BVwG - W256 2225038-1/8E
From GDPRhub
| BVwG - W256 2225038-1/8E | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | § 7(3) DSG |
| Decided: | |
| Published: | 03.08.2022 |
| Parties: | |
| National Case Number/Name: | W256 2225038-1/8E |
| European Case Law Identifier: | |
| Appeal from: | DSB DSB-D202-227/0001 -DSB/2019 |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | RIS (in German) |
| Initial Contributor: | MW |
The Austrian Federal Administrative Court upheld a decision by the Austrian DPA denying a permit for the processing of data for a publicly available for geneaological database because such a project was not included within the scope § 7 (3) DSG.
English Summary
Facts
The controller was an association that aimed to collect knowledge in the fields of genealogy, family research, regional studies, and local history. One of the controller's main focuses was advising members and other interested persons in the field of private family research. For this purpose, the controller offered databases on the internet intended to facilitate research into one's own origin. In principle, only data of deceased persons were processed.
The controller intended to make a freely accessible database for private family trees on the internet. In this database, the data of living persons would also be processed. Specifically, the controller intended to allow unaffiliated persons to make their own family trees available on the controller's website, which might include (a) first and last names, (b) biographical data (dates of birth, marriage, death, and burial as well as place of marriage and death and occupation), and (c) family relationships to adjacent generations.
The controller applied to the Austrian DPA (DSB) for a permit to process the data for archival purposes in the public interest per § 7(3) DSG. Its application was denied by the DPA, which explained that § 7 DSG allows a specifc person reponsible for a research project to evaluate data sets that are delimited according to certain criteria. The person responsible must know which data is to be processed or at least which data they would like to process through investigation. In this case, it would be possible for third parties to make their own family tree available to the research community regardless of whether they are members of the controller's association.
Therefore, it could not be assumed that databases will be evaluated according to certain criteria, but rather that data would be made available to the public, whereby the controller would have no influence on which data would be made available. § 7 DSG was therefore not relevant, and the permit was not granted.
The controller appealed the decision.
Holding
The Court upheld the decision of the DPA to deny the controller's application for a permit. It held that the scope of Section 7 (3) DSG is limited to obtaining approval for the use of personal data from third-party databases solely for the purpose of carrying out an investigation by the applicant as the person responsible. In other words § 7(3) contemplates the granting of a permit for research purposes, not archival purposes. Noting that neither the GDPR nor the DSG defines archival purposes, the Court elaborated that, according to common usage, an archival purpose differs from a research purpose in that it does not aim at direct data use but at making data available for future use. In this case, the controller would be collecting data from users, combining it with its own databases, and then making the resulting data available to the public for their own investigations. Thus, the controller sought a permit for an archival purpose, not a research purpose.
The Court arrived at this conclusion by examining the language in § 7(3) and §7(4) DSG, particularly references in both provisions to a "person responsible" for an investigation. § 7(4) requires that the application for a permit to process data include a declaration signed by a person authorized to dispose of the databases from which personal data are to be gathered stating that they are making the database available to the person responsbile for the investigation. It held that this language is only compatible with a research purpose.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
decision date
05/17/2022
standard
B-VG Art133 Para.4
DSG §7
GDPR Art89
saying
W256 2225038-1/8E
IN THE NAME OF THE REPUBLIC!
The Federal Administrative Court has the judge Mag. Caroline Kimm as chairwoman, the expert lay judges Dr. Claudia Rosenmayr-Klemenz and Mag. Adriana Mandl as assessors on the complaint of XXXX, represented by Lang Weber Rechtsanwälte OG in 1070 Vienna, against clause 1 of the decision of the data protection authority of August 23, 2019, GZ: DSB-D202-227/0001 -DSB/2019 rightly recognised:
A) The complaint is dismissed as unfounded.
B) The revision is not permitted according to Art. 133 Para. 4 B-VG.
text
Reasons for decision:
I. Procedure and facts:
In her application to the relevant authority dated March 13, 2019, the complainant applied for authorization to process personal data in accordance with Section 7 (3) DSG. The complainant was an association founded in 2008, which, according to its statutes, aims to collect scientific foundations and knowledge in the fields of genealogy, family research, regional studies, local history and history. One of the complainant's main areas of focus was advising members and other interested persons, particularly in the field of private family research. For this purpose, the complainant also offers databases on the Internet, which are intended to facilitate research into one's own origin. In principle, only data of deceased persons would be processed.
