BVwG - W214 2224204-1
From GDPRhub
| BVwG - W214 2224204-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 4(1) GDPR Article 6(1)(f) GDPR Article 17 GDPR Article 18 GDPR Article 21 GDPR Article 22 GDPR |
| Decided: | 03.02.2022 |
| Published: | 06.04.2022 |
| Parties: | anonymous DSB |
| National Case Number/Name: | W214 2224204-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2022:W214.2224204.1.00 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Source: Rechtsinformationssystem des Bundes (RIS) (in German) |
| Initial Contributor: | Heiko Hanusch |
The Austrian Federal Administrative Court held that a municipal water provider did not violate the GDPR by measuring the daily water consumption of a user, if this user had in the past exceeded the daily limited allotted to them.
English Summary
Facts
The controller is a municipality. The data subject owns property in the controller’s district. The data subject won a lawsuit against the controller, obliging it to connect the data subject’s property to the municipal drinking water supply. The judgement was limited to the supply needed for a single-family home. The controller complied with the judgement and connected the data subject’s property to its water supply system. It also installed an analogous water meter (not a smart meter) at the beginning of the water pipe to measure the consumption of the data subject’s property. The water meter is checked once a year by the municipality. The results are stored in the municipality’s software application which is hosted in an Austrian datacenter. The data is retained for thirty years to exercise or defend against possible legal claims.
Moreover, because multiple times in the past the data subject used vast amounts of water, exceeding the need of a single-family home by far, the municipality installed a system that measured the daily consumption of the data subject. At the beginning, the system worked as follows: An incremental encoder was installed on top of the water meter. This incremental encoder sent digital signals to a programmable logic controller (PLC) at the water supply facility of the controller every time water was used by the data subject. The programmable logic controller counted the signals and if the usage of the data subject exceeded the threshold of 950 liters per day, the PLC closed the solenoid valve of the pipe, cutting of the water supply to the data subject's property. The counter was automatically reset each day to zero. After five months the controller switched to a system where the water supply was not automatically shut off but an employee was notified to check whether the alarm was accurate and, if yes, to shut off the water supply manually.
After the data subject learned about this conduct of the controller, she asked the controller for the information according to Articles 13 and 14 GDPR, objected to the processing pursuant to Article 21 GDPR and requested the restriction of the processing under Article 18 GDPR. The controller provided the data subject with the information according to Articles 13 and 14 GDPR but denied the request for restriction. As a consequence, the data subject lodged a complaint with the Austrian DPA (Datenschutzbehörde – DSB) asserting a violation of its rights under Articles 17, 18, 21 and 22 GDPR. The Austrian DPA rejected the complaint as unfounded which lead to the data subject initiating court proceedings.
Holding
The Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG) rejected the complaint and upheld the DPA’s decision entirely.
The court held that the controller was processing personal data according to Article 4(1) GDPR because, at least, in (small) private homes measuring the water consumption can give insights into the beaviour of the residents. The court also corrected the view of the DSB which was of the opinion that the controller is not obliged to erase data of its own accord but only if the data subject requested so. It clarified that according to the explicit wording of Article 17(1) GDPR erasing the data of its own accord is an obligation of the controller and a request by the data subject is not necessary. However, it found that Articles 17(1)(c),(d) GDPR and 21(1) GDPR were not violated because the processing was lawful under Article 6(1)(f) GDPR since measuring the water consumption was necessary to fairly distribute the costs among all users, to check whether the data subject exceeds the water supply needed for a single-family home and to detect damage to the distribution system. The court further held that the controller did not violate Article 18 GDPR because the data subject did not show that the data was inaccurate (Article 18(1)(a) GDPR) and the data subject did not oppose the erasure of the data but rather requested it (Article 18(1)(b) GDPR. Moreover, since the controller did not violate Article 21 GDPR, the court found that the requirements of Article 18(1)(d) were also not met, and a violation of Article 18(1)(c) GDPR was not indicated by the data subject's submissions. Lastly, the court did not find a violation of Article 22(1) GDPR. It clarified that Article 22(1) GDPR does not require a request of the data subject – contrary to the DPA’s opinion – because it constitutes a prohibition, although it is systematically listed in Chapter 3 of the GDPR. However, the court found that there was no decision solely based on automated processing as required by Article 21(1) GDPR because the decision to cut off the supply if the data subject exceeds the daily limit was taken by the controller as a kind of "fundamental decision" before the respective system was installed and was not taken again each time when the supply was actually cut off by the automatic system or the employee (the automatic system or the employee just being the means to enforce the "fundamental decision" of the controller). Furthermore, the court reasoned that there was no automated decision making because, even if the decision was taken each time again, the controller switched from an automated system to a system where the accuracy of the counter is checked by an employee, who is also responsible for shutting off the water supply manually, and therefore the decision was not solely based on automated processing.
Comment
The court did not address the 30 years’ storage period. The statute of limitations for the majority of claims in Austria is 30 years. Therefore, storing the data for thirty years is lawful (Articles 17(3)(e), 18(2), 21(1) sentence 2 GDPR).
The argument of the court that Article 22(1) GDPR is not violated because the controller took a "fundamental decision" to shut off the water supply before installing the system and not every time the automatic system or the employee actually shut off the water supply is legally incorrect. The court basically argued that the automatic system or the employee were just mere tools to enforce the decision of the controller. Other controllers could use this argument in cases where the tool to enforce the decision is not just a simple counter which measures the daily usage and automatically cuts off the supply, but a more sophisticated algorithm. In such a case a controller might also argue that the decision was taken beforehand and that the programmer just designed the algorithm in the way that the decision is enforced when a certain set of conditions are met. The controller could basically argue as long as there is no (real) artificial intelligence a decision is never solely based on automated processing but is always the pre-formulated human decision of the controller manifested in the source code and the algorithm is just a mere tool to enforce this decision. However, "decision based solely on automated processing" does not mean that a machine/computer needs to make an intelligent decision comparable to a human decision. The purpose of Article 22(1) GDPR is exactly to limit the risks to privacy resulting from the error-proneness of programming and machines/automation in general. Until today no human ever created a machine which worked (forever) flawless.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Postal address:
Erdbergstrasse 192 – 196
1030 Vienna
Phone: +43 1 601 49-0
Fax: + 43 1 711 23-889 15 41
Email: einlaufstelle@bvwg.gv.at
www.bvwg.gv.at
decision date
03.02.2022
business number
W214 2224204-1/28E
I M N A M E N D E R E P U B L I K !
The Federal Administrative Court, through the judge Dr. Eva SOUHRADA-KIRCMAYER as
Chair and the expert lay judges Mag. Huberta MAITZ-STRASSNIG and
Mag. Claudia KRAL-BAST as assessors on the complaint from XXXX , against the
Decision of the data protection authority of August 19, 2019, Zl. DSB-D123.958/0003-DSB/2019
right recognized:
a)
The complaint will be processed in accordance with Section 28 (2) of the Administrative Court Procedure Act, Federal Law Gazette I No.
33/2013 as amended (VwGVG), rejected as unfounded.
b)
The revision is not permitted according to Art. 133 Para. 4 B-VG., - 2 -
Reasons for decision:
I. Procedure:
1. In her to the data protection authority (DSB, authority responsible before the
Federal Administrative Court) directed complaint of December 22, 2018, received on
December 28, 2018 (improved with submission of January 22, 2019), the complainant made a
Violation of the right to erasure, the right to object, the restriction of
Processing and, in law, no automated data processing
to be subjected to. In summary, it was submitted that the XXXX
(participating party, former respondent before the authority concerned) data
with regard to the complainant's water consumption in a non-transparent way. It
a facility is operated which monitors the complainant and her
family through the party involved. The installation of a lawful
water meter and water measurement shaft on the complainant's property
is denied by the party involved, this allows a review of the
Consumption habits, absences or other behavior of
complainant. Also going with the water meter in the community-owned
Operational facility measured a main supply line, which not only the property
the complainant, but also for the mandatory flushing and for others
Purposes will be used, so the water data could not do anything about the consumption of the
testify to the complainant.
The data protection complaint was a letter from the complainant to the party involved
Party with which the complainant objects to the data processing
regarding their water consumption and asserted the right to restriction
made, and the reply letter from the party involved is attached.
