BVwG - W252 2246156-1

BVwG - W252 2246156-1
Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 15 GDPR § 133 B-VG §24 DSG
Decided:	22.01.2024
Published:	20.02.2024
Parties:
National Case Number/Name:	W252 2246156-1
European Case Law Identifier:	ECLI:AT:BVWG:2024:W252.2246156.1.00
Appeal from:
Appeal to:	Not appealed
Original Language(s):	German
Original Source:	Rechtsinformationssystem des Bundes (in German)
Initial Contributor:	Annkathrin.a.dix

The court clarified the scope of the right to information under Article 15 GDPR, and how it is balanced against the right to confidentiality.

English Summary

Facts

On 9 April 2020, the data subject sent an access request to the legal representative of the data subject's former landlord. MP provided the complaint with information about their personal data and processed a rental agreement and communications between BF and their landlord, without providing copies of these to BF.

On 11 May 2020, the data subject lodged a complaint at the Austrian DPA ("Datenschutzbehörde"), arguing that MP had violated their right of access by providing incomplete information. In particular, documents like their rental agreement and email correspondence were missing.

On 22 July 2021, the DPA dismissed the complaint, stating that the right of access does not include the release of entire documents.

On 30 August 2021, the data subject appealed the DPA's decision at the Federal Administrative Court ("Bundesverwaltungsgericht"), arguing that copies of documents like land register and company register extracts, as well as various correspondence, were still missing.

Holding

Regarding the right of access

The data subject claimed the MP (the data controller) did not provide all information about the origin of the data and did not provide copies of certain documents. Regarding the origin of the data, the BF's argument was not specific and the MP transparently explained the sources of the individual data points. There is thus no violation of the right to information, as the origin of all the relevant data was clear.

Regarding the land register extract of property and the commercial register extract

The complainant objected to the lack of a land register extract and company register extract in the initial proceedings. The MP subsequently provided the additional information on these two extracts in its statement on 13 July 2023. Since the property and company belong to the BF itself, the transmission of copies was deemed unnecessary, as the BF was already aware of the context. Section 24(6) of the Data Protection Act (Datenschutzgesetz (DSG)) grants a respondent the ability to remedy an alleged violation of law by complying with the complainant's requests, even after the proceedings have started. This provision aims to protect the rights of affected persons. The court ruled that there is no right to a determination of a past violation of the right to information under this provision. The procedural objective was achieved by providing the missing information. The court thus held that a violation of the right to information was no longer possible regarding these specific documents, and the complaint could not be upheld on this point.

Regarding the copies of communication between the data subject and their landlord and controller

The right to a copy is not an independent right — the release of entire documents is generally not covered by the right to information, except in cases where the context is important for comprehensibility. In the present case, a copy of the requested documents was not necessary for comprehensibility, as the BF was already aware of the essential content of the communications. The information provided contained the relevant data, and the BF did not explain which parts were incorrect or incomprehensible. The information was thus complete, because the information was understandable for BF, even without such copies.

Regarding the copies of the communication between the controller and their client

The right to information is not unlimited — restrictions can be placed on it by virtue of a balancing act in the event of a conflict. The right to complete and comprehensive information may therefore be limited where the rights of other persons prevail, including situations involving lawyers acting in accordance with their client’s right to confidentiality. MP provided information based on Article 15 GDPR and invoked attorney-client privilege in relation to the communication with their client. If such communication contained personal data of BF, the BF’s right to information must be balanced with the attorney-client privilege. The court considered the following interests: BF being fully aware of the content of the communication between MP and their client pending a legal dispute and MP’s right to confidentiality, and that of their client. The lawyer's duty of confidentiality is an essential element of the rule of law and access to justice. Clients must be able to trust that information provided to their lawyer will remain confidential — undermining this confidentiality would undermine the right to legal representation. The court found that the lawyer's duty of confidentiality and the client's interest in keeping the communication secret outweigh the data subject's right to information. This applies even after the legal proceedings have concluded, as the duty of confidentiality continues indefinitely.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Decision date

