BVwG - W176 2245174-l/3E

BVwG - W176 2245174-l/3E
Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	§ 24(4) DSG
Decided:	22.06.2022
Published:
Parties:	Osterreichische Post AG (controller)
National Case Number/Name:	W176 2245174-l/3E
European Case Law Identifier:
Appeal from:	DSB (Austria) ZI. D205.543, 2020-0.168.430
Appeal to:	Unknown
Original Language(s):	[[:Category:|]] [[Category:]]
Original Source:	[ (in )]
Initial Contributor:	MW

The Austrian Federal Administrative Court annulled a decision by the Austrian DPA and referred it back to investigate whether the data subject's right to file a complaint had actually expired as the controller claimed.

English Summary

Facts

The data subject submitted an access request to the controller, Osterreichische Post AG, and she received a letter in response dated 10.12.18. The data subject submitted a complaint to the Austrian DPA (DSB) on 18.02.20 alleging that the controller's processing of her personal data violated her right to privacy and that the response she received to her request was incomplete and thus violated her right to access her personal data.

The DPA rejected the data subject's complaint on the grounds that her right to file a complaint had expired per § 24(4) DSG because more than a year had elapsed between the time she discovered the alleged violation and the time she filed her complaint.

The data subject appealed on the grounds that the violation of her right to privacy had continued until 13.11.19 when her personal data were deleted by the controller. The controller admitted in a letter to the DPA that the last of its marketing data had been deleted on 13.11.19, but claimed the complainant data subject's personal data had been deleted almost a year earlier on 13.12.18.

Holding

The Federal Adminstrative Court annulled the contested decision and remanded the matter back to the DPA to investigate whether the alleged infringement had ended on 13.11.19 as the data subject claimed or on 13.12.18 as the controller claimed. Whether the data subject's right to file a complaint had expired depended on the answer.

Comment

This decision falls into a line of a cases where the BVwG has had to refer matters back so that the DSB properly invesitgates the underlying facts. Also, it's doubtful that § 24(4) DSG is in line with Article 77 GDPR or even applicable.

