BVwG - W298 2255416-1
From GDPRhub
| BVwG - W298 2255416-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 4(1) GDPR Article 6(1)(f) GDPR Article 77 GDPR § 1 DSG § 129 GewO 1994 § 133 B-VG § 24 DSG |
| Decided: | 23.05.2024 |
| Published: | |
| Parties: | |
| National Case Number/Name: | W298 2255416-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2024:W298.2255416.1.00 |
| Appeal from: | |
| Appeal to: | Not appealed |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (in German) |
| Initial Contributor: | Annkathrin.a.dix |
The Federal Administrative Court held that a detective did not have an overriding legitimate interest in observing the data subject as the controller was only asked to observe the data subject's partner for an employment dispute.
English Summary
Facts
The data subject's partner was observed by a professional detective (the controller), because the partner's employer doubting the partner's medical condition as they were on sick leave. The data subject was listed as "target person 2" in the controller's observation report and was therefore also photographed 4 times (sometimes alone) by the controller on their private property. The photos and reports were send to their partner's lawyer and the labour court without the data subject's consent.
Therefore, the data subject lodged a complaint against a professional detective (the controller) at the Austrian DPA ("Datenschutzbehörde - DSB").
The controller argued they had to also observe the data subject in addition to the data subject's partner to fulfill the assignment. The controller did accidentally referred to the data subject as the "target person" instead of a "witness". The controller however stated that no sensitive data was collected about the data subject and that the photographs were not intended to be used as evidence.
The data subject responded to this claim, arguing that the photographs were unnecessary, as a basic report would have sufficed for such investigative purposes. The data subject emphasised that the photos were taken on the weekend on private property without their permission.
The controller further argued that the data subject's full name was obtained from a land registry search, and that the photographs were of poor quality, and therefore the data subject was not clearly identifiable. Moreover, the controller argued that such photographs do not constitute sensitive data, emphasising that the data subject also had some photos on social media.
The data subject responded to these claims, stating that the photographs were not blurry and that they had never been and would never be called be as a witness in their partner’s proceedings. Moreover, the fact that the data subject had photos on social media did not allow the controller to take pictures of them on their private property without their consent.
The DPA partially upheld the data subject’s complaint, holding that the controller violated the data subject's right to confidentiality under Austrian national data protection law (Section 1(1) DSG) by observing and photographing them without a reasonable justification, and subsequently using this data to establish and communicate an observation report for their client. Although the controller was exercising activities as part of their commercial activity and thus enjoyed a great scope of discretion in carrying out such observations, the photographs taken by the controller were not necessary for the proceedings. The controller thus exceeded the order issued by its client by collecting the data of the data subject.
The controller appealed the DPA's decision at the Federal Administrative Court ("Bundesverwaltungsgericht - BVwG", arguing that the DPA had improperly assessed the legitimate interests of the controller in exercising their profession and that the data subject was not identifiable from the photographs.
Holding
On the question of whether personal data was present
The court held that photographs are "personal data" under the GDPR if they relate to an identified or identifiable natural person. The court took into account that a person can be identifiable retrospectively if one or more characteristics can be assigned to a specific person, constituting to a personal reference.
The court held that in this case, the observation report included a personal reference to the data subject, as they were listed with their full name and referred to as a ‘target person’. The images taken by the controller can thus clearly be assigned to the data subject. The court therefore dismissed the controller's argument that the data subject was clearly not identifiable.
On the question of the controller's legitimate interests
As a professional detective, the controller claimed they had a legitimate interest in processing the data subject's personal data to gather evidence for proceedings against the data subject's partner.
The court held that the controller's legitimate interest as a professional detective lies in carrying out the surveillance of the data subject's partner on behalf of their client, so that the client can bring forward any evidence in the proceedings before the labour court. The court therefore held that the controller was only mandated to observe the data subject's partner for their proceedings, and not the data subject. Therefore, the court held that the controller's legitimate interest did not outweigh the rights and freedoms of the data subject, as outlined in Article 6(1)(f) GDPR. The data processing pertaining to the data subject was not necessary because the client of the controller had no (contractual or employment) relationship with them. The court concluded that the controller's observation of the data subject was not based on an overriding legitimate interest under Article 6(1)(f) GDPR.