2. At the request of the authority concerned on January 28, 2019, the co-involved reimbursed
Party on February 15th, 2019 a statement and stated that they with appeal judgment
of XXXX was found guilty of XXXX, the property of
Appellant with a drinking water supply for the needs of a
Detached house to provide, as well as that they are responsible for all damage arising from the
Impairment of the water supply on the complainant's property, liable., - 3 -
The XXXX was assumed in the appeal judgment that it was in the context of the work on
Construction of the public sewage system for the XXXX to an impairment of
water supply had come to the complainant's property. be it
been determined that in accordance with the judgment of XXXX the property of
Complainant to the existing water supply system of the municipality "XXXX"
(hereinafter: "XXXX") and connected to this water supply with drinking water
be taken care of. In the course of the work to connect the property
the complainant has been offered a water meter on her property
to incorporate, the complainant had refused this. The reason for this is this
Time not ensured frost protection of the house management by the complainant
been. The water meter is currently in the well shaft in the " XXXX ". Of the
Statement of the XXXX as supervisory authority of XXXX (code: XXXX) is to be accepted
see that in the specific case no public municipal water pipe iSd XXXX and
of XXXX is available. The complainant has a different water supply and the
Installation of a water meter and a water measuring shaft on your property
required. However, there is no legal entitlement to the construction of a frost-free one
meter shaft by the party involved. The property owner himself has it
Obligation to assume the costs for the installation of the water meter
to tolerate the work required and the work required to protect the water meter
to maintain facilities. The complainant is free to use a water meter
to be built into the house line, to which the party involved then has no access
had. The party involved is also entitled or obliged to make a possible
Detect damage and take appropriate action. With letter dated
On June 28, 2018, the complainant was informed that a water meter
Record the line harness to your property and to the flushing line and the meter reading in each case
determined once a year by reading and stored on measurement documents. The data
would be processed to detect any damage such as burst pipes
can, in order to split the electricity costs of the water supply system to the individual
To be able to make buyers and to be able to check whether the water consumption
of the property within the established boundaries, namely for the needs of a
family house, successes.
On XXXX 2017, the main water meter of the water supply system " XXXX " had a
unusually high water consumption of the entire system is displayed, whereupon all
The system's water meters had been checked. The high consumption has dem
Water pipeline to which the complainant's property is connected, - 4 -
is, can be assigned. The complainant stated that she (although
absent) left the water running for rinsing purposes. Consequently, she is from the
involved party has been advised that hours or even days
Letting the drinking water run the obligation to use drinking water carefully
contradict. This shows that a water meter is required to check
whether the water consumption of the property is within the scope of the judgment of the XXXX
for a single-family house specified in line XXXX and at about
To be able to quickly limit the damage in the event of pipe bursts. The conditions
to delete the collected data would not be available for the reasons mentioned. the
Appellant repeatedly claims an exorbitantly high, far
beyond the needs of a single-family house, the provisions of the
Water law contradicting water consumption and that it is available
provided water neither qualitatively nor quantitatively to the judgment of the XXXX
correspond to
3. The authority concerned informed the complainant of the results of the
preliminary investigation of March 6th, 2019 and sent her the statement of the
involved party. According to Section 45 (3) AVG, the complainant was heard as a party
granted and given the opportunity to submit a statement.
4. The complainant stated in her statement, received on March 22, 2019,
additionally summarized that the only water meter, which for their
Water consumption could be used in a locked well shaft
involved party and is not accessible to them. One for the complainant
accessible, legally compliant, certified and calibrated water meter is not
available and will be denied. The installation of such a water meter is through that
XXXX and the XXXX set by law. This water meter should only be in one
frost-free basement room or in a water measuring shaft at the property boundary
to be installed. Neither is due to the current design of the house connection line
possible. The flushing line contains 653 liters of water and according to the Drinking Water Ordinance is one
daily rinsing required to prevent contamination and accumulation of precipitated
prevent minerals. Consequently, any water consumption, measured by this
Counters are not assigned to be consumption-neutral. The party involved has in its
Opinion claims to control the complainant's water consumption
need to be able to take action if necessary. The water supply
Complainant can therefore be hired at will, this is in the
past also happened several times. Furthermore, the complainant's house was of - 5 -
January XXXX to October XXXX hooked up to a no consensus water line/flush
been. For years, she and her family had been forced to pollute and
consuming unhealthy water. You will continue to execute the
Water connection refused. It had also been established that in concrete terms
case it is a public water pipe.
5. With the now contested decision of August 19, 2019, the complaint
rejected. As a reason, the authority concerned (after repeating the argument
of the parties and the course of the proceedings) first of all that the subject of the complaint is the
The question is whether the party involved has the right to revoke the complainant
erasure, the right to restriction of processing, the right to object and the
Right not to be subject to an automated individual decision, violated by
the involved party to the request formulated in the letter of 10.06.2018
complainant until the conclusion of the proceedings before the data protection authority
have corresponded.
The authority concerned found, among other things, that the complainant was the owner
who is XXXX. In 2005, work was carried out on a public sewage system
Cadastral community XXXX has been carried out. Based on these works, let it be
a legal dispute between the complainant and the party involved
came. The XXXX decided in its judgment of XXXX XXXX that the involved
Party within eight weeks from the title of damages (in rem restitution).
have to produce drinking water supply for the needs of a single-family house. with XXXX
was the connection of the complainant's property to the water supply system
" XXXX " occurs. Up to this point, the water supply system was only available
Supply of municipal buildings or facilities served. The technical installations
this water supply system (well, treatment systems, UV sterilization system)
would be in the " XXXX ". The water meter for the power line on which the
The complainant's property has been connected since
Installation of the system directly in the well shaft.
No fee will be charged for the use of water on property XXXX. Of the
Water meters enable the involved party to report the annual water consumption
measure, to identify and check damage and broken pipes as quickly as possible
to be able to determine whether the water consumption of the complainant's property within the
in the said judgment of the XXXX of XXXX, namely for the needs
of a single-family house, successes. The water consumption data would only go to these
mentioned purposes., - 6 -
Legally, the relevant authority stated that water consumption data that
as in the present case, to a specific property and thus to a specific one
living situation, to handle personal data in accordance with Art. 4 Z 1 GDPR.
Furthermore, the authority concerned explained that the exercise of the right to deletion as
subjective right of data subject according to Art. 12 Para. 3 DSGVO a corresponding application
assume the person responsible that such a request is neither express nor
been made implied. Regarding a violation of the right to restriction pursuant to
Art. 18 (1) lit. a, lit. b and lit. d GDPR is with regard to lit. a leg. cit. to hold that
the correctness of the water consumption data in question had never been disputed. One
Violation of the right to rectification in accordance with Art. 16 GDPR is also not alleged
been. With regard to lit. b leg. cit. it should be noted that the complainant
obviously did not refuse deletion. With regard to lit. d leg. cit. be held tight
that the complainant had lodged an objection pursuant to Art. 21 (1) GDPR,
however, the complaint should also be dismissed with regard to the right of objection. To
the authority concerned explained that according to the wording of Art. 21 Para. 1 DSGVO a
data subject the reasons arising from their particular situation within the framework
the exercise of the right of objection according to paragraph 1 leg. cit. have to explain. These reasons
were not presented to the party involved as responsible, thus
is not a claim to the handling of the exercised objection by the co-involved
party emerged. Even if you consider the statements in the application of June 10, 2019 [meaning:
06/10/2018], as "explanation of the special situation" in the sense of the above considerations
would qualify, the complaint was to be unsuccessful on this point, since the
involved party as a municipality acts as responsible for the public area,
therefore based on Art. 6 Para. 1 lit. f GDPR, since the procedural
Processing was not carried out in fulfillment of their (sovereign) tasks. It is
objectively a private water supply system of the party involved, which
only supply municipal buildings or facilities with water from the tap
and the connection of the complainant's property to the latter
Water supply system was only on the occasion of the judgment of XXXX from XXXX to Zl. XXXX
takes place in order to implement the "in rem restitution" ordered "by decree". the
The involved party bases the processing on legitimate grounds
Interests according to Art. 6 Para. 1 lit. f GDPR, which is why Art. 21 Para.
1 GDPR is basically fulfilled. However, the party involved has “mandatory
reasons worthy of protection” for the processing, namely the annual
to measure water consumption and to prevent damage and pipe bursts as quickly as possible, - 7 -
recognize. Albeit for the use of water on the complainant's property
no fee is charged, there is also a particular need to check
to be able to ensure that the total water withdrawal of the "XXXX" does not exceed 3050 l/day and
that the water extraction on the complainant's property within the
specified limits, namely for the needs of a single-family home. The opposite
there are no compelling reasons worthy of protection recognizable, which is why the co-involved party
the processing in question should be omitted. So the complainant only
generally brought to the meeting that "profiling" was carried out with the water consumption data
without going into more detail about this process. The water consumption data would
but - as emerged in the present proceedings - only to the aforementioned
purposes and not otherwise used, so no disproportionate
Processing or violation of Art. 5 Para. 1 lit. b GDPR is recognizable. Of the
involved party should also concede that with regard to the limited
Presence of a sufficient amount of drinking water, a certain range in the
Distribution of the maximum water volume to the different consumers monitored
to avoid that a single user has the total fixed
Amount of water (or a disproportionate amount) at the expense of others
consumers consume. Right, not subject to any automated individual decision
to be, it should be pointed out that the first element of the elements of Art. 22 para. 1
GDPR is not fulfilled and there is no "automated decision".
