BVwG - W256 2234851-1

BVwG - W256 2234851-1

Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 4(4) GDPR Article 15(1)(h) GDPR § 151 Abs. 6 GewO
Decided:	27.09.2023
Published:	17.10.2023
Parties:
National Case Number/Name:	W256 2234851-1
European Case Law Identifier:
Appeal from:
Appeal to:
Original Language(s):	German
Original Source:	BVwG (in German)
Initial Contributor:	co

An Austrian court partially dismissed the decision of the Austrian DPA holding that an address publisher should provide data subjects with meaningful information about the logic involved regarding profiling activities under Article 15(1)(h) GDPR.

English Summary

Facts

On 22 February 2019, a data subject submitted an access request to the controller, a logistics and postal service provider acting in its capacity as an address publisher and direct marketing company, that initially did not answer his request at all. Against this background, the data subject filed a complaint with the DSB. After hearing the controller, the DSB established that it did reply to the access request and it considered the complaint to be without object. In response to this, the data subject claimed that such answer was incomplete, as it did not receive information about the data recipients and of the existence of profiling. The DSB thus considered the complaint anew, as the claimed infringement changed to incomplete provision of information under Article 15 GDPR. In its submissions, the controller held that it did provide information about the categories of recipients and it did not inform the data subject about profiling, as it did not carry out such activities.

The DSB partially admitted the complaint, holding that the controller infringed the data subject’s right to access as it did not provide sufficient information as to the data recipients, without explaining why providing such information would affect her protected interest as an address publisher. It also held that the controller failed to provide meaningful information about the logic involved and the scope and effects of processing according to Article 15(1)(h) GDPR as regards the marketing classification, which is to be considered “profiling” under Article 4(4) GDPR. The DSB thus ordered the controller to duly inform the data subject about the above mentioned within a period of four weeks.

The controller still believed the information it provided to be complete, since it lawfully chose to provide information about the categories of recipients and not the recipients themselves and it considered that marketing classifications do not constitute personal data, which are also not determined via profiling. The controller thus appealed the DSB decision before the BVwG.

However, on 9 March 2023, before the BVwG issued its final judgment, the controller submitted that, given some recent case-law of the BVwG and of the CJEU, it recognized that its activities as an address publisher constitute profiling within the meaning of Article 4(4) GDPR. In line with case C-154/21 the controller also provided the data subject with information about the specific recipients of her personal data. However, it still claimed that the obligations of Article 15(1)(h) GDPR do not apply to its activities as it does not engage in automated-decision-making under Article 22(2) GDPR. The controller submitted that the scope and effects of the marketing classifications are defined in the Austrian Commercial Code (Gewerbeordnung, GewO) and they are only used to set target groups for third party marketing purposes and they help selecting the addresses where higher response rates to advertisement are expected in order to increase advertisement accuracy.

Holding

With respect to the data subject’s access request as regards the data recipients, the BVwG held that the controller had eventually complied with its obligation under Article 15 GDPR.

As far as the provision of meaningful information about the logic involved and the scope and effects of the processing via profiling, the BVwG first of all assessed that marketing information clearly constitutes personal data as per Article 4(1) GDPR. Equally so, that processing of such information constitutes profiling under Article 4(4) GDPR.

Further the BVwG assessed the controller’s submission that it does not take automated decisions within the meaning of Article 22 GDPR and must not comply with the obligation of Article 15(1)(h) GDPR. The BVwG held that, even though under Article 15(1)(h) GDPR it can be understood that a controller has to inform a data subject about the existence of automated decision-making including profiling, it is clear from the wording of the second part of the sentence that further information about the logic involved must be provided only or “at least in those cases” mentioned in Article 22(1) GDPR and Article 22(4) GDPR. In the case at hand, so the BVwG, it did not appear from the submissions of the controller that it adopts any decisions producing legal or similarly significant effects on the data subject.

