BVwG - W211 2223243-1

BVwG - W211 2223243-1
Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 13 GDPR Article 15 GDPR Article 77 GDPR § 24 Datenschutzgesetz - DSG
Decided:	28.07.2020
Published:	28.12.2020
Parties:	Österreichische Post AG
National Case Number/Name:	W211 2223243-1
European Case Law Identifier:
Appeal from:
Appeal to:	Unknown
Original Language(s):	German
Original Source:	RIS (in German)
Initial Contributor:	n/a

The Federal Administrative Court ruled on the legality of an Article 15 GDPR deadline extension, upholding the DSB’s decision that the Austrian Post had rightfully made use of an extended deadline due to the high volume and complexity of requests the Post was receiving at the time.

The data subject’s statement that there had been an infringement on their ability to exercise their rights was therefore rejected.

English Summary

Facts

In 2019, the data subject submitted an access request under Article 15 to the Austrian Post. The Austrian Post replied to the data subject stating that due to the high number of inquiries in connection of media coverage that they have, complainant within three months as opposed to one month. The data subject replied stating that their request was not complicated, and that they would like to have an answer within one month. No answer was provided to the data subject within the one-month time frame.

The data subject then submitted a complaint to the Austrian Data Protection Authority (DSB), in which he stated that (1) he had not received an answer to his Article 15 request from the Post within a one-month, and (2) the information received from his Article 13 request was partially incorrect.

The DSB replied stating that they could not yet ascertain whether a subjective right had been violated, given that the three-month period had not expired yet. The DSB told the complainant that they could informally withdraw the complaint within two weeks, or expect a rejection. The complainant replied to the DSB stating that their complaint should remain valid because the information provided by the Post had also been incorrect (Article 13 GDPR). However, the DSB rejected this reasoning, stating that the suggested infringement of Article 13 was to be treated separately in scope to the suggested infringement of Article 15, and that a new complaint should therefore be submitted. Moreover, the DSB stated that

The data subject complained about the DSB’s legal assessment, stating that their legal assessment was incorrect and that they had violated essential procedural rules. The data subject claimed that the three-month deadline should only be used in exceptional cases, and that the DSB had erred in assessing that this instance was one such case. The data subject claimed that the DSB had infringed his rights by causing a delay in his ability to exercise his rights. The data protection authority then referred the case to the Federal Administrative Court.

Dispute

Was the legality of the deadline extension taken by the Austrian Post legitimate within the meaning of the GDPR?

Holding

Taking into account both the relevant national provisions and provisions of the GDPR, the Federal Administrative Court held that there had indeed been a great deal of media responses at the time at which the data subject submitted their complaint. Therefore, the delay in answering the request of the data subject was justified.

With regards to the data subject’s claim that their request regarding missing information according to Article 13 GDPR had not been dealt with, the Federal Administrative Court held that this did not fall within the scope of the contested decision, and therefore was not to be dealt with in the current complaint procedure.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

W211 2223243-1 / 4E

On behalf of the republic!

The Federal Administrative Court recognizes through the judge Mag.a Barbara SIMMA LL.M. as chairwoman and the expert lay judge Margareta MAYER-HAINZ and the expert lay judge Dr. Ulrich E. ZELLENBERG as observer and observer on the complaint of the XXXX against the decision of the data protection authority of XXXX, Zl. XXXX, rightly in a closed meeting:

A)

The complaint is dismissed as unsubstantiated.

B)

The revision is permissible according to Art. 133 Para. 4 B-VG.



text

REASONS FOR DECISION:

I. Procedure:

1. The complainant submitted a request for information in accordance with Art. 15 by email dated XXXX 2019 Previous search termGDPRNext search term to Österreichische Post AG (the participating party).

In an email dated XXXX 2019, the party involved announced that, due to the high number of inquiries in connection with media coverage, they had submitted the inquiry in accordance with the Previous search termGDPRNext search term as soon as possible, at least within three months (Art. 12 Paragraph 3 Sentence 2Previous search termGDPRNext search term ).

The complainant replied to the involved party by email dated XXXX 2019 that his request was not very complex and that he would therefore continue to be asked to answer the request within the legally prescribed period of one month.

