VfGH - G 287/2022-16, G 288/2022-14
From GDPRhub
| VfGH - G 287/2022-16, G 288/2022-14 | |
|---|---|
 | |
| Court: | VfGH (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 85 GDPR § 1(1) DSG § 1(2) DSG § 9(1) DSG |
| Decided: | 14.12.2022 |
| Published: | 09.01.2023 |
| Parties: | |
| National Case Number/Name: | G 287/2022-16, G 288/2022-14 |
| European Case Law Identifier: | |
| Appeal from: | BVwG G 287/2022 and G 288/2022 |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Verfassungsgerichtshof Österreich (in German) |
| Initial Contributor: | n/a |
The Austrian Constitutional Court held that § 9(1) DSG, which provides a blanket data protection exemption for a broad category of media actors, is not required by Article 85 GDOR and unconstitutional pursuant § 1 DSG, the fundamental Austrian right to privacy and secrecy.
English Summary
Facts
The decision of the Austrian Constitutional Court on the constitutionality of § 9(1) of the Austrian Data Protection Law (DSG), a provision exempting all journalists and media enterprises from the DSG and GDPR, was prompted by an application of the Austrian Federal Administrative Court. The Federal Administrative Court question the constitutionality of § 9(1) DSG due to two complaints again decisions of the Austrian DPAs which were brought in before it. In contrast to the majority of other EU member states, the right to data protection and secrecy, pursuant to § 1 DSG, is a constitutional law in Austria.
The first complaint of the case G 287/2022 concerned an alleged data protection breach of a media company, which had published a report and images of a house search, including unredacted pictures of a data subject's business card. The DSA rejected the complaint, arguing that considering the media privilege pursuant to § 9(1) DSG, it was not competent to deal with the complaint.
In complaint number two, concerning case G 288/2022, data subjects argued that a publishing company and a broadcasting company had unlawfully disclosed a "data leak" at an e-mail box attributable to the data subjects. Similar to the complaint mentioned above, the DSA deemed itself not competent pursuant to § 9(1) DSG.
The data subjects in both cases complained to the Federal Administrative Court which sent an application to the Constitutional Court for the assessment of the constitutionality of § 9(1) DSG.
Holding
The Austrian Constitutional Court sided with the data subjects and held that the "blanket" exemption which § 9(1) Data Protection Act gives to media owners and journalists is unconstitutional and not in line with the requirements of Article 85 GDPR.
§ 9(1) DSG provides - in implementation of the obligation under EU law pursuant to Art. 85 (1) of the Data Protection Regulation - that the provisions of the Data Protection Act do not apply to the processing of personal data by media owners, publishers, media staff and employees of a media company or media service within the meaning of the Media Act for journalistic purposes of the media company or media service.
In its assessment. the Constitutional Court first noted that the legislator is subject to a double binding, namely a binding to Union law and a binding to the framework established by constitutional law.
The relevant provision of Union law, Article 85 GDPR, only states that Member State should provide for "derogations or exemptions" to the GDPR for the processing of personal data for journalistic purposes "to the extent necessary to reconcile the right to the protection of personal data with the freedom of expression and information."
Therefore, the Court held that Union law does not require the Austrian legislator to enact a provision according to which any data processing of media owners, publishers, media staff and employees of a media enterprise or media service within the meaning of the Media Act is completely exempted from the DSG and the GDPR. On the contrary, Article 85 GDPR obliges the Member States to define the relationship between data protection and freedom of expression in more detail to ensure an appropriate balance between the conflicting fundamental rights positions. As the regulatory content of § 9(1) DSG is not mandatory under EU law, the Constitutional Court held that the provision is subject its review with regard to its conformity with domestic constitutional law.
The Austrian fundamental right to data protection, pursuant to § 1(1) DSG, guarantees everyone the right to confidentiality of personal data concerning him or her, insofar as he or she has an interest worthy of protection, in particular with regard to respect for private life. § 1(2) DSG contains a material legal limitation in this regard. Apart from the use of personal data in the vital interest of the person concerned or with his or her consent, restrictions on the right to confidentiality are only permissible to protect the overriding legitimate interests of another person.
On the basis of the fundamental right to data protection pursuant to § 1(1) DSG in conjunction with § 1(2) DSG, the legislator is thus always required to weigh the interests of the data subject in the protection of his or her personal data against the opposing (legitimate) interests of another party.
However, the fundamental right to data protection pursuant to §1(1) DSG does not allow the legislator to categorically exclude the applicability of all data protection regulations of a substantive and procedural nature under the DSG in their entirety within the scope of application of the media privilege.
The Court therefore held that § 9(1) DPA to be unconstitutional. In addition, although the Court did not elaborate its legal reasoning (or only to a limited extent), it also held that § 9(1) DPA would have been unconstitutional under other Austrian provisions under constitutional law (namely, the principle of equality pursuant to Art. 7 B-VG and Art. 2 StGG, the right to a trial before the lawful judge pursuant to Art. 83 para. 2 B-VG, the right to protection of personal data pursuant to Art. 8 CFR, and the right to privacy pursuant to Art. 8 ECHR).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
CONSTITUTIONAL COURT
G 287/2022-16, G 288/2022-14
December 14, 2022
IN THE NAME OF THE REPUBLIC!
The Constitutional Court is chaired by the Vice President
dr Verena MADNER
in the presence of the members
dr Markus ACHATZ,
dr Sieglinde GAHLEITNER,
dr Andreas HAUER,
dr Christoph HERBST,
dr Michael HOLOUBEK,
dr Helmut HÖRTENHUBER,
dr Claudia KAHR,
dr Georg LIENBACHER,
dr Michael MAYRHOFER and
dr Ingrid SIES-SCHERZ
and the substitute member
MMag. dr Barbara LEITL-STAUDINGER
as voting leader, in the presence of the constitutional employee
dr Philip SELIM, BA
as secretary,
Constitutional Court
Freyung 8, A-1010 Vienna
www.verfassungsgerichtshof.atG 287/2022-16,
G 288/2022-14
14.12.2022
on the applications of the FEDERAL ADMINISTRATION COURT for repeal of § 9
Para. 1 DSG because of unconstitutionality in its current non-public position
140 B-VG rightly recognised:
I. Section 9 (1) of the Federal Act on the Protection of Natural Persons in the
Processing of personal data (Data Protection Act - DSG), Federal Law Gazette I
No. 165/1999, as amended by Federal Law Gazette INo. 24/2018 is repealed as unconstitutional.
II. The repeal will come into effect at the end of June 30, 2024.
III. Previous statutory provisions will not come into force again.
IV. The Federal Chancellor is responsible for the immediate publication of these statements
required in Federal Law Gazette I.
Reasons for decision
I. Application
With the present applications based on Art. 140 Para. 1 Z 1 lit
belongs to the requesting court, the Constitutional Court wanted
"Art. 2 § 9 para. 1 of the Federal Act on the Protection of Natural Persons in the
Processing of personal data (Data Protection Act - DSG), Federal Law Gazette I
No. 165/1999, in the version of the amendment Federal Law Gazette I No. 24/2018 (Data Protection Dere-
Regulation Act 2018) as unconstitutional".
II. Legal situation
1. The relevant provisions of the Federal Law on the Protection of Natural 2
persons in the processing of personal data (Privacy Act –
DSG), BGBl. I165/1999, as amended by Federal Law Gazette I24/2018 (the contested provision
is highlighted):
2 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
"Article 1
(constitutional provision)
fundamental right to data protection
§ 1. (1) Everybody has, in particular also with regard to the respect of his
family and family life, right to confidentiality of personal
Son-related data, insofar as there is a legitimate interest in it. That
Existence of such an interest is excluded if data as a result of their
general availability or because of their lack of traceability to the
Those affected are not accessible to a non-disclosure claim.
(2) Insofar as the use of personal data is not essential for life
gene interest of the person concerned or with his consent, are restrictions
declarations of the right to secrecy only to safeguard overriding
legitimate interests of another, namely in the event of intervention by one
state authority only on the basis of laws resulting from the in Art. 8 para. 2 of
European Convention for the Protection of Human Rights and Fundamental Freedoms
(EMRK), Federal Law Gazette No. 210/1958, are necessary. such
allow the use of data which, by their nature, are particularly worthy of protection
dig, only provide and must provide for the protection of important public interests
at the same time appropriate guarantees for the protection of confidentiality interests
of those affected. Even in the case of permissible restrictions, the
encroached on the basic right only in the mildest way that led to the goal
be taken.
(3) Everyone has, insofar as personal data concerning him/her are automatically
tion-assisted processing or for processing in manual, ie. without
tomation support files are determined, in accordance with statutory
legal provisions
1. The right to information about who is processing which data about him and from where
where the data comes from and what it is used for, in particular to whom
they are transmitted;
2. the right to have incorrect data corrected and the right to have un-
lawfully processed data.
(4) Restrictions of the rights according to paragraph 3 are only under those mentioned in paragraph 2
conditions allowed.
[...]
Freedom of expression and freedom of information
§ 9. (1) On the processing of personal data by media content
Editors, media workers and employees of a media company
mens or media service within the meaning of the Media Act - MedienG, BGBl.
3 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
No. 314/1981, for journalistic purposes of the media company or medi-
endienstes find the provisions of this federal law as well as of the
GDPR chapters II (principles), III (rights of the data subject), IV (responsibility
literal and processor), V (transfer of personal data
to third countries or to international organizations), VI (Independent Supervisory
authorities), VII (cooperation and coherence) and IX (rules for special
their processing situations) does not apply. The data protection authority has
when exercising their powers towards the persons named in the first sentence
to observe the protection of editorial secrecy (§ 31 MedienG).
(2) To the extent necessary to exercise the right to protection of personal data
data with freedom of expression and freedom of information in
sound, see Chapter II (Principles) of the GDPR, with exception
of Art.5, Chapter III (Rights of the person concerned), Chapter IV (Responsible
and processors), with the exception of Art. 28, 29 and 32, Chapter V (Super-
transmission of personal data to third countries or to international organi-
sations), Chapter VI (Independent Regulatory Authorities), Chapter VII (Collaboration
work and consistency) and Chapter IX (rules on special processing
situations) to processing leading to scientific, artistic or
literary purposes, no application. From the provisions of this
In such cases, Section 6 (data secrecy) of the federal law applies.
[...]
2nd section
Data Protection Authority
furnishings
§ 18. (1) The Data Protection Authority shall act as national supervisory authority pursuant to
Art. 51 GDPR set up.
(2) The data protection authority is headed by a manager. In his absence directs his
representative of the data protection authority. On it you will find the regulations regarding
of the head of the data protection authority.
independence
§ 19. (1) The data protection authority is a service authority and personnel department.
(2) For the duration of his office, the head may not exercise any activity that
1. Doubts about the independent exercise of his office or his impartiality
could cause heat
2. hinders him in the fulfillment of his official duties or
3. essential official interests endangered.
4 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
He is obliged to carry out activities that he performs in addition to his work as head of data
protection authority, immediately to the Federal Minister for the Constitution, Reform
men, deregulation and the judiciary.
(3) The Federal Minister for the Constitution, Reforms, Deregulation and Justice can
contact the head of the data protection authority about the subjects of the
teach. The head of the data protection authority only allows this insofar
correspond, as this does not correspond to the complete independence of the supervisory authority in
within the meaning of Art. 52 GDPR.
[...]
tasks
§ 21. (1) The data protection authority advises the committees of the National Council and the
Bundesrat, the federal government and the state governments at their request
on legislative and administrative measures. The data protection authority is in front
Enactment of federal laws and ordinances in the area of implementation of the
Federal, which directly concern questions of data protection.
(2) The data protection authority has the lists according to Art. 35 Para. 4 and 5 DSGVO im
Ways to announce an ordinance in the Federal Law Gazette.
(3) The data protection authority must determine the
to announce the criteria by way of an ordinance. At the same time, it acts as
only national accreditation body according to Art. 43 Para. 1 lit. a GDPR.
powers
Section 22. (1) The data protection authority may be instructed by the person responsible or
employees of the checked data processing, in particular all necessary processing
request clarifications and inspection of data processing and related
request documents. The controller or processor has the necessary
to provide agile support. The control activity is to be carried out with the greatest
assertion of the rights of the person responsible or the processor and third parties
exercise.
(2) For the purpose of inspection, the data protection authority is, after notifying the
owner of the premises and the person responsible or the order processor
beiters entitled to rooms in which data processing is carried out
to enter the data processing systems to be checked
to carry out processing as well as copies of data carriers in the for
the exercise of control powers to produce the extent absolutely necessary
len.
5 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
(3) Information that the data protection authority or its agents
of the control activity may only be used for the control within the
be used to implement data protection regulations. in the
Otherwise, the duty of confidentiality also applies to courts and
Administrative authorities, in particular tax authorities; this, however, with the
Provided that when the inspection suspects a criminal act
according to § 63 of this federal law or according to §§ 118a, 119, 119a, 126a to 126c,
148a or § 278a of the Criminal Code - StGB, Federal Law Gazette No. 60/1974, or one
crime with a maximum sentence of imprisonment exceeding five years,
arises, is to be reported and with regard to such crimes and misdemeanors
also requests according to § 76 of the Code of Criminal Procedure - StPO, Federal Law Gazette No. 631/1975
correspond to.
(4) If the operation of data processing involves a significant direct
bare endangerment of secrecy interests worthy of protection of the persons concerned
(risk of delay), the data protection authority may continue
of data processing with a decision in accordance with Section 57 (1) of the General Administration
1991 – AVG, Federal Law Gazette No. 51/1991. If this
technically possible, reasonable with regard to the purpose of the data processing and
seems sufficient to eliminate the hazard, the continuation can
even partially prohibited. The data protection authority can also
Request of a data subject to restrict processing
Order Art. 18 GDPR with a decision in accordance with § 57 Para. 1 AVG if the responsible
does not comply with a verbal obligation in this regard in a timely manner. Will
the data protection authority has not complied with a prohibition immediately
to proceed according to Art. 83 Para. 5 GDPR.
(5) Within the scope of its competence, the data protection authority is responsible for
Payment of fines to natural and legal persons.
(6) If, in the course of a lawsuit based on Section 29, an affected person exists who
from an institution, organization or association within the meaning of Art. 80
Para. 1 DSGVO can be represented, doubts as to the existence of the relevant criteria,
the data protection authority shall, at the request of the court of appeal,
relevant findings with notice. This institution, organization or association
agreement has party status in the proceedings. Against a negative assessment
She is free to lodge a complaint with the Federal Administrative Court.
[...]