The complainant now plans to make a freely accessible database for private family trees on the Internet (“family tree database”) available to its members and employees as well as to all persons interested in family research and history. With this database there is theoretically the possibility that data of living persons would also be processed.
Specifically, the complainant intended to make it possible for persons interested in history and family research ("the researchers"), regardless of their association membership, to make their own family tree available on the complainant's website. For the other researchers, these results from private research colleagues could represent valuable tips and information for their own research. From the point of view of the researcher who made the family tree available, there would also be several advantages: on the one hand, there was the possibility that other researchers would contact him if they found a match in surnames or persons. However, making the family tree available to the association also has the side effect that research is secured and, for example, in the event of technical problems with the sender, the data is still available to the sender.
The following data would be transferred to the family tree database and displayed on the Internet:
- First and last name of a person (usually ancestors or relatives of the family tree creator),
- Their biographical data (dates of birth, marriage, death, wedding, burial as well as place of marriage, death and occupation) and
- The family relationships to the adjacent generations (i.e. children and parents).
Of course, all of this can only be seen if the sender of the family tree has also researched all this information and actually entered it into his program. For this purpose, the complainant had developed a query option that enabled interested persons to search in the family trees provided. The query is presented in such a way that specific names or parts of names can be searched for, whereby at least two letters of the name have to be entered in order to obtain a search result. Therefore, not all names in the database are displayed in the list of search results, but only the hits after the corresponding input. If a corresponding hit is selected, the corresponding person would be displayed. The available information as well as the closest family connections would then be displayed for this person, i.e. information on the spouse, children and parents. The complainant's other databases contained only deceased persons. This is different for the planned family tree database, since private research into the family tree usually starts with the researcher himself as the subject and leads back into the past via his parents and grandparents. Without further research, it is rarely possible for the association to determine whether people who were born in the 20th century are still alive. In addition, many researchers would not be satisfied with researching the direct ancestral line into the past, but would also include secondary lines in their private family tree programs. The databases of private researchers would therefore also contain information about their siblings, nephews, nieces and their own descendants. According to the appellant's assessment, the database therefore also contained data from living persons. In principle, it is intended that such data cannot be called up by the users of the database, since people who were born in the last 100 years are automatically filtered and not displayed. However, it cannot be 100 percent ruled out that living people will also be displayed despite these technical precautions. The hiding within the 100-year limit only works if the corresponding biographical data of a person is also entered in the file (i.e. in the family tree created by the researcher). This is not always the case. Fading out all persons for whom no date of birth is known would reduce the purpose of the database ad absurdum, since the program cannot technically distinguish whether such a person was born in the 21st or the 16th century.
According to § 7 para. 3 DSG, the application is therefore made that the authority concerned should approve the project described - the creation, operation and public availability of a database containing researched family trees of natural persons, insofar as this database contains personal data of natural persons persons (e.g. name, birth, marriage and death dates and places and family relationships to other persons). Obtaining the consent of the persons concerned is impossible due to lack of availability or otherwise involves a disproportionate amount of effort. Obtaining the consent of all living persons who may appear in the family trees is not possible for the association because the identity and contact information of the person concerned do not necessarily have to emerge from the data. It is simply not possible to research which person mentioned in the database is still alive, to reliably prove their identity and to determine their contact options. In many cases, the sender of the information is also not aware of this. There is a growing interest in researching one's own origins. In the complainant's view, a public interest resulted from the general interest of other sections of the population in the origin and history of the family. With regard to professional suitability, it is stated that the complainant is an association that has existed for 10 years and has gained a good reputation as a result of various work. Special categories of personal data within the meaning of Art. 9 GDPR are not affected. If the content of this request is not met, the request will also be made that the data protection authority may provide the complainant with information on the legal basis on which they can base their project. Among other things, an overview of the complainant's publications that have appeared to date and a draft of a declaration were submitted as proof of professional suitability, according to which the sender agrees, in accordance with Section 7 (4) DSG, that the data sent in will be included in the long-term family tree database and presented to a broad public on the Internet.
With the contested decision, the complainant's application for approval in accordance with Section 7 (3) DSG was rejected in clause 1 and in clause 2 the information requested by the complainant ("request") was not granted. Regarding point 1, it was explained that § 7 DSG standardizes data processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. In essence, § 7 DSG serves to enable a person responsible to evaluate data sets that are delimited according to certain criteria and to achieve (non-personal) results. Conceptually, this presupposes that the person responsible must be responsible for which databases are analyzed and which data are used. The person responsible must know which data he is processing or at least which he would like to process through investigation. In the present case, however, it should be possible for third parties, namely interested persons, to make their own family tree available to the research community on the complainant's website, regardless of whether they are members of the association. It is therefore not to be assumed that databases will be evaluated according to certain criteria, but rather that data will be made available to the public, whereby the complainant has no influence whatsoever on which data is made available. § 7 DSG is therefore not relevant, which is why the decision had to be taken in accordance with the verdict.
