VwGH - Ra 2023/04/0248

VwGH - Ra 2023/04/0248
Court:	VwGH (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 16 GDPR § 25 AMSG § 38 AVG
Decided:	27.11.2023
Published:	09.01.2024
Parties:	Arbeitsmarktservice Datenschutzbehörde S. P.
National Case Number/Name:	Ra 2023/04/0248
European Case Law Identifier:	ECLI:AT:VWGH:2023:RA2023040248.L00
Appeal from:	BVwG W256 2275675-1/4E
Appeal to:	Appeal not possible
Original Language(s):	German
Original Source:	Rechtsinformationssystem des Bundes (in German)
Initial Contributor:	Sebastian Elisa

The Austrian Supreme Administrative Court held that a suspension of investigation by the Austrian Data Protection Authority was unlawful.

English Summary

Facts

A data subject requested the controller - Arbeitsmarktservice (the public employment service) - to change their gender in the database from "male" to "divers" following a court decision, that changed the subject's gender in the civil registry. The subject submitted an official document proving the change in the civil register. On 15 March, the controller replied that it could not do so, as the software in place does not permit other genders than "male" and "female". The subject then raised a complain to the Datenschutzbehörde, the Austrian data protection authority. The DSB suspended the proceedings on the basis of Article 38 of the General Administrative Procedures Act (AVG) until the CJEU delivers its judgement on the preliminary questions in case C-247/23. The data subject and complainant appealed this decision to the Bundesverwaltungsgericht (Federal Administrative Court) which held that the suspension was unlawful and ordered the DSB to proceed the investigations. The DSB appealed this decision to the Supreme Administrative Court.

Holding

The Supreme Administrative Court ruled that the Federal Administrative Court decided correctly and rejected the complain.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Regarding

The Administrative Court, through the Chairman Senate President Dr. Kleiser and the court councilor Dr. Mayr and Mag. Brandl as judge, with the participation of the secretary Mag. Vonier, on the appeal of the data protection authority against the decision of the Federal Administrative Court of October 12, 2023, Zl. W256 2275675-1/4E, regarding the suspension of proceedings in a data protection matter (Parties involved: 1. S P in W, and 2. Labor Market Service Austria; other party: Federal Minister of Justice), the decision was made:

saying

The appeal is rejected.

Reason

1        With the data protection complaint dated March 18, 2023, addressed to the authority concerned (applicant), the first party involved claims a violation of the right to rectification pursuant to Art. 16 GDPR and requests 1. the determination of the violation of its rights, 2. instructions to the second party involved Party as responsible in accordance with Art. 58 para. 2 lit. c GDPR to change their gender entry from “male” to “diverse”, and 3. the provision of the results of the procedure in accordance with Art. 77 para. 2 GDPR in conjunction with Section 17 AVG , because the second party involved did not comply with its request for change dated March 9, 2023, in which the first party involved pointed out a corresponding change in the Central Civil Status Register (ZPR) with regard to the Vienna Administrative Court's ruling of February 27, 2023. With the In the data protection complaint dated March 18, 2023, addressed to the authority concerned (applicant), the first party involved claims a violation of the right to rectification pursuant to Article 16, GDPR and requests 1. the determination of the violation of its rights, 2. the instruction to the second party involved as the person responsible in accordance with Article 58, Paragraph 2, Litera c, GDPR, to change your gender entry from “male” to “diverse”, and 3. to make available the results of the procedure in accordance with Article 77, Paragraph 2, GDPR in conjunction with Paragraph 17, AVG , because the second party involved did not comply with its request for change dated March 9, 2023, in which the first party involved pointed out a corresponding change in the Central Civil Status Register (ZPR) with regard to the Vienna Administrative Court's ruling of February 27, 2023.