6 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
3rd section
Remedies, Liability and Penalties
Complaint to the data protection authority
§ 24. (1) Every data subject has the right to lodge a complaint with the data
protection authority, if it considers that the processing of data concerning you-
the personal data against the GDPR or against § 1 or Article 2
1. Major breaches.
(2) The complaint must contain:
1. the designation of the right deemed to have been infringed,
2. as far as this is reasonable, the designation of the legal entity or body, the
the alleged infringement is attributed (respondent party),
3. the facts from which the infringement is derived,
4. the grounds on which the allegation of illegality is based,
5. the desire to determine the alleged infringement and
6. the information required to assess whether the complaint is justified
is brought in on time.
(3) A complaint may include the application on which it is based and a
attach any response from the respondent. The data protection
hear further in case of a complaint at the request of the person concerned
to provide support.
(4)The entitlement to treatment of a complaint expires if the intervener
not within one year after becoming aware of the complaining
event, but at the latest within three years after the event
has taken place to a large extent. Late complaints are
to reject.
(5) If a complaint proves to be justified, it must be followed. is
an infringement is to be attributed to a person responsible for the privatearea
instruct him to respond to the complainant's requests for information, reporting
cessation, deletion, restriction or data transmission to the extent
speak, which is necessary to eliminate the identified infringement.
If the complaint proves to be unjustified, it must be dismissed.
(6) A respondent may, until the conclusion of the procedure before the data
protection authority subsequently eliminate the alleged infringement by
it complies with the complainant's requests. If the data protection
hear the complaint to the extent that it is irrelevant, she has the complaint
listen to it. At the same time, he should be made aware that the data
data protection authority will informally discontinue the procedure if he is not within
within a reasonable period of time why he originally claimed that
Violation of the law is at least partially still considered not to have been remedied.
7 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
If such a statement by the complainant puts the matter in perspective
sen after changed (§ 13 Abs. 8 AVG), the withdrawal of the original
a complaint and the simultaneous filing of a new complaint
to go out In this case, too, the original complaint procedure is informal
discontinue and notify the complainant. Delayed foreign
ments are not to be taken into account.
(7) The complainant will be contacted by the data protection authority within three
months from the filing of the complaint about the status and the outcome of the
investigation taught.
(8) Any data subject may refer the matter to the Federal Administrative Court if
the data protection authority does not deal with the complaint or the
affected person within three months about the status or the result
nis of the complaint lodged.
(9) The data protection authority can – if necessary – appoint official experts in
bring procedures.
(10) The decision period according to § 73 AVG does not include:
1. the time during which the procedure until the final decision is
is exposed to a preliminary question;
2. the time during a procedure according to Art. 56, 60 and 63 DSGVO.
Accompanying measures in the complaints procedure
§ 25. (1) If the complainant makes a significant
material impairment of his interests in secrecy, which are worthy of protection
the processing of his personal data is credible, the data
protection authority according to § 22 para. 4.
(2) If the accuracy of personal data is disputed in a procedure,
the respondent is to file a dispute
If necessary, the data protection authority has requested this
to order the complainant's application with a decision in accordance with Section 57 (1) AVG.
(3) If a person responsible invokes the data protection authority on a
Restriction within the meaning of Art. 23 GDPR, this has the legality of
review application of restrictions. Does she come to the conclusion that
the secrecy of processed personal data from the
affected person was not justified, the disclosure of the personal
to apply the data obtained with a notification. If the decision of the data protection authority
If you do not respond within eight weeks, the data protection authority has the
Disclosure of the personal data to the data subject
to do it yourself and to give her the requested information or to inform her
find out which personal data has already been corrected or deleted.
8 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
(4) Notices with which transfers of personal data abroad
country have been approved are to be revoked if the legal or factual
the conditions for granting the permit no longer exist."
2. The relevant provisions of Regulation (EU) No. 2016/679 as of 3
Protection of natural persons during the processing of personal data, e.g
free movement of data and repealing Directive 95/46/EC (data protection
Basic Regulation, hereinafter: GDPR), OJ 2016 L 119, 1, read:
"CHAPTER VI
Independent Regulators
Part 1
independence
Article 51
supervisory authority
1. Each Member State shall provide for one or more independent authorities
are responsible for supervising the application of this regulation so that the
Fundamental rights and freedoms of natural persons in the processing
are protected and the free flow of personal data in the Union
facilitated (hereinafter 'Supervisory Authority').
(2) Each supervisory authority contributes to the uniform application of
this regulation throughout the Union. To this end, the supervisory
authorities among themselves and with the Commission in accordance with Chapter VII.
(3) If there is more than one supervisory authority in a Member State, so determined
this Member State the supervisory authority that these authorities represent in the committee
occurs and puts in place a procedure to ensure that the others
authorities comply with the rules for the consistency mechanism under Article 63.
4. Each Member State shall notify the Commission by 25 May 2018 at the latest
Legislation which he enacts on the basis of this chapter, as well as all without delay
following amendments to these regulations.
[...]
9 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
Section 2
Responsibilities, duties and powers
Article 55
jurisdiction
(1) Each supervisory authority is responsible for the fulfillment of the tasks and the exercise of the
Powers conferred on it by this regulation in the territory
of their own Member State.
(2) If the processing is carried out by authorities or private bodies on the basis
situation of Article 6 paragraph 1 letter c or e, the supervisory authority of
concerned Member State responsible. In this case Article 56 does not apply
turn.
(3) The supervisory authorities are not responsible for the supervision of the
direct processing carried out within the scope of their judicial activities.
[…]
CHAPTER VIII
Remedies, Liability and Penalties
Article 77
Right to lodge a complaint with a supervisory authority
(1) Without prejudice to any other administrative
legal or judicial remedy the right to complain to a
Supervisory authority, in particular in the Member State of your habitual residence
places of residence, their place of work or the location of the alleged violation, if
the data subject believes that the processing is relevant to them
personal data violates this regulation.
(2) The supervisory authority to which the complaint was lodged will be informed
inform the complainant about the status and the results of the complaint
finally the possibility of a judicial remedy under Article 78.
Article 78
Right to an effective judicial remedy against a supervisory authority
(1) Every natural or legal person has, without prejudice to anything else
administrative or non-judicial remedy, the right to a
effective judicial remedy against a legal
binding decision of a supervisory authority.
(2) Without prejudice to any other administrative
legal or non-judicial remedy the right to an effective
10 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
judicial remedy if the competent authority under Articles 55 and 56
supervisory authority does not deal with a complaint or the person concerned
not within three months of the status or outcome of the pursuant
complaint made under Article 77.
(3) For proceedings against a supervisory authority, the courts of the member
competent state in which the supervisory authority has its seat.
(4) If there are proceedings against the decision of a supervisory authority,
which an opinion or a decision of the committee within the framework of the
inheritance proceedings, the supervisory authority directs this agency
consent or this order to the court.
Article 79
Right to an effective judicial remedy against data controllers or
processor
(1) Every data subject has, without prejudice to an available administrative right
judicial or extrajudicial legal remedy, including the right to
appeal to a supervisory authority pursuant to Article 77 the right to an effective
Same judicial remedy if she believes that her due
rights to which you are entitled under this Regulation as a result of a non-compliance with this
regulation violates the processing of your personal data
became.
(2) For lawsuits against a person responsible or against a processor
The courts of the Member State in which the controller is responsible have jurisdiction
or the processor has an establishment. Optionally, such
Actions can also be brought before the courts of the Member State in which the
affected person has their usual place of residence, unless it acts
the person responsible or the processor is an authority
of a Member State acting in the exercise of its sovereign powers
is.
[...]
CHAPTER IX
Rules for special processing situations
Article 85
Processing and freedom of expression and information
(1)Member States bring the right to protection through legislation
personal data according to this regulation with the right to free ma-
expression of opinion and freedom of information, including processing for jour-
nalistical purposes and for scientific, artistic or literary purposes
purposes, in accordance.
11 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
(2) For processing for journalistic purposes or for scientific
ing, artistic or literary purposes, the Member States
ten deviations or exceptions from Chapter II (Principles), Chapter III (Rights
of the data subject), Chapter IV (Controller and processor),
Chapter V (Transfer of personal data to third countries or to internal
national organizations), Chapter VI (Independent Regulatory Authorities), Chapter VII
(Cooperation and Consistency) and Chapter IX (Rules for Special
work situations) if this is necessary to exercise the right to protection of
personal data with freedom of expression and information
to reconcile freedom of information.
3. Each Member State shall notify the Commission of the legislation which it
reason of paragraph 2, as well as immediately all subsequent amendments
implement or amend these regulations."
III. Facts, submissions and preliminary proceedings
1. The procedure recorded at the Constitutional Court on number G 287/2022 4
ren is based on the following facts:
1.1. In his complaint to the data protection authority dated 29. No-5
vember 2019, the complainant alleged a violation of his right
Confidentiality according to § 1 DSG applies. In summary, he submitted that the
Severe opponent, a media company, has a contribution on her homepage
tragedy and images of a house search were published. on one of the
published images are the business card of the complainant (unredacted)
been pictured. His name as well as in employers were recognizable.
The media privilege of § 9 DSG is not applicable to the present case.
Even if you assume the applicability of § 9 DSG, you can get by
an interpretation conforming to Union law to the conclusion that the existing
sufficient data processing was not necessary.
1.2. The respondent in the proceedings before the data protection authority reimbursed 6
tete a statement in which she put forward a media outlet
§ 1 para. 1 no. 6 MedienG. The publication of the pictures was too journalistic
cal purposes; the images were later blacked out. Since the
Heavy publication under the media privilege according to § 9 paragraph 1
DSG falls, the data protection authority is not competent in the present case.
12 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
1.3. With notice dated 23. July 2020, the data protection authority dismissed the complaint 7
back and justified this in summary by the fact that the
Heavy opponent is a media company that, as the media owner
responsible for the content of the reporting. The data of the complaint
deführers are in the context of journalistic articles or journalistic reports
processed and subsequently published. Due to the
Application of the media privilege according to § 9 Abs. 1 DSG is the authority concerned
not competent to deal with the complaint.
1.4. The complainant lodged a complaint against this decision within the time limit 8
to the Federal Administrative Court. He stated in particular that § 9 DSG was
unconstitutional and unlawful.
2. The procedure recorded at the Constitutional Court on number G 288/2022 9
ren is based on the following facts:
2.1. In its complaint to the data protection authority dated 26 November - 10
About 2021, the complaining parties (among others) made a breach of their
The right to secrecy according to § 1 DSG applies. They brought together
suggests that a publishing company and a broadcasting company have a
"Data leak" at one attributable to the second complaining party
E-mail mailbox that is in the power of disposal of the party filing the first
tei stand, reported. The media companies mentioned would have
circumstances unlawfully disclosed. The application of the media privilege
according to § 9 Abs. 1 DSG is unconstitutional.
2.2. With a decision of December 10, 2021, the data protection authority proved the
complaint of the complaining parties, with reference to media privacy
leg of § 9 Para. 1 DSG.
2.3. The complaining parties lodged a complaint against this decision within the 12
complaint to the Federal Administrative Court and suggested an application
According to Art. 140 Para. 1 Z 1 lit. a B-VG to the Constitutional Court and the Einho
ment of a preliminary ruling by the Court of Justice of the European Union
Art. 267 TFEU.
13 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
3. In order to deal with these complaints, the Federal Administrative 13
court had concerns about the constitutionality of Section 9 (1) DSG,
which prompted it to submit an application to the Constitutional Court.
The supporting court lays its concerns in this regard in the
sungsgerichtshof on number G 287/2022 as follows
(without the emphasis in the original):
"III. Constitutional concerns:
1. In the present case, the data protection authority with the contested proof
decided the complainant's data protection complaint because of an alleged
In accordance with § 1 DSG, they withdraw from infringement because they are based on the media privilege
of § 9 Para. 1 DSG for the handling of a complaint against a media company
do not take responsibility.
2. The Federal Administrative Court has serious concerns about the constitutional
compliance with Section 9 (1) DSG.
In detail:
2.1. The Federal Administrative Court primarily has the concern that its applicable
realization of the basic right to data protection of § 1 DSG in the scope
of § 9 para. 1 DSG is effectively undermined, since due to the in § 9 para. 1 DSG
standardized exclusion of the provisions of the DSG - and thus also the non-
applicability of § 24 Para. 1 DSG - (as well as the entire Chapter VI of the GDPR)
no national supervisory authority is available to a data subject,
to assert a violation of fundamental rights. The Federal Administrative
court is of the opinion that its national supervisory authority should also
9 Para. 1 DSG a responsibility for the treatment of complaints
must come.
The following is stated in the scientific literature on Section 9 (1) DSG:
According to the wording of Section 9 (1) DSG, a total exception to this applies
the provisions of the DSG' (Zöchbauer, MR 2018, 102 [103]; cf. also Kunnert
in Bresichet al (editor), DSG comment (2018) §9DSGRz 10).'§ 9 Para.1 DSG sees
in the first sentence that under the conditions defined in more detail there 'the
Provisions of this federal law do not apply. This will - in
Difference to the previous provision of §48DSG2000 -also the applicable-
of the fundamental right to data
Protection according to § 1 DSG excluded. […]' (Jahnel, comment on data protection
Basic Regulation Art. 85 GDPR, margin no. 42).
14 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
After Jahnel comes a constitutional interpretation of Section 9 (1) DSG
'in view of the clear wording ('find the provisions of this federal
zes […] no application') […] not to be considered.' (Jahnel, comment on data
General Protection Regulation Art. 85 GDPR, margin no. 44).
'Like all fundamental rights, the fundamental right to data protection does not apply
restricts. A limitation of this fundamental right is only in the presence of a
of the reasons provided for in Section 1 (2) DSG. Since the approval and
vital interests in connection with media privilege not in
come, is for the constitutional conformity of an intervention in the fundamental
Right to data protection through a legal provision at least one
balancing of interests required. Both in § 9 para. 1 […], however, there is a
General exclusion of the fundamental right to data protection, provided that the other
conditions of a privilege exist.' (Jahnel, comment on data
General Protection Regulation Art. 85 GDPR, margin no. 43).
'§ 9 para. 1 takes processing for journalistic purposes as an overriding norm
by media companies or media services within the meaning of a blanket exception
almost completely from the data protection regulation regime. In particular
the persons affected by the processing situations mentioned
the rights of data subjects enshrined in Chapter III GDPR in accordance with Section 9 (1) DSG fully
extensively withdrawn. This blanket withdrawal of the rights of those affected is before
Background of the material legal reservation according to § 1 paragraph 2 DSG as non-
proportionate encroachment on the fundamental right to data protection. the
Withdrawal of the rights of those affected should rather be within the meaning of the principle of proportionality
solely on the basis of an evaluative consideration of the (public) interests
ressing journalistic activity and the fundamental right to data protection of the
take place. The blanket exception of § 9 Para. 1 DSG privileges journa-
cunning activities of media companies or media services, however
a priori in the negation of any data subject rights and thus encroaches on disproportionate
moderate and consequently unconstitutional manner in § 1 DSG.' (Marco Blo-
cher/Lukas Wieser, Of privileged journalists and data in the (almost) right-
free space - For a unilateral solution to the conflict of fundamental rights between
Data protection and freedom of expression through § 9 DSG, data protection law yearbook
2019, 303 [312f]).
