VwGH - Ra 2020/04/0187: Difference between revisions

Revision as of 15:41, 6 April 2022

VwGH - Ra 2020/04/0187

Court:	VwGH (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 83 GDPR
Decided:	24.02.2022
Published:	24.03.2022
Parties:
National Case Number/Name:	Ra 2020/04/0187
European Case Law Identifier:	ECLI:AT:VWGH:2022:RA2020040187.L00
Appeal from:
Appeal to:	Not appealed
Original Language(s):	German
Original Source:	Rechtsinformationssystem des Bundes (in German)
Initial Contributor:	kc

The Austrian Supreme Administrative Court stayed the proceedings in a case concerning the attribution of infringements to legal persons (Article 83 GDPR) until the CJEU has decided on a preliminary ruling referred to it by the Higher Regional Court of Berlin in Deutsche Wohnen SE.

English Summary

Facts

The controller is an address publisher and direct advertising company that operates a data application in order to provide advertisers with personal data for targeted marketing measures.

In 2019, the Austrian Data Protection Authority (DSB) initiated an ex officio investigation against the controller, following media reports about the alleged sale of personal data, in particular information about the political affinity of individual persons. Based on the findings, the DSB issued a fine of €18,000,000. The infringement was attributed to the controller as a legal person because the natural persons responsible for the infringements belonged to the economic unit formed by the controller as a legal person.

The controller appealed to the Federal Administrative Court (BVwG), arguing that it was not sufficient for a legal person to have committed a criminal offence for a fine to be imposed on it under the GDPR. As a legal person that cannot act on its own, the actions of a natural person must also be attributed to it but the DSB had omitted this attribution.

The BVwG agreed with the controller's reasoning. Since the DSB had not named the natural person whose breach of the GDPR was to be attributed to the controller, the DSB's decision proved to be unlawful.

The DSB filed an extraordinary official appeal against this decision with the Austrian Supreme Administrative Court (VwGH). It referred to the pending case of the Higher Regional Court of Berlin (KG Berlin) before the Court of Justice of the European Union (CJEU) (Case C-807/21) where the question at issue - as in the case at hand - is whether the supervisory authority must record and name those natural persons who are responsible for the infringement in order to enable attribution to the legal person, or whether this is not necessary. The DSB therefore requested to refer the question of the direct criminal liability of a legal person under Article 83 GDPR and the question of the compatibility of § 30 Datenschutzgesetz (Austrian Data Protection Act - DSG) with Article 83 GDPR to the CJEU pursuant to Article 267 TFEU, or, in the alternative, to stay the official appeal proceedings pending the CJEU's decision in the preliminary ruling proceedings initiated by the KG Berlin.

Holding

The VwGH stayed the proceedings until the decision of the CJEU on the preliminary ruling in the proceedings on case C-807/21. The court argued that it was irrelevant that the preliminary ruling concerned a German national law since both the case at hand and the referred case concerned the interpretation of Article 83 GDPR. Therefore, it must be assumed that the answers to the questions referred to the CJEU are also of relevance for the proceedings in the present official appeal.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

regarding

The Administrative Court, through the Chairman of the Senate, Dr. Handstanger, Hofrat Dr. Mayr, Hofrätin Mag. Hainz-Sator and the Hofräte Dr. Pürgy and Mag. Brandl as judges, with the participation of the secretary Mag. Schara, on the revision of the data protection authority in 1030 Vienna, Barichgasse 40-42, against the decision of the Federal Administrative Court of November 26, 2020, Zl. W258 2227269-1/14E, regarding violation of the General Data Protection Regulation (participating party: Ö AG in W, represented by Schönherr Rechtsanwälte GmbH in 1010 Vienna, Schottenring 19), passed the resolution:

saying

The appeal procedure is suspended pending the preliminary ruling by the Court of Justice of the European Union in Case C-807/21 on the request of the Berlin Court of Appeal.

Reason

1 1. The party involved has a business license as an "address publisher and direct advertising company" and operates a data application "DAM target group addresses" in order to provide advertising customers with personal data for targeted marketing measures for a fee.

2 After media reports about the alleged sale of personal data, in particular information about the "political affinity" of individuals, the (appealing) data protection authority initiated on January 8, 2019 ex officio investigation proceedings against the party involved, which was terminated by decision of January 11, 2019. February 2019 (see the judgment of the VwGH December 14, 2021, Ro 2021/04/0007).

3 2.1. Administrative penal proceedings were also initiated against the party involved on the basis of the investigation results of the official data protection investigation procedure. After conducting evidence proceedings and an oral hearing, the data protection authority ruled in a criminal judgment of October 23, 2019 that the party involved, as the person responsible within the meaning of Art. 4 Z 7 GDPR, was responsible for the unlawful processing of special categories of personal data within the meaning of Art. 9 GDPR ( "Party affinities"), the unlawful further processing of personal data, the inaccuracy of the data protection impact assessment for the "DAM target group addresses" application and the inaccuracy and inadequacy of the directory on the "DAM target group addresses" processing activity.