January 22, 2024

Standard

B-VG Art. 133 Paragraph 4
DSG §24
DSGVO Art. 15

B-VG Art. 133 today B-VG Art. 133 valid from January 1, 2019 to May 24, 2018, last amended by BGBl. I No. 138/2017 B-VG Art. 133 valid from January 1, 2019, last amended by BGBl. I No. 22/2018 B-VG Art. 133 valid from May 25, 2018 to December 31, 2018, last amended by BGBl. I No. 22/2018 B-VG Art. 133 valid from August 1, 2014 to May 24, 2018, last amended by BGBl. I No. 164/2013 B-VG Art. 133 valid from 01.01.2014 to 31.07.2014 last amended by BGBl. I No. 51/2012 B-VG Art. 133 valid from 01.01.2004 to 31.12.2013 last amended by BGBl. I No. 100/2003 B-VG Art. 133 valid from 01.01.1975 to 31.12.2003 last amended by BGBl. No. 444/1974 B-VG Art. 133 valid from 25.12.1946 to 31.12.1974 last amended by BGBl. No. 211/1946 B-VG Art. 133 valid from 19.12.1945 to 24.12.1946 last amended by StGBl. No. 4/1945 B-VG Art. 133 valid from 03.01.1930 to 30.06.1934

DSG Art. 2 § 24 today DSG Art. 2 § 24 valid from 15.07.2024 last amended by BGBl. I No. 70/2024 DSG Art. 2 § 24 valid from 25.05.2018 to 14.07.2024 last amended by BGBl. I No. 120/2017 DSG Art. 2 § 24 valid from 01.01.2010 to 24.05.2018 last amended by BGBl. I No. 133/2009 DSG Art. 2 § 24 valid from 01.01.2000 to 12/31/2009

Ruling

W252 2246156-1/13E

IN THE NAME OF THE REPUBLIC!

The Federal Administrative Court, through Judge Mag.a Elisabeth SCHMUT LL.M. as chair and the expert lay judges Dr. Claudia ROSENMAYR-KLEMENZ and Mag.a Adriana MANDL as assessors, has rightly ruled on the complaint by XXXX , XXXX (co-party before the Administrative Court: XXXX ), against the decision of the Data Protection Authority dated July 22, 2021, GZ XXXX , in a closed session in a data protection matter:The Federal Administrative Court, through Judge Mag.a Elisabeth SCHMUT LL.M. as chairperson and the expert lay judges Dr. Claudia ROSENMAYR-KLEMENZ and Mag.a Adriana MANDL as assessors on the complaint of roman XXXX , roman XXXX (co-party before the administrative court: roman XXXX ), against the decision of the data protection authority dated July 22nd, 2021, GZ roman XXXX , in a closed session in a data protection matter, rightly ruled:

A) The complaint is dismissed.

B) The appeal is not admissible.

Text

Reasons for the decision:

I. Course of proceedings: roman one. Course of proceedings:

1. By submission of May 11th, 2020, the complainant (hereinafter "BF") filed a data protection complaint with the authority concerned and, in summary, argued that the co-party (hereinafter "MP") had violated his right to information by providing him with incomplete information. In particular, documents such as a rental agreement concluded by him and email correspondences are missing.

2. In a decision dated July 22, 2021, the authority concerned rejected the complaint as unfounded. In summary, it stated that the right to information does not include the release of entire documents.

3. The complaint in question from the BF dated August 30, 2021 is directed against this decision. In this, the BF essentially states that copies of documents, such as an extract from the land register or company register, and various correspondence are still missing.

4. The authority concerned submitted the administrative act in a written submission dated September 3, 2021, received on September 8, 2021, and requested that the complaint be dismissed - with reference to the reasons for the decision.

5. In a statement dated July 13, 2023, the MP submitted information on an extract from the land register and the company register. Which were sent to the BF by the Federal Administrative Court with a party hearing on July 26, 2023.

Evidence was obtained by examining the administrative and court files.

II. The Federal Administrative Court considered: Roman II. The Federal Administrative Court considered:

1. Findings:

1.1. The BF sent a request for information to the MP on April 9, 2020. The MP is the lawyer for the BF's former landlord.

1.2. The MP1 provided the BF with information about his personal data in letters dated April 10, 2020 (OZ 1, p. 16 f) and April 29, 2020 (OZ 1, p. 13 f). The information includes, among other things, master data, claim data and asset data. As part of the information, the MP sent an extract from the central residents’ register and four land register extracts concerning BF properties in XXXX , XXXX , XXXX and XXXX .1.2. The MP1 provided BF with information about his personal data in letters dated April 10, 2020 (OZ 1, p. 16 f) and April 29, 2020 (OZ 1, p. 13 f). The information includes, among other things, master data, claim data and asset data. As part of the information, the MP sent an extract from the central residents’ register and four land register extracts concerning BF properties in Roman XXXX , Roman XXXX , Roman XXXX and Roman XXXX .

