BVwG - W214 2275073-1

BVwG - W214 2275073-1

Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 15 GDPR Article 56 GDPR Article 60 GDPR Article 65 GDPR §24 Abs. 10 DSG §38 AVG
Decided:	02.10.2023
Published:	13.10.2023
Parties:
National Case Number/Name:	W214 2275073-1
European Case Law Identifier:
Appeal from:	DSB
Appeal to:
Original Language(s):	German
Original Source:	RIS (in German)
Initial Contributor:	co

The Austrian BVwG held, on appeal, that the DSB unlawfully suspended a complaint procedure on the basis of Article 60 GDPR.

English Summary

Facts

On 15 May 2023, a data subject filed an access request via e-mail to a controller, the operator of a gambling website, in accordance with Article 15 GDPR. Unsatisfied with the response by the controller, the data subject filed a complaint with the Austrian DPA (DSB).

The DSB, however, issued a decision stating that it suspended proceedings against the controller until the lead supervisory authority in the case had decided. According to the DSB, the object of the complaint referred to a matter of competence of the authority in which the controller had its main establishment under Article 56(1) GDPR, which, in the case was the Maltese DPA. The DSB held that in such circumstances it is obliged under Article 24 DSG to suspend the complaint procedure.

The data subject instead was of the opinion that the DSB should have dealt with the case as the requirement of Article 56(2) GDPR was met. In fact, the complaint in this case substantially affected only data subjects in Austria. Also, the data subject argued that neither Article 24(10) DSG nor Article 38 AVG provided for a legal basis for suspending proceedings. For these reasons, the data subject appealed the decision of the DSB before the BVwG.

Holding

First of all, the BVwG clarified that the case clearly dealt with cross-border processing activities. The BVwG then reiterated that the handling of cross-border complaints develops in three main steps: first the roles of different authorities as concerned or lead supervisory authority are defined; secondly, the lead supervisory authority initiates the cooperation mechanism and takes a binding decision; last, the decision is communicated to the data subject.

The DSB claimed that under Article 56(1) GDPR as well as Article 24(10) DSG, while the lead supervisory authority is competent, the complaint procedure is to be suspended ex officio. However, the data subject rightfully pointed out that Article 24 DSG does not provide a legal basis for suspending proceedings but merely states that the deadlines are suspended during an Article 56, 60 or 63 procedure.

Also, the procedure could not be suspended in accordance with Article 38 AVG, which foresees that a procedure can be suspended if another authority or court is to issue a binding decision which is essential for the authority to issue its own decision. This could be the case, for instance, if the EDPB were to issue a binding decision regarding the competence of the lead supervisory authorities under Article 65 GDPR. However, in the case at hand the BVwG stated that since neither a cooperation mechanism under Article 60 GDPR nor a procedure under Article 65 GDPR were initiated, it did not have to elaborate on the circumstances allowing for the proceeding to be suspended.

Further, the BVwG agreed with the data subject that Article 60 GDPR does not foresee that the only competent authority is the supervisory authority of the main establishment of the controller. Instead, it foresees that all concerned authorities collaborate in the procedure, meaning that a suspension of proceedings is not envisaged.

So, the BVwG concluded, the contested decision by the DSB should be rectified.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Decision date

October 2, 2023

standard

AVG §38 paragraph 1
AVG §73 paragraph 1
B-VG Art 133 Paragraph 4
DSG §24 Paragraph 1
DSG §24 Paragraph 10
GDPR Art4
GDPR Art51
GDPR Art56
GDPR Art60
GDPR Art65
GDPR Art77

AVG § 38 today AVG § 38 valid from March 1st, 2013 last changed by Federal Law Gazette I No. 33/2013 AVG § 38 valid from February 1st, 1991 to February 28th, 2013

AVG § 73 today AVG § 73 valid from August 15, 2018 last changed by BGBl. I No. 57/2018 AVG § 73 valid from January 1, 2014 to August 14, 2018 last changed by BGBl from April 20, 2002 to December 31, 2013 last amended by BGBl until December 31, 1998, last amended by Federal Law Gazette No. 471/1995 AVG § 73 valid from February 1, 1991 to June 30, 1995

B-VG Art. 133 today B-VG Art. 133 valid from January 1st, 2019 to May 24th, 2018 last changed by Federal Law Gazette I No. 138/2017 B-VG Art. 133 valid from January 1st, 2019 last changed by Federal Law Gazette I No. 22/2018 B-VG Art. 133 valid from May 25th, 2018 to December 31st, 2018 last changed by Federal Law Gazette I No. 22/2018 B-VG Art I No. 164/2013 B-VG Art by BGBl amended by BGBl. No. 211/1946 B-VG Art. 133 valid from December 19, 1945 to December 24, 1946 last amended by StGBl. No. 4/1945 B-VG Art. 133 valid from January 3, 1930 to June 30, 1934

DSG Art. 2 § 24 today DSG Art. 2 § 24 valid from May 25th, 2018 last changed by Federal Law Gazette I No. 120/2017 DSG Art No. 133/2009 DSG Art. 2 § 24 valid from January 1st, 2000 to December 31st, 2009

saying

W214 2275073-1/4E

IN THE NAME OF THE REPUBLIC!