Further Resources

A pdf of the decision: File:BVwG - W176 2245174-l 3E.pdf

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

[Provided: 23.06.2022 08:15]
BVwG
Federal Administrative Court
Republic of Austria
Postal address: Erdbergstra e 192 - 196
1030Vienna Tel: +43 1 60149 - 0
Fax: +43 1 711 23-889 15 41
E-mail: einlaufstelle@bvwg.gv.at
www.bvwg. gv. at
DECISION
The Federal Administrative Court, by Judge NEWALD as presiding judge and the expert lay judge MAYER-HAINZ and the expert lay judge BOGENDORFER as associate judge, decided on the appeal of
- represented by Robert HAUPT, LL.M., lawyer, against the decision of the
Data Protection Authority of 19.05.2021, ZI. D205.543, 2020-0.168.430 (co-participating party: Osterreichische Post AG), due to the rejection of a data protection complaint concerning a violation of the right to confidentiality:
A)
The contested decision is annulled pursuant to § 28 para 3 2nd sentence VwGVG and the matter is referred back to the data protection authority for the issuance of a new decision.
B)
The appeal is not admissible under Article 133(4) of the Federal Constitution.
Reasoning:
I. Course of proceedings
1. When the current complainant asked what data the co-owner was storing about her, the co-owner provided her with information in a letter dated 10 December 2018.
Business Number (GZ):
W176 2245174-l/3E
(please quote for all entries)
-2-
2. In her data protection complaint of 18 February 2020 to the data protection authority ("the
authority concerned"), the complainant complained of a violation of her rights to information
and confidentiality. In essence, she argued that the information of 10 December 2018 did not
meet the legal requirements and that her right to confidentiality had been violated by the
processing of the information, which had come as a surprise to her. However, she had only
become aware of the specific violation after discussing the facts with her lawyer.
3. By procedural order of 28 July 2020, the data protection authority separated the
complaint for violation of the right to secrecy and information pursuant to section 39(2) AVG
into two separate proceedings on the grounds of expediency and simplicity.
4. In the contested decision, it rejected the data protection complaint only on the grounds of
violation of the right to confidentiality.
In essence, it held that the complainant's claim had expired due to the expiry of the one-year
preclusion period stipulated in section 24(4) of the Data Protection Act (DPA).
5. The complainant filed an appeal against this decision in due time in a written statement
dated 16 June 2021 pursuant to Art. 130 para. 1 line 1 of the Federal Constitution.
In summary, it argues that the contested decision was wrongly issued, as the preclusion
period under section 24(4) of the Data Protection Act, which was invoked by the authority
concerned, had not yet expired at the time the data protection complaint was lodged.
This was because the infringement complained of had taken place in the form of a permanent
condition, so that the period mentioned could not have begun before the permanent condition
had ended (reference to BVwG 15.04.2020, W211 2219095-1). The cease-and-desist
declaration and undertaking of the co-participants of 17 May 2021 showed that the so-called
Sinus Geo Milieus (data) had only been deleted on 13 November 2019 and had been
unlawfully processed until then.
This meant that the subjective time limit of one year for filing a data protection complaint had
not yet expired on 18 February 2020.
6. Thereupon, in a letter dated 18 June 2021, the authority concerned sent the coparticipants
- without any reference to the submitted official complaint - the data protection
complaint described under point 2. for their comments, in particular
- 3 -
with the request to state whether and when the complainant's case-related data had been
cancelled or whether it was true that these data had been cancelled on 13 November 2019.
7. In a written statement dated 25 June 2021, the co-participant stated that it had deleted
all marketing classifications (including Sinus-Geo-Milieus) from its marketing database
step by step in 2019, at the latest by 13 November 2019 (physically). All Sinus Geo-Milieus
had been physically deleted from the marketing database of the co-participant on
13.11.2019. Currently, the co-participant does not process marketing classifications
(except for the purposes of asserting, exercising or defending legal claims). However, the
Sinus Geo-Milieus attributed to the complainant's data set had already been deleted on 13
December 2018, of which the complainant had been informed by e-mail of 13 December
2018 (attached to the opinion).
8. In a written statement of 6 August 2021, the authority submitted the complaint, together
with the related administrative documents, to the Federal Administrative Court for a decision,
whereby it requested that the complaint be dismissed. In doing so, it commented on the
complaint to the effect that it had initiated additional investigations as a result of the complaint,
whereby the co-participant disputed the timeliness of the filing of the data protection
complaint. Since, in view of the conflicting statements of the complainant and the coparticipants,
