VwGH - Ro 2021/04/0010-11: Difference between revisions

Revision as of 08:59, 18 March 2024

VwGH - VwGH Ro 2021/04/0010-11

Court:	VwGH (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 4(4) GDPR Article 9(2)(g) GDPR Article 22 GDPR Article 1 §2 DSG §25(1) AMSG §38(c) AMSG
Decided:	21.12.2023
Published:	20.02.2024
Parties:	Austrian Data Protection Authority Public Employment Service Austria
National Case Number/Name:	VwGH Ro 2021/04/0010-11
European Case Law Identifier:	ECLI:AT:VWGH:2023:RO2021040010.J09
Appeal from:	BVwG W256 2235360-1
Appeal to:	Unknown
Original Language(s):	German
Original Source:	VwGH (in German)
Initial Contributor:	ec

The Austrian Supreme Administrative Court held that an algorithm in itself is an automated decision even if the final decision is made by a human who was provided instructions and training to question the algorithm’s decision-making.

English Summary

Facts

Austrian Data Protection Authority (DSB) issued a ban against the processing of data by the Public Employment Service in Austria. The controller, the Public Employment Service in Austria, supports workers in (re)integrating into the labour market by offering various services, including a counsellor that discusses labour market opportunities with the jobseeker.

In order to assess the jobseeker’s labour market opportunities, the controller used an algorithm to calculate the degree of probability for jobseekers to be employed for a certain number of days, based on: (1) age group, (2) gender, (3) country group, (4) education, (5) health impairment, (6) care responsibilities, (7) occupational group, (8) career history and (9) the regional labour market situation and the duration of cases at the controller.

It did not include motivation, self-help potential of the jobseeker, addiction, debt or housing situation. Based on this, the algorithm divided jobseekers into the following three groups: (1) Service jobseekers with high labour market opportunities (2) Care jobseekers with low labour market opportunities (3) Consultancy jobseekers with medium labour market opportunities

The result was used as a starting point for counsellors to work with jobseekers to assess their potential and any obstacles in the labour market integration.

The controller claimed it had a legal basis under Austrian national law (the Arbeitsmarktservicegezetz, AMSG) to process data with the help of an algorithm. According to Article 4(4) GDPR, this processing of data is considered profiling. However, the DPA found that a legal authorisation for this processing was lacking in the AMSG, which is necessary under Austrian data protection law (see Article 1 §2 DSG).

The DPA also found there was a case of automated individual decision-making under Article 22 GDPR. Although the results of the algorithm are not binding as the final decision lies with the counsellor, the DPA contested that it cannot be ruled out that in individual cases, the decision will be based exclusively on profiling.

Therefore, the DPA issued a ban due to lack of a sufficient legal basis for the processing.

The controller appealed this decision at the Bundesverwaltungsgerichts (the Federal Administrative Court).

The Federal Administrative Court upheld the controller’s appeal against the decision of the DPA. In its reasoning, the Court stated that the controller should ensure there is a support plan between the counsellor and jobseeker. Moreover, the controller should provide counsellors with instructions and training to ensure they do not accept the result of the algorithm unquestioningly.

The Court held that the controller is allowed to carry out an assessment of personal data in accordance with national law (see §25(1) AMSG ). Moreover, it cannot be assumed that the mere use of automated processing already results in “informational added value”. Moreover, Article 22 GDPR does not apply, as the final decision lies with the counsellors and therefore the decision-making is not based solely on automated processing. The Court concluded that the DPA decision should be annulled due to the lack of violation of the principle of lawful data processing under Article 5(1)(a) GDPR.

The DPA appealed the decision before the Verwaltungsgerichtshof (Supreme Administrative Court).

Holding

The Supreme Administrative Court found that the lawfulness of the data processing at issue in the proceeding must be examined, because under Austrian national law (see §38c AMSG) the data processing in question is a private-sector activity and not a public service task.

The DPA argued that the Federal Administrative Court did not take into account the character of profiling as a special processing procedure and challenged the lawfulness of the processing under Article 22 GDPR.

The Court found that the controller’s algorithm in itself is an automated decision under Article 22(1) GDPR based on the recent CJEU decision C-634/21 - Schufa. The Court explained that the algorithm decides on the allocation of jobseeker’s group and thus has a legal effect on the jobseekers concerned or similarly significantly affects them. The fact that the final decision on the jobseeker’s group assignment lies with the counsellor, does not prevent the algorithm from being classified as an automated decision under Article 22(1) GDPR. The CJEU decision is also based on the fact that the controller makes the final decision. The Supreme Administrative Court found that the instructions and trainings that were provided to ensure counsellors would not accept the algorithm’s results unquestioningly could not exclude the possibility that the algorithm is ultimately decisive for the allocation.

The Court further held that the algorithm did not fall under the exceptions of Article 22(2) GDPR. Therefore, the Court concluded that the appeal had to be upheld and that the decision of the Court of Appeal needed to be set aside.

Comment

In paragraph 15 and 20 of the decision, the Court refers to Article 9(2)(d) GDPR, which is incorrect. It should be Article 9(2)(g) GDPR, which is about the substantial public interest.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Ro 2021/04/0010-11
December 21, 2023

I M N A M E N D E R R E P U B L I K!

The Administrative Court has through the presiding Senate President

Dr. Kleiser, Councilor Dr. Mayr, court councilor Mag. Hainz-Sator and the court councilors

Dr. Pürgy and Mag. Brandl as judges, with the participation of the secretary
Mag. Vonier, about the data protection authority's appeal against the finding

of the Federal Administrative Court of December 18, 2020,
Zl. W256 2235360-1/5E, concerning a data protection matter

(Participating party: Employment Service, represented by Brauneis Klauser
Prändl Rechtsanwälte GmbH in 1010 Vienna, Bauernmarkt 2;

other party: Federal Minister of Justice), rightly recognized:

The contested finding is due to illegality of the content

lifted.

Reasons for the decision:

1 1. The contested finding is based on the following undisputed facts
remove:

2 The co-participating party (hereinafter: mP), in the proceedings before the

Administrative Court regularly referred to as the “Austrian Labor Market Service”

referred to, is responsible according to Section 1 Paragraph 1 of the Employment Services Act (AMSG).
Implementation of the federal labor market policy” and it is referred to as “a

Service companies under public law with their own
Legal personality” is defined.

3 To help workers (re)integrate into the labor market
To support this, the mP offers various services. The

The detailed procedure of the consultants employed for this purpose can be found in the
“Federal Guideline” of the Labor Market Service “Core Process Workers

support”. This states that consultants in the process
a consultation with job seekers

Wishes/expectations, their previous life course and the reasons for their

have to explain unemployment. The labor market opportunities of
Job seekers should be addressed and discussed.

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

2 of 53

4 To help the consultants assess the labor market opportunities of the

The mP has been developing a concept to support job seekers since 2016
for calculating labor market opportunities

Labor Market Opportunities Assistance System (AMAS). This model should be from

mP consultants will be mandatory from January 1, 2021.

5 This statistical model uses an algorithm to determine the degree of

Probability for job seekers automatically calculated,
a certain number within a certain period of time in the future

to be busy for days. Specifically, this is based on the following
Data an “IC” is calculated:

age group,

Gender,

group of states,

Education,
health impairment,

care obligations,

professional group,

pre-career,
regional labor market events as well

Duration of the business case at mP.

6 Based on the “IC”, job seekers are divided into the following

three groups:

Service customers with job market opportunities are high
Care customers with labor market prospects low

Advice clients with medium labor market prospects.

7 The results of the AMAS should be used in the consultation process and for

The consultants can be a starting point to work together with the customers
Assessment of the respective potential and, if necessary, the obstacles

of labor market integration. Based on these

The aim is to define the optimal care strategy. Has he

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

3 out of 53

Job seekers expressly have a different assessment of the

Labor market opportunities than the consultants, this is in the
Document care agreement.

8 AMAS does not take into account criteria such as motivation, self-help potential
Customers, addiction, debts, housing situation, etc.

9 2. After the initiation of an ex officio examination procedure in accordance with
Art. 57 Para. 1 lit. h in conjunction with Art. 58 Para. 1 lit. b and Para. 2 lit. a GDPR in conjunction with

Section 22 Paragraph 1 DSG was notified to the mP by the appeal applicant

from August 16, 2020 data processing in connection with
Determination of labor market opportunities for job seekers

With the help of the Labor Market Opportunities Assistance System (AMAS).
Effective January 1, 2021, “unless there are any by this point in time.”

there is a suitable legal basis for data processing.”

10 In summary, the appellant gave reasons in her decision

that data processing takes place with the help of AMAS
Within the framework of the exercise of the rights transferred to the mP in accordance with Section 1 Paragraph 1 AMSG

public tasks. For an authority it is in accordance with Section 1 Paragraph 2 DSG

it is necessary that their data processing is sufficient
determined legal authorization. The § 29 mentioned by the mP

and Section 31 Paragraph 5 AMSG would only generally describe the goal and the
Specify the fulfillment of tasks by the mP, but not for data processing

authorize. The data processing in question is the issue
This is a profiling within the meaning of Art. 4 Z 4 GDPR, through which a

“informational added value” comes about, which is stated in the law

must be expressly referred to. The present
Data processing cannot be based on a suitable legal basis

support. In addition, there is a case of Art. 22 GDPR, namely an automated one
individual decision. It should be admitted that the final decision

due to internal guidelines lies with the mP consultants. This

However, internal instructions for action would not bind the mP
unfold and are therefore not subject to any verification controls. In addition

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

4 out of 53

It cannot be ruled out that in individual cases the decision will be made exclusively

based on profiling.

11 3. The Federal Administrative Court issued the contested finding

(BVwG) of the mP's complaint against the appeal applicant's decision

Followed and repealed the contested decision without replacement. The audit explained it
below one for permissible.

12 In addition to the findings already presented at the beginning, the BVwG made in
his reasons also include the findings that only after the

Discussing the optimal support strategy with customers

would be defined by the consultants based on a supervision agreement.
To ensure that the consultants do not have the result of the algorithm

would take over without question, have the mP in addition to those shown
Guidelines also provide appropriate instructions for action

Training conducted.

13 In its legal assessment, the BVwG stated in an ex officio manner

The appellant is responsible for the examination proceedings initiated

Supervisory authority in the event of a violation of the GDPR being detected
the power to order various remedial measures. Matter

The complaint procedure before the BVwG can only be examined
Legality of the specific order made in connection with

the violation on which the supervisory authority is based. In the

In the present case, it can be assumed that the appellant is
Prohibition issued by official notice solely because of the lack of one

sufficient legal basis for official action.
A legality assessed in the contested decision

The BVwG is prohibited from further checking data processing.

14 Art. 9 Paragraph 2 Letter h GDPR refers, according to its wording, to one

Data processing for health-related purposes. In the present case be

this provision cannot therefore be relied upon without further ado.

15 It follows from Art. 6 Para. 1 lit. e GDPR and Art. 9 Para. 2 lit. d GDPR that

the processing of personal data can be lawful if

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023
5 out of 53

the processing for a sovereign or other public interest
underlying task or in the case of processing special categories

personal data due to significant public interest

was required. In this context it is according to the provisions of
GDPR is irrelevant whether the person responsible is an authority or

a private body and in which - sovereign or
private sector - form the controller may take action if necessary.

What is more important is whether a matter is public
or significant public interest is required and a legal requirement

regulated data processing is carried out. Art. 6 Paragraph 3 GDPR
specifies content requirements for an appropriate legal basis,

which are clear and precise in the context of recital 41 of the GDPR
and should be predictable for those subject to the law. Related

Art. 9 Para. 2 lit. g GDPR also stipulates that the corresponding
Legal basis appropriate and specific measures to safeguard the

should provide for the fundamental rights and interests of the persons concerned. Nothing

otherwise see § 1 Para. 2 DSG, Federal Law Gazette I No. 165/1999 as amended by Federal Law Gazette I No. 14/2019,
provided that the data processing is carried out by the state authorities. The

Union law provisions - Art. 6 and Art. 9 GDPR - would generally
a task in the considerable public interest and - accordingly

not limited to sovereign activities - one is sufficient
Demand a specific legal basis for data processing. It

It can therefore remain open in the present case whether the mP
procedural data processing in sovereign or

in a private law form. Rather, it comes because of the
data processing that is the subject of the procedure also includes health data and

thus special categories of data within the meaning of Art. 9 Para. 1 GDPR
are included, depends on whether the data processing that is the subject of the procedure

on an appropriate legal basis and for a task by the MP

is necessary in the significant public interest.

16 The mP is a service company under public law with its own
Legal personality, which is responsible for the implementation of the labor market policy of the

federal responsibility. According to Section 29 Paragraph 1 AMSG, the mP has a

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

6 out of 53

as complete, economically sensible and sustainable as possible

Bringing together labor supply and labor demand
to work towards supplying the economy with workers and the

Employment of all people available on the labor market
to secure it as best as possible. The mP is held in accordance with Section 29 Paragraph 2 AMSG

efficient placement of suitable workers
To create jobs that, as far as possible, correspond to the placement wishes

provide the job seeker with appropriate employment and the

Effect of circumstances that have a direct mediation in this
to help overcome the senses. The principles are:

Economy, economy and practicality must be taken into account and it is
It is also important to ensure that groups of people who are particularly affected by

If people are threatened with unemployment, appropriate support services are offered
would.

