BVwG - W253 2246873-1
From GDPRhub
| BVwG - W253 2246873-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 13 GDPR Article 15 GDPR Article 57(4) GDPR Article 77 GDPR |
| Decided: | 17.12.2021 |
| Published: | 11.02.2022 |
| Parties: | Unknown data subject (complainant) Unknown child and adolescent psychiatric clinic DSB (Austria) |
| National Case Number/Name: | W253 2246873-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2021:W253.2246873.1.00 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (in German) |
| Initial Contributor: | Katharina Creemer |
The Austrian Federal Administrative Court (BVwG) held that when rejecting a complaint for being excessive under Article 57(4) GDPR, the Data Protection Authority needs to properly substantiate this decision. The existence of previous complaints does not meet this threshold.
English Summary
Facts
The complainant is the parent of a minor who was a patient at a child and adolescent psychiatry center. They claimed that the family, including their underage children, had been filmed in the patient's room during a visit. In June and July 2021, they brought this issue to the Austrian Data Protection Authority (DSB), requesting information as to whether the psychiatry had a valid data protection permit for visual or audio recording at the time of the hospitalisation (Articles 13, 15 GDPR). At the same time, the complainant asked for information as to when these alleged recordings had been made. The DSB did not provide any information about this.
The DSB rejected the handling of the complaint based on Articles 57(4) and 77 (1) GDPR, arguing that the complainant had made excessive use of the right to lodge a complaint. Between August and 2018 and August 2021, the complainant brought a total of 29 proceedings to the DSB. The majority of these related to the processing of data on the complainant's underage child.
The investigative procedure of the DSB was limited to the literal reproduction of the complaint, a list of their complaints pending, and the finding that the majority of those complaints related to the processing of the data of their minor child. The DSB doubted whether the complainant had any need for data protection protection at all.
Holding
The court decided in favour of the complainant. It repealed the contested decision and instructed the DSB to continue the lawful procedure.
According to the court, the DSB did not deliver the evidence necessary for the claim of excessive requests. The minimum requirements would have entailed an overview of the content of the proceedings pending at the DBS and their similarity. Furthermore, it held that the DSB did not specifically explain the excessive nature of the inquiries, but rather made legally irrelevant speculations about the actual motivation of the complainant without basing its assessment on the actual argument that the information about the video surveillance or the audio recordings was refused.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
decision date 12/17/2021 standard B-VG Art133 Para.4 GDPR Art13 GDPR Art15 GDPR Art57 Para saying W253 2246873-1/6E IN THE NAME OF THE REPUBLIC! The Federal Administrative Court has judge Mag. Jörg C. Binder as chairman and the expert lay judge Gerhard RAUB and Dr. Ulrich ZELLENBERG as assessor on XXXX's complaint against the decision of the data protection authority of August 17, 2021, Zl. 2021-0.575.711; D 124.4539, rightly recognised: a) The complaint will be followed, the contested decision will be remedied and the authority concerned will be instructed to continue the lawful procedure. b) The revision is permissible according to Art. 133 Para. 4 B-VG. text Reasons for decision: I. Procedure: By letter dated July 16, 2021, subject “Bescheid D124. 2902 (202-0.816.390) of the DPA-Complaint and/or Retrial” XXXX (hereinafter Complainant) turned to the DPA (hereinafter Appellant Authority). In summary, the complainant stated that he himself, his partner and their underage children, were bugged in the patient's room during a visit to the complainant's underage daughter, who was in XXXX inpatient treatment, and recorded using video cameras on the ward. In connection with these alleged incidents, the complainant sent an e-mail dated September 2nd, 2019 to the relevant authority and to ARGE Daten-Österreichische Gesellschaft für Datenschutz. He had asked for information as to whether the child and adolescent psychiatric building in XXXX had a valid data protection permit for visual or audio recording at the time the underage daughter was hospitalized on XXXX. At the same time, the complainant asked for information as to when these alleged recordings had been made. The data protection authority has not yet provided any information about this. In a letter dated July 16, 2021, the complainant informed the subject “Notice D124. 9/2/2002 (202-0.816.300) of the data protection authority complaint and/or reopening of the data protection authority” summarized with that the rejection of his complaint against the child and adolescent psychiatry in XXXX according to § 13 paragraph 3 AVG was wrong, because the Respondent intentionally violated Art. 13 et seq. GDPR, Art. 1 § 1 Para. 1 DSG and Art. 8 Charter of Fundamental Rights in conjunction with Art. and/or tape recordings had been illegally made during the visit to the underage daughter's ward. The child and adolescent psychiatric department in XXXX did not fully, correctly and in a timely manner comply with the numerous requests to assert the right to information in accordance with Art. 13 ff. DSG VO and the right to information in accordance with Art. 15 DSG VO. By withholding the available and relevant information, the complainant would be effectively prevented from exercising his rights as a data subject. With a decision dated August 26, 2021, GZ D124.45392021-0.575.711, the authority concerned rejected the handling of the complaint in accordance with Art. 57 Para. 4 and Art. 77 Para. August 2018 I submitted a first complaint to the data protection authority, which was recorded under reference number D 123.341. Since that point in time, the complainant has brought twenty-nine further proceedings, which are specified in more detail in the notification. The majority of these relate to the processing of data on the complainant's minor daughter. The main issue in the present complaint is the custody of the complainant's minor children. This is also the case with the majority of the 27 complaints that the complainant submitted to the data protection authority, e.g. against the district administration XXXX or against the child and adolescent psychiatric clinic XXXX. In this sense, the complainant and his wife would also take action against the respondent and allege a violation of the right to information and the right to information as well as the right to secrecy. It is doubtful to what extent there is a need for data protection protection