BVwG - W211 2221963-1

The Austrian Federal Administrative Court held that the land register is a publicly accessible file and even a cost reimbursement and identification obligation does not necessarily mean that data is not publicly accessible. General availability is to be understood as legal and not factual. The Court additionally stressed that it cannot be generally assumed that if data is public, it is not possible at all to infringe the right to privacy and that privacy is not worth protecting. Only in the case of mere reproduction of "generally accessible data" without generation of new information can a lack of protection within the meaning of the Data Protection Act actually be assumed. If "new" data is created, the permissibility of its use must be examined completely anew according to the provisions of the data protection provisions.

BVwG - W211 2221963-1
Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 6 GDPR Article 21 GDPR §1 DSG Article 133(4) B-VG §7 GBG 1955
Decided:	29.07.2020
Published:
Parties:
National Case Number/Name:	W211 2221963-1
European Case Law Identifier:
Appeal from:
Appeal to:
Original Language(s):	German
Original Source:	Rechtsinformationssytem des Bundes (in German)
Initial Contributor:	Agnieszka Rapcewicz

English Summary

Facts

A natural person filed a complaint under the Data Protection Act (Datenschutzgesetz, DSG), in which it was summarised that the Company (appellant in this case - a real estate trustee and developer) had already sent letters to this natural person on several occasions, to his/her private address, in which the Company had expressed interest in acquiring the other party's property. Given the repeated sending of such letters, it had to be assumed that the Company had been processing the personal data of the involved party permanently for a long time. Therefore, on XXXX 2018, the natural person involved had asked the Company for information on the processing of personal data under Article 15 GDPR and, as it believed that any data processing that had been carried out was unlawful, he/she had requested that the data be deleted according to Article 17 GDPR. The complainant had not reacted to this request.

The Company claimed in the proceedings initiated by the DPA that unfortunately, due to internal misconduct, the letter had remained unanswered. The opinion was accompanied by a letter from the Company addressed to the other party on the same day, in which the request for information under Article 15 GDPR was complied with and the other party was informed that its personal data had been deleted. It must be added that the complainant searched the land register for the property of the co-participating party and in this way obtained the contact details of the party. Subsequently, the complainant used the data obtained from the land register (extract from the land register) to contact the party three times by post with a view to a possible purchase of the said property. The contact details of the co-interested party were not used for any other purpose. However, the Company had not informed the party concerned about the personal data not collected directly from the party, under Article 14 of the GDPR.

The data protection authority informally discontinued the proceedings regarding a violation of the right to information due to the subsequent elimination of the violation according to Article 24(6) of the Data Protection Act and informed the parties to the proceedings that the alleged violations of the right to secrecy and the obligation to provide information under Article 14 GDPR would be dealt with in a separate decision.

In the contested decision the DPA ruled, that the Company had violated the other party's right to confidentiality by obtaining its personal data from the land register and then contacting the party three times by letter to possibly acquire a property. It was further stated that the complainant had breached its duty to provide information.

Dispute

Has the Company violated the right to the confidentiality of the involved party by obtaining her personal data from the land register and then contacting her three times by letter to possibly acquire a property?

Holding

The Court dismissed the appeal.

Comment

The Court stressed that data from the land register used by the Company is undoubtedly personal data within the meaning of Article 4 (1) GDPR. Pursuant to Section 7 of the Land Register Act 1955, the land register is public and anyone may inspect it in the presence of a land registrar and obtain copies or excerpts. Pursuant to Section 1 (1) of the Data Protection Act, the existence of a confidentiality interest worth protection is excluded if data is not accessible to a confidentiality claim due to its general availability or due to its lack of traceability to the persons concerned.

