OLG Linz - 2R149/21a

OLG Linz - 2R149/21a

Court:	OLG Linz (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 57(3) GDPR Article 77 GDPR Article 78 GDPR Article 82 GDPR § 1293 Austrian Civil Law Code (Allgemeines Bürgerliches Gesetzbuch - ABGB)
Decided:	10.11.2021
Published:	02.12.2021
Parties:	unknown
National Case Number/Name:	2R149/21a
European Case Law Identifier:	ECLI:AT:OLG0459:2021:00200R00149.21A.1110.000
Appeal from:	LG Wels 2 Cg 28/21a-9
Appeal to:	Not appealed
Original Language(s):	German
Original Source:	Rechtsinformationssystem des Bundes (RIS) (in German)
Initial Contributor:	n/a

The Higher Regional Court of Linz held that, in certain situations, a data subject can be entitled to claim the costs of successful legal representation in a procedure under Article 77 GDPR as a damage under Article 82 GDPR from the controller.

English Summary

Facts

A district authority had issued a decision allowing for hawks to be shot in a certain rural area. This decision contained certain personal data of the claimant. The respondent(a natural person) published this decision on their private website. The claimant asked the respondent to redact/anonymise the claimant's personal data on their website but the respondent refused.

Consequently, the claimant filded a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB), represented by an attorney. The DSB upheld the complaint, held that the respondent had violated the claimant's data protection rights (remark: the exact GDPR violations are not specified in the judgment) and ordered the respondent to remove the claimant's personal data from their website. The respondent filed an appeal to the Federal Administrative Court (Bundesverwaltungsgericht - BVwG) which dismissed the appeal.

The claimant filed a lawsuit, claiming the costs of their attorney under Article 82 GDPR. The claimant argued that the respondent had acted unlawfully and culpably, as they refused to redact/remove the personal data despite the claimant's explicit request. The first instance court upheld the claim and the respondent filed an appeal with the Higher Regional Court Linz (Oberlandesgericht Linz - OLG Linz).

Holding

The OLG Linz dismissed the appeal. It noted that Article 57(3) GDPR only states that the performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer. Hence Article 57(3) GDPR does not forbid that a controller can be put under the obligation to pay/refund legal costs in connection with a complaint procedure under Article 77 GDPR. Furthermore, the EFTA Court in E-11/19 and E-12/19 only held that a data subject cannot incur costs in a proceeding where they have become a party to the case by virtue of a controller appealing against a supervisory authority’s decision. However it did not exclude that a controller might incur costs. Hence, EU law does not preclude that a data subject claims the costs of a complaint procedure under from the controller under Article 82 GDPR.

According to Austrian case law, the cost of a successful legal representation before an administrative authority can be claimed as damaged under tort law in certain cases: if a party had party made false statements to the administrative authority which were the cause of the other party initiating proceedings, the representation costs can be claimed as damages. In the case at hand, the respondent's conduct in having published the district authority's decision without anonymising it, resulted in an infringement of the claimant's rights. According to the OLG Linz, this is to be considered equivalent to the situation of an unlawful and culpable false statement to an administrative authority. Therefore the respondent's appeal was dismissed and claimant's claim for damages was upheld.

Comment

The effects of this decision are hard to estimate but could be quite significant. The possibility to get representation cost refunded under Article 82 GDPR might make it more attractive for Austrian attorneys to represent data subjects before the DSB. Furthermore, it might lead to legal costs insurance providers to include the costs of representation before the DSB in their insurance policies.

