BVwG - W214 2232551-1
From GDPRhub
| BVwG - W214 2232551-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 5(1)(c) GDPR Article 6(1)(f) GDPR Article 85(2) GDPR Article 133(4) B-VG § 1 DSG § 9(1) DSG Article 11 GRC Article 8 GRC |
| Decided: | 01.12.2021 |
| Published: | 21.01.2022 |
| Parties: | Vienna police officers DSB (Austria) |
| National Case Number/Name: | W214 2232551-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2021:W214.2232551.1.00 |
| Appeal from: | |
| Appeal to: | Not appealed |
| Original Language(s): | German |
| Original Source: | RIS (in German) |
| Initial Contributor: | Lejla Rizvanovik |
The Federal Administrative Court Austria held that publishing videos on social media accounts showing police officers during an identity check without making the police officers unidentifiable violates Article 5(1)(a),(c) GDPR and is not justified under Article 6(1)(f) GDPR.
English Summary
Facts
In their complaint to the DSB (Austria) the data subjects, both police officers, together with other colleagues, alleged a violation of the right to secrecy. The complainants carried out an identity check. In its course they had been filmed with several smartphones by the persons checked (controllers). The first complainant had repeatedly informed the controllers that it was a criminal offense to publish the video material. However, this was ignored and the material was published on social media (Facebook and Instagram) without making the data subjects unidentifiable. The controllers wanted to draw attention to ethnic profiling or accuse the complainants of such a procedure, as they felt discriminated by the identification, which in their opinion was only based on the colour of their skin. In the videos the controllers did not only make remarks to the effect that the identification of the complainants was done on racist grounds, but also used insulting words towards the complainants.
The complaint was partially upheld by the DSB and it was found that the respondent had violated the second complainant's right to secrecy by publishing a picture of the complainant’s on his Instagram profile and thereby violated the complainant's right to secrecy by at least publishing a picture of the first complainant on his Instagram profile. For the rest, the complaint was dismissed.
Holding
The Federal Administrative Court (Bundesverwatungsgericht – BVwG) stated that the image recordings were in any case personal data of the complainants pursuant to Article 4(1)GDPR, as the identification of the data subjects was possible. Through the publication, the respondents had also processed the personal data of the complainants within the meaning of Article 4(2) GDPR and, as the operators of their Instagram and Facebook profiles, were also to be qualified as data controllers under data protection law pursuant to Article 4(7) GDPR for their respective profiles.
Furthermore, the posting of the data on social media does not fall under § 9(1) DSG which is the national Austrian rule pursuant to the opening clause of Article 85(2) GDPR. § 9(1) DSG is per its wording only applicable to media owner, publisher, media staff and employees of a media enterprise or media service within the meaning of the Media Act. Though it is disputable whether this narrow scope of § 9(1) DSG is in accordance Article 85(2) GDPR, Article Article 85(2) GDPR cannot be applied directly since it has no material content but only obliges the Member States to provide appropriate rules. § 9(1) DSG may also be not applied analogously because the Austrian legislator purposefully narrowed the scope of its application. Even if § 9(1) DSG were applicable the posting of the videos would have violated § 1 DSG which is a constitutional norm and cannot be derogated by § 9(1) DSG.
Moreover, with regard to the GDPR the court held that the posting of the videos violates Article 5(1)(a),(c) GDPR and is not justified under Article 6(1)(f) GDPR:
Article 5(1)(c) GDPR is intended to ensure that the processing of personal data is reduced to an unavoidable minimum. The principle of data minimisation generally limits the depth of intervention and thus the type of data, the personal reference of the data, the amount of data, the level of detail of the data, the storage period of the data, the number of uses and the circle of persons authorised to access the data. Minimising the amount of data means both minimising the number of data subjects and minimising the amount of data per data subject. Minimising the reference to persons means in particular checking whether the purpose of the processing can also be achieved with pseudonymised, aggregated or anonymised data.
The concept of legitimate interests in Article 6(1)(f) GDPR is not to be understood empirically but normatively, otherwise one would inadmissibly conclude from the being to the ought; it therefore depends on whether the person concerned has the subjective expectation to be protected and this expectation is objectively legitimate.
With regard to these general remarks the court concluded that the publication - in the manner undertaken - is not the one with the least impact, as it was not necessary for the purposes of the controller to depict the complainants in an identifiable manner. Indeed, personal data may only be used if no alternative method is available to achieve the purpose pursued by the processing. The processing of personal data is therefore only proportionate to the purpose if its purposes cannot be achieved by recourse to anonymous or anonymised data. The decisive factor is therefore whether an equally effective alternative with a lower level of intrusion is available in the individual case; for many purposes it is sufficient, for example, to record that someone is at a certain place, but not their identity. In the case at hand, the controller could and should have made the complainants' faces unrecognisable before publishing the image data and, according to the findings, this would have been possible and reasonable in a reasonable amount of time with the help of free programs for PCs and smartphones.
As far as the controller brings forward the fact that he immediately published the pictures and was in an emotionally upset state, it must be noted that this does not change the fact that he committed a data protection violation. On the one hand, the "question of culpability" does not play a role in the case at hand, on the other hand, the co-participant - even if he was emotionally agitated - had to know that it was about personal data of the complainants and that he was not allowed to publish them, especially since he was also expressly informed by the second complainant that a publication would be punishable.
Finally, the court reasoned that the complainants have not forfeited their right to secrecy pursuant to § 1 DSG by the fact that they were photographed with recognisable faces in an news article in connection with the official act in question, which is already evident from the fact that the article was published after the posting of the videos by the controller and that the faces of the complainants were already known.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
decision date
01.12.2021
standard
B-VG Art133 Para.4
DSG §1
DSG §24
DSG §9
GDPR Art4
GDPR Art5
GDPR Art57
GDPR Art6
GDPR Art77
GDPR Art85
GRC Art11
GRC Art8
VwGVG §28 paragraph 2
saying
W214 2232551-1/20E
IN THE NAME OF THE REPUBLIC!
The Federal Administrative Court, through the judge Dr. Eva SOUHRADA-KIRCHMAYER as chair and the expert lay judges Mag. Huberta MAITZ-STRASSNIG and Mag. Claudia KRAL-BAST as assessors on the complaint of 1. XXXX and 2. XXXX, both represented by RA Mag. XXXX, against the decision of the data protection authority dated February 28, 2020, Zl. DSB-D123.685/0009-DSB/2019, rightly recognised:
a)
The complaint is upheld in accordance with § 28 Para. 2 VwGVG, so that point 1. b. of the contested decision must now read as follows:
"The 2nd respondent, XXXX , the 1st complainant, district inspector XXXX , and the 2nd complainant, district inspector XXXX , thereby violated their right to secrecy by posting " XXXX " on his Instagram profile and on his Facebook profile "XXXX" has published images and videos of the complainants, which show them identifiable during an official act."
b)
The revision is not permitted according to Art. 133 Para. 4 B-VG.