6. Against the decision in question, the complainant raised with input from
02.10.2019 complaint to the Federal Administrative Court within the deadline and demanded the
Deletion of the data unlawfully assigned to you. In it, she reiterated the view that
the water supply system "XXXX" is a public one
water supply system handle. The complainant must be granted the
Amount of water can be granted and only this amount of water can be checked
take place. The involved party is not permitted to claim from the authority for a
to distribute the amount of water approved for certain properties to other customers. the
The party involved has sole power of disposal over the data from the water meter
in the blocked well shaft. The water pipe line on which the property of
Complainant is connected, also supply other customers. That means that
the statutory, regular flushing of the 271 m long
water pipe line, the volume of which is 653.21 liters of water, at least once per
week must be carried out. This is necessary in order to comply with the Drinking Water Ordinance
regarding sterility. Therefore, the measured data are the only - 8 -
Counter in the well shaft of the party involved, which is approx. 90 meters from the
property of the complainant is situated, not objectifiable. To reprimand that itself
the complainant had refused to install a water meter in her shed
to leave, she explained that no water meter could be installed in the shed because
this is not frost-free. Furthermore, the complainant submitted that the assessment of evidence
the authority concerned is largely based on incorrect information, in particular those that have been complained about
the reference to the notification of XXXX as the supervisory authority dated XXXX
(Code: XXXX ), which is not a legal opinion. Of the
the water pipeline in question, on which the property of
Complainant was affiliated, also had no water permit.
In addition, it is incorrect that the measured data only belong to the
interested party would be used for the purposes mentioned, water consumption
the complainant is constantly being measured. There is no standard
Water meter on the complainant's property, so there is one
"As soon as possible" detection of "damage and burst pipes" not possible,
because a separation of the public line/data from the private line/data is not
feasible. Consequently, it is also not possible to damage the public
water line from damage to the complainant's private water line
to separate. The water consumption data attributed to the complainant would
do not correspond to the data protection regulations, these are directly applicable
Clear. Attached to the complaint is a letter from the law-friendly representative of
involved party from 13.09.2019.
7. By letter dated October 3rd, 2019 (received on October 9th, 2019), the competent authority submitted the
appeal and the administrative act to the Federal Administrative Court for a decision
and issued an opinion to the effect that the complaint submissions in their entirety
contested and referred to the contested decision. Furthermore, some
of the arguments contained in the notification
8. In a letter dated October 29, 2019, the complainant informed that on
23.10.2019 Drinking water withdrawn. You reported this.
Enclosed was a letter to XXXX and other attachments, including an e-mail dated
October 23, 2019, whereby the complainant was informed by the involved party that
that on that day the amount withdrawn from their property exceeded 900 liters and
therefore another withdrawal option was prevented for that day., - 9 -
9. In a further letter, received on April 7th, 2020, the complainant brought
suggests that, based on previously withheld documents from the party involved,
correction was necessary and reiterated some of its previous claims. Next be
on October 22nd, 2019 a water counting and shutdown system was installed to
to monitor the complainant's water consumption data. This has to
automatic shutdown of the water supply on October 23, 2019. First with
In a letter dated March 3, 2020, the party involved admitted new facts
been. With the installation of this solenoid valve, it is possible at any time to
To change the liter setting, this would result in prohibited profiling. These dates
would be used to reduce the applicant's water supply
be used to use the water volumes for flushing purposes and for other customers
be able.
Enclosed was a letter from the mayor dated March 3rd, 2020, a letter from XXXX
from March 25th, 2020, an excerpt from a judgment of XXXX from XXXX on line XXXX, as well as a
Excerpt from XXXX .
10. Due to the decision of the business allocation committee of July 17, 2020, the
the legal matter in question to the now competent court division W214
assigned, where it arrived on 07/24/2020.
11. On XXXX 2021, the Federal Administrative Court granted the parties to appeal
or opinion of the relevant authority. The party involved was
further requested, within the same period, the exact designation and functioning of the
to announce both installed water meters, in particular whether these are
so-called "smart meters" handle, as well as run, whether through the water meter of
exact water consumption of the complainant's property should be given
can or whether the water meter connected the total consumption of all
real estate and (indistinguishable) consumption for flushing purposes.
12. On November 2, 2021, a letter from the complainant including enclosures was received, in
which she essentially repeated her previous submissions.
13. After the extension of the deadline had been approved, the party involved submitted an application on November 12, 2021
submitted a statement in which, to the extent relevant to the proceedings in question, she stated that
that there is a water meter (No. XXXX) at the beginning of the water pipe line, on which
the complainant's property is attached. This
The water pipe then continues to a flushing shaft, where another - 10 -
Water meter (No. XXXX) installed. This one additionally installed in 2019
Water meters are used to determine the amount of water during rinsing processes. The slider after
the house connection of the complainant's property is only used for rinsing processes
opened. There are no further connections or
Customer. The water meters in question are analog
Ring piston meters, therefore no "smart meters". Once a year, a reading of all takes place
customer-side water meter of the water supply system " XXXX ", thereby for
all customers determine their annual consumption in order to share the electricity costs
to be able to carry out the individual customers. For the property of
Appellant, the annual water consumption results from the deduction of
Annual water consumption at water meter no. XXXX from annual water consumption
Water Meter No. XXXX . This subtraction consideration is due to the fact that a
Installing a water meter on the complainant's property
was made possible (creation of a frost-free room).
Due to an exorbitantly high water consumption of the property
The complainant had put an impulse generator on the water meter No. XXXX,
A solenoid valve was installed after the water meter. The impulses (1 liter = 1
pulse) of the pulse generator would be via a digital input on the PLC
(Programmable logic controller) of the water supply system "XXXX" recorded and
are summed up (counter). By exceeding the set limit value of
950 liters, an alarm is set off (call from the building yard employee on duty through
the alarm dialer). It is then carried out by the building yard employee on duty
Deactivation and notification of this by email to the complainant. The counter
in the PLC is reset daily at 00:00 and then starts again at 0 liters
counting. During a rinsing process, the pulse count is switched to inactive. It succeeds
no storage or visualization of daily values, so there is no profiling.
It was noted that the shutdown (the closing of the solenoid valve) initially
was done automatically by the controller. In March 2020 this was reprogrammed
that the information of reaching the maximum amount of water in the first step
automatically sent to the building yard employee on duty, who takes it
then switch off manually and inform the complainant.
The statement was accompanied by a number of documents, including an explanation of the
pipe network of the water supply system in question., - 11 -
14. On December 7th, 2021, the party involved made a statement again and repeated in the
essentially their previous submissions. She explained in reference to another who
Statement attached letter (which contains explanations to the objective
water meters used) that the controller does not have any meter readings
would be transmitted or recorded and no way for the party involved
insist on reading the current daily counter reading.
15. In a letter dated December 15, 2021, the Federal Administrative Court provided additional specific information
Questions for the involved party.
16. By letter dated January 3, 2022 (received at the Federal Administrative Court on
09.01.2022), the party involved commented on the questions. Since installing the
second water meter, it is now possible to record exact amounts of flushing water in the log book
to note. The logbook is made electronic at the building yard by the building yard employees
kept and kept. For the annual percentage breakdown of operating costs at
the other water consumers is the inclusion of the water meter, via which the
Supply of the complainant's property and the (independent)
any flushing was carried out, was in principle sufficient, since the property of the
Complainant (as long as [consumption by] the property does not exceed the need
of a single-family home) does not have to bear any costs. An exact differentiation
between the consumption of the named property and the flushing quantities in the same
From the municipality's point of view, the cable harness was therefore not necessary. Until the installation
Flushing water meter in the flushing shaft two flushings have taken place. Next were in the
Writing transmits the data stored about the water meter. the
Data processing is carried out by the party involved, which identifies itself as XXXX
serve processors, there is also an order processing agreement.
According to the log book, the system control reported on XXXX 2017 that the
The water level in the tank had dropped to a minimum, whereupon initially the
The main water clock and then the individual water meters had been checked. To that extent
the high water consumption of the complainant's property was attributed
be able.
The daily recording, which the building manager in the interrogation before the BG XXXX
addressed only the inlet side of the water supply system "
XXXX " and thus the entire system., - 12 -
The e-mail notifications to the complainant and the respective replies
of the complainant would be stored in the municipal software for evidence purposes.
The letter included an excerpt from the logbook and one to the complainant
directed letter dated January 29, 2020, with which the answer to a
The complainant's request for information and an inspection report on the
water quality were transmitted, connected.
17. The comments of the interested party (and the questions of the
Federal Administrative Court to the party involved, the complainant and
notified to the relevant authority.
II. The Federal Administrative Court considered:
1. Findings:
The procedure outlined under point I is used as a basis for the findings.
In particular, the following facts are established:
1. The complainant is the owner of the XXXX.
2. In 2005, work on a public sewage system was carried out by the parties involved
party performed. Based on this work, a legal dispute arose between
the complainant and the involved party.
3. With the judgment of XXXX dated XXXX, the complainant was given line XXXX from the title
of damages (in kind restitution) the production of a drinking water supply for
the need for a single-family house within eight weeks by the party involved
awarded.
4. In accordance with the judgment of the XXXX, the property of the complainant on
XXXX 2014 to the existing water supply system of the municipality "XXXX"
connected and the complainant's property via this water supply
supplied with drinking water. Up to this point, the water supply system served
only to supply municipal buildings and facilities. The property of
The complainant was addressed to the – originally to empty the system
intended - line to the undeveloped property land register no. XXXX connected
The water meter for this line has been in place since the system was set up
right in the well shaft. There are also water meters in the well shaft of the " XXXX " - 13 -
of the community center XXXX, for the private house XXXX as well as water meter of the "XXXX" and
for the graveyard. The well shaft is closed. have access to the well shaft
the building yard employees of the party involved.