1.3. The MP also processes a rental agreement and several e-mails from the BF. The MP informed the BF of the existence of this data, but did not send a copy of the rental agreement or the emails.

The BF is aware of the essential content of his own rental agreement and the communication between him and his landlord as well as that between him and the MP. In its statement of June 5, 2020, the MP pointed out that the correspondence with its client (the BF's landlord) was subject to professional secrecy and refused to provide information in this regard (OZ 1, p. 85 f).

1.4. In a statement of July 13, 2023, the MP stated that it had processed another land register extract from the BF concerning a property in XXXX on April 9, 2020 and a commercial register extract from the BF's company "XXXX GmbH" on December 17, 2018 and stated the data category, the purpose of processing and the data origin. The BF received this statement during the hearing of the parties on July 26, 2023 and considered the information in its subsequent reply regarding these extracts to be complete.1.4. In a statement dated July 13, 2023, the MP stated that it had processed another land register extract from the BF concerning a property in Roman XXXX on April 9, 2020 and a commercial register extract from the BF's company "Roman XXXX GmbH" on December 17, 2018 and stated the data category, the purpose of processing and the data origin. The BF received this statement during the hearing of the parties on July 26, 2023 and considered the information in its subsequent reply regarding these extracts to be complete.

1.5. With regard to the data origin, the MP announced that the BF's data came from his rental agreement. The BF's address comes from the ZMR, the land register data from the public land register, the company register extract from the company register and the BF's email address and email traffic itself. The deposit claim and the procedural costs were determined from the court files.

2. Assessment of evidence:

2.1. The finding regarding the BF's request for information and that the MP is the lawyer for the BF's former landlord arises from the unobjectionable administrative act. The BF submitted the request for information as part of its data protection complaint. Both the BF and the MP repeatedly stated in the proceedings that the MP was the lawyer for the BF's landlord in several legal disputes. Based on the consistent and comprehensible statements of both parties, the agency relationship was credible (OZ 1, p. 15).

2.2. The information provided by the MP is included in the administrative act. The content of these was not disputed and is understandable due to the complete transmission to the authority concerned and the recording in the administrative act. The only disputed issue is the completeness of the information with regard to "missing" copies of documents and the origin of the data, but not the content of the information actually provided or the copies actually transmitted (OZ 1, p. 13 f, 16 f, 56 f, 60 ff, 85 f).

2.3. The fact that the MP processed a rental agreement and several emails from the BF, informed the BF of this, but did not provide information or send copies, is evident from the coherent submissions of the BF and the MP. The BF stated several times that copies of these documents were still missing. The MP referred to these documents in its statement, but pointed out that the BF already had these documents or that they came from him and therefore did not need to be sent in copies (OZ 1, p. 85 f).

The finding that the BF is aware of his own rental agreement and the email correspondences he conducted is based on the fact that the BF wrote these emails himself. These emails are related to the BF's court proceedings regarding his rental apartment at the time. It could therefore be assumed that the BF was concerned with the content of his rental agreement or the emails he wrote or sent to him in connection with the court proceedings. It was therefore established that the BF remembers the essential content of these emails. In addition, it can be assumed that the corresponding conversations are still stored in his email account.

The refusal to provide information/transmit the email history of the MP with her client and the appeal to professional secrecy are clearly evident from her statement of June 5, 2020 (OZ 1, p. 86).

2.4. The finding that the MP processed another land register extract and a commercial register extract for the BF results from the MP's statement of July 13, 2023 (OZ 6). In this, it credibly stated when and where these came from (land and commercial register) and for what purpose (submission before the BG XXXX ) they were processed. The transmission by means of a party hearing to the BF results from the postal service's proof of delivery (OZ 8). In its reply of August 11, 2023, the BF only listed various correspondence as "missing" or incomplete and confirmed the information on land register and commercial register extracts (cf. OZ 9, p. 1 f).2.4. The finding that the MP processed another land register extract and a commercial register extract for the BF results from the MP's statement of July 13, 2023 (OZ 6). In this, she credibly stated when and where they came from (land and company register) and for what purpose (submission before the Federal Court of Appeal Roman XXXX) they were processed. The transmission by means of a party hearing to the BF is evident from the postal service's proof of delivery (OZ 8). In its reply of August 11, 2023, the BF only listed various correspondence as "missing" or incomplete and confirmed the information on land and company register extracts (see OZ 9, p. 1 f).