The Court found that data is publicly accessible if it is available to the general public or at least to a larger group of people, i.e. if it is generally available. General availability is to be understood as legal and not factual. The decisive factor is whether an appropriately large circle of people may access data, not whether they can. A correspondingly large circle of persons authorised to access data and the fact that in individual cases it is not checked whether there is a legitimate interest in accessing the data are sufficient to qualify data as publicly accessible. The land register is considered a prime example of a publicly accessible file and shows that even a cost reimbursement and identification obligation does not necessarily mean that data is not publicly accessible.

In the view of the Federal Administrative Court data from the land register is generally available data within the meaning of Article 1(1) of the Data Protection Act. It is not overlooked that, as the data protection authority correctly notes in the contested decision, the general assumption of the non-existence of a violation of secrecy interests worth protection for data that has been permissibly published does not appear to be compatible with the requirements of European law.

It can be assumed that only in the case of mere reproduction of "generally accessible data" without generation of new information can a lack of protection within the meaning of Section 1 (1) of the Data Protection Act actually be assumed. This is because a data application that continues to use public data rarely consists exclusively of duplicating data that has already been published, as an added informational value must regularly be generated for economic reasons alone, even if it is only through a new system of offering information or through combining different publicly accessible data or publicly accessible data with other data. If this creates "new" data, the permissibility of their use must be examined completely anew according to the provisions of the DPA. The land register as a register that can be viewed by anyone and everyone and contains records of the respective legal relationships of various persons to a property facilitates economic transactions, saves costs, promotes economic development and grants legal certainty.

In the case at hand, the land register data of the co-participating party were used by the complainant for a total of three letters in order to find out the co-participating party's intentions to sell. This resulted in a change in the purpose of use of the data of the co-participating party collected from the land register, which means that the processing in question can be examined for a possible violation of the right to secrecy under Section 1 of the Data Protection Act. A possible justification is data processing on the basis of overriding legitimate interests within the meaning of Article 1(2) of the DPA, whereby a balancing of the interests of the involved party and those of the complainant must be carried out. we agree with the opinion of the data protection authority that the personal data of the involved party is publicly accessible in the land register and that it is not particularly sensitive data within the meaning of Article 1(2) second sentence of the Data Protection Act or sensitive data within the meaning of Article 9 of the Data Protection Regulation and also not criminally relevant data within the meaning of Article 10 of the Data Protection Regulation, which is why a lower level of protection is to be assumed.

However, the involved party has an interest in ensuring that its personal data are not regularly processed by the complainant for the purpose of enquiries regarding a possible sale of land. On the other hand, it has to be taken into account that the complainant's business as a real estate trustee and developer consists, inter alia, in acquiring new properties or plots of land that are of economic interest from its point of view.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Saying
W211 2221963-1/3E

In the name of the republic!

The Federal Administrative Court, by Judge Barbara SIMMA LL.M. as chairperson and the expert lay judge Margareta MAYER-HAINZ and the expert lay judge Dr. Ulrich E. ZELLENBERG as associate judge, rules on the appeal of XXXX GmbH, represented by Brand Rechtsanwälte GmbH, against item 1. of the decision of the data protection authority of XXXX, no. XXXX, in closed session. XXXX , in closed session:

A)

The appeal against item 1. of the contested decision is granted with the proviso that it shall read:

"The complaint is dismissed with regard to the asserted violation of the right to secrecy."

B)

The appeal is admissible pursuant to Article 133(4) of the Federal Constitution.



Text

GROUNDS OF DECISION:

