BVwG - W252 2237416-1

BVwG - W252 2237416-1
Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 15(1)(g) GDPR Article 15(1)(h) GDPR
Decided:	12.06.2023
Published:	20.07.2023
Parties:
National Case Number/Name:	W252 2237416-1
European Case Law Identifier:	ECLI:AT:BVWG:2023:W252.2237416.1.00
Appeal from:	DSB (Austria)
Appeal to:	Unknown
Original Language(s):	German
Original Source:	BVwG (Austria) (in German)
Initial Contributor:	mg

An Austrian court held that, under Article 15(1)(h) GDPR, and in order to describe a decision-making process, it is sufficient to disclose the data involved, purposes and results. Moreover, describing the process as simply “statistical” was also deemed sufficient.

English Summary

Facts

The data subject made an access request with the controller – a mail services provider and address publisher. However, in the data subject's view, the controller’s reply was not complete. For example, it did not contain the sources of the data and how the data subject was associated with certain political preferences for the purpose of political advertising.

The data subject lodged a complaint with the Austrian DPA. The Austrian DPA upheld the complaint and found a violation of Articles 12(1) and 15(1)(g) and (h) GDPR, as the controller did not provide information about the sources and about how the affinity between the data subject and certain political groups had been inferred.

The controller appealed the decision, arguing that the information asked by the data subject was not personal data but only “marketing classifications” to which neither profiling within the meaning of the GDPR nor Article 22(1) GDPR applied.

Holding

The court upheld the controller's appeal.

First, according to the judges, the sources were duly disclosed in the answer to the access request. The court particularly stressed that Article 15(1)(g) GDPR does not impose to the controller to disclose sources when the controller directly collected data. In its disclosure, the controller correctly shared only information concerning third parties. The disclosure was also transparent and comprehensible, complying with the requirements of Article 12(1) GDPR.

Second, concerning the alleged violation of Article 15(1)(h) GDPR, the court found that the controller provided sufficient information to understand the logic behind the automated decision-making pursuant to Article 22(1) and (4) GDPR. As a matter of fact, data processed were address, age and sex of the data subject; the method used a “statistical” one; and the purpose of the processing was to avoid to deliver irrelevant advertisement to the data subject. The court did not concern itself with the problem whether the processing at issue was profiling, nor with the issue whether the “marketing classifications” were actually personal data. The court stated that the disclosure of the algorithm or the calculation formula was not necessary pursuant to Article 15(1)(h) GDPR.

Therefore, the court overturned the DPA’s decision and declared that no violation of Articles 12 and 15 GDPR occurred.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

decision date

06/12/2023

standard

B-VG Art133 Para.4
GDPR Art12
GDPR Art15
GDPR Art22
Trade Regulations 1994 §151

B-VG Art. 133 today B-VG Art. 133 valid from 01.01.2019 to 24.05.2018 last amended by Federal Law Gazette I No. 138/2017 B-VG Art. 133 valid from 01.01.2019 last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 valid from 05/25/2018 to 12/31/2018 last changed by Federal Law Gazette I No. 22/2018 B-VG Art. 133 valid from 08/01/2014 to 05/24/2018 last changed by BGBl I No. 164/2013 Federal Constitutional Law Art by BGBl. I No. 100/2003 B-VG Art. 133 valid from 01.01.1975 to 31.12.2003 last amended by BGBl. No. 444/1974 B-VG Art. 133 valid from 25.12.1946 to 31.12.1974 last amended by Federal Law Gazette No. 211/1946 B-VG Art. 133 valid from December 19, 1945 to December 24, 1946 last amended by StGBl. No. 4/1945 B-VG Art. 133 valid from 01/03/1930 to 06/30/1934

GewO 1994 Section 151 today GewO 1994 Section 151 valid from May 25th, 2018 last amended by Federal Law Gazette I No. 32/2018 GewO 1994 Section 151 valid from February 27th, 2008 to May 24th, 2018 last amended by Federal Law Gazette I No. 42/2008 GewO 1994 Section 151 valid from August 1, 2002 to February 26, 2008, last amended by Federal Law Gazette I No. 111/2002 GewO 1994 Section 151 valid from March 19, 1994 to July 31, 2002

saying

W252 2237416-1/8E

IN THE NAME OF THE REPUBLIC!