2.5. The respective origin of the data can be seen from the information dated April 10, 2020, the statement dated June 5, 2020, or the statement dated July 13, 2023, in which this is listed in a comprehensible manner (OZ 1, p. 56 f, 85 f; OZ 6).

3. Legal assessment:

On A)

The admissible complaint is not justified.

3.1. On the right to information:

According to Art. 15 (1) GDPR, every data subject has the right to request confirmation from the controller as to whether personal data concerning him or her is being processed; if this is the case, he or she has the right to information about this personal data and the information referred to in letters a to h. If the data was not collected from the data subject himself or herself, the controller must provide information about all available information about the origin of the data in accordance with Art. 15 (1) letter g GDPR. Article 15 paragraph 3 of the GDPR stipulates that the controller shall provide a copy of the personal data being processed in the sense of a faithful and intelligible reproduction. According to Article 15 paragraph one of the GDPR, every data subject has the right to obtain confirmation from the controller as to whether personal data concerning him or her are being processed; if so, he or she has the right to information about this personal data and the information referred to in letters a to h. If the data has not been collected from the data subject himself or herself, the controller shall provide information about all available information about the origin of the data in accordance with Article 15 paragraph one of the GDPR, letter g. Article 15 paragraph 3 of the GDPR stipulates that the controller shall provide a copy of the personal data being processed in the sense of a faithful and intelligible reproduction.

Article 15(3) GDPR sets out the practical modalities for fulfilling the right to information by, among other things, specifying in sentence 1 the form in which the "personal data being processed" must be made available, namely in the form of a "copy". However, Article 15 GDPR cannot be interpreted as granting a different right in paragraph 3 sentence 1 than that provided for in paragraph 1. There is therefore no general right to receive copies of entire documents within the scope of information. However, in order to ensure that the information provided in this way is easily understandable, the reproduction of extracts from documents or even entire documents may prove essential if the contextualization of the data processed is necessary to ensure their comprehensibility (see in this sense ECJ 04.05.2023, C-487/21, Austrian Data Protection Authority, paras. 31 et seq.; 41, 45).Article 15, paragraph 3, GDPR sets out the practical modalities for fulfilling the right of information by specifying, among other things, in sentence 1 the form in which the "personal data that are the subject of the processing" are to be made available, namely in the form of a "copy". However, Article 15, GDPR cannot be interpreted as granting a different right in paragraph 3, sentence 1 than that provided for in paragraph 1. There is therefore no general right to receive copies of entire documents within the scope of information. In order to ensure that the information provided in this way is easy to understand, however, the reproduction of extracts from documents or even entire documents may prove essential if the contextualization of the data processed is necessary to ensure their comprehensibility (see in this sense ECJ 04.05.2023, C-487/21, Austrian Data Protection Authority, paras. 31 f; 41, 45).

3.2. For the specific case, this means:

The BF claimed in its appeal against the decision that the MP had not provided all the information about the origin of the data in its information. In addition, the MP had not provided a copy of some documents, such as another land register extract, an extract from the commercial register, the communication between BF and MP, BF and his landlord and MP and the landlord, which meant that the information was inadequate. In addition, the information was complete (see the complaint against the decision of August 30, 2021, p. 2 ff; OZ 1, p. 172 ff; and the statement of the BF of August 11, 2023; OZ 9). In its complaint against the decision, the BF claimed that the MP had not provided all information about the origin of the data in its information. In addition, the MP had not provided a copy of some documents, such as another land register extract, a company register extract, the communication between BF and MP, BF and his landlord and MP and the landlord, which meant that the information was inadequate. In addition, the information was complete (see the complaint against the decision of August 30, 2021, p. 2 ff; OZ 1, p. 172 ff; and the statement of the BF of August 11, 2023; OZ 9).

3.2.1. On the origin of the data:

The BF did not specify its argument regarding the inadequacy of the information on the origin of the data. Despite his supplementary statement of August 11, 2023, the complainant's argument in this regard is not specific and only general (OZ 9, p. 2). In particular, he did not provide any specific data whose origin was unclear to him.