In this context, it is stated that, in the opinion of the Federal
administrative court the simple legal provision of § 9 paragraph 1 DSG, in any case
not the basic right to data protection, which has constitutional status
of media privilege. Even if one interprets
could make going that the exception of the DSG mentioned in § 9 paragraph 1
only concerns its simple legal regulations, the fundamental right in the
consequence can also be asserted. However, this is precisely not the case
since also § 24 DSG, which is the basis for the determination of (also in the past
factual) violations of rights, in particular of the fundamental right to property
secrecy, would not be applicable.
15 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
For the reasons mentioned, the exception of the entire DSG seems to contradict
to stand with the basic right to data protection standardized in § 1 DSG.
First of all, the Federal Administrative Court does not fail to recognize that the right to
do not lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR in Chapter VIII
is excluded. While the Supreme Court, with reference to the legal
lien (ErläutAB 1761 BlgNR 25. GP 15) assumes that Art. 77 [GDPR] no
independent right to appeal standardized (OGH May 23, 2019, 6 Ob 91/19d),
is used by the doctrine and by the Federal Administrative Court in the cases cited below
are of the opinion that Art. 77 GDPR should not be implemented in the national
Law requires (cf. Schweiger in Knyrim, DatKomm Art. 77 GDPR, margin no. 8 (as of
December 1, 2018, rdb.at), see also BVwG November 23, 2020, W211 2227144-1; BVwG
8/13/2021, W211 2222613-1.
But even with a direct applicability of Art. 77 DSGVO results
following problem:
Art. 77 D[S]GVO appears from its wording (only) to be currently
stop ongoing violations. Accordingly, Art. 58
DSGVO no 'assessment powers', but investigative, remedial and
approval powers.
Also according to the case law of the Administrative Court (VwGH December 14, 2021,
Ro 2020/04/0032) exclusively grants § 24 DSG in his personal
fundamental right violated the possibility that happened to him
To have an infringement determined is such a determination competence
namely not provided for in the GDPR
therefore (due to the lack of applicability of § 24 DSG) no possibility of a legal
last (which took place in the past) to determine (yet just now
a determination of such a violation of fundamental rights is about
understandable case of complaint), which is why the exclusion of the provisions of the DSG
in particular due to the principle of equality as not in accordance with
appears to be based on constitutional law (see below for more details).
The provisions of §§ 18 to 22 DSG (establishment of data protection
authority, independence, head of the data protection authority and powers of the
data protection authority) also not applicable according to the wording of the DSG. Above-
Strictly speaking, this includes § 9 para. 1 DSG in its diction even itself
out, which was apparently not intended by the legislature. should be pointed out
also on the fact that – contrary to the extensive exceptions – the last
Sentence of § 9 para. 1 DSG seems to assume that the data protection authority
very well also in the event of complaints against media companies and owners
to come.
The Federal Administrative Court does not overlook the fact that despite the exclusion of
Applicability of all DSG provisions because of the direct applicability
of Art. 79 GDPR with additional reference to § 1 JN in the case of a
According to the GDPR, a jurisdiction of the civil courts can be assumed
16 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
can. However, in the present case, in which the determination of a
Violation of the fundamental right[s] to secrecy was asserted under
Reference to Art. 79 GDPR does not justify any jurisdiction,
since Art. 79 GDPR (like Art. 77 GDPR) only refers to violations of the GDPR
but not on national laws such as the DSG (Marco Blocher/Lukas Wie-
ser, Of privileged journalists and data in (almost) a legal vacuum – Zur
unilateral solution to the conflict of fundamental rights between data protection and opinion
freedom through § 9 DSG, data protection law yearbook 2019, 303 [320]; see also
Jahnel, Commentary on the General Data Protection Regulation Art. 85 GDPR, margin no. 51). So-
legal protection in the present case would be completely excluded. The-
This result does not seem objectively justifiable to the Federal Administrative Court
and therefore in conflict with the principle of equality and the right to
legal judge (see below).
But also a sole jurisdiction of the regional court (cf. § 50 JN in conjunction with § 49
JN and OGH 05/23/2019, 6 Ob 91/19d) would not comply with the provisions of Art. 79
Para. 1 GDPR, according to which each data subject, without prejudice to the
law of gravity at a supervisory authority the right to a judicial
has a right of appeal if it considers that the
rights to which you are entitled as a result of a non-compliance with this Regulation
standing processing of their personal data have been violated and has
the European legislature thus explicitly provides for a two-pronged legal protection
seen. This two-pronged legal protection has already been re-examined by the OGH
Holt affirmed (e.g. 6 Ob35/21x of April 15, 2021 with reference to 6 Ob 131/18kund
6 Ob 91/19k) and most recently in the Opinion of Advocate General de la Tour
of September 8, 2022 in Case C-132/21, BE. Various considerations
Reasons, especially Recital 122 GDPR, assume a comprehensive responsibility of
supervisory authorities.
Even if one assumed a court of jurisdiction, the regulation of the
§ 9 para. 1 DSG irrelevant because the right to complain to the
data protection authority are perceived as less accessible by those affected
can, especially since filing a complaint with the authority - in contrast to
bringing an action before the regional court – is free of charge and before the authority
there is also no obligation to have a lawyer. It is not misunderstood here that in administration
procedure, the principle of self-support prevails and therefore in the case
If the complaint is successful, no representation costs will be reimbursed.
In the event of a lawsuit in civil court, the flat fee is borne by the plaintiff
to be paid, plus the costs for the necessary representation by a
a lawyer, although in the event of complete victory there may also be a
full reimbursement of the procedural and representation costs (cf.
Jahnel, On the Interplay between the Administrative Law Way and the
Civil law and the interfaces to constitutional law and European law
in: Nunner-Krautgasser/Garber/Klauser (editors), Law Enforcement in Data
protection according to the GDPR and the GDPR2018[2019]).
legal aid can be applied for (cf. § 63 ff ZPO). The party has
17 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
however, to effect the full or partial subsequent payment of the amounts, so
far and as soon as they can do so without impairing the necessary maintenance
(cf. more detail § 71 Abs. 1 ZPO). Legal aid is also only granted for the
costs are granted, but in the event of defeat, the opponent's
to pay the costs despite legal aid being granted (cf. M. Bydlinski in Fa-
sching/Konecny II/1 before §§ 63 ff ZPO Rz 3 (as of September 1st, 2014, rdb.at). total
are therefore the requirements for the person concerned when exercising the
Right of appeal to the DSB to be regarded as lower.
It also does not correspond to the will of the legislature to
exclusively comply with the media law and the jurisdiction
Rather, the (Union law) legislator Art.
assumes that national legislators (only) take into account the basic
rights to data protection and freedom of expression
to be provided for by the GDPR. A requirement of jurisdiction
of the national data protection authority is not apparent, let alone the need
of a (non-equal) 'partial incompetence' for complaints
gen particular actors such as media companies or media services.
Furthermore, the exclusion of Chapter II GDPR 'Principles' would
In the case of a substantive decision, the test standard of Art. 5 ff
GDPR withdrawn, unless you already have this exclusion due to the Union
unlawfulness considered inapplicable.
It should be added that Art. 85 Para. 2 GDPR gives the Member States the task
informs, 'deviations and exceptions' from certain chapters of the GDPR
watch if this is necessary as a result of a balancing of interests ('um
the right to protection of personal data with the freedom of
freedom of expression and freedom of information', see also
ErwG 153 DSGVO), whereby this balancing of interests in § 9 Abs. 1 DSG not
forms (cf. Zöchbauer, Das'Medienprivileg'des§ 9Abs.1 DSGidFDatenschutz-
Deregulation Act 2018, MR 2018, 102). Rather, after the (new) version
of § 9 DSG, a consideration is not (or no longer) necessary, the essential parts of the
GDPR and the DSG are therefore in any case not applicable to the
processing of personal data by media owners, publishers,
Media staff and employees of a media company or media
service for journalistic purposes (Lehofer, adaptation of data protection
sung - last-minute legislation accompanying the GDPR, ÖJZ 2018/55). to the general
Exemption from all data protection regulations, such as § 9 Para. 1 DSG
contains, see also critical Krempelmeier, Are the data protection privileges
9 DSG contrary to Union law?, jusIT 2018/68.
Among the other exceptions - affecting most chapters of the GDPR - is
to record the following:
Chapter VIII GDPR cannot be viewed in isolation from Chapter VI. Since the
Provision on the competence of a supervisory authority in Art. 55 GDPR ex
18 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
1 DSG would be excluded, the relevant authority could
not make a merit-based decision on the complaint. In addition, the
powers of assistance of Art. 58 Para. 2 lit c [GDPR] (the person responsible or the
instruct processors to comply with data subject requests for
exercising the rights to which it is entitled under this regulation).
of the data protection authority are not exercised (cf.Schmidl, DasMedienprivileg
in the case law of the data protection authority, jusIT 2020/20, 54 issue 2 v.
April 27, 2020). Finally, it should be noted that Section 9 (1) DSG also includes the entire
Chapter IX of the GDPR excludes, which also excludes the provision of Art. 85 Para. 2
GDPR is excluded, accordingly for the processing that leads to journalistic
scientific purposes or for scientific, artistic or literary purposes
If the Member States derogate from or make exceptions to Chapter II
(Principles), Chapter III (Rights of the data subject), Chapter IV (Responsibility
and processors), Chapter V (Transmission of personal data
to third countries or to international organizations), Chapter VI (Independent
ing supervisory authorities), Chapter VII (Cooperation and Consistency) and
Provide for Chapter IX (Regulations for special processing situations) if
this is necessary to exercise the right to protection of personal data
freedom of expression and freedom of information
bring. The exclusion of the applicability of Art. 85 Para. 2 GDPR, i.e. the
Union legal basis for the 'media privilege', however, would have the consequence that
the standard of § 9 para. 1 DSG would be deprived of its (union legal) basis.
Again, the Constitutional Court held in its decision of September 26, 2022 that
there is also an inseparable connection with the other provisions
of §9 para. 1 DSG, thus with the other exceptions mentioned in § 9 paragraph 1 DSG
from the GDPR.
With regard to these exceptions to the GDPR, the Federal Administrative Court has the
think that they are not in line with Union law in this general way,
especially since Art. 85 GDPR bases the exceptions on their 'necessity' and a
Excluding the possibility of complaints to the supervisory authority
is required. Likewise, an exclusion of the (entire) IX. Chapter GDPR
not only not necessary, but simply meaningless, since the
If the legal basis of Art. 85 GDPR were withdrawn in § 9 DSG.
2.2. The principle of equality is repeated in Austrian constitutional law,
namely in Art. 2 StGG and above all Art. 7 B-VG, anchored.
sentence also binds the legislature. He sets him content limits insofar as
it forbids the making of regulations that cannot be justified objectively (e.g.
VfSlg 14.039/1995; 16.407/2001). The Constitutional Court emphasized that the principle of equality
forms an essential part of the democratic principle and therefore
is also not at the disposal of the constitutional legislature
(VfSlg 15.373). According to the examination formula developed by the Constitutional Court, the
principle of equality only an objectively justified differentiation; such sets
Relevant differences in the field of facts (objective distinguishing
male) ahead. According to established case law, the legislature must
have the same legal consequences; substantially unequal facts
19 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
lead to correspondingly different regulations (e.g. VfSlg 2956, 11.190,
11,641, 13,477, 14,521, 19,590; VwGH 2. 7. 1992, 90/16/0167 - sen; Administrative Court
2000-03-23, 99/15/0202; cf. also VfSlg 8806, 11.190, 15.510 - on legal
exemptions). The objectivity test of laws aims at a
Evaluation of the relation of the facts covered by a regulation to the
envisaged legal consequence.
to carry out a comparison; it is necessary to ask whether the respective
are so different that the different legal consequences become 'tra-
gene' assets (VfSlg 16.635, 17.309).
first such an examination of the relationship between facts and legal consequences
gain weight. It can lead to the result that this relation is already in itself
based on no 'reasonable' reason; in this case the law is
to be regarded as contrary (e.g. VfSlg 13.975) [Muzak, B-VG Art 2 StGG (as of October 1st, 2020,
rdb.at]. In the present case, no objective reasons are apparent in application
cases of § 9 para. 1 DSG compared to cases in which this is not the
It is important not to assert the fundamental right to secrecy at all
be able. If one speaks of the non-application of the exception of Chapter VI
GDPR, but without the provision of § 24 DSG of the DSB, a fixed
a past encroachment on fundamental rights is denied.
Even if one assumes (sole) jurisdiction of the civil courts,
if it would constitute unequal treatment for the persons concerned, it would not
(also) to provide for official responsibility which – as explained above –
is available to them more easily. The principle of equality appears in
to be injured in the present case because it treats the same unequally (cf.
VfSlg 5737 and others).
2.3.Art
Judge. The 'legal judge' means any state authority
(VfSlg 1443, 2048); from this follows a constitutionally guaranteed right
on the protection and maintenance of the legally justified authorities responsible
ability par excellence (VfSlg 2536, 12.111). This applies to administration
Right to a procedure before the statutory judge at the competent authority
as such. It is consistent case law that Art. 83 Para
binds (VfSlg 6675; otherwise VfSlg2470); the legislature must
responsibility based on objective criteria (VfSlg 3156, 8349), exact (VfSlg 9937,
10,311; VwGH September 5, 2008, 2007/12/0078), clear and unambiguous (VfSlg 11.288) 6estle-
(VfSlg 10.311,12.788; VwGH 7. 7. 2011, 2009/15/0223) [Muzak, B-VG Art.83
(Status 1.10.2020, rdb.at].
If the exceptions from the GDPR mentioned in § 9 Para. 1 DSG were not considered
to be considered applicable, the DPO would generally be any merit decision
about a complaint involving 'media privilege' processing
concerned, denied.
It should also be taken into account that within the scope of §9 DSG for a
Violation of § 1 DSG no jurisdiction of an authority or a court
20 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
exists, since Art. 77 DSGVO (only) the right to complain to a supervisory
hearing denormalized if the data subject believes that the processing
of the personal data concerning them 'against this regulation' - precisely
the GDPR – violates. An alleged violation of the domestic § 1 DSG
however, it cannot be asserted via Art. 77 or Art. 79 GDPR
[…].
As shown above, in the application of § 9 Para. 1 DSG the data
protection authority (at least in the event of a complaint about violation of the
Fundamental right to data protection) no merit decision-making authority to and
this regulation - for the reasons mentioned - is irrelevant. Accordingly would be
also no authority provided according to objective criteria, why
in the present case also a conflict with the right to the statutory judge
according to Art. 83 Para. 2 B-VG and also with Art. 6 EMRK.