Hence, the BVwG concluded that the controller did not fail to provide any information under Article 15 GDPR to the data subject.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Decision date

September 27, 2023

standard

B-VG Art 133 Paragraph 4
GDPR Art 15
GDPR Art 22
GDPR Art4
GewO 1994 §151

B-VG Art. 133 today B-VG Art. 133 valid from January 1st, 2019 to May 24th, 2018 last changed by Federal Law Gazette I No. 138/2017 B-VG Art. 133 valid from January 1st, 2019 last changed by Federal Law Gazette I No. 22/2018 B-VG Art. 133 valid from May 25th, 2018 to December 31st, 2018 last changed by Federal Law Gazette I No. 22/2018 B-VG Art I No. 164/2013 B-VG Art by BGBl amended by BGBl. No. 211/1946 B-VG Art. 133 valid from December 19, 1945 to December 24, 1946 last amended by StGBl. No. 4/1945 B-VG Art. 133 valid from January 3, 1930 to June 30, 1934

GewO 1994 § 151 today GewO 1994 § 151 valid from May 25th, 2018 last amended by BGBl 1994 § 151 valid from August 1, 2002 to February 26, 2008 last amended by Federal Law Gazette I No. 111/2002 GewO 1994 § 151 valid from March 19, 1994 to July 31, 2002

saying

W256 2234851-1/12E

IN THE NAME OF THE REPUBLIC!

The Federal Administrative Court has judge Mag. Caroline Kimm as chairman, the expert lay judge Dr. Claudia Rosenmayr-Klemenz and the expert lay judge Mag. Adriana Mandl as assessors on the complaint by XXXX, represented by Schönherr Rechtsanwälte GmbH in 1010 Vienna, Schottenring 19, against ruling points 1 and 2 of the data protection authority's decision of May 28, 2020, DSB-D205 .328 (2020-0.044.944) rightly recognized: The Federal Administrative Court, through the judge Mag. Caroline Kimm as presiding judge, the expert lay judge Dr. Claudia Rosenmayr-Klemenz and the expert lay judge Mag. Adriana Mandl as assessors on the complaint by Roman XXXX, represented by Schönherr Rechtsanwälte GmbH in 1010 Vienna, Schottenring 19, against ruling points 1 and 2 of the data protection authority's decision of May 28, 2020, DSB- D205,328 (2020-0,044,944) rightly recognized:

A) In settling the complaint, points 1 and 2 of the contested decision will be repealed without replacement.

B) The revision is not permitted in accordance with Article 133, Paragraph 4, B-VG.The revision is not permitted in accordance with Article 133, Paragraph 4, B-VG.

text

Reasons for the decision:

I.Roman one. Process:

In his complaint dated May 6, 2019, XXXX alleged a violation of his right to information by the complainant. In an email dated February 22, 2019, he sent the complainant a request for information in accordance with Article 15 of the GDPR, but this has not yet been answered. In his complaint of May 6, 2019, Roman XXXX (hereinafter: co-participant) alleged a violation his right to information from the complainant. In an email dated February 22, 2019, he sent the complainant a request for information in accordance with Article 15 of the GDPR, but this has not yet been answered.

At the request of the authority concerned, the complainant stated in her statement of July 17, 2019 that she had provided information to the co-participant in a letter dated June 11, 2019.

For this purpose, the co-participant was granted a hearing by the relevant authority. At the same time, he was informed that within the meaning of Section 24 (6) DSG, the complainant's reaction meant that he considered his complaint to be irrelevant. To this end, the co-involved party was granted a hearing by the authority concerned. At the same time, he was informed that the complainant's reaction meant that she viewed his complaint as irrelevant within the meaning of Section 24, Paragraph 6, DSG.

In a letter dated August 13, 2019, the co-participant stated that the information provided was incomplete. There would be no information about the recipients of his data or whether any profiling was being carried out - to the extent that this is material here.

In view of these statements, the procedure originally initiated due to the failure to provide information was discontinued by the authority concerned and the complaint dated August 13, 2019, which was viewed as a new complaint due to incomplete information, was sent to the complainant for comment.

The complainant stated that she had already provided information about recipients or categories of recipients and that she had informed the other parties involved about the data transfer to her business customers and thus about the recipient category. There is no obligation to name specific recipients. She cannot provide any information about profiling because she does not carry out any profiling. The affinities listed in the overview table of the information are marketing classifications within the meaning of Section 151 Paragraph 6 GewO and not personal data within the meaning of Article 4 Para. 1 GDPR. The complainant stated that she had already received information about recipients or categories of Recipients and that they informed the parties involved about the data transfer to their business customers and thus about the recipient category. There is no obligation to name specific recipients. She cannot provide any information about profiling because she does not carry out any profiling. The affinities listed in the overview table of the information are marketing classifications within the meaning of paragraph 151, paragraph 6, GewO and not personal data within the meaning of Article 4, paragraph one, GDPR.