The court thus dismissed the controller's appeal.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Decision date May 23, 2024 Standard B-VG Art133 Para.4 DSG §1 DSG §24 DSGVO Art4 Z1 DSGVO Art6 Para.1 litf DSGVO Art77 GewO 1994 §129 B-VG Art. 133 today B-VG Art. 133 valid from January 1, 2019 to May 24, 2018 last amended by BGBl. I No. 138/2017 B-VG Art. 133 valid from January 1, 2019 last amended by BGBl. I No. 22/2018 B-VG Art. 133 valid from May 25, 2018 to December 31, 2018 last amended by BGBl. I No. 22/2018 B-VG Art. 133 valid from August 1st, 2014 to May 24th, 2018, last amended by BGBl. I No. 164/2013 B-VG Art. 133 valid from January 1st, 2014 to July 31st, 2014, last amended by BGBl. I No. 51/2012 B-VG Art. 133 valid from January 1st, 2004 to December 31st, 2013, last amended by BGBl. I No. 100/2003 B-VG Art. 133 valid from January 1st, 1975 to December 31st, 2003, last amended by BGBl. No. 444/1974 B-VG Art. 133 valid from December 25th, 1946 to December 31st, 1974, last amended by BGBl. No. 211/1946 B-VG Art. 133 valid from 19.12.1945 to 24.12.1946 last amended by StGBl. No. 4/1945 B-VG Art. 133 valid from January 3, 1930 to June 30, 1934 DSG Art. 1 § 1 today DSG Art. 1 § 1 valid from January 1, 2014 last amended by BGBl. I No. 51/2012 DSG Art. 1 § 1 valid from January 1, 2000 to December 31, 2013 DSG Art. 2 § 24 today DSG Art. 2 § 24 valid from July 15, 2024 last amended by BGBl. I No. 70/2024 DSG Art. 2 § 24 valid from May 25, 2018 to July 14, 2024 last amended by BGBl. I No. 120/2017 DSG Art. 2 § 24 valid from January 1, 2010 to May 24, 2018, last amended by BGBl. I No. 133/2009 DSG Art. 2 § 24 valid from January 1, 2000 to December 31, 2009 GewO 1994 § 129 today GewO 1994 § 129 valid from January 1, 9000, last amended by BGBl. I No. 171/2022 GewO 1994 § 129 valid from February 27, 2008 to January 1, 9000, last amended by BGBl. I No. 42/2008 GewO 1994 § 129 valid from August 1, 2003 to February 26, 2008, last amended by BGBl. I No. 48/2003 GewO 1994 § 129 valid from 01.08.2002 to 31.07.2003 last amended by BGBl. I No. 111/2002 GewO 1994 § 129 valid from 01.07.2002 to 31.07.2002 last amended by BGBl. I No. 68/2002 GewO 1994 § 129 valid from 01.07.1994 to 30.06.2002 last amended by BGBl. No. 314/1994 GewO 1994 § 129 valid from 19.03.1994 to 30.06.1994 Saying W298 2255416-1/8E In the name of the republic The The Federal Administrative Court, through Judge Mag. Mathias VEIGL as chairman and the expert lay judge Mag. Gerda Ferch-Fischer and the expert lay judge Dr. Wolfgang Goricnik as assessors, recognizes the complaint of XXXX , represented by attorney Mag. Andreas SCHWEITZER, Wickenburggasse 3/11, 1080 Vienna, against the decision of the data protection authority dated April 11, 2022, GZ: XXXX (co-participating party: XXXX ), due to violation of the right to confidentiality, as follows: The Federal Administrative Court, through Judge Mag. Mathias VEIGL as chairman and the expert lay judge Mag. Gerda Ferch-Fischer and the expert lay judge Dr. Wolfgang Goricnik as assessor and assessor on the complaint of Roman XXXX, represented by attorney-at-law Mag. Andreas SCHWEITZER, Wickenburggasse 3/11, 1080 Vienna, against the decision of the data protection authority dated April 11, 2022, GZ: Roman XXXX (co-involved party: Roman XXXX), due to violation of the right to confidentiality, rightly: A) The complaint is dismissed as unfounded. B) The appeal is not admissible according to Art. 133, Paragraph 4 B-VG.The appeal is not admissible according to Article 133, Paragraph 4, B-VG. Text Reasons for the decision: I. Course of proceedings: Roman one. Course of proceedings: 1. XXXX (in the proceedings before the authority concerned "complainant", in the proceedings before the court "co-involved party") filed a data protection complaint with the data protection authority (hereinafter also "authority concerned") with a submission dated XXXX. Due to an employment dispute between her partner and his former employer (“XXXX”), her partner was being monitored by the professional detective XXXX (in the proceedings before the authority concerned, the “respondent” in the above proceedings, the “complainant”). The co-involved party in this matter was listed in the observation report as “target person 2”. For this purpose, several photos were taken of her on her private property, some of them just of her alone. The surveillance took place between XXXX and XXXX. These photos and the observation report prepared by the complainant were subsequently sent to her partner’s lawyer and to the employment court on XXXX, without the consent of the co-involved party. The co-involved party only found out about it on XXXX. 1. Roman XXXX (in the proceedings before the authority concerned, the “complainant”, in the above proceedings, the “co-involved party”) submitted a data protection complaint to the data protection authority (hereinafter also the “accused authority”) on Roman XXXX. Due to an employment dispute between her partner and his former employer (“Roman XXXX”), her partner was being monitored by the professional detective Roman XXXX (in the proceedings before the authority concerned, the “respondent” in the above proceedings, the “complainant”). In this matter, the co-involved party was listed in the surveillance report as “target person 2”. For this purpose, several photos were taken of her on her private property, some of them just of her. The surveillance took place between Roman XXXX and Roman XXXX. These photos and the surveillance report prepared by the complainant were subsequently sent to her partner’s lawyer and to the employment court on Roman XXXX, without the consent of the co-involved party. The co-involved party only found out about it on Roman XXXX. 2. In a submission dated February 20, 2021, the complainant submitted a statement through his legal representative, stating that in the course of fulfilling the order, in addition to the person to be observed, he also observed the co-involved person on XXXX and XXXX, and that no other data on the complainant was collected. In order to ensure proper fulfillment of the order, all movements related to the objective of the order were recorded and documented. The co-involved party was inadvertently referred to as the target person; the correct term would have been "witness". The finding that the co-involved party was the target person's partner was important in order to be able to proceed according to the exclusion principle of possible competing employment for another company. In order to avoid laborious and costly additional investigations to find the co-involved party as a witness, she was mentioned in the report. Based on the observation report, no sensitive data of the co-involved party was processed. 