2. With a complaint to the data protection authority of XXXX 2019, the complainant complained that the party involved in their obligation to provide information according to Art. 15 Previous search termGDPR wasNext search term not complied with within one month. In addition, it complies with the information requirements according to ArtPrevious search termGDPRNext search term not complied with. In the form it was ticked that a violation of the right to information and the right to object is asserted. To explain why the extension of the deadline by the party involved was not permitted, it was stated that the requirements of a high number of applications and the complexity of the applications must cumulatively exist for an extension of the deadline, which is not the case here.

3. In an email dated XXXX 2019, the complainant filed a complaint with the data protection authority with reference to the response to the request for information by the party involved, stating that the information had been answered partly incorrectly and partly incomplete. In addition, reference is made to the complaint against the extension of the deadline for answering the request for information from XXXX 2019.

4. In a letter dated XXXX 2019, the data protection authority notified the complainant's letter dated XXXX 2019 that this had initially been recorded as an input in the complaint procedure in question. There is no entitlement to a determination that a subjective right has been violated in the past. If the complainant does not receive any or an inadequate response to his request for information after the period of three months has expired, he can file a complaint with the data protection authority. The complaint can also be withdrawn informally within two weeks, otherwise a rejection can be expected.

5. With an email dated XXXX 2019, the complainant announced that his submission of XXXX 2019 would in any case remain valid because the information provided was inadequate. Insofar as the application of XXXX 2019 for the non-disclosure of information according to Art. 13Previous search termGDPRNext search term , this illegality still persists and the application will therefore not be withdrawn. The request to determine the delay in the provision of information will be withdrawn if the data protection authority can state whether a person responsible has the right to extend the deadline for answering the question himself (probably meant :) to three months without being prosecuted Authority can check the reasons for this.

6. With the contested decision, the data protection authority rejected the complaint because the information was not provided. The reason given was that the complainant's second submission of XXXX 2019 regarding an alleged deficiency of the information was to be assessed as a new submission in a procedure to be dealt with separately, since the nature of the complaint had thereby changed. With regard to the information provided by the complainant in his email dated XXXX 2019, the data protection authority stated that it was not allowed to make abstract statements that would come close to a legal opinion. A conditional withdrawal of an application is ineffective. According to § 24 Abs.6 DSG, a respondent can subsequently eliminate the alleged violation of the law until a procedure before the data protection authority has been concluded. The proceedings are then to be discontinued informally, unless a complainant states what had happened in the proceedings and why the complaint had to be rejected.

7. With a complaint of XXXX 2019, the complainant complained about an incorrect legal assessment, incorrect statements of fact and the violation of essential procedural rules and stated in summary that the legal basis of his complaint was Art. 15 Previous search termGDPRNext search term and not Section 24 (6) GDPR used by the authority concerned. The legal basis of the right of appeal is Art. 77Previous search termDSGVONext search term , which knows no restriction, e.g. regarding the determination of legal violations in the past. The legal view of the authority is therefore not covered by this provision. If one considers Art. 12 Para. 3Previous search termGDPRNext search term , it can be assumed that the fee-based extension of the deadline would have to be verifiable by the supervisory authority, otherwise the European legislator would not have had to bind it to criteria. Finally, there is no cover in Art. 15Previous search termGDPRNext search term that catching up on the omitted act could cure the legal violation. The maximum period of 3 months for providing information may only be used in exceptional cases. There is therefore an interest in the establishment of this violation of the law, since the complainant was only later enabled to exercise his rights to deletion, correction or the right of objection due to the extension of the deadline. It is suggested that these issues be referred to the ECJ. Furthermore, the complaint regarding the failure to provide information according to Art. 13, 14Previous search termDSGVO hasNext search term not been agreed by the party involved. Finally, the data protection authority was unclear in its communication of XXXX 2019, which is why it can be assumed that no information was given in accordance with Section 24 (7) DSG. The complainant was therefore unable to exercise essential party rights in the proceedings, as it was not clear which letter the data protection authority was referring to. Furthermore, the parties were not allowed to be heard and the findings in the decision were incomplete.

