VwGH - Ra 2023/04/0259

VwGH - Ra 2023/04/0259
Court:	VwGH (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 57(1)(f) GDPR Article 58 GDPR
Decided:	13.06.2024
Published:	09.07.2024
Parties:	DSB
National Case Number/Name:	Ra 2023/04/0259
European Case Law Identifier:	ECLI:AT:VWGH:2024:RA2023040259.L00
Appeal from:	BVwG (Austria) W176 2273922-1/5E
Appeal to:
Original Language(s):	German
Original Source:	Rechtsinformationsystem des Bundes (in German)
Initial Contributor:	ec

The Supreme Administrative Court held that the DPA should not only investigate to the extent appropriate under Article 57(1)(f) GDPR, but must also observe the principle of material truth arising from national data protection law.

English Summary

Facts

The data subject applied for legal aid for court proceedings. The application for legal aid and the data subject’s objection as well as the decision of the district court to grant legal aid were served on the lawyer of the other party in the proceedings, who forwarded these documents, including the declaration of assets, to their client. Subsequently, these documents were forwarded by the other party to a third party.

On 6 April 2023, the data subject lodged a complaint at the Austrian DPA (“Datenschutzbehörde – DSB”). The DPA held that the forwarding of the application for legal aid, including the declaration of assets, violated the principle of data minimisation pursuant to Article 5(1)(c) GDPR.

The other party appealed this decision at the Federal Administrative Court (“Bundesverwaltungsgericht - BVwG”). The court upheld the appeal and annulled the DPA’s decision. The court held that the DPA failed to consult the third party, to whom the application for legal aid including the declaration of assets had been forwarded to, on the question of whether they had already been aware of the transmitted data beforehand. As the DPA had not made any findings on this question, the court could also not establish facts necessary for a decision on this matter. Therefore, the case should be referred back to the DPA to complete the facts of the case quickly and in a cost-saving manner.

The DPA appealed this decision at the Supreme Administrative Court (“Verwaltungsgerichtshof - VwGH”) and argued that it cannot be inferred from the wording of Article 57(1)(f) GDPR that the DPA is obliged to investigate beyond "to the extent appropriate". In the present case, it could not be said that the "appropiate extent" of the investigation was not reached. Moreover, there was also a lack of case law from the Administrative Court on Article 57(1)(f) GDPR. The annulment of the DPA’s decision by the Federal Administrative Court was therefore unjustified.

Holding

The Supreme Administrative Court dismissed the argument that there was a lack of case law from the Supreme Administrative Court on Article 57(1)(f) GDPR and pointed out its decision in case 2023/04/0254. In this case, the Supreme Administrative Court held that in proceedings concerning a data protection complaint, the DPA must observe the principle of material truth arising from §37 and §39(2) of the Austrian data protection law ("AVG") on a case-by-case basis in order to guarantee effective legal protection to a data subject who considers that their rights under the GDPR have been violated and to ensure compliance with the GDPR. The Supreme Administrative Court then held, unlike the DPA's view, that the DPA should not only investigate a case to the extent appropriate, but find out the material truth of the case.

However, the Supreme Administrative Court held that a referral back is only used in the event of serious gaps in the investigation. Referral of the case back to the administrative authority to carry out necessary investigations will therefore be considered only if the administrative authority failed to carry out any necessary investigative activities or if it took completely unsuitable investigative steps to determine the relevant facts. The Supreme Administrative Court held that this also applies if there are concrete indications that the administrative authority, such as the DPA, omitted (difficult) investigations so that these could then be carried out by the administrative court.

The court then took into account the investigation of the DPA in the present case and held that there were serious investigative gaps. Therefore, the court held that the additional investigative steps deemed necessary by the Federal Administrative Court could have been carried out by themselves without difficulty - within the framework of an oral hearing before the court.

The argumentation of the Federal Administrative Court that it would be necessary to question the third party to whom the data subject's personal data was forwarded in order to clarify the essential question of fact, combined with the statement that the DPA had to carry out a comprehensive investigation regarding this, did not justify a referral back according to the Supreme Administrative Court.

Regarding the Federal Administrative Court’s argument that it would save costs did also not support the annulment of the decision and the referral back according to the Supreme Administrative Court. The Supreme Administrative Court held that it had repeatedly stated that in cases in which supplementary investigations are to be carried out, the interest of speed takes priority. It was therefore irrelevant whether the completion of the proceedings conducted by the administrative authority would cost more as the opening of a new appeal against in this case the DPA at the Federal Administrative Court would lead to an overall extension of the proceedings.