The Federal Administrative Court, through the judge Mag.a Elisabeth SCHMUT, LL.M. as chairperson and the expert lay judges Dr. Claudia ROSENMAYR-KLEMENZ and Mag.a Adriana MANDL as assessors on the complaint of XXXX , represented by Schönherr Rechtsanwälte GmbH, 1010 Vienna, Schottenring 19 (participating party before the administrative court: XXXX ) against sentence 1 .and point 2 of the decision of the data protection authority of October 7th, 2020, GZ XXXX, in a data protection matter, in a closed session rightly recognized: The Federal Administrative Court, through the judge Mag.a Elisabeth SCHMUT, LL.M. as chairperson and the expert lay judges Dr. Claudia ROSENMAYR-KLEMENZ and Mag.a Adriana MANDL as assessors on the complaint of roman XXXX , represented by Schönherr Rechtsanwälte GmbH, 1010 Vienna, Schottenring 19 (participating party before the administrative court: roman XXXX ) against Point 1 and point 2 of the decision of the data protection authority of October 7th, 2020, GZ roman XXXX, in a data protection matter, rightly recognized in a non-public session:

A) The appeal is upheld and the ruling in the contested decision is amended in such a way that ruling point 2 is omitted entirely and ruling point 1 is to read as follows:

"1. The complaint is dismissed as unsubstantiated.".

B) The revision is allowed.

text

Reasons for decision:

I. Roman one. Procedure:

On April 12, 2019, the party involved (hereinafter "MP") lodged a complaint with the relevant authority. In it, she stated in part that she had submitted a request for information to the complainant (hereinafter "BF") on January 8, 2019. On April 2, 2019, she received data information, which was incomplete, received insufficient information about the origin of the data and it was also not clear how the extrapolation, etc. with regard to the target group for election advertising.

In a statement dated June 19, 2019, the BF stated in summary that the information from April 2, 2019 only contained the data that had been processed as part of the activity as an address publisher. In addition, the BF simultaneously sent further data information which also contained data from customer service, logistics, etc.

With the above decision, the relevant authority partially upheld the complaint and found that the BF had violated the MP's right to information by providing incomplete information (paragraph 1). At the same time, the BF carried them on the MP within 4 weeks to designate the exact origin of the data that was collected or purchased as part of the address publishing (point 2.a.) and a statement in accordance with Art. 12 Para. 1 in conjunction with Art. 15 Para. 1 lit. h GDPR to provide corresponding information on the occurrence of the "statistically extrapolated" affinities (point 2.b.). In addition, it rejected the complaint or an application for suspension by the MP (points 3 and 4). With the above-mentioned decision, the relevant authority partially upheld the complaint and determined that the BF was thereby violating the MP's right to information by giving him incomplete information (paragraph 1). At the same time, the BF carried them on the MP within 4 weeks to designate the exact origin of the data that was collected or purchased as part of the address publishing (point 2.a.) as well as Article 12, paragraph one, in connection with Article 15, paragraph one, litera h, GDPR to provide appropriate information on the occurrence of the "statistically extrapolated" affinities (point 2.b.). Otherwise, she dismissed the complaint or an application for suspension by the MP (points 3 and 4).

Against point 1, 2.a. and 2.b. The complaint in question of 05.11.2020 is directed. The origin of the data was sufficiently disclosed. With regard to the statistically extrapolated affinities, the BF explained that this information was not owed because this was not personal data but marketing classifications, did not fall under the concept of profiling, could not be subsumed under Art 22 ABs 1 DSGVO and this could not be used for either Marketing classifications would apply. Contrary to clause 1, 2.a. and 2.b. The complaint in question of 05.11.2020 is directed. The origin of the data was sufficiently disclosed. With regard to the statistically extrapolated affinities, the BF stated that this information was not owed, since this was not personal data but marketing classifications, did not fall under the concept of profiling, could not be subsumed under Article 22, ABs 1 DSGVO and neither could it would apply to marketing classifications.