The co-participant did not comment on this during the party hearing.

With the contested decision, the complaint was partially upheld and it was determined that the complainant had violated the co-party's right to information by, on the one hand, not disclosing the recipients of the co-party's personal data in the information dated June 11, 2019 and by with regard to the marketing classification, did not provide sufficiently meaningful information about the logic involved or about the scope and intended effects of the processing (point 1). Otherwise, the complainant was ordered to identify the specific recipients of the personal data and to provide the necessary information regarding the creation of marketing classifications within a period of four weeks (point 2). Otherwise, the complaint was dismissed (point 3).

In this regard, the authority concerned stated - if relevant here - in relation to points 1 and 2 that the complainant left open why the disclosure of the business partners affected its legitimate interests as an address publisher. From the fact that address publishers provided data for a fee, it could be concluded that the complainant must have precise knowledge of who the data in question had been passed on to, solely for accounting reasons. Regarding the right to information regarding profiling, it should be stated that the “marketing classifications” are data in accordance with Art. 4 Para. 4 GDPR and in this respect Art. 15 Para. 1 lit. h leg. cit. is relevant. In this case, information about the logic involved does not have to be provided, but meaningful information about the logic involved as well as the scope and intended effects of the processing must be provided. In this regard, the authority concerned stated - if relevant here - in relation to points 1 and 2 that the complainant left open why the disclosure of the business partners affected its legitimate interests as an address publisher. From the fact that address publishers provided data for a fee, it could be concluded that the complainant must have precise knowledge of who the data in question had been passed on to, solely for accounting reasons. Regarding the right to information regarding profiling, it should be stated that the “marketing classifications” are data in accordance with Article 4, paragraph 4, GDPR and in this respect Article 15, paragraph one, Litera h, leg. cit. is relevant. In this case, information about the logic involved does not have to be provided, but meaningful information about the logic involved as well as the scope and intended effects of the processing must be provided.

The present complaint is directed against points 1 and 2 of the contested decision. The information provided to the co-participant was complete and free of defects. As the person responsible, the complainant has the right to choose whether she provides information about recipient categories or specific recipients. Marketing classifications are not personal data and are therefore not subject to the scope of the GDPR. The complainant also provided transparent information about the marketing classifications. These would not be determined through profiling and therefore there is no obligation to provide information in accordance with Article 15 Paragraph 1 Letter h of the GDPR. The present complaint is directed against rulings 1 and 2 of the contested decision. The information provided to the co-participant was complete and free of defects. As the person responsible, the complainant has the right to choose whether she provides information about recipient categories or specific recipients. Marketing classifications are not personal data and are therefore not subject to the scope of the GDPR. The complainant also provided transparent information about the marketing classifications. These would not be determined through profiling and therefore there is no obligation to provide information in accordance with Article 15, paragraph one, letter h, GDPR.

The authority concerned submitted the complaint, including the administrative act, to the Federal Administrative Court and filed a reply.

In its statement of August 1, 2022, the complainant essentially stated in its decision of December 14, 2021, Ro 2021/04/0007 that it did not accept its argument that marketing classifications are not personal data, based on the case law issued in the meantime by the Administrative Court hold up more. In addition, the complainant also recognized that marketing classifications calculated using marketing analysis methods were the results of profiling within the meaning of Article 4, Paragraph 4 of the GDPR and that she had therefore carried out profiling. However, it is an address publisher and direct marketing company and does not make any automated decisions, including profiling, within the meaning of Article 22 (2) GDPR, which is why it has no obligation to provide information in accordance with Article 15 (1) (h) GDPR. The scope and impact of marketing classifications result directly from Section 151 Paragraph 6 GewO. These should and would only be used to define target groups for third-party marketing purposes. These are selectors that would be used to select those addresses where a higher response rate is expected from a list of addresses that would otherwise be advertised in their entirety. This increases the accuracy of the advertising materials. In its statement of August 1, 2022, the complainant essentially stated in its decision of December 14, 2021, Ro 2021/04/0007 that it did not accept its argument that marketing classifications are not personal data, based on the case law issued in the meantime by the Administrative Court hold up more. In addition, the complainant also recognized that marketing classifications calculated using marketing analysis methods were the results of profiling within the meaning of Article 4, Paragraph 4, GDPR and that she had therefore carried out profiling. However, it is an address publisher and direct marketing company and does not make any automated decisions including profiling within the meaning of Article 22, paragraph 2, GDPR, which is why it does not have an obligation to provide information in accordance with Article 15, paragraph one, letter h, GDPR. The scope and impact of marketing classifications result directly from paragraph 151, paragraph 6, GewO. These should and would only be used to define target groups for third-party marketing purposes. These are selectors that would be used to select those addresses where a higher response rate is expected from a list of addresses that would otherwise be advertised in their entirety. This increases the accuracy of the advertising materials.