text
Reasons for decision:
I. Procedure:
1. In their complaint of October 25, 2018 (improved with the submission of December 21, 2018) addressed to the data protection authority (DSB, authority before the Federal Administrative Court), the complainants, both police officers, together with other colleagues, alleged a violation of the right to secrecy. In summary, it was submitted that the complainants had been filmed by the persons checked with several smartphones in the course of an identity check in accordance with Section 35 SPG on XXXX 2018 in XXXX Park. The first complainant had repeatedly informed the individuals that it was a criminal offense to publish the video material. However, this was ignored and the video sequences were edited into several small films and published on various social media from the evening of XXXX 2018. None of the police officers used were made unrecognizable in the videos. All deployed colleagues were clearly presented as “racists” in the social networks by the people checked and publicly condemned. The videos spread at breakneck speed and were also linked by various media. Here, too, all the forces deployed were clearly recognizable and unpixelated. One of the persons checked, XXXX (participant before the Federal Administrative Court, former second respondent before the relevant authority), also played the video during his appearance at the Thursday demonstration in front of around 6500 participants on XXXX 2018. Images of the two complainants were reworked, defaced and published by the co-participant and another controlled person (first respondent to the relevant authority). The hashtag XXXX was also created by those involved, where all publications could be tracked.
A USB stick with the collected publications and screenshots was attached to the complaint.
2. At the request of the authority concerned, the person involved and the two other respondents in the proceedings before the authority concerned submitted a statement on February 4th, 2019 and stated that on XXXX 2018 they had held a working meeting with a producer and three other musicians in XXXX Park , when they were subjected to an ID check by two police officers. Since the park was well frequented and only the respondents were subjected to an identity check, without the question of the reason and purpose of this official act leading to any comprehensible answers, the respondents felt discriminated against because of the color of their skin. Since they had experienced similar situations in the past and knew how difficult it was to conduct proceedings against the police without evidence, they decided to film the official proceedings with their mobile phones. After the identity check was completed, the two intervening officers remained in the immediate physical vicinity of the respondents for a further 30 minutes, which caused them to disturb the respondents' work session in an unpleasant manner. Finally, a reinforcement of 10 other officers had arrived and an unlawful eviction was pronounced against the respondents. For the respondents, this was a clear case of ethnic profiling, as they were not only subjected to a discriminatory identity check, but were also evicted from a public park. Due to their numerous experiences in this regard, the respondents decided to draw attention to the topic and published the videos on Instagram. They would have wanted to encourage other affected people to share their experiences with ethnic profiling in order to show the size of the problem and bring about a change in the current situation. There was therefore a great public interest in the publication. This is shown by the fact that numerous media reported on the incident and the assessment of prejudiced and illegal official acts is therefore not obviously wrong. In addition, it is disputed that the complainants actually had an interest in keeping their faces secret and their involvement in the official acts in question, since an article appeared in a XXXX on XXXX 2018, according to which the police officers concerned had been awarded a prize and this article was accompanied by a picture in which the police officers with recognizable faces in civilian clothes would probably have voluntarily allowed themselves to be pictured. The respondents had never been called racists by the respondents, the respondents had never dealt with the personal, individual attitude of the officers involved, but always stated official, i.e. institutional, misconduct. The identity of the complainants themselves was never in focus, further personalization had never taken place in public and there was also no public interest in the identity of the complainants. With regard to the complainant's lack of making the faces unrecognizable, it should be stated that pixelation or the insertion of bars in mobile phone videos are time-consuming and complicated technical work steps that cannot be carried out quickly by private individuals without special knowledge. A Snapchat filter was used instead, but this had no derogatory, disrespectful or other meaning. One effect that goes hand in hand with the XXXX filter used is the reduced identifiability of the person recorded. There is an overriding legitimate interest in the publication within the meaning of Section 1 (2) DSG. This also underpins the control instruments of the SPG, since, unlike other administrative procedures, police behavior can be checked much more extensively (§§ 87, 88 Para. 2, 89 SPG). In an overall view, a legal interest in secrecy must in any case take a back seat to the public interest in lawful security administration in connection with the human right to freedom of expression and freedom of the press.
3. On July 8th, 2019, the complainants also submitted a statement on the statement of the respondents and stated that it was expressly and vehemently contradicted that the respondents had been "expelled" because of the color of their skin. It would have been up to the Respondent to first exhaust the existing legal options, in particular complaints about measures and directives as well as complaints from the Ombudsman Board, before they publish excerpts from the videos in order to draw a specific picture. The voluntary depiction of the complainants in connection with the awarding of the prize does not conflict with the complainants' interest in secrecy, since the complainants' faces were already known to the general public through no fault of their own. Even if, according to the respondents, the identity of the complainants was never the focus of public interest, the actions and allegations - even if they are only "attributed" to the police - are linked to the faces of the complainants. In contrast to the Respondents, the Complainants did not seek publicity themselves, but were more or less drawn into it by the publication. The complainants had been contacted by numerous people and asked about the videos, so overall it should be noted that the complainants' faces were also recognizable to a larger circle (and not only to friends and acquaintances, as alleged). Contrary to what the Respondent claims, there are apps for mobile phones or software for computers to pixelate faces, and this seems to be possible and reasonable even for an inexperienced layman. In addition, the Respondents would have had the opportunity at any time to turn to a (professional) medium (in the sense of the press), which would then have published the publication in pixelated form. The respondents would try to justify themselves by having published the videos "in an understandable state of agitation and shock [...]". This is denied. As already stated by the respondents, it was their concern that the topic of racism be discussed publicly. It can be doubted that there was not enough time to edit the videos or have them edited or to contact the press. According to the complainants, the alienation through a XXXX filter is not a suitable means of making it unrecognizable. In the present case, the filter is used to ridicule a person or situation. It is strongly rejected that only a reduced identifiability with the photo was intended. Rather, it was about degrading the (state) authority of the photographed police officer and portraying him as ridiculous. This type of processing (even if it does not take place afterwards, but through a photo filter) is completely inappropriate for this situation and a complaint was made about it for insult. It is not disputed that the police powers (naturally) often interfere with various fundamental rights. Control in this regard is important and legal instruments are available for subsequent control. Immediately publishing video excerpts in a “shocking manner” without having used one of these tools and then invoking a special public interest in the publication could only be perceived as impudent. The widespread reporting (after publication by the respondents) implied a public interest, but according to the complainants this interest does not include the interest in the faces of the officers who intervened. In this case, the immediate "shocking" publication would have to take second place to the complainants' interests in secrecy. Since no significant time delay was to be expected due to subsequent processing or contact with the media and the respondents were neither in custody nor in any other way under particular pressure to act, the publication in question is not seen as being primarily in the public interest. The rights (in particular the interest in secrecy) of the complainants should have been taken into account. The legal remedies listed (§§ 87 - 89 SPG) are, among other things, the legal options mentioned to take action against allegedly wrong behavior by officials. A special public interest in the publication of video material cannot be derived from this. Censorship through the application of data protection law and a possible obligation to process the complaints cannot be seen on the part of the complainants. It should not be forgotten that false allegations with cut videos could also be published. Then this publication would no longer be sanctionable via data protection law (because of public interest). In summary, it is argued that a legal interest in secrecy in this individual case does not take second place to the public interest, since it would have been reasonable to use the legal instruments provided in advance or at least to make the faces of the complainants unrecognizable.
