from the request for information from the co-participating party submitted by the complainant. The fact that the co-participating party was registered at the address "**** P***hausen, B***straße 4*" from September 3rd, 2020 is evident from the ZMR extract submitted by the complainant (accessed on November 25th, 2020) on the co-participating party.

3. The post office informed the complainant by returning the information that the co-participating party was absent from the address "**** P***hausen, B***straße 4*".

Assessment of evidence: This is evident from a copy of the returned postal item submitted by the complainant, on which the note "Absent from the area until September 9th, 2021" can be found.

4. The complainant made a new delivery attempt with RSa letter to the co-participating party's main residence, "**** R***tal, I***weg *5/*7", which has existed since February 3rd, 2021.

Assessment of evidence: The fact that the co-participating party had been registered at the address "**** R***tal, I***weg *5/*7" since February 3, 2021 is evident from a ZMR extract submitted by the complainant (accessed on April 9, 2021). The fact that the complainant made a new attempt to deliver to this address is evident from a copy of the RSa letter addressed to "Dr. Sonja A***, I***weg *5/*7, **** R***tal" submitted by the complainant.

5. The post office informed the complainant by returning the information that the co-participating party was absent from the address "**** R***tal, I***weg *5/*7".

Assessment of evidence: This is evident from a copy of the returned postal item submitted by the complainant, which is marked "Absent from the area".

6. The complainant did not send the requested information to the co-participating party by email.

Assessment of evidence: This is clear from the consistent submissions of the parties.

7. After the second unsuccessful delivery attempt - due to the co-participating party's absence - the complainant delivered the information dated 19 October 2020 to the co-participating party by depositing it with the BMI (Department III/7/a) in accordance with Section 8 Paragraph 2 in conjunction with Section 23 of the Delivery Act.7. After the second unsuccessful delivery attempt - due to the co-participating party's absence - the complainant delivered the information dated 19 October 2020 to the co-participating party by depositing it with the BMI (Department III/7/a) in accordance with Paragraph 8 Paragraph 2 in conjunction with Paragraph 23 of the Delivery Act.

Assessment of evidence: This is clear from the comprehensible and credible statement made by the complainant on October 27, 2021.

8. The co-participating party is staying abroad for an indefinite period of time. Despite the complainant's request, it has not named an authorized delivery agent in Austria.

Assessment of evidence: This is clear from an email from the co-participating party addressed to the complainant on November 9, 2020 ("(...) I am abroad and will stay here for an indefinite period of time, which could be several years. There will definitely never be a delivery address in Austria again. There is neither a delivery address nor an authorized delivery agent in Austria (...))". This email was submitted by both the co-participating party and the complainant. The fact that the complainant asked the co-participating party to appoint a person authorized to receive service is evident from an email from the complainant to the co-participating party dated November 9, 2020 at 8:** a.m., which the complainant has submitted.

D. From a legal point of view, this means:

1. In the present case, Chapter 3 (sections 36-61) of the Data Protection Act, which implements Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences (hereinafter: Data Protection Directive in the area of justice and home affairs), applies, which was not disputed by the parties to the proceedings.1. In the present case, Chapter 3 (sections 36-61) of the DSG, which implemented Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences (hereinafter: Data Protection Directive for the Area of Justice and Home Affairs), applies, which was not disputed by the parties to the proceedings.

According to Section 44 DSG, every data subject has the right to receive information from the controller as to whether or not he or she processes his or her personal data. If so, the data subject has the right to receive the information in accordance with Section 44, Paragraph 1, Items 1 to 7 DSG.

According to Section 44, DSG, every data subject has the right to receive information from the controller as to whether or not he or she processes his or her personal data. If so, the data subject has the right to receive the information in accordance with Section 44, Paragraph 1, Items 1 to 7 DSG. The Data Protection Directive in the area of Justice and Home Affairs further states in its last sentence, Article 12(1): ‘The information shall be transmitted in any appropriate form, including electronic transmission. In principle, the controller shall transmit the information in the same form in which the request was received.’The Data Protection Directive in the area of Justice and Home Affairs further states in its last sentence, Article 12(1): ‘The information shall be transmitted in any appropriate form, including electronic transmission. In principle, the controller shall transmit the information in the same form in which it received the request.”