The present appeal is directed against this decision with the request to hold an oral hearing and to amend the contested decision so that the plan described by the complainant in the application of March 13, 2019 is approved in accordance with Section 7 (3) DSG. The legal explanations of the authority concerned would be limited to the fact that § 7 DSG by its very nature serves to enable a person responsible to evaluate data sets that are delimited according to certain criteria and to achieve (non-personal) results. This presupposes that the person responsible must know which data he is processing or at least which he would like to process through investigation. These conditions would be met in the present case. As stated in the application, certain information would be taken from the sender's family tree. The databases are therefore delimited according to certain criteria. Other information would not be processed. The complainant therefore knew what "type of data" it was processing. Should the relevant authority demand that the complainant be aware of the precise content of the data, this would deprive Section 7 (3) DSG of any practical scope. According to the express provision in recital 160, the GDPR is also applicable to historical research in the field of genealogy. The term "historical research" therefore also includes research in the field of genealogy. Recital 160 further specifies that the Regulation does not apply to deceased persons. The term "historical research purposes" must therefore also refer to persons who are still alive, since historical research purposes relating to the deceased would not fall within the scope of the GDPR. The scope of § 7 DSG is thus broader than the previous provision of § 46 DSG 2000, which did not refer to historical research purposes. The extension of § 7 DSG to include "archive purposes in the public interest" differs from pure research purposes with reference to literature described in more detail in that it does not aim at direct data use, but at making it available for future research. The purpose of the present project is, among other things, to secure private research results, on the one hand for the sender himself, on the other hand as documentation (archiving) for later researchers and generations of researchers. Private research results would be lost very easily. The project in question is also intended for "archive purposes" in that, on the one hand, the sender himself can request his research results. On the other hand, these results are also secured for future generations. Special archiving regulations are not applicable to this case of securing private research results. This is what § 7 DSG is aimed at, in order to enable such projects that are in the public interest despite the data protection framework with the approval of the data protection authority. From all of this it follows that the family tree database is a project that falls within the scope of Section 7 (3) DSG and must be approved.
The authority concerned submitted the complaint together with the administrative act to the Federal Administrative Court.
In a letter dated March 2, 2022, the Federal Administrative Court informed the complainant that, given the wording in the complaint, it was assumed that only clause 1 of the contested decision would be contested. Furthermore, the complainant was made aware of the data protection provisions of the Research Organization Act (FOG) that apply specifically to the science and research sector and of the fact that, according to the clear wording, § 7 Para. 3 DSG can only be claimed by the person responsible for the investigation.
In this regard, the complainant first made it clear in her statement of March 15, 2022 that her complaint relates exclusively to clause 1 of the contested decision. An approval according to § 7 paragraph 3 DSG is able to put the project of the "family tree database" on a legally secure basis. Such an approval would also be in the interest of science in Austria, so that research projects of this type can also be carried out by honorary scientific associations. Otherwise, this topic would ultimately be left to commercial providers, some of whom would not take data protection aspects very seriously or would be based outside the EU at all and therefore not within reach. Section 7 (3) DSG stipulates that the applicant under Section 7 (3) DSG is solely responsible for the investigation. In the present project of the pedigree database, however, it could be "theoretically" argued that the individual user of the database is "responsible for the investigation", namely the investigation for the purpose of which he carries out a query in the pedigree database and evaluates and evaluates the query results. Ultimately, however, the complainant is also to be regarded as the person responsible for the investigation because she is conducting numerous research projects and, of course, also uses data from her own databases. For more detailed reasons, the applicability of the FOG cannot be assumed with certainty.
II. Evidence assessment:
The procedure described above and the undisputed facts result from the submitted administrative act and the statement made by the complainant in the procedure.
III. The Federal Administrative Court considered:
Legal assessment:
In the present case, the complainant asked the authority concerned for permission to create and operate a family tree database, which can be accessed on the complainant's website and should give people interested in history and family research the opportunity to do (their) family research. In doing so, she relied on Section 7 (3) DSG.
