BVwG - W256 2235360-1
From GDPRhub
| BVwG - W256 2235360-1 part 1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 4 GDPR Article 5 GDPR Article 6 GDPR Article 9 GDPR Article 22 GDPR Article 57 GDPR Article 58 GDPR § 25 AMSG § 29 AMSG § 31 AMSG § 4 AMSG § 1 (2) DSG |
| Decided: | 18.12.2020 |
| Published: | 31.03.2021 |
| Parties: | Public Employment Service Austria (respondent in the initial trial before the DSB) |
| National Case Number/Name: | W256 2235360-1 part 1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2020:W256.2235360.1.00 |
| Appeal from: | DSB (Data Protection Authority) DSB-D213.1020, 2020-0.513.605 |
| Appeal to: | Pending appeal VwGH (Supreme Administrative Court of Austria) |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (RIS) (in German) |
| Initial Contributor: | Fabian Schuster |
The Austrian Federal Administrative Court held that the Public Employment Service could lawfully process personal data belonging to jobseekers as this was necessary in order to guarantee a well-functioning labour market. This is outlined in Austrian law and it is in the substantial public interest in line with Article 9(2)(g) GDPR.
English Summary
Facts
The Public Employment Service (AMS) is a service provider under public law with its own legal personality, which is responsible for implementing the labour market policy of the federal government. In order to support workers in their (re-)integration into the labour market, it offers various services which are implemented by its counsellors.
In order to support counsellors in assessing the labour market opportunities of jobseekers, the AMS has developed a concept for calculating the labour market opportunities of jobseekers (AMAS). In concrete terms, AMAS uses an algorithm to automatically calculate the probability of currently registered customers being employed for a certain number of days within a certain period in the future. For this purpose, a so-called IC is calculated from the following data: age group, sex, Group of States, Education, Health impairment, Caring duties, professional group, pre-career, Regional labour market performance, Duration of the business case at the AMS. Based on the calculated IC, a classification is made into the following groups: Service clients with high labour market opportunities, care clients with low labour market opportunities, Counselling clients with medium labour market opportunities.
The results of the AMAS ought to be used in the guidance process and be a starting point for the counsellors to determine, together with the client, the optimal support strategy (subsidies and support services). The final decision on the assignment to a client group is always made by the counsellors. In the contested decision the Data Protection Authority (DSB) initiated an ex officio investigation into the matter and concluded that, the AMS was prohibited from processing data with the help of the AMAS with effect from 1 January 2021, unless there is a suitable legal basis for the data processing.
Dispute
Whether the data processing of the data controller regarding the determination of labour market opportunities of job-seekers with the help of the Labour Market Opportunities Assistance System ("AMAS") is carried out lawfully. Additionally, whether the data processing complies with the principles pursuant to Art. 5 of the GDPR and whether at least one condition pursuant to Art. 6 (1) in conjunction with Art. 9 (2) of the GDPR is fulfilled. The question finally arises as to which remedial powers under Art. 58(2) of the Regulation would come into consideration in order to remedy the breach.
Holding
The court held that, the AMS is in principle entitled under section 25(1) AMSG to assess the labour market opportunities of jobseekers on the basis of (certain) personal data.
With regard to Article 9(2)(g) of the GDPR and the requirement of a substantial public interest set out therein, it must first be noted that a substantial public interest can undoubtedly be seen in the task assigned to the Public Employment Service (AMS) by law in Section 29 of the AMSG, namely to guarantee a labour market that is as orderly and well-functioning as possible. In order to achieve this goal, it is undisputedly necessary to take into account the personal characteristics of jobseekers in combination with the general labour market situation and thus the possibilities of employment of jobseekers on the labour market and their need for support. The fact that the personal data of jobseekers used by the AMS and described above can be relevant for their job search and for the assessment of the market opportunities and the possible need for support, cannot be denied.
The Public Employment Service has to assess, among other things, the job opportunities of job seekers in order to ensure a proper policy and that it may also use the above-mentioned personal data according to section 25 (1) AMSG for this purpose. There are no indications that such data processing is not sufficiently clear in section 25 AMSG and is not otherwise regulated by means of adequate and specific measures to protect the fundamental rights and interests of the person concerned. It should be noted that the result of (any) assessment undoubtedly depends not only on the (personal) data used, but also on who or what carries out the assessment and how the individual factors (data) are weighted in each case. An assessment based on the same (personal) data may therefore not always lead to the same result. However, this does not change the fact that the result is based on the same (personal) data and thus the same information.
An "informational added value" of an assessment of labour market opportunities based on the same (personal) data, whether automated on the basis of profiling or not automated by (different) advisors cannot therefore be recognised from the perspective of data protection law. The case of an automated decision, which is separately regulated by Article 22 of the GDPR, is not given here, because the assessment of labour market opportunities is only to be carried out with the help of AMAS. The final decision on a jobseeker's chances of finding work and his or her further support remains with the counsellors, and not only were guidelines and instructions issued by the Public Employment Service to its employees, but training courses were also held.
The fact that the counsellors take over AMAS on a case-by-case basis and could violate the binding requirements of the AMS is not relevant for the assessment of the lawfulness of the data processing per se. Whether the Public Employment Service has sufficiently complied with its separate obligation under the GDPR to prevent unauthorised use of lawful data processing by taking appropriate measures is not the subject of the present proceedings, which are limited to the assessment of lawfulness. This would have to be assessed - if it is considered necessary - by the authority concerned in a separate procedure. Since the data processing in question could therefore rightly be based on section 25(1) AMSG, the contested decision had to be annulled because it did not violate the principle of lawful data processing laid down in Article 5(1)(a) of the GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Court
Federal Administrative Court
Decision date
18.12.2020
Business number
W256 2235360-1
Saying
W256 2235360-1/5E
IN THE NAME OF THE REPUBLIC!
The Federal Administrative Court, presided over by Caroline Kimm, Claudia
Rosenmayr-Klemenz, an expert lay judge, and Matthias Schachner, an expert lay judge,
heard the appeal of the Public Employment Service Austria, represented by Brauneis
Klauser Prändl Rechtsanwälte GmbH, 1010 Vienna, Bauernmarkt. Matthias Schachner
as associate judge on the appeal of the Public Employment Service Austria,
represented by Brauneis Klauser Prändl Rechtsanwälte GmbH, Bauernmarkt 2, 1010
Vienna, against the decision of the data protection authority of 16 August 2020, ref.
no. DSB-D213.1020, 2020-0.513.605:
A)The appeal is upheld pursuant to section 28 (1) and (2) VwGVG and the decision is
repealed without replacement.