2.4. Art. 8 GRC also guarantees the data subject the protection of the
applicable personal data and provides that compliance with these
writings is monitored by an independent body. Compliance with the
Art. 8 para. 1 and 2 standardized guarantees – in accordance with Art. 16 para. 2
Sentence 2 TFEU and Art. 39 last sentence EUV - is by an independent body
monitor. The procedural protection that is thereby achieved at the same time is specified
the legal guarantees of Art. 47 GRC for the area of data protection. the
Art. 51 f GDPR regulates independence (in a legally unifying manner).
of supervisory authorities at Member State level in a comprehensive manner and
in accordance with the case law of the ECJ that specifies this postulate, which
cheinsb.in explicit congruence withArt.8para.3GRC.'Independent
Body' are both the European data protection officer (according to Art. 41 ff VO
[EU] 2001/45), the official (community) data protection officers
(Art. 24 leg. cit.) and (above all) the supervisory authorities in the Member States
(Art. 51 f GDPR; formerly control bodies according to Art. 28 GDPR). According to the
The ECJ applies the establishment of independent control bodies in the Member States (such as
of course also in the Union itself) as an essential element of protection
of persons in the processing of personal data (ECJ 9.3.2010,
C-518/07, Commission/Germany margin no. 23; ECJ 16.10.2012, C-14/10, Commission
sion/AustriaRz37; ECJ8.4.2014, C-88/12, Commission/HungaryRz48; et al (cf.
also recital 62 DRSL and recital 117 GDPR).
The fact that this is not only secondary law (Art. 51 para. 1 and Art. 52
GDPR), but also explicitly by Art.8 Para.1 GRC (as well as Art.16 Para.1 TFEU).
is protected, speaks in favor of a kind of institutional guarantee in Art. 8 Para. 3 CFR
see. This conclusion is also confirmed by the provisions of
Secondary law, which statute a legal order to set up. On
Right of the person concerned to lodge a complaint with the national control bodies
judge, the ECJ also recently pronounced this reasoning (ECJ
December 21, 2016, related cases C-203/15 and C-698/15, Tele2 Sverige AB and others margin no. 123; before
already ECJ6. 10.2015, C-362/14, Schrems Rz 58 with reference to the decision
tion Digital Rights Ireland and Seitlinger and others).
21 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
Likewise, according to Art. 47 GRC, the person concerned has the right to object to a
rejection decision of the control body regarding the protection of his personal
personal data to appeal to the national courts. the
In this context, the control body itself is inter alia through Art. 8 Para. 3
GRC - when you receive a complaint from a person dealing with an input to you
has turned to be correct - an appeal before the (national) authorities
len/courts to. In addition, the control body/supervisory authority receives more
Investigation and intervention powers within the meaning of Art. 58 GDPR
comprehensive listing so that it can fulfill its role as 'guardian of fundamental rights'
can exercise effectively (Riesz in Holoubek/Lienbacher, GRC comment Art. 8 2
(Status April 1, 2019, rdb.at).
This alone shows that the mere possibility of directly asserting a
Data protection violations in the courts (which, however, in the present case also
is not given) the institution of a supervisory authority and legal protection
cannot be replaced by this authority, but can only be seen as an alternative,
whereby, as explained above, in the present case the fundamental right
Confidentiality cannot be asserted via Art. 79 GDPR.
In the decision of the VfGH VfSlg 19.632/2012 it was already stated that
due to the principle of equivalence also the rights guaranteed by the GRC
before the Constitutional Court as constitutionally guaranteed rights according to Art. 144
B-VG can be invoked and they are within the scope of the GRC
a test standard in procedures of general norm control, above all
according to Art. 139 and Art. 140 B-VG. This applies if the relevant
Guarantee of the GRC in its wording and certainty constitutional
guaranteed rights same. The intervention goals of Art. 52 Para. 1 GRC, in con-
creto 'objectives for the common good recognized by the Union', he-
allow more far-reaching encroachments on Art. 8 GRC than those permitted in Art. 8 para. 2 ECHR
are exhaustively mentioned (on which § 1 para. 2 DSG with regard to state intervention
explicitly recursed), whereby this divergence, considering the same limitations
test (proportionality) practically no significant differences
which will lead to the admissibility of interventions. In view of this
it is assumed that Art. 8 GRC 'does not contain any
the provision of § 1 DSG has a protective content that goes beyond the
However, the areas of application of the two fundamental rights provisions are not
(Completely) congruent
Overall connection but still existing comparability between § 1
DSG and Art. 8 GRC, this provision can in any case be considered a fundamental right before the
VfGH (Riesz in Holoubek/Lienbacher, GRC comment 2
Art 8 (as of April 1, 2019, rdb.at)).
The ECtHR has also recognized the need for protection of personal data
known by having the processing, transmission and storage correspond-
of the data regularly as an infringement of the privacy protected by Art. 8 Para. 1 ECHR
vatsphere (esp. in general personal rights). Art. 8 GRC
22 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
ties in with the existing comprehensive protection guarantees of Art. 8 Para. 1 ECHR
and writes the aspect of the protection of personal data in a
independent fundamental right. Indirectly, an incorporation takes place in the
range of data protection, however, through the explicit reference to Art. 8
ECHR in the explanations of Art. 8 GRC, which according to Art. 52 Para. 7 GRC in conjunction
Art. 6 para. 1 subparagraph 3 TEU must be observed in the interpretation, from which the
close linking of both systems – also underlined by primary law –
This is also evident by following the Rsp of the EuGHhandieRsp of the 2nd
ECHR confirmed (see again Riesz in Holoubek/Lienbacher, GRC comment
Art 8 (as of April 1, 2019, rdb.at).
Thus, Art. 8 ECHR also represents a test standard and the contested
The following parts of Section 9 (1) DSG are - for the reasons given above - in
Conflict with provision of Art. 8 ECHR.
3. A constitutional interpretation of the contested provision came
in the present case, at least with regard to the exception of ordinary law
Regulations of the DSG are not considered, since these - like any other interpretation
tion method - finds its limit in the unambiguous wording of the law (VwGH
March 13, 2009, 2005/12/0240, with reference; 06/29/2011, 2009/12/0141).
Even if one assumes that a word interpretation shows that § 9
Para. 1 DSG a responsibility of the data protection authority for the treatment of
Complaints against actors who are not mentioned in § 9 paragraph 1 DSG, not
closes, would a responsibility of a national supervisory authority for complaints
the against journalistic persons not mentioned in § 9 paragraph 1 DSG
part (keyword: citizen journalism) and a lack of competence of the DSB regarding
Complaints against the journalistic actors named in Section 9 (1) DSG
on the other hand, objectively not justifiable and therefore contrary to equality. § 9 paragraph 1
DSG is therefore not accessible to a constitutional interpretation.
An unlawful norm is not irrelevant, but rather to be applied for as long
until they have been examined and addressed by the Constitutional Court in the
(cf. VfGH 11.10.1955, V 15/55).
IV. Conclusion
The Federal Administrative Court has therefore decided that the
application to the Constitutional Court."
4. The application of the Federal Administrative Court in the case before the Constitutional Court 14
hof corresponds to number G 288/2022 - with adjustments
and the facts and procedure there – the one just reproduced
Legislative Review Request.
23 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
5. The Federal Government informed the Constitutional Court in briefs dated 15
November 16, 2022, in the proto-
collided proceedings to refrain from making a statement.
6. The data protection authority reported in the 16th
Number G 287/2022 procedures recorded a statement in which they raised the
ken of the applicant court as follows (without the original
included highlights):
"I. Statement on the subject
1. General information on admissibility:
It is preceded that the question of whether and, if necessary, to what extent §9 para. 1
DSG is in accordance with Union law, a matter for the ECJ
Art. 267 TFEU is. Accordingly, in the opinion of the data protection authority, the
no further introduction with regard to a potential violation of Union law
go to
In the course of its application, the BVwG is requesting the repeal of the following
statement:
'§ 9 (1) On the processing of personal data by media content
Editors, media workers and employees of a media company
mens or media service within the meaning of the Media Act - MedienG, BGBl.
NO. 314/1981, for journalistic purposes of the media company or medi-
endienstes find the provisions of this federal law as well as of the
GDPR chapters II (principles), III (rights of the data subject), IV (responsibility
literal and processor), V (transfer of personal data
to third countries or to international organizations), VI (Independent Supervisory
authorities), VII (cooperation and coherence) and IX (rules for special
their processing situations) does not apply. The data protection authority has
when exercising their powers towards the persons named in the first sentence
to observe the protection of editorial secrecy (§31 MedienG).'
in the version of the amendment BGBl.INr.24/2018 (Data Protection Deregulation Act
2018).
As a reason, it is essentially stated that an assertion of the
Fundamental right to data protection according to § 1 DSG in the scope of § 9 paragraph 1
DSG will actually be undermined because of the standardized in § 9 para. 1 DSG
Exclusion of the simple legal provision of the DSG - and thus also the
Inapplicability of Section 24 (1) DSG and the entire Chapter VI of the GDPR
– no national supervisory authority is available to a data subject,
24 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
to claim a violation of fundamental rights. The BVwG represents the
Opinion that a national supervisory authority also within the scope of § 9 para. 1
DSG must be responsible for dealing with complaints.
The data protection authority is of the opinion, to be further substantiated, that
§ 9 para. 1 DSG in the current version is not mandatory under constitutional law
contradicts specifications.
2. Regarding the specific constitutional concerns of the applicant
judge:
The court appealed to decides on the unconstitutionality of the
disputed legal provision (Art. 140 para. 1 B-VG). The motion has them against them
the constitutionality of the law in detail.
gen (§62 para. 1 second sentence VfGG). The Constitutional Court has to judge
whether the contested provision from the reasons presented in the application
given reasons is unconstitutional (VfSlg. 15.193/1998, 16.374/2001,
16.538/2002, 16.929/2003).
According to the established case law of the constitutional
Court of Justice only fulfilled if the reasons for the alleged violation of the constitution
rity - in a verifiable way - to be precisely spread, and therefore the application
it can be inferred with sufficient clarity by which legal regulation the
the norm requested for repeal is said to be inconsistent and what the reasons are
speak for this assumption (cf. e.g. VfSlg. 14.802/1997, 17.752/2006; specifically
on the party motion VfGH July 2, 2015, G 16/2015; 2.7.2015, G 145/2015; 2/18/2016,
G 642/2015).
Summarized to the essentials, the BVwG sees a constitutional
of § 9 Para. 1 DSG because
a) a violation of the fundamental right to data protection according to § 1 DSG not before
data protection authority can be asserted (see point 3.1.);
b) the exclusion of legal recourse to the data protection authority in violation of equality
7 B-VG and Art. 2 StGG (see point 3.2.);
c) the right to the statutory judge according to Art. 83 B-VG is violated and
(see point 3.3.);
d) a breach of the guarantee of protection provided for in Art. 8 EU-GRC
personal data is available (see point 3.4.).
The subject of the present proceedings is therefore exclusively the question of
(In)competence of the data protection authority. Whether § 9 para. 1 DSG from other
Reasons unconstitutional, however, is not the subject of the proceedings.
25 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
The data protection authority comments on this as follows:
3.1. Concerning the concerns regarding the fundamental right to data protection in
menhang with the 'media privilege'
The so-called 'media privilege' is characterized in that in order to
Basic right to protection of personal data according to Art. 8 EU-GRC and that
on freedom of expression and information according to Art. 11 EU-GRC
to reconcile partial deviations from the requirements of the GDPR
dig, among other things, regarding the responsibility of the supervisory authority (here: data
protection authority) according to Chapter VI GDPR. According to Art. 85 Para. 2 GDPR, it is a task
of the Member States[,] these two basic
to reconcile rights. A general priority of these two
fundamental rights is not possible insofar as fundamental rights im-
must be weighed against each other, with the ECJ in its previous
Case law has indicated the fundamental right to protection of personal data
Data against the right to freedom of expression and information
to give priority to freedom of action (cf. most recently the judgment of September 24
2019, C-136/17, para. 66).
The data protection authority is of the opinion that the simple legal provisions
9 paragraph 1 DSG, in any case not the basic
undermine the right to data protection according to § 1 DSG in the context of media privilege
able and also within the scope of the 'media privilege' from the stock of
§ 1 DSG as well as a limited competence of the data protection
according to § 24 DSG.
It should already be noted at this point that neither § 1 DSG nor
Art. 7 B-VG in conjunction with Art. 2 StGG and from Art. 83 B-VG a responsibility of the data
protection authority can be derived. Art. 8 EU-GRC also reveals how more precisely
is to add that no unrestricted competence of the data protection authority
guide.
Irrespective of this, according to the case law of the Supreme Court, what is even closer
will have to be addressed, the basic right to data protection according to § 1 DSG immediately
be asserted before the civil courts, so that in any case a legal
protective route is opened.
According to the data protection
authority therefore whether the (partial) exclusion of the competence of the data protection
authority within the scope of Section 9 (1) DSG is contrary to equality because this
if only the (chargeable) legal protection route to the civil courts is opened.
a) On the wording of Section 9 (1) DSG
§ 9 para. 1 DSG reads 'freedom of expression and information'
as follows (emphasis added by data protection authority):
26 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
On the processing of personal data by media owners, he-
Publishers, media workers and employees of a media company
or media service within the meaning of the Media Act – MedienG, BGBl.
No. 314/1981, for journalistic purposes of the media company or
Media service can find the provisions of this federal law as well as of the
GDPR chapters II (principles), III (rights of the data subject), IV
(Responsible and processor), V (Transfer of personal
Data to third countries or to international organizations), VI (Independent
Regulatory Authorities), VII (Cooperation and Consistency) and IX (Regulations for
special processing situations) no application. The data protection authority
exercise their powers over those named in the first sentence
persons to observe the protection of editorial secrecy (§ 31 MedienG).