4. With the now contested decision, the complaint of the complainants was partially upheld and it was found that the first respondent had violated the second complainant's right to secrecy by publishing a picture of the second complainant on his Instagram profile "XXXX". show this in an official act with XXXX and XXXX (paragraph 1.a.) and that the co-participant violated the first complainant's right to secrecy by at least publishing a picture of the first complainant on his Instagram profile " XXXX ", which show them with the title " XXXX " and a XXXX in an official act (point 1.b.). For the rest, the complaint was dismissed (paragraph 2).
In justification, the authority concerned (after repeating the submissions of the parties and the course of the proceedings) first stated that the subject of the complaint was the question of whether the respondents violated the complainants' right to secrecy by publishing various images showing the complainants performing an official act had.
The authority concerned established, among other things, that the complainants, as organs of the public security service of XXXX on XXXX in the publicly accessible XXXX Park in XXXX, vis-à-vis the respondents, who were musicians and had stayed in the park for a professional appointment, an identification pursuant to Section 35 SPG carried out and then stayed in the immediate vicinity of the Respondents for about 30 minutes until the Respondents finally had to leave the park due to an eviction. The Respondents would have a darker skin type. No official acts of this kind were carried out with regard to other visitors to the park. These official acts of the complainants were recorded by the respondents using several smartphones. All of the complainants can be identified in the photographs. On the same day, the first respondent to the complaint published a compilation of these images on the social media platform Instagram on his profile “XXXX”, using the hashtag XXXX. A picture was also published that photographed the second complainant using a Snapchat filter with XXXX and XXXX . The person involved also published a compilation of these images on the same day on the social media platform Instagram on his profile " XXXX ". A photo was also published, which the first complainant photographed with the text " XXXX " and a so-called XXXX. The person involved published further images of the official act on the social media platform Facebook. It was not possible to determine whether the above-described images of the complainants were among these images. It was also not possible to determine which video recordings the person involved played to the participants at the Thursday demo of XXXX 2018 on XXXX. The Respondents had published the images in order to stimulate a public discussion on the topic of "ethnic profiling by the police".
Legally, the authority concerned stated that the images would in any case be personal data of the complainant pursuant to Art. 4 no. 1 GDPR, since the data subjects could be identified. As a result of the publication, the respondents also processed the personal data of the complainants within the meaning of Art. 4 Z 2 GDPR and, as the operator of their Instagram or Facebook profiles, are also to be qualified as those responsible for data protection pursuant to Art. 4 Z 7 GDPR for their respective profile. The data protection authority is also responsible for handling the matter, since it can be assumed that only if the (narrow) requirements of Section 9 (1) DSG are met, legal protection is only possible by way of the ordinary courts under the Media Act and that the data protection authority has no jurisdiction. According to the definition, the respondents are not a media company according to § 1 Z 6 MedienG or a media service according to § 1 Z 7 MedienG. With regard to the publication of the images of official acts by the respondent, it should therefore be examined whether the subject matter is the right to protection of personal data of the complainant (Art. 8 EU-GRC and § 1 DSG) or the right to freedom of expression of the respondent (Art. 11 EU -GRC) predominate. In its most recent case law, the ECJ referred to the case law of the European Court of Human Rights (ECtHR) and the criterion formulated by it with regard to the question of when “processing for journalistic purposes” exists (see judgment of February 14, 2019). , C-345/17, margin no. 66). Accordingly, for the purpose of weighing up the fundamental right to secrecy (Article 8 EU-GRC) and the freedom of expression (Article 11 EU-GRC), particular attention should be paid to the contribution to a debate of general interest, the degree of familiarity of the person concerned, the subject of the reporting, content, form and effects of the publication, the manner and the circumstances under which the information was obtained and its accuracy. As established, the Respondents shared the footage of the official act in order to stimulate a public discussion on the topic of "ethnic profiling by the police". It is therefore evident that the Respondents' aim was to disseminate information, opinions or ideas to the public or, by publishing the photographs, to initiate a contribution to a debate of general interest, namely the question of whether the official act in question - ie the Identification and subsequently the expulsion of the respondent - was carried out solely because of their skin color and was therefore the result of ethnic profiling by the police. The questioning of the proportionality of official acts - especially the use of police coercion and authority - appears again and again in the media and is regularly part of a debate of general interest (cf. in this sense also the judgment of the Supreme Court of June 27, 2019, GZ 6 Ob 6/19d). With regard to the publication of the photographs of an official act, it can be assumed in principle that, in view of the above-mentioned criteria and the fact that the complainants are not specifically addressed, but only the official act in general, that at least a contribution to a debate is of public interest present. Since the first criterion is already met, there is no need to go into the other criteria further. The complaint had therefore to be dismissed on this point due to the priority of the right to freedom of expression over the right to the protection of personal data.
However, the situation is different with individual, concrete photographs of the complainants, which the Respondents have published, since the taking of photographs of an official act and their subsequent publication is not justified in every case, but only if this is justified for reasons of Art. 11 EU-GRC is necessary. However, on the one hand, the use of the Snapchat filter in question, contrary to what the respondents submit, neither reduces the possibility of identifying the second complainant in a suitable way and, on the other hand, in no way contributes to a debate of general interest. Rather, the person concerned is ridiculed or belittled by the representation with XXXX and XXXX and the use of such a Snapchat filter and therefore the content of the publication is completely unsuitable and inappropriate, especially in the context of a public debate about official acts of the police to watch. With regard to this point in the ruling, the right of the second appellant to secrecy therefore has the higher protection in a weighing up. These statements would also apply to the publication of the picture showing the first appellant with the text "XXXX" including XXXX. In any case, there is no suitable contribution to a public debate about official police actions here either. In particular, the focus of this photograph is not on the complainant as the body responsible for enforcement and the official act performed by her, but rather refers directly to her role as a woman, which means that the first complainant’s right to secrecy is entitled to greater protection in this point as well.