2        In the statement dated April 24, 2023, the second party involved requests that the data protection complaint be rejected as inadmissible, and possibly its dismissal, and summarizes that the first party involved provided it with a false social security number in its submission of March 9, 2023. There is an “obligation to provide correct data to the person responsible” on the part of the first party involved. Regardless of this, the first party involved “does not have an active customer relationship (internal status ‘dormant’)” with the second party involved. After the business transaction has been completed, data from people who are not in an active care relationship would only be “kept” in accordance with the applicable retention periods in accordance with Section 25 Para. 9 AMSG until the end of the respective period. In the absence of further processing purposes, additional processing apart from storage to fulfill retention obligations is not planned. When a new customer relationship occurs, the data record would be reactivated. By assuming the internal status “dormant”, the data record meets the requirements of a restriction in accordance with Article 18 GDPR. Finally, the second party involved set up its own project “to support gender diversity”. The introduction of the changes in the ITIn the statement of April 24, 2023, the second party involved requests that the data protection complaint be rejected as inadmissible, and possibly its dismissal, and summarizes that the first party involved made a false statement to it in its submission of March 9, 2023 Social security number provided. There is an “obligation to provide correct data to the person responsible” on the part of the first party involved. Regardless of this, the first party involved “does not have an active customer relationship (internal status ‘dormant’)” with the second party involved. After completion of the business transaction, data from persons who are not in an active care relationship would only be “kept” in accordance with the applicable retention periods in accordance with Section 25, Paragraph 9, AMSG until the end of the respective period. In the absence of further processing purposes, additional processing apart from storage to fulfill retention obligations is not planned. When a new customer relationship occurs, the data record would be reactivated. By assuming the internal status “dormant”, the data set meets the requirements of a restriction under Article 18, GDPR. Finally, the second party involved set up its own project “to support gender diversity”. The introduction of the changes in the IT systems of the second party involved is scheduled for June 2023 after a long and extensive survey and analysis phase. For reasons explained in more detail, delays in the implementation of individual elements are unavoidable. In order to still fulfill the “request of the complaining person”, the request for correction is saved in the data record and this is carried out manually after the planned change.

3        By decision of July 17, 2023, the applicant continued the process of the data protection complaint “until the final decision by the Court of Justice of the European Union in case C-247/23 regarding the question of the interpretation of Article 16 of the GDPR under EU law in relation to the Correction of the gender entry in a register and whether the data subject who requests the correction of the data relating to their gender is obliged to provide evidence to justify their request, in accordance with Section 38 AVG 247/23 with regard to the question of the interpretation of EU law Article 16, GDPR in relation to the correction of the gender entry in a register and whether the data subject requesting the correction of data relating to their gender is obliged to provide evidence to support their request, in accordance with paragraph 38, AVG.

4        The Federal Administrative Court upheld the complaint lodged against it by the first co-participant with the contested finding, repealed the appeal applicant's suspension decision without replacement and declared that the appeal was inadmissible.

In summary, the administrative court stated that on April 18, 2023, a Hungarian court had submitted a request for a preliminary ruling on C-247/23 to the Court of Justice of the European Union (ECJ) on the following questions:

"1. Should Article 16 GDPR be interpreted as meaning that, with a view to exercising the rights of the data subject, the authority which maintains the registers under Member State law is obliged to correct personal data registered by it relating to the gender of that person if this Data have changed since they were entered into the register and therefore do not comply with the principle of accuracy set out in Article 5 Paragraph 1 Letter d GDPR?"1. Should Article 16, GDPR be interpreted as meaning that, with a view to exercising the rights of the data subject, the authority which maintains the registers under Member State law is obliged to correct personal data registered by it relating to the gender of that person if the latter data have changed since they were entered into the register and therefore do not comply with the principle of accuracy set out in Article 5, paragraph one, letter d of the GDPR?

2. If question 1 is answered in the affirmative: Should Article 16 GDPR be interpreted as meaning that the person requesting the correction of data relating to their gender is obliged to provide evidence to support their request for correction?2. If the answer to question 1 is in the affirmative: Should Article 16, GDPR be interpreted as requiring the person requesting the rectification of data relating to their gender to provide evidence supporting their request for rectification?