I. Course of proceedings:

On XXXX 2019, the other party filed a complaint under the Data Protection Act (Datenschutzgesetz, DSG), in which it was summarised that the (now) complainant had already sent letters to the other party on several occasions, most recently on XXXX 2018, to the latter's private address, in which she had expressed interest in acquiring the other party's property. In view of the repeated sending of such letters, it had to be assumed that the complainant had been processing the personal data of the involved party on a permanent basis for a long time. Therefore, on XXXX 2018, the co-operating party had asked the complainant for information on the processing of personal data pursuant to Article 15 of the General Data Protection Regulation (GDPR) and, as it was of the opinion that any data processing that had been carried out was unlawful, it had requested that the data be deleted pursuant to Article 17 of the GDPR. The complainant had not reacted to this request. A legitimate interest within the meaning of Article 6(f) of the GDPR could not exist. Although the complainant may have a legitimate interest in contacting owners of properties it is interested in acquiring on a one-off basis in order to find out about their intentions to sell, this does not result in a right to longer-term data processing. Ignoring the request for information constituted a violation of Articles 12 and 15 of the GDPR. Furthermore, the complainant had not informed the co-operating party about the personal data not collected from the co-operating party in accordance with Article 14 of the GDPR. Attached to the data protection complaint were letters from the complainant dated XXXX 2017, XXXX 2017 and XXXX 2018, in which the complainant inquired about a possible interest in selling the co-participating party, as well as an email from the co-participating party addressed to the complainant dated XXXX 2018, which contained a request for the deletion of its personal data. 2.

In a letter dated XXXX 2019, the complainant stated that it had received the email from the co-operating party dated XXXX 2018, including a request for access to or deletion of personal data pursuant to Article 17 of the GDPR. Unfortunately, due to internal misconduct, the letter had remained unanswered. The opinion was accompanied by a letter from the complainant addressed to the other party on the same day, in which the request for information pursuant to Article 15 of the GDPR was complied with and the other party was informed that its personal data had been deleted. 3.

By letter of XXXX 2019, the intervening party stated that it considered the information provided by the complainant on the processing of its personal data to be sufficient and that it thus considered the infringement committed by the failure to provide the information pursuant to Article 15 of the GDPR to have been remedied. The situation was different in connection with the alleged violations of the duty to provide information pursuant to Articles 13 and 14 of the GDPR and of the right to confidentiality through unlawful data processing: The alleged violations had already finally occurred as a result of the data processing carried out without a (sufficient) legal basis or without informing the involved party. The subsequent deletion would not be able to eliminate these violations of rights either, since, unlike the violation of the right to information, this was not a permanent matter. 4.

In its decision of 25 March 2019, the data protection authority informally discontinued the proceedings regarding a violation of the right to information due to the subsequent elimination of the violation pursuant to Article 24(6) of the Data Protection Act and informed the parties to the proceedings that the alleged violations of the right to secrecy and the obligation to provide information would be dealt with in a separate decision.

In the contested decision of XXXX 2019, the data protection authority ruled,

that the complainant had violated the other party's right to confidentiality by obtaining its personal data from the land register and then contacting it three times by letter with a view to possibly acquiring a property (decision point 1.).

It was further stated that the complainant had breached its duty to provide information by not providing the other party with the information listed in paragraph 3 (paragraph 2).

The complainant was then ordered to provide the other party with the following information within a period of two weeks, failing which the complainant would be held liable (point 3): a. the legal basis for the processing of the other party's personal data (Art. 14(1)(c) of the GDPR), b. the duration for which the personal data was processed (Art. 14(1)(c) of the GDPR), c. the duration of the processing (Art. 14(1)(c) of the GDPR). the duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration (Art. 14(2)(a) GDPR), c. if the processing of the personal data of the involved party is based on Art. 6(1)(f) GDPR, the legitimate interests pursued by the complainant in the processing (Art. 14(2)(b) GDPR).

In addition, the complaint regarding a breach of the information obligations was rejected because the party involved already had the asserted information pursuant to Article 14 (1) (d), (e) and (f) and (2) (c), (e) and (f) of the GDPR in accordance with Article 14 (5) (a) of the GDPR (point 4).