5. Two complainants (the current first complainant and the current two-complainant) lodged a timely complaint with the Federal Administrative Court against the decision in question in a letter dated April 20, 2020, whereby it was initially stated that the complaint was only directed against the other party involved and only to the extent it had not been determined by the authority concerned, also in relation to point 2 of the contested decision, that the complainants had been violated by the video recordings in their right to protection of images (non-disclosure) under the GDPR and the fundamental right to data protection under Section 1 DSG. It was also stated that the notice was being challenged on the grounds of the incorrect or incomplete determination of the facts and incorrect legal assessment. It was argued that in addition to the findings of the authority concerned, it should be noted that recordings of the official act were edited into several videos, and a total of 6 videos on Instagram (another 2 videos on Facebook and 4 photographs) of the co-participant with a length of between 0:50 and 5:00 a.m. were published. The videos were distributed by the participants on social networks and shared hundreds of thousands of times. The videos were also leaked to the media and linked to the respective accounts of the participants in their online editions. The hashtag XXXX was created by the participant and he created an Instagram story called "Police", where all publications and videos were available. The published videos contain comments and statements by those involved, which can be heard on the videos and can be clearly assigned to them, such as: XXXX The viewer of the videos is given the impression that the police officers have not behaved correctly - which by no means is the case Correspond to facts - and these permanently insulting statements of the participants were exposed. When the videos on the official act of XXXX 2018 were published, the person involved was not interested in stimulating a public discussion on the subject of "ethnic profiling" by the police, but rather making fun of their intervention, insulting police officers and the general public to demonstrate. On none of the videos was there even a hint of any racist statement or illegal action by the police officers. In the context of the legal assessment, it boils down to whether the "legitimate interests" of the co-participant outweigh those of the two complainants that their faces should not be made known to the general public. On the basis of the legal basis of the GDPR, the "principle of interests" as known from the protection of images under civil law applies. As with the data protection norms, the civil law protection of images according to § 78 UrhG also contains case groups for the interpretation of the legitimate interest, where detrimental accompanying texts in connection with the publication of an image must also be taken into account. Due to the parallelism, when interpreting the legitimate interests according to the GDPR or the DSG, the civil law case law and teaching on Section 78 of the Copyright Act should be used without restriction. If one takes into account the derogatory statements of the co-participant, which can be heard on the videos, the interests of the two complainants in the protection of the image would undoubtedly outweigh any other - not at all recognizable - interests of the co-participant. Under no circumstances could the protection of the two complainants' portraits be undermined with the fundamental right to "freedom of expression" as assumed by the authority concerned or in order to conduct a public discussion on the subject of "ethnic profiling by the police". It should be mentioned in passing that such a discussion could also be conducted by pixeling the faces of the two complainants, thereby rendering them unrecognizable.
6. In a letter dated June 5th, 2020, the authority concerned submitted the complaint and the administrative act to the Federal Administrative Court for a decision and issued an opinion to the effect that the complaint was disputed in its entirety and reference was made to the contested decision. For the sake of completeness, it should be mentioned that personal assessments and expressions of opinion are not subject to review from the point of view of data protection. In addition, an examination of the civil law protection of images according to § 78 UrhG does not fall within the competence of the data protection authority and would have to be asserted before the ordinary courts.
7. Based on the order of the business allocation committee of July 17, 2020, the legal matter in question was assigned to the now responsible court department W214, where it arrived on July 24, 2020.
8. On May 5th, 2021, the Federal Administrative Court forwarded the complaint to the person involved as well as the statement of the authority concerned to the complainants and the person involved and gave them the opportunity to submit a statement.
As a result, however, neither the complainants nor the co-participant made a statement.
9. On November 11, 2021, an oral hearing took place before the Federal Administrative Court in the presence of the complainants, their legal representatives, the co-involved party and a representative of the authority concerned. In the oral hearing, the complainants and the co-participant were heard as parties. A copy of the settlement from the Commercial Court XXXX relating to a settlement between the second complainant and the co-participant was submitted by the complainants' legal representative. The parties have been asked to submit the decisions made in various other proceedings relating to the incident in question to the court within a week.
10. In a brief dated November 12, 2021, the complainants submitted a comparative copy of the BG XXXX and a decision by the Administrative Court XXXX. No decisions were submitted by the party involved.
II. The Federal Administrative Court considered:
1. Findings:
The procedure outlined under point I is used as a basis for the findings.
The complainants are organs of the public security service of XXXX, the other person involved works as a musician under the stage name " XXXX ".
The participant and five colleagues met on XXXX 2018 for a professional meeting in a partially hidden wooden pavilion, which was located to the right of the entrance to XXXX Park in XXXX. Five of them, including the other person involved, have darker skin.
At around 3:30 p.m., the complainants carried out a check in XXXX Park on behalf of their superior, because criminal offenses had already been committed there several times. In the course of this check, they carried out an identity check in accordance with Section 35 SPG on the person involved and his colleagues and justified this by saying that the group of people seemed suspicious to them because they were staying in a pavilion that was partially hidden from view. The applicant and another colleague stated that they were Austrian nationals and did not have any identification with them. The person involved claimed that he and his colleagues were only checked because of the color of their skin. The rest of the group showed their IDs. Eventually the fellow involved gave his name, which was confirmed by another of his colleagues.
After some time, the group of the participant and his colleagues briefly left the park, but then returned to the park. The complainants also left the park and returned.
Eventually, the applicants left the park again and, due to the aggressive mood that existed against them, called for reinforcements. As a result, a colleague of the person involved (Mr. XXXX) was expelled from the park because of his loud behavior by the second complainant, who was now back in the park. After Mr XXXX, who refused to leave the park, was pushed out of the park by the second complainant with his hand flat behind his back (calling for help to draw attention to himself), the co-participant was also arrested by the police escorted out of the park and his other colleagues and the other police officers also left the park. Outside the park, the co-participant, in an angry tone, engaged another police officer in an argument and got very close to him, who pushed him away and then lightly grabbed his right upper arm by the jacket fabric to keep him safely at a distance.
Due to the completion of the official act, which had taken a long time, the complainants did not carry out any further checks in XXXX Park.
It could not be established that the control and identification of the co-participant was carried out for racist reasons.
The complainants, a few weeks after the incident, accepted a tribute from then XXXX and XXXX, who showed solidarity with them. A photo showing the complainants at this ceremony appeared in XXXX on XXXX 2018
The co-participant filmed the complainants with his smartphone on XXXX 2018 when they (among other things) carried out an identity check on him or were then still in the vicinity. The co-participant was informed by the second complainant that publication of the recordings was a punishable offence. Nevertheless, the person involved subsequently published these recordings or recordings that were sent to him by his colleagues (partly as images, partly in video form) on his Instagram profile " XXXX ", without making the complainants' faces unrecognizable. These videos were also automatically published on Facebook because the co-participant had set a function on his Instagram profile according to which the pictures are automatically published on Facebook if you post them on Instagram ("Share your posts on Facebook"). In any case, the person involved wanted to draw attention to ethnic profiling or to accuse the complainants of such an approach because he felt discriminated against by the identity check, which in his opinion was only based on the color of his skin. Some of his videos were published immediately on the social networks mentioned, others only in the evening hours of that day or the following day. In the videos published by the person involved, he not only made comments to the effect that the identity of the complainants was determined for racist reasons, but he also accused the police of XXXX, made the comment XXXX and used insulting words towards the complainants such as: XXXX
The related videos, which were played during a Thursday demonstration on XXXX 2018, were not played on behalf of the collaborator
Before the incident in question, the person involved had around 10,000 followers on Instagram. After the videos and pictures were published, the number of his followers rose to around 18,000.
The person involved has at least average technical skills in connection with the operation of PCs and smartphones. Various programs are available for free download on the Internet and in the Appstore or Playstore, such as GIMP, Pixelator (for photos) or Sensarea (for videos), with which even a layman can easily Blurring the faces of people in image or video recordings.