The Federal Administrative Court, through judge Dr. Eva SOUHRADA-KIRCHMAYER as chairwoman and the expert lay judges Mag. Huberta MAITZ-STRASSNIG and Mag. Claudia KRAL-BAST as assessors on the complaint of XXXX, represented by SUMMER SCHERTLER KAUFMANN Rechtsanwälte GmbH, against the decision of the data protection authority dated June 1st, 2023, Zl. D124.1115/23 2023-0.371.518, rightly recognized: The Federal Administrative Court, through the judge Dr. Eva SOUHRADA-KIRCHMAYER as chairwoman and the expert lay judges Mag. Huberta MAITZ-STRASSNIG and Mag. Claudia KRAL-BAST as assessors on the complaint of the Roman XXXX, represented by SUMMER SCHERTLER KAUFMANN Rechtsanwälte GmbH, against the decision of the data protection authority dated June 1st, 2023, Zl . D124.1115/23 2023-0.371.518, rightly recognized:

A)

The complaint is upheld in accordance with Section 28 Paragraph 2 of the Administrative Court Procedure Act, Federal Law Gazette I No. 33/2013 as amended (VwGVG) and the contested decision is repealed without replacement. The complaint is upheld in accordance with Section 28, Paragraph 2, Administrative Court Procedure Act, Federal Law Gazette Part One, No. 33 from 2013, as amended (VwGVG) and the contested decision is repealed without replacement.

B)

The revision is permissible in accordance with Article 133, Paragraph 4, B-VG.The revision is permitted in accordance with Article 133, Paragraph 4, B-VG.

text

Reasons for the decision:

I. Procedural courseRoman one. Procedural course

1. In his complaint dated May 15, 2023, addressed to the data protection authority (DSB, the authority concerned before the Federal Administrative Court), the complainant alleged a violation of the right to information in accordance with Art. 15 GDPR by XXXX (a party involved in the proceedings before the Federal Administrative Court). 1. In his complaint dated May 15, 2023, addressed to the data protection authority (DSB, the authority concerned before the Federal Administrative Court), the complainant alleged a violation of the right to information in accordance with Article 15 of the GDPR by Roman XXXX (participating party in the proceedings before the Federal Administrative Court). .

It was alleged that the complainant played online gambling on the website of the party involved. The complainant sent an email request to the party involved to grant him the right to information. The requested information was directed to all deposits and withdrawals made by the party involved. However, the party involved only submitted lists of deposits and withdrawals for the last six months. The information was therefore incomplete and the party involved had therefore violated the right to information, which is why the complainant requested that the relevant authority determine that his rights had been violated.

The data protection complaint was accompanied by the complainant's request for information to the co-involved party dated January 23, 2023, the information provided by the co-involved party dated February 21, 2023, and correspondence from the co-involved party to the complainant's legal representation.

2. With the contested decision, the authority concerned suspended the proceedings against the party involved until the decision of the lead supervisory authority or the European Data Protection Board.

The reasons given were that the complaint in question concerned a matter which, within the meaning of Articles 56 and 60 of the GDPR, was not subject to the sole jurisdiction of the authority concerned. According to Article 56 Paragraph 1 of the GDPR, the lead responsibility lies with the supervisory authority in whose district the party involved has its main branch or only branch. In the present proceedings, this is the supervisory authority of Malta. In accordance with Article 56 Paragraph 1 of the GDPR in conjunction with Section 24 Paragraph 10 No. 2 of the DSG, the authority concerned has to act ex officio for the duration of the procedure for identifying a lead supervisory authority and during the lead responsibility of a supervisory authority in accordance with Article 56 or Article 60 of the GDPR to suspend the complaint procedure in accordance with Section 24 DSG. The times in proceedings to determine a lead supervisory authority or before a lead supervisory authority would not be included in the deadline in accordance with Section 73 AVG. According to the ruling, the complaint procedure was to be suspended until the lead supervisory authority or the European Data Protection Board determined or made a decision. The reasons given were that the complaint in question concerned a matter which, within the meaning of Articles 56 and 60 of the GDPR, was not subject to the sole jurisdiction of the authority concerned. According to Article 56, paragraph one, GDPR, the lead responsibility lies with the supervisory authority in whose district the party involved has its headquarters or only branch. In the present proceedings, this is the supervisory authority of Malta. The authority concerned has, in accordance with Article 56, paragraph one, GDPR in conjunction with paragraph 24, paragraph 10, number 2, DSG, for the period of the procedure for determining a lead supervisory authority and during the lead responsibility of a supervisory authority in accordance with Article 56 or Article 60, DSGVO to suspend the complaint procedure ex officio in accordance with Section 24, DSG. The times in proceedings to determine a lead supervisory authority or before a lead supervisory authority would not be included in the deadline according to paragraph 73, AVG. According to the ruling, the complaint procedure was to be suspended until the lead supervisory authority or the European Data Protection Board determined or made a decision.