Article 12, paragraph 1, last sentence of the Data Protection Directive for the area of justice and home affairs was implemented as follows in Section 42, paragraph 4, last sentence of the DSG: “If the data subject submits the request electronically, he or she shall be informed electronically if possible, unless he or she indicates otherwise.”Article 12, paragraph 1, last sentence of the Data Protection Directive for the area of justice and home affairs was implemented as follows in Section 42, paragraph 4, last sentence of the DSG: “If the data subject submits the request electronically, he or she shall be informed electronically if possible, unless he or she indicates otherwise.”

It should also be noted at this point that Article 12, paragraph 3, last sentence of the GDPR - although this provision does not apply here - has the same wording as Section 42, paragraph 4, last sentence of the DSG.It should also be noted at this point that Article 12, paragraph 3, last sentence of the GDPR - although this provision does not apply here does not apply - has the same wording as paragraph 42, paragraph 4, last sentence DSG.If a request for information is made - as in the present case - the controller must make all necessary efforts to ensure that the information provided actually reaches the person concerned. 2. In the complainant's view, it was necessary to deliver the information to the recipient's own hands. The complainant justifies this by arguing that he is an authority and therefore Section 21 AVG applies to him, according to which deliveries must be made in accordance with the ZustG. Furthermore, Section 22 AVG also applies to him, the first sentence of which stipulates that a written copy with proof of delivery must be delivered if there are important reasons for doing so. The second sentence of Section 22 AVG, which is also relevant, states that if there are particularly important reasons or if it is provided for by law, delivery must be made to the recipient's own hands. In proceedings D124.3435 before the data protection authority, the complainant stated that information from the BMI regularly contains data relevant to criminal law, which must be handled with care. The complainant therefore assumes that there is a "particularly important reason" within the meaning of the second sentence of Section 22 AVG, which is why such information must be delivered by post to one's own address (i.e. by RSa letter) in accordance with Section 21 ZustG ("delivery to one's own address"). If, on the other hand, the complainant does not want to deliver by post but electronically, he must comply with Section 3 ZustG ("Electronic delivery"). Section 28 Paragraph 4 ZustG, in turn, stipulates that electronic deliveries with proof of delivery are only permitted through delivery systems in accordance with Section 28 Paragraph 3 Items 1 and 3 and, in the case of Section 37a, the second sentence of ZustG. The fact that information to be provided electronically by the complainant in accordance with Section 44 DSG can only be delivered with proof of delivery (and not by simple email) follows from the fact that the data to be disclosed is criminally relevant data that must be handled with care. In any case, this represents an important reason within the meaning of the first sentence of Section 22 AVG, which obliges authorities to provide delivery with proof of delivery. Now, according to the second sentence of Section 37a ZustG, which represents a form of delivery with proof of delivery, identity must be proven by means of a citizen card. However, since the co-participating party did not prove his identity with a citizen card, the complainant should not have delivered the information dated October 19, 2020 to the co-participating party by simple email.2. In the complainant’s opinion, it was necessary to deliver the information himself. The complainant justifies this by saying that he is an authority and therefore Section 21 AVG applies to him, according to which deliveries must be made in accordance with the ZustG. Furthermore, Section 22 AVG also applies to him, the first sentence of which stipulates that a written copy with proof of delivery must be delivered if there are important reasons for doing so. The equally relevant second sentence of Paragraph 22, AVG, states that if there are particularly important reasons or if it is provided for by law, delivery must be made to the recipient’s own hands. In proceedings D124.3435 before the Data Protection Authority, the complainant stated that information from the BMI regularly contains data relevant to criminal law which must be handled with care. The complainant therefore assumes that there is a “particularly important reason” within the meaning of the second sentence of Paragraph 22, AVG, which is why such information must be delivered by post to the recipient’s own hands (i.e. by RSa letter) in accordance with Paragraph 21, ZustG (“Delivery to the recipient’s own hands”). If, on the other hand, the complainant wishes to deliver electronically rather than by post, he must comply with Section 3 of the ZustG (“Electronic delivery”). Paragraph 28, Paragraph 4, ZustG, in turn, stipulates that electronic deliveries with proof of delivery are only permitted through delivery systems in accordance with Paragraph 28, Paragraph 3, Numbers one and 3, and in the case of Paragraph 37a, second sentence, ZustG. The fact that information from the complainant to be provided electronically in accordance with Paragraph 44, DSG can only be delivered with proof of delivery (and not by simple email) is due to the fact that the data to be disclosed is data relevant to criminal law and must be handled with care. In any case, this represents an important reason within the meaning of the first sentence of Paragraph 22, AVG, which requires authorities to deliver with proof of delivery. Now, in accordance with Paragraph 37a, second sentence, ZustG, which represents a form of delivery with proof of delivery, identity must be proven using a citizen card. However, since the party involved did not prove their identity with a citizen card, the complainant was not allowed to send the information dated October 19, 2020 to the party involved by simple email.