The authority concerned submitted the complaint, following the administrative act, with a brief dated November 23, 2020, received on December 2, 2020, and requested - with reference to the reasoning of the contested decision - to dismiss the complaint.

Based on the decision of the business allocation committee of January 14, 2021, the case in question was removed from court division W256 and reassigned.

In a statement dated March 1, 2023, the BF again emphasized that the origin of the data had already been disclosed.

Evidence was collected by inspecting the administrative file.

II. Roman II. The Federal Administrative Court considered:

1. Findings:

In a letter dated January 8th, 2019, the MP requested information from the BF in relation to Art. 15 GDPR which data the BF had stored from the MP. With regard to any data stored by the BF about the MP, the MP requested information as to where this data came from. In a letter dated January 8th, 2019, the MP requested information from the BF in relation to Article 15, GDPR, which data the BF had stored from the MP. With regard to any data stored by the BF about the MP, the MP requested information as to where this data came from.

The BF provided the MP with data protection information on April 2nd, 2019 and further information on June 19th, 2019 (OZ 1, S 29 ff, S 77 ff). The BF informed the MP that it was processing the MP's name, address and date of birth as personal data. In a letter dated April 2, 2019, the BF sent the MP the MP data listed in “XXXX” and an “overview of the data processed (according to Section 151 GewO)”. The data of the " XXXX " come from the XXXX . The data in the table with the heading "Overview of processed data (according to § 151 GewO)" are partly collected from the MP itself and partly purchased without specifying this in more detail (identification generally as "collected/purchased"). The BF issued the MP on April 2nd, 2019 provided information on data protection law and provided further information on June 19th, 2019 (OZ 1, S 29 ff, S 77 ff). The BF informed the MP that it was processing the MP's name, address and date of birth as personal data. In a letter dated April 2, 2019, the BF sent the MP the MP data listed in the “Roman XXXX” and an “overview of the processed data (according to paragraph 151, GewO)”. The dates of the " roman XXXX " come from the roman XXXX . The data in the table with the heading "Overview of processed data (according to paragraph 151, GewO)" was partly collected from the MP itself and partly purchased without specifying this in more detail (identification generally as "collected/purchased").

In a letter dated June 19, 2019, the BF sent a letter to the MP in which it listed the data that it stores outside of its work as an address publisher. In the appendix to this letter, the BF sent data sheets in which, in addition to the stored information, information was also given on the storage period and the processing purpose of the respective data. The following data sheets were attached to the letter: "Consumer customer data", "XXXX customer service", "Letter logistics international shipments". This information also contained other shipment information that is not relevant to the procedure. In a letter dated June 19, 2019, the BF sent a letter to the MP in which it listed the data that it stores outside of its work as an address publisher. In the appendix to this letter, the BF sent data sheets in which, in addition to the stored information, information was also given on the storage period and the processing purpose of the respective data. The following data sheets were attached to the letter: "Consumer customer data", "Roman XXXX customer service", "Letter logistics international shipments". This information also contained other shipment information that is not relevant to the procedure.

The MP contacted BF customer service several times and has a user account that she created herself. This data comes from the MP documents sent in the course of the customer service request.

The BF processes statistically extrapolated data from the MP on possible target groups for advertising, such as "Possible target group for election advertising [...]" or "Possible target group for advertising organic". Values such as “high” or “low” are assigned to the respective target groups. These target groups were calculated by statistical extrapolation using data from the BF, such as place of residence, gender and date of birth. They serve to avoid wastage in advertising, to prevent the sending of unwanted advertising material and to minimize the impact on the environment and traffic.

2. Evidence assessment:

The findings on the content of the information from April 2nd, 2019 and June 19th, 2019 result from the harmless administrative act. The MP presented the information from February 4th, 2019 as part of its data protection complaint. On June 19, 2019, the BF presented the second information including a statement. The actual content of the specific information and the statement is known to both parties to the proceedings and - in contrast to its legal assessment - undisputed (see OZ 1, 29-32; as well as OZ 1, p 75 ff).