8. By letter of XXXX 2019 the data protection authority submitted the file.

II. The Federal Administrative Court has considered:

1. Findings:

The complainant sent an email dated XXXX 2019 a request for information according to Art. 15 Previous search termGDPRNext search term to the involved party. The party involved indicated by email dated XXXX 2019 that, due to the large number of inquiries in connection with media coverage, the request should be answered as soon as possible, at least within three months.

On XXXX 2019, the complainant then lodged a complaint with the authority concerned and complained that the information was not provided within the prescribed period of one month and that the extension of the deadline was not permitted. In addition, he was not from the processing of the data according to Art. 13Previous search termGDPR has beenNext search term informed.

The party involved provided the information in a letter dated XXXX 2019.

With a complaint dated XXXX 2019, the complainant made the point that the information provided was incomplete and partially incorrect. He also referred to the complaint of XXXX 2019.

With the disputed decision, the authority concerned rejected the complaint because the information was not provided.

2. Evidence assessment:

The findings result from the administrative act and are not disputed. The relevant facts could be determined unequivocally and completely on the basis of the available files.

3. Legal assessment:

To A)

1. Legal basis:

Section 1 of the Federal Act for the Protection of Natural Persons in the Processing of Personal Data (Data Protection Act - DSG) reads (in excerpts):

Complaint to the data protection authority

§ 24. (1) Every data subject has the right to lodge a complaint with the data protection authority if they are of the opinion that the processing of their personal data is contrary to the Previous search termGDPRNext search term or § 1 or Article 2 1st main section violates.

(2) The complaint must contain:

1. the designation of the right considered to be infringed,

2. insofar as this is reasonable, the designation of the legal entity or body to which the alleged infringement is attributed (respondent),

3. the facts from which the infringement is derived,

4. the reasons on which the allegation of illegality is based,

5. the request to establish the alleged infringement and

6. the information necessary to assess whether the complaint was filed in a timely manner.

(3) The underlying application and any response from the respondent may be attached to a complaint. In the event of a complaint, the data protection authority must provide further assistance at the request of the data subject.

(4) The entitlement to a complaint being dealt with expires if the person intervening does not bring it in within one year of becoming aware of the complaining event, but no longer than three years after the event allegedly took place. Late complaints must be rejected.

(5) If a complaint proves to be justified, it must be followed up. If a violation can be attributed to a person responsible in the private sector, this person must be instructed to comply with the complainant's requests for information, correction, deletion, restriction or data transfer to the extent necessary to eliminate the legal violation identified. If the complaint proves to be unjustified, it must be dismissed.

(6) A respondent can subsequently eliminate the alleged infringement of the law by completing the proceedings before the data protection authority by responding to the complainant's requests. If the data protection authority considers the complaint to be irrelevant, it must hear the complainant about it. At the same time, attention must be drawn to the fact that the data protection authority will informally terminate the procedure if it does not justify within a reasonable period of time why it still considers the originally alleged infringement to be at least partially not remedied. If such a statement by the complainant changes the nature of the matter (Section 13 (8) AVG), it is assumed that the original complaint has been withdrawn and a new complaint has been introduced at the same time.In this case, too, the original complaint procedure must be discontinued informally and the complainant informed. Late comments are not to be taken into account.

(7) The complainant will be informed by the data protection authority within three months of the filing of the complaint about the status and the result of the investigation.

The relevant provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data, on the free movement of data and on the repeal of Directive 95/46 / EC (General Data Protection Regulation - Previous search termGDPRNext search term ), are:

Article 12

Transparent information, communication and modalities for exercising the rights of the data subject

1. The controller shall take appropriate measures to provide the data subject with all information pursuant to Articles 13 and 14 and all communications pursuant to Articles 15 to 22 and Article 34 relating to processing in a more precise, transparent, understandable and easily accessible manner To convey form in clear and simple language; this applies in particular to information that is specifically aimed at children. The information is transmitted in writing or in another form, possibly also electronically. If requested by the person concerned, the information can be given orally, provided that the identity of the person concerned has been proven in another form.