the authority did not assume that a final decision could be reached by means of a
preliminary decision on the complaint, it was not necessary to issue a preliminary decision on
the complaint.
II. The Federal Administrative Court considered:
1. Findings
The Federal Administrative Court based its decision on the facts of the case as described
under point I.
2. Admissibility of evidence
The findings result from the administrative documents submitted and are not disputed
between the parties to the proceedings.
-4-
3. Legal assessment
3.1. Re point A):
3.1. Pursuant to Art. 130 para. 1 z 1 B-VG, the administrative courts shall rule on appeals
against the decision of an administrative authority on grounds of illegality.
Pursuant to section 6 of the Federal Administrative Court Act (BVwGG), the Federal
Administrative Court decides by single judges, unless federal or provincial laws provide for
decisions by senates. In the absence of a special regulation on a specific subject matter, there
is therefore a single-judge status.
The procedure of the administrative courts, with the exception of the Federal Finance Court, is
governed by the Administrative Court Procedure Act (VwGVG) (§ 1 leg.cit.). Pursuant to § 58
para 2 VwGVG, conflicting provisions that have already been promulgated at the time of the
entry into force of this Federal Act shall remain in force.
Pursuant to § 17 VwGVG, unless otherwise provided for in this Federal Act, the provisions of
the AVG, with the exception of §§ 1 to 5 and Part IV, as well as other closely mentioned laws
(not relevant in the present case) and, moreover, those procedural provisions in Federal or
Land laws which the authority applied or had applied in the proceedings before the
Administrative Court preceding the proceedings, shall apply mutatis mutandis to the
proceedings on appeals pursuant to Art. 130 para 1 B-VG.
3.2. On the process requirements:
The appeal was filed in due time pursuant to section 7 (4) VwGVG and the other procedural
requirements are also met.
3.3. To the point:
3.3.1. Legal position:
3.3.1.1. § Section 24 (1) and (4) of the FADP read as follows:
Any data subject shall have the right to lodge a complaint with the data protection authority if
he or she considers that the processing of personal data concerning him or her infringes the
GDPR or Article 1 or Article 2, first indent".
- 5 -
(4) The right to have a complaint dealt with shall lapse if the person lodging the complaint
does not do so within one year of becoming aware of the event giving rise to the complaint,
but at the latest within three years of the event alleged to have taken place. Late complaints
shall be rejected. "
In the case of "continued damage" due to unlawful permanent conditions, both the subjective
one-year and the objective three-year preclusive period do not begin to run before the end of
this permanent condition (cf. BVwG 15.04.2020, W211 2219095-1 a.o. the - on the provision
of § 34 para. 1 DSG 2000 - E OGH 25.09.2017, 6 Ob 217/16d as well as the materials on § 34
para. 1 DSG 2000 [BGBI I 1999/165; ErlautRV 1613 BlgNR 20. GP 50], see also
Thiele/Wagner, Praxiskommentar zum DSG, § 24, Rz 306 ff. )
3.3.1.2. § 28 para. 3, 2nd sentence VwGVG reads:
If the authority has omitted to investigate the facts of the case, the administrative court may
set aside the contested decision by order and refer the matter back to the authority for the
issuance of a new decision.
Pursuant to § 28 para 3, 3rd sentence VwGVG, the authority is bound by the legal
assessment on which the administrative court based its decision.
A referral of the case back to the administrative authority to carry out necessary investigations
pursuant to § 28 para. 3, second sentence VwGVG is possible in the case of blatant or
particularly serious investigative errors, in particular if the administrative authority has omitted
any necessary investigative activity, if it has only taken completely unsuitable investigative
steps to determine the relevant facts or has only made rudimentary investigations. The same
applies if concrete indications lead to the assumption that the administrative authority will
carry out (for example difficult) investigations so that these can then be carried out by the
administrative court (VwGH 26.06.2014, Ro 2014/03/0063).
3.3.2. Based on the facts of the case and the legal situation described, there are particularly
serious deficiencies in the administrative procedure in the sense mentioned above in the
present case:
This is because, as the statements of the authority concerned presented under point 1.8.
show, it also assumes that the legal infringement alleged by the complainant exists in the
form of a permanent situation, which means that the preclusive periods standardised in
Section 24 (4) of the Data Protection Act can only begin to run once this permanent situation
has ended.
- 6 -
Nevertheless, the authority concerned rejected the complainant's data protection complaint
regarding the alleged violation of the right to secrecy under Section 24 (4) of the Data
Protection Act without first investigating the question of when the aforementioned permanent
status ended (by deleting the data in question). It only submitted the data protection complaint
to the co-participant in view of the statements on the above-mentioned problem made in the
official complaint.