Due to the judgment of the Court of Justice of the European Union of January 12, 2023, C-154/21, the complainant informed the Federal Administrative Court in a letter dated March 9, 2023 that she had in the meantime provided the co-participant with additional information - which was submitted under one. The specific recipients of the co-participant's data were listed there.

The co-participant did not comment on this - despite repeated requests from the Federal Administrative Court.

II.Roman II. The Federal Administrative Court considered:

1. Findings:

The complainant is a logistics and postal service provider. It has the commercial authority of an address publishing and direct marketing company.

In a letter dated February 22, 2019, the co-participant requested data protection information from the complainant. In it, he requested, among other things, information about the recipients of his data as well as whether profiling had been carried out with regard to his data and, if so, about the logic involved.

In a letter dated June 11, 2019, the complainant provided the co-participant with detailed information about the data processed about him in accordance with Section 151 GewO. It contained, among other things, a list of market information such as “possible target group for advertising organic”, “possible target group for advertising evening entertainment”, “possible target group for advertising investment”, “possible target group for advertising sport”, “possible target group for advertising running”, “ possible phase of life", "possible target group for advertising distance selling" and "mail order buyer", which were evaluated by the complainant in relation to the co-participant, namely the information "possible target group for advertising organic", "possible target group for advertising evening entertainment", "possible Target group for sports advertising” and “possible target group for running advertising” were each rated “yes”. The information “possible target group for advertising investment” was rated “low”. Under “possible phase of life” there was the statement “Young, Free. In a letter dated June 11, 2019, the complainant provided the co-participant with detailed information about the data processed about him in accordance with Section 151, GewO. It contained, among other things, a list of market information such as “possible target group for advertising organic”, “possible target group for advertising evening entertainment”, “possible target group for advertising investment”, “possible target group for advertising sport”, “possible target group for advertising running”, “ possible phase of life", "possible target group for advertising distance selling" and "mail order buyer", which were evaluated by the complainant in relation to the co-participant, namely the information "possible target group for advertising organic", "possible target group for advertising evening entertainment", "possible Target group for sports advertising” and “possible target group for running advertising” were each rated “yes”. The information “possible target group for advertising investment” was rated “low”. Under “possible life phase” the information was “Young, Free & Single”. The information “possible target group for distance selling advertising” was rated “high” and the information “mail order buyer” was rated “low”.

In addition, the complainant stated that she processes this data as part of her work as an address publisher and offers it to business customers for marketing purposes.

The market information was determined by the complainant using profiling.

In a letter dated March 9, 2023 - thus during the ongoing appeal proceedings before the Federal Administrative Court - the complainant provided the co-participant with additional information in which she listed the specific data recipients of his personal data.

2. Assessment of evidence:

The facts arise from the administrative act submitted and the court act and are not in dispute. The fact that the complainant provided the co-participant with an addition to the information already provided, in which the specific recipients of his data were listed in particular, follows from the complainant's letter of March 9, 2023. The co-participant took - after express and repeated warnings from the Federal Administrative Court - no position on this.

3. Legal assessment:

to A)

Articles 4, 15 and 22 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC ( General Data Protection Regulation (GDPR) are excerpted as follows: Articles 4, 15 and 22 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation; GDPR) are excerpts as follows:

“Article 4

Definitions

For the purposes of this Regulation, the term means:

1. “personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); A natural person is considered to be identifiable if he or she can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more special characteristics that express the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person;

2. “Processing” means any operation or series of operations carried out with or without the aid of automated procedures in connection with personal data, such as the collection, recording, organization, structuring, storage, adaptation or modification, reading, querying, the use, disclosure by transmission, distribution or other form of making available, alignment or combination, restriction, deletion or destruction;

[...]