B)The appeal is admissible pursuant to Art 133 para 4 B-VG.
Text
Reasons for decision:
I. Course of proceedings
By letter of 10. In its letter of 10 March 2020, the public authority concerned informed the Public Employment Service Austria ("AMS") that it was planning to calculate the labour market opportunities of jobseekers using a mathematical model: Labour Market Service) that it had taken its plan to calculate the labour market chances of job seekers using a mathematical model (known in the media as the "AMS algorithm") as an opportunity to initiate an official review procedure pursuant to Article 57 (1) (h) in conjunction with Article 58 (1) (b) and (2) (a) of the GDPR in conjunction with Section 22 (1) of the Data Protection Act and requested the Labour Market Service to answer the questions set out in more detail and to submit a statement.
The Public Employment Service complied with this request in a letter dated 11 August 2020, at the same time submitting various documents relating to the project in question, "Labour Market Opportunities Assistance System" (hereinafter: AMAS). Specifically, an excerpt from the Federal Guideline of the Public Employment Service "Supporting the core process of the labour force" and a manual on AMAS were submitted.
In the contested decision, the Public Employment Service was prohibited in paragraph I. "from processing data in connection with the determination of labour market opportunities of job-seekers with the help of the Labour Market Opportunities Assistance System ("AMAS") with effect from 1 January 2021, unless there is a suitable legal basis for the data processing by that date", and in paragraph II. the suspensive effect of a complaint that may have been filed in time and is admissible was excluded.
In justifying its decision, the authority essentially stated that the subject of the official proceedings it had initiated had been the permissibility of the aforementioned data processing pursuant to Art. 5 et seq. of the GDPR as well as the implementation of the associated obligations of a controller, and that the authority had carried out an investigation procedure in this regard. The subject of the contested decision was "now the question of whether the data processing of the data controller in connection with the determination of labour market opportunities of job-seekers with the help of the Labour Market Opportunities Assistance System ("AMAS") is carried out lawfully, i.e. whether the data processing complies with the principles pursuant to Art. 5 of the GDPR and at least one condition pursuant to Art. 6 (1) in conjunction with Art. 9 (2) of the GDPR is fulfilled. cit. is fulfilled. If unlawful data processing and thus a breach of the GDPR is to be assumed, the question finally arises as to which remedial powers under Art. 58(2) of the Regulation would come into consideration in order to remedy the breach".
The underlying facts were established on the basis of the undisputed statements of the Public Employment Service in its statement of 11 August 2020. According to the statement, the Public Employment Service had gradually introduced the present project since the end of 2018, which was intended to support the counsellors in assessing labour market opportunities and thus ensure a more efficient use of resources. Specifically, the probabilities of currently registered clients (job seekers) being employed for a certain number of days in the future within a certain period of time would be calculated. For this purpose, a so-called integration chance (IC) is calculated from certain characteristics. The IC is calculated by distinguishing between a short-term and a long-term labour market chance. If there is at least a 66% probability of achieving a short-term labour market opportunity, jobseekers have high labour market opportunities. If a jobseeker is calculated to have less than a 25% probability of taking up a job in the long term, then labour market opportunities would be low. Jobseekers with values in between would have medium labour market opportunities.
To calculate labour market opportunities based on this project, the following categories of jobseeker data would be processed, namely:
-age group
-sex
-Group of States
-Education
-Health impairments
-Caring duties
-professional group
-pre-career (to the extent of a maximum of four years before the onset of
unemployment)
-Regional labour market performance
-Duration of the business case.
The final decision on the labour market opportunity and thus the allocation of subsidies lies with the respective counsellor(s). In order to ensure that the result calculated by AMAS was not accepted unquestioningly by the counsellors, the Public Employment Service drew up guidelines and instructions for action and carried out training. The counsellors were informed by the Public Employment Service that AMAS was only one of several information bases. The counsellors also had to justify and document their final decision and both the result calculated by AMAS and the final result of the counsellors were made available to the jobseekers. The average counselling time for jobseekers for the first contact as well as the monthly follow-up contacts is about 30 minutes. In the eastern provinces in particular, however, the counselling time can be shortened to ten minutes.
Legally, the authority stated that the data processing with the help of AMAS was carried out within the framework of the public tasks assigned to the Public Employment Service pursuant to section 1(1) AMSG and not in the area of private economic administration. However, according to section 1(2) of the Data Protection Act, it was necessary for a public authority to base its data processing on a sufficiently defined legal authorisation. The Public Employment Service had based its authorisation on sections 25(1), 29 and 31(5) AMSG. "Although this is not disputed, it must be stated briefly that the implementation of labour market policy undoubtedly constitutes a public interest. The automated calculation of labour market opportunities with the help of new technologies and an efficient use of the resources available to the person responsible [could] in principle also be considered necessary within the meaning of Article 8(2) of the ECHR".
However, in addition to compliance with the respective legal reservations, it is necessary that the encroachment on the fundamental right to data protection only takes place on the basis of a sufficiently specific law. This is also clear from the case law of the ECtHR and the Constitutional Court on the legal situation before the GDPR. Recital 41, second sentence, of the GDPR also states that a corresponding legal basis must be "clear and precise" and "its application must be foreseeable for those subject to the law".
Sections 29 and 31(5) of the AMSG referred to by the Public Employment Service would only generally define the objective and the fulfilment of the tasks of the Public Employment Service, but would not authorise it to process data. However, the provision of section 25 AMSG would only list data categories which the Public Employment Service was allowed to process in the context of its tasks.