It was explained that although the land register is a public register, according to the established case law of the Supreme Court (OGH), this does not mean that the facts to be taken from the register are generally known or even known by the courts, which is why one cannot simply speak of generally available data within the meaning of Article 1(1) of the Data Protection Act. According to the case law of the data protection authority, the very general assumption of the non-existence of a violation of confidentiality interests worthy of protection for permissibly published data was also not compatible with the provisions of the GDPR. Furthermore, it had to be taken into account that the present use of the personal data from the land register was not limited to mere reproduction, but that the data were used for the possible acquisition of properties in the context of the trade as a real estate trustee. This linkage constituted processing pursuant to Article 4(2) of the GDPR, which always required authorisation pursuant to the GDPR. In the present case, the lawfulness of the data processing could be considered on the basis of overriding legitimate interests, whereby the fact that the personal data of the other party was already publicly accessible in the land register meant that a lesser degree of protection could be assumed. The involved party had an interest in ensuring that its personal data were not permanently processed for the purpose of regular enquiries regarding a possible sale of land by the complainant. In contrast, the complainant, as a real estate trustee, had an interest in continuously acquiring new properties or plots of land that were of economic interest from its point of view, inter alia, by purchasing and managing (agricultural) land.
Overall, the data protection authority came to the conclusion that there had been a violation of the right to confidentiality, since due to the disproportionate contacting of the complainant three times within a period of slightly more than one year in order to ascertain the intention to buy, the legitimate interests of the involved party outweighed the interests of the complainant. In this context, the data protection authority explicitly stated that a mere one-off request to find out about the interest in selling was proportionate. With regard to the alleged failure to provide information pursuant to Art. 14 (1) (c), (d), (e), (f) and (2) (a), (b), (c), (e), (f) of the GDPR, it was stated that the complainant had not provided information on the legal basis of the data processing in question in any of the three requests by post, in the information provided on XXXX 2019 or at any other time. In the information provided on XXXX 2019, the co-respondent had been informed that her name, address and e-mail address were processed by the complainant. She had also been informed that her personal data would not be further transmitted. According to Article 14(2) of the GDPR, additional information had to be provided if this appeared necessary in order to ensure fair and transparent processing vis-à-vis the data subject: In the present case, it appeared necessary, with regard to fairness and transparency, that the complainant inform the involved party of the duration for which its personal data would be stored or, if this was not possible, of the criteria for determining this duration pursuant to Art. 14(2)(a) GDPR. It also appears necessary to inform the other party of the legitimate interests if the processing is based on Article 6(1)(f) of the GDPR, so that the other party can form an opinion on the processing and check its lawfulness in accordance with recital 63 of the GDPR. If the other party argues that it was not provided with the information pursuant to Article 14(2)(c) and (d) of the GDPR (existence of the right of access, rectification, erasure, restriction of processing and objection or the right to lodge a complaint with a supervisory authority), it must be noted that the other party has this information and, as a lawyer, has already asserted two of these rights.
In its complaint of XXXX 2019 against decision point 1 of the contested decision of the data protection authority, the complainant stated that it was also a property developer and, for this purpose, purchased land and subsequently sold or rented out flats. The complainant had personally sent a letter to the other party on XXXX 2018 (meaning XXXX 2017), which had remained unanswered. It was therefore unclear to the complainant whether the other party had not received the letter or had no intention to sell. It was the complainant's experience that even if there was an intention to sell, a property owner did not act on his own initiative, but had to be reminded two or three times. Often, the first letter would also give a property owner food for thought. In the present case, if the involved party had declared that it did not wish to be contacted, an immediate deletion would have taken place, but since this had not been the case, it had only been clear to the complainant after the third address that the involved party was not interested in concluding a purchase contract. The land register was a public register, which anyone could inspect at any time without violating the interests of the entitled and obligated parties listed in the land register. In the grounds for the contested decision, the data protection authority stated that data that had been published in a permissible manner had been linked to a new element and assumed that by combining publicly accessible data with other data, the permissibility of their use had to be reviewed in a completely new way. In the present case, however, this was not the case, as the name and postal address of the co-participating party had been used exactly as taken from the land register. The reference to the decision of 15 January 2019 (GZ DSB-D123.527/0004-DSB/2018) could also not be used as a justification, as in that case the data records ISd § 27 para. 1 ÄrzteG 1998 had been combined with the possibility of submitting an evaluation as well as a progress report, which had resulted in an informational added value and new personal data of a complainant - going beyond the data records pursuant to § 27 para. 1 ÄrzteG 1998 - had been processed. The case at hand was not comparable to this, because publicly accessible data from the land register had been used completely unchanged. Article 6(1)(f) of the GDPR could be used as a justification for the processing. The proportionality test of the data protection authority was insufficient and incorrectly substantiated. If it had been carried out correctly, it should have come to the conclusion that the interests or rights of the party involved were not overriding. The legitimate interest of the complainant as a property developer was to acquire new properties in order to build on them and to rent or sell flats. In this context, it should be added that the business interest in purchasing properties in order to build flats coincides with the public interest in creating more housing in XXXX. It should also be noted that according to Recital 47 of the GDPR, the processing of personal data for the purposes of direct marketing is a processing operation serving a legitimate interest. Based on the definition of advertising in Art. 2 lit a of the EU Directive 2006/114/EC, the processing at issue in the proceedings was undoubtedly to be subsumed under this. The risk and the severity of the consequences of the data processing for the data subject were to be classified as extremely low in the context of an impact assessment. Furthermore, only name and postal address would be processed, and the data would not be passed on, published or linked to other data, but would be used exclusively for the purpose of finding out whether an interesting property could be purchased. Moreover, this data was only stored until the complainant had positive knowledge that an interesting property was not being sold by the current owner. Moreover, the involved party could at any time terminate the further processing of its personal data by informing the complainant that it was not interested in the sale or by objecting to the data processing. However, the involved party had not done this.
7. by letter of XXXX 2019, the data protection authority submitted the file.