With the contested decision of the authority concerned, the complainants' complaint was partially upheld and, among other things, it was found that the respondent to the first complainant had violated the (now) second complainant's right to secrecy by posting a picture of the published the second complainant, showing him XXXX and XXXX in an official act (paragraph 1.a.) and that the co-participant had violated the (now) first complainant's right to secrecy by posting "XXXX “ I published a picture of the first complainant, which shows her with the title XXXX and a XXXX in an official act (paragraph 1.b.). For the rest, the complaint was dismissed (paragraph 2).
In a letter dated April 20, 2020, the complainants submitted a timely complaint to the Federal Administrative Court against the part of the decision that affected them.
With the settlement between the second complainant and the other party involved in GZ XXXX of May 23, 2019, which was concluded before the XXXX Commercial Court, the other party committed himself to refraining from video recordings/photographs showing the second complainant as a police officer of an official act on XXXX 2018 in XXXX, XXXX Park, especially in social to publish it on networks such as Instagram and Facebook without first blurring the face of the second complainant.
Furthermore, the co-participant undertook to make the face of the second complainant unrecognizable in a video posted on Facebook that was identified in more detail and, if necessary, to delete the video.
With the settlement reached before the BG XXXX on 26.06.2019 for GZ XXXX , between the complainants and the co-participant, the co-participant undertook to refrain from making insulting statements to the complainants such as the complainants would be XXXX or XXXX in the future.
Due to a complaint about measures and guidelines by the co-participant and his colleague XXXX, the administrative court XXXX of December 21, 2020, GZ XXXX and others, found that they were right on one point and the identity checks of the two police officers, who are now acting as complainants in the proceedings at hand, declared illegal. The appeal was dismissed for the remaining seven points.
The co-participant received a criminal order for a complaint of making noise and aggressive behavior (in connection with the above-mentioned incident), which he did not fight and which became final.
2. Evidence assessment:
The findings result on the one hand from the administrative act (in particular the video recordings submitted by the complainants), on the other hand from Hg. Court document, in particular from the minutes of the oral hearing of November 11, 2021, and from the inspection of the decision of the Administrative Court XXXX submitted by the complainants, GZ. XXXX et al., dated December 21, 2020, as well as in the settlement concluded between the second complainant and the other party involved before the Commercial Court XXXX of May 23, 2019, GZ XXXX, or in the settlement concluded between the complainants and the other party involved before the BG XXXX of June 26. 2019, GZ XXXX .
The fact that the publication of the recordings by the co-participant also had the purpose of drawing attention to ethnic profiling is evident from the submissions of the co-participant, who credibly stated that he felt discriminated against because of the identity check carried out, which was allegedly only carried out because of the color of his skin and also expressed this during the identity check. It can be seen that the person involved was at any rate concerned to record the official act, that he inquired about the reason for the official act and that he also complained several times about the official act (albeit largely unsuccessfully), so that it is clear that the accusation of " Ethnic Profiling” was also the focus of his publication. This is also consistent with the media coverage following the release of the videos.
The fact that the purpose of the publication was also to accuse the complainants of such an approach and to cast the police actions in a bad light is evident from the spoken comments that the person involved made audibly on the videos. It can be assumed that the video recordings were not primarily intended to make fun of the intervention and to insult the police officers. However, the person involved made provocative verbal statements XXXX XXXX [this can be heard on the video recordings] and he not only made the comparison with XXXX, but also asked the police officers whether they wanted his autograph, the police further alleges , to place ads with XXXX allegations [this can be heard on video recordings], but also – as can be seen from the findings of the state administrative court – directed the insult XXXX to the police officers, which is also indicated by the settlement concluded before the BG XXXX; Finally, the person involved received – as can be seen from the – minutes of the oral hearing, also a criminal order for making noise and aggressive behavior, which underpins the thesis of his aggressive behavior) and he and a colleague in particular presented themselves as victims of police assaults, so that it is doubtful is that the person involved wanted to bring about a factual debate about the incident in question and it can be assumed that a tendentious presentation was intended here and that the police were also to be presented to the public in a bad light.
Against the background that there was apparently no concrete suspicion of a criminal offense by the musicians or was asserted, it is also explicable that the person involved, who, like his colleagues, has often been checked in the past, and this because of the color of his skin returned, reacted negatively to the identity check. It is also understandable that he and his colleagues took pictures and videos of the official act as evidence. In this context, it also seems credible that some of these pictures and videos were published by him immediately due to the emotional state of the collaborator.
The fact that it could not be established that the identification was carried out for racist motives is evident from the credible statements by the complainants that they checked the group of musicians because they were in a pavilion that was difficult to see into at times and criminal offenses had already taken place there should. It also seems plausible that other park visitors were no longer checked because the official act with the musicians took longer due to the aggressive reaction of some members of the group and the time allotted for the check was over. In addition, this also results from the above-cited finding of the administrative court XXXX.
The fact that not all images and videos were posted immediately, but some only later after several hours, is evident from the statements made by the complainants, which the other party did not object to in the oral hearing, and from the statements shown on the mobile phone of the first complainant at the hearing time tagged posted photos and videos.
The fact that the person involved had 10,000 Instagram followers before the incident and was able to increase this to around 18,000 after the publication is evident from his testimony in the oral hearing before the Federal Administrative Court.
The fact that the person involved has at least average technical skills in connection with the operation of PCs and smartphones was confirmed by him and has also become apparent through the publication of the image and video data on his Instagram or Facebook profile. The programs available for image and video processing and their ease of use result from official research by the Federal Administrative Court, with the complainants also pointing out such simple options for making them unrecognizable.
3. Legal assessment:
3.1. According to § 6 BVwGG, the Federal Administrative Court decides through a single judge, unless federal or state laws provide for the decision to be made by senates. According to § 27 Data Protection Act (DSG) as amended, the Federal Administrative Court decides in proceedings on complaints against decisions due to violation of the obligation to inform according to § 24 Paragraph 7 and the decision-making obligation of the data protection authority by the Senate. The Senate consists of a chairman and a competent lay judge from the circle of employers and from the circle of employees.
The procedure of the administrative courts, with the exception of the Federal Finance Court, is regulated by the VwGVG, Federal Law Gazette I 2013/33 as amended by Federal Law Gazette I 2013/122 (§ 1 leg.cit.). Pursuant to Section 58 (2) VwGVG, conflicting provisions that were already promulgated at the time this federal law came into force remain in force.
According to § 17 VwGVG, unless otherwise specified in this federal law, the provisions of the AVG with the exception of §§ 1 to 5 and Part IV, the provisions, apply to the procedure for complaints pursuant to Art. 130 Para. 1 B-VG the Federal Fiscal Code - BAO, Federal Law Gazette No. 194/1961, the Agricultural Procedures Act - AgrVG, Federal Law Gazette No. 173/1950, and the Service Law Procedures Act 1984 - DVG, Federal Law Gazette No. 29/1984, and otherwise those procedural provisions in federal or state laws that the authority applied or should have applied in the proceedings preceding the proceedings before the administrative court.