(2) The controller facilitates the data subject's exercise of their rights under Articles 15 to 22. In the cases referred to in Article 11 (2), the controller may only refuse on the basis of the data subject's request to exercise his or her rights under Articles 15 to 22 to take action if he can credibly show that he is not able to identify the person concerned.

(3) The controller shall provide the data subject with information about the measures taken upon request pursuant to Articles 15 to 22 without delay, but in any case within one month of receipt of the request. This period can be extended by a further two months if this is necessary taking into account the complexity and the number of applications. The person responsible will inform the data subject within one month of receipt of the request of an extension of the deadline, together with the reasons for the delay. If the person concerned submits the application electronically, they must be informed electronically if possible, unless they indicate otherwise.

(4) If the person responsible does not act on the request of the data subject, he shall inform the data subject without delay, but at the latest within one month after receipt of the request, of the reasons for this and of the possibility of lodging a complaint with a supervisory authority or a to appeal to a court.

5. Information pursuant to Articles 13 and 14, as well as all communications and measures pursuant to Articles 15 to 22 and Article 34, shall be provided free of charge. In the case of obviously unfounded or - especially in the case of frequent repetition - excessive requests by a data subject, the person responsible can either

a)

request an appropriate remuneration that takes into account the administrative costs of informing or notifying or implementing the requested measure, or

b)

refuse to act on the request.

The person responsible must provide evidence that the application is manifestly unfounded or excessive.

6. If the controller has reasonable doubts about the identity of the natural person making the application pursuant to Articles 15 to 21, without prejudice to Article 11, he may request additional information necessary to confirm the identity of the data subject.

(7) The information to be provided to the data subjects in accordance with Articles 13 and 14 can be provided in combination with standardized icons in order to provide a meaningful overview of the intended processing in an easily perceptible, understandable and clearly comprehensible form. If the icons are displayed in electronic form, they must be machine-readable.

8. The Commission is empowered to adopt delegated acts in accordance with Article 92 to determine the information to be presented by icons and the procedures for the provision of standardized icons.

Article 15

Right of the data subject to be informed

(1) The person concerned has the right to request confirmation from the person responsible as to whether personal data concerning them are being processed; If this is the case, she has a right to information about this personal data and the following information:

a)

the purposes of the processing;

b)

the categories of personal data that are processed;

c)

the recipients or categories of recipients to whom the personal data have been disclosed or are still being disclosed, in particular to recipients in third countries or to international organizations;

d)

if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration;

e)

the existence of a right to correction or deletion of the personal data concerning you or to restriction of processing by the person responsible or a right to object to this processing;

f)

the existence of a right of appeal to a supervisory authority;

G)

if the personal data are not collected from the data subject, all available information on the origin of the data;

H)

the existence of automated decision-making including profiling in accordance with Article 22 paragraphs 1 and 4 and - at least in these cases - meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

(2) If personal data are transmitted to a third country or to an international organization, the data subject has the right to be informed of the appropriate guarantees pursuant to Article 46 in connection with the transmission.

(3) The controller provides a copy of the personal data that is the subject of the processing. For all further copies that the person concerned requests, the person responsible can demand an appropriate fee based on the administrative costs. If the data subject submits the application electronically, the information must be made available in a common electronic format, unless otherwise stated.

(4) The right to receive a copy in accordance with paragraph 1b must not impair the rights and freedoms of other persons.

Article 77

Right to complain to a supervisory authority

(1) Without prejudice to any other administrative or judicial remedy, every person concerned has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their place of residence, their place of work or the place of the alleged infringement, if the person concerned is of the opinion that the processing of the personal data concerning them violates this regulation.

(2) The supervisory authority to which the complaint was lodged shall inform the complainant of the status and the results of the complaint, including the possibility of a judicial remedy in accordance with Article 78.

2. Application of the legal bases to the facts at hand:

2.1. Retrospective determination of the non-provision of information; Legality of the deadline extension

The matter before the administrative court is basically the matter that has to be dealt with by the administrative authority, however the matter of the contested decision represents the ultimate framework for the administrative court's authority to examine. The matter of the appeal procedure is that matter which the content of the verdict of the before Administrative authority concerned with the administrative court (see VwGH, 17.10.2019, Ro 2019/18/0005 with reference to VwGH, 09.09.2015, Ro 2015/03/0032 mwN). Accordingly, it should be noted that the contested decision rejected the complainant's complaint because the information was not provided. The administrative court's authority to review is thus limited to the matter of the criticized failure to provide information.

