OGH - 4Ob84/19k
From GDPRhub
| OGH - 4Ob84/19k | |
|---|---|
 | |
| Court: | OGH (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 6(1)(f) GDPR Article 14 GDPR Article 80(2) GDPR § 1 UWG (Austria) § 28 DSG (Austria) |
| Decided: | 26.11.2019 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 4Ob84/19k |
| European Case Law Identifier: | ECLI:AT:OGH0002:2019:0040OB00084.19K.1126.000 |
| Appeal from: | OLG Wien (Austria) GZ 133 R 31/19k-17 |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (RIS) (in German) |
| Initial Contributor: | Kari |
Austrian supreme court finds that actions by associations and other bodies can be brought exclusively in front of DPA, requiring explicit mandate, and privacy law breaches be unsuitable element for substantial competition law claim.
English Summary
Facts
A business added names and other personal information from a list of Austrian registered psychotherapists, which had been publicly available on a federal ministry‘s website, to their own register of psychotherapists and psychotherapists in training with supervision. The commercial website offered paid features for listees including prioritisation in search results and the possibility to add further information such as links and pictures.
Action was brought by an association of Austrian psychotherapists in order to stop the publishing of listee's names without consent or, alternatively, stop providing a perceived competitive advantage to paying listees. The featuring of entries was seen as misleading since it was not clearly indicated that those were part of a paid advertising package.
Dispute
Can the defendant rely on Article 6 (1) (f) GDPR/legitimate interest as a basis for the processing and were appropriate information requirements according to Article 14 GDPR met?
Can the defendant’s activities be challenged under competition law?
Holding
The Austrian supreme court (Oberster Gerichtshof der Republik Österreich - OGH) refers to § 28 of the Austrian data protection act (Datenschutzgesetz - DSG) and concludes that this exclusively grant rights for group actions by associations and other bodies in front of the national data protection authority, but not in front of courts. In addition, it finds, was the association not explicitly legitimised by its individual members to bring such action for them, nor had it claimed to be doing so.
It supports this by reference to Article 80 (2) GDPR which require an explicit provision from the national legislator for action brought by an organisation without explicit commission from the data subject.
Hence, due to a lack of active legitimation to bring the action, it does not review the applicability of Article 6 (1) (f) and 14 GDPR.
Regarding privacy related claims based on competition law, the supreme court raises the question of general admissibility (Zulässigkeit). It does not decide on the question, instead negatively answers the question of substantial suitability of privacy rights to constitute a breach of law leading to an application of §1 of the Austrian competition act (Bundesgesetz gegen den unlauteren Wettbewerb - UWG) and hence denies the claim.
Comment
In the appealed decision, the High Regional Court Vienna (Oberlandesgericht Wien - OLG Wien) had held that the defendant could rely on Article 6 (1) (f) GDPR. According to OLG Wien, the business’s legitimate interest was not outweighed by the data subjects’ rights since a public’s need to be informed via the (amongst other things with mobile device compatibility) enhanced list had in addition to be taken into account.
Furthermore, it considered all information requirements according to Article 14 GDPR as met, but pointed out that even if this had not been the case the data processing would still have been legitimate.
The plaintiff's appeal to the supreme court primarily challenged this assessment in relation to Article 6 (1) (f) and 14 GDPR. (The appeal was accepted by the OGH with reference to an unanswered question regarding the relationship between privacy rights and competition law and its effects.)