5. The water pipe in question is not a public one
Community water line iSd XXXX and the XXXX The water supply system is used in addition
the primary purpose of supplying community facilities and buildings
the fulfillment of the municipality's obligations under the law on damages by supplying
two private properties (including that of the applicant).
6. Due to the connection of the complainant's property, the
Existing water law permit from BH XXXX from 13.11.2007 for Zl. XXXX and
XXXX with a maximum water withdrawal of 1,550 l/d or 380m³/a
are complied with, which is why the BH XXXX at the request of the party involved
Notice of 05/21/2015 for Zl. XXXX an increase in water use "XXXX" to 3050
3
l/d or 864 m/a approved. As part of the approval process,
Official experts for groundwater hydrology stated that the existing
Well would have a sufficient yield, whereby for the property the
Complainant was assumed to need 900 l/day.
7. No payment is made for the use of water by the complainant's property
charged.
8. On June 10, 2018, the complainant submitted the following application to the co-participant
Party (reproduced verbatim without salutation and salutation):
"[...]
Since it has been made known to me that you are using my water consumption data without my
Consent, continuously checking, saving and thus profiling, I declare that
I object.
According to GDPR Art 21 - right of objection, all relevant paragraphs in particular (1),
Furthermore according to Art. 18 GDPR - right to restriction (1), in particular a - d.
Furthermore, I request the prescribed information according to Art. 13, DSGVO -
Obligation to provide information when collecting personal data from the data subject
Person, all paragraphs (1) a - f, (3), (4).
Art. 14 GDPR – obligation to provide information if the personal data is not with the
data subject have been collected. All paragraphs (1) a-f, (2) a-g, (3) a-c, (4), (5) a-d.
[...]", -14-
9. The involved party informed the complainant in a letter dated
28.06.2018 that they have data on the meter reading relating to the water meter in question
process, with the meter reading once a year in January by reading the
water meter is determined and stored on measurement documents. Furthermore, the
informed the complainant about the purposes of the data processing. It wouldn't
Data transmitted to third parties. The data would be stored for 30 years (for this purpose the
purposes stated). There will be no automated individual decision-making process
used and no profiling operated. Finally, the complainant
informed that the involved party formulated in the letter of 10.06.2018
will not comply with the complainant's request. The writing of
involved party from 06/28/2018 is the basis of the findings.
10. The complainant made in her data protection complaint of 22.12.2018
(improved with input from 01/22/2019) a violation of the right to erasure, im
Right to object, right to restriction of processing and right none
to be subject to automated individual decision-making and argued that the
involved party consumption data regarding the water consumption of
process the complainant in a non-transparent manner. The appellant therefore applied for
Deletion of recorded data regarding your water consumption.
11 By decision of August 19, 2019, Zl. DSB-D123.958/0003-DSB/2019, the
authority dismisses the complaint as unfounded.
12. The complainant raised an objection to this decision in a letter dated September 30, 2019
timely appeal to the Federal Administrative Court.
13. At the beginning of the water pipe line to which the property of
Complainant is connected, is (since October 22, 2019 due to a
calibration change) of the water meter no. XXXX . Before the calibration change, water meter No.
XXXX installed. This water pipe runs after the house connection
The complainant's property further to a flushing shaft, where the
Water meter no. XXXX is installed. This water meter was added in 2019
installed and is used to determine the amount of water in flushing processes. The slider after
the house connection of the complainant's property is only used for rinsing processes
opened. By deducting the annual water consumption at meter no. XXXX from
Annual water consumption of water meter No. XXXX is the determination of
water consumption on the complainant's property and can the - 15 -
made available to the complainant upon request. Rinsing processes that are carried out
the operators of the water supply system are initiated, take place at least twice in
year instead. On January 29th, 2020 there were two flushes in 2018 and six flushes a year
2019 documented in the logbook of the water supply system " XXXX ".
14. With the water meters that (also) measure the consumption of the property
concern complainant and also with the newly installed water meter, the
now measures the water consumption of the rinsing processes, it is/was analogue
Piston meters and no "smart meters".
15. The party involved carries out automated data processing in which
regarding the water connection of the complainant's property
are saved.
The water meters of the water supply system are read once a year
basically in January. or around the turn of the year. Due to the calibration change in the year
At this time in 2019, the final reading of the old water meter and the
initial reading of the new water meter can be recorded.
The measurement document values of the contract XXXX (XXXX + flushing line) are like those of
other relevant contracts annually in the table below showing the
Percentages calculated for the billing of operating costs. This table is in the
Community software XXXX in E-Akt A-XXXX:
16. The data is processed to detect any damage such as burst pipes
to be able to, in combination with the other water meters, the allocation of the
To be able to make electricity costs on the individual customers, and to check
whether the water consumption of the complainant's property within the
with the judgment of XXXX to XXXX, namely for the need of a
single-family house takes place.
17. The data mentioned under point 15 for processing the water meter reading
for a period of 30 years to fulfill the obligation imposed by the judgment and, - 16 -
to assert any liability or unjust enrichment claims
kept.
18. The data mentioned under point 15 will be processed by the party involved in the
Community software XXXX from the company XXXX processed. The community software XXXX is from
hosted by XXXX in an Austrian data center. To login is
personalized Citrix access required. There are also those mentioned under point 15
Data physically stored. With the company XXXX there is one
Data Processing Agreement. The data will not be given to any other recipients
disclosed to.
19. The system control reported on XXXX 2017 that the water level in the tank in
Area "XXXX" had dropped to a minimum. Then checked
The municipal building yard employees all the water meters of the system and realized that
about the water meter on the complainant's property and the flushing pipe
affected, an unusually large amount of water ran. The building yard employees could on the
property of the complainant, whereupon they
House connection valve due to the suspicion of a burst pipe in the house
closed the property and the complainant was informed. In further
As a result, the complainant informed that she (although absent) for flushing purposes
let the water run and presumably there was no ruptured water pipe. Of the
The house connection valve was then opened again. The complainant was
requested by the party involved in a letter dated November 2nd, 2017, such exorbitant
Refrain from withdrawing water, as this will disrupt all other withdrawals of water
would be impaired and this in accordance with a careful handling of drinking water
contrary to the Water Rights Act.
20. The continued extremely high water withdrawals on the property of
Complainant caused the involved party to fear that compliance with the
approved total consumption of 3,050 liters per day compared to BH XXXX
to be able to guarantee. As early as September 2019, the upstream
Main water meter that in 2019 also with the approved total annual consumption
3
of 864 m threatened to be exceeded. The complainant was therefore
Letter dated 09/13/2019 from the involved party announced that they are to comply
the consensus amount determined by decision of the district authority
was forced to stop withdrawal if 900 liters per day were exceeded
to foresee. Should this maximum daily, - 17 -
withdrawal quantity be required, the complainant has the co-involved party in the
To be informed in advance, whereupon the party involved will try to obtain an increased
To coordinate water requirements with the other water recipients, so that the specified
consensus quantity is not exceeded.
21. For the purpose of determining if the maximum water level has been exceeded
of the complainant's property was added to water meter no. XXXX on October 22, 2019
an impulse generator put on. A solenoid valve was installed after the water meter. the
Pulses from the pulse generator are transmitted via a digital input on the PLC
(programmable logic controller) of the water supply system "XXXX" recorded and
accumulated (counter). If the daily maximum amount of water was exceeded, the
Shutdown (the closing of the solenoid valve) initially automatically by the controller,
since March 2020 the following procedure has been in place: By exceeding the set
limit value of 950 liters, an alarm is set off (the person on duty calls
building yard employee through the alarm dialer). It is then done by the
depot employees on duty and in close temporal relation
then the relevant notification by e-mail to the complainant. The counter will
resets daily at 00:00 and starts counting from 0 liters again. The impulses
are only used directly in the software of the control of the water supply system " XXXX "
processed. There is no storage or visualization of daily values. During
of a rinsing process, the pulse count is switched to inactive.
22. There has now been an increase in the number of shutdowns due to the
Exceeding the daily water consumption of 950 liters on the property
complainant came.
23. In 2019, the limits set by the BH XXXX with a decision dated
05/21/2015 approved water withdrawal quantity of 864,000 l/a (for the entire system),
because on the complainant's property alone around 725,000 liters instead of for
their property consumes an assumed 328,5000 l/a (needs for a single-family house).
became.
24. The e-mail communications to the complainant and their related
Responses are stored in the community software XXXX in the E-Akt XXXX in order to
to be able to prove that the complainant was duly informed in each case
became. Furthermore, the shutdowns are displayed according to months and days and the sum of the
shutdowns are processed in a table, which is also located in the file mentioned. The, - 18 -
Storage is necessary to fulfill the obligation imposed by the judgment and to
Assertion of any liability or unjust enrichment claims for the duration
intended for 30 years. The building yard employee on duty notes both the
fact that on a specific date from the applicant's property the
water consumption of 950 l was exceeded and at what time this took place as well as,
that and at what time an e-mail was sent, in the logbook of the
Water treatment plant " XXXX ". Any use other than those mentioned
purposes is not made.