For XXXX, see in particular the heading "XXXX data source: XXXX" (information 04/02/2019, p. 4; OZ 1, p. 32). For customer service and user accounts, see in particular the statement "Processing your inquiries - We process your data to process your inquiries if you have given us your name and address by telephone, post, on our website or by e-mail." in the consumer customer management table "Customer created manually by employee - No", which means that the MP created the account himself and the data was disclosed by her (information from 06/19/2019, S 1, 3; OZ 1, pp. 79, 82). For the rest, see the table with the heading "Overview of processed data (according to § 151 GewO)" and the more detailed explanation in the statement of 06/19/2019 (information from 02/04/2019, S 3; OZ 1, S 31; and statement from 06/19 .2019, S 3; OZ 1, S 77). On Roman XXXX, see in particular the heading "Roman XXXX data source: Roman XXXX" (information 02.04.2019, S 4; OZ 1, S 32). For customer service and user accounts, see in particular the statement "Processing your inquiries - We process your data to process your inquiries if you have given us your name and address by telephone, post, on our website or by e-mail." in the consumer customer management table "Customer created manually by employee - No", which means that the MP created the account himself and the data was disclosed by her (information from 06/19/2019, S 1, 3; OZ 1, pp. 79, 82). For the rest, see the table with the heading "Overview of processed data (according to paragraph 151, GewO)" and the more detailed explanation in the statement of June 19, 2019 (information from February 4th, 2019, S 3; OZ 1, S 31; and statement from June 19, 2019, p. 3; OZ 1, p. 77).

3. Legal assessment:

to A)

3.1. “Cause” of the Complaints Procedure:

The "matter" of the complaints procedure before the VwG is - regardless of the scope of examination specified by § 27 VwGVG - only the matter that formed the content of the verdict of the administrative authority prosecuted before the VwG (cf. VwGH 16.11.2015, Ra 2015/12/0026 , mwN). Since the BF only points 1. and 2. a. and b. contested, the subject of the proceedings is only the question of the completeness of the information regarding the origin of the data that was collected or purchased as part of the address publishing (see point 2. a. of the contested decision), as well as the completeness of the information on the " statistically extrapolated" data (paragraph 2. b. of the contested decision). The completeness of the remaining information is covered by the unchallenged point 4 of the notice and is therefore not the subject of the proceedings administrative authority before the VwG compare VwGH 16.11.2015, Ra 2015/12/0026, mwN). Since the BF only points 1. and 2. a. and b. contested, the subject of the proceedings is only the question of the completeness of the information regarding the origin of the data that was collected or purchased as part of the address publishing (see point 2. a. of the contested decision), as well as the completeness of the information on the " statistically extrapolated" data (paragraph 2. b. of the contested decision). The completeness of the remaining information is covered by point 4 of the decision, which has remained unchallenged, and is therefore not the subject of the proceedings.

3.2. Regarding point 2. a.:

As part of the right to information, the person responsible must provide all available information about the origin of the data, provided that this was not collected from the data subject. Only available information is recorded here and there is no obligation (within the scope of Art 15 GDPR) to document or subsequently collect data sources solely for the purpose of providing information (see Haidinger in Knyrim, DatKomm Art 15 GDPR Rz 43; and Jahnel, comment to the General Data Protection Regulation Art. 15 GDPR Rz 31). As part of the right to information, the person responsible must provide all available information about the origin of the data, provided that this was not collected from the data subject. Only available information is recorded here and there is no obligation (within the scope of Article 15, GDPR) to document or subsequently collect data sources solely for the purpose of providing information, compare Haidinger in Knyrim, DatKomm Article 15, GDPR margin no. 43; and Jahnel, Commentary on the General Data Protection Regulation Article 15, GDPR margin no. 31).

In any case, the origin of the data of the XXXX is clear, understandable and complete, since the XXXX is explicitly identified as the data source above the respective table (see the information from April 2nd, 2019; OZ 1, S 32). The origin of the data of the Roman XXXX is in any case clear, understandable and complete, since the Roman XXXX is explicitly shown as the data source above the respective table (see the information from April 2nd, 2019; OZ 1, p. 32).