2. In a submission dated February 20, 2021, the complainant submitted a statement through his legal representative, stating that in the course of fulfilling the order, in addition to the person to be observed, he also observed the co-involved person at Roman XXXX and Roman XXXX, and that no other data on the complainant was collected. In order to ensure proper fulfillment of the order, all movements related to the objective of the order were recorded and documented. In doing so, the co-involved party was inadvertently referred to as the target person; the correct term would have been "witness". The finding that the co-involved party was the target person's partner was important in order to be able to proceed according to the exclusion principle of possible competing employment for another company. In order to avoid laborious and costly additional investigations to find the co-involved party as a witness, she was mentioned in the report. Based on the observation report, no sensitive data of the co-involved party had been processed. 3. The co-involved party replied in a submission dated February 24, 2021 that it was not clear to what extent the photographs taken by it were intended to serve as evidence. The complainant could not have assumed that it was a possible competitor because it worked in a completely different sector and the photographs were taken on a weekend on private property. A "simple, plain" report from the complainant would have been sufficient in this regard, without additional images. 4. In a written submission dated March 15, 2021, the complainant submitted a further statement, adding that the query in the land register had been carried out by the client himself. The land register extract was then sent to the complainant, which is why he already had the full name of the co-involved party. In addition, the co-involved party had not been specifically observed and could not be clearly identified in the photographs due to their poor quality. Photographs are not sensitive data. The co-involved party is represented with photos on some social media. 5. The co-involved party replied in a submission dated May 31, 2021 that the photos were taken in the digital original without blurring. The scanned version of the complainant simply no longer had the required resolution. The co-involved party has never been and will never be called as a witness in the labor law proceedings against her partner. It is also not true that she is represented with photos on various social media, even if this is true, the complainant is not entitled to photograph her without permission on her private property. 6. By decision of April 11, 2022, the complaint of the co-participating party was partially upheld and it was determined that the complainant had violated the co-participating party's right to confidentiality under Section 1 Paragraph 1 of the Data Protection Act by unlawfully observing and photographing them on XXXX and XXXX and using this data to prepare an observation report on XXXX and send it to his client (ruling point I.) Otherwise, the complaint was dismissed (ruling point II.)6. By decision of April 11, 2022, the complaint of the co-participating party was partially upheld and it was determined that the complainant had violated the co-participating party's right to confidentiality under paragraph one, subsection one, DSG by unlawfully observing and photographing them on Roman XXXX and Roman XXXX and using this data to prepare an observation report on Roman XXXX and send it to his client (ruling point Roman one). Otherwise, the complaint was dismissed (ruling point Roman II.) The authority concerned stated that although the client had given the civil law order to observe the co-participating party's partner, the observation itself was subsequently carried out independently by the complainant as part of his commercial activity (cf. Section 129, Paragraph 1, Item 3 of the Trade Regulation Act 1994) and that he had a correspondingly wide scope of discretion in carrying out the observation and in choosing the means of the associated data processing. By also observing the co-involved party and collecting their data (namely by taking pictures of the co-involved party and recording their motorcycle license plate number), the complainant exceeded the order given by the civil law client and is therefore to be qualified as the (sole) controller within the meaning of Art. 4 Z 7 GDPR. The co-involved party is identifiable in the photographs and is listed in the observation report as "target person 2", which is why it is clear that this is the co-involved person. The photographs of the co-involved party taken by the complainant are not useful in labor court proceedings. In order to be able to present the complainant as a witness in court proceedings, the information that the complainant received from his client is sufficient. The assumption that the co-involved party was a competing employer was also unfounded. In its justification, the authority concerned stated that although the client had issued the civil law order to observe the partner of the co-involved party, the observation itself was subsequently carried out independently by the complainant as part of his commercial activity (see paragraph 129, paragraph one, item 3, GewO 1994) and that the complainant had a correspondingly wide scope of discretion in carrying out the observation and in choosing the means of the associated data processing. By also observing the co-involved party and collecting their data (namely by taking pictures of the co-involved party and recording their motorcycle license plate), the complainant had exceeded the order issued by the civil law client and was therefore to be qualified as the (sole) controller within the meaning of Article 4, item 7, GDPR. The co-involved party is identifiable in the photographs and is listed in the observation report as "target person 2", which is why it is clear that this is the co-involved person. The photographs of the co-involved party taken by the complainant are not useful in labor court proceedings. In order to be able to present the complainant as a witness in court proceedings, the information that the complainant had received from his client was sufficient. The assumption that the co-involved party was a competing employer was also unfounded. 