3. The complainant lodged a timely complaint against this decision with the Federal Administrative Court in a letter dated July 5, 2023.

It stated (after repeating the facts and presenting them in the official proceedings) that the prerequisites for a notice of suspension in the present proceedings were not met. The authority concerned violated its obligation to deal with the data protection complaint, since only one data subject from Austria, namely the complainant, was significantly affected within the meaning of Article 56 (2) GDPR, so that the authority concerned was therefore solely concerned with the data protection complaint must deal with the data protection complaint lodged with it, regardless of whether another supervisory authority is the “lead supervisory authority” within the meaning of the GDPR. It stated (after repeating the facts and presenting them in the official proceedings) that the prerequisites for a notice of suspension in the present proceedings were not met. The authority concerned violated its obligation to deal with the data protection complaint, since only one affected person from Austria, namely the complainant, was significantly affected within the meaning of Article 56, Paragraph 2, GDPR, so that the authority concerned was solely concerned with the data protection complaint must deal with the data protection complaint lodged with it, regardless of whether another supervisory authority is the “lead supervisory authority” within the meaning of the GDPR.

In addition, the provision of Section 24 Para. 10 Z 2 DSG cited by the authority concerned in the decision merely stipulates the suspension of the deadline. However, there is no legal basis for suspending the proceedings. The provision of Section 38 AVG is also not applicable in the present case; the applicability in relation to a procedure for determining the lead supervisory authority in accordance with Article 56 GDPR fails because of the decision of another court or authority that is binding for the authority concerned. At the time of the suspension, no other authority or court was authorized to make a binding decision for the authority concerned as to whether it or which supervisory authority is responsible for the complaint submitted to it. The authority concerned was therefore prevented - at this stage of the procedure - from suspending the proceedings in accordance with Section 38 AVG. Furthermore, it should be noted that Article 60 of the GDPR does not norm the sole responsibility of the supervisory authority of the main branch or the only branch for the processing of the procedure and (content-related) decision-making, but rather a cooperation in which all relevant information is to be exchanged between each other, which is why a suspension of the Proceedings are also not taken into consideration in this respect. In addition, the provision of paragraph 24, paragraph 10, number 2, DSG, cited by the authority concerned in the decision, only stipulates the suspension of the deadline. However, there is no legal basis for suspending the proceedings. The provision of paragraph 38, AVG is not applicable in the present case, the applicability in relation to a procedure for determining the lead supervisory authority according to Article 56, GDPR already fails because of the binding decision of another court or authority for the authority concerned. At the time of the suspension, no other authority or court was authorized to make a binding decision for the authority concerned as to whether it or which supervisory authority was responsible for the complaint lodged with it. The authority concerned was therefore prevented - at this stage of the procedure - from suspending the proceedings in accordance with paragraph 38 of the AVG. Furthermore, it should be noted that Article 60 of the GDPR does not norm the sole responsibility of the supervisory authority of the main branch or the only branch for the processing of the procedure and (content-related) decision-making, but rather a cooperation in which all relevant information is to be exchanged between each other, which is why a suspension of the Proceedings are also not taken into consideration in this respect.

The decision should therefore be repealed in any case.

4. The authority concerned did not make use of the option of a preliminary decision on the complaint, submitted the complaint and the associated administrative act to the Federal Administrative Court for a decision and issued a statement in which it stated, among other things, that, contrary to the complainant's opinion, the authority concerned dealt with the I dealt with the complaint promptly. Although the procedure was suspended by decision, the complaint was sent to the responsible supervisory authority (Malta). The lead supervisory authority has already announced that this is based on its responsibility. The requirements of Article 56 (2) GDPR are not met; as can be seen from the wording of Article 56 (3) GDPR, (subsidiary) jurisdiction of the authority concerned only comes into consideration if the lead supervisory authority makes the decision , not to deal with the case. In the present case, however, the lead supervisory authority decided to deal with the case. The complaint is therefore disputed in its entirety and the authority concerned refers in its entirety to the contested decision.4. The authority concerned did not make use of the option of a preliminary decision on the complaint, submitted the complaint and the associated administrative act to the Federal Administrative Court for a decision and issued a statement in which it stated, among other things, that, contrary to the complainant's opinion, the authority concerned dealt with the complaint promptly have dealt with. Although the procedure was suspended by decision, the complaint was sent to the responsible supervisory authority (Malta). The lead supervisory authority has already announced that this is based on its responsibility. The requirements of Article 56, Paragraph 2, GDPR are not met. As can be seen from the wording of Article 56, Paragraph 3, GDPR, (subsidiary) jurisdiction of the authority concerned only comes into consideration if the lead supervisory authority makes the decision , not to deal with the case. In the present case, however, the lead supervisory authority decided to deal with the case. The complaint is therefore disputed in its entirety and the authority concerned refers in its entirety to the contested decision.