4. 'Profiling' any type of automated processing of personal data, which consists in using these personal data to evaluate certain personal aspects relating to a natural person, in particular aspects relating to work performance, economic situation, health “to analyze or predict that natural person’s personal preferences, interests, reliability, behavior, location or movements;”

[...]

Article 15

Right to information of the data subject

(1) The data subject has the right to request confirmation from the controller as to whether personal data concerning him or her is being processed; If this is the case, you have the right to access this personal data and the following information:

a) the processing purposes;

b) the categories of personal data processed;

c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;

d) if possible, the planned period for which the personal data will be stored or, if this is not possible, the criteria for determining that period;

e) the existence of a right to rectification or deletion of personal data concerning them or to restriction of processing by the controller or a right to object to such processing;

f) the existence of a right to lodge a complaint with a supervisory authority;

g) if the personal data are not collected from the data subject, any available information about the origin of the data;

(h) the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

2. Where personal data are transferred to a third country or to an international organization, the data subject shall have the right to be informed of the appropriate safeguards referred to in Article 46 in relation to the transfer.

(3) The controller provides a copy of the personal data that is the subject of processing. For all further copies requested by the data subject, the person responsible may charge a reasonable fee based on the administrative costs. If the data subject submits the application electronically, the information must be provided in a common electronic format unless the data subject states otherwise.

(4) The right to receive a copy in accordance with paragraph 1b must not prejudice the rights and freedoms of other persons.

[…]

Article 22

Automated decisions in individual cases including profiling

(1) The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

(2) Paragraph 1 does not apply if the decision

a) is necessary for the conclusion or performance of a contract between the data subject and the controller,

b) is permitted by Union or Member State law to which the controller is subject and that law contains appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject or

c) takes place with the express consent of the data subject.

(3) In the cases referred to in paragraph 2 letters a and c, the controller shall take appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject, including at least the right to obtain human intervention on the part of the controller Present your own point of view and appeal against the decision.

(4) Decisions under paragraph 2 may not be based on special categories of personal data referred to in Article 9(1), unless Article 9(2)(a) or (g) applies and appropriate measures have been taken to protect the rights and freedoms and legitimate interests of the data subject .”

§ 151 of the Trade Code 1994, Federal Law Gazette No. 194/1994 as amended by Federal Law Gazette I No. 32/2018 reads in part as follows: Paragraph 151, Trade Code 1994, Federal Law Gazette No. 194 from 1994, as amended by Federal Law Gazette Part One, No. 32 from 2018, reads in part as follows:

“(1) The use of personal data for the marketing purposes of third parties by traders authorized to carry out the business of address publishing and direct marketing companies is subject to the provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), OJ No. L 199 of May 4, 2016 S 1, (hereinafter: GDPR), as well as the Federal Act on the Protection of Natural Persons with the Processing of Personal Data (Data Protection Act - DSG), BGBl. I. No. 165/1999, in the version of the federal law BGBl Third parties through traders authorized to carry out the business of address publishing and direct marketing companies are the provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (data protection Basic Regulation), OJ No. L 199 of May 4, 2016 S 1, (hereinafter: GDPR), as well as the Federal Act on the Protection of Natural Persons with regard to the Processing of Personal Data (Data Protection Act - DSG), Federal Law Gazette Roman One. No. 165 from 1999, in the version of the federal law Federal Law Gazette Roman one. No. 120 from 2017, applies unless otherwise specified below.

[...]

(6) Traders pursuant to paragraph 1 may only use marketing information and classifications collected for marketing purposes and which are attributed to specific persons on the basis of marketing analysis procedures for marketing purposes and, in particular, may only transmit them to third parties if they declare without hesitation that they are transferring these analysis results exclusively for marketing purposes. (6) Traders according to paragraph one may only use marketing information and classifications collected for marketing purposes, which are attributed to specific people on the basis of marketing analysis procedures, only for marketing purposes and, in particular, may only transmit them to third parties if this is harmless declare that they will use these analysis results exclusively for marketing purposes.

[...]"

In the present case, the authority concerned accepted the complaint of the co-participant in points 1 and 2 to the extent that the complainant 1. did not provide any information about the specific recipients of his data and 2. did not provide sufficiently meaningful information about the logic involved or its scope and has provided the intended effects of the processing in relation to the profiling it carries out.

to the recipients

As was established, the complainant provided the co-participant with information about the specific recipients of his data during the course of the proceedings before the Federal Administrative Court and thus fulfilled the co-party's right to information in this regard.