The origin of the data can also be seen from the "Overview of processed data (according to § 151 GewO) XXXX". With the designation "Overview of processed data" and the respective note "collected/purchased", this table clearly represents a summary or combination of all existing data from various data sources. It does not appear necessary to list the data sources again, as clear data sources are listed below (e.g. XXXX ). In their statements, the authority concerned and the MP overlook the fact that according to the clear wording of Article 15 (1) (g) GDPR, the origin of the data does not have to be disclosed if the data was “collected” from the person concerned. In addition, the choice of words "collected" in contrast to "bought" suggests that part of the data was collected by the BF itself, which also corresponds to a reference. From an overall view of the information, it is therefore clear from which sources the (purchased) data originate. In the specific case of the MP, it was also evident from the second information from June 19, 2019 that the BF had recorded some data from the MP itself. This contacted BF customer service several times and set up a user account with them (see information from June 19, 2019, S 1, 3 ff; OZ 1, S 80, 82 ff). It was therefore not apparent that there were other data sources to be reported. The origin of the data can also be seen from the "Overview of processed data (according to paragraph 151, GewO) Roman XXXX". With the designation "Overview of processed data" and the respective note "collected/purchased", this table clearly represents a summary or combination of all existing data from various data sources. It does not appear necessary to list the data sources again, as clear data sources are listed below (e.g. Roman XXXX ). In their statements, the authority concerned and the MP overlook the fact that according to the clear wording of Article 15, paragraph one, litera g, GDPR, the origin of the data does not have to be disclosed if the data was "collected" from the person concerned. In addition, the choice of words "collected" in contrast to "bought" suggests that part of the data was collected by the BF itself, which also corresponds to a reference. From an overall view of the information, it is therefore clear from which sources the (purchased) data originate. In the specific case of the MP, it was also evident from the second information from June 19, 2019 that the BF had recorded some data from the MP itself. This contacted BF customer service several times and set up a user account with them (see information from June 19, 2019, S 1, 3 ff; OZ 1, S 80, 82 ff). It was therefore not apparent that there were other data sources to be reported.

For the sake of completeness, it should be noted at this point that the BF once again clarified in its complaint and in its statement of March 1, 2023 that there are no other data sources. In any case, the table labeled "Overview" should be seen together with the rest of the information. A comparison with the other tables shows where the data came from.

The information is therefore detailed enough with regard to the origin of the data that was collected or purchased as part of the address publishing, so that the MP could become aware of the processing of their personal data and check their legality. The information is transparent due to the tabular overview and also understandable due to the choice of words. Even if the type of information selected here, with several tables and an additional "overview" viewed on its own, initially makes the origin of the data appear somewhat confusing, a synopsis with the supplementary information nevertheless clearly shows where which data originates from. The information is therefore complete and also meets the transparency requirements of Article 12 (1) GDPR. The violation of law determined by the authority concerned is therefore not available. The information is therefore detailed enough with regard to the origin of the data that was collected or purchased as part of the address publishing, so that the MPs are aware of the processing of their personal data and check its legality could. The information is transparent due to the tabular overview and also understandable due to the choice of words. Even if the type of information selected here, with several tables and an additional "overview" viewed on its own, initially makes the origin of the data appear somewhat confusing, a synopsis with the supplementary information nevertheless clearly shows where which data originates from. The information is therefore complete and also meets the transparency requirements of Article 12, paragraph one, GDPR. The violation of law determined by the authority concerned is therefore not present.

3.3. Regarding point 2. b.:

If there is automated decision-making in individual cases in accordance with Art. 22 Para. 1 and 4 GDPR, i.e. the exception provision of Art. 22 Para. In addition, information about the logic involved and the scope and intended effects of such processing must be provided. When providing information to the data subject, the person responsible must describe the logic used in such a way that the data subject is informed about the parameters used in the evaluation and that they can recognize which aspects of their person or their behavior are being used. The algorithm itself cannot be disclosed. The concept of the logic involved is to be understood in such a way that only the principle on which such a calculation is based is to be presented, but not the specific calculation formula (cf. Jahnel, commentary on the General Data Protection Regulation Art 15 DSGVO Rz 32). If automated decision-making in the If there is an individual case according to Article 22, Paragraphs 1 and 4 GDPR, i.e. the exception provision of Article 22, Paragraph 2, GDPR does not apply (see Article 22, GDPR), the data subject must also be informed of this when the information is provided. In addition, information about the logic involved and the scope and intended effects of such processing must be provided. When providing information to the data subject, the person responsible must describe the logic used in such a way that the data subject is informed about the parameters used in the evaluation and that they can recognize which aspects of their person or their behavior are being used. The algorithm itself cannot be disclosed. The concept of the logic involved is to be understood in such a way that only the principle on which such a calculation is based is to be presented, but not the specific calculation formula (cf. Jahnel, commentary on the General Data Protection Regulation, Article 15, GDPR margin no. 32).