3. When the complainant states that, as an authority, he has to apply the AVG and subsequently also the ZustG, he is to be agreed with in principle, but it should be pointed out that the complainant also has to apply Chapter 3 of the DSG: Chapter 3 of the DSG now implements the Data Protection Directive for the area of justice and home affairs at national level, which is to be applied by the authorities responsible for the prevention, investigation, detection or prosecution of criminal offenses, and thus also by the complainant as the highest "security authority." Since the AVG and the ZustG are to be applied by administrative authorities in general, but Chapter 3 of the DSG only by the authorities responsible for the prevention, investigation, detection or prosecution of criminal offences, Chapter 3 of the DSG represents a “lex specialis” in relation to the AVG and the ZustG.

In the present case, the last sentence of Section 42, Paragraph 4 of the DSG is therefore relevant: “If the data subject submits the application electronically, he or she shall be informed electronically if possible, unless he or she indicates otherwise.” In the present case, the last sentence of Section 42, Paragraph 4 of the DSG is therefore relevant: “If the data subject submits the application electronically, he or she shall be informed electronically if possible, unless he or she indicates otherwise.”

In the present case, the last sentence of Section 42, Paragraph 4 of the DSG is to be interpreted in the light of Article 12, Paragraph 1 of the Data Protection Directive in the area of justice and home affairs. As already explained, Article 12(1) requires that information be transmitted, among other things, in any appropriate form, including electronic transmission, whereby the controller shall, in principle, transmit the information in the same form in which the request was received. Paragraph 42, paragraph 4, last sentence of the DSG is to be interpreted in the light of Article 12, paragraph one, of the Data Protection Directive in the area of justice and home affairs. As already explained, Article 12, paragraph one requires that information be transmitted, among other things, in any appropriate form, including electronic transmission, whereby the controller shall, in principle, transmit the information in the same form in which the request was received.

Article 12, paragraph 1 of the Directive therefore postulates that, as a rule, information must be transmitted in the same form in which the controller received the request for information. Any deviation from this principle therefore requires justification.Article 12, paragraph one of the directive therefore states that, as a general rule, information must be provided in the same form in which the controller received the request for information. Any deviation from this principle therefore requires justification.