II. The Federal Administrative Court has considered: Roman II. The Federal Administrative Court has considered:

1. Findings:

The procedure listed under point I. is used as the basis for the findings. The one under point one. The above-mentioned procedure will be used as the basis for the findings.

In a complaint dated May 15, 2023, the complainant alleged a violation of the right to information pursuant to Art. 15 GDPR by the participating party to the relevant authority. In a complaint dated May 15, 2023, the complainant alleged a violation of the right to information pursuant to Article 15 of the GDPR by the participating party to the relevant authority.

With the contested decision, the authority concerned suspended the proceedings against the party involved until the decision of the lead supervisory authority or the European Data Protection Board.

The complainant lodged a timely complaint against this decision with the Federal Administrative Court in a letter dated July 5, 2023.

2. Assessment of evidence:

The findings result from the administrative act and are undisputed.

3. Legal assessment:

To A)

3.1. According to Art. 130 Para. 1 Z 1 B-VG, the administrative courts rule on complaints against the decision of an administrative authority on the grounds of illegality. 3.1. According to Article 130, paragraph one, number one, B-VG, the administrative courts rule on complaints against the decision of an administrative authority on the grounds of illegality.

According to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court decides by single judges, unless federal or state laws provide for the decision by senates. In accordance with Section 27 of the Data Protection Act (DSG) as amended (which essentially corresponds to Section 39 of the Data Protection Act 2000, which was in force until May 24, 2018), the Federal Administrative Court decides in proceedings on complaints against notices due to violations of the obligation to provide information in accordance with Section 24 Paragraph 7 and the decision-making obligation of the Federal Administrative Court Data protection authority by Senate. The Senate consists of a chairman and an expert lay judge from the employer and employee circles. According to paragraph 6, Federal Administrative Court Act (BVwGG), the Federal Administrative Court decides by single judges, unless federal or state laws provide for the decision by senates. According to paragraph 27, Data Protection Act (DSG) as amended (which essentially corresponds to paragraph 39, DSG 2000, which was in force until May 24, 2018), the Federal Administrative Court decides in proceedings on complaints against notices due to violation of the obligation to provide information in accordance with paragraph 24, paragraph 7 and the Duty of the data protection authority to make decisions by the Senate. The Senate consists of a chairman and an expert lay judge from the employer and employee circles.

The procedure of the administrative courts, with the exception of the Federal Finance Court, is regulated by the Administrative Court Procedure Act (VwGVG) (§ 1 leg.cit.). According to Section 58 Paragraph 2 VwGVG, conflicting provisions that were already announced at the time this federal law came into force remain in force. The procedure of the administrative courts, with the exception of the Federal Finance Court, is regulated by the Administrative Court Procedure Act (VwGVG) (paragraph one, leg.cit.). According to paragraph 58, paragraph 2, VwGVG, conflicting provisions that were already announced at the time this federal law came into force remain in force.

According to § 17 VwGVG, unless otherwise provided in this federal law, the provisions of the AVG with the exception of §§ 1 to 5 as well as Part IV and others apply to the complaint procedure in accordance with Article 130 Paragraph 1 B-VG to apply the laws mentioned (not relevant in the present case) and, moreover, those procedural provisions in federal or state laws that the authority applied or would have applied in the proceedings preceding the proceedings before the administrative court. According to paragraph 17, VwGVG, unless otherwise provided in this federal law, the procedures for complaints in accordance with Article 130, paragraph one, B-VG are subject to the provisions of the AVG with the exception of paragraphs one to 5 as well as Roman Part IV and others to apply the laws specified in more detail (not relevant in the present case) and, moreover, those procedural provisions in federal or state laws that the authority applied or would have had to apply in the proceedings preceding the proceedings before the administrative court.

According to Section 28 Paragraph 1 VwGVG, the administrative court must settle the case through a ruling unless the complaint is rejected or the proceedings are discontinued. According to Section 31 Paragraph 1 VwGVG, the decisions and orders are made by resolution unless a finding is required. According to paragraph 28, paragraph one, VwGVG, the administrative court has to settle the case by means of a finding, unless the complaint is rejected or the proceedings are discontinued is. According to paragraph 31, paragraph one, VwGVG, decisions and orders are made by resolution unless a finding has to be made.

According to Section 28 Paragraph 2 VwGVG, the administrative court itself has to decide on complaints in accordance with Article 130 Paragraph 1 Z 1 B-VG if the relevant facts are established or the determination of the relevant facts by the administrative court itself is in the interest of the speed or is associated with significant cost savings. According to paragraph 28, paragraph 2, VwGVG, the administrative court itself has to decide on complaints in accordance with Article 130, paragraph one, number one, B-VG if the relevant facts are established or the determination of the relevant facts by the administrative court itself is in in the interests of speed or is associated with significant cost savings.

3.2. Regarding the process requirements:

The complaint was filed within the deadline in accordance with Section 7 Paragraph 4 VwGVG and the other procedural requirements were also met. The complaint was filed within the deadline in accordance with Section 7, Paragraph 4, VwGVG and the other procedural requirements were also met.