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Reference Jung/Schwab, MR 2020,44 = MR 2020,47 = ZIIR 2020,203 = wbl 2020,233/76 - wbl 2020/76 = VbR 2020/42 S 72 - VbR 2020,72 = jusIT 2020/44 S 122 (Thiele) - jusIT 2020,122 (Thiele) = ÖBl 2020/49 S 164 (Tonninger) - ÖBl 2020,164 (Tonninger) - Psychotherapist - Physiotherapist list - Psychotherapist directory Business figures 4Ob84/19k Decision date 26.11.2019 Head The Supreme Court of Justice, through the President of the Senate, Dr. Vogel as chairman and the court councillors Dr. Schwarzenbacher, Hon. Prof. Dr. Brenn, Priv.-Doz. Dr. Rassi and MMag. Matzka as further judges in the case of the plaintiff Österreichischer Bundesverband *****, represented by Jank Weiler Operenyi Rechtsanwälte GmbH in Vienna, against the defendants 1. t***** GmbH, *****, 2. Mag. G***** D*****, both represented by Graf & Pitkowitz Rechtsanwälte GmbH in Vienna, for failure to act (amount in dispute in the provisional proceedings 34. 000 EUR), on the extraordinary appeal of the plaintiff against the order of the Higher Regional Court Vienna as appellate court of 4 April 2019, GZ 133 R 31/19k-17, confirming the order of the Commercial Court Vienna of 13 February 2019, GZ 54 Cg 1/19d-13, to dismiss the appeal in a closed session. Decision caught: Saying The extraordinary revision course is not followed. The plaintiff is obliged to reimburse the defendants for the costs of the appeal appeal proceedings, determined at EUR 2,330.81 (including EUR 388.47 VAT), within 14 days. Text Justification: The plaintiff association is the lobby of Austrian psychotherapists and has about 4,000 members. The second defendant is a psychotherapist in training under supervision as well as managing director of the first defendant and holds a 50% share in it. The Federal Ministry of Labour, Social Affairs, Health and Consumer Protection (BMASGK) publishes a list of psychotherapists registered in Austria (currently about 9,500 persons). This list contains in pure text form the first name and surname, gender, additional designation, professional domicile and/or place of work (postal address, telephone number, e-mail address) of the persons recorded. The list is non-responsive (i.e. not optimized for use on mobile devices) and does not contain any information on additional training courses, main areas of work, health insurance settlement and available places. This list is publicly available and can also be accessed on the Internet. The first defendant operates a service and information portal on the Internet. For this online directory of psychotherapists and psychotherapists in training under supervision based in Austria, she took the data from the BMASGK's list without first obtaining the consent of the persons contained therein. The platform of the first defendants is optimised for mobile devices (responsive display) and contains a search function with only one form field and a detailed search with further filters. With regard to the design and content of the entries on the individual therapists, the platform of the first defendants offers a free version on the one hand, and on the other hand (in the event that the name bearer orders the corresponding name bearer) also three (different in scope and placement) extended and fee-based packages (Basic, Top, Premium). The additional services offered with the fee-based booking of extended packages include, among other things, ranking and highlighting in the search results (without marking the fee-based entry), the inclusion of a profile picture of varying size up to a gallery of 15 pictures/videos and the publication of additional information (publications, linking to homepage and blog article). In order to secure a content-equivalent application for injunction (in summary), the plaintiff requests that the defendant be ordered to refrain from doing so by means of a temporary injunction, (a) (main request) to include in their online directory (specified) personal data of psychotherapists and psychotherapists in training, unless they have given their prior consent b) (as an alternative to the main request) to promote the competition of psychotherapists and psychotherapists in training, who are listed in their online directory with a paid profile, which in particular results in prioritisation and special emphasis compared to the free profiles, by listing in their online directory personal data of persons who have not given their prior consent; c) (as an alternative to the first contingent request) to enable in their online directory a ranking in search results, a highlighting and/or a greater choice of design options against payment; d) (as an alternative to the second contingency request) to promote competition between psychotherapists and psychotherapists in training with a paid profile by allowing them to be ranked in search results, highlighted and/or given a wider choice of options in their online directory compared with persons with a free profile. The conduct complained of infringes data protection regulations, since, in the absence of justification and sufficient information, there is unlawful data processing (in particular under Article 6 and Article 14 of the DSGVO). Furthermore, the defendants infringed professional codes of conduct (Professional Code of Conduct for Psychotherapists and Advertising Guidelines for Psychotherapists issued by the Federal Ministry of Health and Women's Affairs), which require professional advertising to take precedence over commercial considerations, as well as the prohibition of comparative and blatant advertising