17 Section 25 Paragraph 2 AMSG expressly authorizes the mP to do so
Processing of those involved in the proceedings

personal data, provided this is necessary to fulfill legal requirements
Task is an essential prerequisite. That of the mP is therefore legal

The task of ensuring an orderly system assigned by Section 29 AMSG

and well-functioning labor market is undoubtedly a significant one
public interest within the meaning of Art. 9 Para. 2 lit. g GDPR.

18 In addition, it is undisputed that it is also necessary to take into account personal characteristics

of job seekers in combination with the general

Labor market events and the resulting application opportunities
of job seekers on the labor market to take into account the

The task of optimally supplying the economy with workers and the
To secure employment for job seekers in the best possible way

can. The relevance of the procedural subject matter in data processing
The personal data included cannot be disputed

become. There are therefore no concerns that the MP should be used to “ensure

“Ordinary labor market policy” is the subject matter of the proceedings
may use personal data to ensure a “proper

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

7 out of 53

to secure labor market policy”. § 25 Para. 10 AMSG meets before the

Background to the requirements of the GDPR and the DSG
Related comprehensive appropriate technical and

organizational measures to ensure compliance with the principles of

GDPR and processing in accordance with the DSG. About the of
In addition to the measures mentioned in recital 78, see Section 25 (10) AMSG

additional specific requirements to ensure the
Data security.

19 The fundamental right of the mP to evaluate the
Labor market opportunities for job seekers based on certain personal characteristics

The appellant does not doubt that data should be provided
pulled. An “informational” accepted by the appeal applicant

Added value” of one based on the same personal data

Assessment of labor market opportunities can - whether the assessment is not
automated or based on profiling - for data protection reasons

View cannot be recognized because each evaluation is also weighted
the evaluator is based on.

20 In addition, a different assessment could affect the legality of a
Data processing relating to Article 6 Paragraph 1 Letter e or Article 9

Paragraph 2 lit. d GDPR cannot be derived because these provisions do not

distinguish between automated and non-automated processing
would only focus on the concept of processing in general

would. Art. 4 Z 1 GDPR in turn defines using an example
List the processes there in connection with personal data

Data as processing, regardless of whether this is done with or without help
automated procedures are carried out. That Art. 4 Z 4 GDPR

I exclusively refer to automated processing separately as profiling,

highlight this significant use case and make it clear that these
Form of processing falls within the scope of application of the GDPR and the

must meet the general criteria there.

21 Art. 22 GDPR in turn states that a data subject has the right

should have no decision to evaluate aspects that concern them

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023
8 out of 53

to be subjected exclusively to an automated
Processing would be based and legal effect for the data subject

develop or significantly impair them in a similar way. Art. 22 GDPR

I therefore only aim at decisions that are devoid of any human touch
intervention would take place. However, this provision limits profiling

not as such in its legal admissibility as part of a
Decision support. As stated, they should

algorithm used in the procedure and those calculated from it
Labor market opportunities merely as a source of information for a decision

of the mP consultants can be used. The final decision
about the job seekers' labor market opportunities should be with the consultants

remain. In this regard, internal guidelines and guidelines would be issued by the mP
Instructions for action exist and training courses are carried out. The according to § 4

Paragraph 2 Z 2 AMSG guidelines are for the fulfillment of the tasks
the mP is binding for all bodies and institutions. In the federal guidelines

“Supporting the workforce as a core process” is the exact process in relation to

the assessment of labor market opportunities is specified and explicit
stipulated that the mP consultants would use the calculated labor market opportunities

to be discussed with the person concerned during a consultation
would have to document a contrary view of the person concerned and

ultimately have to decide about it. Given these clear guidelines
There would be no reasons for this to be a completely automated decision

within the meaning of Art. 22 GDPR. With the argument of
Appellant, it was not due to the shortened consultation times

to rule out that ultimately a completely automated decision
would be available because the mP consultants calculated it from AMAS

would routinely adopt this value, overlooking the fact that the assessment,
whether data processing is lawful in accordance with Art. 5 Para. 1 lit. a GDPR

is, from the assessment of whether the person responsible is the legality of a

to ensure such data processing. At the
Assessment of the lawfulness of data processing is based on the actual

Processing process and possible violations by third parties do not apply
enter into. Whether the MP ultimately fulfills its obligation in accordance with Article 5

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

9 out of 53

Paragraph 1 lit. f GDPR adequately and unauthorized use

excludes the data processing in question
The subject of the complaint procedure at issue. Ultimately

In this context, it should be noted that the applicant for appeal in

contested decision itself assumes that the mP
Appropriate measures “internal to the organization” to protect the

Job seekers hit and thus an abusive use
data processing by their employees is appropriately excluded

have.

22 In summary, it should be noted that the mP according to Section 25 Paragraph 1 AMSG

is fundamentally entitled to evaluate personal data
to be carried out. That from the mere use of an automated

Processing does not result in “informational added value”.

to accept. The case frowned upon in Article 22 of the GDPR is just on one
The decision based on automated data processing does not lie here

because - as shown - the final decision lies with the consultants.
Whether the mP fulfills its obligation under the GDPR to prevent an unauthorized person

Excluding use by taking appropriate measures is sufficient

has complied with is not the subject of the assessment of the
Legality of limited present proceedings. Since the present one

Data processing can therefore rightly be based on Section 25 Paragraph 1 AMSG
can, the contested decision is due to a lack of violation of the provisions of Article 5

Paragraph 1 lit. a GDPR standardized principle of a lawful
to cancel data processing.

23 The appeal is admissible because (among other things) it comes to the highest court
Case law on Articles 6, 9 and 22 GDPR in connection with profiling

missing.

24 4. The ordinary appeal of the defendant is directed against this decision

authority before the administrative court.

25 The mP filed a complaint in the preliminary proceedings before the BVwG

Revision response.

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

10 out of 53

5. The Administrative Court considered:

26 The revision refers to the statements of the BVwG regarding
Admissibility of the appeal and that the highest court case law

on the requirement of certainty of legal regulations against the background of
GDPR and the question of the interpretation of the criterion of “similar

“significant impairments” within the meaning of Article 22 GDPR are missing.

27 For these reasons, the appeal is admissible and ultimately justified.

28 5.1. The legal basis:

29 5.1.1. The case-specific relevant recitals and provisions of the

Regulation (EU) 2016/679 of the European Parliament and of the Council of
April 27, 2016 on the protection of natural persons during processing

personal data, the free movement of data and the abolition of the
Directive 95/46/EC (General Data Protection Regulation - GDPR), OJ L 119

dated May 4, 2016, p. 1, are as follows:

“(10) In order to ensure a uniform and high level of data protection for natural persons
to ensure people and the barriers to traffic
to eliminate personal data in the Union, the level of protection should be increased

for the rights and freedoms of natural persons during processing
this data must be equivalent in all Member States. The regulations for
Protection of the fundamental rights and freedoms of natural persons
Processing of personal data should be uniform and uniform across the Union

be applied uniformly. Regarding processing
personal data to fulfill a legal obligation or
to carry out a task that is in the public interest or in
The exercise of public authority is carried out and is transferred to the person responsible
Member States should have the possibility to adopt national ones

Provisions ensuring the application of the provisions of this Regulation
to be maintained or introduced in more detail. Combined with
the general and horizontal legislation on data protection
There are several implementations of Directive 95/46/EC in the Member States
sector-specific legislation in areas that are more specific

regulations require. This regulation also offers Member States
a scope for the specification of their regulations, including for the
Processing of special categories of personal data (in
“Sensitive Data” below). This regulation is not exclusive in this regard

Legislation of Member States where the circumstances are particular

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

11 of 53

Processing situations can be determined, including a more precise one

Determination of the conditions under which the processing
personal data is lawful.
(...)

(40) For the processing to be lawful, personal data must
with the consent of the data subject or otherwise permitted
The legal basis for processing is this regulation

or - whenever referred to in this Regulation
other Union law or the law of the Member States, as follows
other things on the basis that they comply with legal requirements
Obligation to which the controller is subject or to fulfill one
Contract to which the data subject is a party, or for which
Implementation of pre-contractual measures at the request of those affected

person is required.
(41) If this Regulation refers to a legal basis or a
Legislative measure referred to does not require this

necessarily one adopted by a parliament
legislative act; Requirements in accordance with the remain unaffected
Constitutional system of the Member State concerned. The corresponding
However, the legal basis or legislative measure should be clear and precise
and their application should be for those subject to the law in accordance with
Case law of the Court of Justice of the European Union (hereinafter

‘Court of Justice’) and the European Court of Human Rights
be predictable.
(...)

(45) If the processing is carried out by the person responsible on the basis of a request to him
applicable legal obligation or is the processing for
Carrying out a task in the public interest or in exercise

If public authority is required, there must be a basis for this in Union law
or exist in the law of a Member State. This regulation will not
a specific law requires each individual processing. A law as
Basis for multiple processing operations may be sufficient if
the processing is based on a legal obligation incumbent on the person responsible
Obligation takes place or if the processing is carried out for the purpose of carrying out an obligation
Task in the public interest or in the exercise of official authority

is required. The same should be done in Union law or in the law of the
Member States regulate the purposes for which the data is processed
may be. Furthermore, the general conditions could be included in this law
this regulation regulating the lawfulness of processing
personal data would be clarified and it could specify how
the person responsible must determine what type of personal data

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

12 of 53

Data is processed, which people are affected, which ones

Institutions disclose the personal data and for what purposes
and how long they may be stored and what other measures
be taken to ensure that the processing is lawful and
carried out in good faith. The same should be done in Union law or in
The law of the Member States determines whether this is the case
Responsible person who carries out a task that is in the public interest

lies or takes place in the exercise of official authority, to an authority or to
another natural or legal entity covered by public law
Person or, if this is justified by the public interest including
health purposes, such as public health or social
security or the administration of health care services,
is justified, a natural or legal person under private law, such as

for example a professional association, should act.
(...)

(71) The data subject should have the right not to decide what
a measure may include - to evaluate what affects it
to be subjected to personal aspects that are exclusively based on one
is based on automated processing and the legal effect for that

the person concerned develops or significantly affects them in a similar way,
such as the automatic rejection of an online loan application or
Online recruitment process without any human intervention. To a
Such processing also includes 'profiling' in any form
automated processing of personal data under assessment of the
personal aspects exist in relation to a natural person, in particular
to analyze or predict aspects related to work performance,

economic situation, health, personal preferences or interests,
Reliability or behavior, whereabouts or change of location
data subject, insofar as this has legal effect for the data subject
unfolds or significantly affects them in a similar way. One on one
such processing, including profiling
However, decision-making should be allowed if this is according to the

Union law or the law of the Member States responsible for the processing
Controller is subject to, is expressly permitted, also in accordance with
the regulations, standards and recommendations of the institutions
[European] Union or national supervisory bodies fraud and
to monitor and prevent tax evasion and security and
Reliability of a service provided by the person responsible

guarantee, or if this is necessary for the conclusion or fulfillment of a
Contract between the data subject and a controller
is necessary or if the data subject expressly expresses their consent
has given consent to this. In any case, such processing should

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023
13 out of 53

be accompanied by appropriate guarantees, including specific ones
Informing the person concerned and the right to direct action
Intervention by a person to present their own point of view
Explanation of the decisions taken after an appropriate assessment
decision and the right to challenge the decision. This
Measure should not affect any child. In order to take into account the

special circumstances and framework conditions under which the
personal data processed is that of the data subject
To ensure fair and transparent processing, the
suitable mathematical or statistical data controllers
Use procedures for profiling, technical and organizational

Take measures to ensure appropriate security in particular
that factors that lead to inaccurate personal data
be corrected and the risk of errors is minimized, and
secure personal data in such a way that the potential
Threats to the interests and rights of the data subject
is worn and, among other things, prevent it from becoming natural

people based on race, ethnic origin, political opinion,
Religion or belief, trade union membership, genetic
Dispositions or health status as well as sexual orientation
discriminatory effects or processing that occurs
has such an effect. Automated decision making and profiling

on the basis of special categories of personal data
only be allowed under certain conditions.
(...)

Article 4

Definitions
(1) For the purposes of this Regulation, the term means:

(...)

4. 'Profiling' any type of automated processing of personal data
Data that consists of using personal data
be to certain personal aspects that relate to a natural
person, to evaluate, especially aspects relating to

work performance, economic situation, health, personal preferences,
Interests, reliability, behavior, location or change of location
to analyze or predict that natural person;

(...)

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023
14 out of 53

Article 5
Principles for processing personal data

(1) Personal data must

a) in a lawful manner, in good faith and in a manner for which
data subject are processed in a comprehensible manner
(“Legality, fair processing, transparency”);

(...)
c) appropriate and relevant to the purpose and relevant to the purposes of the

Processing must be limited to the extent necessary ('data minimization');
(...)