The BF stated in the same way in the procedure that the assignment to a marketing group was based on the personal data and marketing classifications disclosed. It is factually impossible to provide further attribution parameters (complaint, S 9). The BF already announced in the proceedings before the authority concerned that it would use the MP's place of residence, gender and date of birth to allocate the affinities. This data is used to avoid wastage in advertising and to prevent the sending of unwanted advertising material (statement of June 19, 2019, p. 3; OZ 1, p. 77). In addition, the table "Overview of processed data (according to § 151 GewO)" also states "statistically extrapolated" (see the information from April 2nd, 2019; OZ 1, S 31). The BF stated in the procedure that the assignment to a marketing group was based on the personal data and marketing classifications disclosed. It is factually impossible to provide further attribution parameters (complaint, S 9). The BF already announced in the proceedings before the authority concerned that it would use the MP's place of residence, gender and date of birth to allocate the affinities. This data is used to avoid wastage in advertising and to prevent the sending of unwanted advertising material (statement of June 19, 2019, p. 3; OZ 1, p. 77). In addition, the table "Overview of processed data (according to paragraph 151, GewO)" also states "statistically extrapolated" (see the information from April 2nd, 2019; OZ 1, S 31).

Regardless of whether the marketing groups in question are personal data or whether there is a case of profiling, the BF has input variables (data provided by the MP, such as place of residence, gender, date of birth), the calculation method (statistical extrapolation), the result (high/low), as well as the impact/consequence on the MP (sending/non-sending of advertising material). The possible profile categories (“Possible target group for election advertising”, “Possible target group for advertising organic”) and the assigned values (“low” and “high” etc.) were self-explanatory in the present case.

Irrespective of whether the information given was due in the sense of Art 15 Para 1 lit h GDPR, in the present case it appears to be complete, transparent and also understandable in the sense of Art 12 Para 1 GDPR. The individual parameters were disclosed and the calculation method as well as the results and effects were explained. A disclosure of the specific calculation formula or the algorithm is not required (see Haidinger in Knyrim, DatKomm Art 15 DSGVO Rz 45). There is therefore no violation of the right to information in this regard. Irrespective of whether the information provided was due in the sense of Article 15, paragraph one, litera h, GDPR, it appears in the present case to be complete, transparent and also understandable in the sense of Article 12, paragraph one, GDPR. The individual parameters were disclosed and the calculation method as well as the results and effects were explained. Disclosure of the specific calculation formula or the algorithm is not required (see Haidinger in Knyrim, DatKomm Article 15, GDPR Rz 45). There is therefore no violation of the right to information in this regard.

There is therefore no violation of the right to information. As a result, the complaint was to be granted and clause 1 of the contested decision was to be amended in accordance with the ruling. The performance orders in point 2 had to be omitted.

It had to be decided accordingly.

3.4. Pursuant to Section 24 (1) VwGVG, the administrative court must hold a public oral hearing upon application or, if it deems it necessary, ex officio.3.4. According to paragraph 24, paragraph one, VwGVG, the administrative court must hold a public oral hearing upon application or, if it deems it necessary, ex officio.

According to § 24 para. 4 VwGVG - unless otherwise provided by federal or state law - the administrative court can, regardless of a party's application, refrain from a hearing if the files indicate that the oral discussion does not give reason to expect any further clarification of the legal matter, and a Art. 6 para. 1 EMRK nor Art. 47 GRC stand in the way of the omission of the hearing. Pursuant to paragraph 24, paragraph 4, VwGVG - unless otherwise provided by federal or state law - the administrative court can refrain from a hearing, regardless of a party's application, if the files recognize that the oral discussion does not lead to the expectation of further clarification of the legal matter, and that neither Article 6, paragraph one, ECHR nor Article 47 CFR preclude the omission of the hearing.