However, it must be noted that representation costs will certainly not be refundable under Article 82 GDPR in every case. In cases where the controller acted in good faith and argued legal positions that were somewhat reasonable but did not convince the authority or in cases where the data subject gave the controller no chance to remedy an infringement prior to a procedure under Article 77 GDPR, it's quite likely that the courts would not refund representation costs.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

court
Higher Regional Court Linz

Decision date
11/10/2021

Business number
2R149 / 21a

head
The Linz Higher Regional Court, as the court of appeal, appointed Mag. Bernhard Telfser as chairman, Dr. Werner Gratzl and Mag. Christine Mayrhofer in the case of the plaintiff J ***** E *****, represented by Dr. Fritz Vierthaler, lawyer in Gmunden, against the defendant E ***** S *****, represented by MMag. Michael Krenn, lawyer in Vienna, due to EUR 1,649.34, about the appeal of the defendant against the judgment of the Regional Court of Wels of July 27, 2021, 2 Cg 28 / 21a-9, rightly recognized in a closed session:

Saying

The appeal is not followed.
The defendant is owed to reimburse the plaintiff for the costs of the appeal proceedings determined at EUR 548.86 (including EUR 91.48 VAT) within 14 days.
The revision is in any case inadmissible.

text
Reasons for the decision:
The District Commission ***** issued a notice about an officially ordered forced shooting of hawks in the cooperative hunting area L *****. The decision also contained the plaintiff's personal data.
The defendant published this decision on his homepage, on which he otherwise also provides information with private reference - he introduces his family there, for example.
In a letter dated March 29, 2018, the defendant was requested to anonymize the published decision in a suitable manner and to remove the plaintiff's personal data. The defendant did not comply with this request.
The plaintiff then lodged a complaint with the data protection authority. In a decision dated December 3, 2018, the data protection authority determined that his right to data protection had been violated by the publication of personal data. At the same time, the authority ordered the defendant to remove the published personal data in the event of any other execution. The defendant lodged a complaint with the Federal Administrative Court against this decision. On April 16, 2020, the court dismissed the complaint and confirmed the decision of the data protection authority.
With his action dated March 22, 2021, the plaintiff seeks compensation for the representation costs incurred for the proceedings before the data protection authority and the Federal Administrative Court on the basis of Section 29 (1) GDPR and Article 82 GDPR from the title of compensation. He alleged that the illegal publication of his personal data by the defendant had violated his right to data protection and that he had incurred representation costs of EUR 1,649.34 in order to enforce his interests worthy of protection. In any case, the defendant acted negligently and therefore culpably and unlawfully. Before the review process was initiated, the latter was expressly requested, but unsuccessfully, to anonymize the published decision. The defendant operates a private homepage that does not make him a media owner or operator or publisher, so that he does not fall under the media privilege of Section 9 DSG.
The defendant denied and requested that the lawsuit be dismissed for a fee. In summary, he objected that his obligation to reimburse costs could not be derived from the General Data Protection Regulation (GDPR for short) or from Austrian administrative law. Any representation costs in proceedings before the supervisory authority according to Art 77 ff GDPR were not covered by the obligation to pay compensation under Art 82 GDPR. Section 74 AVG also stipulates that the respective parties must bear the costs. Compensation for the costs of administrative proceedings can only be sought in civil law if the opponent in the administrative proceedings has provided the authority with unlawful or culpable false information that was the cause of the representation costs of the other party. That is not the case here. In the administrative proceedings, the defendant merely took a justifiable legal opinion on the basis of which the publication of the non-anonymized decision was legal. This alone does not trigger a claim for damages on the part of the plaintiff with regard to the costs of representation in the administrative procedure. In addition, the defendant is a voluntary nature conservation body and reports on its website on various nature conservation, hunting and environmental topics that are of public interest. The media privilege of § 9 DSG applies. The plaintiff's personal rights were not violated by the defendant.
With the judgment under appeal, the first court upheld the action. Specifically, it affected the factual findings on pages 5 to 15 of the judgment (= ON 9, AS 5 to 15), to which reference is made, insofar as they were not reproduced in the introduction (Section 500a ZPO).
From this it is particularly important:
The defendant received the decision of the district administration ***** on the basis of the environmental information laws (UIG, Upper Austria. USchG) from the district administration ***** with full personal reference and published it on its website. The plaintiff's consent to this was not given. The publication by the defendant took place in the course of his commitment to nature conservation law at the N *****. He published the decision without any changes.
In the data protection proceedings, the defendant did not rely on the fact that he, as the publisher, operated an Internet portal on which he provided information or reports on various current topics in connection with his personal work; this in particular on the topic of nature, the environment and hunting, and that it is therefore covered by the media privilege of § 9 DSG. Nor did he make any false claims about the plaintiff in these proceedings.
In legal terms, the first court ruled that, according to Section 29 (1) GDPR and Art 82 GDPR, a person whose rights have been violated is entitled to compensation. The publication of the plaintiff's personal data through the publication of the BH ***** decision violated the plaintiff's right to data protection. The plaintiff successfully asserted this fact in the proceedings before the data protection authority and subsequently before the Federal Administrative Court without the defendant having invoked a media privilege there, especially successfully. Even after the factual findings, the plaintiff is not entitled to the media privilege. The plaintiff's representation costs were thus caused by the defendant's behavior which was found to be unlawful in the administrative proceedings. Due to the complexity of the data protection regulations, representation by a lawyer seems appropriate and appropriate. The expenses were actually paid by the plaintiff. This means that the defendant is obliged to pay compensation for the damage suffered by the plaintiff. Since the defendant did not invoke a media privilege in the administrative proceedings, the question whether an appeal would actually have been correct could remain open.
The defendant's appeal is directed against this decision on the grounds of the incorrect legal assessment with the amendment aimed at rejecting the claim; In eventu, a referral request is made.
In his response to the appeal, the plaintiff requests that the defendant's appeal be disregarded.
The appeal is not justified.