In § 9 para. 1 DSG, the previous data protection law 'media privilege' is replaced
Section 48 DSG 2000, Federal Law Gazette I No. 165/1999 as amended to Federal Law Gazette I No. 132/2015, with an expanded version
Scope transposed into the GDPR system. The national reg-
The provision in § 9 DSG is linked to Art. 85 GDPR, a basic provision including
Opening clause, to (see Suda/VeiglinGantschacher/Jelinek/Schmidl/Spanberger,
Data Protection Act, § 9 Rz 1, still with reference to § 9 DSG in the version of Federal Law Gazette I No. 120/2017
[Data Protection Amendment Act 2018]).
recital 153 of the GDPR, which refers to Art. 85, reads as follows […]:
'In Member State law, the rules on freedom of expression should
and freedom of information, also by journalists, scientists, artists
learners and/or writers, with the right to protection of personal data
data are reconciled in accordance with this regulation. For processing
use of personal data exclusively for journalistic purposes or
for scientific, artistic or literary purposes, deviations should
modifications and exceptions to certain provisions of this regulation apply,
if this is necessary to exercise the right to protection of personal data
with the right to freedom of expression and information, such as
it is guaranteed in Article 11 of the Charter to reconcile. This should
special for the processing of personal data in the audiovisual field
as well as in news and press archives. Member States should
forth Legislative measures to regulate derogations and exceptions
enacted, which are necessary for the purpose of weighing up these fundamental rights
are done. Member States should make such derogations and exceptions in
reference to the general principles, the rights of the data subject, the
responsible and the processor, the transmission of personal
collected data to third countries or to international organizations that are independent
pending supervisors, cooperation and consistency and special
data processing situations. Should these deviations or
vary from Member State to Member State should the law
of the Member State to which the controller is subject. Around
the importance of freedom of expression in a democratic
27 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
Society must take into account terms such as journalism, which relate to
this liberty be construed broadly.'
First of all, it is noticeable that § 9 Para. 1 DSG contains a restriction to a certain
professional group ('classic media companies'), although Art. 85 para. 2
DSGVO such a restriction is foreign and only to a 'processing
journalistic purposes'.
The restriction to a specific professional group standardized in Section 9 (1) DSG
was in the originally planned implementation of Art. 85 Para. 2 GDPR by § 9
idF BGBl. I No. 120/2017 also not provided (cf. RV 1664 dB XXV. GP, at that time
still § 27).
The ECJ follows settled case law in relation to the former Art. 9 of the
Directive 95/46/EG - the counterpart provision of now Art. 85 DSGVO - da-
assumes that the exemptions provided for in Article 9 of Directive 95/46/EC and
Exceptions apply not only to media companies, but to anyone who
works as a journalist (cf. the judgment of the ECJ of February 14, 2019, C-345/17,
Rn 52 and the Rsp cited there).
A direct application of Art. 85 Para. 2 GDPR with non-application
of § 9 Para. 1 DSG is excluded, however, since the former provision does not
any provision, but only to the instructions addressed to the Member States
contract contains, corresponding legal provisions for certain processing situations
ations (cf. Schiedermair in Ehmann/Selmayr, data protection
Basic Regulation Comment [2018] Art. 85 margin nos. 1 and 9). Apart from that is
Art. 85 para. 2 GDPR - unlike Art. 58 para. 5, to which the ECJ has a direct
Applicability Acknowledged - Not Sufficiently Determined To
to ensure applicability (see the judgment of the ECJ of June 15
2021, C-645/19, from paragraph 106, in particular paragraph 112).
An interpretation of Section 9 (1) DSG in the light of the case law mentioned
of the ECJ would - by implication - lead to any data processing
for 'journalistic purposes' of the verification by the data
protection authority. According to the stRspdesEuGH, exceptions and
Reduce privacy restrictions to what is absolutely necessary
limit (cf. again the judgment of the ECJ of February 14, 2019, C-345/17,
Rn 64 and the Rsp cited there).
For this reason, the data protection authority - after an initially very broad
Interpretation of § 9 Para. 1 DSG (see Blocher/Wieser, Von privilege-
journalists and data in (almost) a legal vacuum, in Jahnel (ed.), Da-
data protection law. Yearbook 19 (2019), p. 314 and the case law cited there)
- in their jurisprudence to interpret § 9 para. 1 DSG 'narrower'
and thus a limited competence to deal with complaints
affirm.
28 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
A 'privilege' in the sense of the incompetence of the data protection authority can
accordingly, only certain actors, namely 'media owners, publishers,
servants and employees of a media company or media
service within the meaning of the MedienG', and only claim it if
they personal data 'for journalistic purposes of the media company
mens or Mediendiensts' process.
In other words: Only this strict double bond - namely certain
expensive and specific purpose - which is expressly provided for in § 9 Para. 1 DSG,
causes 'the provisions of this federal statute and' certain chapters
of the GDPR do not apply.
A word interpretation thus shows that § 9 para. 1 DSG is a responsibility of
Data Protection Authority not fully responsible for handling complaints
closes.
b) For data processing for journalistic purposes
Apart from that, both the CJEU and the ECtHR have certain criteria
rien developed to define journalistic activities, leading to that
not any data processing in the journalistic context also a data processing
work for journalistic purposes.
A processing of personal data for 'journalistic purposes' lies
according to the understanding of the ECJ only if the processing exclusively
has the objective of disseminating information, opinions or ideas to the general public
spread (cf. judgments of the ECJ December 16, 2008, C-73/07, para. 61, and dated
14 February 2019, C-345/17, paragraph 53). Although this Rsp. still on Art. 9
of Directive 95/46/EC, which - as already mentioned - as a pendant
consent to Art. 85 GDPR is to be understood.
It can therefore not be assumed that any (on the Internet) published
public information relating to personal data, under the
Term of 'journalistic activities' would fall and therefore for them in Art. 9 of
Directive 95/46/EG (now Art. 85 Para. 2 DSGVO) intended deviations
Exceptions apply (see again the judgment of the ECJ of
14 February 2019, C-345/17, paragraph 58).
Rather, publications must meet a minimum level of journalistic processing
exhibit. Of importance is the hurdle of minimum processing
especially for online information offers. In its jurisprudence on assessment-
sports, the German BGH has a sufficiently journalistic-editorial ni-
veau, which could justify its data protection privilege, only
then accepted 'if the opinion-forming effect for the general public
is a defining part of the offer and not just a decorative accessory'. at
the specific demarcation from when information on a website
29 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
crossing the threshold of journalism is a decision
which is to be made on a case-by-case basis using the criteria developed by the ECJ.
These are cumulative criteria and in the case of the 'no'
one of the mentioned criteria of the inapplicability of the 'media privilege'
and thus to assume that the data protection authority is responsible for what the
Data protection authority taken into account in their case law (cf. notice of
DSB of August 19, 2019, GZ DSB-D123.957/0003-DSB/2019).
c) On the (limited) competence of the data protection authority
The wording of § 9 Para. 1 DSG includes a responsibility of the data protection
hear only in the presence of the already mentioned 'double bond'.
The data protection authority therefore considers - in the absence of these prerequisites
stipulations - for the content treatment as responsible, but within the framework of
balancing the right to freedom of expression and freedom of information
Art. 11 EU-GRC or Art. 10 ECHR to be taken into account.
For this purpose, the ECtHR has developed relevant criteria that are used for this goods weighing
are to be tightened (see again the judgment of the ECJ of 14 February 2019,
C-345/17, para. 66 with reference):
- contribution to a debate of general interest,
- degree of familiarity of the data subject,
- subject of reporting,
- previous behavior of the data subject,
- Contents,
- form and impact of publication,
- way as well
- circumstances under which the information was obtained,
- correctness
This is to be illustrated using the following examples:
- The data protection authority stated in its decision of September 9, 2019, DSB-
D124.274/0007-DSB/2019, stated that a Facebook post by a fellow
worker of a media company does not fall under Section 9 (1) DSG if the
Facebook posting is written on the employee's private Facebook profile
and this Facebook posting also has no recognizable reference to the media
company. In recognition of the BVwG of November 20, 2020, W274
2224363-1/18E, this has the statements of the data protection authority on the
enprivileg confirms and records that postings by a private person (himself
if she is a journalist) who publishes on her private Facebook profile
are not included in the scope of media privilege.
- The data protection authority also explained itself in this sense in its decision
of December 2, 2019, DSB-D124.352/0003-DSB/2019 (RIS), for the decision
30 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
about the production of photographs of a police official act and
the subsequent publication of these recordings on a private Facebook
book account because there was no 'double bond' in the above sense.
- Furthermore, the data protection authority held in its decision of 19 February
2021, D124.3022, 2021-0067945, states that for attribution of a posting
to the media company a necessary connection with the journalistic
cal activity is to be assumed and this is therefore not available when postings
completely without journalistic control and editing and solely from your own
Drive the user to be published.
- In the notification of December 18, 2019, DSB-D123.768/0004-DSB/2019 (RIS).
the data protection authority stated that the fact that a Facebook
site is maintained by a media worker from a political party
inevitably leads to processing for journalistic purposes. Because that
The aim here is not the content of the medium, but much more
extensively influencing state decision-making through political activity
senior In this context, media activity can therefore only be viewed as a 'ne-
'phenomenon' in the course of the intended achievement of these goals
will.
- Also the note that an editor no longer works for a media company
company may be of 'interest' to individual readers and in
of a person's natural 'curiosity', but must under no circumstances
be mistaken for a certain 'interest in a certain topic' and
therefore does not fall under 'processing for journalistic purposes' (cf. the
Decision of the Data Protection Authority of February 19, 2021, D124.3022, 2021-
0,067,945).
-In this context, the BVwG in its finding of December 15th
2021, W176 2245370-1, already stated that rating platforms
do not fall under the term 'journalistic purposes'.
It also follows from the above statements that § 9 Para. 1 DSG does not include a total
exclusion of certain rights and the competence of the data protection authority
works.
Ultimately, the legislature itself seems to have a 'residual responsibility' for the data
protection authority than is stated in the last sentence of Section 9 (1) DSG,
that 'the Data Protection Authority, when exercising its powers vis-à-vis the im
persons mentioned in the first sentence the protection of editorial secrecy (§ 31
MediaG) to be observed'. However, the legislature assumed that
that no competence of the data protection authority within the scope of § 9
Para. 1 DSG existed, the last sentence of Para. 1 would be completely meaningless, what the
However, the legislature cannot be assumed.
This can be confirmed in particular from the overall constellation of Section 9 (1).
DSG. In the first sentence, both the jurisdiction and the powers of the
Data Protection Authority under the conditions of application explained above
31 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
excluded and therefore the second sentence can logically only be based on those
refer rich, in which the 'media privilege' does not apply
comes.
The BVwG also seems to have followed this view by
trag points out that 'the last sentence of § 9 paragraph 1 DSG assume
seems that the data protection authority is very comfortable with complaints against
Media companies and owners have powers.'
d) On previous case law of the Constitutional Court
The Constitutional Court has already in its decision of 8 October
2015, G 264/2015, with the - with § 9 Abs. 1 DSG comparable - § 48 DSG 2000
(Federal Law Gazette I No. 165/1999 as amended to Federal Law Gazette I No. 132/2015).
In this regard, the Constitutional Court has stated that 'even with a [...]
extensive area of application of § 48 DSG 2000 […] the standard therein
Media privilege [...] not all cases of communications protected by Art. 10 ECHR
tion and freedom of information[recorded].[…]There[are]case constellations in which
- in the absence of applicability of § 48 DSG 2000' - thus the simple legal
provisions of the DSG 2000 apply.
The data protection authority does not overlook the fact that the said decision
basically the unconstitutionality of § 28 para. 2 DSG 2000
and § 48 DSG 2000 was only peripherally affected.
Nevertheless, the Data Protection Authority takes the view that in the
mentioned knowledge is expressed with sufficient clarity that § 48
DSG2000 through exceptional case constellations, in which the simply statutory
Provisions of the DSG 2000 - and thus also the provisions on the
authority of the data protection commission/data protection authority – to apply
ten.
Thus, the Constitutional Court went from a limited jurisdiction
the Data Protection Commission/Data Protection Authority within the framework of media privacy
lay out
In the opinion of the data protection authority, these considerations are based on Section 9 (1) DSG
transferable.
e) Summary considerations
In summary of what has been said, the data protection authority therefore represents the
view that § 9 para. 1 DSG cannot be qualified a limine as unconstitutional:
A lack of competence of the data protection authority to handle complaints
according to § 24 DSG in conjunction with Art. 77 DSGVO because of an alleged violation in
32 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
The right to secrecy according to § 1 Para. 1 DSG therefore only exists if
personal data used by certain actors for certain purposes
be worked. § 9 DSG is therefore doubly narrower than the specification of the
DSGVO (cf. Forgó, data protection assessment of publicly accessible
Evaluation platforms of teachers using the example of 'learning victory',
2020, p. 15). The privilege is thus technology-neutral and can be dynamic
Developments in the market including newly created journalistic offers
(cf. [Forgó], ibid., p. 21).
A competence of the data protection authority is to be affirmed if this prerequisite
not apply (e.g. processing of personal data in the
men of an Internet blog operated by a private person, etc.).
A competence of the data protection authority is also to be affirmed if the
processing of personal data takes place in a context that is not considered 'journal
nalistical activity' can be viewed (e.g. subscription management).
It can therefore not be said that § 9 para. 1 DSG the assertion of the
Fundamental right to data protection according to § 1 DSG before the data protection authority
'[undercuts]'.
3.2. Regarding the concerns regarding the principle of equality according to Art. 2 StGG
and Art. 7 B-VG
As the BVwG explains, the objectivity check of laws aims at
evaluation of the relation of the facts covered by a regulation to the
legal consequences. If there are different regulations, a nor-
to carry out a comparison, it must be asked whether the
Facts are so different that they have different legal consequences
able to 'carry' (VfSlg. 16.635/2002, 17.309/2004).
Within these limits, however, the legislature is constitutionally free to do so
not prevented from adapting his political objectives to those he deems appropriate
to be pursued in this way (cf. VfSlg. 13.576/1993, 13.743/1994, 15.737/2000,
16.504/2002).
From the point of view of the principle of equality, it is therefore not possible to judge whether
a regulation is expedient or whether it is the optimal way to achieve the goal
is taken (cf. VfSlg. 11.288/1987), but it is subject to the legislature
to oppose the aspect of the principle of equality only if this
when determining the means to be used, the constitutional ones
exceeds barriers. This is particularly the case when he
The principle of equality violates the resulting objectivity requirement, so if he to
goal attainment provides completely unsuitable means or if the provided ones
appropriate means to an objectively unjustifiable differentiation
ren (cf. e.g. VfSlg. 12.227/1989).
33 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
In the light of the case law of the Constitutional Court, it is the legislature
But also not prevented from making simple and easily manageable regulations,
serving administrative economy (cf. VfSlg. 9645/1983 and 11.775/1988).
The legislature may use an average
go out and typify his regulations (cf. VfSlg. 11.469/1987
and 13.726/1994).
In the opinion of the data protection authority, however, in the present case there are very
factual reasons that justify a differentiation:
§ 9 para. 1 DSG privileges 'classic media' (in the sense of 'institutionalized
Form 'of freedom of expression') to the effect that the ordinary legal
Provisions of the DSG and certain chapters of the GDPR - and thus the
permanent of the data protection authority - do not apply.
From the point of view of the principle of equality, it must therefore be assessed whether this difference
differentiation between 'classical media' and 'other media' justified
is.
a) On the case law of the Constitutional Court
The Constitutional Court itself, in its decision of March 4, 2021,
GZ E 4037/2020, referring to the 'special importance' of the 'classic media'
reported, because in a democratic society they have the role of a 'guard
dogs' come.