25. The yard manager carries out daily awards, which, however, are the inflow side of the
affect the entire water system. These are transferred to the logbook logs
and supplemented by operational measured values. This record serves as proof of
Adhering to the water rights consensus with the water rights authority.
2. Evidence assessment:
The facts result from the submitted administrative act and the present one
Court act, in particular also from the statements of the involved party from
02/15/2019, 11/12/2021, 12/06/2021 and from 01/03/2022 together with the contained therein
Screenshots, but also partly from those submitted by the complainant
documents. That it is - what the complainant during the proceedings at
the authority concerned and also in the proceedings before the Federal Administrative Court
was repeatedly denied - in the case of the water supply system by none
public water supply, results from the knowledge of the
Administrative Court of April 20, 2021, Ro 2021/07/0001-5.
That the water pipe line, at the beginning of which water meter No. XXXX is located,
only measures the amount of water flowing from the complainant's property
is consumed, as well as the flushing processes that take place on a case-by-case basis, which are carried out by the operator
of the water supply system are initiated, results from the above
Comments of the involved party. This is plausible if only because a
Distribution of the electricity costs among the (other) connected customers is not possible
would be, their consumption would not be measured by other water meters. For that yet
other properties (except those to which the flushing line leads) on the water line and
water meter, which affects the complainant's property, are connected
there are no clues., - 19 -
That the maximum daily water consumption is exceeded
through the use of water on the complainant's property, was
Appellant not disputed. That this overrun is not due
Flushing operations of the operator of the water supply system was caused, results for
one from the fact that the complainant herself on the occasion of the incident on XXXX 2017
admitted to having left the water running despite being absent. Also
flushing processes are always documented by the operator of the system in the operating log.
Furthermore, the list provided by the party involved shows the
Exceeding the daily maximum water supply volume, which has been in force since autumn
2019 is that the daily maximum amount of water is repeatedly exceeded
occur that can be clearly assigned to the complainant's property.
The fact that the party involved already informed the complainant in a letter dated September 13, 2019
announced, in the future, a water withdrawal that exceeds the daily withdrawal amount of
900 liters and to inform the complainant immediately by e-
To inform you by mail results from the letter of 05.11.2021 submitted by the
Attorney of the involved party from September 13th, 2019. So that was the planned one
Procedure from receipt of the letter of 09/13/2019 and thus before the first
Shutdown known to the complainant.
3. Legal assessment:
3.1. According to Art. 130 Para. 1 Z 1 B-VG, the administrative courts decide on complaints
against the decision of an administrative authority due to unlawfulness.
According to § 6 BVwGG, the Federal Administrative Court decides through a single judge, provided that
Federal or state laws do not provide for the decision to be made by senates. According to
Section 27 of the Data Protection Act (DSG) as amended is decided by the Federal Administrative Court in proceedings
about complaints against decisions due to violation of the duty to inform according to §
24 para. 7 and the decision-making obligation of the data protection authority by the Senate. The Senate
consists of a chairman and a competent lay judge from among the
employers and from among the employees.
The procedure of the administrative courts with the exception of the Federal Finance Court is through
the VwGVG, Federal Law Gazette I 2013/33 as amended by Federal Law Gazette I 2013/122 (§ 1 leg.cit.). According to § 58 paragraph 2
VwGVG remain conflicting provisions at the time of entry into force
of this federal law have already been made public., - 20 -
According to § 17 VwGVG, unless otherwise specified in this federal law,
Procedure for complaints according to Art. 130 Para. 1 B-VG with the provisions of the AVG
Exception to §§ 1 to 5 as well as part IV and others specified in more detail (in
in this case not relevant) laws and otherwise those procedural law
Provisions in federal or state laws to apply mutatis mutandis, which the authority in
applied to the procedure preceding the procedure before the administrative court
has or should have applied.
According to § 28 para. 1 VwGVG, the administrative court has the legal matter by cognizance
deal with, provided that the complaint is not to be dismissed or the proceedings are to be discontinued.
According to § 28 para. 2 VwGVG, the administrative court has jurisdiction over complaints according to Art. 130
Para. 1 Z 1 B-VG to decide on the matter itself if the relevant facts
is established or the determination of the relevant facts by the administrative court
even in the interest of speed or with a significant cost saving
connected is.
3.2. Regarding the process requirements:
The complaint was made in accordance with § 7 para. 4 VwGVG and there are also
the other process requirements.
3.3. Regarding part A):
3.3.1. Legal situation:
The relevant authority has its decision - as far as relevant to the proceedings -
based on the following legal bases:
Art. 12 (2), (3) and (4), Art. 17, Art. 18 (1) lit. a, lit. b and lit. d, Art. 21 (1),
Article 22(3), Article 57(1)(f) and Article 77(1) of Regulation (EU) 2016/679
(General Data Protection Regulation - GDPR), OJ No. L 119 of 4.5.2016, p. 1; § 24 paragraph 1 and
Paragraph 5 of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999 as amended. These provisions are
also in the present complaint proceedings before the Federal Administrative Court
In addition, Art. 4 Z 1 and Art. 6 Para. 1 lit. c and f GDPR are relevant.
Art. 4 Z 1 GDPR reads:
"Article 4
definitions
For the purposes of this Regulation, the term means:, - 21 -
1."Personal Data" means any information relating to an identified or
identifiable natural person (hereinafter "data subject"); as
identifiable is a natural person who directly or indirectly, in particular
by association with an identifier such as a name, an identification number
location data, an online identifier or one or more specific
characteristics expressing the physical, physiological, genetic, psychological,
economic, cultural or social identity of this natural person,
can be identified;"
Art. 6 para. 1 lit c. and f DSGVO are:
"Article 6
lawfulness of processing
(1) The processing is only lawful if at least one of the following
conditions are met:
c) the processing is necessary for compliance with a legal obligation imposed by the
Controller is subject to;
f) the processing is to protect the legitimate interests of the person responsible or
of a third party required, unless the interests or fundamental rights and freedoms
of the data subject, which require the protection of personal data, prevail,
especially when the data subject is a child
Point (f) of the first subparagraph shall not apply to public authorities in the performance of their duties
processing carried out.”
Art. 12 para. 2, para. 3 and para. 4 GDPR read:
"Article 12
Transparent information, communication and modalities for exercising rights
the person concerned
(2) The person responsible facilitates the exercise of the data subject's rights in accordance with
Articles 15 to 22. In the cases referred to in Article 11 paragraph 2, the
Controllers only refuse based on the request of the data subject
exercise their rights under Articles 15 to 22 to take action if credible
makes it impossible to identify the data subject.
(3) The person responsible shall provide the data subject with information on the request
measures taken in accordance with Articles 15 to 22 without undue delay, but in any event
available within one month of receipt of the application. This deadline can
Another two months can be extended if this takes into account the complexity
and the number of applications required. The person responsible informs the data subject
Person within one month of receipt of the request for an extension of time,
along with the reasons for the delay. The data subject submits the request
electronically, it is to be informed electronically if possible, provided that it
states nothing else.
(4) If the person responsible does not act upon the request of the data subject,
he shall inform the person concerned without delay, but at the latest within one
month after receipt of the application about the reasons for this and about the possibility of
to lodge a complaint with the supervisory authority or to lodge a judicial remedy.”
Art. 17 GDPR reads:
"Article 17
Right to Erasure (“Right to be Forgotten”)
(1) The data subject has the right to demand that the person responsible
relevant personal data will be deleted immediately, and the
The person responsible is obliged to delete personal data immediately if
one of the following reasons applies:
a) The personal data are necessary for the purposes for which they were collected or otherwise
way were processed, no longer necessary.
b) The data subject withdraws their consent on which the processing is based
Article 6(1)(a) or Article 9(2)(a) and lack of
another legal basis for the processing.
c) The data subject objects to the processing pursuant to Article 21(1).
and there are no overriding legitimate grounds for the processing, or the
the data subject objects to the processing pursuant to Article 21(2).
d) The personal data have been processed unlawfully.
e) The deletion of the personal data is necessary to fulfill a legal obligation
Obligation required by Union law or the law of the Member States, the
the person responsible is subject.
f) The personal data was collected in relation to the services offered by
Information Society collected in accordance with Article 8(1).
(2) Has the person responsible made the personal data public and is he
obliged to delete them in accordance with paragraph 1, he shall take into account the
available technology and the implementation costs appropriate measures, too
of a technical nature, to those responsible for data processing who process the personal
process data, to inform that a data subject of them
Delete all links to this personal data or any copies or replications
requested this personal data.
(3) Paragraphs 1 and 2 do not apply if processing is necessary
a) to exercise the right to freedom of expression and information;
b) to fulfill a legal obligation that requires processing under the law of
Union or the Member States to which the person responsible is subject, or for
Performance of a task that is in the public interest or in exercise
public authority delegated to the controller;
c) for reasons of public interest in the field of public health pursuant
Article 9 paragraph 2 letters h and i and Article 9 paragraph 3;
d) for archival purposes in the public interest, scientific or historical
research purposes or for statistical purposes in accordance with Article 89 paragraph 1, to the extent that - 23 -
Paragraph 1 of the law is likely to achieve the objectives of this processing
renders impossible or seriously impairs, or
e) to assert, exercise or defend legal claims.”