3. If question 2 is answered in the affirmative: Should Article 16 GDPR be interpreted as meaning that the applicant must prove that he or she has undergone gender reassignment surgery?”3. If question 2 is answered in the affirmative: Should Article 16, GDPR be interpreted as meaning that the applicant must prove that he or she has undergone gender reassignment surgery?”

This procedure is based on the refusal of an authority to correct a gender entry in accordance with Article 16 GDPR. In contrast, the second party in the present proceedings did not refuse to comply with the request for correction. Rather, she argued that the technical implementation of the requested correction would take several more months due to the legal and technical complexity. It is therefore only necessary to assess whether the second party involved is right to claim a delayed implementation of the correction in accordance with Article 12 Para. 3 GDPR. In this respect, the questions referred to the ECJ are based on the refusal of an authority to correct a gender entry in accordance with Article 16, GDPR. In contrast, the second party in the present proceedings did not refuse to comply with the request for correction. Rather, she argued that the technical implementation of the requested correction would take several more months due to the legal and technical complexity. It is therefore only necessary to assess whether the second party involved is right to claim a delayed implementation of the correction in accordance with Article 12, Paragraph 3, GDPR. In this respect, the questions referred to the ECJ on C-247/23 are not a necessary basis for answering the main question to be clarified in the present proceedings.

In this case, there are no two “same” or “similar” cases. The only parallel between the present proceedings and the request for a preliminary ruling is that both concern the interpretation of Article 16 GDPR in connection with the correction of a gender entry. Apart from that, the two procedures would differ fundamentally from one another, particularly with regard to the legal question to be assessed. The existence of a preliminary question justifying the suspension should therefore be denied and the contested decision should be repealed without replacement. In the present case, there are no two “equivalent” or “similar” cases. The only parallel between the present proceedings and the request for a preliminary ruling is that both concern the interpretation of Article 16, GDPR in the context of the correction of a gender entry. Apart from that, the two procedures would differ fundamentally from one another, particularly with regard to the legal question to be assessed. The existence of a preliminary question justifying the suspension should therefore be denied and the contested decision should be repealed without replacement.

5        This official revision is directed against this.

6        According to Article 133, paragraph 4, B-VG, an appeal against a decision of the administrative court is permissible if it depends on the solution of a legal question that is of fundamental importance, in particular because the decision is based on the case law of the Administrative Court differs, such case law is missing or the legal question to be resolved is not answered uniformly in the previous case law of the Administrative Court.

7        According to Section 34 Paragraph 1 VwGG, revisions that arise due to the non-fulfillment of the requirements of Article 133 Paragraph 4 BAccording to Paragraph 34, Paragraph One, VwGG are revisions that arise due to non-fulfillment of the requirements of Article 133 Paragraph 4, B- VG is not suitable for treatment and should be rejected without further proceedings.

8        According to Section 34, Paragraph 1a, VwGG, the Administrative Court has the admissibility of an extraordinary appeal in accordance with Article 133, Paragraph 4, B-VG. According to Paragraph 34, Paragraph One a, VwGG, the Administrative Court has the admissibility of an extraordinary appeal in accordance with Article 133, Paragraph 4, B-VG within the framework of the reasons put forward for this in the appeal (Section 28, Paragraph 3, VwGG).VG within the framework of the reasons put forward in the appeal (Section 28, Paragraph 3, VwGG).

9        The official revision justifies its admissibility on the basis that the contested finding deviates from the case law of the Administrative Court mentioned in more detail, according to which it is sufficient if it concerns the interpretation of the same EU law provision and the procedures in question at least show points of overlap in comparison. In contrast, the administrative court believes that a question referred for a preliminary ruling from another procedure must correspond entirely to the question of the procedure to be suspended. Since the request for a preliminary ruling on C-247/23 and the main proceedings concern the same EU law provision - Article 16 of the GDPR - and there is also a comparable situation - an application for the correction of the gender designation - the requirements for a suspension of the proceedings according to the case law of the Administrative Court.