Legal assessment
As in the first instance proceedings, the defendant takes the position in the appeal that the plaintiff is not entitled to reimbursement of representation costs, which he had to pay in the administrative procedure according to § 77 GDPR, neither under European law nor under national Austrian legal basis.
First of all, the argued European legal bases:
For the legal basis under European law, the defendant relies on Art 77 (1) in conjunction with Art 57 (3) GDPR and the judgment of the EFTA Court of 10 December 2020 (E-11/19 and E-12/19). Both levels of argument do not apply due to the following considerations:
According to Art 77 (1) GDPR, without prejudice to any other administrative or judicial remedy, every person concerned has the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged violation, if the person concerned is of the opinion that the processing of your personal data violates this regulation.
According to Art 57 (3) GDPR, the fulfillment of the tasks of each supervisory authority is free of charge for the data subject and, if applicable, for the data protection officer.
If the defendant now claims that these provisions conflict with his obligation to pay compensation, he overlooks the fact that these regulations are intended to provide the data subject with easy access to legal enforcement and the data subject or the data protection officer from the costs of filing complaints and initiating a legal review should free (Schweiger in Knyrim Datkomm Art 77 Rz 1 and 17 [as of Feb. 2019]). In addition, it only emerges from Section 57 (3) GDPR that the fulfillment of the tasks of the supervisory authority is free of charge, which does not say anything about whether a controller or processor has to reimburse the representation costs of the person concerned (which are independent of the tasks of the supervisory authority). The defendant fails to recognize that he, as the person who is responsible for the “processing of the data” through the publication, is not the “data subject”, but rather the person responsible within the meaning of Art or legal person, authority, agency or other body that decides alone or jointly with others on the purposes and means of processing personal data; ...), so that these provisions are not an obstacle to the disputed reimbursement of representation costs, neither in terms of their wording nor of their target orientation .
The judgment of the EFTA Court of 10 December 2020 (E-11/19 and E-12/19), which was also brought up by the defendant, does not in principle prevent the person responsible from reimbursing representation costs. The expert answer to the second question put to the Court of Justice in the start-up procedure is:
"From Art 77 Paragraph 1 and Art 57 Paragraph 3 of the GDPR it emerges that a data subject becomes a party to a procedure according to Art 78 Paragraph 1 because a person responsible has lodged an appeal against a decision of the supervisory authority and this status according to national law is automatically assigned, no costs may be imposed in connection with this procedure ”.
The content of this question answer in the opinion of the EFTA Court of Justice is that (only) the person concerned should not have to incur any costs in the proceedings before the supervisory authority. It says nothing about whether a person responsible has to pay compensation for (representation) costs or not. As in the main proceedings relating to this opinion, the fact that the defendant lodged a complaint with the Federal Administrative Court against the decision of the data protection authority meant that the person responsible had lodged a legal remedy (a complaint) against a decision by the supervisory authority (the data protection authority) and the claimant was thereby automatically assigned the status of the data subject.