Art. 18 para. 1 reads:
"Article 18
Right to restriction of processing
(1) The data subject has the right to have the person responsible restrict the
to request processing if one of the following conditions is met:
a) the accuracy of the personal data is contested by the data subject,
for a period that enables the person responsible to verify the accuracy of the
to check personal data,
b) the processing is unlawful and the data subject requests the erasure of the
personal data and instead restricts the use of the
personal data requested;
c) the person responsible does not use the personal data for the purposes of processing
longer, but the data subject needs them to assert, exercise or
Defense of legal claims needed, or
d) the data subject objects to the processing pursuant to Article 21(1).
filed, as long as it is not certain whether the legitimate reasons of the
those responsible outweigh those of the data subject.”
Art. 21 Para. 1 GDPR reads
"Article 21
Right to object
(1) The data subject has the right, for reasons arising from their particular situation
arise at any time against the processing of personal data concerning them
based on Article 6 paragraph 1 letters e or f to file an objection; this applies
also for profiling based on these provisions. The controller processes
the personal data no longer, unless he can compelling protection-worthy
demonstrate grounds for processing that outweigh the interests, rights and freedoms of the
affected person outweigh, or the processing serves to assert, exercise
or defense of legal claims.”
Art. 22 para. 1 to 3 GDPR read:
"Article 22
Automated decisions on a case-by-case basis, including profiling
(1) The data subject has the right not to be contacted solely on an automated basis
to be subject to a decision based on processing, including profiling,
which has a legal effect on it or which affects it in a similar way
impaired.
(2) Paragraph 1 does not apply if the decision - 24 -
a) for the conclusion or performance of a contract between the data subject and
is necessary for the person responsible
b) on the basis of Union or Member State legislation to which the
Controller is subject to, is permissible and appropriate to this legislation
Measures to protect the rights and freedoms and legitimate interests of
data subject contain or
c) with the express consent of the data subject.
(3) In the cases referred to in paragraph 2 letters a and c, the person responsible
appropriate measures to protect the rights and freedoms and legitimate interests
of the data subject, including at least the right to obtain intervention
of a person on the part of the person responsible, on the presentation of his own point of view and on
challenge the decision.”
Article 57 (1) (f) GDPR reads:
"Article 57
tasks
(1) Without prejudice to other duties set out in this Regulation, each
supervisory authority in their territory
f) dealing with complaints from a data subject or complaints from a body, a
organization or association referred to in Article 80, the subject of
Investigate the complaint to a reasonable extent and the complainant within
a reasonable period of time about the progress and the result of the investigation
inform, particularly when further investigation or coordination with a
other supervisory authority is necessary;"
Art. 77 para. 1 GDPR reads:
"Article 77
Right to lodge a complaint with a supervisory authority
(1) Without prejudice to any other administrative or
judicial remedy, the right to lodge a complaint with a supervisory authority,
in particular in the Member State of their place of residence, their place of work or location
of the alleged infringement if the data subject believes that the
Processing of the personal data concerning you contrary to this regulation
violates.
(2) The supervisory authority to which the complaint was lodged shall inform the
Complainant about the status and outcome of the complaint including the
Possibility of a judicial remedy under Article 78.”
§ 24 paragraphs 1 and 5 DSG read: - 25 -
"Article 24. (1) Every data subject has the right to lodge a complaint with the data protection authority,
if she believes that the processing of personal data concerning her
Data violates the GDPR or § 1 or Article 2 1st main part.
(5) If a complaint proves to be justified, it must be followed. Is a
Injury to be attributed to a person responsible for the private sector, so is this
to comply with the complainant's requests for information, correction, deletion,
Restriction or data transfer to the extent necessary to comply
to remedy the identified infringement. As far as the complaint as not
proves to be justified, it is to be rejected.”
3.3.2. Applied to the present case, this means the following:
First of all, it should be noted that the complainant raised a number of legal issues
has, which is not to be dealt with in the context of this procedure. in the representational
Complaints are exclusively related to questions relevant to data protection law
to refer to. Claims regarding the allegedly polluted drinking water or
that the water made available to the complainant was neither qualitative nor
quantitatively correspond to the judgment of the XXXX, the alleged disadvantage of the
The applicant because of her Jewish roots, the alleged lack of one
Water law permit for the water pipeline and the claimed
Obligation of the party involved to meet the requirements (frost-free basement room).
installing a water meter on the complainant's property
or to install a water meter on the complainant's property
not subject to the complaints procedure. Any civil claims can
if necessary, be asserted in civil courts.
The subject of the proceedings is the question of whether by those mentioned in the findings
data processing is a violation of the complainant's rights as a data subject,
namely the right to erasure, the right to object, the right to restriction
the processing and the right, not subject to any automated individual decision
to be, by the involved party.
To qualify water consumption data as personal data in accordance with Art. 4 Z 1
GDPR:
The authority concerned stated in the contested decision that the definition of
"Personal data" according to Art. 2 lit. a of Directive 95/46/EC, mutatis mutandis in Art. 4 Z
1 GDPR has been adopted. information "about" a specific person
inter alia, if data relate to the situation of a person (cf. the
Opinion of the Art. 29 Data Protection Group 4/2007 on the term "personal, - 26 -
Data”, WP 136, 01248/07/DE, p. 10). On the water pipe line, which the
measures the complainant's water consumption and consumption for rinsing purposes,
there are no further connections or consumers. As the party involved in
stated in her statement of November 12, 2021, it is possible with the
water meters to determine the consumption of the complainant's property. the
The authority concerned further explained that water consumption data, which, like
in the present case, to a specific property and thus to a specific one
living situation, to handle personal data in accordance with Art. 4 Z 1 GDPR. It
namely insofar as (also) information would be available "about" the complainant, as
based on the water consumption data, for example, the size of your household or any
and absences can be closed.
The explanations of the authority concerned are to be followed that in (smaller) private
Households a recording of the water consumption conclusions about specific people and
enables their individual habits (cf. also decisions of
Data protection commission from 14.11.2008 to Zl. K121.388/0008-DSK/2008, as well as from
22.10.2008 to Zl. K121.386/0009-DSK/2008, as well as legal aspects of digitization in
of urban water management, Karl Weber, May 9, 2019, p. 369). It is at
Water consumption data is therefore personal data within the meaning of Art. 4 Z. 1 DSGVO.
Violation of certain data subject rights:
The complainant alleged a violation of the right to erasure, the right to
Objection, restriction of processing and in law, none
to be subjected to automated data processing.
For the sake of completeness, it is noted that the right to secrecy according to § 1 DSG
is not the subject of the proceedings, although this is - apparently - by the authority concerned
erroneously - is noted in the course of the contested decision. At long last
However, the authority concerned only spoke about a possible violation of the above
rights off.
It is therefore to be examined below (only) whether a violation of the
The rights of the data subject mentioned by the complainant are given:
Regarding the right to erasure (Art. 17 GDPR):
The authority concerned explained in its legal assessment that the exercise of the
Right to erasure as a subjective right of the data subject pursuant to Art. 12 Para. 3 GDPR one, - 27 -
corresponding application to the person responsible presupposes that such an application is from the
complainant was neither expressly nor implied. misjudged
the authority that the right to erasure also includes the duty of the person responsible,
to check at regular intervals, even without a request from a data subject, whether
2
processed data are to be deleted (cf. Jahnel/Pallwein-Prettner/Marzi, data protection law
113). This results from the wording of Art. 17 Para. 1 GDPR: "[...] the
The person responsible is obliged to delete personal data immediately if
one of the following reasons applies” (cf. Data Protection Law (Spring) 2nd edition, September
2020). The statements of the authority concerned that the complainant had none
Request for deletion made to the involved party as the responsible party and in the absence of
The request is not a claim to the handling of the request for deletion by the party involved
arisen, therefore cannot be followed. Rather, it must (also) be checked whether the
involved party itself the personal data of the complainant
would have to delete.
In total, Art. 17 Para. 1 GDPR provides six reasons, after which a
Deletion is to be made, among other things, if there is no longer a need for
Achievement of purpose or unlawful processing. In order to be able to assess whether
one of these facts is fulfilled and the involved party the personal
would have to delete the complainant's data, it must first be clarified from which
Reason the involved party the personal data of the complainant
collected, stored and processed. The authority concerned led in the contested
Notice that the party involved is responsible for the processing of the
data based on legitimate interests according to Art. 6 Para. 1 lit. f GDPR. The involved
The party has given compelling reasons for the processing that are worthy of protection, namely the
measure annual water consumption and identify damage and
to detect broken pipes. In particular, there is also a need
to be able to check that the total water withdrawal of the "XXXX" 3050 l/day is not
exceeds and that the water withdrawal on the complainant's property
within the specified limits, namely for the needs of a single-family home.
The water consumption data would only be used for the aforementioned purposes and not
used elsewhere, so that no disproportionate processing or
Violation of Art. 5 Para. 1 lit. b GDPR is recognizable. The party involved is also
concede that in view of the limited presence of sufficient
amount of drinking water has a certain bandwidth when dividing the maximum amount of water
will be monitored for the different buyers in order to avoid that an individual, - 28 -
user the total stipulated amount of water (or a disproportionately large proportion)
consumed at the expense of the other customers.