II. the Federal Administrative Court considered:

1. findings:

The complainant is a real estate trustee and developer. For this purpose, it purchases plots of land and builds flats on them, which it then sells or rents out.

The complainant searched the land register for the property of the co-participating party in XXXX and in this way obtained the contact details of the co-participating party. Subsequently, the complainant used the data obtained from the land register (extract from the land register) to contact the co-participating party three times by post with a view to a possible purchase of the said property by letters dated XXXX 2017, XXXX 2017 and XXXX 2018.

The contact details of the co-interested party were not used for any other purpose.

By letter of XXXX 2018, the co-operating party sent the complainant requests for access to and deletion of her personal data. These requests initially remained unanswered. In the course of the proceedings before the data protection authority, the complainant provided the involved party with information by letter of XXXX 2019 and informed it that it had deleted its personal data, whereupon the proceedings concerning an asserted violation of the right of access were informally discontinued by the data protection authority.

In the contested decision of XXXX 2019, the data protection authority found, inter alia, that the complainant had violated the right to confidentiality of the involved party by obtaining her personal data from the land register and then contacting her three times by letter for the purpose of possibly acquiring a property (decision point 1.).

The complaint of XXXX 2019 is directed exclusively against decision point 1 of the decision of the data protection authority of XXXX 2019.

2. assessment of evidence:

The findings result from the administrative act and are not disputed. The relevant facts could be established beyond doubt and completely on the basis of the available files.

3. legal assessment:

Concerning A)

1. legal basis:

§ Section 1 of the Federal Act on the Protection of Individuals with regard to the Processing of Personal Data (Data Protection Act - DSG) reads (in excerpts):

(constitutional provision)

Basic right to data protection

§ (1) Everyone has the right to confidentiality of personal data concerning him, in particular with regard to respect for his private and family life, insofar as there is an interest worthy of protection. The existence of such an interest shall be excluded if data is not accessible to a claim to secrecy due to its general availability or due to its lack of traceability to the person concerned.