Since the aim of a complaint procedure according to Art. 15 GDPR in conjunction with Art. 77 GDPR in conjunction with Section 24 DSG is that the person concerned receives the information to which he is entitled, the basis for points 1 and 2 in this regard has been withdrawn. It was therefore necessary to decide in accordance with the ruling. Since the aim of a complaint procedure according to Article 15, GDPR in conjunction with Article 77, GDPR in conjunction with Paragraph 24, DSG is that the person concerned receives the information to which he is entitled, the ruling points 1 and 2 were followed in this regard removed the basis. The decision therefore had to be made in accordance with the verdict.

There is no right to determine past violations of the right to information (cf. the case law of the VwGH on the right to information issued in connection with the DSG 2000: VwGH 27.9.2007, 2006/06/0330 with reference to VwGH 28.3.2006, 2004/06/0125, the main considerations of which can also be transferred to the current legal situation). There is no right to determine past violations of the right to information; compare the case law of the VwGH on the right to information issued in relation to the DSG 2000: VwGH September 27, 2007, 2006/06/0330 with reference to VwGH March 28, 2006, 2004/06/0125, the main considerations of which can also be transferred to the current legal situation).

about the sufficiently meaningful information about the logic involved as well as about the scope and intended effects of the processing

In the present case, it is (now) undisputed that the “marketing information” attributed to the co-participant is “personal data” within the meaning of Article 4, Paragraph 1 of the GDPR (cf. VwGH December 14, 2021, Ro 2021/04 /0007, concerning the data type “party affinities” and BVwG 2.9.2022, W214 2230686-1). In the present case, it is (now) undisputed that the “marketing information” attributed to the co-participant is “personal data” within the meaning of Article 4, paragraph one, GDPR, see VwGH December 14, 2021, Ro 2021/04/0007 , concerning the data type “party affinities” and BVwG 2.9.2022, W214 2230686-1).

It is also undisputed that the complainant determined this “marketing information” as part of profiling within the meaning of Article 4, Paragraph 4 of the GDPR. Accordingly, the complainant also announced in the course of the proceedings before the Federal Administrative Court that the marketing classifications calculated using marketing analysis procedures were the result of profiling within the meaning of Article 4, Paragraph 4 of the GDPR and that she had therefore carried out profiling. However, it is an address publisher and direct marketing company and does not make any automated decisions including profiling within the meaning of Article 22 Paragraph 2 GDPR, which is why it is not subject to any obligation to provide information pursuant to Article 15 Paragraph 1 Letter h GDPR. This is also undisputed that the complainant determined this “marketing information” as part of profiling within the meaning of Article 4, Section 4, GDPR. Accordingly, the complainant also announced in the course of the proceedings before the Federal Administrative Court that the marketing classifications calculated using marketing analysis procedures were the result of profiling within the meaning of Article 4, Paragraph 4, GDPR and that she had therefore carried out profiling. However, it is an address publisher and direct marketing company and does not make any automated decisions including profiling within the meaning of Article 22, Paragraph 2, GDPR, which is why it is not subject to any obligation to provide information pursuant to Article 15, Paragraph One, Letter h, GDPR.

The following should be noted:

It can be concluded from the wording of the provision of Article 15 Paragraph 1 Letter h of the GDPR (“at least in these cases”) that a person responsible must inform the data subject about the existence of any automated decision-making and profiling measures. However, the extended obligation to provide information about the methods and criteria as well as the scope and effects, which is ordered in the second half-sentence and is the subject of this article, should, in contrast, clearly “at least” only apply to the cases of particularly intrusive decision-making regulated in Article 22 Paragraphs 1 and 4 GDPR, including Extend profiling (see Bäcker in Kühling/Buchner, General Data Protection Regulation, BDSG3 [2020], Art. 13, Rn. 52 and Art. 15, Rn. 27). It can be concluded from the wording of the provision of Article 15, paragraph one, letter h, GDPR (“at least in these cases”) that a controller must inform the data subject about the existence of any automated decision-making and profiling measures. However, the extended obligation to provide information about the methods and criteria as well as the scope and effects set out in the second half-sentence and which is at issue here should, in contrast, clearly “at least” only apply to the cases of particularly intrusive decision-making, including profiling, regulated in Article 22, paragraphs one and 4 of the GDPR see bakers in Kühling/Buchner, General Data Protection Regulation, BDSG3 [2020], Article 13, paragraph 52 and Article 15, paragraph 27).