7. The complainant filed the appeal in due time with a written submission dated May 5, 2022, essentially arguing that the authority concerned cited a standard in its determination of facts that, on the one hand, did not exist and, on the other hand, that Section 127 of the Trade Code was a completely different trade than the one that the complainant was practicing. The authority concerned should have carried out appropriate research and findings to find out how a detective works, what evidence he has to collect and how identity should be established. The authority concerned is not authorized to determine whether or not someone is a suitable witness and whether or not this person can provide relevant information in proceedings before the civil courts. In addition, the identity of the person depicted cannot be established on the basis of a photograph alone.7. The complainant filed the appeal in due time with a written submission dated May 5, 2022, essentially arguing that the authority concerned cited a norm in its determination of facts which, on the one hand, does not exist and, on the other hand, that Section 127 of the Trade Code is a completely different trade than the one the complainant practices. The authority concerned should have carried out appropriate research and findings to find out how a detective works, what evidence he has to collect and how identity should be established. The authority concerned is not authorized to determine whether or not someone is a possible witness and whether or not this person can provide relevant information in proceedings before the civil courts. In addition, the identity of the person depicted cannot be established on the basis of a photograph alone. 8. With a file submission dated May 23, 2022, the authority concerned submitted the administrative act in question to the Federal Administrative Court for a decision and stated in its statement that it should have correctly cited Section 129 of the Trade Code instead of Section 127 Z 18 of the Trade Code. It was essential that the complainant had a valid trade license as a professional detective. The complainant was therefore not aggrieved by the finding made and the reference to an incorrect legal provision, contrary to his assertion. 8. With a file submission dated May 23, 2022, the authority concerned submitted the administrative act in question to the Federal Administrative Court for a decision and stated in its statement that it should have correctly cited Section 129, GewO, instead of Section 127, Item 18, GewO. It was essential that the complainant had a valid trade license as a professional detective. The complainant was therefore not aggrieved by the finding made and reference to an incorrect legal provision, contrary to his assertion. 9. By order of the Business Allocation Committee of November 29, 2023, the case was taken from the originally responsible court department and reassigned to Department W 298. 10. By order of January 8, 2024, the complainant was granted a hearing. 11. In a submission dated February 6, 2024, the complainant commented on the statements made by the authority concerned and stated in summary that the authority concerned had not adequately and correctly assessed the complainant's legitimate interest in exercising his trade because, by granting the application, it had withdrawn the data processing basis for exercising the legally protected trade. As a result, the complainant was aggrieved by the unlawful decision. In addition, the complainant referred to the appeal against the decision and requested that the appeal be granted. II. The Federal Administrative Court considered: Roman II. The Federal Administrative Court considered: 1. Findings: The procedure set out under point I. is the basis for the findings.The procedure set out under point Roman one. is the basis for the findings. The complainant works as a professional detective and was commissioned by XXXX, the employer of the partner of the co-involved party, to observe him because there was a suspicion that he was behaving detrimentally to his recovery while on sick leave. The complainant works as a professional detective and was commissioned by XXXX, the employer of the partner of the co-involved party, to observe him because there was a suspicion that he was behaving detrimentally to his recovery while on sick leave. Based on the assignment given to him, the complainant therefore observed the partner of the co-involved party on XXXX, XXXX and XXXX. The observation was also carried out on XXXX and XXXX on the private property of the partner of the co-involved party, at the address XXXX. The co-involved party was also present at this address at the time. The complainant recorded the results of the observations in his report dated XXXX. Based on the instructions given to him, the complainant therefore carried out an observation of the partner of the co-involved party on Roman XXXX, Roman XXXX and Roman XXXX. The observation was also carried out on Roman XXXX and Roman XXXX on the private property of the co-involved party's partner, at the address Roman XXXX. The co-involved party was also present at this address at the time. The complainant recorded the results of the observations in his report dated Roman XXXX. In his report, he gave the full name of the co-involved party, “ XXXX ”, and referred to them as “Target Person 2 (ZP 2)”. The partner of the co-involved party was referred to as “Target Person 1 (ZP 1)”. In his report, he gave the full name of the co-involved party, “ Roman XXXX ”, and referred to them as “Target Person 2 (ZP 2)”. The partner of the co-involved party was referred to as “Target Person 1 (ZP 1)”. During his observation on XXXX, the complainant took several photographs of the co-involved party’s partner, as well as one photograph in which only the co-involved party can be seen, and noted in his report: “At around 3:00 p.m., ZP2 can also be seen on the balcony”. In this picture, it can be seen that the co-involved party is standing alone on a balcony. On XXXX, the complainant took another photograph showing the co-involved party and their partner. The complainant photographed the co-involved party and their partner standing together on the balcony. In his report, the complainant noted, among other things, "At 9:00 a.m. ZP1+2 can be seen together on the balcony." He also noted: "At 10:22 a.m. ZP2 comes out of the ZO, gets on the ZF2 and drives away." He took two more photographs exclusively of the co-involved party, in which you can see her first getting on a motorcycle and then driving away. In his report, he noted that this was a XXXX motorcycle with the license plate XXXX and referred to it as "Target Vehicle 2 (ZF2)." During his observation at Roman XXXX, the complainant took several photographs of the partner of the co-involved party, as well as one photograph in which only the co-involved party can be seen, and noted in his report: "At around 3:00 p.m., ZP2 can also be seen on the balcony." This photo shows the co-involved party standing alone on a balcony. At Roman XXXX, the complainant took another photograph showing the co-involved party and her partner. The complainant photographed the co-involved party and her partner standing together on the balcony. In his report, the complainant