Article 6

Lawfulness of processing
(1) Processing is only lawful if at least one of the

the following conditions are met:
(...)

c) the processing is to fulfill a legal obligation
required to which the controller is subject;

(...)
e) the processing is necessary for the performance of a task that

is in the public interest or in the exercise of official authority
carried out, which was transferred to the person responsible;

(...)
(2) Member States may provide more specific adaptation provisions
the application of the provisions of this Regulation in relation to

Processing to comply with paragraph 1 letters c and e maintained or
introduce specific requirements for processing as well
determine other measures more precisely in order to ensure a lawful and faithful action
and to ensure processing carried out in faith, including for
other special processing situations in accordance with Chapter IX.

(3) The legal basis for the processing pursuant to paragraph 1 letter c
and e is determined by

a) Union law or

b) the law of the Member States to which the controller is subject.
The purpose of the processing must be specified in this legal basis or
with regard to the processing referred to in paragraph 1 letter e for fulfillment

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

15 out of 53

be necessary for a task that is in the public interest or in

The exercise of public authority is carried out and is transferred to the person responsible
became. This legal basis may contain specific provisions for adaptation
the application of the provisions of this Regulation, among others
Provisions on what general conditions govern the
The lawfulness of the processing by the controller applies
Types of data processed determine which individuals are affected

which facilities and for what purposes the personal data
may be disclosed, what purpose they are subject to and for how long
they may be stored and which processing operations
and procedures may be applied, including measures to
Ensuring that the service is carried out lawfully and in good faith
Processing, such as those for other special processing situations

according to Chapter IX. Union law or the law of the Member States must
pursue a goal that is in the public interest and in one
be proportionate to the legitimate purpose pursued.

(4) If the processing is based on a purpose other than that of
which the personal data was collected, not on the consent
the data subject or on a law of the Union or the
Member States that have a necessary and
proportionate measure to protect the persons referred to in Article 23(1).
represents goals, the person responsible takes them into account - to determine whether the

Processing for a purpose other than that for which the
personal data was originally collected is compatible - under
other
a) any connection between the purposes for which the personal data

Data was collected and the purposes intended
further processing,
b) the context in which the personal data was collected

were, particularly with regard to the relationship between the
affected persons and the person responsible,
c) the type of personal data, in particular whether special

Categories of personal data are processed in accordance with Article 9
or whether personal data about criminal convictions and
offenses are processed in accordance with Article 10,

d) the possible consequences of the intended further processing for the
affected persons,
e) the existence of appropriate guarantees, including encryption or

Pseudonymization can include.
(...)

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023
16 of 53

Article 9
Processing of special categories of personal data

(1) The processing of personal data from which the racial and
ethnic origin, political opinions, religious or ideological
beliefs or union membership, as well as the
Processing of genetic data, biometric data for unique purposes

Identification of a natural person, health data or data on
sex life or sexual orientation of a natural person
prohibited.

(2) Paragraph 1 does not apply in the following cases:
(...)

g) the processing is based on Union law or law
of a Member State that is proportionate to the one being prosecuted
The aim is to preserve the essence of the right to data protection and

appropriate and specific measures to safeguard fundamental rights
and interests of the data subject, for reasons of one
significant public interest required,

h) the processing is for health care purposes or
Occupational medicine, for assessing the employee's ability to work,
for medical diagnostics, care or treatment in
Health or social sector or for the administration of systems
and health or social services based on the

Union law or the law of a Member State or based on one
Contract with a healthcare professional and
subject to the conditions and guarantees set out in paragraph 3
necessary,

(...)

(3) The personal data mentioned in paragraph 1 may be included in
Paragraph 2 letter h are processed if these

Data is processed by or under the responsibility of specialist personnel
and these professionals in accordance with Union law or the law of a
Member State or the regulations of national competent bodies
is subject to professional secrecy, or if the processing is carried out by another party
Person who is also under Union law or the law of a
Member State or the regulations of national competent bodies

subject to confidentiality.

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023
17 of 53

(4) Member States may impose additional conditions, including
introduce or maintain restrictions insofar as the processing of
genetic, biometric or health data is affected.

(...)
Article 22

Automated decisions in individual cases including profiling

(1) The data subject has the right not to rely solely on one
automated processing - including profiling
to be subjected to the decision, which has legal effect on it
unfolds or significantly affects them in a similar way.

(2) Paragraph 1 does not apply if the decision

a) for the conclusion or fulfillment of a contract between the
the person concerned and the person responsible is required to

b) under Union or Member State law,
which the person responsible is subject to, is permissible and this
Legislation appropriate measures to safeguard rights and
freedoms and the legitimate interests of the data subject
contain or

c) takes place with the express consent of the data subject.

(3) In the cases mentioned in paragraph 2 letters a and c
Responsible for taking appropriate measures to protect rights and freedoms
as well as to protect the legitimate interests of the data subject, for what purpose
at least the right to obtain human intervention on the part of the
those responsible, to present their own point of view and to contest it

belongs to the decision.
(4) Decisions under paragraph 2 may not be based on special categories
personal data pursuant to Article 9 paragraph 1, unless

Article 9(2)(a) or (g) applies and appropriate measures to be taken
Protection of the rights and freedoms as well as the legitimate interests of the
affected person.”

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

18 of 53

30 5.1.2. § 1 of the Federal Act for the Protection of Natural Persons

Processing of personal data (Data Protection Act - DSG),
Federal Law Gazette I No. 165/1999 as amended by Federal Law Gazette I No. 51/2012 reads in part:

“Article 1 (constitutional provision)

Basic right to data protection

§ 1. (1) Everyone has, especially with regard to respect for their own
Private and family life, right to secrecy of those concerning him
personal data to the extent that there is a legitimate interest in doing so.
The existence of such an interest is excluded if data as a result
their general availability or because of their lack of traceability

are not accessible to those affected by a claim of confidentiality.
(2) To the extent that the use of personal data is not permitted

vital interest of the person concerned or with his consent,
are restrictions on the right to confidentiality only for reasons of protection
overriding legitimate interests of another are permissible, namely at
Intervention by a state authority only on the basis of laws arising from the
in Article 8 paragraph 2 of the European Convention for the Protection of the

Human rights and fundamental freedoms (ECHR), Federal Law Gazette No. 210/1958,
reasons mentioned are necessary. Such laws permit the use
of data that is particularly worthy of protection due to its nature, only for preservation purposes
important public interests and must be provided for at the same time
appropriate guarantees to protect the confidentiality interests of the

Determine those affected. Even in the case of permissible restrictions, the
Interference with fundamental rights only in the slightest way that achieves the desired result
type.

(...)"

31 5.1.3. The relevant provisions of the Federal Law on
Labor Market Service (Labor Market Service Act - AMSG),

Federal Law Gazette No. 313/1994, namely § 1, § 25 and § 27 as amended by Federal Law Gazette I No. 32/2018,
§ 29 as amended by Federal Law Gazette I No. 3/2013, § 31 as amended by Federal Law Gazette I No. 90/2009, § 32 as amended

Federal Law Gazette I No. 71/2005 and § 38c as amended by Federal Law Gazette I No. 77/2004 read in extracts:

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

19 of 53

“Labor market service

§ 1. (1) The implementation of the federal labor market policy is the responsibility of the
'Labour market service'. The employment service is one
Service companies under public law with their own

Legal personality.
(...)

Data processing

§ 25. (1) The employment service, the Federal Administrative Court and the
Federal Ministry of Labor, Social Affairs, Health and Consumer Protection
are for the processing of personal data within the meaning of
Data Protection Act, Federal Law Gazette I No. 165/1999, insofar as this is authorized
Fulfillment of legal tasks is an essential prerequisite. The
The types of data in question are:

(...)

(2) The labor market service or the Federal Ministry of Labor,
Social, health and consumer protection data processed in accordance with
Paragraph 1, with the exception of health data in accordance with Paragraph 1 Item 4, may
other authorities, courts, social security institutions and the
Federal Statistical Institute Austria by means of automation-supported

Data processing will be disclosed to the extent that the relevant data is for
the execution of the respective legally assigned tasks
form an essential prerequisite. Other authorities, courts and the carriers
The social security authorities may process data they process in accordance with paragraph 1
Exception of health data in accordance with paragraph 1 item 4, the employment service
and the Federal Ministry of Labor, Social Affairs, Health and

Consumer protection through automated data processing
disclose to the extent that this data is necessary for the execution of the
Employment Service and the Federal Ministry of Labor, Social Affairs,
tasks assigned by law to health and consumer protection
form an essential prerequisite. From the social security providers
Data transmitted in accordance with Paragraph 1 Z 9 may be used by the employment service and by

Federal Ministry of Labor, Social Affairs, Health and Consumer Protection
personally for the purposes of sustainable labor market integration
group of people are processed.

(...)
(4) The data processed by the employment service in accordance with paragraph 1 may be sent to
the Bundesrechenzentrum GmbH and to institutions that are responsible for the tasks of the

are transferred to the Labor Market Service (§ 30 para. 3 and § 32 para. 3), within the framework
the services to be provided by them by way of
automated data processing.

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

20 out of 53

(5) The Labor Market Service and the Federal Ministry of Labor, Social Affairs,

Health and consumer protection may use the data they process
in accordance with paragraph 1, with the exception of health data in accordance with paragraph 1 item 4
commissioned legal entities by means of automated support
Transmit data processing to the extent that the relevant data is a
an indispensable prerequisite for the fulfillment of an assessment requirement
Services, aid and other financial benefits

research contracts awarded by the Labor Market Service. For in public
Interested scientific and statistical studies may be carried out
the Federal Ministry of Labor, Social Affairs, Health and
Consumer protection and the employment service provide the necessary support
Data in accordance with paragraph 1 (except Z 1 lit. a and e to h), linked to the
encrypted bPK AS, the Austrian Federal Statistical Institute for the purpose of

Merging with indirectly personal data from others
Authorities or social security institutions or at the Federal Agency
transmit existing data on the working population. These are also allowed
other authorities or social insurance providers in accordance with legal regulations
Data processed in accordance with the regulations of the state's own area of activity,
linked to the encrypted bPK AS, transmitted to the Federal Agency.

A return transfer of merged data or the enabling of this
Restoring a direct personal connection is not permitted. The
The Federal Institute prepares the scientific or statistical evaluations
after commissioning by the Federal Minister of Labor, Social Affairs and Health
and consumer protection. The federal agency provides its services
this federal law against reimbursement of costs in accordance with Section 32 Paragraph 4 Z 2 of
Federal Statistics Act 2000. The merged data is as soon as it is

are no longer needed for the purpose of the investigation, at the latest
three years to delete.
(6) The Austrian Federal Statistical Institute may process master data

the employer in accordance with paragraph 1 item 6 and data on training in accordance with paragraph 1
Z 2 lit. b and Z 7 lit. b to the employment service and the Federal Ministry
for work, social affairs, health and consumer protection through the
disclose automated data processing, insofar as this data is for
Scientific purposes that fall within their legal area of responsibility
or labor market statistical studies that are not personal

Aiming to achieve results (§ 7 DSG) is an essential prerequisite.
(7) If this is necessary for the fulfillment of legal tasks,
Health data (paragraph 1 no. 4) may be disclosed by the employment service to the

responsible social security institutions, the Ministry of Social Affairs,
the responsible social assistance providers and institutions that carry out their tasks
are transferred to the employment service (§ 30 para. 3 and § 32 para. 3) as well
must be disclosed by them to the employment service.

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

21 of 53

(8) Employers may only disclose data in accordance with paragraph 1

for the establishment of an employment relationship and the assessment
the professional suitability of the job seekers are needed.
Health data may not be disclosed to employers.

(9) The data according to paragraph 1 is seven years after the end of the respective period
business case. The retention period is extended by
Periods in which the data is used to assert, exercise or
Defense of legal claims are still needed or others
Legal regulations provide for longer deadlines. The deletion of data is
for economic and technical reasons on one or two dates

year to focus. Until then, there is no entitlement to early payment
Deletion.
(10) The employment service has to take into account the economic

Justifiable and the state of the art adequate precautions for the
Ensuring data security within the meaning of Articles 24, 25 and 32 of the
Regulation (EU) No. 2016/679 on the protection of natural persons
Processing of personal data, free movement of data and
Repeal of Directive 95/46/EC (General Data Protection Regulation),
OJ No. L 119 of May 4, 2016 p. 1, (hereinafter: GDPR) and Section 6 DSG

hold true. In particular, recordings or changes are personal
Data only by the responsible organizational units
(employees) permitted. When transmitting
of personal data to third parties is due to technical or organizational reasons
Measures to ensure that only the intended recipients
Recipients gain access to the data. Access and reading rights are
according to the tasks (roles) of the respective organizational units and

to design servants. Access to personal data as well as any
Transmission of health data must be recorded. Log data
may not be used for personal purposes unless this is necessary
Enforcement or defense of legally asserted claims
Ensuring the lawful use of data processing or
necessary for technical reasons.