As stated in the findings, the party involved provided the complainant with information about the data stored by them regarding the complainant by email and enclosures dated XXXX 2019. The extent to which this information is correct and complete is not a matter for the present proceedings.

Insofar as the complainant complains that the information was given late, the grounds of an ed. Based on the findings of January 31, 2020, Zl. W258 2226305-1 / 5E, which the relevant Senate agrees:

"According to § 24 Paragraph 1 DSG, which according to § 34 Paragraph 5 DSG is to be applied accordingly in the scope of the 3rd main part of the DSG, every person concerned has the right to complain to the data protection authority if they are of the opinion that the processing of the personal data concerning them violates main part 3 of the DSG. According to Section 24 (5) DSG, in the case of a justified complaint about a violation that is attributable to a person responsible in the private sector, the person responsible in the private sector must be instructed to comply with the complainant's requests, for example to provide the requested information. Paragraph 6 leg cit stipulates that a respondent can subsequently remove the alleged infringement by completing the proceedings before the data protection authority by responding to the complainant's requests.In this case, the authority concerned has to terminate the procedure informally.

3.2.3. From this it is clear that § 24 DSG is intended to grant affected persons the right to enforce any violations of rights that arise from the - here 3rd main part of the - DSG (Bresich / Dopplinger / Dörnhöfer / Kunnert / Riedl, DSG (2018) § 24 margin no.7). A determination of legal violations that no longer exist at the time of the decision of the data protection authority is expressly not provided, in such a case the procedure must be terminated informally. This interpretation is also supported by the present tense § 24 Paragraph 1 DSG "violates" and not "has violated" and § 24 Paragraph 5 DSG, according to which a performance notice must be issued in the event of a justified complaint about a violation by those responsible in the private sector.This would not be possible in the event of a legal violation that has already been resolved.

3.2.4. The Administrative Court has also denied such a right to the Data Protection Act 2000 (DSG 2000) BGBl I No. 1999/1965 , in the version BGBl I No. 13/2005 (VwGH 27.09.2007 2006/06/0330 with reference to the fundamental decision VwGH 28.03. 2006 2004/06/0125). Although this decision - as the complainant correctly explains - is not directly transferable to the new legal situation (Section 24 in conjunction with Section 34 Paragraph 5 in conjunction with Section 44 in conjunction with Section 42 Paragraph 4 DSG; Section 9 PNR-G) due to the changed wording of the law, the The fundamental considerations of the Higher Administrative Court - which essentially correspond to the considerations outlined above - are transferred to the new legal situation.

3.2.5. Likewise, Directive (EU) 2016/680 of the European Parliament and of the Council of April 27, 2016 speaks about the protection of natural persons in the processing of personal data by the competent authorities for the purpose of preventing, investigating, detecting or prosecuting criminal offenses or the execution of sentences as well on the free movement of data and the repeal of the framework decision 2008/977 / JHA of the Council, on the basis of which the 3rd main part of the DSG was issued, in the scope of which data subjects can lodge complaints according to § 24 DSG, not against this interpretation. Thus, Article 52 of the Directive (Article 54 referred to by the complainant is not relevant because it relates to judicial protection and not to the legal protection at issue here before a supervisory authority),grants the data subject the right to lodge a complaint with a supervisory authority if they are of the opinion that the processing of the personal data concerning them violates the regulations enacted under this directive, also kept in the present tense ("violates"). In addition, according to Recital 43 of the Directive, the right of access is intended to enable data subjects to be aware of the processing of personal data concerning them and to check their legality. In order to achieve this goal, it is not necessary for data subjects to have violations of the law that have been remedied in the meantime determined by notification.that the processing of personal data concerning you violates the regulations issued under this directive, also kept in the present tense ("violates"). In addition, according to Recital 43 of the Directive, the right of access is intended to enable data subjects to be aware of the processing of personal data concerning them and to check their legality. In order to achieve this goal, it is not necessary for data subjects to have violations of the law that have been remedied in the meantime determined by notification.that the processing of personal data concerning you violates the regulations issued under this directive, also kept in the present tense ("violates"). In addition, according to Recital 43 of the Directive, the right of access is intended to enable data subjects to be aware of the processing of personal data concerning them and to check their legality. In order to achieve this goal, it is not necessary for data subjects to have violations of the law that have been remedied in the meantime determined by notification.to be aware of the processing of personal data concerning them and to check their legality. In order to achieve this goal, it is not necessary for data subjects to have violations of the law that have been remedied in the meantime determined by notification.to be aware of the processing of personal data concerning them and to check their legality. In order to achieve this goal, it is not necessary for data subjects to have violations of the law that have been remedied in the meantime determined by notification.