The data processing in question was profiling within the meaning of Article 4(4) of the GDPR. It is understandable for the average person subject to the law that the Public Employment Service has to process some of the data mentioned in Article 25(1) AMSG in order to be able to provide certain services, such as the processing of an application for the receipt of certain benefits from unemployment insurance, as was also the case before the introduction of AMAS. However, it was not comprehensible to the person subject to the law, solely on the basis of the provision of section 25(1) AMSG, that these data were "processed for the purpose of such intrusive profiling". By "fully automated processing of the categories of data listed in section 25(1) AMSG in the form of profiling", the Public Employment Service created an "informational added value", so that the law had to refer to the manner in which this added value came about. Therefore, the data processing in question could not be based on any suitable
legal basis - mentioned by the Public Employment Service - within the meaning of Article 1(2) of the Data Protection Act in conjunction with Articles 6(1)(c) and (e) and 9(2)(h) of the Data Protection Regulation, and - since the case at hand concerned a public authority - no other legal basis under Articles 6 and 9 of the Data Protection Regulation was apparent.
Apart from that, the legal bases mentioned were also not suitable because a case of Art 22 of the GDPR, namely an automated individual decision, existed anyway. It must be admitted that the final decision lies with the counsellors on the basis of internal guidelines of the Public Employment Service. However, these internal instructions to the counsellors had no "external effect" and thus no binding effect on the authority concerned. In this respect, the persons concerned could not refer to them in a legally
effective manner and thus could not demand a review. Furthermore, it could not be ruled out "for all individual cases that - despite the assurance of the person in charge - the counsellors would merely routinely adopt the results of the AMAS". The fact that the counselling time - as has been established – is sometimes only ten minutes, speaks for a routine adoption. Also, due to COVID-19, it can be assumed that the counsellors will increasingly rely on the decision of AMAS. Since genuine supervision by a human being was therefore "not bindingly ordered (in the sense of a legal guarantee) for all individual cases and thus also not completely guaranteed", Article 22 of the GDPR was to be applied with reference to the guidelines of the Article 29 Data Protection Working Party, according to which in cases in which
automatically calculated results are merely routinely taken over, an "automated decision" in the sense of Article 22 of the GDPR was to be assumed. In this respect, the requirements of Article 22(4) of the GDPR must be met and thus the existence of a legal basis within the meaning of Article 9(2)(a) or (g) of the GDPR must be given. It could not be denied that the data controller had taken appropriate measures within the organisation to protect jobseekers. However, it follows from Article 9(2)(g) of the
GDPR that such measures to protect the rights and freedoms of the data subjects must be guaranteed in the law itself. However, there is no legal provision that authorises the Public Employment Service to calculate labour market opportunities on the basis of profiling and that also provides for appropriate guarantees, which is why the Public Employment Service was not able to base the data processing in question on a suitable legal basis. In this respect, a prohibition pursuant to Article 58(2)(f) of the GDPR should be applied in point I, whereby it should be expressly noted that this prohibition refers exclusively to the current legal situation. If a qualified legal basis is created, it is open to the Public Employment Service to carry out such data processing. The exclusion of the suspensive effect in decision point II was necessary because considerable risks were to be expected with the nationwide introduction of AMAS in January 2021.
The present complaint is directed against this decision. Contrary to the assumption of the authority concerned, Article 22 of the GDPR only requires that a decision is based exclusively on an automated decision. Automated processing in support of a decision, on the other hand, is generally permissible and does not fall within the scope of Art 22 GDPR. Although the authority itself admitted in the present case that the final decision on labour market opportunities remained with the respective counsellors, it
nevertheless assumed the existence of a case under Article 22 of the GDPR. This was justified by the fact that the Labour Market Service guidelines - which had been updated under a previous submission - had "no external effect whatsoever" and could not be effectively invoked by the persons concerned. It should be noted, however, that section 4(3) AMSG provides that such guidelines are binding for all bodies and institutions of the Public Employment Service. The employees of the Public Employment Service were therefore obliged to comply with them. In assuming that a routine transfer could not be ruled out due to the limited counselling time, the Public Prosecutor's Office also departed from its own findings. In fact, the counsellors would make the final decision in the present case and were not only bound by the Federal Guidelines and internal instructions, but had also been trained in detail. For the case at hand, this showed that in the course of the automated processing with the help of the AMS algorithm, no decision was made that could have legal effect or affect the jobseeker in a similar way. The AMS algorithm only shows certain probabilities with regard to labour market opportunities. The actual funding decision, which is included in the support agreement and thus has legal effect, is made separately by the counsellors. The "real supervision" by a human being, as required by the authority, was therefore fulfilled in the present case. Therefore, in the present case, the requirement of an exclusively automated decision was already lacking, which is why Article 22 of the GDPR did not apply and, in this respect, paragraph 4 of this provision did not even need to be addressed.
Apart from that, contrary to the assumption of the prosecuting authority, there is no case of sovereign activity in the present case, but AMAS is used for activities of the Public Employment Service in the private sector. Therefore, the statements of the prosecuting authority with regard to the requirement of a legal basis according to Article 1(2) of the Data Protection Act were incorrect. Irrespective of this, the legislator had in any case created a sufficiently defined legal basis for such data processing in ¨ 25 AMSG. According to the authority, it was also undisputed that the implementation of labour market policy was in the public interest and that the automated calculation of labour market opportunities with the help of new technologies could also be considered necessary. However, insofar as the authority complained that section 25 AMSG was not sufficiently specified, it had to be countered that section 25 AMSG authorised the Public Employment Service to process the types of data mentioned therein, insofar as the processing of data was an essential prerequisite for the fulfilment of the Public Employment Service's statutory tasks. The legislative materials to the Data Protection Amendment Act 2018 state that the fulfilment of the numerous legally assigned tasks of the Public Employment Service necessarily requires a correspondingly extensive processing of types of data. Section 25 of the AMSG allows the Public Employment Service to process a wide range of data types. The scope depends on the specific tasks assigned to the Public Employment Service. Moreover, the view of the public authority that the specific processing activity must already be described in sufficient detail in the law is also not apparent from Article 6(1)(e) of the GDPR. The assessment of the job-seeker's chances on the labour market is an essential part of the service provided by the Public Employment Service and is also explicitly mentioned in ¨ 29 AMSG. Such an assessment had already been carried out by the
counsellors of the Public Employment Service for each individual case before the introduction of the AMS algorithm. With the help of the AMS algorithm, this process was now only to be standardised with the aim of depicting labour market opportunities as accurately as possible on the basis of statistical data and to be able to place and support workers in the best possible way. Insofar as the authority in question apparently wanted to infer from the separate mention of profiling in addition to the term "processing" that the legislature wanted to regulate the admissibility of profiling separately and demanded a specific legal basis for this, this was not convincing. Profiling is indisputably only a form of processing. Therefore, if section 25 of the AMSG authorises processing, this also includes profiling. The legislator only standardised stricter regulations for automated decision-making based on profiling in Article 22 of the GDPR. In the present case, however, this did not take place, which is why the general provisions of Articles 6 and 9 of the GDPR would suffice for such "simple" profiling. As already explained, the Public Employment Service had always carried out assessments of job opportunities. Why this assessment should be "more intrusive" and create an "informational added value" through the use of profiling is not apparent. It was expressly requested that an oral hearing be held, because in the
present case - unless it was annulled - questions of fact and also questions of law had to be assessed, the resolution of which required an oral hearing. The authority concerned submitted the complaint together with the administrative act to the Federal Administrative Court and filed a counter-submission.