(11) Based on paragraphs 1 to 10, Section 69 AlVG and Sections 27 and
27a AuslBG, the data processing to be carried out meets the requirements
Requirements of Art. 35 Para. 10 GDPR for the omission of the

Data protection impact assessment.
(...)

Obligation of confidentiality

§ 27. (1) The bodies of the employment service are, to the extent not permitted by law
otherwise is intended to maintain confidentiality about all of them from their official position
Facts that have become known during the activity are obliged to keep them confidential

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023
22 of 53

interest in maintaining public peace, order and
Security, comprehensive national defense, foreign
Relationships, in the economic interest of the employment service, to
Preparation of a decision or in the overriding interests of the parties
is required. The responsible supervisor has to waive this obligation
To release the request of a court or an administrative authority if

this is in the interests of justice or in other public interests
lies.

(2) The obligation of confidentiality in accordance with paragraph 1 also applies after
Leaving the position and after termination of the employment relationship.
The obligation of confidentiality in accordance with paragraph 1 also applies to persons
a committee of the board of directors, the state directorate or the
Member of the regional advisory board.

(...)

Goal and task fulfillment
§ 29. (1) The aim of the employment service is, within the framework of

The federal government's full employment policy for prevention and elimination
of unemployment while maintaining social and economic principles
In the sense of an active labor market policy, the most complete,
economically sensible and sustainable merging
supply and demand for labor, and thereby the supply
the economy with workers and the employment of all people who

are available to the Austrian labor market in the best possible way
to back up. This includes securing economic existence during the
Unemployment within the framework of the legal provisions.

(2) In order to achieve this goal, the labor market service has to do so within the framework of
legal provisions to provide services aimed at:

1. the placement of suitable workers in an efficient manner
To create jobs that are as close as possible
Employment appropriate to the job seeker's placement wishes
offer,

2. the effects of circumstances that require direct mediation
hinder the senses of Z 1, to help overcome them,

3. to counteract the confusion of the labor market,
4. quantitative or qualitative imbalances between
reduce labor supply and demand,

5. the preservation of jobs if this makes sense within the meaning of paragraph 1
is to enable and

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

23 out of 53

6. to secure the economic existence of the unemployed.

(3) The tasks of the employment service include in particular:
Ensuring vocational training opportunities for young people
through placement of suitable apprenticeships and additional measures such as

the commissioning of training institutions for inter-company purposes
Apprenticeship training in accordance with Section 30b of the Vocational Training Act (BAG),
Federal Law Gazette No. 142/1969, or from training institutions in accordance with Section 2 Paragraph 4 of
Agricultural and Forestry Vocational Training Act,
Federal Law Gazette I No. 298/1990.

(4) The tasks of the employment service also include:
Promoting the re-employment of those with health impairments
people through placement in suitable jobs and supplementary ones
or preparatory measures. Particular attention is paid to the individual

Performance, the development and expansion of on the labor market
usable qualifications and securing economic existence
to pay attention.

(...)
Principles in the performance of tasks

§ 31. (1) The services of the employment service that are not covered by the authorities
Procedures can be carried out by anyone at all branches and
Make use of the employment service facilities that provide this
Offer services unless the principles stated in paragraph 5 are met

oppose.
(2) If there is no legal entitlement to benefits from the employment service
exists, the choice, type and, if necessary, combination of the

services used according to the requirements of the individual case
from the point of view that they achieve the aim stated in § 29 as best as possible
are equivalent to. When fulfilling its tasks, the employment service has to
an appropriate balance between the interests of employers and
respect employees.

(3) For people who either because of their personal circumstances or
their belonging to a group that is disadvantaged in the labor market
particular difficulties in obtaining or maintaining a job
the services of the employment service within the meaning of paragraph 2 are as follows

design and, if necessary, use it more intensively so that a
The greatest possible equality of opportunity with other workers is achieved
becomes. In particular, through appropriate use of the services
gender-specific division of the labor market and discrimination
of women in the labor market.

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

24 out of 53

(4) The activity of the employment service is, as far as it is

- ensuring compliance with and implementation of labor market policy
the federal government,

- the equal treatment of similar matters,

- the necessary uniformity of approach and
- achieving the highest possible efficiency and practicality
performance

allow to be carried out decentrally. The services of the employment service
are, unless expressly stated otherwise, by the
regional organizations.

(5) In all activities, the public employment service adheres to the principles of
Economy, economy and practicality from the point of view
the best possible achievement of the goal stated in § 29

take. To assess the efficiency of the activities of the labor market service
to set up internal controlling.
(6) The employment service has particular responsibility for projects relating to:

Ensuring vocational training opportunities for young people
in accordance with Section 29 Paragraph 3 to the different needs of each individual
Federal states should be taken into account and fulfilled in the best possible way
Tasks require the participation and appropriate financial participation of the
to strive for in the respective federal state.

(7) When planning measures, the employment service must ensure that
that for groups of people who are particularly at risk of unemployment,
appropriate support services are offered.

(8) The measures are intended in particular to maintain and expand
promote marketable skills among employees. The
The labor market service can participate in measures taken by other legal entities
Improving the framework conditions for long-term maintenance

participate in health.
(...)

Services

§ 32. (1) The employment service has its services in the form of
to provide services whose purpose is to provide
Job seekers on vacancies, job security and the
Securing one's existence within the meaning of Section 29 is.

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023
25 out of 53

(2) Services to prepare, enable or facilitate a
such placement or job security are particularly important
1. Information about the labor market and the professional world,

2. Advice on choosing a career,

3. Assistance in the production or maintenance of the
ability to place workers,

4. Supporting the qualification of workers and
5. Supporting companies in finding and selecting suitable ones

workforce and the design of the internal company
workforce planning,
6. Assisting job seekers in searching and choosing one

workplace and
7. Supporting businesses and workers to create and

Preservation of jobs.
(3) To the extent that the employment service does not provide services within the meaning of paragraph 2
can provide itself or its provision is inappropriate or

If it were uneconomical, it must ensure that such services are provided
based on contractual agreements, e.g. through transfer to suitable persons
Facilities may be provided by other means. Allowed to do so
third party interests worthy of protection within the meaning of Section 1 Paragraph 1 of
Data protection law is not violated.

(4) Services are generally free of charge. For special ones
Services such as testing and pre-selection of applicants or special ones
Advertising measures and personnel consulting measures for companies can

the board of directors shall set an appropriate remuneration that corresponds to the
to the labor market service. Services for employees, unemployed people
and jobseekers must in any case be provided free of charge.

(5) If services of the employment service are covered by the provisions
of Section 2 of the Labor Market Promotion Act (AMFG), Federal Law Gazette No. 31/1969,
the provisions of Sections 3 to 7 AMFG apply to them.

(...)
Care plan

§ 38c. The regional office has one for every unemployed person
Create a care plan based on what is expected
Care needs in particular the type of care and the in

Measures taken and a justification for them
contains the intended procedure. In particular, the care plan includes:
the relevant aspects in accordance with Section 9 Paragraphs 1 to 3 AlVG are taken into account

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

26 of 53

take. When communicating and taking measures to improve the
Placement opportunities are those that can be exploited on the labor market
Qualifications (professional and technical knowledge and skills
Nature) of the unemployed person and these are to be taken into account if possible

maintained or expanded if necessary. When changing the for incorporation
Circumstances significant in the labor market is the care plan
adjust accordingly. The regional office has an agreement
with the unemployed person via the care plan. Can one
If agreement is not reached, the care plan is from the regional

Office with the greatest possible consideration of the interests of the
unemployed person unilaterally. The care plan is this
brought to the attention of the unemployed person. To a specific one
Care plan or measures planned in the care plan
taken, there is no legal claim. The board of directors has one

Guideline to ensure a consistent approach to the
Creation and adjustment of care plans.
(...)"

32 5.2. To assess the relevant action of the AMS as sovereign or

private sector and on the question of the applicability of Section 1 Paragraph 2 DSG

the present facts

33 5.2.1. The revision argues that the data processing in question is carried out

the mP takes place within the framework of sovereign administration. Nobody spoke
understandable reasons for the processing to be in the area of

To be attributed to private sector administration, especially since Section 29 AMSG covers the mediation
of suitable workers for jobs as the goal and task of the mP

statue. However, the task of providing employment is one
inseparable connection with the Unemployment Insurance Act

(AlVG). AMAS cannot be separated from official activities according to the
AlVG are considered because this data processing is ultimately considered

Basis for decision-making for job placement and thus

serve in conjunction with unemployment insurance claims.
Since the data processing in question takes place within the framework of sovereign administration

is carried out, Section 1 Paragraph 2 DSG requires the respective legislator
Matter-specific regulations in the sense that the cases are more admissible

Interventions in the fundamental right to data protection are specified and limited
would.

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

27 of 53

34 The response to the appeal counters that the AMSG regulates the same

Essentially the “services” of the employment service (AMS) and
thus the private sector tasks of the mP, in particular their

Employment placement activities including organization and
Carrying out training and awarding aid. The

Procedural processing - AMAS - is used for activities of the
mP used in the private sector. These in Sections 29 ff AMSG

The tasks envisaged by the mP would be carried out using the means of private law

carried out, the basis for the procedure essentially being:
Supervision agreement in accordance with Section 38c AMSG. On any possible

There is no entitlement to services. See Section 32 AMSG in this sense
suggests that the MPs describe their services in more detail

have to provide services to which expressly no reference is made
legal claim exists. This also applies to the awarding of aid. The

The appellant herself assumes that the matter at issue in the proceedings

Data processing for the purposes of job placement in accordance with
§§ 29 ff AMSG is used. It should be noted that AMAS is not for

the job placement itself, but only for the targeted person
Support and support can be used. The program

serve to choose the right care strategy. The employment agency itself
success regardless of the calculated opportunities on the labor market. From all

The result is that the requirement of Section 1 Paragraph 2 DSG, according to which an intervention in the
Basic right to data protection by a state authority only on the basis

should be made on a qualified legal basis, this is not the case

application succeed.

35 5.2.2. The balancing of interests stipulated in Section 1 Paragraph 2 DSG requires:
Admissibility of official interventions in data protection secrecy

an (express) legal regulation resulting from the provisions set out in Article 8 Para. 2 ECHR

reasons mentioned is necessary. The explanations for this provision
understand authorities as state bodies acting sovereignly; that is what is meant

sovereign action by administrative authorities (cf. Pürgy/Zavadil,
The state authority within the meaning of Section 1 Paragraph 2 DSG 2000 in Bauer/Reimer,

Handbook on data protection law [2009], 141 ff [147], with reference to

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

28 out of 53

ErlRV on the StF of § 1 DSG 2000, 1613 BlgNR 20. GP 34 f; Eberhard in

Korinek/Holoubek, B-VG, 12th Lfg [2016], § 1 DSG, Rn. 58, mwN).

36 5.2.3. Sovereign administration occurs when the administrative bodies

“Empire”, i.e. using specific state command and control
Coercive force occurs. They act in those legal sentence forms that...

public law for the exercise of official powers

(cf. VfGH March 3, 2001, KI-2/99).

37 The determination that an administrative body is an act of society

services of general interest, thus a public administrative task,
excludes the qualification of such an activity as

Private sector administration not out. For the delimitation of the area
Private sector administration from that of the sovereign administration it depends on the

motives and the purpose of the activity, what is more important is
what legal technical means the legislation can use to implement the

fulfilling tasks. Does the legislature have the administrative authority?

not endowed with coercive powers, there is no sovereign administration,
but rather private sector administration (see VfGH October 18, 1957, KI-1/57;
6
see also the comments in Raschauer, General Administrative Law,
2021, paragraph 694 ff).

38 According to the statements in - the still relevant
“leading case” - VfSlg. 3262/1957 it is official for qualification

Acting as a sovereign administration, it is irrelevant whether the authority in question has one
performs a “public task” because not everything “public” is sovereign

is carried out. Furthermore, it is not decisive that it is one

regulation in the field of public law. Not everyone is either
Act of a body endowed with official powers is an act of sovereignty.

The fact that the relevant authority in connection with the
Works with public funds to fulfill the task does not make a decision either

about the questions of sovereign action, because also within the framework of

Private sector administration the state deals with public funds.
The only decisive factor is what legal means the legislature uses

has provided, i.e. whether there is a legal authorization to do something sovereign

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

29 of 53

action is given and whether such action is used in the specific case

is made (cf. on all the Raschauer, ibid).