(2) Unless the use of personal data is in the vital interest of the data subject or with his or her consent, restrictions to the right to secrecy shall only be permissible to protect overriding legitimate interests of another, and in the case of interference by a state authority only on the basis of laws which are necessary for the reasons set out in Article 8(2) of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No 210/1958. Such laws may only provide for the use of data which, by their nature, are particularly worthy of protection, in order to safeguard important public interests, and must at the same time lay down appropriate safeguards for the protection of the confidentiality interests of the data subjects. Even in the case of permissible restrictions, the encroachment on the fundamental right may only be carried out in the most lenient manner that leads to the objective.

[…]

The relevant provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of individuals with regard to the processing of personal data, on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation - GDPR), are:

Article 6 Lawfulness of processing

1. Processing shall be lawful only if at least one of the following conditions is met:

(a) - (e) [...]

(f) processing is necessary for the purposes of the legitimate interests of the controller or of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

[…]

Article 21 Right to object

1. The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her carried out on the basis of Article 6(1)(e) or (f), including any profiling based on those provisions. The controller shall no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

(2) If personal data are processed for the purposes of direct marketing, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing; this also applies to profiling insofar as it is related to such direct marketing.

(3) If the data subject objects to the processing for direct marketing purposes, the personal data shall no longer be processed for these purposes.

4. The data subject shall be expressly informed of the right referred to in paragraphs 1 and 2 at the latest at the time of the first communication with him or her; this information shall be given in a comprehensible form which is separate from other information.

[…]

§ Section 7 of the General Land Register Act 1955 (GBG 1955) reads:

§ 7 (1) The land register is public.

(2) Any person may inspect the land register in the presence of a land register officer and obtain copies or extracts thereof; the land register officer shall provide them.

(2) Application of the legal bases to the facts of the case at hand:

The data from the land register used by the complainant are undoubtedly personal data within the meaning of Article 4(1) of the GDPR. Pursuant to Section 7 of the Land Register Act 1955, the land register is public and anyone may inspect it in the presence of a land registrar and obtain copies or excerpts. Pursuant to Section 1 (1) of the Data Protection Act, the existence of a confidentiality interest worthy of protection is excluded if data is not accessible to a confidentiality claim due to its general availability or due to its lack of traceability to the persons concerned.

If the data protection authority refers in the contested decision to the case law of the Supreme Court, according to which the facts to be taken from the register are not generally known or even known to the courts, and concludes from this circumstance that in the case of land register data one cannot simply speak of generally available data within the meaning of section 1(1) of the Data Protection Act, this view cannot be shared by the Federal Administrative Court.
Data is publicly accessible if it is available to the general public or at least to a larger group of people, i.e. if it is generally available. General availability is to be understood as legal and not factual. The decisive factor is whether an appropriately large circle of people may access data, not whether they can. A correspondingly large circle of persons authorised to access data and the fact that in individual cases it is not checked whether there is a legitimate interest in accessing the data are sufficient to qualify data as publicly accessible. The land register is considered a prime example of a publicly accessible file and shows that even a cost reimbursement and identification obligation does not necessarily mean that data is not publicly accessible (Löffler in Knyrim, DatKomm Art 89 DSGVO Rz 65 (as of 1.10.2018, rdb.at)).

In this context, it should also be pointed out that the Administrative Court already clarified in 1992 (on the provision of Section 1 of the Data Protection Act 1978) that the prerequisite for a fundamental right claim under Section 1 of the Data Protection Act is the existence of an interest worthy of protection. Accordingly, information from public books, such as the land register or the company register, is not worthy of protection (VwGH 19.02.1992, 90/12/0267).

Against this background, there can be no doubt in the view of the Federal Administrative Court that data from the land register is generally available data within the meaning of Article 1(1) of the Data Protection Act.