noted, among other things, "At 9:00 a.m. ZP1+2 can be seen together on the balcony." He also noted: "At 10:22 a.m. ZP2 comes out of the ZO, gets on the ZF2 and drives away." He took two more photographs exclusively of the co-involved party, in which you can see how she first gets on a motorcycle and then drives away. In his report he noted that it was a Roman XXXX motorcycle with the Roman XXXX license plate and referred to it as "Target Vehicle 2 (ZF2)". The complainant took a total of four photographs, which (also) show the co-involved party; three of these photographs only show the co-involved party. The co-involved party subsequently filed a data protection complaint against XXXX for unauthorized use and forwarding of her photos, and against the complainant for intrusion into her privacy and disregard of her personal rights.The co-involved party subsequently filed a data protection complaint against Roman XXXX for unauthorized use and forwarding of her photos, and against the complainant for intrusion into her privacy and disregard of her personal rights. The contested decision at issue deals exclusively with the complaint against the complainant. 2. Assessment of evidence: The findings are based on the administrative act (in particular the observation report contained in the administrative act and prepared by the complainant on XXXX) and on the Federal Administrative Court's file. The facts are undisputed. The findings are based on the administrative act (in particular the observation report contained in the administrative act and prepared by the complainant on XXXX) and on the Federal Administrative Court's file. The facts are undisputed. 3. Legal assessment: The admissible complaint is not justified. 3.1. Relevant provisions Section 1 DSG reads: Paragraph one, DSG reads: (Constitutional provision) Basic right to data protection Section 1. (1) Everyone has the right to keep personal data concerning him or her confidential, in particular with regard to respect for his or her private and family life, provided that there is a legitimate interest in doing so. The existence of such an interest is excluded if data is not accessible to a claim of confidentiality due to its general availability or because it cannot be traced back to the person concerned.Paragraph one, (1) Everyone has the right to keep personal data concerning him or her confidential, in particular with regard to respect for his or her private and family life, provided that there is a legitimate interest in doing so. The existence of such an interest is excluded if data is not accessible to a claim of confidentiality due to its general availability or because it cannot be traced back to the person concerned. (2) To the extent that the use of personal data is not in the vital interest of the data subject or with his consent, restrictions on the right to confidentiality shall only be permissible to protect the overriding legitimate interests of another person, and in the case of interventions by a state authority only on the basis of laws that are necessary for the reasons set out in Article 8 paragraph 2 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210/1958. Such laws may only provide for the use of data which, by their nature, are particularly worthy of protection to protect important public interests and must at the same time establish appropriate guarantees for the protection of the data subject’s interests in confidentiality. Even in the case of permissible restrictions, the interference with the fundamental right may only be carried out in the mildest way that achieves the goal.(2) If the use of personal data is not in the vital interest of the person concerned or with his consent, restrictions on the right to confidentiality are only permissible to protect the overriding legitimate interests of another person, and in the case of interventions by a state authority only on the basis of laws that are necessary for the reasons stated in Article 8, paragraph 2, of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210 of 1958. Such laws may only provide for the use of data that are particularly worthy of protection by their nature to protect important public interests and must at the same time establish appropriate guarantees for the protection of the interests of the persons concerned in confidentiality. Even in the case of permissible restrictions, the interference with the fundamental right may only be carried out in the mildest way that achieves the goal. (3) Everyone has, insofar as personal data concerning him are intended for automated processing or for processing in manual files, i.e. files kept without automated support, in accordance with statutory provisions 1. the right to information about who processes which data about him, where the data comes from and what it is used for, in particular to whom it is transmitted; 2. the right to correct incorrect data and the right to delete data that has been processed unlawfully. (4) Restrictions on the rights under paragraph 3 are only permissible under the conditions set out in paragraph 2. (4) Restrictions on the rights under paragraph 3 are only permissible under the conditions set out in paragraph 2. Paragraph 24 of the Data Protection Act states: (1) Any data subject has the right to lodge a complaint with the data protection authority if they believe that the processing of personal data concerning them violates the GDPR or paragraph 1 or Article 2, Chapter 1. Paragraph 24 of the Data Protection Act states: (1) Any data subject has the right to lodge a complaint with the data protection authority if they believe that the processing of personal data concerning them violates the GDPR or paragraph 1 or Article 2, Chapter 1. (5) If a complaint proves to be justified, it must be acted upon. If a violation can be attributed to a person responsible in the private sector, this person must be instructed to comply with the complainant's requests for information, correction, deletion, restriction or data transfer to the extent necessary to eliminate the violation of law identified. If the complaint proves to be unjustified, it must be rejected. (6) Until the proceedings before the data protection authority have been concluded, a respondent may subsequently remedy the alleged violation of law by complying with the complainant's requests. If the data protection authority considers the complaint to be irrelevant, it must hear the complainant on the matter. At the same time, the complainant must be informed that the data protection authority will discontinue the proceedings without any formalities if the complainant does not provide reasons within a reasonable period of time as to why he still considers the originally alleged violation of law to have not been remedied, at least in part. If such a statement by the complainant changes the nature of the matter (Section 13 (8) AVG), the original complaint is to be assumed to have been withdrawn and a new complaint submitted at the same time.In this case too, the original complaint procedure must be discontinued without notice and the complainant must be informed of this. Late statements are not to be taken into account.”