The breach of duty is attributed to the party involved as a legal entity, because the natural persons responsible for the violations belong to the economic entity formed by the responsible party as a legal entity.

4 A fine of EUR 18,000,000 was imposed on the party involved in accordance with Art. 83 (5) (a) GDPR.

5 2.2. The party involved lodged an appeal with the Federal Administrative Court against this penal decision. In it, she argued, among other things, that it was not sufficient for the imposition of a fine on a legal person under the GDPR to fulfill a criminal offense. As a legal entity that cannot act itself, the actions of a natural person must also be attributed to it. The data protection authority omitted this attribution.

6 2.3. With the contested decision of November 26, 2020, the Federal Administrative Court upheld the complaint, repealed the criminal decision of the data protection authority and discontinued the proceedings in accordance with Section 45 (1) Z 3 VStG (Section A.I). It also stated that the party involved did not have to bear any costs (point A.II) and that the revision was not permissible in accordance with Art. 133 (4) B-VG (point B.).

7 In its reasoning, the Federal Administrative Court explained, with reference to the decision of the VwGH May 12, 2020, Ro 2019/04/0229, that for the imposition of a fine under the GDPR on a legal person in a criminal court, the assessment of a factual, illegal and culpable conduct that also satisfies any additional requirements for criminal liability, the necessary determinations are to be made. Likewise, all the necessary elements for a punishment of the natural person would have to be included in the sentence, with the addition that the behavior of the natural person would be attributed to the legal person.

8 In the ruling of the penal decision, the data protection authority did not name the natural person whose violation of the GDPR should be attributed to the person involved. The penal decision therefore turns out to be unlawful. The administrative court was denied a remedy for this deficiency.

9 Since the lack of specification of the allegation constitutes a procedural obstacle to a review by the Federal Administrative Court, the criminal proceedings in question had to be discontinued.

10 3.1. The present extraordinary official revision of the data protection authority is directed against this finding. Among other things, it is argued that the Federal Administrative Court assumed that the VwGH decision May 12, 2020, Ro 2019/04/0229 was “too restrictive in content”. It is also questionable whether this case law of the Administrative Court on Art. 83 GDPR can be upheld in view of the decisions that have been made by (higher) courts in other member states in the meantime. It is therefore suggested that "in the event of doubts regarding the interpretation of Art. 83 GDPR, refer the matter to the ECJ in accordance with Art. 267 TFEU".

11 3.2. With an additional submission of January 3, 2022, the data protection authority referred to the decision of the Berlin Court of Appeal of December 6, 2021, GZ Ws 250/21, with which two questions on the interpretation of Art. 83 GDPR were submitted to the Court of Justice of the European Union (ECJ) for a preliminary ruling pursuant to Art. 267 TFEU. The proceedings before the Berlin Court of Appeal - as in the official appeal proceedings at hand - concern the question of whether the supervisory authority in a proceeding pursuant to Art person to allow, or whether this is not necessary. It is therefore requested that the ECJ, in accordance with Art. 267 TFEU, deal with the question of direct criminal liability of a legal person in accordance with Art. 83 GDPR and with the question of the compatibility of Section 30 DSG with Art. 83 GDPR, in eventu, the official appeal proceedings at issue pending the decision of the ECJ in the preliminary ruling proceedings initiated by the Berlin Court of Appeal.

12 4. With the aforementioned decision of December 6, 2021, the Berlin Court of Appeal addressed the following questions to the ECJ for a preliminary ruling:

"1. Is Art. 83 (4) to (6) GDPR to be interpreted in such a way that it incorporates the functional company concept assigned to Art. 101 and 102 TFEU and the functionary principle in domestic law with the result that under extension of the legal entity principle on which Section 30 OWiG is based, fine proceedings are initiated immediately can be taken against a company and the fine does not require the determination of an administrative offense committed by a natural and identified person, possibly in a criminal offence?