§ 7 Data Protection Act in the version of the Data Protection Amendment Act 2018, Federal Law Gazette I No. 165/1999, last amended by Federal Law Gazette I No. 120/2017 (DSG) reads as follows:
"§ 7. (1) For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes that do not aim for personal results, the person responsible may process all personal data that
1.
are publicly accessible,
2.
he has legitimately ascertained for other investigations or other purposes, or
3.
are personal data that has been pseudonymised for him and the person responsible cannot determine the identity of the person concerned by legally permissible means.
(2) In the case of data processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes that do not fall under paragraph 1, personal data may only
1.
according to special legal regulations,
2.
with the consent of the data subject or
3.
with the approval of the data protection authority in accordance with paragraph 3
are processed.
(3) A permit from the data protection authority for the processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes must be granted at the request of the person responsible for the investigation if
1.
Obtaining the consent of the data subject is impossible due to a lack of availability or otherwise involves a disproportionate effort,
2.
there is a public interest in the requested processing and
3.
the professional suitability of the person responsible is made credible.
If special categories of personal data (Art. 9 GDPR) are to be determined, there must be an important public interest in the investigation; Furthermore, it must be ensured that the person responsible for the investigation processes the personal data only from persons who are subject to a statutory duty of confidentiality with regard to the subject of the investigation or whose reliability in this regard is otherwise credible. The data protection authority must link the approval to the fulfillment of conditions and requirements, insofar as this is necessary to protect the interests of the data subject that are worthy of protection.
(4) An application under paragraph 3 must in any case be accompanied by a declaration signed by the person authorized to dispose of the database from which the personal data is to be determined, stating that he is making the database available to the person responsible for the investigation. Instead of this declaration, an execution title replacing this declaration (§ 367 Para. 1 of the Enforcement Ordinance - EO, RGBl. No. 79/1896) can be submitted.
(5) Even in those cases in which the processing of personal data for the purposes of scientific research or statistics in personal form is permissible, the personal reference must be encrypted immediately if, in individual phases of scientific or statistical work with personal data pursuant to para. 1 Z 3 sufficient can be found. Unless expressly provided otherwise by law, the personal reference to the data must be completely removed as soon as it is no longer necessary for the scientific or statistical work.
(6) Legal restrictions on the admissibility of the use of personal data for other reasons, in particular copyright, remain unaffected.
With § 7 DSG in the version of the Data Protection Adaptation Act 2018, § 46 of the Data Protection Act 2000 (DSG 2000), Federal Law Gazette I No. 165/1999, which still applies to the area of scientific research and statistics, was largely adopted (see ErläutRV 1664 , BlgNR 25. GP 1 and ErläutRV 68, BlgNR 26. GP 7).
While the scope of § 46 DSG 2000 was limited to data processing for statistical purposes and scientific (and thus also historical) research, § 7 DSG was expanded in accordance with Art 89 GDPR to include "archiving purposes in the public interest" (cf. Bresich/Dopplinger/ Dörnhöfer/Kunnert/Riedl, DSG, § 7, para. 5).
Art 89 GDPR reads:
“Guarantees and exceptions in relation to processing for archival purposes in the public interest, for scientific or historical research purposes and for statistical purposes
(1) Processing for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes is subject to appropriate safeguards for the rights and freedoms of the data subject under this Regulation. These guarantees ensure that technical and organizational measures are in place to ensure, in particular, that the principle of data minimization is respected. These measures may include pseudonymisation where it is possible to achieve these purposes in this way. In all cases in which these purposes can be achieved through further processing where the identification of data subjects is not or no longer possible, these purposes will be achieved in this way.
(2) If personal data are processed for scientific or historical research purposes or for statistical purposes, subject to the conditions and safeguards referred to in paragraph 1 of this Article, Union or Member State law may provide for exceptions to the rights under Articles 15, 16, 18 and 21 may be provided when such rights are likely to render impossible or seriously impair the attainment of the specific purposes and such exceptions are necessary for the attainment of those purposes.
(3) If personal data are processed for archiving purposes in the public interest, exceptions to the rights under Articles 15, 16, 18, 19, 20 and 21 when such rights are likely to render impossible or seriously impair the attainment of the specific purposes and such exceptions are necessary for the attainment of those purposes.
(4) If the processing referred to in paragraphs 2 and 3 also serves another purpose, the exceptions shall only apply to processing for the purposes referred to in these paragraphs.”