According to Section 28 (1) VwGVG, the administrative court has to settle the legal matter by finding it unless the complaint is to be rejected or the proceedings are to be discontinued. Pursuant to § 31 Para. 1 VwGVG, the decisions and orders are made by way of a resolution, unless a finding is to be made.
Pursuant to § 28 Para. 2 VwGVG, the administrative court has to decide on the matter itself on complaints pursuant to Art. 130 Para. 1 Z 1 B-VG if (1.) the relevant facts are established or (2.) the determination of the relevant facts by the administrative court itself is in the interest of speed or is associated with significant cost savings.
3.2. Regarding the process requirements:
The complaint was raised in accordance with Section 7 (4) VwGVG and the other process requirements are also met.
3.3. Regarding part A):
3.3.1. Legal situation:
The authority concerned based its decision on the following legal bases, insofar as they are relevant to the proceedings:
Sections 1 (1) and (2), 9 (1) and 24 (1) and (5) of the Data Protection Act – DSG, Federal Law Gazette I No. 165/1999 as amended; Articles 4, 5, 6, 57(1)(f), 77(1) and 85 of Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR), OJ No. L 119 of 4 May 2016, p 1 and Articles 8 and 11 of the Charter of Fundamental Rights of the European Union (EU-GRC), OJ. No. C 326 of 26.10.20212, p. 391. These provisions are also to be used in the present complaints procedure before the Federal Administrative Court.
§ 1 paragraph 1 and 2 DSG read:
Ҥ 1. (1) Everybody has the right to confidentiality of personal data concerning him, in particular with regard to respect for his private and family life, insofar as there is a legitimate interest in doing so. The existence of such an interest is excluded if data are not accessible to a non-disclosure claim due to their general availability or due to their lack of traceability to the data subject.
(2) Insofar as the use of personal data is not in the vital interests of the person concerned or with his consent, restrictions on the right to secrecy are only permissible to protect overriding legitimate interests of another, and in the case of interventions by a state authority only on the basis of laws, which are necessary for the reasons stated in Art. 8 Para. 2 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (EMRK), Federal Law Gazette No. 210/1958. Such laws may only provide for the use of data, which by their nature are particularly worthy of protection, to protect important public interests and must at the same time provide for appropriate guarantees for the protection of the confidentiality interests of the data subjects. Even in the case of permissible restrictions, the encroachment on the fundamental right may only be carried out in the mildest way that leads to the desired result.”
§ 9 paragraph 1 DSG reads:
"§ 9. (1) The processing of personal data by media owners, publishers, media employees and employees of a media company or media service within the meaning of the Media Act - MedienG, Federal Law Gazette No. 314/1981, for journalistic purposes of the media company or media service can be found in the provisions of this federal law and of the GDPR Chapters II (Principles), III (Rights of the data subject), IV (Controller and processor), V (Transfer of personal data to third countries or to international organizations), VI (Independent supervisory authorities), VII (Cooperation and Consistency) and IX (Regulations for Special Processing Situations) do not apply. When exercising its powers vis-à-vis the persons named in the first sentence, the data protection authority must observe the protection of editorial secrecy (Section 31 MedienG)."
§ 24 paragraphs 1 and 5 DSG read:
Section 24. (1) Every data subject has the right to lodge a complaint with the data protection authority if they believe that the processing of their personal data violates the GDPR or Section 1 or Article 2, Part 1.
(5) If a complaint proves to be justified, it must be followed. If an infringement is attributable to a person responsible for the private sector, the person responsible must be instructed to comply with the complainant's requests for information, correction, deletion, restriction or data transfer to the extent necessary to eliminate the identified infringement. If the complaint proves to be unjustified, it must be dismissed.
Art. 4 Z 1, 2 and 7 GDPR read:
"Art. 4 GDPR
definitions
For the purposes of this Regulation, the term means:
"1. "personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more special features that express the physical , physiological, genetic, mental, economic, cultural or social identity of that natural person;
2. "Processing" means any process carried out with or without the aid of automated processes or any such series of processes in connection with personal data, such as collection, recording, organisation, ordering, storage, adaptation or modification, reading out, querying, use, disclosure by transmission, distribution or any other form of making available, matching or linking, restriction, deletion or destruction;
7. "Responsible person" means the natural or legal person, public authority, agency or other body that alone or jointly with others decides on the purposes and means of processing personal data; if the purposes and means of this processing are specified by Union law or the law of the Member States, the person responsible or the specific criteria for his naming may be provided for by Union law or the law of the Member States;"
Art. 5 para. 1 GDPR reads:
"Art. 5 GDPR
Principles for the processing of personal data
(1) Personal data must
a) processed lawfully, fairly and in a manner that is transparent to the data subject ("lawfulness, fair processing, transparency");
b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes shall not be deemed incompatible with the original purposes pursuant to Article 89(1) ("purpose limitation");
c) adequate and relevant to the purpose and limited to what is necessary for the purposes of the processing ("data minimization");
d) accurate and, where necessary, up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without undue delay ("accuracy");
e) stored in a form which permits identification of data subjects only for as long as is necessary for the purposes for which they are processed; personal data may be stored for a longer period of time to the extent that the personal data, subject to the implementation of appropriate technical and organizational measures required by this regulation to protect the rights and freedoms of the data subject, are used exclusively for archiving purposes in the public interest or for scientific and historical research purposes or processed for statistical purposes in accordance with Article 89(1) ("storage limitation");
f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical and organizational measures ("integrity and confidentiality");"
kind 6 para. 1 GDPR reads:
"Art. 6 GDPR
lawfulness of processing
Processing is lawful only if at least one of the following conditions is met:
a) The data subject has given their consent to the processing of their personal data for one or more specific purposes;
b) the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
c) processing is necessary for compliance with a legal obligation to which the controller is subject;
d) processing is necessary to protect vital interests of the data subject or another natural person;
e) the processing is necessary for the performance of a task that is in the public interest or in the exercise of official authority that has been delegated to the controller;
f) processing is necessary to protect the legitimate interests of the person responsible or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail, in particular if the data subject is a child acts.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their duties."
Article 57 (1) (f) GDPR reads:
"Art. 57 GDPR
tasks
Without prejudice to other duties set out in this Regulation, each supervisory authority in its territory
f) deal with complaints from a data subject or complaints from a body, organization or association in accordance with Article 80, investigate the subject matter of the complaint to an appropriate extent and inform the complainant within a reasonable time of the progress and the result of the investigation, in particular, where further investigation or coordination with another supervisory authority is necessary;"
Art. 77 para. 1 GDPR reads:
"Art. 77 GDPR
Right to lodge a complaint with a supervisory authority
(1) Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement, if the data subject believes that the processing of the personal data concerning them violates this regulation."
Art. 85 GDPR reads:
"Art. 85 GDPR
Processing and freedom of expression and information
1. Member States shall bring by legislation the right to the protection of personal data in accordance with this Regulation to reconcile the right to freedom of expression and information, including processing for journalistic, scientific, artistic or literary purposes.