The MP stated the origin of the BF's data in its information of April 10, 2020. It explained transparently and understandably where the individual data came from. Due to the clear breakdown according to the individual sources or data categories, it is clear that, for example, the BF's address, property and company data come from the publicly accessible books (ZMR, land register, company register), the email address or email traffic comes from the BF itself and the bail demands come from the court files. The origin of the data was thus clearly and transparently explained. No other data emerged whose origin remained unclear.

There is no violation of the right to information in this regard.

3.2.2. On the land register extract for the property in XXXX and the commercial register extract of XXXX GmbH:3.2.2. On the land register extract for the property in Roman XXXX and the commercial register extract of Roman XXXX GmbH:

In its appeal against the decision, the BF objected, among other things, to the lack of a land register extract and a commercial register extract (OZ 1, p. 173).

As stated, the MP provided additional information on the two extracts in its statement of July 13, 2023. Given that this concerns a property and a company belonging to the BF itself, the transmission of a copy does not appear necessary in the specific case, since the BF is aware of the context of this data and no longer complained about its absence (see OZ 9, p. 1 f). As stated, the MP provided additional information on the two extracts in its statement of July 13, 2023. Given that this concerns a property and a company belonging to the BF itself, the transmission of a copy does not appear necessary in the specific case, since the BF is aware of the context of this data and no longer complained about its absence (see OZ 9, p. 1 f).

Section 24 (6) DSG, which is to be applied mutatis mutandis in administrative court proceedings in accordance with Section 17 VwGVG, provides that a respondent can subsequently remedy the alleged violation of law by complying with the complainant's requests until the proceedings before the data protection authority have been concluded. In this case, the authority concerned must in principle discontinue the proceedings without any formalities. Section 24 DSG is intended to grant affected persons the right to enforce any violations of rights arising from the DSG or the GDPR (see Bresich/Riedl in Bresich/Dopplinger/Dörnhöfer/Kunnert/Riedl, DSG Section 24 Rz 7). The wording of Section 24 Paragraph 6 does not indicate that this reaction must necessarily be made to the complainant during the proceedings. In this respect, the BF's interest in legal protection is also safeguarded by the fact that the court transmitted the information in this case as part of the hearing of the parties (see in this sense Thiele/Wagner, Practical Commentary on the Data Protection Act (DSG)2 § 24 Rz 258 f). Paragraph 24, Paragraph 6, DSG, which is to be applied mutatis mutandis in administrative court proceedings in accordance with Paragraph 17, VwGVG, provides that a respondent can subsequently remedy the alleged violation of law by complying with the complainant's requests until the proceedings before the data protection authority have been concluded. In this case, the authority concerned must in principle discontinue the proceedings informally. Paragraph 24, DSG is intended to grant affected persons the right to enforce any violations of rights arising from the DSG or the GDPR (see Bresich/Riedl in Bresich/Dopplinger/Dörnhöfer/Kunnert/Riedl, DSG Paragraph 24, Rz 7). The wording of paragraph 24, paragraph 6, does not indicate that this reaction must necessarily be made to the complainant during the proceedings. In this respect, the BF's interest in legal protection is also safeguarded by the fact that the court transmitted the information in question during the hearing of the parties (see in this sense Thiele/Wagner, Practical Commentary on the Data Protection Act (DSG)2 paragraph 24, margin number 258 f).

The VwGH has already stated with regard to the predecessor provision of § 24 DSG (§ 31 DSG 2000) that no right to a determination of a violation of the right to information that occurred in the past can be derived from this (see VwGH 27.09.2007, 2006/06/0330). The VwGH has applied this case law to the current legal situation (see VwGH October 19, 2022, Ro 2022/04/0001, para. 24 ff). The VwGH has already ruled on the predecessor provision of Paragraph 24, DSG (Paragraph 31, DSG 2000) that no right to a determination of a past violation of the right to information can be derived from this (see VwGH September 27, 2007, 2006/06/0330). The VwGH has applied this case law to the current legal situation (see VwGH October 19, 2022, Ro 2022/04/0001, para. 24 ff).