These explanations of the authority concerned are to be followed: This is how the connection of the
Property of the complainant based on the judgment of the XXXX of XXXX on line XXXX
to produce a drinking water supply for the needs of a single-family home
create. In order to be able to ensure that the withdrawal of water within the framework of the with judgement
granted extent takes place, it is inevitable that a certain control or
to check the water intake. Also the other reasons mentioned for
the processing, namely to be able to measure the annual water consumption in order to
to be able to identify damage and burst pipes as quickly as possible and for distribution
of the electricity costs incurred in connection with the water supply
individual customers are to protect the legitimate interests of the person responsible,
as well as third parties (the other buyers of the water supply system " XXXX ") in any case
to be subsumed under Art. 6 Para. 1 lit. f GDPR. At this point it should be noted that it
the subject water meter is an electronic water meter, with
which only the water consumption can be recorded. For the reasons mentioned
cannot be assumed that the complainant's interests in a
Deletion of the water consumption data assigned to the named interests of
involved party prevail. With the subject water meter can, with
Except for the water consumption of their property, no further data from the
Complainant be recorded. There are also no indications that the collected
data was used for another purpose.
In this context, the principle of data minimization must also be observed
will. According to Art. 5 Para. 1 lit. c GDPR, the processed personal
Data adequate and relevant to the purpose and to what is necessary for the purposes of the processing
be limited to what is necessary ("data minimization"). According to this principle
Personal data will only be processed if the purpose of the processing is not in
can reasonably be achieved by other means. It follows that on
personal data may only be accessed if no alternative
method is available in order to achieve the intended purpose of the processing
reach. The processing of personal data is appropriate for the purpose if
whose purposes are not achieved by using anonymous or anonymized data
can become. From the requirement that the personal data processed
must also be significant for these purposes, it follows that no data is collected
which are not or no longer suitable for achieving the with the processing, - 29 -
to contribute to the objectives pursued. The principle of data minimization does not prohibit
only the collection of data that may or may not be related to the purpose of processing
suitable to contribute to the achievement of the purpose, but also the collection
personal data not necessary for the purposes specified at that time
are required (cf. Heberlein in Ehmann/Selmayr, DSGVO Art. 5 Rz 22). Since none
Possibility exists to get data on water consumption without the help of a water meter
collect and this data is necessary and suitable (necessary) to the annual
Measure water consumption in order to prevent damage and pipe bursts as quickly as possible
recognize in order to be able to check that the total water withdrawal of the " XXXX " 3050
l/day, as well as to be able to check that the water withdrawal on the
property of the complainant within the specified limits, namely for the
needs of a single-family home, there is no violation of the principle of
data minimization. As for the incident on XXXX 2017, the
Water consumption of the complainant's property not monitored
recognized, but it was first determined that the water level in the
Water supply system " XXXX " had fallen to a minimum. Only in further
As a result, the other water meters were checked. The processing of the data is limited
thus relying on the security of the water supply for a further
There are no indications of use.
It is also necessary to follow the explanations of the authority concerned that the processing of the
personal data of the complainant by the involved party
Fulfillment of their sovereign tasks within the meaning of Art. 6 Para. 1 second sentence GDPR. That it
the water supply system in question is not a “public
Water line” is also the finding of the Administrative Court of
April 20, 2021, Ro 2021/07/0001-5. The legitimate interests of
In any case, the party involved has no legitimate interests
Complainant against, which outweigh them.
As far as the complainant in the proceedings before the Federal Administrative Court
submitted that their data will be used for their "surveillance" and to the (new)
Data processing refers to stopping the water supply after reaching
the daily maximum consumption quantity, it should first be noted that this
The type of data processing is not part of the proceedings before the
Data Protection Authority was., - 30 -
Even if this processing were included in the legal considerations, it would remain so
The result is the same: With this processing, the collection and
Summation of impulses of water consumption measured but not recorded.
The impulses are only directly in the software of the control of the water supply system
"XXXX" processed. Only if the limit value is exceeded does the
on-call building yard employee an alarm on his work cell phone. This
then initiates the shutdown and notifies the complainant by e-mail. It
there is no storage or visualization of daily values. This takes place
Data processing also only for the purpose of compliance with the judgment of XXXX
to XXXX specified limits, namely a water consumption for a single family house
and to ensure that the involved party fulfills its obligation to comply with the
comply with the maximum annual water consumption set by the BH XXXX
can. The design of the data processing also corresponds to the principle of
Data minimization, as only the data necessary to achieve the purpose is processed
will. Thus, in the given case, there are legitimate interests of the party involved
of the processing, which do not have overriding interests of the complainant
oppose Incidentally, it should be noted that the involved party also offered
has to find a solution for a foreseeable exceedance in individual cases, so here
overall, no disproportionate procedure can be assumed.
Therefore, there are none of the requirements specified in Article 17 (1) GDPR for a
deletion before. In particular, it is also due to the overriding interests of those involved
17 (1) (c) GDPR does not apply to the party.
Regarding the right to object (Art. 21 GDPR):
First of all, it should be noted that according to Art. 21 Para. 1 GDPR the data subject has the right
has, for reasons that arise from their particular situation, at any time against the
to object to the processing of personal data concerning you
based on Article 6 paragraph 1 letters e or f. In this respect, the insertion would be
an objection is possible in principle.
With regard to the right to object, the authority concerned stated that a data subject had
the wording of Art. 21 Para. 1 GDPR the reasons arising from your particular situation
arise in the context of exercising the right of objection. This emerges from
a comparison with Art. 21 Para. 2 DSGVO, according to which an objection to the processing
of personal data is possible without such justification. These reasons are - 31 -
has not been explained to the party involved, which is why no claim to
treatment of the objection arose. The statements of the authority concerned
to follow: The complainant does not have a special situation in the entire procedure
be able to explain the reasons that would result in the processing of your
personal data would have to be avoided.
When weighing the interests, reference is made to the above statements on the right
refer to deletion. For the reasons set out above, it can be assumed that the
legitimate reasons of the party involved compared to those of the complainant
prevail, which is why no justified objection was filed and an infringement
the complainant does not have the right to object.
As to the complainant's allegation that this would be profiling,
The following should be noted: In the application of June 10, 2018, the complainant stated "[...]
it has been made known that you have used my water consumption data without my consent
continuously check, save and thus carry out profiling, I declare that I
file an objection".
Also in her statement (submitted in the court proceedings) of April 7th, 2020
brought the complainant a (further) prohibited profiling by the co-involved
party before.
First of all, it should be noted here that this new processing is not the subject of the
Procedure before the relevant authority was and could be.
Even if one were to concede to the complainant that she - by
Surveillance of her person or her household asserted - reasons that arise from
resulting from their particular situation, against profiling (in some cases even before the
authorities concerned, but only with regard to the measurement data of the water meters).
it appears that the said processing does not fall within the definition of profiling
correspond:
Art. 4 Z 1 GDPR reads:
"For the purposes of this Regulation, the term means:
4. "Profiling" any type of automated processing of personal data contained therein
exists that this personal data will be used to establish certain personal
Evaluate aspects relating to a natural person, in particular aspects, - 32 -
regarding work performance, economic situation, health, personal preferences,
Interests, reliability, behavior, whereabouts or relocation of these natural
analyze or predict person;"
As far as the objection relates to the (general) processing of the water meter
ascertained data relates, the following should be noted: In the case of the subject
Water meters are analog rotary piston meters. Only the
Water consumption of the connected property (in the case of the complainant also
nor the mud line) and no additional data that would require an analysis of the
Complainant or a creation of a "profile" would allow. Consequently can
under no circumstances should it be assumed that profiling is being carried out. Is it about
Profiling, as set out in more detail above, namely the collection of certain
personal data to evaluate personal aspects of a natural. Alone
through the measured water consumption is an analysis regarding personal aspects
a natural person within the meaning of this provision is not possible.
Also what the automated determination of a possible exceeding of the
daily water consumption (which was not part of the proceedings before the
authority concerned), it is not a matter of processing that was carried out
is "to control certain personal aspects relating to a natural person
evaluate", but this procedure serves exclusively to comply with the specifications
of the water law decision, which the party involved has to comply with, so that
Even in this case, the facts of a profiling are not fulfilled.
Thus, the complainant's right to object was not violated either., - 33 -
Regarding the right to restriction (Article 18 GDPR):
As explained in the literature, the right to restriction must be applied for
i.e. asserted by the data subject against the person responsible
(Jahnel, Commentary on the General Data Protection Regulation Art. 18 GDPR, as of December 1, 2020,
rdb.at). Although one could take the view that a restriction of
Responsible in the presence of one of the above conditions on their own
would have to be made, this consideration can be made in the present case
remain undecided, since the complainant has already submitted a request for restriction
of the processing to the party involved.
In accordance with Article 18 (1) (a) GDPR, a data subject has the right to request a restriction
to request processing if the accuracy of the personal data
data subject is disputed, for a period of time that allows the person responsible
allows to check the accuracy of the personal data.