(2) For processing carried out for journalistic purposes or for scientific, artistic or literary purposes, Member States shall provide derogations or exceptions to Chapter II (Principles), Chapter III (Rights of the data subject), Chapter IV (Controller and processor) , Chapter V (Transfer of personal data to third countries or to international organisations), Chapter VI (Independent supervisory authorities), Chapter VII (Cooperation and consistency) and Chapter IX (Rules for specific processing situations) where necessary to exercise the right to protection to reconcile personal data with freedom of expression and information.
3. Each Member State shall notify the Commission of the legislation which it has adopted pursuant to paragraph 2 and of any subsequent law amending or amending such legislation without delay."
Art. 8 GRC reads:
"Article 8
Protection of personal data
(1) Every person has the right to protection of their personal data.
(2) This data may only be processed in good faith for specified purposes and with the consent of the data subject or on another legitimate basis regulated by law. Every person has the right to obtain information about the data that has been collected about them and to have the data corrected.
(3) Compliance with these regulations is monitored by an independent body."
Art. 11 GRC reads:
"Article 11
Freedom of expression and freedom of information
(1) Everyone has the right to freedom of expression. This right includes freedom of expression and the freedom to receive and impart information and ideas without interference by public authority and regardless of frontiers.
(2) Media freedom and pluralism are respected.”
3.3. Applied to the present case, this results in the following:
The authority concerned determined that, according to the case law of the European Court of Justice (ECJ), there is basically processing for journalistic purposes, since the co-participant had the aim of publishing the images on his Instagram profile to disseminate information to the public or to to initiate a contribution to a debate of general interest by publishing the images, namely the question of whether the official act in question - i.e. the determination of identity and subsequently the expulsion of a colleague of the person involved - was carried out solely because of his skin color and is therefore a consequence of ethnic profiling of the was the police (cf. ECJ February 14, 2019 C-345/17). Although this may be true in principle, the publication of the official act with comments by the person involved, some of which contain unproven allegations ( XXXX , " XXXX " contents of advertisements) or are even wrong, XXXX goes beyond a description of what is happening in the police force. It also cannot be completely ruled out that videos and pictures that are posted on social networks should also increase the level of awareness of the person involved as a musician. In this respect, it seems doubtful that the publication in question served exclusively journalistic purposes.
But even if you follow the authorities concerned that an exclusively journalistic purpose was pursued here, the following should be noted
In any case, the participant has not processed these images for journalistic purposes of a media company or media service within the meaning of the Media Act - MedienG, Federal Law Gazette No. 314/1981, which is why the regulation of § 9 DSG, according to which the provisions of the DSG and the DSGVO chapters II (Principles), III (Rights of the data subject), IV (Controller and processor), V (Transfer of personal data to third countries or to international organizations), VI (Independent supervisory authorities), VII (Cooperation and consistency) and IX (Regulations for special processing situations) do not apply is not relevant in the present case.
The authority concerned correctly states that - despite concerns about the restriction of media privileges in accordance with Section 9 (1) DSG - a direct application of Art. 85 (2) GDPR does not appear expedient due to the priority of Union law regulations, since Art. 85 (2) GDPR does not represent a substantive provision, but - as mentioned - contains the mandate addressed to the Member States to enact corresponding legal provisions for certain processing situations (cf. Schiedermair in Ehmann/Selmayr, General Data Protection Regulation comment 2 [2018] Art. 85 margin nos. 1 and 9) .
The analogous application of Section 9 (1) DSG to the present facts is also ruled out, because the restriction standardized in Section 9 (1) DSG was domestic in the originally planned implementation of Art. 85 (2) GDPR in the version of the data protection law. Adaptation Act 2018, which is why it is a deliberately restrictive approach by the Austrian legislator (cf. VwGH 10.10.2018, Ra 2018/08/0189, Rs 4 mwN, according to which the analogy is generally permissible in public law, but the existence of a genuine legal loophole is assumed).
In addition, the authority concerned rightly stated that the complainants alleged a violation of the fundamental right to data protection in accordance with Section 1 DSG, which is a constitutional provision that in any case could not even be overridden by Section 9 DSG.
According to the case law of the European Court of Human Rights (ECtHR), for the purposes of balancing the fundamental right to secrecy (Art. 8 EU-GRC) and freedom of expression (Art. 11 EU-GRC), the contribution to a debate is particularly important of general interest, the level of awareness of the data subject, the subject matter of the reporting, content, form and effects of the publication, the manner and circumstances under which the information was obtained and its accuracy (ECtHR February 14, 2019, C-345/17, margin no. 66).
Likewise, the possibility must be taken into account that the controller takes measures that make it possible to reduce the extent of the interference with the right to privacy (see again ECJ 14.02.2019 C-345/17).
The authority concerned states that the publication of the videos and images in question constitutes a contribution to a debate of public interest. However, the relevant authority overlooks the fact that it is not just a matter of whether a criterion applies, but that the criteria formulated by the ECJ or ECtHR are to be considered as a whole and all have to be included in the weighing of interests.
According to Section 1 (1) DSG, everyone has the right to confidentiality of personal data concerning them, in particular with regard to respect for their private and family life, insofar as there is a legitimate interest in doing so. The existence of such an interest is excluded if data are not accessible to a non-disclosure claim due to their general availability or due to their lack of traceability to the data subject.
According to Section 1 (2) DSG, restrictions on the right to secrecy are only permissible if the use of personal data is in the vital interests of the data subject or with his consent, if there are overriding legitimate interests of another or if there is a qualified legal basis. Even in the case of permissible restrictions, the encroachment on the fundamental right may only be carried out in the mildest way that leads to the desired result.
There is no need to oppose the authority concerned if it comes to the conclusion that, when weighing up the fundamental right to data protection and the fundamental right to freedom of expression in the case at hand, it was permissible to show the police actions. However, when the videos and pictures that are the subject of the complaint were published, the mildest means leading to the goal were clearly not chosen. On the contrary, the faces of the complainants were not made unrecognizable, although, according to the other party involved, it was not a matter of disclosing the identity of the police officers, but merely of showing the police actions in question. This is all the more serious as the person involved here also publicly accuses the police of things (such as " XXXX " content of advertisements, XXXX with which the complainant could be associated. With regard to these unproven allegations, there cannot even be a legitimate interest be established that the fundamental right to data protection of the complainant prevails. In any case, there is a violation of the fundamental right to secrecy of the complainant (see also the following detailed considerations on the weighing of interests according to the GDPR, which also apply to the weighing up according to the fundamental right data protection are to be used accordingly).
Also according to Art. 5 Para. 1 lit c of the GDPR, personal data must be appropriate and relevant to the purpose and limited to what is necessary for the purposes of processing (data minimization). This principle is intended to ensure that the processing of personal data is reduced to an unavoidable minimum (Jahnel, comment on the GDPR, Art. 5 Rz 32). The principle of data minimization generally limits the depth of intervention and thus the type of data, the personal reference of the data, the amount of data, the level of detail of the data, the storage period of the data, the number of uses and the group of authorized persons. Minimizing the amount of data means both minimizing the number of data subjects and minimizing the amount of data per data subject. Minimizing the personal reference means in particular checking whether the purpose of the processing can also be achieved with pseudonymised, aggregated or anonymised data. (Hötzendorfer/Tschohl/Kastelitz in Knyrim, DatKomm Art 5 GDPR, Rz 39 (as of October 1st, 2020, rdb.at)).