39 The term “simple sovereign administration” refers to administrative action

recorded, which is not of a private economic nature, but rather belongs to the area of
sovereign administration, even if in the specific case there is no sovereign act

is set. In the simple sovereign administration the
Administrative bodies not in the forms of action of the decision

direct administrative command and coercive power as well as the
Regulation acts, although this limits its power to order and enforce

is present in the background. In this sense it is simple

Sovereign administration a potentially sovereign administration that can be achieved through deployment
can go from empire to current sovereign administration; it deals

It is therefore a matter of “different intensity” of an administrative activity
overall belongs to the area of sovereign administration (cf. VwGH April 15, 2016,

Ra 2016/02/0028). There may be administrative acts that are not
have independent normativity, but undoubtedly - preparatory,

accompanying, implementing - within the framework of the sovereign administration.
In some cases it is even expressly provided that the refusal

Such an (actual) performance should be made with a notice, which is probably the case

The clearest indication of this is also the case of positive approval
or fulfillment can be qualified as sovereign action. The simple one

Sovereign administration can no longer be based solely on the limited
Number of typified forms of sovereign acts can be determined.

What is crucial is that certain actions are taken that both
in the area of sovereign administration as well as in the area of

Private sector administration can be found. To act sovereignly
this action the context in which they are placed

(cf. again Raschauer, ibid).

40 5.2.4. It is undisputed that the mP has both private and sovereign interests

To fulfill tasks (see Section 31 Paragraph 1 AMSG) because they

Job seekers both as a (contractual) partner and as a sponsor
confronted with state sovereignty.

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

30 out of 53

41 5.2.4.1. The mP acts in the area of sovereign administration, provided that it has

Benefits to which there is a legal claim - for example under the AlVG - are decided

consists. The care activity in question including that in this context
the planned creation of a care plan/a care agreement

but takes place without the law granting the mP coercive powers or
the job seeker has a legal right to what is considered expedient there

The prospect of supporting measures opens up. Rather, the mP

theirs in the service of “the federal government’s full employment policy
Preventing and eliminating unemployment while preserving social and

“Economic Principles” fulfillment of tasks

(see Section 29 Paragraph 1 AMSG) to be provided in the form of services,
which anyone can take advantage of (Section 31 Paragraph 1 AMSG). The

Case-related relevant activity of the MP is therefore not considered a sovereign activity
in a narrower sense.

42 5.2.4.2. The possibility of this happening simply needs to be questioned
sovereign action because - as the appeal argues - the

Employment placement in an “inseparable connection with the AlVG”

stand.

43 According to the undisputed findings, the results of the AMAS should be

Consultation process can be used and a starting point for the consultants
be in order to make an assessment together with the job seeker

Potentials and, if necessary, obstacles to labor market integration
to determine. Because of this dispute, the optimal one is

Care strategy - funding and care services

define. The final decision about assignment to one of the
The consultant meets customer groups. Does the job seeker have a dedicated one?

different assessment of the labor market opportunities than the consultant
document this in the supervision agreement.

44 Based on this, the following should be considered:

45 Against the background of the AMSG, the task of the mP is the prevention and

Elimination of unemployment while preserving social and economic

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

31 out of 53

Principles in the sense of an active labor market policy (Section 29 Paragraph 1 AMSG).

According to the materials on the AMSG (RV 1468 BlgNR 18. GP, 32; AB 1555
BlgNR 18. GP) the sole purpose of the law is reform

the labor market administration and the associated re-achievement of the
Full employment and the participation of job seekers in working life

The central aim of the provisions of the AMSG is to achieve one
the highest possible level of employment through the organization of the mP

should be achieved, for whose services the rapid placement of a

Productive and individually satisfying employment is the top priority.
According to Section 29 AMSG, the economic existence should be maintained during the period of

Job search is guaranteed, securing a living in form
Recurring benefits to job seekers are therefore part of the

Labor market policy. This is the basic idea of active labor market policy
through specific measures tailored to the individual case and under

Consideration of the greatest possible compatibility of full employment

and achieve economic growth. From this objective
The AMSG shows that, on the one hand, the AMS unites the job seeker

Overview of the domestic labor market and orientation towards it
enable, on the other hand, through targeted advice and assistance

Identify a position that is appropriate to the individual's individual abilities
should do (see OGH January 30, 2001, 1 Ob 257/00a).

46 The entitlement to unemployment benefit (§ 47 para. 1 AlVG) is of a sovereign nature;
when deciding whether you are entitled to unemployment benefit

official tasks are fulfilled. The placement of job seekers
However, as can be seen from Section 31 Paragraph 1 AMSG, it is in any case not sovereign

(see OGH November 24, 2015, 1 Ob 208/15t, mwN).

47 The relevant advice according to the findings, within the framework of which this

The data processing in question is carried out - regardless of the narrow subject matter
Context - intentionally not about the preparation of the agreement

Claims from unemployment insurance, but rather the purpose of the

Bringing together supply and demand in the labor market. The
Legally designed advisory process as a service, which is in accordance with

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023
32 out of 53

Section 31 Paragraph 1 AMSG is also open to job seekers who are not recipients of
Unemployment benefits are not provided through sovereign means

carried out this still ends - given the lack of reciprocal

Rights and obligations - in a sovereign act. The purely objective one
Connection between unemployment and possible support

According to the AlVG, in the event of an unsuccessful job search, advice is provided
Reintegration into the labor market itself is not one

Preparatory act for official activities at the
Granting support, namely in the absence of a sufficient normative one

Connexes does not apply even if it is made to people who are already in the
Receipt of benefits according to the AlVG.

48 This also applies to the “care plan”: according to the
The Labor Market Reform Act 2004, BGBl. I No. 77, inserted Section 38c AMSG has this

AMS to create a care plan for every unemployed person
“Based on the expected need for care, in particular the type and

Type of care and the measures envisaged as well as a
Justification for the intended course of action”. The explanations

of the legislature, ErlRV 464 BlgNR 22. GP 9, excerpts read:

“The basic principles of the employment service have already been good so far
Experiences in the care plan used should now be expressly legal
be anchored. The care plan is not the sovereign administration
to be attributed, but should only be the framework conditions for which the

Mediation and placement services associated with the private sector administration
the employment service's placement-supporting activities.
The care plan should provide a consistent, meaningful, predictable and
Proceedings in accordance with the principle of trust in the care and
Placement of the unemployed must be ensured. Depending on the to
Part of very different conditions for success

Reintegration into the labor market involves different requirements
to provide care for the unemployed. This results in tiered ones
Requirements for the care plan. Discussions to clarify the situation
and the care process will usually take this into account
(must) whether the unemployment is only temporary and expected

appears to be remediable in the foreseeable future without special measures or
With regard to age, lack of qualifications, health, for example
Restrictions, care obligations or structural problems on the

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023
33 out of 53

Special efforts are required in the labor market. (...) The
Agreement on the care plan is within the framework of the existing one
discretion. If the ideas of the (des)
Unemployed people are not in compliance with the applicable regulations
clarification in this regard should be provided. Still can't agree
achieved, the care plan is one-sided from the regional one

Establish office. The care plan is for the unemployed person
in any case in an appropriate manner, for example by handing it over or sending it
to bring knowledge. The care plan should define the framework,
within which placement efforts and qualification or other
to improve employment opportunities on the labor market

necessary measures should be taken. In the agreements should
also the planned personal activities of the unemployed
be held. The care plan is for the actions of the
Labor market service as well as the unemployed as long as he
not changed - usually after a new consultation
became. (...) On the one hand, the support plan is intended to provide for the unemployed

higher degree of personal action orientation as well
Predictability of the actions of the employment service and on the other hand
Overall, it is even more planned, easier to understand and, if necessary, targeted
changeable approach of the employment service can be guaranteed. The
The tried and tested 'agreement culture' should be continued and expanded. (...)"

49 According to the declared will of the legislature, the mP is given the task

the creation of the care plan/care agreement within the framework
the private sector administration. This corresponds to the explicit one

Exclusion of a legal right to a specific care plan or

on measures that are envisaged in the care plan
(see also Julcher in AlV-Komm § 9 AlVG Rz 79). Furthermore is

decisive for the classification of the relevant cases
mP's advisory activity as a private sector activity that

Creation of the care plan in accordance with the reasonableness criteria
Section 9 paragraphs 1 to 3 AlVG must be taken into account; one from the

Binding terms that can be derived directly from the care plan/care agreement
Determination of the limits of the reasonableness of employment in the sense of

§ 9 AlVG or just a binding definition of the individual case-related criteria
However, the law does not provide for the assessment of these limits,

so that the care plan, against this background, limits the

Reasonableness of employment - especially in connection with

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

34 out of 53

possible sanctions according to § 10 AlVG - neither expand nor restrict

can. There can also be no sanction directly following the care plan
§ 10 AlVG. Section 9 (8) AlVG also changes this consequence

nothing, because the provision there does reduce the justification effort of the mP for

Reintegration measures for the job seeker - under
certain requirements - in connection with an existing one

Care plan modified, but which itself does not develop any bond and the
Authority is also not relieved of its obligation to present one

comprehensible - and in this sense independent - justification

which is subject to verification (cf. in this direction
pointing VwGH March 28, 2012, 2010/08/0250).

50 From what has been said above it follows that neither the advice

as part of the job placement itself, the creation of the

Care plan (a care agreement) within the meaning of Section 38c AMSG
to be attributed to the (even if simply) sovereign area of activity of the mP

is. Rather, this is part of the private sector
actions of the mP, against the background of the functional concept of authority

Section 1 Paragraph 2 DSG does not correspond to this in terms of data protection law

determinate standard for encroachments on fundamental rights
Personal data is subject to confidentiality in accordance with Section 1 Paragraph 1 DSG.

51 For this reason alone, the controversial legality of the
data processing that is the subject of the procedure using the

to examine the relevant provisions of the GDPR without the standard of
Section 1 Paragraph 2 DSG must be taken into account.

52 5.3. On the question of the existence of sufficient justification reasons
Articles 6 and 9 GDPR

53 5.3.1. The BVwG supported its argument regarding legality
the processing in question is based on the conclusion in accordance with Article 6

Paragraph 1 lit. e GDPR and Art. 9 para. 2 lit. g GDPR can be processed
personal data or special categories of personal data

Data will be lawful if this processing is based on the law of

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023
35 out of 53

Member State of the person responsible for a matter in the public interest
underlying task or with regard to the processing of special categories

personal data based on significant public interest

was required. The legal basis corresponding to Art. 6 Para. 3 GDPR
according to Recital 41 of the GDPR, I have made it clear and precise and for the

to be predictable for those subject to the law. Art. 9 paragraph 2 lit. g GDPR requires
additional appropriate and specific measures to safeguard the

Fundamental rights and interests of the persons concerned. Summarized
The BVwG believes that the mP has the right to it in accordance with Section 29 Paragraph 1 AMSG

assigned tasks in accordance with Section 31 Paragraph 5 AMSG
required principles of thrift, economy and

expediency must be met. Section 25 Paragraph 2 AMSG grants the mP one
Authorization to process personal data, insofar as this

are an essential prerequisite for fulfilling legal tasks.
The task assigned to the mP in accordance with Section 29 AMSG is undoubtedly one of

significant public interest. In order to achieve the set goal of optimal

Supplying the economy with workers and employing everyone
In order to secure people in the best possible way, it is undeniably necessary to focus on the

personal characteristics of the job seekers in combination with the
Labor market events to be taken into account. That those brought in

personal data of job seekers for the assessment of the job seekers
Labor market opportunities can be relevant, also from the appeal applicant

not been disputed. There are none in this case
Concerns that the mP is intended to ensure a “proper

Labor market policy” the personal data in accordance with Section 25 Paragraph 1 AMSG
may use. There are indications that such data processing is carried out in

§ 25 AMSG is not sufficiently clearly expressed
recognizable. Section 25 Paragraph 10 AMSG takes precautions to ensure that the

Processing and warranty in accordance with the principles of the GDPR

data security.

54 5.3.2. In order to answer the appeal's submissions, we must first look at the
The question of whether the requirements of Articles 6 and 9 of the GDPR are met will be addressed

and to say in advance that the question of the legality of the

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

36 out of 53

Processing against the background of these provisions is one of the questions

the ban on automated decisions in accordance with Art. 22 GDPR
represents a dividing legal question.

55 5.3.2.1. The processing of personal data is in accordance with
Art. 6 Para. 1 lit. e GDPR - among other things - lawful if the

Processing is necessary for the performance of a task that is...

is in the public interest or is carried out in the exercise of official authority
was transferred to the person responsible.

56 Art. 6 Para. 1 lit. e GDPR is closely related to Art. 6
Paragraphs 2 and 3, which contain more detailed requirements for the legal basis.

The legal basis for the processing is in accordance with Article 6 Paragraph 1 Letter e of the GDPR
may in accordance with Art. 6 para. 3 leg. cit. by Union law or the law of the

Member States to which the controller is subject must be determined. The
The purpose of the processing must - unlike the processing according to

Art. 6 Para. 1 lit. c GDPR - not necessarily in a legal basis

be expressly provided for. According to Art. 6 Para. 3 Sentence 2 GDPR, it is sufficient
if the purpose of the processing is necessary to complete a task

fulfill which is in the public interest or in the exercise of a public purpose
Violence occurs.