The authority concerned stated in the contested decision that with regard to lit. a leg.
cit. it should be noted that the accuracy of the water consumption data in question has never been
had been disputed. However, in the course of the proceedings (in her
data protection complaint and in its statement of January 28, 2019 and October 2, 2019),
that the water pipeline in question supplies several connections and the
Water data could therefore say nothing about their consumption, and that the
measured data at the only meter in the well shaft of the involved party
are objectifiable or cannot be assigned in a consumption-neutral manner. Dem is
however, to counter that the involved party has not claimed that it is
the processed water meter data, which is read annually, is data
which are attributed to the complainant's property alone, since - like the
involved party is known - also the flushing line to this water meter
connected.
There is no right to restriction of processing according to Art. 18 Para. 1 lit. a GDPR,
if the person responsible comes to the conclusion that the personal data
contrary to the claim of the person concerned are correct (cf. EU-DSGVO:
Short commentary, Feiler Forgó on Article 18 EU-GDPR, 1st edition September 2016, margin no. 3). So
the party involved had no reason for the accuracy of the water meter
to doubt the measured data, the complainant could not explain it either
that the measured consumption data are incorrect. As stated by the - 34 -
party has been credibly informed, only the consumption of the water meter is used
Property of the complainant and that of the flushing line measured. The consumption
of the complainant's property can be determined, however, since the water consumption at
rinsing processes is entered in the logbook or in the meantime by its own
meter is recorded, and this consumption is to be deducted from the common meter reading. Of the
each current consumption of the property is only measured when there is a
Exceeding the amount of water comes, in which case the flushing line
is switched to inactive.
A right to restriction also exists according to Art. 18 Para. 2 GDPR
not if the data processing is to protect the rights of another natural
or legal person is necessary. The question of whether the rights of the person responsible
are protected, the literature on the similar formulations in Art. 15 para. 4 (s
Art. 15 margin no. 49), Art. 20 para. 4 (see Art. 20 margin no. 28), Art. 21 para. 1 (see Art. 21 margin no. 42) and Art. 23 para. 1
lit i (s Art 23 Rz 21) affirmed (Haidinger in Knyrim, DatKomm Art. 18 GDPR, as of October 1, 2018,
rdb.at). The involved party has explained the reasons for the processing of the data, im
The result was no violation of the right to restriction.
With regard to Art. 18 Para. 1 lit. b GDPR, the statements of the relevant authority in
to follow the contested decision that the complainant's deletion is obvious
has not refused, so that the requirements of this provision are not met
are.
As for the facts of Art. 18 para
lit. d GDPR, there was no doubt from the outset that the legitimate reasons
of the controller outweigh those of the data subject (see
also the considerations on the right to erasure) and this requirement was not either
given, which is why there was no violation of the complainant's right to restriction
existed and exists.
The fact that the facts of Article 18 (c) GDPR were fulfilled was confirmed by the
complainant does not claim and there are no indications for this.
Thus, the prerequisites for a restriction of data processing were and are
not given., - 35 -
The right not to be subject to an automated decision in individual cases (Art. 22
GDPR):
Art. 22 para. 1 GDPR formulates a right of the data subject, but without one
to mention the application. For those responsible, this indirectly means a ban
for automated decisions in individual cases (Schulz in Gola, DS-GVO2 Art. 22 Rz 5; Helfrich
in Sydow, European General Data Protection Regulation2 Art. 22 Rz40 (due to the
"systematic position"); Martini in Paal/Pauly, GDPR/BDSG2 Art. 22 Rz 1, 29).
It therefore seems inaccurate that - as the relevant authority explains - the exercise
of this right and the associated right in Art. 22 Para. 3 GDPR to the presentation of the
own point of view and to contest the decision as a subjective right of the person concerned
according to Art. 12 Para. 3 GDPR - a corresponding application to the person responsible
requires. Rather, the person responsible has - similar to the right to deletion - from
own provision to ensure that this provision is taken into account.
The authority concerned sees the processing of water consumption data for measurement
of the annual water consumption, as well as to identify damage/pipe bursts
and unusually high water consumption by individual consumers
to be able to counteract this, rightly no automated processing. She supports her
Considerations on the fact (relevant at the time of the decision) that the
the present water meter only measures the water consumption, but beyond that
no automated processing takes place. For this reason alone, the facts of Art 22
GDPR not fulfilled.
Incidentally, the not yet relevant in the proceedings before the relevant authority and
facts that only occurred afterwards and are therefore not the subject of the proceedings
regarding the period from the installation of the pulse generator and the solenoid valve on
October 22nd, 2019:
In Art. 22 Para. 1 GDPR, a fundamental prohibition is based solely on one
automated processing based decision. Recital 71 of
GDPR states that the data subject should have the right, no one
subject to a decision to assess personal aspects affecting them
are based solely on automated processing and the legal
have an effect on the person concerned or they are similarly significant
impaired. Art. 22 GDPR is therefore only aimed at those decisions that are made without
any human intervention and shall, based on this provision, - 36 -
Dangers posed by unchecked automated processing operations for the
protection of personality expire, be limited (see Martini in Paal/Pauly, DS-
GVO/BDSG², Art 22 DS-GVO margin nos. 2 and 20).
The complainant was informed by the involved party in a letter dated September 13, 2019
informed about what happens in the future when the maximum daily water consumption is reached
action will be taken. In this respect, the decision was already made by the party involved
taken at this time and is not every time the water consumption amount
is exceeded, by a new "automated decision in individual cases"
to go out This is also because, in the event of an incident, none from the party involved
Decisions are made, but the construction workers according to the
original decision of the involved party and corresponding instructions
Action. For this reason alone, data processing can be used to determine whether
The complainant's property was taken from the daily maximum amount of water,
not to speak of "automated decisions in individual cases". Furthermore
This procedure can also be waived if the complainant
Explains in advance that increased water consumption is necessary in individual cases. the
Procedure does not constitute a decision that the complainant made in a similar manner,
how a decision that produces legal effects is significantly affected.
It should also be noted in this context that the processing in question
(automatic collection of the data, whereupon when a certain
water quantity, an alarm is automatically set off and then the water supply
is interrupted) the controller has been programmed since March 2020 in such a way that no
the solenoid valve closes automatically when the limit value is exceeded. the
Information about reaching the maximum amount of water becomes automatic in the first step
transmitted to the building yard employee on duty, who then takes the
switch off manually. By involving a building yard employee after triggering
the alarm, which can switch off and check the water supply,
whether the triggering of the alarm is due to the high water consumption or
was incorrect, it is in any case not a question of a decision made without any
human intervention takes place. Therefore, without the intervention of a natural person,
In the present case, the water supply cannot be shut off.
The fact that the processing in question is not profiling has been confirmed
already set out above (in the considerations on the right to object). It is therefore also
no violation of Art. 22 GDPR., - 37 -
3.4. Pursuant to § 24 para. 1 VwGVG, the administrative court shall, upon application or if it is required to do so for
deems it necessary to hold a public oral hearing ex officio.
According to § 24 para. 4 VwGVG - unless otherwise stipulated by federal or state law
is determined - the administrative court regardless of a party application from a
Refrain from hearing if the files show that the oral discussion is a
no further clarification of the legal matter can be expected and no hearing
neither Art. 6 Para. 1 ECHR nor Art. 47 GRC conflict.
In the present case, the omission of an oral hearing could result
be supported that the facts were clarified from the file situation. The attraction
further evidence was not necessary to clarify the facts.
In the present case, the Federal Administrative Court only has jurisdiction over a legal question
recognize (cf. ECtHR 20.6.2013, Appl. No. 24510/06, Abdulgadirov/AZE, margin no. 34 ff). Also after
the jurisprudence of the Constitutional Court may hold an oral hearing
omitted if the facts are undisputed and the legal issue is not addressed by anyone
particular complexity (VfSlg. 17.597/2005; VfSlg. 17.855/2006; most recently VfGH
June 18, 2012, B 155/12).
It was therefore not necessary to conduct an oral hearing.
3.5. Re B) Inadmissibility of the revision:
According to § 25a Abs. 1 VwGG, the administrative court in the ruling of its knowledge or
Pronounce a resolution as to whether the revision is permissible in accordance with Art. 133 Para. 4 B-VG. Of the
Statement must be briefly justified.
The present decision does not depend on the resolution of a legal question
is of fundamental importance. Neither is there a lack of case law
Administrative Court, the decision in question deviates from the
Jurisdiction of the Administrative Court; further is the present
Jurisdiction of the Administrative Court should also not be judged as inconsistent. It
there are also no other indications of a fundamental importance of the to be solved
legal questions. The Federal Administrative Court can appeal to all significant
Legal questions based on existing case law or an already clear legal situation.
Based on this, a legal question within the meaning of Art. 133 Para. 4 B-VG of
of fundamental importance cannot be affirmed in this respect either (cf. e.g. VwGH 25.09.2015, - 38 -
Ra 2015/16/0085, with further references). It was therefore to be stated that the revision pursuant to Art. 133
Para. 4 B-VG is not permitted in each case.
3.5. It was therefore to be decided accordingly.