It should be emphasized at this point that the wording of Article 12, paragraph 1 of the directive, which - as already explained - regulates the processing of "criminal data", goes beyond that of Article 12, paragraph 1 of the GDPR:It should be emphasized at this point that the wording of Article 12, paragraph one of the directive, which - as already explained - regulates the processing of "criminal data", goes beyond that of Article 12, paragraph one of the GDPR:

Article 12, paragraph 1 of the GDPR stipulates that information must be provided in writing or in another form, including electronically if necessary. According to Article 12(3) GDPR, the data subject must be informed electronically wherever possible, unless they specify otherwise. Unlike Article 12(1) of the directive, electronic transmission is therefore not standardized as a principle within the scope of application of the GDPR. Article 12(1) GDPR stipulates that the information must be transmitted in writing or in another form, including electronically where appropriate. According to Article 12(3) GDPR, the data subject must be informed electronically wherever possible, unless they specify otherwise. Unlike Article 12(1) of the directive, electronic transmission is therefore not standardized as a principle within the scope of application of the GDPR.

In any event, it can be concluded from this that, within the scope of the Data Protection Directive in the area of justice and home affairs, even though it essentially concerns the processing of ‘more sensitive information’ – namely information about criminal offences – the Union legislature deliberately opted for the principle – and not just the option – of transmission via the (electronic) means by which the controller received the request.

It cannot be inferred from the Data Protection Directive in the area of justice and home affairs that the Union legislature had a specific (secure) form of transmission in mind, which is also supported by the wording of Article 12(1), last sentence (‘in the same form in which it received the request’).It cannot be inferred from the Data Protection Directive in the area of justice and home affairs that the Union legislature had a specific (secure) form of transmission in mind, which is also supported by the wording of Article 12, paragraph 1, last sentence (‘in the same form in which it received the request’).

In addition, the Austrian legislature does not necessarily require a specific form of service in comparable cases, in particular personal service:

According to Sections 47 and 48 of the Administrative Penalty Act, the authority can issue penal orders in an abbreviated procedure if the necessary requirements are met. These contain the accusation of a criminal offense (administrative offense) and can therefore - following the case law of the ECJ (see the judgment of June 22, 2021, C-439/19, para. 77 ff) - be qualified as "criminal data" within the meaning of Art. 10 GDPR and thus also as a "criminal offense" within the meaning of the Data Protection Directive for the area of justice and home affairs (see Recital 13).According to Sections 47 and 48 of the Administrative Penalty Act, the authority can issue penal orders in an abbreviated procedure if the necessary requirements are met. These contain the accusation of a criminal offence (administrative offence) and can therefore - following the case law of the ECJ (see the judgment of 22 June 2021, C-439/19, para. 77 ff) - be qualified as "criminal data" within the meaning of Article 10, GDPR and thus also as a "criminal offence" within the meaning of the Data Protection Directive for the area of justice and home affairs (see its recital 13).

While until the amendment in Federal Law Gazette I No. 33/2013, penalty orders had to be served "in one's own hands" in accordance with Section 48 (2) of the Administrative Offenses Act, this is no longer provided for since this amendment. The explanations for this (2009 of the appendices XXIV. GP p. 22) state that personal delivery should be "abandoned in the interest of saving costs". While until the amendment to the Federal Law Gazette Part One, No. 33 of 2013, penalty orders had to be delivered "in person" in accordance with Paragraph 48, Paragraph 2, VStG, this is no longer provided for since this amendment. The explanations for this (2009 of the appendices Roman XXIV. GP p. 22) state that personal delivery should be "abandoned in the interest of saving costs".

A further example of the permissible delivery of "sensitive data" pursuant to Article 9(1) GDPR by email can be found in Section 27(12b) GTelG 2012 (as amended by Federal Law Gazette I No. 34/2021). A further example of the permissible delivery of "sensitive data" pursuant to Article 9(1) GDPR by email can be found in Section 27(12b) GTelG 2012 as amended by Federal Law Gazette Part One No. 34 of 2021.)

In summary, it can therefore be stated – contrary to the complainant’s view – that neither Union law nor comparable domestic law necessarily requires that information, which may also contain ‘criminal data’ or even special categories of personal data pursuant to Article 9(1) of the GDPR, be delivered personally and under no circumstances by email.In summary, it can therefore be stated – contrary to the complainant’s view – that neither Union law nor comparable domestic law necessarily requires that information, which may also contain ‘criminal data’ or even special categories of personal data pursuant to Article 9(1) of the GDPR, be delivered personally and under no circumstances by email.