II. the Federal Administrative Court considered:
1. findings:
According to section 1(1) AMSG, the Public Employment Service is a service provider under public law with its own legal personality, which is responsible for implementing the labour market policy of the federal government. In order to support workers in their (re-)integration into the labour market, the Public Employment Service offers various services which are (supposed to be) implemented by its counsellors. The more detailed procedure of the counsellors in this regard was laid down in the Federal Guideline of the Public Employment Service "Core Process Supporting Workers" (currently "Core Process Supporting Workers with Regulations on Physical Distancing" of 13 July 2020, GZ XXXX ).
It states, among other things, that counsellors have to discuss the client's wishes/expectations, their previous life history and the reasons for their unemployment in the course of a counselling interview. The jobseeker's chances on the labour market should also be addressed and discussed. In order to support counsellors in assessing the labour market opportunities of jobseekers, the Public Employment Service has developed a concept for calculating the labour market opportunities of jobseekers (AMAS) since 2016. This model is already being used by counsellors of the Public Employment Service. From 1.1.2021 it is to be used on a mandatory basis.
In concrete terms, AMAS uses an algorithm (AMAS algorithm) to automatically calculate the probability of currently registered customers being employed for a certain number of days within a certain period in the future. For this purpose, a socalled IC is calculated from the following data:
-age group
-sex
-Group of States
-Education
-Health impairment
-Caring duties
-professional group
-pre-career
-Regional labour market performance
-Duration of the business case at the AMS
Based on the calculated IC, a classification is made into the following groups:
Service clients with high labour market opportunities
-care clients with low labour market opportunities Counselling clients with medium labour market opportunities
The results of the AMAS should be used in the guidance process and be a starting point for the guidance counsellors to determine, together with the client, an assessment of the potentials and, if applicable, the obstacles to labour market integration. Based on this discussion, the optimal support strategy (subsidies and support services) is to be defined. If the client has a decidedly different assessment of the labour market opportunities than the counsellor, this must be documented in the counselling agreement. The final decision on the assignment to a client group is always made by the counsellors.
The guideline mentions criteria that cannot be taken into account by AMAS, such as motivation and self-help potential of the client, addiction, debts, housing situation, etc., as decisive for a change of AMAS results on the part of the counsellor. Only after a discussion with the client has taken place should the counsellor define the optimal support strategy (subsidies and support services) on the basis of a support agreement.
In order to ensure that the counsellors do not adopt AMAS unquestioningly, the Public Employment Service has not only issued the guidelines described above, but has also provided corresponding instructions and conducted training courses.
2. assessment of evidence:
These findings result from the findings in the contested decision made by the authority - on the basis of the information and submissions made by the Public Employment Service in the proceedings. The Federal Administrative Court has no doubts as to the correctness of these findings and, moreover, this was not claimed by any of the parties.
3. legal assessment:
to the present scope of testing:
According to the case law of the Administrative Court, the "matter" of the appeal proceedings is limited by the matter of the administrative proceedings, i.e. the matter that formed the subject matter of the administrative proceedings and the final decision (cf. inter alia VwGH 28.8.2017, Ra 2016/03/0078 mwH). In this respect, the "matter" of the appeal proceedings before the Administrative Court can only be the matter that comprised the content of the decision contested before the Administrative Court (cf. VwGH 9.9.2015, Ro 2015/03/0032 mvwH).
In this context, the administrative court, if it decides on the merits, must not only settle the complaint filed against the administrative decision, but also the matter that was to be decided by the administrative authority (cf. e.g. VwGH 12.9.2018, Ra 2015/08/0032 mvwN).
In the case at hand, the authority initiated an ex officio investigation into the "project [...] to calculate labour market opportunities using a mathematical model [...]". Pursuant to Art 57(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 2016/119, 1 ("GDPR"), it is also, inter alia, the task of the public authority concerned to monitor and enforce the application and enforcement of this Regulation within its territory. To this end, it must not only deal with complaints by data subjects (under Art 77 GDPR) (Art 57(1)(f) GDPR), but also conduct investigations into the application of this Regulation and thus intervene ex officio to ensure compliance with the GDPR (Art 57(1)(h) GDPR; cf. Selmayr in Ehmann/Selmayr, DS-GVO2, Art 57 Rz 6 ff). Article 58 (1) of the GDPR grants the authority subject to a complaint various investigative powers for the necessary clarification of facts relevant to data protection law, which, according to lit b, includes the conduct of data protection reviews. If, in the course of proceedings, the authority concerned discovers (intended) data processing contrary to the GDPR, Art 58(2) GDPR grants it comprehensive remedial powers, which, according to lit f, also include the possibility (in this case) of imposing a ban on processing.
In contrast to a complaint procedure under Art 77 GDPR, which is based on an application and thus in any case aimed at a decision, the authority concerned in an official review procedure only has the power to make a decision (by way of a decision) to the extent that it has determined an (intended) processing contrary to the GDPR in the course of a review (see Nemitz in Ehmann/Selmayr, DS-GVOÇ, Art 77 Rz 18, according to which the supervisory authority in a complaint procedure pursuant to Art 77 GDPR is not only responsible for determining the lawfulness or unlawfulness of the data processing, but also has the remedial powers pursuant to Art 58 (2) GDPR at its disposal.).