and the prohibition of the provision of unobjective information. Through these violations of data protection and professional ethics provisions, the defendants gained an unfair competitive advantage over law-abiding competitors and committed a breach of fairness pursuant to § 1 UWG (breach of law). Further breaches of unfairness law would lie in deceiving the persons being courted about the existence of an advertisement (due to non-disclosed ranking in the search result in return for a fee) and in unfairly biasing the persons included in the online directory without prior consent for the defendant's own economic purposes. The defendants applied for the dismissal of the application for security. Their business model was admissible under data protection law (a permissible offence of safeguarding legitimate interests) and did not violate either the professional code of conduct of psychotherapists (there was no comparative or blatant advertising) or the law of fairness: even if one wanted to recognise a violation of the law, it would not be unfair because the defendants' legal view was justifiable. The prior ranking of therapists who had booked an additional package was not misleading, and there was also no unfair lure. The court of first instance dismissed the application for security. The Appeals Court confirmed this decision and ruled that the value of the subject matter of the decision exceeded EUR 30,000 and that the ordinary appeal on points of law was not admissible due to the lack of substantial legal issues. There was no unlawful data processing. The weighing of interests to be carried out in accordance with Article 6.1 letter f of the DPA was in favour of the defendant, since the public's need for information was also to be taken into account. The BMASGK published the list in pure text form, while the publication of the first defendants was also optimised for mobile devices and contained useful additional information and no negative consequences for the listed psychotherapists were apparent. The latter had a right to deletion from the list, which the first defendant expressly granted them in the context of its general terms and conditions of business, with reference to a data protection declaration that could be accessed on the Internet. There was no legitimate interest of the plaintiff in the confidentiality of the data published by the first defendant resulting from the data protection law. Nor is there any violation of information obligations under Art. 14 DSGVO, but even incorrect or incomplete information would not result in the unlawfulness of the data processing. The mere prior ranking of psychotherapists who purchase a paid package from the first defendant is not in conflict with either the Code of Professional Conduct or the Advertising Guidelines for Psychotherapists, which in each case only set out content requirements for advertising. Therefore, the claim for injunctive relief based on breach of law under the UWG was not justified. Even if this were the case, however, the defendant's legal view would be justifiable. The rankings in the search result were not misleading because the search function's result list did not suggest sorting according to relevance, ratings, popularity or other criteria. It was also unobjectionable that entries in the database of the first defendant which are subject to a charge are given preferential treatment without any labelling, since it is clear to the average Internet user that free databases not operated by public institutions are financed by advertising or memberships. The defendants also did not unfairly exploit third party services for their own economic purposes, since they had taken the basic data from a public register without infringing the law. In his extraordinary appeal on a point of law, the plaintiff asserts that the conditions for justifying data processing under Art. 6 Para. 1 lit. f DSGVO are not fulfilled and that the defendants also fail to comply with their information obligations under Art. 14 DSGVO. Moreover, he maintained his view that there was also a violation of the professional ethics of psychotherapists and a violation of fairness as a result of misleading and exploiting the services of others. In their defence on appeal, the defendants request that the extraordinary appeal be rejected or that it not be complied with. Legal assessment The appeal on points of law is admissible because there is no supreme court ruling on the fairness of violations of data protection regulations; however, it is not justified. The plaintiff association bases its claim on the following grounds: 1. infringement of the DSGVO (and thus implicitly of the DSG); 2. violation of the professional code of conduct for psychotherapists as a breach of law according to § 1 UWG; 3. further violations of the UWG: a. Violation of the DSGVO as a breach of law; b. Misleading; c. Exploitation of third party services. 1. the breach of data protection law 1.1 The complainant association does not claim that the defendant has encroached on its own protected legal position, but claims on behalf of its members (around 40 % of all registered psychotherapists) that there has been a breach of data protection legislation concerning the data of its members. 1.2 The right to data protection is a personal right (Schweiger in Knyrim, DatKomm DSGVO Art 82 Rz 29) and a fundamental right according to Art 8 of the Charter of Fundamental Rights of the European Union. 