(6) A respondent can subsequently remedy the alleged violation of law by complying with the complainant’s requests until the proceedings before the data protection authority have been concluded. If the data protection authority considers the complaint to be irrelevant in this respect, it must hear the complainant on the matter. At the same time, the complainant must be informed that the data protection authority will discontinue the procedure without notice if the complainant does not provide reasons within a reasonable period of time as to why he still considers the originally alleged violation of law to have not been remedied, at least in part. If such a statement by the complainant changes the nature of the matter (Section 13, Paragraph 8, AVG), it is to be assumed that the original complaint has been withdrawn and a new complaint has been submitted at the same time. In this case too, the original complaint procedure must be discontinued without notice and the complainant must be informed of this. Late comments shall not be taken into account." Article 4(1) GDPR reads: " For the purposes of this Regulation, the following terms shall apply: 1. "Personal data" means any information relating to an identified or identifiable natural person (hereinafter referred to as "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Art. 6, paragraph 1, letter f, GDPR states: (1) Processing is only lawful if at least one of the following conditions is met:Article 6, paragraph one, letter f, GDPR states: (1) Processing is only lawful if at least one of the following conditions is met: f) processing is necessary to protect the legitimate interests of the controller or of a third party, unless the interests or fundamental rights and freedoms of the data subject which require protection of personal data prevail, in particular where the data subject is a child. Subparagraph 1, letter f does not apply to processing carried out by public authorities in the performance of their duties. Art. 77 GDPR states: (1) Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data concerning him or her infringes this Regulation."Article 77, GDPR states: (1) Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data concerning him or her infringes this Regulation." Section 129, paragraphs 1 and 2 of the Trade Regulation Act state: (1) A trade license for the profession of professional detective (Section 94, item 62) is required for Section 129, paragraphs 1 and 2 GewO reads: (1) A business license for the business of professional detectives (Section 94, Item 62) is required for 1. the provision of information on private circumstances, 2. the conduct of investigations into criminal offenses, 3. the acquisition of evidence for the purposes of judicial or administrative proceedings, 4. the investigation of missing or hidden persons, the author, writer or sender of anonymous letters, the originator or disseminator of slander, suspicion or insults, 5. the observation and control of the loyalty of employees, 6. the observation of customers in business premises, 7. the protection of persons, 8. the detection of devices for the unauthorized transmission of images and sound, of electronically stored data and the associated protective measures (Section 2) remain unaffected by this provision.8. the detection of devices for the unauthorized transmission of images and sound, of electronically stored data stored data and the associated protective measures (Section 2) remain unaffected by this provision. (2) Businessmen who are authorized to practice the profession of professional detectives are not authorized to provide information about credit relationships for business purposes. 3.2. On the merits Re: A) Dismissal of the complaint: The subject of the proceedings is the question of whether the complainant violated the co-participating party's right to confidentiality by taking photographs of her on XXXX and XXXX during the course of observing her partner. The subject of the proceedings is the question of whether the complainant violated the co-participating party's right to confidentiality by taking photographs of her on Roman XXXX and XXXX during the course of observing her partner. In this specific case, there is no doubt that the complainant took a total of four photographs of the co-involved party while observing the partner of the co-involved party. 3.2.1 On the question of whether personal data is present: It is also undisputed that photographs are “personal data” according to Article 4(1) GDPR if they relate to an identified or identifiable natural person (hereinafter “data subject”). A natural person is considered identifiable if he or she can be identified, directly or indirectly, by one or more specific characteristics that express the physical, physiological, genetic, mental[…] or social identity of that natural person. It is also undisputed that photographs are “personal data” according to Article 4(1) GDPR if they relate to an identified or identifiable natural person (hereinafter “data subject”). A natural person is considered identifiable if he or she can be identified, directly or indirectly, by one or more specific characteristics that express the physical, physiological, genetic, mental [...] or social identity of that natural person. A person is always clearly identified if the identity of the person, as is the subject of the proceedings, is immediately apparent from the information itself (ECJ 19 October 2016, C-582/14). In the case of image data, the person depicted must at least be recognizable. Even if the persons concerned can be subsequently identified, there is a personal reference if one or more characteristics can be assigned to a specific person (Hödl in Knyrim, DatKomm Art 4 DSGVO Rz 12, 16 (as of 1 December 2018, rdb.at)). A person is always clearly identified when the identity of the person, as is the subject of the proceedings, is immediately apparent from the information itself (ECJ October 19, 2016, C-582/14). In the case of image data, the person depicted must at least be recognizable. Even if the persons concerned can be identified subsequently, a personal reference exists if one or more characteristics can be assigned to a specific person (Hödl in Knyrim, DatKomm Article 4, GDPR Rz 12, 16 (as of December 1, 2018, rdb.at)). In the complainant's observation report, the co-involved party was listed with their full name and referred to as "target person 2". Even if the co-involved party could not be clearly recognized in the photographs, the images taken by the complainant can be clearly assigned to the co-involved party based on his additional image descriptions (including the name of the co-involved party and the license plate of the motorcycle). There is therefore a personal reference. The complainant's argument that the party involved cannot be clearly identified is therefore irrelevant. 