The requested oral hearing could be waived, since the facts that are essential for the legal assessment have already been fully collected by the administrative authority and in a proper investigation and at the time of the decision of the adjudicating court is still up to date and complete as required by law. The complaint also did not allege any facts that contradicted or went beyond the result of the official investigation (VwGH February 24, 2015, Ra 2014/19/0171). Furthermore, the administrative court was able to agree with the assessment of evidence by the authority concerned. The arguments of the BF in the complaint about the origin of the data in the table "Overview of processed data (according to § 151 GewO) XXXX" are only directed against the legal assessment of the authority concerned (in particular the comprehensibility within the meaning of Art 12 DSGVO). The information provided by the complainant was fully recorded by the authority concerned in the notification. The supplementary statement of the statements made by the BF in its statement of June 19, 2019 does not represent a "new" fact insofar as this information is already evident from the information ascertained by the authority concerned. It already refers to the "statistical extrapolation". In addition, terms such as "Possible target group for election advertising" and "Possible target group for organic advertising" were self-explanatory, which is why the supplementary explanations in this regard in the administrative complaint did not have to be used The facts relevant to the decision have already been fully collected by the administrative authority and in a proper investigation and at the time of the decision of the adjudicating court are still up to date and complete as required by law. The complaint also did not allege any facts that contradicted or went beyond the result of the official investigation (VwGH February 24, 2015, Ra 2014/19/0171). Furthermore, the administrative court was able to agree with the assessment of evidence by the authority concerned. The arguments of the BF in the complaint about the origin of the data in the table "Overview of processed data (according to paragraph 151, GewO) Roman XXXX" are only directed against the legal assessment of the authority concerned (in particular the comprehensibility within the meaning of Article 12, DSGVO). The information provided by the complainant was fully recorded by the authority concerned in the notification. The supplementary statement of the statements made by the BF in its statement of June 19, 2019 does not represent a "new" fact insofar as this information is already evident from the information ascertained by the authority concerned. It already refers to the "statistical extrapolation". Furthermore, terms such as “Possible target group for election advertising” and “Possible target group for organic advertising” were self-explanatory, which is why the supplementary explanations in this regard in the complaint about the administrative decision did not have to be used.

The assessment of whether the statements in the information comply with the transparency requirement, are understandable and complete is a legal question. The actual content of the information and thus the facts relevant to the decision are undisputed in the present proceedings.

In the present case, the Federal Administrative Court therefore only has to rule on a legal issue (cf. ECtHR June 20, 2013, Appl. No. 24510/06, Abdulgadirov/AZE, margin nos. 34 et seq.). Neither Art. 6 Para. 1 of the ECHR nor Art. 47 of the Charter of Fundamental Rights stand in the way of the omission of the hearing. In the present case, the Federal Administrative Court therefore only has to decide on a legal issue, compare ECtHR June 20, 2013, Appl. No. 24510/06, Abdulgadirov/AZE, margin no. 34 ff). Neither Article 6, Paragraph 1 of the ECHR nor Article 47 of the Charter of Fundamental Rights stand in the way of the omission of the hearing.

Re B) Admissibility of the revision

Pursuant to § 25a Para. 1 VwGG, the administrative court has to pronounce in its ruling or resolution whether the revision is admissible in accordance with Art. 133 Para. 4 B-VG. The statement must be briefly justified. According to paragraph 25 a, paragraph one, VwGG, the administrative court has to pronounce in its ruling or decision whether the revision is permissible according to article 133, paragraph 4, B-VG. The statement must be briefly justified.

The revision is permitted in accordance with Art. 133 Para. 4 B-VG because there has not yet been any case law from the Administrative Court on the basis of which criteria precise, transparent, understandable information formulated in clear and simple language is to be assessed. The revision is in accordance with Article 133, paragraph 4, B-VG, because there has not yet been any case law from the Administrative Court on the basis of which criteria precise, transparent, understandable information formulated in clear and simple language is to be assessed.