1.3 Section 28 DSG (representation of data subjects by a data protection association) regulates the representation of data subjects exclusively in proceedings concerning complaints before the data protection authority. Neither does it exist, nor has the plaintiff claimed to have been instructed by its members on their behalf to conduct such complaint proceedings. 1.4 Under Art. 80(2) DPA, Member States may provide that certain bodies may enforce the rights in question even without a mandate from the data subject. This reflects the fact that arbitrary prosecution of data protection violations by third parties (associations) is only permissible if the national legislature expressly provides for such a possibility. This means that the respective member state must expressly regulate a class action for data protection claims. Austria has not made use of this enabling clause. Consequently, no class action is provided for in Austria for the enforcement of claims under the DSGVO. 1.5 The plaintiff association therefore lacks the active legitimation for the assertion of data protection rights of third parties. This must be taken into account in the context of a comprehensive legal examination of a permissible legal remedy. In this respect, there is no need to deal with the content of the defendant's infringements of data protection law, which are still alleged in the appeal. 2. the infringement of professional ethics 2.1 The complainant association claims that the alleged violation of the professional code of conduct for psychotherapists is a violation of § 1 UWG (case group breach of law). It is actively legitimised for this purpose as an association of entrepreneurs within the meaning of § 14 (1) UWG. 2.2 The plaintiff asserts that it is irrelevant if psychotherapists are placed in a higher ranking on the basis of a payment to the first defendant alone, this has nothing to do with professional aspects. Users assumed that the ranking was based on a special professional quality. This would be an unobjective provision of information. The Code of Professional Conduct allows only announcements in which technical aspects are given priority over commercial aspects. There is also comparative advertising because the portal enables users to compare therapists. In this context, secondary deficiencies in the findings are referred to. 2.3 According to § 16, paragraph 1 of the Psychotherapy Act, psychotherapists (and according to paragraph 4, leg cit, also other physical and legal persons) must refrain from any unobjective or untrue information in connection with the exercise of the profession. Point IV Z 4 of the psychotherapists' code of ethics stipulates that in advertising and announcements to the public, professional aspects must be given strict priority over commercial aspects; advertising or announcements must be limited to what is objectively necessary. Untruthful advertising, advertising from outside the profession, misleading advertising or blatant advertising (i.e. announcements that are not meant literally but as an exaggeration that is not meant seriously) is not permitted. Point I of the Advertising Guidelines for Psychotherapists essentially repeats the content of the quoted provision in the Code of Professional Conduct. 2.4 A violation of professional advertising rules is only unfair if it is based on an unjustifiable legal opinion. The wording of the respective provision and the practice of the bodies primarily responsible for its interpretation are decisive for the assessment of this question (RS0130682). Even in connection with advertising regulations under the Code of Professional Conduct, market participants do not have to base their conduct from the outset on the strictest interpretation of the relevant regulations (RS0130682 [T1]). 2.5 Insofar as the appeal on points of law complains that the portal is to be judged as unobjective comparative advertising, the same applies as already stated by the Senate in 4 Ob 241/16v. There it was stated that when examining whether advertising for a particular dentist is made personally in an advertising mailing, the impression the announcement gives to its average addressees must be taken into account. This legal question is to be solved according to objective standards. Also, announcements must not be viewed in a disjointed manner, but rather the overall impression that the average interested party receives on cursory examination must be taken into account. 2.6 The Appeals Court has correctly assumed - in accordance with this case law - that a comprehensive list of psychotherapists (which, according to the certified facts in the search results, does not give a particular impression of the reason for the selection or ranking) does not give the impression that it advertises certain therapists. 2.7 If the appeal is objected to as a secondary finding defect, namely that it has not been established that the search result is presented as random, even if it contains a series of paid interventions, and that no clarification is provided about this, it must be countered by the fact that this can in any case be inferred from the certified facts in an overall view. 2.8 The fact that the users of the platform attribute the ranking on the platform to the first defendant cannot be assumed from the overall view. The appeal does not show where the unobjective information should lie. 2.9 In summary, the Senate shares the assessments of the lower instances that the defendant's contested publications (rankings, additional information on "paying customers") do not violate any professional ethics regulations. It is not apparent that the platform contained unobjective information (§ 16 PsychotherapieG). The content is also not blatant with a photograph (cf. 4 Ob 117/99f on a notary's unaddressed mail to advertise his official position with a photograph of the defendant). 