Due to the lack of the investigations/findings in the administrative proceedings on these
questions of fact, which are important here, the facts of the case, which are necessary for a
decision of the Federal Administrative Court on the merits, are not established: The contested
decision does not contain any findings on the question of when or whether the oats in
question were cancelled and thus the aforementioned preclusive periods began to run. Such
findings were also not made subsequently in the context of a preliminary appeal decision.
In the present case, there are therefore particularly serious deficiencies in the
administrative procedure in the sense mentioned above (on the case of merely rudimentary
investigative activity by the prosecuting authority, cf. e.g. VwGH 17.03.2016, Ra
2015/11/0127 with reference to VwGH 26.06.2014, Ro 2014/03/0063; on the extent of the still
missing investigations, which allow a remedy and referral back, cf. e.g. VwGH 27.04.2017, Ra
2016/12/0071).
3.3.3. It cannot be said that the taking of evidence by the Federal Administrative Court led
to a - considerable - saving of time and costs when viewed as a whole; rather, in a case such
as the present one, the remittal of the matter to the authority concerned serves to complete
the facts of the case quickly and in a cost-saving manner. Against the backdrop of
administrative economic considerations, whereby reference should also be made to the
investigative powers of the supervisory authority pursuant to Art. 58 of the GDPR and the
obligation of data controllers to cooperate with the supervisory authority resulting from Art. 31
of the GDPR, and with a view to the efficiency criteria of Art. 39 Para. 2 AVG, it was therefore
necessary to make use of the possibility of proceeding in accordance with § 28 para. 3,
second sentence VwGVG (annulment of the decision of the prosecuting authority and referral
of the matter back to the same).
3.3.4. In the continued proceedings, the authority concerned will have to make findings - with
due regard to the parties' right to be heard - on the basis of a comprehensible presentation of
evidence, on the basis of which it can be judged whether the claim of the
- 7 -
The decision of the complainant to deal with her data protection complaint pursuant to Section
24 (4) of the Data Protection Act lapsed due to preclusion.
3.4. In accordance with § 24 para. 2 no. 1 VwGVG, the conduct of an oral hearing could be
dispensed with, especially since it was established on the basis of the files that the contested
decision was to be revoked.
3.5. With regard to point B) (inadmissibility of the appeal):
Pursuant to § 25a par. 1 VwGG, the administrative court shall state in the ruling of its decision
or order whether the appeal is admissible pursuant to Art. 133 par. 4 8-VG. The decision shall
be briefly substantiated.
The appeal is inadmissible because no legal question of fundamental importance within the
meaning of Article 133 (4) of the Eighth Constitutional Act was to be assessed.
Rec htsmitteI
Instruction:
An appeal against this decision may be lodged with the Constitutional Court and/or an
ordinary or extraordinary appeal with the Administrative Court within six weeks of service. A
lawyer is required to draft and file a complaint or an appeal.
Any person who considers himself or herself to be the victim of an infringement of a right
guaranteed by the Constitution or of an unlawful general provision shall be entitled to lodge an
appeal with the Constitutional Court. An appeal is admissible if the decision depends on the
resolution of a legal question of fundamental importance.
A complaint shall be lodged with the Constitutional Court. An appeal shall be lodged with the
Federal Administrative Court. Unless otherwise provided by law, a filing fee of € 240 shall be
paid.
An appeal to the Constitutional Court and/or an appeal to the Administrative Court shall no
longer be admissible if it has been expressly waived after the pronouncement or service of the
decision or ruling. The waiver of the appeal to the Constitutional Court shall be effective until
the delivery of the copy of the decision.
-8-
The Federal Administrative Court shall be notified in writing of the decision or ruling, and the Constitutional Court shall be notified in writing or recorded after the copy of the decision or ruling has been served. The Federal Administrative Court shall be notified in writing of the waiver of the appeal or the waiver shall be recorded. If the waiver was not made by or in the presence of a professional party representative, it may be revoked in writing or on record within three days.
FEDERAL ADMINISTRATIVE COURT
Judicial Division W176, on 22.06.2022
Mag. NEWALD (JUDGES)
*!. Y, lig,ht
Signatory
Federal Administrative Court
Daturn/Time
2022-06-23T08:09:37+02:00
Exhibitor certificate
CN=a-sign-corporate-light-02,OU=a-sign-corporate-light-02,O=A-Trust Ges. f. Sicherheitssysteme im elektr. Datenverkehr GmbH,C=AT
Serial no.
1054911121
Note
This document has been officially signed.
Prulinformation
For information on how to apply for the electronic seal or electronic signature, please visit: https:/twww. signatur. rtr.aVde/vd/Pruefung. html
For information on how to print, please visit: https://www.bvwg.gv.aVservice/amtssignatur