The subject matter of a final decision issued in an official procedure can therefore only be the violation determined in the course of an examination procedure and its (ordered) remedial measure and - based on the above case law - the scope of examination of the administrative court must accordingly also be limited to this (cf. in contrast VwGH 1.7.2020, Ro 2017/06/0030 on the application-based procedure,
according to which the duty of review of the administrative court in the case of a construction project is comprehensive and not limited to the non-existence of the grounds for prohibition invoked by the authority). This can also be explained by the fact that the requirements imposed on the data controller in the GDPR are not only manifold, but are also to be assessed separately from each other and their infringement can also result in different remedial powers pursuant to Art 58 (2) GDPR (see Art 83 GDPR, which in its (3) and (4) summarises the possible infringements in connection with data processing; see also Art 83(3) GDPR, which, in the case of the remedy of imposing a fine [and here too only] in relation to the amount of the penalty as standardised in Art 58(2)(i) GDPR, provides as a special
case for a uniform approach in the case of several infringements [based on the same or interconnected processing operations]; on Art 83(3) GDPR, see also BVwG 12.3.2020, W256 2223922-1).
In the case of several breaches of the GDPR identified in the course of a data review, the authority concerned would therefore not only have to assess them separately on its own, but would sometimes also have to take action on the basis of different remedial measures pursuant to Art 58(2) GDPR. However, such a (first-time) assessment of data protection violations that are detached from each other and their remedy cannot under any circumstances be covered by the cognition power of the administrative court (described above) within the framework of an administrative review procedure (see also VwGH 28.1.2020, Ra 2019/03/0076, according to which the review power of the administrative courts is further limited in cases of severability of the administrative decision if only one part of several severable claims is contested in the appeal).
In the specific case, the authority in question, by means of the contested decision, prohibited the Public Employment Service from processing data in connection with the determination of labour market opportunities of job-seekers with the help of "AMAS" with effect from 1 January 2021, unless there is a suitable legal basis for the data processing by that date.
In its reasoning, it stated that after the review of the admissibility of data processing pursuant to Art 5 et seq. of the GDPR and the implementation of the related obligations of the Public Employment Service, the subject of the decision was "now" (only) the lawfulness of the data processing in question, which the Public Employment Service lacked due to the lack of a suitable legal basis. In its reasoning, the authority also expressly stated that if a "qualified legal basis" existed, it would be open to the Public Employment Service to carry out the data processing in question.
In view of this wording, it is to be assumed - as the ruling already makes found the data processing under examination in the course of its investigation to be inadmissible exclusively due to a lack of a "qualified" legal basis and in this respect only issued the contested decision for this reason Against the background of the above considerations, the court hearing the case is therefore precluded from carrying out a review of the data processing that goes beyond the lawfulness assessed in the contested decision.
On legality Article 5 of the GDPR sets out the principles for (lawful) processing of personal data. According to paragraph 1 lit a, personal data must be processed in a lawful manner, whereby the necessary conditions for lawful processing are explicitly stated in Art 6 of the GDPR or, in the case of the processing of special categories of data, in Art 9 of the GDPR.
The relevant provisions here are in part as follows:
"Article 6
Lawfulness of processing
(1) conditions is met;
[...]
(e) processing is necessary for the performance of a task carried out in the public
interest or in the exercise of official authority vested in the controller;
[...]
Member States may maintain or introduce more specific provisions to adapt
the application of the provisions of this Regulation in relation to processing to comply
with points (c) and (e) of paragraph 1 by specifying more precisely specific
requirements for processing and other measures to ensure lawful and fair processing,
including for other specific processing situations referred to in Chapter IX.
3. The legal basis for the processing operations referred to in points (c) and (e) of
paragraph 1 shall be determined by
[…]
(b) the law of the Member States to which the controller is subject.
The purpose of the processing must be specified in that legal basis or, as regards the
processing referred to in point (e) of paragraph 1, must be necessary for the
performance of a task carried out in the public interest or in the exercise of official
authority vested in the controller. […]
Article 9
Processing of special categories of personal data
(1)The processing [... of ...] health data [...] is prohibited.
(2) Paragraph (1) shall not apply in the following cases:
[…]
(g) processing is necessary for reasons of substantial public interest on the basis of the
law of a Member State which is proportionate to the aim pursued, respects the
essence of the right to data protection and provides for adequate and specific
measures to safeguard the fundamental rights and interests of the data subject;
(h) the processing is necessary for healthcare or occupational health purposes, for the
assessment of the employee's fitness for work, for medical diagnosis, healthcare or
social care or treatment, or for the management of healthcare or social care systems
and services on the basis of Union law or the law of a Member State or on the basis of
a contract with a healthcare professional and subject to the conditions and safeguards
referred to in paragraph 3;
[…]“
First of all, it should be noted that Article 9(2)(h) of the GDPR, according to its wording, applies exclusively to data processing for health-related purposes and thus – contrary to the view of the Public Employment Service and also of the authority against which the complaint was lodged - cannot be used without further ado for a calculation of labour market opportunities such as in the present case (cf. also explicitly recital 53 on which this provision is based, which only refers to the processing of special categories of personal data for health-related purposes; see also Frenzel in Paal/Pauly, DSGVO/ BDSGÇ, Art 9 DS-GVO margin 41 and Schiff in Ehmann/Selmayr, DS-GVOÇ, Art 9 margin 59).
However, it follows from Art 6(1)(e) and Art 9(2)(g) GDPR that the processing of personal data may also be lawful under the GDPR if the processing is necessary for the controller on the basis of the law of its Member State, on the one hand, for a sovereign task or another task in the public interest and, on the other hand, in the case of the processing of special categories of personal data generally on the basis of a substantial public interest.
According to the provisions of the GDPR, it is completely irrelevant whether the controller is a public authority or a private body and in which form (sovereign or private) the controller operates. Rather, the only decisive factor is that the controller carries out data processing that is necessary for a matter in the (substantial) public interest and is also regulated by law (see explicitly Art 55 (2) GDPR; cf. also Frenzel in Paal/Pauly, DS-GVO/BDSGÇ, Art 6 DSGVO Rz 23 as well as Art 9 DS-GVO Rz 38 ff; Heberlein in Ehmann/Selmayr, DS-GVOÇ, Art 6 Rz 21 as well as Schiff in Ehmann/Selmayr, DSG-VO2, Art 9 Rz 51 ff as well as Recital 45).