The term archive purposes is not defined in either the DSG or the GDPR. According to general usage, archiving means the orderly storage of information. In § 2 Z 5, the Austrian Federal Archives Act defines archiving as the recording, taking over, safekeeping, preservation, repair, ordering, development, exploitation, utilization of federal archive material (Jahnel, commentary on the General Data Protection Regulation (GDPR) Art 89, margin no. 7) .
The archive purpose differs from the research purpose in that it does not aim at direct data use, but at making it available for future research (cf. Bresich/Dopplinger/Dörnhöfer/Kunnert/Riedl, DSG, § 7, marginal note 3).
Contrary to the heading or the reference to archiving purposes, Section 7 (3) DSG in particular does not in essence aim at archiving (cf. Bresich/Dopplinger/Dörnhöfer/Kunnert/Riedl, DSG, Section 7, marginal note 6).
Both Section 7, paragraph 3 (“at the request of the person responsible for the investigation”) and paragraph 4 (“An application under paragraph 3 is in any case a declaration signed by the person authorized to dispose of the databases from which the personal data are to be determined to conclude that he makes the database available to the person responsible for the investigation") use the term "investigation".
These formulations make it clear that the scope of Section 7 (3) DSG is limited to obtaining approval for the use of personal data from third-party databases, solely for the purpose of carrying out an investigation by the applicant as the person responsible.
It is not overlooked that the term investigation is to be interpreted broadly and that future research projects can also be included in addition to specific research projects (cf. Gabauer, The processing of personal data for scientific research purposes, 99ff). However, that does not change the fact that the requested approval (only) for investigations is to be granted by the applicant as the person responsible.
Accordingly, the collection and processing of data in order to make them accessible to the public for research purposes cannot be included in the scope of Section 7 (3) DSG.
Rather, the assessment of the admissibility of such data processing would have to be based on other national special data protection and data processing provisions or on provisions of the GDPR (cf. Bresich/Dopplinger/Dörnhöfer/Kunnert/Riedl, DSG, § 7, para. 6; Löffler in Knyrim, DatKomm Art 89 GDPR, Rn 98ff; Gabauer, loc.cit., 108ff and in particular the Research Organization Act, BGBl. , which regulates the processing of personal data for the purposes of Art. 89 GDPR in detail and the explanations issued for the FOG, ErläuRV 68, BlgNR 26. GP 7, 7).
In this case, the complainant has applied for approval to create and operate a family tree database in accordance with Section 7 (3) DSG in order to give people interested in history and family research the opportunity to make family tree data (also) of living people available to other interested parties. However, such data processing for archiving purposes cannot – against the background of the above statements – be the subject of an application and thus an approval according to § 7 Para. 3 DSG.
In any case, the fact that the complainant will also use this data processed in her family tree database in a further step - as she submitted in her statement of March 15, 2022 - for her own research projects in the future does not change the fact that the original data collection and data use requested here for archival purposes.
It should only be noted for the sake of order that the admissibility of using data from one’s own databases, but for other purposes (“purpose-changing data processing”) is again specified separately, e.g. according to Section 7 Para. 1 Z 2 DSG or according to Article 5 Para. 1 lit. b in connection with Art 6 Para. 4 GDPR would have to be assessed. Since our own databases would be affected, Section 7 (3) DSG would not come into question here either.
According to § 24 para. 4 VwGVG, the administrative court can, unless otherwise provided by federal or state law, refrain from a hearing regardless of a party's application if the files indicate that the oral discussion does not give reason to expect any further clarification of the legal matter, and Neither Art. 6 Para. 1 ECHR nor Art. 47 CFR preclude the omission of the hearing.
In the present case, only one legal question had to be clarified, namely the applicability of Section 7 (3) DSG. The fact that Section 7 (3) DSG can only be claimed by the person responsible for an investigation results from the clear wording of the provision and is not even doubted by the complainant. Since only (non-complex) legal questions had to be clarified in the present case, it was possible to refrain from holding an oral hearing despite a party application pursuant to Section 24 (4) VwGVG.
Re B) Inadmissibility of the revision:
Pursuant to § 25a Para. 1 VwGG, the administrative court has to pronounce in its ruling or resolution whether the revision is admissible in accordance with Art. 133 Para. 4 B-VG. The statement must be briefly justified.
According to Art. 133 Para. 4 B-VG, the revision is not permissible because the decision does not depend on the solution of a legal question that is of fundamental importance. Due to the clear legal situation, this is not a legal question of fundamental importance. There are also no other indications of a fundamental importance of the legal question to be solved.
There are no other indications of a fundamental importance of the legal question to be solved.
It was therefore to be decided by the Senate in accordance with the verdict.