3.3. Regarding sentence A):

3.3.1. Legal basis:

Section 24 paragraphs 1 and 10 DSG including the heading read: Paragraph 24, paragraph one and 10 DSG including the heading read:

“§ 24 DSG

Complaint to the data protection authority

(1) Every data subject has the right to lodge a complaint with the data protection authority if he or she is of the opinion that the processing of personal data concerning him or her violates the GDPR or Section 1 or Article 2, 1st part. (1) Every data subject has the right to lodge a complaint with the data protection authority if she is of the opinion that the processing of personal data concerning her violates the GDPR or paragraph one or Article 2 1st part.

(10) The following are not included in the decision period in accordance with Section 73 AVG: (10) The following are not included in the decision period in accordance with Section 73 AVG:

1. the time during which the proceedings are suspended until a final decision on a preliminary question is made;

2. the time during a procedure according to Articles 56, 60 and 63 GDPR."2. the time during a procedure according to Articles 56, 60 and 63 GDPR.”

Section 38 Paragraph 1 AVG reads: Paragraph 38, paragraph one, AVG reads:

“§ 38. Unless the law stipulates otherwise, the authority is entitled to assess preliminary questions that arise in the investigation procedure, which would have to be decided as main questions by other administrative authorities or by the courts, based on its own view of the relevant circumstances and to make this assessment its own decision to be taken as a basis. However, it can also suspend the proceedings until the preliminary question has been finally decided if the preliminary question is already the subject of pending proceedings before the competent administrative authority or the competent court or if such proceedings are pending at the same time.

Section 73 Paragraph 1 AVG including the heading reads: Paragraph 73, paragraph one, AVG including the heading reads:

“3. Section: Obligation to make decisions

§ 73. (1) The authorities are obliged, unless otherwise provided in the administrative regulations, to issue the decision on applications from parties (§ 8) and appeals without unnecessary delay, but no later than six months after their receipt. If the applicable legal provisions result in different decision-making deadlines in related procedures (Section 39 Paragraph 2b), the last one is decisive Parties (Section 8) and appeals without unnecessary delay, but at the latest six months after they are received. If the applicable legal provisions result in different decision-making deadlines in related proceedings (Section 39, Paragraph 2 b), the last one is decisive.”

Article 4, paragraphs 21 to 23 of the GDPR read:Article 4, paragraphs 21 to 23 of the GDPR read:

“Art. 4 GDPR

Definitions

21. “supervisory authority” means an independent public body established by a Member State in accordance with Article 51;

22. “supervisory authority concerned” means a supervisory authority that is affected by the processing of personal data because

(a) the controller or processor is established in the territory of the Member State of that supervisory authority,

b) this processing has or may have a significant impact on data subjects residing in the Member State of that supervisory authority or

c) a complaint has been lodged with that supervisory authority;

23. “cross-border processing” either

(a) processing of personal data carried out in more than one Member State in the context of the activities of establishments of a controller or processor in the Union, where the controller or processor is established in more than one Member State, or

(b) processing of personal data which takes place in the context of the activities of a single establishment of a controller or a processor in the Union but which has or may have a significant impact on data subjects in more than one Member State;"

Article 51 paragraphs 1 and 2 GDPR read:Article 51 paragraphs one and 2 GDPR read:

“Art. 51 GDPR

supervisory authority

1. Each Member State shall provide that one or more independent authorities are responsible for monitoring the application of this Regulation in order to protect the fundamental rights and freedoms of natural persons during processing and to facilitate the free movement of personal data within the Union (hereinafter: “Supervisory Authority”).

2. Each supervisory authority shall contribute to the uniform application of this Regulation throughout the Union. 2To this end, the supervisory authorities shall cooperate with each other and with the Commission in accordance with Chapter VII."(2) Each supervisory authority shall contribute to the uniform application of this Regulation throughout the Union. 2For this purpose, the supervisory authorities cooperate with each other and with the Commission in accordance with Chapter Roman VII.”

Article 56 paragraph 1 GDPR reads:Article 56 paragraph one GDPR reads:

“Art. 56 GDPR

Responsibility of the lead supervisory authority

1. Without prejudice to Article 55, the supervisory authority of the main or sole establishment of the controller or processor shall, in accordance with the procedure referred to in Article 60, be the relevant lead supervisory authority for the cross-border processing carried out by that controller or processor."

Article 60 paragraph 1 GDPR reads:Article 60 paragraph one GDPR reads:

“Art. 60 GDPR

Cooperation between the lead supervisory authority and the other supervisory authorities concerned

1. The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article, seeking to reach consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information between themselves.”