Art. 6 (1) (f) GDPR enables the processing of personal data in "equal order relationships" among private individuals if it is necessary to protect the legitimate interests of a person responsible or a third party. However, these legitimate interests do not constitute sufficient justification for the lawfulness of the processing if the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail. In doing so, the reasonable expectations of the data subject based on their relationship with the controller shall also be taken into account. The concept of the reasonable expectations of the person concerned is not to be understood empirically but normatively, otherwise one would improperly infer from is to ought; it therefore depends on whether the data subject has a subjective expectation of being protected and whether this expectation is objectively legitimate. For the previous provision (Art 7 lit f GDPR), which is largely the same in terms of content, the ECJ has specified a "test scheme" according to which the processing of personal data is permissible under three cumulative conditions, which is also used by the relevant authority and the Supreme Court in their decision-making practice:
1. Existence of a legitimate interest pursued by the controller or by the third party(s) to whom the data are communicated,
2. Necessity of processing personal data to realize legitimate interest and
3. no predominance of the fundamental rights and freedoms of the data subject.
In essence, the interests affected (weighing of interests) must be weighed up on a case-by-case basis, whereby it must also be checked whether a data subject can reasonably foresee at the time the personal data is collected and in view of the circumstances under which it takes place that processing may be necessary will be made for this purpose. The weighting must be carried out from an objective point of view and not from the subjective point of view of individual affected persons, so individual sensitivities are not to be taken into account. If this weighing of interests is in favor of the person responsible or a third party, the processing is generally permissible (taking into account the other, aforementioned requirements, and in particular Art. 5 GDPR). The person responsible is responsible for weighing up the interests and has to provide evidence (Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Art 6 GDPR (as of May 7th, 2020, rdb.at)).
As stated above, the co-participant filmed the complainants on XXXX 2018 in the XXXX park in XXXX with his smartphone when they (among other things) carried out an identity check on him in accordance with § 35 SPG and published these recordings (partly in image form, partly in video form ) including on his Instagram profile " XXXX " and his Facebook profile " XXXX ".
The fact that the images in question are personal data of the complainants in accordance with Art. 4 Z 1 GDPR, since the data subjects can be identified, the personal data of the complainants are also processed within the meaning of Art. 4 Z 2 GDPR through the publication of those involved and as the operator of his Instagram or Facebook profile is also to be qualified as the person responsible for data protection pursuant to Art. 4 Z 7 GDPR and therefore the scope of Art. 2 Para. 1 GDPR is open overall, the authority concerned has already correctly determined and was this was also not disputed by the other party involved.
The purpose and justifying interest for the publication of these recordings was stated by the co-participant to want to draw attention to ethnic profiling because he felt discriminated against by the identity check, which was supposedly carried out solely on the basis of his skin color.
As explained above, according to the provisions of the GDPR, a weighing of interests must also be carried out, whereby in the present case the complainant’s constitutionally protected right to secrecy outweighs an interest of the co-involved party:
The co-participant brought forward a justifying interest within the meaning of Article 6 (1) (f) GDPR for the publication of the image and video recordings (calling attention to "ethnic profiling"), but the publication is in the manner in which the co-participant made it , does not represent the mildest means within the meaning of Art. 5 GDPR, since it was not necessary for the purposes of the co-involved party to depict the complainants in an identifiable way. This is because personal data may only be used if no alternative method is available to achieve the purpose for which the processing is intended. The processing of personal data is therefore only appropriate for the purpose if its purpose cannot be achieved by using anonymous or anonymized data (Heberlein in Ehmann/Selmayr, DS-GVO, Art 5 Rz 22). The decisive factor is whether an equally effective alternative with a lesser degree of intervention is available in the individual case; for many purposes it is sufficient to record that someone is at a certain point, but not their identity (Roßnagel in Simitis, data protection law Art. 5 margin no. 121). In the present case, the co-participant could and should have made the faces of the complainants unrecognizable before the image data was published, and according to the findings for the co-participant - contrary to his statements - this would have been possible and reasonable within a reasonable time with the help of free programs for PCs and smartphones.
Insofar as the co-participant claims that he published the images immediately and was in an emotionally agitated state, it must be noted that this does not alter the fact that he committed a data breach. On the one hand, the "question of guilt" does not play a role in the present case, on the other hand, the person involved - even if he was emotionally agitated - had to know that the complainant's personal data was involved and that he was not allowed to publish it, especially since he also expressly pointed this out from the second complainant became that a publication was punishable. In this context, he apparently also accepted that the faces of the complainants were recognizable. Apart from that, the co-participant also posted some pictures and videos on social networks several hours after the incident, so in this case it cannot be assumed that this was done carelessly.
Contrary to the explanations of the co-participant, the complainants have not forfeited their right to secrecy under § 1 DSG by allowing themselves to be photographed in an article in a XXXX on XXXX 2018 in connection with the official act in question with recognizable faces, which is already clear from this that the article was written after the publication of the photographs by the co-participant and that the faces of the complainants were already known. With the argument that it was never about the personal, individual attitude of the complainants, but about official, i.e. institutional, misconduct, the co-participant himself states in the end that an identifying representation of the complainants is necessary to achieve the purpose of publishing the image and video recording was not required.
As a result, the complainants' interests in secrecy prevail, so that in the present case the legal basis for the admissibility of data processing under Article 6 (1) (f) GDPR is out of the question. Another justifying legal basis is not apparent to the Federal Administrative Court and was not put forward by the complainant.
The publication of the image and video files on which the complainants are identifiably depicted was therefore inadmissible under Article 5(1)(a) and (c) and Article 6(1)(f) GDPR, as the principle of data minimization was not complied with would.
The appeal was therefore to be upheld and the contested decision to be amended in accordance with the verdict.
3.4. Re B) Inadmissibility of the revision:
Pursuant to § 25a Para. 1 VwGG, the administrative court has to pronounce in its ruling or decision whether the revision is admissible according to Art. 133 Para. 4 B-VG. The statement must be briefly justified.
This decision does not depend on the resolution of a legal issue of fundamental importance. There is neither a lack of case law of the Administrative Court nor does the decision in question deviate from the case law of the Administrative Court; Furthermore, the case law of the Administrative Court is not to be judged as inconsistent. There are also no other indications of a fundamental importance of the legal issues to be resolved. In the case of all significant legal issues, the Federal Administrative Court can rely on the established case law of the Administrative Court (see the explanations under item 3.3.) or on an already clear legal situation. Based on this, a legal question of fundamental importance within the meaning of Art. 133 Para. 4 B-VG cannot be answered in the affirmative (cf. e.g. VwGH 25.09.2015, Ra 2015/16/0085, with further references). It was therefore to be stated that the revision according to Art. 133 Para. 4 B-VG is not permissible in each case.
3.5. It was therefore to be decided accordingly.