Article 6(3) of the GDPR sets out the substantive (mandatory and optional) requirements for a corresponding legal basis, whereby, according to Recital 41 of the GDPR, such a legal basis should in any case be clear and precise and foreseeable for those subject to the law. In the case of the processing of special categories of personal data, Art 9(2)(g) GDPR additionally stipulates that this legal basis should, inter alia, provide for appropriate and specific measures to safeguard the fundamental rights and
interests of the data subject (see in particular Art 24, 25 and 32 GDPR on the appropriate - technical and organisational - measures to be implemented by the controller to safeguard the principles of the GDPR and the rights of the data subjects).
The national provision of Section 1(2) of the Data Protection Act BGBl I 1999/165 as amended by BGBl I 2019/14 (hereinafter: DSG) - which regulates the encroachment on the fundamental right to data protection, albeit only for data processing by state authorities - does not provide otherwise, as the authority in question decisively referred to the case-law of the highest courts on the legal situation prior to the GDPR.
However, since the directly and primarily applicable provisions of EU law require a sufficiently defined legal basis for the lawfulness of data processing for a task in the (substantial) public interest - as explained - in general and not only limited to the sovereign sphere of activity, it can therefore be left open in the present case – contrary to the view of the authority in question - whether the Public Employment Service carries out the data processing in question in a sovereign or private law form (cf. on Section 1 of the Data Protection Act Dopplinger in Bresich/Dopplinger/Dörnhofer/Kunnert/Riedl, DSG ¨ 1 [Status 12.6.2018, rdb.at] para 10, according to which, due to the primacy of directly applicable Union law, the fundamental right cannot prevent data processing that is lawful under the GDPR; see on the limited possibility of specification granted to the Member States in Art 6(2) GDPR within the framework of the Regulation Heberlein in Ehmann/Selmayr, DS-GVOÇ, Art 6 para 6 and 35 et seq; see on the official and non-official scope of activities of the Public Employment Service ¨¨ 24, 31 para 2, 58 and 59 Labour Market Service Act BGBl 1994/313 as amended by BGBl I 2020/71 [hereinafter: AMSG]).
Rather - since the data processing in question also includes health data and thus special categories of data - it is solely a matter of whether the data processing based on a corresponding legal basis is necessary for a matter of the Public Employment Service in the substantial public interest.
According to section 1(1) AMSG, the Public Employment Service is a service provider under public law with its own legal personality, which is responsible for implementing the labour market policy of the federal government. Pursuant to section 29(1) AMSG, it must, among other things, work towards the most complete, economically sensible and sustainable matching of labour supply and demand in the sense of an active labour market policy, thereby ensuring the supply of labour to the economy and the employment of all persons available on the Austrian labour market in the best possible way.
According to paragraph 2 of this provision, the services to be provided by the Public Employment Service are accordingly aimed, inter alia, at efficiently bringing about the placement of suitable workers in jobs that offer employment that corresponds as far as possible to the jobseeker's placement wishes (subparagraph 1) as well as helping to overcome the effects of circumstances that hinder direct placement within the meaning of subparagraph 1 (subparagraph 2). Pursuant to section 31(5) AMSG, in all its activities the Public Employment Service shall take into account the principles of economy, efficiency and expediency with a view to achieving the objective specified in section 29 in the best possible way. Pursuant to section 7 of this provision, when planning measures it must also ensure that suitable support services are offered to groups of persons who are particularly threatened by unemployment. In the case at hand, the counsellors of the Public Employment Service - as has been
established - assess the labour market opportunities of the person seeking employment for the purpose of efficient support in job placement, among other things, on the basis of data available to the Public Employment Service on this person, such as gender, country group, education, health impairment, care obligations, occupational group, previous career and duration of the business case, and this is to be done from 1 January 2021 with the mandatory use of the automated data application
"AMAS" in question. Section 25(2) AMSG also explicitly authorises the Public Employment Service to process such personal data, but only to the extent that it is essential for the fulfilment of the Public Employment Service's statutory tasks.
With regard to Article 9(2)(g) of the GDPR and the requirement of a substantial public interest set out therein, it must first be noted that a substantial public interest can undoubtedly be seen in the task assigned to the Public Employment Service by law in Section 29 of the AMSG, namely to guarantee a labour market that is as orderly and well-functioning as possible.
However, in order to achieve this (imposed) goal of an optimal supply of labour to the economy and to secure the employment of all persons in the best possible way, it is undisputedly (also) necessary to take into account the personal characteristics of jobseekers in combination with the general labour market situation and thus - as in the present case - the possibilities of employment of jobseekers on the labour market and their need for support in individual cases. The fact that the personal data of jobseekers
used by the Public Employment Service and described above can be relevant for their job search and thus for the assessment of their labour market opportunities and subsequently also their possible need for support in the respective case constellation cannot be denied and, moreover, this was not taken up by the authority concerned in any way (cf. also the explanations on the government bill on the data protection amendment [in view of the entry into force of the General Data Protection Regulation
on 25 May 2018]). May 2018] Data Protection Amendment Act 2018, RV 65 BlGNR 26.GP 28 on ¨ 25 AMSG, where it is also clarified that for the core tasks of the Public Employment Service, master data of jobseekers must always be processed and this also includes the respective knowledge and skills of the jobseekers as well as the requirements profile of vacancies).
Therefore, in the present case there are no concerns at all that the Public Employment Service has to assess, among other things, the job opportunities of job seekers in order to ensure a proper labour market policy and that it may also use the above-mentioned personal data according to section 25 (1) AMSG for this purpose. There are no indications that such data processing is not sufficiently clear in ¨ 25 AMSG and is not otherwise regulated by means of adequate and specific measures to protect the fundamental rights and interests of the person concerned. Section 25 (10) explicitly states that the Public Employment Service shall take sufficient precautions to ensure data security within the meaning of Art. 24, 25 and 32 of the GDPR and Section 6 of the GDPR, taking into account economic feasibility and the state of the art. 24, 25 and 32 of the GDPR and Section 6 of the GDPR, and thus to take comprehensive and appropriate technical and organisational measures to ensure processing in compliance with the principles of the Regulation (see recital 78 relevant to Articles 24, 25 and 32, according to which such measures could consist, inter alia, in minimising the processing of personal data, pseudonymising personal data as soon as possible, providing transparency as to the functions and processing of personal data, enabling the data subject to monitor the processing of personal data and enabling the controller to establish and improve security features.