3.2.6. Since the guideline does not give the supervisory authority a right to a notification of a determination of a violation of the right to information that has been resolved in the meantime, the complainant's reference to Art 47 GRC, which only guarantees an effective legal remedy with regard to those guaranteed by Union law, does not result from the directive Granting rights or freedoms into nothing.

3.2.7. Finally, the Constitutional Court has the legal situation before the DSG 2000, namely the right to information according to the Data Protection Act as amended by Federal Law Gazette No. 565/1978, in which Section 14 (1) DSG even - comparable with the current wording of the law - was based on the fact that the complainant alleged that his rights had been violated due to a violation of provisions of this federal law or the implementing provisions issued on the basis of this federal law, a right on finding of past and now resolved legal violations negated (VfGH June 26, 1991, VfSgl. No. 12.768). In particular, it follows that, contrary to the complainant's opinion expressed in the complaint in question, the fundamental right to data protection, which has not changed with regard to the right to information - insofar as this is relevant to the decision - has not changed (Section 1 (3) Data Protection Act as amended by Federal Law Gazette No. . 565/1978 or § 1 Abs 3 Z 1 DSG as amendedFederal Law Gazette I No. 165/1999 last amended by Federal Law Gazette I No. 51/2012 ) does not result in the fact that a person concerned must be granted the right to a notification of past legal violations. The unconstitutionality of Section 24 (6) DSG that the complainant has put forward in this regard is therefore also not present. "

In the sense of the above-cited paragraph “3.2.5.”, It is pointed out that Art. 77 Previous search termGDPRNext search term speaks of the fact that data subjects have the right to lodge a complaint with a supervisory authority if they are of the opinion that the processing of their personal data violates this regulation - thus the text to be used here is kept in the present tense.

Finally, with comparable justification, it must also be denied that the party involved can have a claim to the determination of a possibly unjustified extension of the deadline after the information has been provided (here, incidentally, within the announced three months).

The suggestion of a submission to the European Court of Justice did not have to be dealt with, since in the opinion of the judging Senate, the applicable legal situation and interpretation, as set out above, is sufficiently clear.

If the complainant thinks that an unlawful extension of the deadline that cannot be subsequently determined would - in summary - lead to too long deadlines for answering requests for information, it must be countered that the data protection law also applies to official intervention by the authority concerned (in particular Section 32 (1) 1 and 33 DSG), which can lead to the prohibition of the operation of the data application (Section 33 (2) 3 DSG) and thus provides for sanctions if those responsible do not fulfill requests for information in good time. The right to (timely) information therefore does not become obsolete if compliance is only ensured ex officio and not also through a party application (see again BVwG 31.01.2020, Zl. W258 2226305-1 / 5E). In addition, it is noted at this point thatthat precisely in connection with the use of data by the party involved, there was a great media response at the beginning of January 2019, which understandably will have led to an increased increase in requests for information from the party involved (see, for example, Heckmann / Paschke in Ehmann / Selmayer , DS-GVO, Art 12, K 33); The complainant in question also submitted his request on XXXX 2019, and thus during this period. The involved party announced within the period of one month provided that due to the large number of requests for information, an extension of two months would have to be taken. The information was finally given within the period of three months.Accordingly, neither the extension of the deadline notified by the party involved is in principle implausible, nor has the information actually been given with a relevant delay. Finally, it should also be pointed out that the necessary cumulative requirement for both extension criteria for the period in Art. 12 Para. 3Previous search termDSGVONext search term , namely the complexity and number of applications, is questioned (see Illibauer in Knyrim, DatKomm Art 12Previous search termGDPRNext search term (as of October 1, 2018, rdb.at), K 88).