In margin nos. 61 and 62 of its reasoning for the judgment, the EFTA Court also states that under circumstances in which a data subject does not initiate proceedings under Art 78 (1) of the GDPR, but is nevertheless assigned the status of a defendant in these proceedings, he or she is assigned the potential imposition of reimbursement would have the effect of charging a fee for the duties of the regulator. Such an obligation to reimburse costs is contrary to the right to a free complaint according to Art 77 Paragraph 1 and Art 57 Paragraph 3 of the GDPR and also contradicts the purpose of the GDPR to create a clearly enforceable legal framework and to offer data subjects more security in legal and practical terms ( Recital 7 of the GDPR; the person responsible under Art 4 Z 7 GDPR is not protected by this). The prospect of the imposition of an obligation to pay compensation is a deterrent to filing a complaint with a supervisory authority. Accordingly, the Court of Justice comes to the conclusion that such a regulation of the reimbursement of costs runs counter to the scope of protection granted by the aforementioned provisions of the GDPR and would make the exercise of the rights conferred by EEA law contrary to these provisions of the GDPR excessively difficult.
These arguments can be summarized in such a way that the European legal norms and principles do not conflict with the defendant's obligation to pay compensation for representation costs from the procedure according to Art 77 GDPR - contrary to his opinion. That, as Zavadil (in Knyrim, DatKomm Art 57 margin no.26) points out, neither the GDPR nor the GDPR provides for reimbursement of costs for any procedural costs (in particular legal fees) that arise for a person concerned in a complaint procedure according to Art 77 (1) GDPR , says nothing about whether the defendant as the person responsible according to Art 4 Z 7 GDPR does not have to reimburse these costs on the basis of general principles of compensation law (§ 1293ff ABGB) or special compensation regulations (Art 82 GDPR).
In order to check the claim according to the national legal bases:
According to Art 82 GDPR, every person who has suffered material or immaterial damage as a result of a violation of this regulation is entitled to compensation from the person responsible or the processor.
Any person who has suffered material or immaterial damage as a result of a violation of the GDPR or of Section 1 or Article 2, main part, has the right to compensation from the person responsible or from the processor in accordance with Article 82 GDPR. In detail, the general provisions of civil law apply to this claim for damages (Section 29 DSG).
In this regard, the defendant takes the position that reimbursement of costs on his part is out of the question because, according to Section 74 (1) AVG, everyone involved has to pay the costs incurred in the administrative procedure themselves and, according to the case law of the Supreme Court, costs of an administrative procedure only in exceptional cases A claim could be made if the opposing party had illegally and culpably made false statements to the authority in the administrative proceedings, which were the cause of the representation costs of the other party, which is not the case here (RIS Justice RS0022786; 6 Ob 94 / 20x).
It is in accordance with the established case law of the Supreme Court that the ordinary legal process is excluded for the independent assertion of administrative (criminal) procedural costs and that only the administrative route is open for this purpose (RS0022786). It should be noted that this legal principle is based on the fact that a cost reimbursement is (at all) provided for in the administrative procedure, which is therefore to be sought there, which is not the case here (RIS-Justiz RS0022786 [T3]; Zavadil in Knyrim, Datkomm Art 57 margin no.26 [as of March 2021]). In any case, the appeal correctly states that exceptions have already been made several times from this case law if the costs incurred in the administrative procedure amounted to a rescue effort (BS 5). For example, in decision 4 Ob 37 / 16v, the Supreme Court stated that the question of whether a party could successfully assert its costs incurred in administrative legal channels depends on whether the other party has provided the administrative authority with unlawful and culpable false information which were causal for initiating a procedure whereby the first-named party incurred the representation costs alleged as damage. These costs are a rescue effort, i.e. an effort that was made to avert a danger (RIS Justice RS0023516).