The Supreme Administrative Court thus held that the decision by the Federal Administrative Court should be annulled.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Subject

The Administrative Court, through the presiding Senate President Dr. Pollak and the court councilors Dr. Mayr and Mag. Brandl as judges, with the participation of the secretary Mag. Amesberger, on the appeal by the data protection authority against the decision of the Federal Administrative Court of October 25, 2023, file number W176 2273922-1/5E, concerning the rectification and referral in a data protection matter (other party: Federal Minister of Justice; co-parties: 1. R B in P, represented by Dr. Martin Wuelz, attorney-at-law in 6020 Innsbruck, Salurnerstrasse 12/EG, and 2. T M in I), rightly ruled:The Administrative Court, through the presiding Senate President Dr. Pollak and the court councilors Dr. Mayr and Mag. Brandl as judges, with the participation of the secretary Mag. Amesberger, on the appeal by the data protection authority against the decision of the Federal Administrative Court of October 25, 2023, reference number W176 2273922-1/5E, concerning the rectification and referral in a data protection matter (other party: Federal Minister of Justice; co-parties: 1. R B in P, represented by Dr. Martin Wuelz, attorney at law in 6020 Innsbruck, Salurnerstrasse 12/EG, and 2. T M in Roman one), rightly ruled:

Judgment

The contested decision is annulled due to the illegality of the content.

Reasons

1        1. By decision of the Data Protection Authority (DSB, official appeal applicant) of April 6, 2023, the data protection complaint of the second party was partially upheld and it was determined that the first party had violated its right to confidentiality because it had forwarded a (more precisely specified) application for the approval of legal aid from the second party, including a declaration of assets, to a third party (ruling point I). Otherwise, the DSB rejected the data protection complaint as unfounded (ruling point II).

2        The DSB essentially found that the first party had sued the second party at the Innsbruck District Court for payment of the more precisely specified detective costs. The District Court then issued a conditional payment order, against which the second party had lodged an objection. The second party subsequently applied for legal aid, which was granted to her by order of the district court on 22 January 2020. The application for legal aid and the objection of the second party as well as the district court’s order granting legal aid were served on the first party’s lawyer, who forwarded these documents to the first party. These documents were subsequently forwarded by the first party to a third party.

3        Legally, the DSB concluded that the scope of application of Section 1 Paragraph 1 of the Data Protection Act (DSG) was open because the information passed on indisputably related to the second party in accordance with Article 4 Paragraph 1 of the General Data Protection Regulation (GDPR). The first party involved was admittedly granted a legitimate interest in enforcing its legal claims, but it was not necessary to forward the application for legal aid, including the declaration of assets, because all of the essential information was already contained in the decision to grant legal aid. The (chosen) approach did not comply with the principle of data minimization pursuant to Art. 5, Paragraph 1, Letter c of GDPR. The data protection complaint was therefore upheld with regard to the forwarding of the application for legal aid, including the declaration of assets (with ruling point I). However, the forwarding of the objection to the payment order and the decision to grant legal aid was to be regarded as lawful, which is why the data protection complaint in this regard (with ruling point II) was to be dismissed.

4        2. The Federal Administrative Court (BVwG) upheld the appeal filed by the first party (identifiably only against point I of the decision) with the contested order of October 25, 2023, annulled the contested decision in accordance with Section 28, Paragraph 3, second sentence, of the Administrative Court Act (VwGVG) and referred the matter back to the DSB for a new decision. It further ruled that the ordinary appeal was inadmissible.

5        In its justification, the BVwG essentially stated that, despite the application in this regard, the DSB had failed to interview the third party to whom the application for legal aid including the declaration of assets had been forwarded on the question of whether he had already been aware of the transmitted data beforehand. Since the DSB had not made any findings on this question, the facts required for the BVwG to make a decision on the matter had not been established. It cannot be said that the taking of evidence by the BVwG would, when viewed as a whole, lead to significant time and cost savings. Rather, in a case such as the present, the referral of the matter back to the DSB would serve to complete the facts quickly and cost-effectively. Against the background of administrative and economic considerations, whereby reference must also be made to the investigative powers granted to the supervisory authority under Art. 58 GDPR and the obligation of those responsible to cooperate with the supervisory authority arising from Art. 31 GDPR, the option of proceeding under Section 28 Paragraph 3, second sentence, VwGVG should therefore be used. In the continued proceedings, the DSB will therefore have to interview the third party and make findings in this regard on the basis of a comprehensible assessment of the evidence.

6        3. The present extraordinary official appeal by the DSB is directed against this decision.

7 Both the first party and the second party (the latter unrepresented) filed responses to the appeal.

The Administrative Court, in a senate constituted pursuant to Section 12 Paragraph 1 Item 2 of the Administrative Court Act, considered:The Administrative Court, in a senate constituted pursuant to Paragraph 12 Paragraph 1 Item 2 of the Administrative Court Act, considered:

8 4. In order to justify its admissibility, the appeal is argued, firstly, that there is no case law of the Administrative Court on Article 57 Paragraph 1 Letter f of GDPR. It cannot be inferred from the wording of this provision that the DSB is obliged to take procedural steps that go beyond treatment “to an appropriate extent”. In the present case, it cannot be said that the level of investigation “to an appropriate extent” was not achieved. The annulment by the BVwG was (also) wrong for this reason.

9 Whether a legal question of fundamental importance exists must be assessed at the time of the decision of the Administrative Court. If the legal question to be resolved has therefore already been clarified in the case law of the Administrative Court - even after the decision of the Administrative Court or even after the appeal has been lodged - an appeal is no longer admissible due to the lack of case law of the Administrative Court (see, for example, VwGH 8.8.2018, Ra 2017/04/0090 to 0091, para. 5, with further references).