2. If the first question is answered in the affirmative: Is Art. 83 Para. 4 to 6 GDPR to be interpreted as meaning that the company must have culpably committed the violation mediated by an employee (cf. Art. 23 of Regulation [EC] No . 1/2003 of the Council of 16 December 2002 on the implementation of the competition rules laid down in Articles 81 and 82 of the Treaty), or is an objective breach of duty attributable to the company in principle sufficient for a fine to be imposed on it ('strict liability')? "

13 5. In its statement of February 3, 2022, the party involved counters the additional arguments of the data protection authority in summary that the questions referred by the Berlin Court of Appeal are not relevant in the appeal proceedings in question and that a suspension should therefore be refrained from. The data protection authority believes that Section 30 of the German Administrative Offenses Act (OWiG) mentioned in the question referred essentially corresponds to Section 30 (1) to (3) DSG and that the question referred is therefore relevant in the proceedings on which the appeal is based. § 30 OWiG is based on an action by a manager. In this respect, the question referred by the Berlin Court of Appeal aims to determine whether - beyond § 30 OWiG - the action of each person who is entitled to work for the company also constitutes a criminal offence. However, this has already been implemented by Section 30 (2) DSG, because this is based on the action of some person. Section 30 (2) DSG effects an investigative standard that is below that of Section 30 OWiG and the admissibility of which the question referred by the Berlin Court of Appeal is aimed at. This is also not relevant when considering the Union legal principle of efficiency for Section 30 (2) DSG.

14 A legal comparison also shows that the German questions referred are not relevant to the appeal proceedings in question. The attribution model anchored in § 30 DSG is not an exception, but is a solid part of Union law and does not conflict with it. It can be demonstrated in at least 20 pieces of EU legislation currently in force. The regulation in § 30 DSG is not based on the German, but on the European attribution model.

15 6. According to the case law of the ECJ (regarding Art. 267 TFEU), a national court whose decisions can no longer be challenged by means of legal remedies under national law may resolve a question of the interpretation of Union law on its own responsibility if the correct interpretation of the Union law is so obvious that there is no room for a reasonable doubt (cf. ECJ 10/06/1982, Srl CILFIT et al., C-283/81, EU:C:1982:335, and ECJ 10/06/2021, Consorzio Italian Management, C-561/19, EU:C:2021:799, paragraph 39 ff).

16 Measured against this, the statements of the involved party, according to which the questions submitted by the Berlin Court of Appeal to the ECJ are "not relevant" for the appeal proceedings in question, cannot be followed. The differences between the German § 30 OWiG and the Austrian § 30 DSG brought up by the involved party are not able to change the fact that both proceedings (in the German preliminary ruling proceedings before the ECJ and in the present revision proceedings) concern the interpretation of the Union law provision of Art. 83 GDPR.

17 It can therefore be assumed that the answer to the questions put to the ECJ by the Berlin Court of Justice is also important for the treatment of the official revision at issue, which is why the requirements of Section 38 AVG, which is also to be applied by the Administrative Court in accordance with Section 62 (1) VwGG, are met (cf . e.g. VwGH 13.6.2016, Ro 2014/03/0049, mwN).

The revision proceedings in question were therefore to be suspended - in a senate formed in accordance with Section 12 (2) VwGG - until the ECJ made its decision on the aforementioned request for a preliminary ruling in the proceedings in Case C-807/21.

Vienna, February 24, 2022

@@ Line 62: / Line 62: @@
 The DSB filed an extraordinary official appeal against this decision with the Austrian Supreme Administrative Court (VwGH). It referred to the pending case of the Higher Regional Court of Berlin (KG Berlin) before the Court of Justice of the European Union (CJEU) [[CJEU - C-807/21 - Deutsche Wohnen SE|(Case C-807/21)]] where the question at issue - as in the case at hand - is whether the supervisory authority must record and name those natural persons who are responsible for the infringement in order to enable attribution to the legal person, or whether this is not necessary. The DSB therefore requested to refer the question of the direct criminal liability of a legal person under [[Article 83 GDPR|Article 83 GDPR]] and the question of the compatibility of § 30 Datenschutzgesetz (Austrian Data Protection Act - DSG) with [[Article 83 GDPR|Article 83 GDPR]] to the CJEU pursuant to Article 267 TFEU, or, in the alternative, to stay the official appeal proceedings pending the CJEU's decision in the preliminary ruling proceedings initiated by the KG Berlin.
 === Holding ===
-The VwGH stayed the proceedings until the decision of the CJEU on the preliminary ruling in the proceedings on case [[CJEU - C-807/21 - Deutsche Wohnen SE|C-807/21]].
+The VwGH stayed the proceedings until the decision of the CJEU on the preliminary ruling in the proceedings on case [[CJEU - C-807/21 - Deutsche Wohnen SE|C-807/21]]. The court argued that it was irrelevant that the preliminary ruling concerned a German national law since both the case at hand and the referred case concerned the interpretation of [[Article 83 GDPR]]. Therefore, it must be assumed that the answers to the questions referred to the CJEU are also of relevance for the proceedings in the present official appeal.
-The court argued that it was irrelevant that the preliminary ruling concerned a German national law since both the case at hand and the referred case concerned the interpretation of [[Article 83 GDPR|Article 83 GDPR]]. Therefore, it must be assumed that the answers to the questions referred to the CJEU are also of relevance for the proceedings in the present official appeal.
 == Comment ==