Furthermore, there is a lack of case law from the Administrative Court on the question of whether a person responsible under Article 4 Para. whether the requirements for correcting a gender designation were met or whether he could rely on the entry in the ZPR taking into account Section 40 Paragraph 3 of the Personal Status Act 2013 (PStG 2013). If a commitment to registration in the ZPR can be assumed, a suspension according to Section 38 AVG cannot be considered. had to independently check whether the requirements for correcting a gender designation were met or whether he could rely on the entry in the ZPR, taking into account Section 40, Paragraph 3, Personal Status Act 2013 (PStG 2013). If a commitment to registration in the ZPR can be assumed, a suspension according to Paragraph 38, AVG is out of the question.

10       The facts essential to the decision, the contested decision and the admissibility of the official appeal in the present proceedings are essentially the same as the initial facts and the statements of the applicant for the appeal in the proceedings recorded under Ra 2023/04/0221. In this respect, reference can therefore be made, in accordance with Section 43 Para. 2 VwGG, to the statements of the Administrative Court in the rejection decision Nos. 11 to 18 issued today in these proceedings. The material facts of the decision, the contested decision and the admissibility argument are the same as the official revision of the present proceedings essentially the initial facts and the statements of the appeal applicant in the proceedings recorded under Ra 2023/04/0221. In this respect, in accordance with paragraph 43, paragraph 2, VwGG, reference can be made to the statements of the Administrative Court in the rejection decision Nos. 11 to 18 issued in these proceedings today.

11       Accordingly, in the present case, in the sense of the case law summarized in the rejection decision Ra 2023/04/0221, paras. 11 to 15, the administrative court did not obviously incorrectly assume that the questions referred in the request for a preliminary ruling to the ECJ on C-247/23 are for interpretation of Art. 16 GDPR are not prejudicial in relation to the procedure for the data protection complaint of the first party involved because, in contrast to the procedure on which the request for a preliminary ruling is based, the second party involved does not fundamentally refuse the requested correction, but only its immediate implementation for technical reasons denies, and does not seek any (further) evidence to support the request for correction. Contrary to the argument of admissibility, the legal question in this case is not whether a person responsible has to independently check whether the requirements for correcting the gender designation are met or whether he can rely on the entry in the ZPR, taking into account Section 40 (3) PStG 2013, essential to the decision.247/23 on the interpretation of Article 16, GDPR in relation to the procedure for the data protection complaint of the first party involved is not prejudicial because, in contrast to the procedure on which the request for a preliminary ruling is based, the second party involved does not fundamentally refuse the requested correction, but rather merely denies their immediate implementation for technical reasons, and does not request any (further) evidence to justify the request for correction. Contrary to the argument of admissibility, the legal question in this case is not whether a person responsible has to independently check whether the requirements for correcting the gender designation are met or whether he can rely on the entry in the ZPR, taking into account paragraph 40, paragraph 3, PStG 2013 , crucial to the decision.

12       Nothing to the contrary emerges from the reference of the official revision to the suspension decision of the Administrative Court of February 24, 2022, Ra 2020/04/0187 (cf. again VwGH Ra 2023/04/0221, Rn. 15). Official appeal on the suspension decision of the Administrative Court of February 24, 2022, Ra 2020/04/0187, there is nothing to the contrary (compare again VwGH Ra 2023/04/0221, Rn. 15).

13       The mere fact that the questions referred to the ECJ in case C-247/23 concern the interpretation of Article 16 GDPR with regard to changing a person's gender does not justify the "similarity" or prejudiciality of the questions referred to in the present case the suspended proceedings before the appellant.247/23 concerning the interpretation of Article 16, GDPR in relation to the change of a person's gender entry, does not justify the "similarity" or prejudiciality of the questions referred for the suspended proceedings before the appellant.

14       Against this background, the appeal does not raise any legal questions that are of fundamental importance within the meaning of Article 133, Paragraph 4, B-VG. The appeal was therefore rejected.

Vienna, November 27, 2023