If the complainant argues that he is bound by the ZustG pursuant to Section 21 AVG, this cannot be contradicted. However, he overlooks the fact that the ZustG does not preclude delivery by email (Section 28, Paragraph 3 in conjunction with Section 37, Paragraph 1 and Section 2, Item 5 of the ZustG) and - as explained above - the delivery of information does not necessarily have to be carried out in accordance with the requirements of Section 22 of the AVG.If the complainant argues that he is bound by the ZustG in accordance with Section 21 of the AVG, this cannot be contradicted. However, he overlooks the fact that the ZustG does not preclude delivery by email (Section 28, Paragraph 3, in conjunction with Section 37, Paragraph 1 and Section 2, Item 5 of the ZustG) and - as explained above - the delivery of information does not necessarily have to be carried out in accordance with the requirements of Section 22 of the AVG.

4. The co-participating party who submitted their request for information electronically by email and who expressly wished to receive the information electronically should therefore have received it electronically in accordance with Section 42, Paragraph 4, last sentence of the DSG. However, since the complainant did not send the information electronically to the co-participating party, he violated their right to information.4. The co-participating party who submitted their request for information electronically by email and who expressly wished to receive the information electronically should therefore have received it electronically in accordance with Section 42, Paragraph 4, last sentence of the DSG. However, since the complainant did not send the information electronically to the co-participating party, he violated their right to information.

Finally, reference should be made to the provision of Section 44, Paragraph 7 of the DSG, according to which the controller may request additional information necessary to confirm the identity of the person who - as in the present case - has submitted a request in accordance with Section 44 DSG. In addition, the decision of the VwGH of 4 July 2016, Ra 2016/04/0014, should also be cited here, which was issued in relation to the old legal situation of the DSG 2000, but whose assessment can be adopted for the current legal situation: Finally, reference should be made to the provision of Paragraph 44, Paragraph 7, DSG, according to which the controller may request additional information necessary to confirm the identity of the person who - as in the present case - has submitted an application in accordance with Paragraph 44, DSG. In addition, the ruling of the VwGH of July 4, 2016, Ra 2016/04/0014, should also be cited here, which was issued in relation to the old legal situation of the DSG 2000, but whose assessment can be adopted for the current legal situation:

"The provision of Section 26 DSG 2000 has the clearly identifiable purpose of putting a stop to the misuse of the right to information for the purpose of obtaining information by third parties. A client may not transmit any data to the information requestor - who they can only assume at that moment is actually the person concerned - without proof of identity, because otherwise they could violate data secrecy in accordance with Section 15, Paragraph 1 DSG 2000. Proof of identity must be in a form that enables the client to verify the identity of the information requestor with the person whose data is to be the subject of the information. In view of the objectives of the law and in order to prevent misuse, a high degree of reliability with regard to proof of identity is required (Note E of 9 September 2008, 2004/06/0221, mwN).""The provision of Paragraph 26, DSG 2000 has the clearly identifiable purpose of putting a stop to the misuse of the right to information for the purpose of obtaining information by third parties. A client may not transmit any data to the information requestor - who the client can only assume at that moment is actually the person concerned - without proof of identity, as this could otherwise violate data secrecy in accordance with Paragraph 15, Paragraph one, DSG 2000. Proof of identity must be in a form that enables the client to verify the identity of the information requestor with the person whose data is to be the subject of the information. In view of the aim of the law and to prevent abuse, a high degree of reliability with regard to proof of identity is required (Note E of 9 September 2008, 2004/06/0221, mwN)."

As the complainant - as established - made two attempts to deliver the information to the other party himself, he evidently had no doubts about the identity of the other party, which is why the information could also have been sent to the other party by email for this reason.

Furthermore, it should be noted that according to the case law of the VwGH, personal delivery cannot replace the requirement of a prior identity check (VwSlg. 17.515 A/2008).

In view of the above, the decision was to be made in accordance with the ruling.