In the proceedings, the MP provided additional information on a land register and company register extract that it had processed, which was sent to the BF (OZ 6; OZ 8). The procedural objective of the complaint regarding a violation of the right to information was achieved by transmitting this (missing) information. A violation of the right to information is therefore no longer possible with regard to these documents. A subjective public right to establish a past violation of the right to information - or delayed information - is not covered by the right of appeal under Section 24 DSG in conjunction with Article 15 GDPR.In the proceedings, the MP provided additional information on a land register and company register extract that it had processed, which was sent to the BF (OZ 6; OZ 8). The procedural objective of the complaint regarding a violation of the right to information was achieved by transmitting this (missing) information. A violation of the right to information is therefore no longer possible with regard to these documents. A subjective public right to establish a past violation of the right to information - or delayed information - is not covered by the right to complain under paragraph 24, DSG in conjunction with article 15, GDPR.

The information was therefore complete in this regard and the complaint with regard to the two extracts could not be upheld.

3.2.3. Regarding the copies of the communication processed by the MP between BF and his landlord and BF and MP:

As the authority concerned has already correctly stated and described above under point II.3.1., the "right to a copy" is not an independent right. The release of entire documents is therefore fundamentally not covered by the right to information. Only in cases where the context in which the data is located is important, it may be necessary to provide copies of extracts from documents or even entire documents in order to ensure easy comprehensibility (see ECJ 04.05.2023, C-487/21, Austrian Data Protection Authority, para. 41). As the authority concerned has already correctly stated and as shown above under point II.3.1, the "right to a copy" is not an independent right. The release of entire documents is therefore not covered by the right to information in principle. Only in cases where the context in which the data is located is important, it may be necessary to provide copies of extracts from documents or even entire documents in order to ensure easy comprehensibility (see ECJ 04.05.2023, C-487/21, Austrian Data Protection Authority, para. 41).

In the specific case at hand, a copy of the documents requested by the BF is not necessary for comprehensibility. The BF is in any case aware of the essential content of the communication sent by or to him. In order to understand the information, which already contains the relevant data from the court cases and the BF's master data, it is therefore not necessary for the MP to send the BF copies of emails that the BF himself wrote or that were sent to him. The BF is aware of the context of the information contained therein. The BF did not explain which specific details of the information were "incorrect, incomprehensible" to him (see OZ 9). The information is understandable for the BF even without copies of these documents, which is why they did not have to be sent. In the specific case at hand, a copy of the documents requested by the BF is not necessary for understandability. The BF is in any case aware of the essential content of the communication sent by or to him. In order to understand the information, which already contains the relevant data from the court proceedings and the BF's master data, it is therefore not necessary for the MP to send the BF copies of emails that the BF himself wrote or that were sent to him. The BF knows the context of the information contained therein. The BF did not explain which specific information in the information was "incorrect, incomprehensible" for him (see OZ 9). The information is understandable for the BF even without copies of these documents, which is why they did not have to be sent.

The information was therefore complete in this respect. There is no violation of the right to information.

3.2.4. Regarding the copies of the communication between the MP and his client:

The BF also stated in his appeal against the decision that a copy of the communication between the MP and her client (the BF's former landlord) should be sent to him. The MP invoked professional secrecy with regard to the communication with her client.

3.2.4.1. On the limits of the right to information:

The right to information is not unlimited; it can be restricted with regard to the rights and freedoms of other persons. In the event of a conflict between the exercise of the right to information on the one hand and the rights or freedoms of other persons on the other, the rights in question must be weighed against each other. If possible, modalities for transmitting personal data should be chosen that do not violate the rights or freedoms of other persons, although these considerations must not lead to the data subject being denied any information. The right to complete and comprehensive information about personal data therefore finds its limits where the rights or freedoms of other persons prevail (see ECJ 04.05.2023, C-487/21, Austrian Data Protection Authority, para. 43 f).

The right to information is limited, among other things, for lawyers, to the extent that the lawyer's right to confidentiality requires it to ensure the protection of the party or the rights and freedoms of other persons or the enforcement of civil law claims (see Article 23 GDPR in conjunction with Section 9 Paragraph 4 RAO).The right to information is limited, among other things, for lawyers, to the extent that the lawyer's right to confidentiality requires it to ensure the protection of the party or the rights and freedoms of other persons or the enforcement of civil law claims (see Article 23, GDPR in conjunction with Paragraph 9, Paragraph 4, RAO).