Article 65 paragraph 1 GDPR reads:Article 65 paragraph one GDPR reads:

“Art. 65 GDPR

Dispute resolution by the committee

(1) In order to ensure the proper and uniform application of this Regulation in individual cases, the Committee shall adopt a binding decision in the following cases:

(a) where, in a case referred to in Article 60(4), a supervisory authority concerned has lodged a relevant and reasoned objection to a draft decision of the lead supervisory authority and the lead supervisory authority has not joined the objection or has rejected the objection as not relevant or not well-founded. The binding decision concerns all matters that are the subject of the relevant and reasoned objection, in particular the question of whether there has been a violation of this Regulation,

b) if there are conflicting views as to which of the supervisory authorities concerned is responsible for the head office,

(c) where a competent supervisory authority does not seek the opinion of the Committee or does not follow the opinion of the Committee in accordance with Article 64 in the cases referred to in Article 64(1). In this case, any supervisory authority concerned or the Commission may refer the matter to the Committee."

Article 77 paragraph 1 GDPR reads:Article 77 paragraph one GDPR reads:

“Art. 77 GDPR

Right to complain to a supervisory authority

(1) Every data subject shall, without prejudice to any other administrative or judicial remedy, have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or the place of the alleged infringement, if the data subject considers that the processing the personal data relating to them violates this Regulation.”

3.3.2 In this specific case, this means the following:

3.3.2.1. First of all, it should be noted that although the administrative court generally has to apply the law in force at the time the decision or decision is issued, a different approach is required when the legislature expresses in a transitional provision that pending proceedings the previously valid law still applies, or if there is a need to agree on what was lawful on a specific date or in a specific period of time. In order to assess the question of which legal situation should be used, the interpretation of the administrative regulations applicable in the respective case must be taken into account (see VwGH June 25, 2019 Ra 2018/10/0120 mwN).

The assessment of the effectiveness of a procedural act, here the issuance of a suspension notice, is as such to be assessed according to the (procedural) legal situation applicable at the time the procedural act was taken (VwGH October 21, 2004, 99/06/0016), and is therefore for the assessment The legality of the suspension of the proceedings should be based on the situation at the time the suspension decision was issued, i.e. the time of its delivery on June 7, 2023.

3.3.2.2. In the present case, it is undisputed that there is cross-border data processing. The procedure for a complaint from a data subject in connection with (intra-community) cross-border data processing generally consists of three phases. In a first step, the supervisory authorities involved and their respective roles as lead or affected supervisory authorities are determined (Art. 56 GDPR). Each supervisory authority basically determines its own role; However, as part of the general obligation to cooperate in accordance with Article 51 Paragraph 2 Sentence 2 of the GDPR, it is obliged to coordinate with the other supervisory authorities and strive for a consensus (see Polenz in Simits, Hornung, Spiecker, Data Protection Law (2019) Art 65 Rz 16 ). In a second step, the lead supervisory authority carries out the consistency procedure in accordance with Article 60 GDPR and takes a decision on the complaint - which is binding for all supervisory authorities in the absence of an objection from another supervisory authority in accordance with Article 60 Paragraph 4 GDPR (Article 60 Paragraph 6 GDPR). . In the final step, this decision is issued by the supervisory authority to which the complaint was lodged with regard to negative or negative points in the decision against the complainant (Article 60 (8) GDPR). The complainant will be informed about the content of other points by the supervisory authority to which the complaint was submitted (Art. 60 Para. 7 GDPR).3.3.2.2. In the present case, it is undisputed that there is cross-border data processing. The procedure for a complaint from a data subject in connection with (intra-community) cross-border data processing generally consists of three phases. In a first step, the supervisory authorities involved and their respective roles as lead or affected supervisory authorities are determined (Article 56, GDPR). Each supervisory authority basically determines its own role; However, as part of the general obligation to cooperate according to Article 51, Paragraph 2, S 2 GDPR, it is obliged to coordinate with the other supervisory authorities and to strive for a consensus see Polenz in Simits, Hornung, Spiecker, Data Protection Law (2019) Article 65, paragraph 16 ). In a second step, the lead supervisory authority carries out the consistency procedure in accordance with Article 60, GDPR and takes a decision on the complaint - which, in the absence of an objection from another supervisory authority, is binding for all supervisory authorities in accordance with Article 60, paragraph 4, GDPR (Article 60, paragraph 6, GDPR) . In the final step, this decision is issued by the supervisory authority to which the complaint was lodged with regard to dismissive or negative rulings against the complainant (Article 60, Paragraph 8, GDPR). The complainant will be informed about the content of other points by the supervisory authority to which the complaint was submitted (Article 60, paragraph 7, GDPR).

If the supervisory authorities involved do not agree on, among other things, their respective jurisdiction or the content of the decision, a dispute resolution procedure can be initiated as an interim step in accordance with Art. 65 GDPR. In this case, the European Data Protection Board makes a binding decision on the disputed issue for the respective supervisory authorities (for clarification of questions of jurisdiction, see also Polenz in Simits, Hornung, Spiecker, Data Protection Law (2019) Art 56 Rz 9 and Art 65 Rz 13 ff; also Klabunde in Ehmann /Selmayr, General Data Protection Regulation² (2018) Art 65 Rz 9).If the supervisory authorities involved do not agree on, among other things, their respective jurisdiction or the content of the decision, a dispute resolution procedure can be initiated as an intermediate step in accordance with Article 65, GDPR. In this case, the European Data Protection Board makes a binding decision on the disputed issue for the respective supervisory authorities (for clarification of questions of jurisdiction, see also Polenz in Simits, Hornung, Spiecker, Data Protection Law (2019) Article 56, paragraph 9 and Article 65, paragraph 13 ff; also Klabunde in Ehmann/Selmayr, General Data Protection Regulation² (2018) Article 65, Rz 9).