Subsequently, however, it is not overlooked that, as the data protection authority correctly notes in the contested decision, the general assumption of the non-existence of a violation of secrecy interests worthy of protection for data that has been permissibly published does not appear to be compatible with the requirements of European law. In 2008, for example, the European Court of Justice affirmed the scope of application of the European data protection regime for publicly accessible data - in this case pursuant to Directive 95/46/EC (cf. ECJ 16.12.2008, C73/07 Satakunnan Markkinapörssi and Satamedia; this case concerned the public data of tax authorities, namely the surnames and first names of approx. 1.2 million natural persons, their income from capital and gainful employment and information on the taxation of their assets).

Nevertheless, it can be assumed that only in the case of mere reproduction of "generally accessible data" without generation of new information can a lack of protection within the meaning of Section 1 (1) of the Data Protection Act actually be assumed. This is because a data application that continues to use public data rarely consists exclusively of duplicating data that has already been published, as an added informational value must regularly be generated for economic reasons alone, even if it is only through a new system of offering information or through combining different publicly accessible data or publicly accessible data with other data. If this creates "new" data, the permissibility of their use must be examined completely anew according to the provisions of the DPA (cf. on the legal situation under the DPA 2000 Kotschy in Jahnel (ed.), Datenschutzrecht und EGovernment Jahrbuch 2012, p. 46f).

The land register as a register that can be viewed by anyone and everyone and contains records of the respective legal relationships of various persons to a property facilitates economic transactions, saves costs, promotes economic development and grants legal certainty (cf. Höller/Kodek in Kodek, Grundbuchsrecht2 Vor § 1 GBG (as of 1.9.2016, rdb.at)).

In the case at hand, the land register data of the co-participating party were used by the complainant for a total of three letters in order to find out the co-participating party's intentions to sell. This resulted in a change in the purpose of use of the data of the co-participating party collected from the land register, which means that the processing in question can be examined for a possible violation of the right to secrecy under Section 1 of the Data Protection Act.
A possible justification is data processing on the basis of overriding legitimate interests within the meaning of Article 1(2) of the DPA, whereby a balancing of the interests of the involved party and those of the complainant must be carried out. Due to the direct applicability of the GDPR, an interpretation of Section 1 of the GDPR in conformity with EU law is required (Lachmayer in Knyrim, DatKomm Art 1 DSGVO Rz 70 (as of 1.12.2018, rdb.at)), which is why Art. 6 lit f DSGVO (processing necessary to protect the legitimate interests of the controller(s) or a third party) must be used for interpretation.

First of all, we agree with the opinion of the data protection authority that the personal data of the involved party is publicly accessible in the land register and that it is not particularly sensitive data within the meaning of Article 1(2) second sentence of the Data Protection Act or sensitive data within the meaning of Article 9 of the Data Protection Regulation and also not criminally relevant data within the meaning of Article 10 of the Data Protection Regulation, which is why a lower level of protection is to be assumed.

However, the involved party has an interest in ensuring that its personal data are not regularly processed by the complainant for the purpose of enquiries regarding a possible sale of land. On the other hand, it has to be taken into account that the complainant's business as a real estate trustee and developer consists, inter alia, in acquiring new properties or plots of land that are of economic interest from its point of view.

If the complainant points out in her complaint that the activity of writing to potential property sellers is to be understood as direct advertising within the meaning of the GDPR, which, according to recital 47, constitutes processing serving a legitimate interest pursuant to Art. 6 lit f of the GDPR, it should be noted that the term direct advertising is not defined in more detail either in the GDPR or in the TKG 2003. According to the case law on § 107 TKG 2003, the term "direct advertising" is to be understood as any content that promotes or provides arguments for a specific product, but also for a specific idea, including specific political concerns. In addition, the Supreme Court has repeatedly held that the term "direct advertising" is to be interpreted broadly. It covers any electronic mail that advertises a certain product, but also a certain idea, or provides arguments for it; it also includes any measure that serves to point out an individual need and the possibility of satisfying it, whereby even the suggestion to use certain services can be included in this term. Remuneration is not required (Haidinger in Knyrim, DatKomm Art 21 DSGVO Rz 33 (as of 1.10.2018, rdb.at)). Contacting property owners for the purpose of acquiring properties can therefore certainly be considered direct advertising and thus a legitimate interest under Art. 6 lit f DSGVO.