10       In its decision VwGH 21.12.2023, Ra 2023/04/0254, to the reasons for the decision of which reference is made pursuant to Section 43 Para. 2 VwGG, the Administrative Court has already dealt with the provision of Article 57 Para. 1 lit. f GDPR in proceedings - such as the present one - concerning a remedy and referral by the Administrative Court pursuant to Section 28 Para. 3 second sentence VwGVG. In it, the Administrative Court, referring to the case law of the Court of Justice of the European Union on the principles of equivalence and effectiveness under Union law, held that in proceedings concerning a data protection complaint, the DPO must observe the principle of substantive truth arising from Section 37 and Section 39(2) AVG (official principle, ex officio principle) on a case-by-case basis in order to guarantee effective legal protection to a data subject who considers that his or her rights under the GDPR have been violated and to ensure compliance with the provisions of the GDPR. Contrary to the view of the DSB (also represented here in the grounds for appeal), there is no indication of a "partial" derogation of the principle of material truth arising from Section 37 and Section 39(2) AVG by Article 57(1)(f) GDPR to the detriment of the parties to the proceedings on a complaint pursuant to Article 77(1) GDPR (cf. VwGH 21.12.2023, Ra 2023/04/0254, para. 14).

11       The admissibility argument that there is a lack of case law of the Administrative Court on Article 57(1)(f) GDPR is thus undermined.

12       5. However, in view of the deviation of the contested decision from the more detailed case law of the Administrative Court regarding the existence of the requirements for referral under the second sentence of Section 28(3) of the Administrative Court Act, as set out in its admissibility arguments, the appeal is admissible and justified.

13       According to the consistent case law of the Administrative Court, the possibility of referral under the second sentence of Section 28(3) of the Administrative Court Act represents an exception to the fundamental merit-based decision-making jurisdiction of the administrative courts. According to the understanding required by this, this possibility is not on the same level in terms of its requirements as the fundamental merit-based decision-making jurisdiction of the administrative courts enshrined in the first sentence of Section 28(3) of the Administrative Court Act. Rather, the system as a whole standardised in Section 28 VwGVG, which in particular reflects the normative objective of speeding up proceedings and taking into account a reasonable duration of proceedings, requires that the possibility of referral back is only used in the event of blatant or particularly serious gaps in the investigation. Referring the matter back to the administrative authority to carry out necessary investigations will therefore be considered in particular if the administrative authority has failed to carry out any necessary investigative activity, if it has only taken completely unsuitable investigative steps to determine the relevant facts (cf. Section 37 AVG) or has only carried out rudimentary investigations. The same applies if there are concrete indications that the administrative authority failed to carry out (e.g. difficult) investigations so that they could then be carried out by the administrative court (cf., for example, VwGH 30 August 2023, Ra 2023/04/0076, para. 12, with further references).

14       The DSB made findings based on the results of its investigation and used these as the basis for its decision. In view of the administrative procedure on record, it is not clear to what extent this procedure contains serious investigative gaps in the sense of the case law of the Administrative Court. The additional investigative steps considered necessary by the Federal Administrative Court could have been carried out without difficulty by the Federal Administrative Court - in the context of an oral hearing before the Federal Administrative Court.

15 The mere reference by the BVwG in the contested decision that the necessary clarification of the essential factual issue required the questioning of the third party to whom the data in question had been forwarded, combined with the statement that the DSB had to carry out a comprehensible assessment of the evidence in the continued proceedings on the basis of the results of this taking of evidence, does not justify the DSB's failure to carry out necessary factual investigations that would justify referral under Section 28(3), second sentence, of the VwGVG (see again in this sense VwGH 30.8.2023, Ra 2023/04/0076, para. 15, with reference to VwGH 22.6.2016, Ra 2016/03/0027, para. 22, according to which the need for additional questioning does not justify referral and that these questionings should be expediently carried out by the administrative court would have to be carried out in the context of an oral hearing).

16 The BVwG’s argument that referring the matter back to the DSB would serve to quickly and cost-effectively complete the facts of the case does not support the rectification and referral. The Administrative Court has already repeatedly stated that in cases where additional investigations are to be carried out, the (additional) determination of the relevant facts by the administrative court is in the interest of speed within the meaning of Section 28 Paragraph 2 Item 2, First Case VwGVG, especially since in this regard the focus is not only on the expected duration of the administrative court proceedings alone, but on the duration of the entire procedure required up to the merits decision. On this basis, it is therefore irrelevant whether supplementing the proceedings conducted by the administrative authority would in itself entail higher costs or a longer duration of the proceedings before the administrative court or the administrative authority. Only with this perspective can a result be achieved that takes into account the expansion of legal protection in the sense of accelerating the procedure, since the opening of a new legal action against the renewed administrative decision to an administrative court, which is associated with the administrative court's cassation of an administrative authority decision, leads overall to a prolongation of the procedure (cf. VwGH 25.4.2018, Ra 2018/03/0005, para. 16).

17 The contested decision was therefore to be annulled pursuant to Section 42 para. 2 item 1 VwGG due to the illegality of its content.

Vienna, 13 June 2024