Here the defendant did not provide any incorrect information to the administrative authority. His behavior of having published a decision without anonymization with the personal data of the plaintiff, which results in the risk of or a direct violation of the property rights of the plaintiff, is to be equated with the situation of an illegal and culpable false statement to an administrative authority. Based on this, the Supreme Court held in decision 4 Ob 42 / 04m that the claim to reimbursement of the costs for participating in a domain name dispute settlement procedure was not a procedural claim. The defendant caused these expenses through an illegal and culpable domain registration of the plaintiff's trademark and so he had to reimburse them as rescue expenses insofar as they were sensible and expedient (Tades / Hopf / Kathrein / Stabentheiner AGBG37 E 86b to § 1293 ABGB). The Supreme Court further states that the defendant's argument that he acted neither unlawfully nor culpably and that he is fundamentally free to dispute the allegations brought against him in a lawsuit and to bring counter-arguments cannot be accepted because the defendant thereby I misunderstand the basis of the claim for damages made against him. The plaintiff is not claiming damages from the defendant because he has denied the transfer request, but because he is accused of illegal domain grabbing and yet he has refused to transfer the domain (4 Ob 42 / 04m).
Applied to this case, this means that the defendant may not withdraw from having acted neither unlawfully nor culpably in the proceedings and only focused on clarifying his legal position because the main reason for the claim for damages (for the reimbursement of the rescue effort) is There is a violation of data protection law through the publication of the plaintiff's personal data, which he refused to remove. The necessary, appropriate and reasonable representation costs due to the difficulty of data protection law are rescue costs to avert a danger (RIS Justice RS0023516 [T2]; 8 Ob 6 / 09d; RS0106806).
This shows that according to the national legal situation (cited decisions of the Supreme Court), costs from a preliminary procedure, even if this is an administrative procedure, fall below the general term of damage in § 1293 ABGB in conjunction with Art 82 DSGVO, § 29 DSG in the sense of a rescue effort and are to be replaced (Tades / Hopf / Kathrein / Stabentheiner AGBG37 E 86 ff; Schweiger in Knyrim DatKomm Art 82 Rz 13f [on the definition of damage in the GDPR]; 4 Ob 42 / 04m).
Insofar as the appeal ultimately states that, after the findings, the defendant simply took the justifiable legal position within the framework of the administrative proceedings that he, as a media owner, was entitled to publish the personal data of the plaintiff in his reporting, these statements are incorrect because on No. 14 in point 7, it has been established without controversy that the plaintiff in the data protection proceedings did not rely on the fact that he, as the publisher, operates an Internet portal on which he provides information or reports on various current topics in connection with his personal work; this in particular in the area of nature, the environment and hunting, and that it is therefore covered by the media privilege of § 9 DSG.
In addition, the defendant is to be referred to the fact that the civil courts are bound by legally binding decisions of an administrative authority with which a preliminary question relevant to the civil dispute was decided, even if these decisions are incorrect. In this case, a control of the content by the civil court is out of the question (Matthias Schmiedl, Der doppelgleisige Rechtsschutz in Datenschutzsachen, VbR 2020/104 p. 164; Schwamberger, parallelism and binding effect of civil and administrative proceedings according to the GDPR in Jahnel (publisher), yearbook data protection law (2019) 283 mwN on the case law of the Supreme Court; RIS-Justiz RS0036981, RS0036864).
The first court correctly affirmed the defendant's obligation to reimburse costs.
The suggestion to initiate a preliminary ruling procedure was not to be followed because the answers to the questions requested by the applicant for the appeal are not relevant to the decision because of the above legal statements and the wording of the provision of Article 57 (3) GDPR on cost relief is only clear to the person concerned.
The decision on costs is based on §§ 50, 41 ZPO.
The inadmissibility of the revision is based on Section 502 (2) ZPO.

European Case Law Identifier
ECLI: AT: OLG0459: 2021: 00200R00149.21A.1110.000