It follows, according to the DPA, that due to the role that
'classical media', a privilege in the sense that the processing
processing of personal data is not under the control of the data protection
authorities - but only the courts - is quite objectively justifiable
may be necessary.
b) On the historical development of 'media privilege'
Furthermore, it corresponds to the historical will of the legislature to
legal matters exclusively to the MedienG - and thus the judicial
chen jurisdiction – to submit:
The 'media privilege' was in its original version in Section 54 of the Data Protection Act
zes, Federal Law Gazette No. 565/1978. In the stenographic record of the 104th session
of the National Council in the XIV legislative period on October 18, 1978
is stated in this regard:
'First, we limit the effectiveness of the Data Protection Act to the
version of this law for the media and we say something else: But
this media privilege, which only applies until a media law is passed
34 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
only apply to companies that are dedicated exclusively to media purposes
men' (p. 36).
The Committee Report 1978, 1024 dB XIV. GP, states the intention that
during the deliberations on the government bill for a media law, the
ken of data protection would receive due attention.
In the stenographic protocol of the 91st session of the National Council in the XVI. sex
legislative period on May 22, 1985, the media privilege is as follows
passage:
'We have the media privilege in passing the Data Protection Act
granted, a so-called media privilege. We said: Yes, the basic right of the
Data protection, the human right standardized by the Council of Europe, is intended for
the media already apply, but otherwise the media legislator in the media
setindividualruleshowitshouldappearinthemediaarea.Andhavethat
we then overlook. Therefore, the media are exempt from the fundamental right, and
there are no special regulations for this in the Media Act. […] I believe that
was a mistake by the legislature, and it actually raises a characteristic
light on the situation.' (p. 51).
Incidentally, the stenographic minutes of the 151st session of the National
nalrates in the XVI. Legislative session on June 27, 1986 on media privilege
the following passage:
'I'll just give the example of the Media Act. We have the Data Protection Act
decided and said that for the media sector only the constitutional
apply, we leave the simple legal provisions to the
enlegislators, the media law should regulate that. Then what happened? - We
have mutually agreed on the regulation of data protection in the Media Act
waives! Therefore, there is now a media privilege in Austria, and it says that
data protection for the media sector only with its constitutional provision
applies, nothing else' (p. 33).
From a synopsis of the materials it can be concluded that
the historical legislator the matter of the (classical) 'media' as well as the
with associated data protection regulations only the MedienG
wanted to submit.
c) Jurisdiction
The data protection authority does not overlook the fact that an action is probably not based on Art. 79
DSGVO could be supported because § 9 Abs. 1 DSG expressly certain ca-
chapter of the GDPR, in particular Chapters II and III, and thus the assumed
called court the standard of assessment for an alleged violation of
GDPR would be withdrawn.
35 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
However, this does not change the fact that a legal protection option after
MedienG in connection with § 1 DSG or merely based on § 1 DSG and a
affected person is not completely unprotected.
In particular, it is pointed out that a civil law injunction
according to the judicature of the OGH always directly to the immediately applicable
Constitutional provision of § 1 para. 1 DSG can be supported (cf.
6 Ob 148/00h; 9 ObA 73/03f; Ennöckel, The protection of privacy in the electronic
electronic data processing[,] 211).
Furthermore, the OGH - with regard to § 48 DSG 2000 - expressly
said that despite the broad wording of this provision, a
there is legal jurisdiction to assert claims and § 48
DSG 200[0] must therefore be 'teleologically reduced' (decision of 17 January
ner 2018, 6 Ob 144/17w).
These considerations can be transferred to § 9 Para. 1 DSG:
Accordingly, in cases in which the data protection
authority exists, in any case a jurisdiction of the civil courts.
The third section of the MedienG in particular contains provisions on personal
privacy protection. These provisions, which, among other things, in § 7 regulations for
'Violation of the highly personal sphere of life' as well as in § 7a the
'Protection against disclosure of identity in special cases', can
here at least as a kind of 'special data protection law' and as a (further) outflow of the
§ 1 para. 1 DSG.
Thus, the provisions of the Media Act for the interpretation of § 1 DSG can
get dressed by.
This results in particular from the repeatedly mentioned 'interests worthy of protection
eat' of the person concerned and does not allow any other conclusion than that it
it is an explicitly ordered balancing of interests that forms the basis for
offers a balance between Art. 8 and Art. 10 ECHR (more on this in Rami
in Höpfel/Ratz, WK MedienG § 7).
But also the assertion of other civil law provisions - in particular
special according to the ABGB - in conjunction with § 1 DSG comes into consideration.
Likewise, the exclusive possibility of appeal to a court appears in the
In the event of data processing by 'media owners, publishers, media staff
Workers and employees of a media company or media service in
within the meaning of the MedienG for journalistic purposes of the media company or
Mediendiensts' by no means as unobjective.
36 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
On the one hand, civil law regulations, in particular the MedienG, allow a
comprehensive weighing of interests, which includes the fundamental right to data protection
pulls.
On the other hand, a court of jurisdiction in media matters can
could hardly be accused of state censorship, which, however,
a responsibility of a - albeit independent and free of instructions -
administrative authority such as the data protection authority would be entirely conceivable.
A claimed 'lack of redress' for those narrow areas that
Prerequisites for the applicability of the 'media privilege' are accordingly
in the opinion of the data protection authority, while maintaining the current
mood at least not apparent.
In addition, it is pointed out that the (rudimentary) data subject rights on
Information, correction and deletion, as provided for in Section 1 (3) DSG,
are in any case not excluded by § 9 DSG (cf. Ehrnberger, Das
Media privilege: Media companies between data protection and information
freiheit, jusIT 2018, 148 (149)) and can therefore be asserted in court
be able.
Therefore, the assertion of the fundamental right to data protection is also within the scope
of media privilege secured.
Furthermore, it must not be overlooked that the procedure before a civil
court - in comparison to the official procedure - definitely for the person concerned
person can be beneficial:
- While the data protection authority only based on the GDPR and the DSG
can divorce, there is no such restriction in courts. § 227 ZPO allowed
tet - subject to the conditions - that multiple claims are asserted in one action
can be made (cf. Schmidl, The dual legal protection in data
protection matters, VbR 2020/104). In this regard, for example, when taking pictures or
Evaluation platforms the general right of personality according to § 16 ABGB, Eh-
Ren insult and damage to reputation according to §1330 ABGB as well as the right to your own
Image under § 78 UrhG under consideration. In addition, any claim for damages
replacement (see Art. 82 GDPR) only in the civil court at the same time as an
requests for release are asserted [...] (cf. Jahnel, comment on the
General Data Protection Regulation, Art. 79 GDPR). In particular, this looks forward
the mere determination competence according to § 24 DSG an extended one
area of legal protection.
- A civil court procedure is always associated with a risk of costs
However, the prevailing party has a comprehensive claim in accordance with § 41 ZPO
for reimbursement of costs by the opposing party (cf. Schmidl, Der double tracked
Legal protection in data protection matters, VbR 2020/104).
37 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
- Unlike the DSG, the ZPO knows the legal institution of the comparison in §§ 204 f
ZPO, which a comprehensive settlement of the legal dispute, including the
Bearing the costs, enables and according to § 1 Z 5 EO also an execution title
provides (Schmidl, The dual legal protection in data protection matters, VbR
2020/104).
- It is true that from a value in dispute of more than EUR 5,000 and before the court
1st instance absolute obligation to have a lawyer (§ 27 Para. 1 ZPO), which involves costs
is bound, however, legal representation can also prove to be advantageous
point. Unlike in proceedings under the AVG, the following applies in proceedings under the ZPO
namely the maxim of the parties, so that only what is used by the courts is used in court
parties and offered as evidence. Also exists on the part
of the court in these proceedings no (extended) obligation to Manudu-
tion (§ 182a vs § 432 ZPO). Lawyers can therefore, by virtue of their training and
their professional obligations (§ 9 Abs. 1 RAO) tend to follow these requirements
come as unrepresented and legally ignorant parties. A representation by
a lawyer can also make a significant contribution to an efficient
lead the race. Also not to be neglected is the fact that
as a rule, lawyers are better 'trained' for civil court proceedings than for
the procedure before an administrative authority (cf. Schmidl, Der doppelgleisige
Legal protection in data protection matters, VbR 2020/104).
In summary, it can therefore be stated that, even if the civil court
procedure is associated with costs and risk, it is due to the above considerations
which cannot yet be regarded as irrelevant, this burden affects
to hand over to a person.
d) The competence of the data protection authority is generally not absolute
The competence of the data protection authority – also and especially under disregard-
solution of 'media privilege' – is by no means unrestricted.
For example, Art. 55 Para. 3 GDPR provides that the 'supervisory authorities [...] shall not
constantly [are] responsible for the supervision of courts in the context of their judicial
activity carried out' and enables precisely Art. 85 para. 2
an exception of Chapter VI (Independent Regulatory Authorities).
In view of the latest developments, reference is made in this context to
Current preliminary ruling requesting Administrative Court of 14 January
ner 2022 in case C-33/22. In this case,
approached the ECJ with the following preliminary question:
1. Concerns activities carried out by a Parliament of a Member State
committee of inquiry set up by his right to control
depending on the object of investigation in the scope of the Union
right within the meaning of Art. 16 (2) first sentence TFEU, so that the Regulation (EU)
38 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
2016/679 (1) on the processing of personal data by a parliament
mental committee of inquiry of a Member State is applicable?
If question 1 is answered in the affirmative:
2. Concerns activities carried out by a Member State Parliament
committee of inquiry set up for his right to control the execution,
of the activities of a police state security authority, thus the protection of
activities related to national security within the meaning of recital 16
the General Data Protection Regulation has as the object of investigation, under the
Exception in Article 2(2)(a) of this regulation?
If question 2 is answered in the negative:
3. If - as in the present case - a Member State has only one single supervisory authority
according to Art. 51 Para. 1 of the General Data Protection Regulation
their responsibility for complaints within the meaning of Art. 77 Para. 1
with Art. 55 Para. 1 of the General Data Protection Regulation already directly from this
this regulation?
It is therefore also fundamentally disputed whether the data protection authority in the event of alleged violations
Last, which are attributable to the state power 'legislature', are invoked
can.
With regard to the DSG 2000, the Constitutional Court has already
kennVfSlg.15.130/1998 clarified that his responsibility of the data protection
Commission under no circumstances vis-à-vis the legislature and its auxiliary bodies
stands (cf. also decision of the Constitutional Court of October 3, 2013; B 683/2013) and
a legal recourse to the data protection commission (or another authority)
is excluded (cf. VfSlg. 19.112/2010).
Apart from that, § 32 DSG 2000 already saw no limitless jurisdiction
area of the data protection commission/data protection authority:
affected person generally alleged violations of the DSG 2000 - with
exercise of the right to information – vis-à-vis a client of the private
area before the ordinary courts [enforce ], resulting in a
resulted in a much greater restriction of legal protection than in Section 9
Para. 1 DSG is currently the case.
In summary, it can therefore be stated that even the DSG 2000
No comprehensive competence of the Data Protection Commission/Data Protection
heard. The GDPR does not provide for this either.
Also from Art. 8 EU-GRC no comprehensive competence of the supervisory
derive authority.
39 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
e) On the legal situation in other Member States
In addition, it is pointed out that such an exclusion of the
consistency of the supervisory authorities in accordance with Art. 85 GDPR also from other members
member states has been implemented.
In order to be able to create a comparison, the objective combination
initially referred to the German legal enactment. So the da-
data protection laws of the German federal states - the legal competence for this
are responsible - for example the following provisions:
- Bavarian [Data Protection Act] (BayDSG):
Art. 38 Processing for journalistic, artistic or literary purposes
Purposes (to Art. 85 GDPR)
(1) If personal data is used for journalistic, artistic or li-
processed for teric purposes, the data subjects are only entitled to the
Para. 2 rights mentioned. For the rest, the processing within the meaning of Art
Sentence 1 Chapter I, Art. 5 Para. 1 Letter f, Art. 24 and 32, Chapter VIII, X and XI
GDPR. Art. 82 GDPR applies with the proviso that only for insufficient measures
according to Art. 5 Para. 1 Letter f, Art. 24 and 32 DSGVO.
(2) Does the journalistic, artistic or literary processing of personal
personal data for the dissemination of counter-notifications, for
declarations, judicial decisions or revocations, are these to the
stored data to keep there for the same length of time as the
data itself and in the case of a transmission of the data together with this
average
- Law on the protection of personal data in the Berlin administration (Berlin
ner data protection law - BlnDSG):
§ 19 Processing of personal data for purposes of freedom of expression
expression and freedom of information
(1) Insofar as personal data are processed in exercise of the right to freedom of expression
freedom of expression and information on journalistic, artistic or literary
ric purposes, including lawful processing based on
Sections 22 and 23 of the law relating to copyright in works of the visual arts
arts and photography in the Federal Law Gazette Part III, classification
number 440-3, revised version published, last amended by Article 3
§ 31 of the law of February 16, 2001 (BGBl. I p. 266) has been changed,
work, apply from Chapters II to VII and IX of the Regulation (EU)
2016/679 only article 5 paragraph 1 letter f and article 24 and 32. article 82 of
Regulation (EU) 2016/679 applies with the proviso that liability only damages
40 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
includes, through a violation of data secrecy or through inadmissible
sufficient technical or organizational measures within the meaning of Article 5
Paragraph 1 letter f of Regulation (EU) 2016/679.
(2) Leads to the processing of personal data in accordance with paragraph 1 sentence 1
Dissemination of counter-statements by the data subject or to
declarations, resolutions or judgments on the omission of the dissemination
tion or about the revocation of the content of the data, these are among the stored
ten data and keep it there for the same length of time as the
to transmit data itself, and when transmitting the data together.
- Hessian Data Protection and Freedom of Information Act (HDSIG):
§ 1 Scope
(1) The provisions of this law, with the exception of Section 28, do not apply
notification, insofar as Hessischer Rundfunk uses personal data for journalistic
processed for public purposes.
Similar provisions can be found in
- Data protection law for the state of Mecklenburg-Western Pomerania (state data protection
law - DSG M-V) and in the
- Law on the protection of personal data in the state of Brandenburg (Branden-
Burgisches Data Protection Act - BbgDSG)
At the same time, Art. 11 of the Bavarian Press Act standardizes regulations on
protection of personal data and the possibility of a complaint
Art. 77 GDPR to the institutions of voluntary self-regulation (and thus
not to the supervisory authority according to the GDPR).
Something similar is in § 22a of the Berlin Press Act and § 10 of the Hessian Press
provided for by law, however without express reference to the legal
protection options.
The comparison with the German legal situation shows that it is by no means unusual
is, in the respective data protection laws no responsibility of the data
protection supervisory authorities and parallel to this in the respective press
laws to standardize corresponding protective provisions.