57 Recital 41 of the GDPR again provides that the corresponding
Legal basis or legislative measure clear and precise and their

Application should be predictable for those subject to the law. However
Recital 45 of the GDPR expressly does not require each individual

Processing a specific law. Rather, a law can serve as a basis

be sufficient for multiple processing operations when processing
is necessary to carry out a task in the public interest.

58 In light of the wording of these relevant provisions
It cannot be assumed that the national legislature is responsible for fulfilling the

Justification of Article 6 Paragraph 1 Letter e GDPR with regard to a
certain data processing is in any case held, the data processing

to determine themselves in the law. Rather, it is the justification fact

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

37 out of 53

fulfilled if the task to be performed is in the legal basis

is adequately described and the relevant data processing
the purpose of fulfilling this task. However, this assumes that

such a task is sufficiently clear and defined by the law
is described. The legal basis in question may be more specific

Regulations are included, but this is not mandatory (arg.: “can”
in Art. 6 Para. 3 third sentence GDPR). Ultimately sees

Art. 6 Para. 3 fourth sentence GDPR also applies to processing

Art. 6 Para. 1 lit. e leg. cit. proposes that the legislation be a public one
Pursue a goal that is of interest and in an appropriate proportion

must be consistent with the legitimate purpose pursued (see also this view
supporting Kastelitz/Hötzendorfer/Tschohl in Knyrim, the DatKomm, 2020,

Art. 6 para. 47; see also Buchner/Petri in Kühling/Buchner, DS-GVO, BDSG,
3rd edition, 2020, Art. 6 GDPR, paragraph 120 f).

59 5.3.2.2. The purpose of the provisions of Article 9 Paragraph 1 GDPR is to provide a
to ensure increased protection against such data processing

a particularly difficult one due to the particular sensitivity of this data
Interference with the fundamental rights guaranteed by Articles 7 and 8 of the Charter

Respect for private life and protection of personal data

can (cf. the comments of the ECJ on the purpose of protection in the judgment of
September 24, 2019, C-136/17, GC and others, paragraph 44).

60 Core of - Art. 6 Paragraph 1 Letter e GDPR

reproduced - legality of Article 9 Para. 2 lit. g GDPR

is that the processing is carried out for reasons of significant public concern
interest must be required. While accordingly for processing

personal data is generally in the public interest
(Art. 6 Para. 1 lit. e GDPR), the processing of sensitive data is required

Within the meaning of Article 9 Para. 1 GDPR - according to its wording - such
considerable interest. This means that specific consideration is required

a special legitimation for the use of such data (cf. to

Interpretation of the corresponding legal situation in Germany
Explanations in Kühling/Buchner, DS-GVO, BDSG, 3rd edition, Art. 9 Rz. 91,

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023
38 out of 53

cf. on Art. 9 Para. 2 lit. g GDPR also already ECJ September 24, 2019, C-136/17,
GC et al. [Delisting of sensitive data], paragraph 61).

61 The requirements for the legal basis are not specified in more detail
Art. 9 GDPR. Art. 9 Para. 2 lit. g GDPR refers as well as Art. 6

Paragraph 1 lit. e leg. cit. as a justification for the requirement of
Processing for reasons of - in connection with Art. 9 Para. 2 lit. g

considerable - public interest. With regard to the structural
What these two justification facts have in common and the respective one

Reference to Union law or the law of a Member State as well

In the absence of an order to the contrary, this is also necessary to justify the
Processing of special categories of personal data within the meaning of

Art. 9 Para. 2 lit. g GDPR assumes that - just like with
Justification for Article 6 Paragraph 1 Letter e - the sufficiently clear definition

the task to be performed with the processing - which is related
This data must have a special quality (arg.: “significant

public interest”) - is necessary but also sufficient (cf. the
Statements by Schörghofer/Warter, The legal basis of a

Data processing in FS Pfeil, 2022, 721ff [734]). This view corresponds
the opinion of the ECJ in C-136/17, according to which Art. 9 Para. 2 lit. g GDPR

Processing of the special categories of data referred to in Article 9 is permitted,
if it is necessary for reasons of significant public interest,

on the basis of Union law or the law of a third party

Member State that is proportionate to the objective pursued,
preserves the essence of the right to data protection and appropriate and

specific measures to safeguard the fundamental rights and interests of the
data subject, whereby the ECJ in the manner provided for by Article 11 of the Charter

protected right to free information a possible justification
The legal basis for the data processing in dispute there is (cf. ECJ ibid.,

61, 66 and 68). In this examination, the ECJ in no way relies on
whether the justifying legal basis is the disputed data processing itself

designated.

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

39 out of 53

62 5.3.2.3. Case-related arises against the background of this legal situation

the following:

First of all, it should be noted that the question of the existence of a public one

Interest in the assets transferred to mP by Sections 29 ff AMSG
Tasks - including those of the audit department - are not disputed.

63 Section 29 Paragraph 1 AMSG defines the task of the mP; Section 29 Paragraph 2 AMSG mentions this

The goals to be achieved in connection with the fulfillment of this task

Activity of the mP. Section 30 Paragraph 2 AMSG also explicitly norms this
Commitment of the mP to labor market monitoring and statistics

care for. By detailing the principles governing task fulfillment
must be taken as a basis; Section 31 AMSG also states which

Demands must be met when fulfilling tasks. Section 25 Paragraph 1 AMSG
limits the authorization for processing to the statutory task and

to such processing that is essential for the fulfillment of the task

are prerequisites. This is done by listing the data and the
direct connection between the same and the permitted processing purpose

It regulates in a predictable manner for the data subject which data and for what purpose
may be processed. There is no doubt that this violates §§ 29

up to 31 AMSG the task in connection with which the mP is to be processed
the data listed in Section 25 Paragraph 1 AMSG is authorized, and thus the

Framework for the permitted purpose of data processing is sufficiently clear and
describe precisely. That the assessment of the labor market opportunities of one

a relevant parameter for an efficient person looking for work

Employment placement is obvious. It can therefore be assumed
that a subject to the law is given in view of the mP

Task and the services to be provided - in particular the
The care plan to be drawn up in accordance with Section 38c AMSG - is sufficiently clear

It is clear that processing in accordance with Section 25 Paragraph 1 AMSG
The data listed also helps to assess the positioning of each

relevant job seekers on the labor market and thus for

this purpose, which is necessary for the fulfillment of the public task,
can be used.

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

40 out of 53

64 Furthermore, with regard to the health data affected on a case-by-case basis,

the special categories of personal data within the meaning of
Art. 9 Para. 1 GDPR must be counted, it should be noted that it is in accordance with the requirements

There is no doubt about the case law of the ECJ cited above

can ensure the best possible integration of job seekers
The legislative objective applicable to the national labor market is significant

pursues public interest within the meaning of Article 9 Paragraph 2 Letter g GDPR
but this objective in connection with efficient use

state support resources and optimization of social satisfaction

job-seekers on the one hand and the best possible care for the
labor market on the other hand. That case-related data processing in one

appropriate relationship to the task assigned by law
pursued goals is not and is not in dispute

visible. This is particularly because, according to the findings in
According to the contested finding, only those health data are processed

which restrict the exercise of activities in the labor market and therefore

are directly related to the employment placement.

65 The provisions regarding the duty of confidentiality of the bodies of the mP in

§ 27 AMSG and the detailed provisions on disclosure and
Storage of the data in Section 25 Paragraphs 2 to 11 AMSG leaves no room for doubt

to fulfill the measures required by Art. 9 Para. 2 lit. g GDPR
Preservation of the essence of the fundamental right enshrined in Article 8 GRC

Protection of personal data (see the concept of the essential content guarantee
ECJ April 8, 2014, Digital Rights Irefond et al., C‑293/12 and C‑594/12, para. 40;

see also bakers in Kühling/Buchner, DSG-VO, BDSG, comment,

3rd edition, 2020, Art. 23 Rn. 57) as well as the fundamental rights and interests of the
affected persons. The revision does not bring forward anything concrete,

which calls this view into question.

66 Insofar as the appeal repeatedly points out that the BVwG has the

Character of profiling as a special processing procedure
There is no connection with the requirements of Articles 6 and 9 GDPR

observed, it is not clear from the statements to what extent the mentioned

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

41 out of 53

There are other requirements for this form of processing

should provide a justifying legal basis, especially since neither Article 6 nor
Art. 9 GDPR refer to Art. 4 Z 4 GDPR. That of revision in it

It may be agreed that profiling is a special form of processing
does not change this view per se. The peculiarity of the

Rather, profiling is taken into account in Art. 22 GDPR, whereby the
Dangerous nature of this form of processing as formulated there

prohibition or in the reasons for justification there

Precipitation finds.

In this respect, the revision - including in this context - is based on the

Requirements of Section 1 Paragraph 2 DSG, the case law of
Constitutional Court on the legality principle of Article 18 B-VG and the

insufficient legal basis of the federal directive because of it
refers to insufficient commitment, please refer to the comments on point

5.2. to point out.

67 Does the revision point out that in order to exercise the rights concerned,

It is necessary that “the data collection is carried out in a way that is suitable for those affected by it
[...] foreseeable manner and in a manner that is at most contestable

“duly verifiable form”, it should be noted that the
Data collection itself is not even an issue in this case.

The subject of the appeal proceedings is rather that of the
Prohibition issued by the appellant regarding the appeal

Processing of data. The data to be collected itself is also set out in Section 25

Paragraph 1 AMSG is listed in detail so that there is no doubt about it
There is predictability about the type of data to be collected.

68 If the appeal further refers to this, it follows from

Recital 41 second sentence GDPR that from the legal basis itself

It must be clear and predictable which data processing will take place
carried out, this is not reflected in the wording of the recital

to bring harmony. This states that “the corresponding legal basis
or legislative measure [...] should be clear and precise and their

Application [...] for those subject to the law in accordance with the jurisprudence of

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

42 out of 53

Court of Justice of the European Union and the European Court of Justice for

“Human rights [should] be predictable.” To what extent this recital
the order of Article 6 Paragraph 1 Letter e GDPR, according to which the purpose of the

Processing may be necessary for the performance of a public task

It is not clear that the content should be determined in more detail.
Art. 6 Para. 3 GDPR, on the other hand, expressly speaks of the need for one

Legal basis from which the purpose of the processing can be derived
must, or the relevant task in the public interest to which the

data processing must be attributed. In this respect, the revision in this

In this context, the second sentence of Section 1 (2) of the DSG is repeatedly referred to
these in turn refer to the statements under point 5.2. to refer to what

this legal provision does not apply in each case.

69 This is used by the revision as a yardstick for the sufficient specification of a

The legal basis for the decision of the ECJ of October 6, 2020,
C-511/18, C-512/18 and C-520/18, were issued on the interpretation of Article 15(1).

Directive 2002/58/EC of the European Parliament and of the Council of
July 12, 2002 on personal data processing and protection

privacy in electronic communications (Privacy Policy

for electronic communications, OJ 2002, L 201, p. 37). This into the meeting
The judgment of the ECJ is not relevant because it violates the principle of

Data minimization is treated in accordance with Art. 5 lit. c GDPR. On this
The appellant's decision was not supported in principle.

70 The appeal must be agreed that when processing special data
Categories of personal data within the meaning of Article 9 Paragraph 1 GDPR

special intervention circumstances of Art. 9 Para. 2 GDPR are relevant. She
In this context, criticizes the reasoning of the BVwG, according to which a

Review of Section 25 Paragraph 10 AMSG to ensure compliance with the requirements

necessary data security measures did not have to be taken,
because this is not the subject of the review by the appeal applicant

has been.

71 However, even if this view of the BVwG were not correct, the appeal

does not show to what extent the guarantees for data security in this case

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

43 out of 53

Case - different from that under 5.3.2.1. shown

assessment - would be inadequate. So nothing comes of the appeal applicant
brought forward, which would lead to the assumption that with the

Obligations of confidentiality of the organs and in particular with the prohibition of

Disclosure of health data in accordance with Section 25 Paragraph 8 AMSG
employers and the legal precautions regarding storage

and ensuring data security on a case-by-case basis is not for one in mind
Sufficient data protection is ensured in accordance with the provisions of the GDPR

be.

5.4. On the question of the existence of an automated decision within the meaning of

Art. 22 Para. 1 GDPR

72 The appeal repeatedly points out that the BVwG has the character of

Profiling is not taken into account as a special processing procedure. It will happen
from Recital 41, second sentence of the GDPR, that from the

The legal basis itself must be clearly visible and predictable

Data processing is carried out. The job seekers also ran
There is a risk that AMAS' assumptions will be changed without further processing

could be taken over.

73 With this argument, the appeal concerns the legality of the

processing that is the subject of the proceedings against the background of
Art. 22 GDPR.