In the present case, the processing in question took place as part of the complainant's activity as an address publisher in accordance with Section 151 GewO and was limited to use for marketing purposes in accordance with paragraph 6 of this provision. However, following the complainant's statements, such use cannot be qualified as a significant impairment of the data subject (Hladjk in Ehmann/Selmayr, General Data Protection Regulation 2 [2018] Art. 22, Rn. 9 and BVwG 2.9.2022, W214 2230686-1) . In the present case, the processing in question took place as part of the complainant's activity as an address publisher in accordance with Paragraph 151 of the GewO and was limited to use for marketing purposes in accordance with Paragraph 6 of this provision. However, following the complainant's statements, such use cannot be qualified as a significant impairment of the data subject (Hladjk in Ehmann/Selmayr, General Data Protection Regulation 2 [2018] Article 22, paragraph 9 and BVwG 2.9.2022, W214 2230686-1) .

Since the complainant was therefore unable to fulfill the extended information obligation stipulated in Article 15 Paragraph 1 Letter h of the GDPR, the basis for points 1 and 2 was also withdrawn in this respect. Since the complainant was therefore unable to fulfill the extended information obligation stipulated in Article 15, paragraph one, letter h, GDPR, the basis for points 1 and 2 was also withdrawn in this respect.

Overall, the decision had to be made in accordance with the verdict.

According to Section 24 Paragraph 1 VwGVG, the administrative court must, upon request or if it deems it necessary, conduct a public oral hearing ex officio. According to paragraph 24, paragraph one, VwGVG, the administrative court has upon request or if it deems this necessary considers to hold a public oral hearing ex officio.

According to Section 24 Paragraph 4 VwGVG - unless otherwise provided by federal or state law - the administrative court can, regardless of a party's request, refrain from a hearing if the files show that the oral discussion does not lead to the expectation of further clarification of the case, and Neither Article 6 Para. 1 ECHR nor Article 47 GRC preclude the cancellation of the hearing. According to Paragraph 24, Paragraph 4, VwGVG - unless otherwise provided by federal or state law - the administrative court can refrain from holding a hearing regardless of a party's request, if the files show that the oral discussion does not lead to any further clarification of the case and neither Article 6, paragraph one, ECHR nor Article 47, CFR precludes the cancellation of the hearing.

In the present case, the facts of the case were clarified from the file. It was not necessary to use further evidence to clarify the matter.

In this case, the Federal Administrative Court has to rule exclusively on legal questions (cf. ECHR June 20, 2013, Appl. No. 24510/06, Abdulgadirov/AZE, paragraph 34 ff.). Even according to the jurisprudence of the Constitutional Court, an oral hearing can be omitted if the facts are undisputed and the legal question is not particularly complex (VfSlg. 17.597/2005; VfSlg. 17.855/2006; most recently VfGH June 18, 2012, B 155/12). In this case, the Federal Administrative Court has to rule exclusively on legal questions see ECHR June 20, 2013, Appl. No. 24510/06, Abdulgadirov/AZE, Rz 34 ff.). Even according to the jurisprudence of the Constitutional Court, an oral hearing can be omitted if the facts are undisputed and the legal question is not particularly complex (VfSlg. 17.597/2005; VfSlg. 17.855/2006; most recently VfGH June 18, 2012, B 155/12).

B) Inadmissibility of the appeal:

According to Section 25a Paragraph 1 VwGG, the administrative court must state in its ruling or decision whether the appeal is permissible in accordance with Article 133 Paragraph 4 B-VG. This statement must be briefly justified. According to paragraph 25 a, paragraph one, VwGG, the administrative court must state in its decision or decision whether the appeal is permissible in accordance with Article 133, paragraph 4, B-VG. This statement needs to be briefly justified.

The case law in question is consistent with the case law cited. Due to the clear legal situation, this is not a legal question of fundamental importance. There are also no other indications of the fundamental significance of the legal question to be resolved.

There are no other indications of the fundamental significance of the legal question to be resolved.