at all. The authority concerned is therefore proceeding against the background of the total number of complaints filed and the core of his complaint as presented by the complainant himself, which always involves the allegation of the violation of a large number of rights due to the processing of the data of his minor daughter by a wide variety of respondents , although the complainant and his wife do not live together with their daughter and they are no longer entitled to custody, from an excessive use of the right of appeal under Article 57 (4) GDPR. The appeal by the above-mentioned complainant dated September 23, 2021, which was submitted by the relevant authority to the Federal Administrative Court on September 30, 2021, is directed against this decision. Insofar as it is relevant to the procedure, the complainant explains that the decision suffers from major deficiencies due to the failure to establish the relevant facts, because the proceedings brought by the complainant to the DSB relate to different respondents. The question of the entitlement to custody was not even raised in the proceedings against the Respondent. Therefore, the considerations of the authority concerned are illegal. II. The Federal Administrative Court considered: The complaint is justified to the extent evident in the ruling: 1. Findings: In his submissions of June 3, 2021 and July 16, 2021, the complainant summarized that he and his partner and their minor children were bugged by the party involved during a visit to the minor daughter who was being treated by XXXX in inpatient treatment at the hospital ward and by means of video cameras on the station were recorded. With the decision of August 26, 2021, GZ D124.45392021-0.575.711, the data protection authority authorized the processing of XXXX’s data protection complaint of June 3, 2021, supplemented by a submission of July 18, 2021, against child and adolescent psychiatry in accordance with Article 57 (4). as well as Art. 77 Para. 1 DSG VO from rejected. The authority concerned assumed that the reasoning for the decision was an excessive use of the right to lodge a complaint. As of August 17, 2021, twenty-nine files relating to the complainant and various respondents were kept in the ELAK file management system at the authority concerned. Five files relating to the party involved can be identified from the keywords given in this list. 2. Evidence assessment: The above findings are based on an inspection of the submitted administrative files, the administrative court file, the decision and the complainant's complaint. 3. Legal assessment: to A) The subject of the proceedings is the question of whether the refusal to deal with the complaint was justified. The relevant provisions of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND THE COUNCIL of April 27, 2016 on the protection of natural persons with regard to the processing of personal data, on the free movement of data and on the repeal of Directive 95/46/EC (General Data Protection Regulation in further consequence GDPR) read in extracts as follows: "Article 57 (4) GDPR In the case of manifestly unfounded or excessive requests, in particular in the case of frequent repetition, the supervisory authority may charge a reasonable fee based on administrative costs or refuse to act on the request. In this case, the supervisory authority bears the burden of proving that the request is manifestly unfounded or excessive.” The data protection complaint relates to a request for information from Jugendpsychiatrie XXXX, which did not fully, correctly and timely comply with the requests to assert the right to information pursuant to Art. 13 et seq. GDPR and the right to information pursuant to Art. 15 GDPR. According to Art. 57 Para. 4 GDPR last sentence, the authority bears the burden of proof for the manifestly unfounded or excessive nature of the request. In the present case, the authority relies on the total number of complaints filed and the allegation, always made by the complainant, of violating a large number of rights due to the processing of his daughter's data by a wide variety of respondents, even though he and his wife no longer live with the daughter would and no longer have custody of them. The investigative procedure of the authority concerned is limited to the literal reproduction of the complaint made by the complainant and a list of the complaints pending at the authority concerned by the complainant and the finding that the majority of the complaints submitted by the complainant relate to the processing of the data of his minor daughter. The authority defines the issue of custody of the underage children as the priority core of the complaint to the authority concerned. According to the statements made by the authorities, this question is the basis for most of the further proceedings brought before her by the complainant. From the point of view of the authority, it is doubtful whether the complainant had any need for data protection protection at all. The authority concerned is to be granted that the complainant addressed a not inconsiderable number of submissions to it. The senate appointed to make the decision does not ignore the fact that the issue of custody of the complainant's underage daughter, which is smoldering in the background, seems to be the starting point for numerous complaints to the data protection authority. From the point of view of the Senate called upon to make the decision, the authority has the evidence to be provided by simply reproducing the allegations made by the complainant, the tabular listing of the pending proceedings in relation to this complainant and the description of the officially accepted or assumed motives of the complainant, not delivered. At least an overview of the content of the proceedings pending at the authority and their similarity (declaration that the contested image and sound processing is already the subject of the proceedings) would have been required. In addition, the authority did not specifically explain what the excessive nature of the inquiries was, but rather made legally irrelevant speculations about the actual motivation of the complainant without basing its assessment on the actual argument that the information about the video surveillance or the audio recordings was refused . This has to result in the contested notice being repealed and the lawful procedure being carried out by the authority. It was therefore to be decided accordingly. Regarding B) Admissibility of the revision: Pursuant to § 25a Para. 1 VwGG, the administrative court has to pronounce in its ruling or decision whether the revision is admissible according to Art. 133 Para. 4 B-VG. The statement must be briefly justified. The revision is permissible according to Art. 133 Para. 4 B-VG because the decision depends on the solution of a legal question and there is no case law of the Administrative Court.