The authority concerned states in the contested decision that in accordance with Article 56 Para. 1 GDPR in conjunction with Section 24 Para. 10 Z 2 DSG for the period of the procedure to determine a lead supervisory authority and during the lead responsibility of a supervisory authority in accordance with Article 56 or Art 60 DSGVO, the complaint procedure must be suspended ex officio in accordance with Section 24 DSG. The authority concerned states in the contested decision that in accordance with Article 56, paragraph one, GDPR in conjunction with paragraph 24, paragraph 10, number 2, DSG for the period of the procedure for determining a lead supervisory authority and during the lead responsibility of a supervisory authority in accordance with Article 56, or Article 60, GDPR, the complaint procedure must be suspended ex officio in accordance with Section 24, DSG.

However, as the complainant correctly points out in his appeal, Section 24 Paragraph 10 Para. 2 DSG does not contain a legal basis for a suspension of proceedings, but merely stipulates a suspension of the time limit in such a way that "the time during proceedings in accordance with Articles 56, 60 and 63 GDPR" is "not included" in the decision-making period according to Section 73 AVG. However, as the complainant correctly points out in his appeal, paragraph 24, paragraph 10, number 2, DSG does not contain a legal basis for a suspension of proceedings, but merely stipulates a suspension of the time limit in such a way that "the time during proceedings according to Article 56,, 60 and 63 GDPR" is "not included" in the decision-making period according to paragraph 73, AVG.

A suspension according to § 38 AVG is also out of the question: According to the established case law of the Administrative Court, a preliminary question within the meaning of § 38 AVG is to be understood as a legal question that is prejudicial to the decision of the administrative authority and which is considered as the main question by other administrative authorities or by the courts or must also be decided by the same authority, but in a different procedure. Prejudicial - and therefore a preliminary question decision in the procedurally relevant sense - is only a decision which, firstly, concerns a legal question, the answer to which is indispensable for the main question decision, i.e. a necessary basis, and secondly, which regulates this in a manner that is binding on the administrative authority. The fact that the preliminary question must be a question that is to be decided by the other authority as the main question arises from the fact that the special procedural economic meaning of the provision of Section 38 AVG can only be achieved if the other decision, The issue of which is awaited, as a result of which the authority is bound, although such a binding effect only ever has a decision on a main question (cf. recently VwGH June 27, 2019, Ra 2019/02/0017, mwN). There is also a suspension according to paragraph 38 , AVG not considered: According to the established jurisprudence of the Administrative Court, a preliminary question within the meaning of paragraph 38, AVG is to be understood as a legal question which is prejudicial to the decision of the administrative authority and which is considered as the main question by other administrative authorities or by the courts or even by the same authority, However, it must be decided in a different procedure. Prejudicial - and therefore a preliminary question decision in the procedurally relevant sense - is only a decision which, firstly, concerns a legal question, the answer to which is indispensable for the main question decision, i.e. a necessary basis, and secondly, which regulates this in a manner that is binding on the administrative authority. The fact that the preliminary question must be a question that is to be decided by the other authority as the main question arises from the fact that the special procedural economic meaning of the provision of paragraph 38 AVG can only be achieved if the other decision , the issue of which is awaited, subsequently binds the authority, although such a binding effect only ever has a decision on a main question (see recently VwGH June 27, 2019, Ra 2019/02/0017, mwN).

The applicability of Section 38 of the AVG in relation to a procedure for determining the lead supervisory authority in accordance with Article 56 of the GDPR already fails due to the binding decision of another court or authority for the authority concerned: The applicability of Section 38 of the AVG in relation to a procedure to determine the lead supervisory authority in accordance with Article 56, GDPR, the decision of another court or authority that is binding for the authority concerned fails:

At the time of suspending the administrative procedure, the authority concerned had to decide whether it or which supervisory authority had primary responsibility for the complaint lodged with it; A dispute resolution procedure in accordance with Article 65 of the GDPR, in which the European Data Protection Board could have made a binding decision on this issue for the authority concerned, was not initiated. At the time of the suspension, no other authority or court was authorized to make a binding decision for the authority concerned as to whether it or which supervisory authority was responsible for the complaint lodged with it. The authority concerned was therefore prevented - at this stage of the procedure - from suspending the proceedings in accordance with Section 38 AVG. At the time of suspending the administrative procedure, the authority concerned had to decide whether it or which supervisory authority was responsible for the complaint lodged with it ; A dispute resolution procedure in accordance with Article 65 of the GDPR, in which the European Data Protection Board could have made a binding decision on this issue for the authority concerned, was not initiated. At the time of the suspension, no other authority or court was authorized to make a binding decision for the authority concerned as to whether it or which supervisory authority was responsible for the complaint lodged with it. The authority concerned was therefore prevented – at this stage of the proceedings – from suspending the proceedings in accordance with Paragraph 38, AVG.