The Dutch Data Protection Act ('Act of 16 May 2018 with Enforcement
provisions of Regulation (EU) 2016/679 of the European Parliament
and of the Council of 27 April 2016 on the protection of natural persons in the
processing of personal data, free data movement and cancellation
of Directive 95/46/EG (General Data Protection Regulation) (OJ EU 2016, L 119)
(General Data Protection Regulation)') contains Art. 43 the following regulation [in-
formal translation of the data protection authority]:
41 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
Exceptions for journalistic purposes or academic, artistic or
literary forms of expression
(1) With the exception of Articles 1 to 4 and 5 paragraphs 1 and 2, this Act does not apply
for the processing of personal data to exclusively journalistic
purposes and for the benefit of academic, artistic or literary
shear forms of expression.
(2) The following chapters and articles of the regulation do not apply to the processing
processing of personal data for purely journalistic purposes and for academic
mixed, artistic or literary forms of expression:
a. Article 7(3) and Article 11(2);
b. CHAPTER III;
c. Chapter IV, with the exception of Articles 24, 25, 28, 29 and 32;
i.e. CHAPTER V;
e. CHAPTER VI; and
f. CHAPTER VII.
(3) Articles 9 and 10 of the Regulation shall not apply to the extent that the
processing of the data referred to in these articles for journalistic purposes or
required for academic, artistic or literary expression
is.
The Irish 'Data Protection Act 2018' provides in its Section 43 the following provisions
statement before [informal translation of the data protection authority]:
Data processing and freedom of expression and
Freedom of Information
(1) The processing of personal data for the purpose of exercising the
Right to freedom of expression and information, including processing
for journalistic purposes or for purposes of scientific, artistic
eral or literary expression, is subject to compliance with a
mentioned provision of the data protection regulation except if the
Compliance with the provision given the importance of the right to free speech
expression of opinion and information in a democratic society with these
purposes would not be compatible.
(2) The provisions of the data protection law mentioned for the purposes of paragraph 1
Regulation are Chapter II (Principles), with the exception of Article 5(1).
Letter f, Chapter III (Rights of the data subject), Chapter IV (Responsibility
chers and processors), Chapter V (Transfer of personal data
to third countries or international organizations), Chapter VI (independent
supervisory authorities) and Chapter VII (Cooperation and coherence).
(3) […]
Accordingly, this international comparison also confirms that the
Exclusion of the competence of the supervisory authority is outdated and thus
subject to objective justification […].
42 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
A violation of the principle of equality is therefore in the opinion of the data
protection authority not visible.
3.3. On concerns about the right to a statutory judge
(Art. 83 para. 2 B-VG)
The right to a procedure before the statutory judge is determined by the decision
of an administrative authority if the authority violates a
coming jurisdiction claims (e.g. VfSlg. 15.372/1998,
15.738/2000, 16.066/2001, 16.298/2001 and 16.717/2002) or if they are
unlawfully rejects their jurisdiction, for example by wrongly accepting a
Substantive decision refused (e.g. VfSlg[.]15.482/1999,15.858/2000,16.079/2001
and 16.737/2002).
This constitutional norm binds not only the enforcement, but also the
giving. This means that the substantive jurisdiction of an authority in law
must be determined (cf. decision of the Constitutional Court of September 25, 2020,
G 222/2020). The legislature has to ensure that one thing is not both
can be dealt with by the court as well as by an administrative authority (cf.
Decision of the Constitutional Court of June 19, 1989, B 1874/88).
Jurisdiction shall not depend on circumstances
unforeseeable and an arbitrary change of jurisdiction
(VfSlg. 14.192/1995; VwGH October 4, 2018, Ro 2018/22/0001). the
Boundaries must be clearly and unambiguously recognizable for them (VfSlg. 19.991/2015
regarding legal protection in the field of criminal police; Muzak, B-VG Art. 83, margin no. 3).
Basically, 'shared' responsibilities are unproblematic in the sense that the
legislature in a particular matter part of a procedure of the
one and the following part of the procedure by another administrative authority
authority (or a court) can be carried out (VfSlg. 4693/1964). So there is
In other words, because of Art. 83 Para. 2 B-VG even then no right to that
the legislature a single authority to decide on a particular
circumstances of life if he is under the jurisdictional perspective
points would be possible (cf. Zußner in Kahl/Khakzadeh/Schmid, commentary on
Federal constitutional law B-VG and fundamental rights Art. 83 B-VG, margin no. 13).
As the BVwG explains, if there is a 'double bond' in § 9 Para. 1 DSG
no competence of the data protection authority.
A civil court jurisdiction to assert the fundamental right to data
However, data protection is given, as explained above.
In the opinion of the data protection authority, the regulation of the (in)competence of
Data protection authority in § 9 para. 1 DSG also foreseeable and factually concrete
compared to the jurisdiction of the civil courts. This also illuminates an
international comparison as above.
43 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
3.4. Regarding the concerns regarding 'Art. 8 EU GRC'
Art. 8 EU-GRC guarantees the data subject the protection of those concerned
personal data and provides that compliance with these regulations
is monitored by an 'independent body'.
However, this does not mean that Art. 8 EU-GRC creates a comprehensive
ability of the supervisory authorities can be derived: Whether namely from the order
8 Para. 3 EU-GRC an objective legal component of the data
protection or (beyond the organizational-legal character of the regulation)
an institutional guarantee results, given the abstract formulation of the
Para. 3 unclear (cf. Riesz in Holoubek/Lienbacher, GRC comment Art. 8, para. 80).
A synopsis with Art. 52 Para. 1 EU-GRC also makes it clear that from
Art. 8 para. 3 EU-GRC can be deviated from.
It is pointed out that Art. 8 EU-GRC does not go beyond the constitutional
mood of § 1 DSG has protective content (cf. the dg. cognition
of September 29, 2012, B 54/12 etc.) and the wording of Art. 8 Para. 3
[EU-GRC] it also cannot be inferred that a right to treatment of
by a subordinate agency (cf. Riesz in Holoubek/Lienba-
cher, GRC comment Art. 8, para. 81).
Art. 51 f GDPR (in a legally unifying manner) now regulates the
dependency of the supervisory authorities at member state level and in de-
the judicature of the ECJ that specifies this postulate, which in particular
particular in explicit congruence with Art. 8 Para. 3 EU-GRC (cf.
2
Riesz in Holoubek/Lienbacher, GRC comment Art. 8, para. 78).
In this context, reference is again made to what was said above (item 3.2.).
grasslands.
4. Summary
According to the data protection authority, Section 9 (1) DSG is currently in force
Version accessible to a constitutional interpretation. In particular is
no complete exclusion of the competence of the data protection authority.
An exclusive jurisdiction of the ordinary courts according to § 1 DSG in
scope of § 9 para. 1 DSG in those cases in which no jurisdiction
given by the data protection authority, is not to be regarded as irrelevant and can
moreover no violation in the right of the legal judge and in view
be seen on Art. 8 EU-GRC."
44 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
7. In the Ver- 17
drive returned the data protection authority a statement in which they first on
the statement just reproduced in the proceedings G 287/2022. dar
In addition, the DPA carries out the following (without the original
included highlights):
"Since one of the parties involved is a legal entity [...]
delt, the following is added:
The Union law provisions on the protection of personal data
(Art. 8 EU-GRC, Art. 16 TFEU and the GDPR) only apply to the processing
processing of personal data of natural persons. Legal persons
are only protected insofar as their designation is the name of a natural
person appears (see the judgment of the ECJ of November 9, 2010,
C-92/09 and C-93/09, margin nos. 52 and 53).
This is not the case with the legal entity with the company […].
Consequently, it cannot rely on the protection of Art. 8 EU-GRC and the GDPR
and disregard considerations under Union law in this regard
to stay.
It is therefore a matter that exclusively belongs to the Austrian
is subject to national law.
3. Since § 1 DSG does not distinguish between natural and legal persons
separates, a legal entity is still protected within the scope of § 1 DSG.
As explained in the initial decision, the data protection authority takes the view that
that within the scope of § 9 Para. 1 DSG, considered in the light of § 1 DSG,
even if it is a case that is not covered by Union law
is recorded, nevertheless no responsibility for the treatment of complaints
of ristic persons (emphasis in the original):
D.1. For the application legitimacy of legal entities
[...]
According to the will of the legislature, the simple statutory provisions
of the DSG, including the complaint according to § 24 DSG, therefore on the protection of
limited to natural persons.
However, the data protection authority has already stated several times that § 1
DSG also protects legal persons. An interpretation of the ordinary law
Provisions - in particular §§ 4 and 24 DSG - to the effect that only natural
45 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
persons the possibility of lodging a complaint before the data protection
authority, but not to legal persons, would
against the background of § 1 DSG an equal and thus incompatible
impute unconstitutional content. The legislature cannot
that this is a legal entity without any comprehensible reason
in pursuit of their constitutionally guaranteed rights
wanted to treat grossly disadvantageously differently than natural persons (see the
Scheid from May 25, 2020, GZ 2020-0.191.240, with further reference).
That it is possible for the national legislature to adopt a purely national concept of
Protection of personal data of legal entities has been
ECJ affirmed (judgment of December 10, 2020, C-620/19, margin no. 47), so that the above
The case law of the data protection authority does not conflict with this.
As a result, this means that legal persons - to the extent of them through
§ 1 DSG granted rights - are entitled to complain.
However, in order not to impose any unequal and therefore unconstitutional content under § 1 DSG
the data protection authority can exercise its jurisdiction over legal
only to the extent that you perceive natural
certain persons in the same circumstances. § 1 DSG cannot
be interpreted in such a way that the data protection authority can
of persons has to deal with in terms of content, those of natural persons with the same
Chem facts, however, not. This would result in a non-objective justifiable
Better position of legal entities and thus § 1 DSG an equal
impute inappropriate content.
As a result, it can be stated that the second complainant as a legal
cal person is in principle actively legitimized, a complaint under Section 24
GDPR before the data protection authority if they claim a violation of the
§ 1 DSG guaranteed rights asserted, but only to the extent to which
chem this would also be possible for a natural person.
D.2. On the Competence of the Data Protection Authority and 'Media Privilege'
On the processing of personal data by media owners, he-
Publishers, media workers and employees of a media company
or media service within the meaning of the MedienG for journalistic purposes of media
The company or media service find the provisions in accordance with Section 9 (1) DSG
provisions of the DSG and of the GDPR Chapter II (Principles), III (Rights of the
data subject), IV (responsible person and processor), V (transmission
transfer of personal data to third countries or to international organizations
onen), VI (Independent supervisory authorities), VII (Cooperation and coherence)
and IX (Regulations for Special Processing Situations) do not apply.
Due to the explicit exclusion of the application of the provisions of
Chapter III GDPR ('Rights of data subjects') also applies to the exercise of the right
46 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
Deletion in accordance with Art. 17 GDPR and the exercise of the right to information
according to Art. 15 DSGVO not considered. Legal protection is due to this legal
only according to the provisions of civil law (in particular according to the
enG) possible.
Since § 9 DSG is a simple statutory provision of the DSG,
which, according to the clear wording of § 4 DSG, is not limited to legal persons
is to be applied, it seems at first that the media privilege in connection
dealings with legal persons - thus for the second complainant -
would not apply. In this regard, the data protection
but listen to the explanations under point D.1. As can be seen in this
the explanations given in this point opens up the possibility of de-
Aggravation of legal entities only from an equality conclusion
with natural persons. But if the data processing of the complainant
ners falls under the 'media privilege' and the data protection authority is therefore not responsible
responsible for the decision, then it cannot make any difference whether a
complainant is a natural person or [a legal] person. A lot of-
the data protection authority is therefore incompetent because the data processing
of the Respondent falls under the media privilege."
8. The - as a respondent in the proceedings before the Federal Administrative 18
judge - party involved in the number at the Constitutional Court G 287/2022
recorded proceedings made the following statement (without the original
included highlights):
"A. On the facts
[…]
B. On the application of the Federal Administrative Court
1.
The Federal Administrative Court is of the opinion that Section 9(1) of the Data Protection Act is
unconstitutional. Therefore, an application is made to the Constitutional Court
repeal that provision as unconstitutional.
2.
Contrary to the opinion of the Federal Administrative Court, Section 9 (1) DSG is one
accessible to constitutional interpretation:
[...]
In the opinion of the data protection authority (see the in the present
Proceedings for the first application of the Federal Administrative Court
of the data protection authority of July 26, 2022, page 4 ff) - does not leverage § 9 para. 1 DSG
47 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
the (constitutional) fundamental right to data protection within the framework of the
Media privileges completely off. We agree with this view. Thus is
also in the area of application of the media privilege from a restricted access
consistency of the data protection authority according to § 24 DSG.
3.
A lack of competence of the data protection authority to handle complaints
according to § 24DSGiVmArt77DSGVO because of an alleged violation of the law
secrecy according to § 1 paragraph 1 DSG only exists if personal
gene data are processed by certain actors for certain purposes
the:
to the privileged actors:
A lack of competence of the data protection authority can only 'media owners,
Publishers, media workers and employees of a media company
or media service within the meaning of the Media Act' (see also
Application of the Federal Administrative Court W214 2235037-1/21Z of November 3rd
2022, page 24).
for the privileged purposes:
The actors mentioned above are only privileged if they have the personal
data 'for journalistic purposes of the media company or media
process services'.
5.
Therefore, it is not true that Section 9 (1) DSG enshrines the fundamental right to data protection
§ 1 DSG factually undermined (however, according to the application of the Federal Administrative Court W214
2235037-1/21Z of November 03, 2022, page 15).
6.
Art83Abs2B-VG standardizes the right to a procedure before the statutory
ter (the Federal Administrative Court also refers to this in its application W214
2235037-1/21Z of November 03, 2022 on page 20). The Bun
However, the administrative court fails to recognize that legal protection during processing
of personal data by 'media owners, publishers, media
workers and employees of a media company or media service in the
Within the meaning of the MedienG (...) for journalistic purposes of the media company
or media services', even without the competence of the data protection authority
is entirely excluded. Rather, there is a legal protection option
according to the MedienG in conjunction with § 1 DSG and thus a court of jurisdiction (see
again the in the present procedure for the first application of the federal administration
statement by the data protection authority of July 26, 2022, reported to the court,
page 14ff).
48 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
Conclusion:
➢ A lack of competence of the data protection authority to deal with complaints
according to § 24 DSG in conjunction with Art 77 DSGVO because of an alleged violation
the right to secrecy according to § 1 para. 1 DSG is correct
when personal data is processed by certain actors ('media
owners, publishers, media workers and employees of a media
company or media service within the meaning of MedienG').
purposes ('for journalistic purposes of the media company or media
service') are processed.