3.2.2. Legitimate interests Following this, the question of whether the complainant has a (sufficient) justification within the meaning of Article 6 of the GDPR must also be answered in the negative.Following this, the question of whether the complainant has a (sufficient) justification within the meaning of Article 6 of the GDPR must also be answered in the negative. Accordingly, the legality of any data processing requires that the processing - cumulatively to the other principles regulated in Art. 5 (1) - must satisfy at least one of the legal grounds conclusively defined in Art. 6 (1) GDPR (see judgment of 24 November 2011, C‑468/10 and C‑469/10, EU:C:2011:777, and repeatedly in the judgment of 11 December 2019 C-708/17 ECLI:EU:C:2019:1064, and most recently VwGH of 06.03.2024 Ro 2021/04/0030-4 to 0031-5, para. 50 with reference to ECJ of 22.06.2023, C-579/21 J.M. para. 62). Accordingly, the legality of any data processing requires that the processing - cumulatively to the other principles regulated in Article 5, paragraph one - must satisfy at least one of the legal grounds conclusively defined in Article 6, paragraph one, GDPR (see judgment of November 24, 2011, C‑468/10 and C‑469/10, EU:C:2011:777, and repeatedly in the judgment of December 11, 2019 C-708/17 ECLI:EU:C:2019:1064, and most recently VwGH of March 6, 2024 Ro 2021/04/0030-4 to 0031-5, para. 50 with reference to ECJ of June 22, 2023, C-579/21 J.M. para. 62). In this specific case, there is no evidence that the party involved has consented to the data processing or that the vital interests of the party involved are affected. Therefore, only processing based on Article 6, Paragraph 1, Letter f, GDPR (overriding legitimate interests of the complainant) is possible.In this specific case, there is no evidence that the party involved has consented to the data processing or that the vital interests of the party involved are affected. Therefore, only processing based on Article 6, Paragraph 1, Letter f, GDPR (overriding legitimate interests of the complainant) is possible. The processing of personal data is permissible under Article 6, Paragraph 1, Letter f, GDPR, among other things, if it is necessary to protect the legitimate interests of the controller or a third party. If the complainant now claims that the data processing in question is in his legitimate interest, this is not correct. The processing of personal data is permitted, among other things, in accordance with Article 6, paragraph one, letter f, GDPR, if it is necessary to protect the legitimate interests of the controller or a third party. If the complainant now claims that the data processing in question is in his legitimate interest, this is not correct. A case-by-case balancing of interests must be carried out, in which the legitimate interests of the controller or a third party for the processing must be compared with the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data. In doing so, the interests of the controller and of third parties, on the one hand, and the interests, rights and expectations of the data subject, on the other, must be taken into account (Recital 47 GDPR). In the course of this balancing of interests, the following conditions must be met cumulatively: (i) existence of a legitimate interest, (ii) necessity of processing the personal data in question in order to pursue this interest, (iii) no outweighing of the fundamental rights and freedoms of the data subject (cf. Jahnel, Commentary on the General Data Protection Regulation Art. 6 GDPR Rz 71 [as of 1.12.2020, rdb.at]). A case-by-case balancing of interests must be carried out in which the legitimate interests of the controller or a third party for the processing must be compared with the interests or fundamental rights and freedoms of the data subject which require the protection of personal data. In doing so, the interests of the controller and of third parties on the one hand and the interests, rights and expectations of the data subject on the other hand must be taken into account (Recital 47 GDPR). In the course of this balancing of interests, the following conditions must be met cumulatively: (i) existence of a legitimate interest, (ii) necessity of processing the personal data in question in order to pursue this interest, (iii) no outweighing of the fundamental rights and freedoms of the data subject (cf. Jahnel, Commentary on the General Data Protection Regulation Article 6, GDPR Rz 71 [as of 1.12.2020, rdb.at]). The legitimate interest of the complainant as a professional detective lies in carrying out the observations of the partner of the co-involved party on behalf of his client, in concrete terms in observing the behavior of the partner of the co-involved party while on sick leave, so that the client can present any behavior that may be detrimental to recovery in the proceedings before the Labor and Social Court. An assessment of the facts to this effect - namely whether this data processing is justified - is not permissible in the present proceedings, because the "matter" of the appeal proceedings is only that matter that formed the content of the decision of the authority concerned. (see, for example, VwGH 18.10.2022, Ra 2022/01/0276, para. 19, with further references). The legitimate interest of the complainant as a professional detective lies in carrying out the observations of the partner of the co-involved party in the interests of his client, in concrete terms in observing the behavior of the partner of the co-involved party while on sick leave, so that the client can raise any behavior that may be detrimental to recovery in the proceedings before the labor and social court. An assessment of the facts to this effect - namely whether this data processing is justified - is not permissible in the present proceedings, because the "matter" of the appeal proceedings is only the matter that formed the content of the decision of the authority concerned. compare, for example, VwGH 18.10.2022, Ra 2022/01/0276, para. 19, with further references). The complainant cannot be followed when he complains that the authority concerned incorrectly cited the Trade Code, because this has no influence on the question of whether the complainant was entitled to process data of the other party involved when exercising the mandate. The