Finally, the argument put forward that the complainant was late in receiving knowledge of the processing of special categories of personal data - namely data on political convictions - due to the extension of the deadline, which is why he did not have his further rights as a data subject, such as deletion, correction and objection - probably Meant: earlier - be able to perceive, reference must be made again to the media reporting relevant to the party involved in his letter of XXXX 2019, according to which the complainant will probably be able to perceive as early as 7th (cf., among others, https: //www.addendum. org / datenhandel / parteiaffinitaet / , https://futurezone.at/netzpolitik/oesterreichische-post-verkauf-daten-ueber-politische-vorlieben/400370723) or 09.01.2019 ( https://kurier.at/politik/inland/diese-parts-kauften-post-daten/400372577 ) in knowledge of the relevant practice of the party involved and submitted a request for deletion, correction or an objection could have brought in. Recital 63 of thePrevious search termGDPR alsoNext search term provides that a data subject should have a right to information regarding their personal data and should be able to exercise it without problems and at regular intervals in order to be aware of the processing and to be able to check its legality. However, the right to information is also not a prerequisite for the use of other data subject rights (cf. Haidinger in Knyrim, DatKomm Art 15Previous search termGDPRNext search term (as of October 1st, 2018, rdb.at).

2.2. On the other objections:

Information obligations according to Art. 13 Previous search termGDPRNext search term :

If the complainant complains that his request regarding the missing information according to Art. 13 Previous search termGDPR hasNext search term not been dealt with, it must be stated that this - separable - complaint was not the subject of the contested decision, which is why it cannot be addressed in the present complaint procedure.

Message from the DPO:

Regarding the procedural error brought forward in the notification by the data protection authority, it should be said that the data protection authority's letter of XXXX 2019 clearly shows that the complainant's input from XXXX 2019 "initially logged as input in the complaint procedure", which is why it is not understandable to what extent the The data protection authority is said to have made an unclear statement. The complainant also took the opportunity and submitted a written statement to the proceedings on XXXX 2019. Thus, the results of the proceedings did not result in any violations of relevant procedural rules and party rights of the complainant, which is why the requested statement on this was not to be made.

Request for a declaration that the complaint regarding Art. 13 Previous search termGDPR hasNext search term not been withdrawn:

Since the present proceedings concern the decision with which the complaint was discussed because information was not provided, the question is whether the complaint about the information obligations according to Art. 13 Previous search termGDPR has been withdrawn or not, is not the subject of the complaint procedure.

3. Since only legal issues had to be clarified in the proceedings, the implementation of an - not requested - oral hearing could be dispensed with in accordance with Section 24 (4) VwGVG (VwGH 19.09.2017, Ra 2017/01/0276).

To B) Admissibility of the revision:

Pursuant to Section 25a (1) VwGG, the administrative court has to pronounce in the ruling of its decision or decision whether the revision is permissible under Article 133 (4) B-VG. The statement must be briefly justified.

The appeal is admissible because there is no case law of the Administrative Court on the question of whether § 24 DSG in the scope of the 3rd main part of the DSG grants a person concerned the right to determine a violation of the right to information if information occurs during the complaint procedure the DSB has been granted or whether the relevant case law of the Administrative Court on the legal situation relating to the DSG 2000 can be transferred to the current legal situation.

Catchwords
Supervision authority Provision of information Request for information Interested in information Obligation to refuse information Data protection Data protection authority Data protection complaint Data protection request for information Data protection procedure Findings Notification of notification Deadline extension Defect personal data Legal issue Revision admissible Requirements Nature of the subject matter of the proceedings
European Case Law Identifier (ECLI)
ECLI: AT: BVWG: 2020: W211.2223243.1.00
In RIS since
December 28, 2020
Last updated on
December 28, 2020
Document number
BVWGT_20200728_W211_2223243_1_00