Section 25(10) AMSG also formulates additional specific requirements with regard to ensuring data security ("[...] In particular, the collection or modification of personal data is only permitted by the respective competent organisational units (employees).
When transmitting personal data to third parties, technical or organisational measures must be taken to ensure that only the intended recipients gain access to the data. Access as well as reading rights shall be designed according to the tasks (roles) of the respective organisational units and staff members. Access to personal data as well as every transmission of health data must be logged. Log data may not be used in relation to persons unless this is necessary to enforce or defend against legally asserted claims, to ensure the lawful use of data processing or for technical reasons"; see again the explanations on the government bill on the Data Protection Amendment Act, RV 65 BlGNR 26.GP 28 on ¨ 25 AMSG, according to which ¨ 25 AMSG is to be supplemented by, among other things, provisions on data security measures and adapted to the terminology of the GDPR in view of the entry into force of the GDPR).
The fact that the Public Employment Service is in principle entitled under section 25(1) AMSG to carry out an assessment of jobseekers' labour market opportunities on the basis of (specific) personal data is not even called into question by the authority concerned. Rather, it is of the opinion that such an assessment in the special automated form of profiling creates an "informational added value" and that the legal basis should explicitly refer to such "intrusive profiling". In addition, in the view of the authority, this is a case of "fully automated" decision-making, which is why such data processing must also comply with the requirements of Article 22 of the GDPR.
The relevant provisions of the GDPR are excerpted as follows:
"Article 4
Definitions
For the purposes of this Regulation, the term:
[…]
(2) 'processing' means any operation or set of operations which is performed upon
personal data, whether or not by automatic means, such as collection, recording,
organisation, filing, storage, adaptation or alteration, retrieval, consultation, use,
disclosure by transmission, dissemination or otherwise making available, alignment or
combination, restriction, erasure, destruction;
[...]
(4) 'profiling' means any automated processing of personal data which consists in using
such personal data to evaluate certain personal aspects relating to a natural person, in
particular to analyse or predict aspects relating to that natural person's performance
at work, economic situation, health, personal preferences, interests, reliability,
behaviour, location or change of location;
[…]
Article 22
Automated decisions in individual cases including profiling
1. The data subject shall have the right not to be subject to a decision based solely on
automated processing, including profiling, which produces legal effects concerning him
or her or similarly significantly affects him or her.
(2) Paragraph (1) shall not apply if the decision is
[...]
(b) is authorised by Union or Member State legislation to which the controller is
subject and that legislation contains appropriate measures to safeguard the rights and
freedoms and legitimate interests of the data subject; or
[…]
Decisions under paragraph 2 shall not be based on special categories of personal data
referred to in Article 9(1), unless Article 9(2)(a) or (g) applies and appropriate
measures have been taken to protect the rights and freedoms and legitimate interests
of the data subject."
It should be noted that the result of (any) assessment undoubtedly depends not only on the (personal) data used, but also on who or what carries out the assessment and how the individual factors (data) are weighted in each case. An assessment based on the same (personal) data may therefore not always lead to the same result. However, this does not change the fact that the result is based on the same (personal) data and thus the same information.
An "informational added value" of an assessment of labour market opportunities based on the same (personal) data, whether automated on the basis of profiling or not automated by (different) advisors, as assumed by the authority concerned, cannot therefore be recognised from the perspective of data protection law - which is the only one to be assessed here.
Apart from that, Art 6(1)(e) and Art 9(2)(g) of the GDPR do not distinguish between automated and non-automated processing, but - as in Section 25(1) of the AMSG – only refer to the term "processing" in general.
However, Article 4(1) of the GDPR defines any operation or set of operations which is performed upon personal data, whether or not by automatic means, as a processing operation. A different assessment of the lawfulness of data processing under Art 6(1)(e) and Art 9(2)(g) of the GDPR solely because of the form of its processing can therefore - contrary to the view of the authority complained against - also not be derived from the law.
This does not overlook the fact that Art 4(4) GDPR separately refers to the exclusively automated processing of personal data of a data subject for the purpose of evaluating, analysing or predicting certain personal aspects of that data subject as profiling. However, this merely highlights the use case of automated "profiling", which is becoming increasingly important in practice for various areas, and is also intended to clarify that this (special) form of automated processing carried out for a specific purpose falls within the scope of application of the GDPR and must therefore also comply with the general criteria set out therein (see explicitly recital 72 and the broad geographical scope of application of Art. 3(2)(b) GDPR created specifically for this purpose).
In addition to the general requirements for (lawful) data processing outlined above, Article 22 of the GDPR (formulated as a data subject right) sets out additional requirements for automated decisions.
Specifically, paragraph 1 of this provision establishes a general prohibition of a decision based solely on automated processing. Recital 71 of the GDPR states that the data subject should have the right not to be subject to a decision evaluating personal aspects relating to him or her which is based solely on automated processing and which produces legal effects concerning him or her or significantly affects him or her in a similar way to the automatic rejection of an online credit application or online recruitment procedure without any human intervention.
Article 22 of the GDPR is therefore only aimed at decisions that are made without any human intervention, and this provision is intended to limit the risks to personal privacy posed by unchecked automated processing operations (see Martini in Paal/Pauly, DSGVO/ BDSGÇ, Art 22 DS-GVO Rz 2 and 20).
However, Article 22 of the GDPR does not limit the legal admissibility of profiling as such as a way to support decision-making (see Martini in Paal/Pauly, DS-GVO/BDSG2,
Art 22 DS-GVO Rz 2).As the investigation carried out by the prosecuting authority has shown and also
established (by the prosecuting authority itself), the job opportunities of a jobseeker calculated by AMAS on the basis of an algorithm are to be used by the counsellors of the Public Employment Service as of 1 January 2021, but only as a source of information for a decision. However, the final decision on a jobseeker's chances of finding work and his or her further support should remain with the counsellors, and not only were guidelines and instructions issued by the Public Employment Service to its employees, but training courses were also held.