The existence of such a legitimate interest does not, however, release the complainant from the need to further weigh up the interests involved: In the case at hand, the complainant contacted the other party by post a total of three times, whereby two letters were sent within the short period of one month. If the data protection authority states in the contested decision that contacting the complainant twice within one month and a total of three times in slightly more than one year is to be regarded as disproportionate and going beyond the manifestation of a legitimate interest, this assessment cannot be followed. The discerning senate does not overlook the fact that the complainant contacted the involved party several times; nevertheless, the sending of a total of three letters to the address of the involved party, which is publicly accessible through the land register, cannot be seen as a disproportionate use of those - publicly accessible - data within a little more than one year. When comparing the interests of the parties to the effect that the complainant pursues its economic business objective with components of the public interest in the creation of housing in the context of the direct advertising explicitly mentioned in the explanations of the GDPR on the basis of publicly accessible data, while the other party received a total of three unsolicited letters in the context of this use of its publicly accessible data in a period of slightly more than one year, it cannot be said that the interests of the other party are currently outweighed.
Thus, with regard to the factors to be included in the examination a) the general availability of the data in question, b) the specific mention of a legitimate interest in the possibility of direct marketing in recital 47 of the GDPR itself, as well as c) the low severity of the encroachment on the rights of the involved party in the weighing of interests to be carried out with the three letters in the period of slightly more than one year, the discerning senate arrives at a different weighting than the data protection authority.

Only in addition, it is noted that especially in the case of this outcome of the complaint procedure - after weighing the interests in the individual case - the importance of complying with the information obligations pursuant to Articles 13 and 14 of the GDPR must be emphasised in order to grant data subjects transparency regarding the processing of their data and to enable them to exercise their rights. The complainant's omissions in this regard were already - correctly - explicitly stated in the not contested points 2. and 3. of the decision of XXXX. 3.

Pursuant to § 24 (1) VwGVG, the administrative court shall hold a public hearing upon request or, if it deems it necessary, ex officio. Pursuant to § 24 (4) VwGVG, the administrative court may - unless otherwise provided by federal or provincial law - dispense with a hearing, notwithstanding a party application, if the files indicate that the oral discussion is unlikely to lead to a further clarification of the case and neither Art. 6 (1) ECHR nor Art. 47 CFR preclude the dispensing with the hearing.

In the case at hand, the omission of an oral hearing can be based on the fact that the facts of the case for the assessment of the complaint have been clarified from the file in connection with the submissions of the complainant. Neither did the facts need to be supplemented in essential points nor did they appear to be incorrect in decisive points. In the present case, the Federal Administrative Court therefore has to rule exclusively on questions of law (cf. ECHR 5 September 2002, Appl. no. 42057/98, Speil v. Austria). Also according to the case law of the Constitutional Court, an oral hearing can be omitted if the facts of the case are undisputed and the legal question is not of any particular complexity (VfSlg. 17.597/2005; VfSlg. 17.855/2006; most recently, for example, VfGH 18.6.2012, B 155/12).

Apart from that, the parties did not request an oral appeal hearing.

Re B) Admissibility of the appeal:

Pursuant to section 25a (1) VwGG, the administrative court has to state in its decision whether the appeal is admissible pursuant to Art. 133 (4) B-VG. The decision shall be briefly substantiated. The appeal is admissible pursuant to Art. 133 para. 4 B-VG because there is a lack of case law of the Administrative Court, inter alia, on whether the change of the purpose of use of land register data constitutes a corresponding linking of data that requires a justification.

Therefore, the decision had to be in accordance with the ruling.