74 5.4.1. The ECJ has in its - for the present appeal decision
to be seen - recent judgment of December 7, 2023, C-634/21,

SCHUFA Holding [Scoring] on the request for a preliminary ruling
Art. 267 TFEU, submitted by the Wiesbaden Administrative Court

(Germany) by decision of October 1, 2021, submitted question

regarding the interpretation of Article 22 Para. 1 GDPR as follows:

“40 With its first question, the referring court essentially wants:
know whether Article 22 Para. 1 GDPR is to be interpreted as meaning that a
“automated decision in individual cases” within the meaning of this provision
exists if a claim is based on personal data about a person
Probability value in relation to their ability to fulfill future requirements

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

44 out of 53

Payment obligations are created automatically by a credit reporting agency

will, provided that this probability value significantly determines whether a
Third party to whom this probability value is transmitted
The contractual relationship with this person is established, executed or terminated.

41 To answer this question, it should first be noted that:
the interpretation of a provision of Union law not only its wording,
but also the context in which it stands, as well as the purposes and
objectives pursued by the legal act to which it is a part
must be taken into account (judgment of June 22, 2023, Pankki S, C‑579/21,
EU:C:2023:501, paragraph 38 and the case law cited therein).

42 As far as the wording of Article 22 Para. 1 GDPR is concerned, this is what it looks like
Provision stipulates that a data subject has the right, not one
solely based on automated processing - including

Profiling - to be subjected to decision based on it
has legal effect or is similarly significant
impaired.

43 The applicability of this provision therefore depends on three cumulative factors
prerequisites, namely that, firstly, a 'decision'
must be available, secondly, this decision 'exclusively on one
automated processing, including profiling, must be based on and
thirdly, they have ‘legal effect vis-à-vis [the person concerned]’
or must affect it ‘in a similar significant way’.

44 As regards, first, the requirement for the existence of a decision,
It should be noted that the term 'decision' within the meaning of Article 22
Paragraph 1 GDPR is not defined in this regulation. Already from the

However, the wording of this provision shows that this term does not apply
only refers to actions that have legal effect on the person concerned
person develop, but also on actions that this person is similar to
significantly affect.

45 The broad meaning of the term 'decision' is defined by the
Recital 71 of the GDPR confirms that a decision on
Assessment of personal aspects that affect a person, 'a measure
[may] include', which either has 'legal effect for the person concerned
Person' develops or 'significantly affects him in a similar way', whereby
the data subject should have the right not to make such a decision

to be subjugated. According to this recital, the
The term 'decision', for example, means the automatic rejection of a decision
Online loan application or online hiring process without any
human intervention.

46 Since the term 'decision' within the meaning of Article 22 Paragraph 1 GDPR,
as the Advocate General pointed out in point 38 of his Opinion, several

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

45 out of 53

Actions can involve the affected person in many ways

can affect, this term is broad enough to cover the result of the
Calculation of a person's ability to fulfill future needs
Payment obligations in the form of a probability value
to include.

47 Secondly, as regards the requirement that the decision in the sense
of Art. 22 Para. 1 GDPR 'exclusively on an automated basis
Processing, - including profiling - [must be based]', it says
Advocate General stated in point 33 of his Opinion that one
Activity like that of SCHUFA in the definition of 'profiling'

Art. 4 No. 4 GDPR corresponds and that this requirement is therefore in place
present case is fulfilled; the wording of the first question refers
Furthermore, we expressly refer to the automated creation of one
personal data about a person based probability value
regarding their ability to service a loan in the future.

48 Thirdly, as regards the requirement that the decision against
the data subject has 'legal effect' or it has 'a similar effect'
The content of the document must have a significant impact on it
first question that the actions of the third party, the

Probability value is transmitted, 'relevant' from this value
is directed. According to the facts of the case submitted by the presenter
Court in a case addressed to a bank by a consumer
Loan application has an insufficient probability value in almost all
In some cases, the bank may refuse to grant the requested loan.

49 Consequently, it can be assumed that the third requirement, of which
the application of Art. 22 Para. 1 GDPR depends, is fulfilled because a
Probability value like that at issue in the main proceedings
affected person is at least significantly impaired.

50 Therefore, in circumstances such as those in the main proceedings, in which
that determined by a credit reporting agency and reported to a bank
Probability value plays a significant role in granting a
Credit plays, the determination of this value as such is a decision

to be classified as a person within the meaning of Article 22 Paragraph 1 GDPR
data subject has legal effect or in a similar way
significantly impaired'.

51 This interpretation is influenced by the context in which Article 22
Paragraph 1 GDPR stands, as well as the purposes and objectives associated with it
Regulation to be pursued is supported.

52 In this regard, it should be noted that, as the Advocate General stated in point 31
in its Opinion stated that Art. 22 Para. 1 GDPR was the data subject
Person who gives the 'right', not one solely based on an automated one

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

46 out of 53

Processing - including profiling - subject to decision

to become. This provision imposes a fundamental ban on
Violation cannot be claimed individually by such a person
are needed.

53 As can be seen from Article 22 Para. 2 GDPR in conjunction with
As can be seen from recital 71 of this regulation, the adoption of a
based exclusively on automated processing
Decision only permissible in the cases mentioned in Article 22 paragraph 2, i.e. H.,
if they are necessary for the conclusion or performance of a contract between the
the person concerned and the person responsible is required (letter a),

if they are based on Union or Member State law,
which the controller is subject to, is permissible (letter b) or if they are with
express consent of the data subject (letter c).

54 Furthermore, Article 22 Paragraph 2 Letter b and Paragraph 3 GDPR provides that
appropriate measures to safeguard rights and freedoms as well as the
legitimate interests of the data subject must be taken into account. In
the cases referred to in Article 22(2)(a) and (c) of this Regulation
the person responsible grants the data subject at least the right to
Obtaining the intervention of a person upon presentation of one's own

position and to challenge the decision.
55 Furthermore, according to Art. 22 Para. 4 GDPR, automated decisions may be made
in individual cases within the meaning of this Article 22 only in certain special cases

special categories of personal data in accordance with Article 9 Paragraph 1 of this
Regulation based.
56 In addition, in the case of an automated

Decision-making such as that within the meaning of Art. 22 Para. 1 GDPR
one of the persons responsible has additional information obligations in accordance with Article 13
Paragraph 2(f) and Article 14(2)(g) of this Regulation. On the other hand
is the responsibility of the data subject in accordance with Article 15 Paragraph 1 Letter h GDPR
Right to information to the person responsible for processing
in particular 'meaningful information about the logic involved as well
the scope and intended effects of such

Processing for the data subject concerns.
57 These higher requirements for the legality of an automated
Decision-making and the additional information obligations of the

Those responsible and the associated additional information rights
The data subject explains the purpose pursued by Article 22 of the GDPR
and which consists in protecting people from the particular risks to their rights and
Protect freedoms associated with automated processing
personal data - including profiling.

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

47 out of 53

58 This processing requires, as follows from

Recital 71 of the GDPR results in the assessment of personal aspects
in relation to the natural person affected by this processing,
especially for analyzing or predicting aspects related to them
work performance, economic situation, health, preferences or interests,
Reliability or their behavior, their location or change of location.

59 These particular risks are, according to this recital, capable of:
to impair the interests and rights of the data subject, in particular
with regard to any discriminatory effects compared to natural ones
people based on race, ethnic origin, political opinion,

Religion or belief, trade union membership, genetic
Dispositions or health status as well as sexual orientation. Therefore should
According to this recital, fair and fair treatment to the data subject
transparent processing can be guaranteed, in particular by the
Use of suitable mathematical or statistical methods for this
Profiling and through technical and organizational measures with which in

appropriately ensuring that the risk of errors is minimized
becomes.
60 The interpretation set out in paragraphs 42 to 50 of this judgment and

in particular the broad meaning of the term 'decision' in the sense of
Art. 22 Para. 1 GDPR strengthens the effective protection to which this is based
purpose.

61 However, in circumstances such as those in the main proceedings, this would be the case
involving three actors, there is a risk of circumvention
Art. 22 GDPR and consequently a gap in legal protection if a narrow one
Interpretation of this provision would be given preference according to which the
Determination of the probability value only as a preparatory action
and only the action taken by the third party
if applicable, as a “decision” within the meaning of Article 22 Paragraph 1 of this

Regulation can be classified.
62 In this case, the determination of a
probability value such as that at issue in the main proceedings

does not meet the special requirements of Article 22 Paragraphs 2 to 4 GDPR
are subject to, although this procedure is based on automated processing
is based and has effects that have a significant impact on the person concerned
affect the actions of the third party to which this
Probability value is transmitted, is largely guided by this.

63 Furthermore, the data subject could, as the Advocate General did in point 48
in his opinion, on the one hand with the credit reporting agency,
which determines the probability value that concerns them, their right to
Information about the specific ones mentioned in Article 15 Paragraph 1 Letter h GDPR

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

48 out of 53

Do not claim information if not automated

decision-making by this company. On the other hand it would be
the third party - assuming that the action taken by him
would fall under Art. 22 Para. 1 GDPR, as it meets the requirements for the
Application of this provision met - unable to comply with this specific
to provide information because he generally does not have it.

64 That the determination of a probability value like that in
The main proceedings in question are covered by Article 22 (1) GDPR,
has the effect, as stated in paragraphs 53 to 55 of this judgment,
that it is prohibited, unless one of the things mentioned in Art. 22 Para. 2 GDPR

Exceptions is applicable and the special requirements of Article 22
Paragraphs 3 and 4 GDPR are fulfilled.
65 What concerns in particular Article 22 Paragraph 2 Letter b GDPR, to which the

The reference to the referring court is clear from the wording of that court
Provision that national legislation authorizing the adoption of a
allow automated decision-making in individual cases
Measures to safeguard the rights and freedoms of those entitled to them
must contain the interests of the person concerned.

66 In the light of recital 71 of the GDPR, such
Measures include in particular the obligation of the person responsible to
to use appropriate mathematical or statistical methods, technical
and to take organizational measures in an appropriate manner

ensures that the risk of errors and errors is minimized
be corrected, and to secure personal data in a way that
the potential threats to the interests and rights of those affected
Person is taken into account and in particular to prevent it from happening to her
discriminatory effects occur. These measures
also include at least the right of the data subject
Obtaining the intervention of a person on the part of the person responsible

Presenting your own point of view and challenging those against it
issued decision.
67 It should also be noted that, according to settled case law

Court of Justice any processing of personal data with the in
Art. 5 GDPR stipulated principles for processing
personal data are consistent and in view of the provisions of Article 5
Paragraph 1 letter a of the principle of legality of the
Processing one of the conditions listed in Article 6 of this Regulation
for the lawfulness of the processing (judgment of

October 20, 2022, Digi, C‑77/21, EU:C:2022:805, paragraph 49 and there
cited case law). The person responsible must ensure compliance with this
Principles in accordance with the principle laid down in Article 5 Para. 2 GDPR

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

49 out of 53

be able to demonstrate accountability (cf. in this sense judgment of

October 20, 2022, Digi, C‑77/21, EU:C:2022:805, paragraph 24).
68 Is required by the legislation of a Member State in accordance with Article 22
Paragraph 2 letter b GDPR the issuance of an exclusively on one

Decision based on automated processing is permitted, this must be the case
Processing therefore not only those in the last-mentioned provision and in
22 Paragraph 4 GDPR, but also
the requirements in Articles 5 and 6 of this Regulation. Consequently, they may
Member States do not have legislation under Article 22
Paragraph 2 letter b GDPR enacted, according to which profiling is disregarded

the requirements of these Articles 5 and 6 as interpreted by the
The case law of the Court of Justice is admissible.
69 What in particular is that in Article 6 Paragraph 1 Letters a, b and f GDPR

the conditions for legality provided for in a case
like that in the main proceedings can apply
Member States are not authorized to apply additional rules
of these conditions, since such a power is provided for in Article 6
Paragraph 3 GDPR refers to those in Article 6 Paragraph 1 Letters c and e of this Regulation
reasons mentioned is limited.

70 What also concerns Article 6 Paragraph 1 Letter f GDPR in detail, may
the Member States are not affected by the GDPR in accordance with Article 22 Paragraph 2 Letter b of the GDPR
Requirements differ from the case law of the Court

according to the judgment of December 7, 2023, SCHUFA Holding
(Residual debt discharge) (C‑26/22 and C‑64/22, EU:C:2023:XXX), result,
especially not because they are the result of weighing each other up
conclusively prescribe conflicting rights and interests (cf. in
to this effect, judgment of October 19, 2016, Breyer, C‑582/14, EU:C:2016:779,
62).

71 In the present case, the referring court points out that only
§ 31 BDSG is a national legal basis within the meaning of Article 22 Paragraph 2
Letter b GDPR could represent. Regarding the compatibility of this
However, § 31 BDSG with Union law applies to this court

profound concerns. This provision should be considered consistent with Union law
are viewed as incompatible, SCHUFA would not only be without it
legal basis, but would ipso iure violate the provisions of Article 22
Paragraph 1 of the GDPR.

72 In this respect, it is for the referring court to examine whether Section 31 BDSG
qualifies as a legal basis within the meaning of Article 22 Paragraph 2 Letter b GDPR
according to which it would be permissible to use one exclusively on one
to adopt a decision based on automated processing. should that
The referring court comes to the conclusion that Section 31 is such

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

50 out of 53

legal basis, it would still have to examine whether the provisions in Article 22
Paragraph 2 letter b and paragraph 4 GDPR and in Articles 5 and 6 GDPR
requirements are met in this case.