3. on the infringement of the DSGVO as a breach of law under § 1 UWG 3.1 In German doctrine, it is disputed whether the enforcement of claims under the DSGVO by way of the UWG is permissible (affirmative instead of many, such as Uebele, Die Durchsetzung des Datenschutzrechts über UWG und UKlaG auf dem Prüfstand von Rechtsprechung und Gesetzgeber, GRUR 2019, 694 et seq, GRUR 2019, 686), or whether this is inadmissible because the DSGVO contains a final provision on enforcement (e.g. Köhler, Durchsetzung der DS-GVO - eine Aufgabe auch für Mitbewerber oder zumindest für Verbraucherverbände?, wrp 2019, 1279 ff; Köhler/Bornkamm/Feddersen, dUWG37 [2019] § 3a Rz 1.40a, 1.74b). 3.2 In the present case, there is no need to pursue this question further. According to the case-law of the Senate, which has been approved by the doctrine (see Schmid in Wiebe/Kodek, UWG² § 1 margin no. 807), an encroachment on the exclusive rights of third parties which does not entail official sanctions and does not concern interests of the general public worthy of protection cannot, in principle, be claimed as an unfair commercial practice in the case group breach of law (4 Ob 93/01g on copyright; 4 Ob 169/15d on the right of ownership; 4 Ob 75/16g on interference with a mere possession of rights; RS0115373). Violations of data protection law also belong to this case group, because the right to data protection is a personal right and thus an exclusive right that can only be asserted in person. 3.3 Accordingly, what was said under 1 applies here too: The plaintiff is not legitimised for this basis of claim, which is why the alleged violations and in particular the question of whether there is a justification under Article 6.1 lit f of the DPA is irrelevant. 4. on misleading statements under the UWG 4.1 The appeal on points of law argues that it is not apparent to the users that the prior ranking is the result of a payment of fees. Advertising and other content must be clearly separated, ambiguities are at the expense of the advertiser. It was also misleading that the impression was given that the therapists were listed with their consent. 4.2 The fact that claims based on original violations of the Unfair Competition Act (UWG) (circumstances outside the circumstances regulated by the DSGVO) are not excluded is admitted by both camps in the literature on the offence of "breach of law" mentioned above (point 3.1.) (Köhler/Bornkamm/Feddersen, dUWG37 [2019] § 3a Rz 1.40i; Ohly, UWG legal protection for violations of the Basic Data Protection Regulation, GRUR 2019, 686 [692]). 4.3 The yardstick for the fairness test of a commercial practice applied to consumers is an average consumer who is reasonably well informed and reasonably observant and circumspect (RS0114366 [T5]). For misleading omissions - apart from the general criteria (consideration of all factual circumstances, average consumer, etc.) - it is important a) whether material circumstances which the average consumer needs in order to take an informed transactional decision are concealed and b) whether this may have an effect on his business conduct; in this context c) account must be taken of the possibly limited possibilities for conveying information (RS0124472). 4.4 Deception as to the nature of advertising falls under the misleading nature of § 2 para. 4 no. 2 UWG, unless the commercial purpose does not result directly from the circumstances themselves (see Anderl/Appl in Wiebe/Kodek, UWG2 § 2 Rz 502). 4.5 The previous instances took the view that for the average user of a directory which is accessible free of charge and financed by advertising, the fact that the preceding entries can be distinguished from the subsequent ones by means of photos and a more elaborate design and that the order of the entries can then be deselected, makes it sufficiently clear that the entries are paid entries. 4.6 The Senate agrees with this assessment. Users are aware of the now common practice that in a directory of various providers some of them are highlighted with photos and more detailed information for a fee. Thus, for example, the yellow pages, as part of the general telephone directory, contain entries of providers in individual sectors with highly varying presentations. For the average addressee, there is no doubt under such circumstances that more elaborately designed listings in comparable directories are paid advertisements and not rankings of the publisher for objective reasons. 4.7 The argument that consumers of psychotherapeutic services are misled by the fact that the therapists included in the list have consented to their inclusion in the list must be countered by the fact that it is neither apparent nor is it shown by the appeal to what extent this circumstance of alleged deception is capable of significantly influencing the ability of the average consumer to make an informed decision (Paragraph 1(1)(2) UWG; lack of relevance; see RS0121680). 5. the exploitation of third party services The allegation of unfair exploitation of third party services, which is upheld in the appeal, is not present for the simple reason that the data published by the defendants do not originate from the plaintiff's stock but from a publicly accessible online directory of the public sector. 6 The decision on costs is based on § 393.1 EO in conjunction with §§ 41, 50 ZPO. Translated with www.DeepL.com/Translator (free version)