The question of the extent to which a consistency procedure according to Art. 60 GDPR or a dispute resolution procedure according to Art. 65 DSGVO could justify a suspension according to Section 38 AVG did not need to be addressed further by the sentencing court because the procedures eligible for a suspension were at the time of the Suspension should have already been initiated or should have been initiated at the same time as the suspension and at the time the suspension decision was issued neither procedures under Article 60 nor Article 65 of the GDPR had been or had been initiated. Furthermore, it should be noted that - as the complainant also correctly points out - Article 60 of the GDPR does not norm the sole responsibility of the supervisory authority of the main branch or the only branch for the processing of the procedure and (content-related) decision-making, but rather a cooperation in which all relevant information is shared between each other should be exchanged, which is why a suspension of the procedure is not an option. The sentencing court did not need to go into further detail on the question of the extent to which a consistency procedure under Article 60, GDPR or a dispute resolution procedure under Article 65, GDPR could justify a suspension under Paragraph 38, AVG, because the procedures eligible for a suspension were at the time the suspension should have already been initiated or should have been initiated at the same time as the suspension and neither procedures under Article 60 nor Article 65 of the GDPR had been or had been initiated at the time the suspension decision was issued. Furthermore, it should be noted that - as the complainant also correctly points out - Article 60 of the GDPR does not norm the sole responsibility of the supervisory authority of the main branch or the only branch for the processing of the procedure and (content-related) decision-making, but rather a cooperation in which all relevant information is shared between each other should be exchanged, which is why a suspension of the procedure is not an option.

Against this background, the argument of the authority concerned in its statement on the complaint, according to which the requirements of Article 56 Para. 2 GDPR were not met in the present case, has no relevance, especially since at the time the suspension decision was issued neither Section 24 Para. 10 Z 2 DSG another legal basis could justify a suspension of the complaint procedure. Against this background, the argument of the authority concerned in its statement on the complaint, according to which the requirements of Article 56, paragraph 2, GDPR were not met in the present case, is of no relevance, especially since at the time the suspension decision was issued, neither paragraph 24, paragraph 10, paragraph 2, DSG, another legal basis could justify a suspension of the complaint procedure.

The complaint was therefore upheld and the contested decision was to be repealed without replacement.

3.4. Regarding the cancellation of an oral hearing:

According to Section 24 Paragraph 1 VwGVG, the administrative court must, upon request or if it deems it necessary, conduct a public oral hearing ex officio. According to paragraph 24, paragraph one, VwGVG, the administrative court has upon request or if it deems this necessary considers to hold a public oral hearing ex officio.

In the present case, the facts of the case were clarified from the file. It was not necessary to use further evidence to clarify the matter.

In this case, the Federal Administrative Court has to rule exclusively on a legal question (cf. ECHR June 20, 2013, Appl. No. 24510/06, Abdulgadirov/AZE, paragraph 34 ff.). Even according to the jurisprudence of the Constitutional Court, an oral hearing can be omitted if the facts are undisputed and the legal question is not particularly complex (VfSlg. 17.597/2005; VfSlg. 17.855/2006; most recently VfGH June 18, 2012, B 155/12). In this case, the Federal Administrative Court has to rule exclusively on a legal question see ECHR June 20, 2013, Appl. No. 24510/06, Abdulgadirov/AZE, Rz 34 ff.). Even according to the jurisprudence of the Constitutional Court, an oral hearing can be omitted if the facts are undisputed and the legal question is not particularly complex (VfSlg. 17.597/2005; VfSlg. 17.855/2006; most recently VfGH June 18, 2012, B 155/12).

It was therefore not necessary to hold an oral hearing.

Regarding B) Admissibility of the revision:

According to Section 25a Paragraph 1 VwGG, the administrative court must state in its ruling or decision whether the appeal is permissible in accordance with Article 133 Paragraph 4 B-VG. The statement needs to be briefly justified. According to paragraph 25 a, paragraph one, VwGG, the administrative court must state in its ruling or decision whether the appeal is permissible in accordance with Article 133, paragraph 4, B-VG. The statement needs to be briefly justified.

The appeal is permissible because a legal question had to be resolved that is of fundamental importance within the meaning of Article 133 Paragraph 4 B-VG. There is a lack of jurisprudence from the Administrative Court on the legality of an administrative suspension of a procedure until the lead supervisory authority has been determined/until the decision of the lead supervisory authority or the European Data Protection Board has been made. The appeal is permissible because a legal question had to be resolved, which is of fundamental importance of Article 133, Paragraph 4, B-VG. There is a lack of case law from the Administrative Court on the legality of an administrative suspension of a procedure until the lead supervisory authority has been determined/until the decision of the lead supervisory authority or the European Data Protection Board has been made.