decisive factor is that the complainant works as a professional detective. The Administrative Court also ruled that the incorrect citation of a legal provision does not constitute an illegality of the contested decision (see VwGH 17.5.1988, 87/04/0121). In his appeal against the decision, the complainant states in summary that the co-participating party was photographed because he could be considered as a witness in the labor law proceedings against his partner. The assessment of the evidence as to whether or not someone could be considered as a witness and whether or not this person could provide relevant information in proceedings before the civil courts is the sole responsibility of the court. However, it must be pointed out to the complainant that he was only commissioned to observe the co-participating party's partner because the client is only seeking labor law proceedings against him. The complainant's legitimate interest in processing data is based on the one hand on exercising his recognized profession and on the other hand on fulfilling his mandate (specifically: obtaining evidence for the purposes of a judicial or administrative procedure) for the client. With regard to the mandate (if the partner of the co-involved party is behaving in a way that is detrimental to recovery), the data processing cannot be justified, especially towards the co-involved party, because the client (employer of the co-involved party's partner) has no employment or contractual relationship with the co-involved party. As regards the possible status of witness in a possible procedure, it should be noted that the legitimate interest must already have arisen and existed at the time of processing and must not be merely hypothetical (cf. again ECJ 11.12.2019, C-708/18, TK/Asociaţia de Proprietari bloc M5A-ScaraA, para. 44)As regards the possible status of witness in a possible procedure, it should be noted that the legitimate interest must already have arisen and existed at the time of processing and must not be merely hypothetical (cf. again ECJ 11.12.2019, C-708/18, TK/Asociaţia de Proprietari bloc M5A-ScaraA, para. 44) The data processing subject to the procedure is also not necessary for the exercise of the profession of professional detective. The observation of the party involved, in particular the photographing of their person, was therefore not based on an overriding legitimate interest compared to the non-collection of this data from the party involved. 3.2.3. Compliance with the principles of data processing Since the data processing in question lacks the legally required legitimacy at the level of Art. 6 Para. 1 lit. f GDPR, the examination of whether the other mandatory factual requirements (in particular the question of whether the data processing also satisfies Art. 5 Para. 1 lit. c GDPR) are cumulatively present can be omitted in accordance with the cited case law of the ECJ. Since the data processing in question lacks the legally required legitimacy at the level of Article 6, paragraph one, letter f, GDPR, the examination of whether the other mandatory factual requirements (in particular the question of whether the data processing also complies with Article 5, paragraph one, letter c, GDPR) are cumulatively present can be omitted in accordance with the cited case law of the ECJ. The complaint was therefore dismissed as per the ruling. On the omission of the oral hearing: According to Section 24 Paragraph 4 of the Administrative Court Act, an oral hearing - which was not requested by any of the parties - could be dispensed with, since the facts appear to have been clarified from the undisputed file in connection with the complaint and an oral discussion is not expected to provide further clarification of the legal matter. Neither Article 6 Paragraph 1 of the Convention for the Protection of Human Rights and Fundamental Freedoms, Federal Law Gazette No. 210/1958, nor Article 47 of the Charter of Fundamental Rights of the European Union, Official Journal No. C 83 of 30 March 2010, p. 389, stand in the way of the cancellation of the hearing. The holding of an oral hearing – which was not requested by any of the parties – could be dispensed with in accordance with Paragraph 24, Paragraph 4 of the Administrative Court Act (VwGVG), since the facts of the case appear to have been clarified from the undisputed file in connection with the complaint and an oral discussion is not expected to provide further clarification of the legal matter. Neither Article 6, paragraph one, of the Convention for the Protection of Human Rights and Fundamental Freedoms, Federal Law Gazette No. 210 of 1958, nor Article 47 of the Charter of Fundamental Rights of the European Union, OJ No. C 83 of 30 March 2010, p. 389, preclude the cancellation of the hearing. 3.4. On B) Inadmissibility of the appeal: According to Section 25a, Paragraph 1 of the Administrative Court Act, the administrative court must state in its ruling or decision whether the appeal is admissible in accordance with Article 133, Paragraph 4 of the Federal Constitutional Court Act. The ruling must be briefly justified.According to Paragraph 25a, Paragraph 1 of the Administrative Court Act, the administrative court must state in its ruling or decision whether the appeal is admissible in accordance with Article 133, Paragraph 4 of the Federal Constitutional Court Act. The ruling must be briefly justified. According to Article 133, Paragraph 4 of the Federal Constitutional Court Act, the appeal is not admissible because the decision does not depend on the solution of a legal question that is of fundamental importance. The decision in question neither deviates from the previous case law of the Administrative Court, nor is there no case law; furthermore, the present case law of the Administrative Court cannot be judged to be inconsistent. There are also no other indications of the fundamental importance of the legal issue to be resolved. Specific legal issues of fundamental importance were neither raised in the complaint in question, nor did they arise in the proceedings before the Federal Administrative Court. The appeal is inadmissible under Article 133, paragraph 4, B-VG because the decision does not depend on the resolution of a legal issue of fundamental importance. The decision in question does not deviate from the previous case law of the Administrative Court, nor is there no case law; furthermore, the current case law of the Administrative Court cannot be judged to be inconsistent. There are also no other indications of the fundamental importance of the legal issue to be resolved. Specific legal issues of fundamental importance were neither raised in the complaint in question, nor did they arise in the proceedings before the Federal Administrative Court.