73 In view of the foregoing, the answer to the first question is that Article 22
Paragraph 1 of the GDPR must be interpreted as meaning that an “automated decision”.
in individual cases' within the meaning of this provision if a
personal data about a person based probability value in

Regarding their ability to meet future payment obligations
is created automatically by a credit reporting agency, provided that it does so
The probability value depends significantly on whether a third party is responsible for this
Probability value is transmitted, a contractual relationship with this
Person establishes, carries out or terminates.”

75 5.4.2. From the reasons for the judgment given above
of the ECJ it can be concluded that the application of an automated

Processing - such as AMAS - as such already constitutes a decision
of Art. 22 Para. 1 GDPR can represent, without justification

legal basis within the meaning of Article 22 Paragraph 2 Letter b GDPR - the
Justifications for the necessity of automated

Decision to conclude a contract within the meaning of Article 22
Paragraph 2 lit. a GDPR or the existence of consent within the meaning of

Article 22 Paragraph 2 Letter c GDPR is not at issue on a case-by-case basis - the ban

of Article 22 Paragraph 1 GDPR. Is there such an automated one?
Before making a decision, the relevant national legislation must comply with the

Allow the automated decision to be made in individual cases and also
appropriate measures to safeguard rights and freedoms as well as the

legitimate interests of the data subject (cf. the
Statements by the ECJ in C-634/21, paragraph 65).

76 According to the statements in the ECJ judgment cited, one
Automated data processing - such as profiling - itself an “automated

Decision in individual cases” within the meaning of Article 22 Paragraph 1 GDPR if
the result of this automated processing for a

certain - further - decision is decisive insofar as the action

of the third party is “significantly guided” by the profiling in question, and so on
significantly affects those affected (cf. the statements of the ECJ in

C-634/21, paragraphs 48 and 73).

Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

51 out of 53

77 5.4.3. Depending on the case, this results in the following:

78 5.4.3.1. First of all, it should be noted that the classification of the
mP applied automated, based on a mathematical-statistical

program processing of personal data
affected job seekers (in AMAS) as “profiling” in the sense

of Art. 4 Z 4 GDPR in accordance with the case law of the ECJ

in C-634/21 cannot be doubted.

79 According to the ECJ, this is already automated

Processing - here the determination of the IC value, which is the probability
integration into the labor market - itself (already) identified as one

“automated decision” within the meaning of Article 22 Paragraph 1 GDPR,
provided that this probability value determines the allocation to the

intended customer groups, and thus those affected
legal effect towards job seekers or similar

Significantly impaired.

80 That the final decision on the customer group allocation lies with the

Consultants of the mP are able to qualify the AMAS as one

automated decision within the meaning of Art. 22 Para. 1 GDPR is not applicable
prevent, the judgment of the ECJ is based on the facts that

Ultimately, the potential lender decides on the question of how the loan comes about
the credit agreement in question there. The - possibly - pure

formal separation of data processing from automated data processing is crucial
decision influenced by the automated data processing itself,

prevents the latter from being classified against the background of Art. 22 GDPR

This is a fundamentally forbidden decision (cf. again
ECJ C-634/21, paragraph 73). The finding of the BVwG that through

Instructions and training ensured that the
mP consultants do not question the result of the algorithm unconditionally

would take over, may now justify the assumption that

Classification into the respective customer group is not exclusive
due to the AMAS. However, this finding does not rule out that

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

52 out of 53

AMAS - as an automated decision - is ultimately decisive for this

Classification is.

81 Since the BVwG based on its - against the background of the judgment of

ECJ does not make any findings on the legal opinion that is to be regarded as incorrect

precise use of the AMAS - especially not specific ones
Findings on the question of which other parameters and to what extent

Take into account, or what procedure to use the
AMAS is provided - has already taken the question of

Automated processing is not relevant in this case

be assessed exhaustively legally.

82 5.4.3.2. Should the use of AMAS fall within the scope of Article 22

Paragraph 1 of the GDPR would result in it being prohibited unless
one of the exceptions mentioned in Article 22 Paragraph 2 GDPR is applicable and

the special requirements of Article 22 Paragraphs 3 and 4 GDPR are met.

83 Art. 22 Paragraph 2 Letter b GDPR contains an opening clause that allows the Union

and the Member States open up legislation for automated

to create decisions. The relevant - justifying - national ones
However, legislation would need to allow for the adoption of the automated

Allow decisions to be made in individual cases and also take appropriate measures
Safeguarding the rights and freedoms as well as the legitimate interests of the

the person concerned (cf. the ECJ's comments in C-634/21,

65). Furthermore, these would have to comply with the requirements of Articles 5 and 6 of the GDPR
the interpretation of which is sufficed by the case law of the Court of Justice

(cf. again ECJ C-634/21, para. 68).

84 The AMSG now obviously does not contain any provision with regard to the

case-related processing - the AMAS - the justification of the
Article 22 Paragraph 2 Letter b GDPR would be fulfilled.

85 The GDPR understands “legal basis” - and therefore also under
“Legal provision” in Article 22 Paragraph 2 Letter b GDPR - Recital 41

not necessarily one “adopted by a parliament”.

legislative act”. However, whether this is the case for the application of AMAS

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
December 21, 2023

53 out of 53

profiling, the claims of recital 41
legal requirements sufficient in terms of clarity, precision and predictability

A basis exists that meets the ECJ's requirements for the opening clause

(cf. again C-634/21, paras. 65 and 68), was by
BVwG - based on the legal opinion that AMAS does not constitute an automated system

Decision within the meaning of Article 22 Paragraph 1 GDPR - not examined.

86 5.5. According to the above, the appeal was ultimately upheld

and the contested finding as a result of the existence of the provisions under point 5.4.
secondary deficiencies in the findings due to the illegality of the

content in accordance with Section 42 Paragraph 2 Z 1 VwGG.

87 The BVwG will continue the proceedings as part of an oral hearing
Negotiation against the background of point 5.4. shown

Legal situation to discuss the legal situation with the parties and take this opportunity
to provide a statement or additional facts.

Vienna, December 21, 2023

Administrative Court

Judenplatz 11, 1010 Vienna
www.vwgh.gv.at

@@ Line 41: / Line 41: @@
 |EU_Law_Link_2=
-|National_Law_Name_1=§1(2) DSG
+|National_Law_Name_1=Article 1 §2 DSG
-|National_Law_Link_1=
+|National_Law_Link_1=https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P2/NOR40139563
 |National_Law_Name_2=§25(1) AMSG
-|National_Law_Link_2=
+|National_Law_Link_2=https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10008905&Artikel=&Paragraf=25&Anlage=&Uebergangsrecht=
 |National_Law_Name_3=§38(c) AMSG
-|National_Law_Link_3=
+|National_Law_Link_3=https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10008905&FassungVom=2017-05-16&Artikel=&Paragraf=38c&Anlage=&Uebergangsrecht=
 |National_Law_Name_4=
 |National_Law_Link_4=
@@ Line 92: / Line 92: @@
 The result was used as a starting point for counsellors to work with jobseekers to assess their potential and any obstacles in the labour market integration.
-The controller claimed it had a legal basis under Austrian national law (the Arbeitsmarktservicegezetz, AMSG) to process data with the help of an algorithm. According to [[Article 4 GDPR#4|Article 4(4) GDPR]], this processing of data is considered profiling. However, the DPA found that a legal authorisation for this processing was lacking in the AMSG, which is necessary under Austrian data protection law (see §1(2) DSG).
+The controller claimed it had a legal basis under Austrian national law (the Arbeitsmarktservicegezetz, AMSG) to process data with the help of an algorithm. According to [[Article 4 GDPR#4|Article 4(4) GDPR]], this processing of data is considered profiling. However, the DPA found that a legal authorisation for this processing was lacking in the AMSG, which is necessary under Austrian data protection law (see&nbsp;[https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563 Article&nbsp;1&nbsp;§2&nbsp;DSG]).
 The DPA also found there was a case of automated individual decision-making under [[Article 22 GDPR|Article 22 GDPR]]. Although the results of the algorithm are not binding as the final decision lies with the counsellor, the DPA contested that it cannot be ruled out that in individual cases, the decision will be based exclusively on profiling.
@@ Line 102: / Line 102: @@
 The Federal Administrative Court upheld the controller’s appeal against the decision of the DPA. In its reasoning, the Court stated that the controller should ensure there is a support plan between the counsellor and jobseeker. Moreover, the controller should provide counsellors with instructions and training to ensure they do not accept the result of the algorithm unquestioningly.
-The Court held that the controller is allowed to carry out an assessment of personal data in accordance with national law (§25(1) AMSG). Moreover, it cannot be assumed that the mere use of automated processing already results in “informational added value”. Moreover, [[Article 22 GDPR|Article 22 GDPR]] does not apply, as the final decision lies with the counsellors and therefore the decision-making is not based solely on automated processing. The Court concluded that the DPA decision should be annulled due to the lack of violation of the principle of lawful data processing under [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]].
+The Court held that the controller is allowed to carry out an assessment of personal data in accordance with national law (see [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10008905&Artikel=&Paragraf=25&Anlage=&Uebergangsrecht= &nbsp;§25(1)&nbsp;AMSG&nbsp;]). Moreover, it cannot be assumed that the mere use of automated processing already results in “informational added value”. Moreover, [[Article 22 GDPR|Article 22 GDPR]] does not apply, as the final decision lies with the counsellors and therefore the decision-making is not based solely on automated processing. The Court concluded that the DPA decision should be annulled due to the lack of violation of the principle of lawful data processing under [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]].
 The DPA appealed the decision before the Verwaltungsgerichtshof (Supreme Administrative Court).
 === Holding ===
-The Supreme Administrative Court found that the lawfulness of the data processing at issue in the proceeding must be examined, because under Austrian national law (see §38(C) AMSG) the data processing in question is a private-sector activity and not a public service task.
+The Supreme Administrative Court found that the lawfulness of the data processing at issue in the proceeding must be examined, because under Austrian national law (see [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10008905&FassungVom=2017-05-16&Artikel=&Paragraf=38c&Anlage=&Uebergangsrecht= §38c AMSG]) the data processing in question is a private-sector activity and not a public service task.
 The DPA argued that the Federal Administrative Court did not take into account the character of profiling as a special processing procedure and challenged the lawfulness of the processing under [[Article 22 GDPR|Article 22 GDPR]].
-The Court found that the controller’s algorithm in itself is an automated decision under [[Article 22 GDPR#1|Article 22(1) GDPR]] based on the recent CJEU decision, C-634/21 Schufa. The Court explained that the algorithm decides on the allocation of jobseeker’s group and thus has a legal effect on the jobseekers concerned or similarly significantly affects them. The fact that the final decision on the jobseeker’s group assignment lies with the counsellor, does not prevent the algorithm from being classified as an automated decision under [[Article 22 GDPR#1|Article 22(1) GDPR]]. The CJEU decision is also based on the fact that the controller makes the final decision. The Supreme Administrative Court found that the instructions and trainings that were provided to ensure counsellors would not accept the algorithm’s results unquestioningly could not exclude the possibility that the algorithm is ultimately decisive for the allocation.
+The Court found that the controller’s algorithm in itself is an automated decision under [[Article 22 GDPR#1|Article 22(1) GDPR]] based on the recent CJEU decision [[CJEU - C‑634/21 - SCHUFA|C-634/21 - Schufa]]. The Court explained that the algorithm decides on the allocation of jobseeker’s group and thus has a legal effect on the jobseekers concerned or similarly significantly affects them. The fact that the final decision on the jobseeker’s group assignment lies with the counsellor, does not prevent the algorithm from being classified as an automated decision under [[Article 22 GDPR#1|Article 22(1) GDPR]]. The CJEU decision is also based on the fact that the controller makes the final decision. The Supreme Administrative Court found that the instructions and trainings that were provided to ensure counsellors would not accept the algorithm’s results unquestioningly could not exclude the possibility that the algorithm is ultimately decisive for the allocation.
-The Court further held that the algorithm did not fall under the exceptions of Article 22(2) GPDR. Therefore, the Court concluded that the appeal had to be upheld and that the decision of the Court of Appeal needed to be set aside.
+The Court further held that the algorithm did not fall under the exceptions of [[Article 22 GDPR#2|Article 22(2) GDPR]]. Therefore, the Court concluded that the appeal had to be upheld and that the decision of the Court of Appeal needed to be set aside.
 == Comment ==
-In paragraph 15 and 20 of the decision, the Court refers to [[Article 9 GDPR#2d|Article 9(2)(d) GDPR]], which is incorrect. It should be Article 9(2)(g), which is about the substantial public interest.
+In paragraph 15 and 20 of the decision, the Court refers to [[Article 9 GDPR#2d|Article 9(2)(d) GDPR]], which is incorrect. It should be [[Article 9 GDPR#2g|Article 9(2)(g) GDPR]], which is about the substantial public interest.
 == Further Resources ==