3.2.4.2. For the specific case, this means:

In principle, a complete refusal to provide information with a blanket appeal to attorney-client privilege would probably be inadmissible. In the specific case, however, the MP provided information in accordance with Article 15 GDPR and only invoked attorney-client privilege with regard to communication with the client (see OZ 1, p. 86). In principle, a complete refusal to provide information with a blanket reference to attorney-client privilege would probably be inadmissible. In the specific case, however, the MP provided information in accordance with Article 15 GDPR and only invoked attorney-client privilege with regard to communication with the client (see OZ 1, p. 86).

If the communication between the MP as a lawyer and the client contains personal data of the BF, the BF's right to information in this regard is contradicted by attorney-client privilege within the meaning of Article 23 GDPR in conjunction with Section 9 Paragraph 4 RAO. These rights must be weighed against each other: If the communication between the MP as a lawyer and the client contains personal data of the BF, the BF's right to information in this regard is contradicted by the attorney-client privilege within the meaning of Article 23, GDPR in conjunction with Paragraph 9, Paragraph 4, RAO. These rights must be weighed against each other:

On the one hand, the BF has an interest in complete information and in knowing the context or the specific content of the communication between the MP and her client. There was a legal dispute pending in this regard and there was also an execution against the BF.

On the other hand, with regard to the lawyer's right to confidentiality and also her client's right to confidentiality, the MP has an interest in the communication between them remaining confidential.

When weighing up the interests, in this case the interest of the MP or his client in keeping the communication between the lawyer and client confidential clearly outweighs the interest. The requirement of attorney-client confidentiality is one of the main pillars of the legal profession. The right to - and associated with it - the lawyer's duty to maintain confidentiality is an indispensable core element of the rule of law and essential for access to justice and the fundamental right to a fair trial. A legal profession without a strictly understood obligation of confidentiality is inconceivable. The object of protection of the lawyer's duty of confidentiality is the interests of the parties. Anyone - including the MP's client - who turns to a professional party representative in their affairs must be able to trust that they will not create evidence against themselves by entrusting a party representative and providing information to them. If this protection is lacking, an essential element of the right to use legal counsel in one's affairs is missing. In this respect, however, the rights granted by the GDPR must not lead to such circumvention. It should also be borne in mind that the restriction of the rights of those affected only goes as far as the lawyer's right to confidentiality requires in order to ensure the protection of the party or the rights and freedoms of other persons or to enforce civil law claims (see ErlRV 65 BlgNR 26. GP, p. 160 with further references). When weighing up the interests, the interest of the MP or his client in keeping the communication between lawyer and client confidential clearly prevails in the present case. The requirement of lawyer-client confidentiality is one of the main pillars of the legal profession. The right to - and associated with it - the lawyer's duty to confidentiality is an indispensable core element of the rule of law and essential for access to justice and the fundamental right to a fair trial. A legal profession without a strictly understood obligation of confidentiality is inconceivable. The object of protection of the lawyer's duty of confidentiality is the interests of the party. Anyone - including the MP's client - who turns to a professional party representative in their affairs must be able to trust that they will not create evidence against themselves by entrusting a party representative and providing information to them. If this protection is lacking, an essential element of the right to use legal advice in one's affairs is missing. In this respect, however, the rights granted by the GDPR must not lead to such circumvention. It should also be borne in mind that the restriction of the rights of the data subject only goes as far as the lawyer's right to confidentiality requires in order to ensure the protection of the party or the rights and freedoms of other persons or the enforcement of civil law claims (see ErlRV 65 BlgNR 26. GP, p. 160 with further references).

In the present case, the lawyer's duty of confidentiality as an essential core element of the rule of law and his client's interest in keeping this communication secret outweigh the BF's right to information. This view is not changed by the circumstances put forward by the BF, such as the fact that court proceedings were pending in this regard, the BF was threatened with execution and the legal disputes had already been legally decided. On the one hand, the lawyer's duty of confidentiality is aimed precisely at constellations in which the interests of the parties are diametrically opposed. On the other hand, the lawyer's duty of confidentiality applies for an unlimited period of time, i.e. regardless of the duration of the mandate (Schur, Die anwaltliche Verschwegenheitspflicht in der österreichische Rechtsordnung, AnwBl 2009, 257 (258); RIS-Justiz RS0072359). If the duty of confidentiality continues even beyond the duration of the mandate, then it continues to apply even after the final termination of individual proceedings.