The view of the authority concerned that the "guidelines" presented do not have any "external effect" cannot be followed - as already pointed out by the Public Employment Service with reference to section 4 AMSG. Pursuant to section 4(2)(2) AMSG, the federal organisation (note: the Public Employment Service; see section 1(3) AMSG) is responsible for drawing up and defining labour market policy guidelines and priorities for the activities of the Public Employment Service by means of generally binding regulations. Para 3 of this provision explicitly states that the guidelines issued by the federal organisation after consultation with the provincial organisations for the fulfilment of the tasks of the Public Employment Service are binding for all bodies and institutions of the Public Employment Service.
In the case at hand, the Public Employment Service - as stated - has specified the exact procedure with regard to the assessment of labour market opportunities, among other things, in its federal guideline "Core process to support workers" (currently "Core process to support workers with regulations on physical distancing" of 13 July 2020, GZ XXXX ) (among other things 7.2.2.). It is explicitly stipulated that the counsellors have to discuss the job opportunity value calculated automatically using AMAS with the clients during a counselling interview, document any contrary opinion of the client and ultimately decide on it themselves.
In view of these clear requirements - which are also binding on the respective institutions of the Public Employment Service pursuant to Article 4(3) AMSG - there are no reasons whatsoever on the part of the Discerning Senate to assume a (completely) automated decision within the meaning of Article 22(1) of the GDPR in the present case.
In the present case, however, the authority does not deny that - as it itself states in the decision - the data processing in question in connection with the determination of the labour market opportunities of job-seekers is to be carried out by the counsellors only "with the help" of AMAS and thus not exclusively with the help of automation.
However, in view of shortened counselling times, it could not be ruled out "in individual cases" that the counsellors would routinely use AMAS and that, in the end, a completely automated decision would be made in individual cases.
However, the authority concerned overlooks the fact that the assessment of whether data processing is lawful per se pursuant to Art 5(1)(a) of the GDPR must be distinguished from the assessment of whether the controller also ensures the lawfulness of such data processing through organisational measures pursuant to Art 5(1)(f) of the GDPR.
When assessing the lawfulness of data processing, the actual processing operation must be considered and not any possible infringements of it by third parties. Whether the Public Employment Service ultimately fulfilled its obligation under Art 5(1)(f) of the GDPR sufficiently in the present case and thus suitably excludes unauthorised use of the (planned) data processing cannot, however, be assessed by the Administrative Court - as outlined above - within the framework of the complaint procedure limited to the assessment of the lawfulness of the data processing in question under Art 5(1)(a) of the GDPR, but would rather have to be clarified - if it is considered necessary - by the authority concerned in (further) proceedings.
For the sake of order, it is merely noted that the authority itself assumes in its statement of reasons in the contested decision that the Public Employment Service has taken appropriate measures "within the organisation" to protect jobseekers and has thus appropriately ruled out any misuse of data processing by its employees.
The contested decision's assertion that data subjects could not "verify" compliance with the Directive and thus lawful processing in individual cases cannot be understood with regard to the right of appeal granted to data subjects in Article 77 of the GDPR. Since in the present case, according to the findings of the authority concerned, there is no (fully) automated decision on labour market opportunities within the meaning of Article 22(1) of the GDPR, it is not necessary to go into the additional requirements for such a decision, in particular in paragraph 4, which are also described in more detail in the guidelines of the Article 29 Data Protection Working Party referred to by the authority concerned.
In conclusion, it must therefore be stated that - as was not disputed by the authority itself - the Public Employment Service is in principle entitled under section 25(1) AMSG to assess the labour market opportunities of jobseekers on the basis of (certain) personal data. The assumption of the authority concerned that such an assessment would receive an "informational added value" from a data protection perspective due to the mere use of automated processing ("profiling") cannot be accepted and a different assessment of the lawfulness of data processing solely due to the form of its processing (automated or non-automated) is not provided for in the law.
The case of an automated decision, which is separately regulated by the law in Art. 22 of the GDPR, is not given here, because - as was stated by the authority itself – the assessment of labour market opportunities under consideration is only to be carried out with the help of AMAS, but ultimately by the counsellor(s). The fact that the counsellors - as assumed by the prosecuting authority – nevertheless only routinely take over AMAS in individual cases and could thus violate the binding requirements of the Public Employment Service is not relevant for the assessment of the lawfulness of the data processing per se. Whether the Public Employment Service has sufficiently complied with its separate obligation under the GDPR to prevent unauthorised use of lawful data processing by taking appropriate measures is not the subject of the present proceedings, which are limited to the assessment of lawfulness.This would have to be assessed - if it is considered necessary - by the authority concerned in a separate procedure.
Since the data processing in question could therefore rightly be based on section 25(1) AMSG, the contested decision had to be annulled because it did not violate the principle of lawful data processing laid down in Art 5(1)(a) of the GDPR.
on the omission of an oral hearing:
An oral hearing could be omitted in the present case pursuant to ¨ 24 para 2 subpara 1 VwGVG, because it was already established on the basis of the files that the contested decision had to be "repealed" (cf. on the similar earlier legal situation Hengstschläger/Leeb, AVG ¨ 67d [as of 1.7.2007, rdb.at] margin note 22, according to which "repeal" means the complete elimination, i.e. in any case the repeal without replacement of the contested decision).
B) Admissibility of the appeal:
Pursuant to ¨ 25a para 1 VwGG, the administrative court shall state in the ruling of its decision or order whether the appeal is admissible pursuant to Art 133 para 4 B-VG.
The decision shall be briefly substantiated.
The appeal is admissible pursuant to Art 133 (4) because the decision depends on the resolution of a legal question of fundamental importance. On the one hand, there is a lack of case law of the highest courts on the question of the power of cognition of the administrative courts in the case of proceedings before the courts, and on the other hand, there is a lack of case law of the highest courts on Article 6(1)(e) of the GDPR, Article 9(2)(g) of the GDPR and Article 22 of the GDPR in connection with profiling.
It was therefore to be decided by the senate in accordance with the ruling.
European Case Law Identifier
ECLI:AT:BVWG:2020:W256.2235360.1.00