3.3. The information provided by the MP was complete and understandable within the meaning of Article 15 of the GDPR. There is no violation of the BF's right to information. The appeal against the decision was therefore dismissed.3.3. The information provided by the MP was complete and understandable within the meaning of Article 15 of the GDPR. There is no violation of the BF's right to information. The appeal against the decision was therefore dismissed.

3.4. According to Section 24 Paragraph 1 of the Administrative Court Act, the administrative court must hold a public oral hearing upon request or, if it considers this necessary, ex officio.3.4. According to Section 24, Paragraph 1 of the Administrative Court Act, the administrative court must hold a public oral hearing upon request or, if it considers this necessary, ex officio.

According to Section 24, Paragraph 4 of the Administrative Court Act (VwGVG), the administrative court can – unless otherwise provided by federal or state law – refrain from holding a hearing regardless of a party’s application if the files show that the oral discussion is unlikely to provide any further clarification of the legal matter, and neither Article 6, Paragraph 1 of the ECHR nor Article 47 of the Charter of Fundamental Rights preclude the omission of the hearing.According to Section 24, Paragraph 4 of the Administrative Court Act (VwGVG), the administrative court can – unless otherwise provided by federal or state law – refrain from holding a hearing regardless of a party’s application if the files show that the oral discussion is unlikely to provide any further clarification of the legal matter, and neither Article 6, Paragraph 1 of the ECHR nor Article 47 of the Charter of Fundamental Rights preclude the omission of the hearing.

The oral hearing - which was not requested - could be dispensed with because the facts essential to the legal assessment had already been fully established by the administrative authority in a proper investigation and at the time of the decision of the court of first instance still had the timeliness and completeness required by law. The complaint did not allege any relevant facts that contradicted or went beyond the result of the administrative investigation (VwGH 24.02.2015, Ra 2014/19/0171). The BF merely objected to the legal assessment of the authority concerned and continued to demand the release of entire documents. Furthermore, the administrative court was able to agree with the assessment of evidence by the authority concerned.

The assessment of whether information is complete in accordance with the GDPR or the question of whether entire documents must be transmitted is a legal question. The facts relevant to the decision, in particular with regard to the information from the MP submitted by the BF itself, are undisputed in the present proceedings. The BF did not criticize the information on a land register and company register extract (OZ 6) submitted in the court proceedings and, in contrast to his appeal against the decision, did not include this in his list of missing documents in his statement of August 11, 2023. Further clarification through an oral hearing was not to be expected in this regard.

The Federal Administrative Court must therefore only rule on a legal question in the present case (cf. ECHR June 20, 2013, Appl. No. 24510/06, Abdulgadirov/AZE, para. 34 ff). Neither Article 6 paragraph 1 of the ECHR nor Article 47 of the Charter of Fundamental Rights preclude waiving the hearing.The Federal Administrative Court must therefore only rule on a legal question in the present case (cf. ECHR June 20, 2013, Appl. No. 24510/06, Abdulgadirov/AZE, para. 34 ff). Neither Article 6, paragraph one, ECHR nor Article 47 of the Charter of Fundamental Rights preclude waiving the hearing.

3.5. The decision had to be made in accordance with the ruling.

On B) Inadmissibility of the appeal:

According to Section 25a, paragraph 1 VwGG, the administrative court must state in its ruling or decision whether the appeal is admissible in accordance with Article 133, paragraph 4 B-VG. This ruling must be briefly justified.According to Section 25a, paragraph one, VwGG, the administrative court must state in its ruling or decision whether the appeal is admissible in accordance with Article 133, paragraph 4 B-VG. This ruling must be briefly justified.

The appeal is not admissible because the decision does not depend on the solution of a legal question of fundamental importance. With regard to the interpretation of Article 15 of the GDPR relevant in this specific case, the adjudicating court was able to rely on the cited case law of the ECJ. Furthermore, the balancing of interests in the context of restricting the right to information is a decision on a case-by-case basis that is not reversible. With regard to violations of the right to information in the past, the adjudicating court was able to rely on the cited case law of the VwGH.The appeal is not admissible because the decision does not depend on the solution of a legal question that is of fundamental importance. With regard to the interpretation of Article 15 of the GDPR relevant in this specific case, the adjudicating court was able to rely on the cited case law of the ECJ. Furthermore, the balancing of interests in the context of restricting the right to information is a decision on a case-by-case basis that is not reversible. With regard to violations of the right to information in the past, the adjudicating court was able to rely on the cited case law of the VwGH.