➢ The exclusive jurisdiction of the ordinary courts according to the
enG in conjunction with § 1 DSG within the scope of § 9 Para. 1 DSG in those cases in
which the data protection authority has no jurisdiction is not considered
unobjective."
9. The - as a complainant in the proceedings before the Federal Administrative Court - 19
parties involved in the number G 288/2022 pro-
tocollated procedures returned the following statement (without the in the original
included highlights):
"1. Facts
[...]
2. Application of the Federal Administrative Court
The BVwG followed the suggestion of the complainants and for its part brought the following
serious concerns about the constitutionality of Section 9 (1) DSG
Before:
− The fundamental right to data protection according to § 1 Para. 1 DSG is enforced by the media
privilege effectively undermined because a person concerned has no national
supervisory authority is available to assert a violation of the fundamental right
more correctly, a national supervisory authority for the treatment
be responsible for handling complaints against media companies. Any deviating
The relevant legal situation would be in conflict with Art. 8 ECHR, Art. 8 para. 1 GRC and
Article 16 (1) TFEU.
−Due to the media privilege, the data protection authority could
gen media companies do not meritically decide what the right to a
procedure before the lawful judge. This also violates the provisions of Article 8
Para. 3 GRC securitized institutional and the legal
protection guarantee.
49 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
− The institutional guarantee of Art. 8 Para. 3 GRC is also violated by the fact that
the data protection authority does not make use of its remedial powers
can.
− The media privilege violates the principle of equality because there are no objective reasons
can be seen, access to the data protection authority and the civil courts
to refuse data processing by media companies across the board.
The BVwG thus recognizes several reasons for an incompatibility of § 9 paragraph 1
DSG with the Federal Constitution. The complainants agree with this legal view
and subsequently add the following to the arguments of the BVwG
the end:
3. Regarding the prejudice of § 9 para. 1 DSG in the present case
Do the complainants succeed in their legal view that the media
vilegal is to be repealed as unconstitutional, this is not to be applied, so that the
Authority responsibility would lie with the data protection authority and the BVwG
to revoke the rejection notice as part of the notice of appeal
would have.
On the other hand, the Constitutional Court sees this in the provision of Section 9 (1) DSG
no constitutional incompatibility if the legal view of the data
protection authority regarding the lack of jurisdiction confirmed by the Court of Justice
and the BVwG would have to reject the complaint.
The quoted provision is therefore prejudicial within the meaning of Art 89 Para 2 in conjunction with Art 135
Para 4 in conjunction with Art 140 Para 1 Z 1 lit. a B-VG.
4. The fundamental right to data protection is effectively undermined
4.1 The constitutional provision of Section 1(2) DSG standardizes a substantive
reservation in such a way that restrictions on the right to secrecy
only on the basis of laws resulting from those mentioned in Art. 8 Para. 2 EMRK
reasons are necessary.
Such laws permit the use of data that is particularly
are worthy of protection only to safeguard important public interests
and at the same time appropriate guarantees for the protection of confidentiality
determine the interests of those affected. Even in the case of a permissible restriction
the encroachment on the fundamental right of § 1 DSG may therefore only be in the mild
ten, still leading to the goal can be made.
However, Section 9 (1) provides for a general exclusion of all rights of those affected,
by not only complying with the relevant provisions of the GDPR, but even
§ 1 DSG itself is declared inapplicable. This satisfies the requirement
Restrictions on rights only by establishing appropriate guarantees for the
50 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
to protect the confidentiality interests of those affected, not in accordance
chen. Not only no reasonable, but no guarantees at all
tien set. However, with regard to the
Proportionality principle only on the basis of a weighing decision
between a justified public interest (here: media report
reimbursement) and the fundamental right to data protection.
The encroachment on the fundamental right to data protection must therefore be suitable, necessary
and be adequate. This may be the case in individual cases; § 9 paragraph 1 DSG permitted
a case-by-case decision, however, by the blanket exclusion of those affected
not right now. Accordingly, the norm applies in disproportionate
ger way in the fundamental right to data protection, because it is the fundamental right in its
Entirely simply undermined.
4.2 As the BVwG explains, the media privilege excludes access for those affected
to the data protection authority according to § 24 paragraph 1 DSG. This with the result that
for data protection-related determination requests and within the scope of the
§ 1 DSG no national supervisory authority for the legal protection against
company is available.
Access to the civil courts according to Section 29 DSG is also restricted due to the media
vilegs excluded. While this the 2nd complainant due to the
personal scope of application of the GDPR is denied from the outset
the 1st complainant the civil courts to deal with the declaratory
and performance requests via the 'detour' of Art. 79 Para. 1 GDPR are not
reasonable because according to this provision also an administrative law
legal remedy must be available. Furthermore, it would be up to the 1st complainant
due to the exclusion of the fundamental right iSd § 1 DSG and the rights of those affected
iSdArt12ffDSGVO by the media privilege also in front of civil courts
possible to enforce these claims.
The complainants is therefore within the scope of media privilege
denied any determination of an infringement.
4.3 However, the complainants must be able to object to any type of processing
personal data checked by an independent body within the meaning of Art 8 Para 3 GRC
to let fen. The legislator ignores this right to access to a
dependent supervisory authority, however, by way of media privilege, and admits
thereby inadmissibly the public interest in the protection of
Freedom of communication, information and the press have completely undifferentiated priority
against the fundamental right to data protection.
Contrary to what is provided for in Art. 52 para. 1 GRC and Art. 8 para. 2 ECHR and Art. 85
Paragraph 1 GDPR as an order to the Austrian legislature
in media privilege just created no legislation that the right to
Protection of personal data with the right to freedom of expression and
reconcile freedom of information. The now anchored in § 9 para. 1 DSG
51 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
Blanket exception does not reconcile the rights mentioned, but concedes them
Media companies the unobjective privilege, about the fundamental right to
Data protection and the inspection and defense rights of data subjects simply
to be able to put away.
By designing the media privilege as a completely undifferentiated priority
the public interest in maintaining the rights of opinion, information and
freedom of the press, the legislature also deprives the complainants of their independent
mandatory right, processing of personal data by an independent
pending body to be examined.
4.4 It may be that the legislature for the processing of personal
data for journalistic purposes a wide scope of action with the goal
wanted to put the work of the free press and other journalistically active people
not to make it unreasonably difficult or even to
impossible.
The question of whether the interest in the processing of personal data
nalistical purposes outweighs the interests of data subjects
checking the legality of the processing of personal data,
must, however, be checked and decided by a supervisory authority in individual cases,
and cannot be imposed across the board by the legislature in the form of media privilege
be normalized. The last sentence of § 9 Para. 1 DSG is probably in this sense
read, which the data protection authority in the exercise of its powers to
Obliged to maintain editorial secrecy in accordance with § 3 MedienG.
The possibility of a constitutionally required weighing - between the
Interest of media companies in reporting on the one hand and the
Interest of data subjects in the secrecy and examination of the
Legality of the processing of personal data on the other hand -
The complainants are subject to official or judicial review
not because of the media privilege.
5. No trial before the statutory judge
5.1 The legislature has authority according to objective criteria and
also to be defined precisely, clearly and unambiguously. This is present by
instruction to the data protection authority in Art 77 in conjunction with 4 Z 21 GDPR (for the 1st
complainant) and § 24 para. 1 DSG (for both complainants) in principle
he follows.
5.2 However, the media privilege gives the data protection authority the meritorious
Technical authority to decide on the violation of the fundamental right according to § 1 paragraph 1
DSG and any other determination and remedy just withdrawn.A
The legislature has not provided for any other authority
expectation or impossibility of recourse to the civil courts see point 4.1).
52 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
The complainants have the right to
In addition, no access to a trial before (any) statutory judge.
This exclusion of access is irrelevant.
5.3 As a result of the media privilege, the Complainants have accordingly in
Austria neither the possibility of compliance with the right to protection of
Appropriate personal data iSdArt8Abs3GRC by an independent
body to be examined, nor can the complainants relinquish their right to
Complaint to the supervisory authority (in the case of the 1st complainant from his
nem according to Art. 77 GDPR or the 2nd complainant according to § 24 para. 1 DSG)
Make use.
Any examination of the processing of personal data by media under
is withdrawn from an examination by an independent body from the outset,
which of course also excludes the question of whether in individual cases in practice
any journalistic activity is pursued with the processing at all.
As the rejection decision of the data protection authority shows, the Medi-
enprivileged to data protection immunity of media companies,
if even a rudimentary journalistic activity can be assumed or
at least this cannot be ruled out. This legal consequence is improper
lich and deprives the complainants of their lawful judge.
6. Breach of Institutional Guarantee
6.1Art8iVm47GRCguarantees an independent body that
for monitoring and checking compliance with regulations for the protection of
ment-related data is ordered and their negative decision by the
national courts can be examined.
Accordingly, the legislature has mandatory - possibly in addition to a civil court
legal protection – to provide for the institution of a supervisory authority.
6.2 As already explained in point 4.1, the procedure before the civil
judge unreasonable or impossible for the complainant. Art 8 para 3 GRC
requires that compliance with the right to protection of personal data
is monitored by an independent body. The responsibility of the data
protection authority as an independent supervisory authority is protected by the media privilege
however excluded.
Accordingly, the Austrian legislature violates media privacy
lay the institutional guarantee set forth in this provision and denies the
Complainants with legal protection interests against media companies
Access to such an independent body.
6.3 With regard to the 1st complainant, this is also reinforced by Art. 77
Para. 1 GDPR, which, without prejudice to any other administrative law
53 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
or judicial remedy, the right to lodge a complaint with a supervisory
heard guaranteed.
This right to complain to the Austrian data protection authority
does not require national implementation and is the regulatory power of the member
States withdrawn. Art 77 GDPR is only applicable to current, i.e. future
permanent violations of rights.
for the 1st complainant are therefore about the direct
Application of Art 77 GDPR not enforceable at all. Although the data
protection authority in principle from their remedial powers according to Art 58 DSGVO
make use of and can, for example, order the information and
to comply with the complainants' requests for research, but any
relevant powers in the opinion of the data protection authority by the Me-
privilege of service excluded.
As a result, the 1st complainant cannot appeal to his
anchored right of appeal according to Art. 77 GDPR and the remedial powers of the data
data protection authority according to Art. 58 GDPR, because the media privilege
denies access to the institution which, in particular according to Art. 8 para. 3 GRC
is guaranteed.
7. Violation of the principle of equality
7.1 Section 1 (1) DSG stipulates that everyone has the right to secrecy
relevant personal data, provided that there is a legitimate interest in
interest in secrecy exists. This right to secrecy comes with it
benefit not only natural but also legal persons. The 2nd
Schwerdeführerini is a company established under Austrian law
limited liability and thus from the personal application and protection
range of § 1 DSG.
7.2 Subsequent judiciary, the legislature must equalize the same facts
create legal consequences. Significantly dissimilar facts, on the other hand, must be allowed
according to different regulations. Are there different
successful, the question must be asked whether the facts recorded in each case are so different
are different in that they justify the different legal consequences. Under-
different regulations that are not apparent for any reasonable reason
contrary to equality.
The media privilege now means that complaints against media companies
are treated differently than those who oppose other data protection
direct legal persons responsible. While the latter both an admin
tive proceedings in the course of a complaint in accordance with Article 77 GDPR or Section 24 DSG
also a civil proceeding as a result of a lawsuit under Art. 79 GDPR or § 29 DSG
are exposed, media companies enjoy in the scope of the
dienprivilegs complete data protection immunity from the data protection
hörde and the civil courts.
54 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
7.3 It is incomprehensible why § 24 Para. 1 DSG, which every person concerned
son - and thus also the 2nd complainant as a legal entity - a right
on complaint, and § 29 para. 1 DSG, which every data subject the
Access to the civil courts opened, in principle for complaints or
Lawsuits should apply against everyone responsible, but not when it is
the person responsible is a media company.
The media privilege means that legal rights directed against media companies
requests for protection without recognizable reasonable reason are treated differently than this
would be the case with other responsible persons. The regulation is accordingly
unobjective and therefore to be repealed as contrary to equality.
7.4 Data subjects have no national supervisory authority
a violation of a fundamental right, another request for a determination or
to assert remedial action. However, this limitation would only apply to
based on the principle of proportionality and only on the basis of a value
constitutionally permissible.
The blanket exception of § 9 Para. 1 DSG privileges journalistic activities
of media companies or media services, however, a priori in the negation of any
cher data subject rights and thus takes disproportionate and consequently wrong
in an unconstitutional manner into data protection law.
This is irrelevant and therefore contrary to equality. Data protection law knows
Verse special regulations for branches, in order to protect their legitimate (economic)
to safeguard or protect interests. This regularly on individual aspects in the
in connection with the processing of personal data and as a result
a weighing of interests anticipated by the legislator in detail.
Media privilege negates the right to protection of personal data and
However, any inspection and remedial authorizations of data subjects are fully granted.
[...]"
10. The Federal Administrative Court returned in the case before the Constitutional Court 20
one procedure each for the numbers G 287/2022 and G 288/2022
Reply, in which the arguments of the data protection authority with more justification
tion counteracts.
55 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
IV. Considerations
The Constitutional Court ruled on the analogous application of § 187 21
and § 404 ZPO in conjunction with § 35 para. 1VfGG for joint consultation and decision
related applications under consideration:
1. Admissibility 22
1.1. The Constitutional Court is not authorized by its prejudiciary 23
the requesting court decides on a certain interpretation of the law
bind, because he thereby indirectly the decision of this court in the main
che would anticipate. According to the established case law of the constitutional
richtshofes may therefore apply for Sd Art. 140 para. 1Z 1lit. aB-VG only because of that
be rejected in the absence of prejudice if it is manifestly incorrect
(impossible) that the – contested – general norm is a prerequisite
basis of the decision of the applicant court in the event of a case (cf.
about VfSlg. 10.640/1985, 12.189/1989, 15.237/1998, 16.245/2001 and
16.927/2003).
1.2. If the provision is in obvious contradiction with directly 24
applicable Union law, the primacy of Union law is also in the
140 Para. 1 Z 1 lit. a B-VG must be observed
(VfSlg. 15.215/1998, 15.368/1998, 16.293/2001; VfGH 12.12.2018, G 104/2018
et al.) and a request under this constitutional provision for lack of
to reject prejudice.
A violation of Union law is then to be considered obvious if it is of the kind 25
obvious that there is no room for reasonable doubt ("acte-clair-
doctrine"; cf. ECJ October 6, 1982, case 283/81, CILFIT, ECR 1982, I-3415, margin no. 16; VfGH
December 12, 2018, G 104/2018 etc.).
1.3. In the literature, there are considerable doubts about the conformity of the 26th
§ 9 para. 1 DSG expressed (e.g. Krempelmeier, Are the data protection regulations
Privileges of § 9 DSG contrary to Union law?, jusIT 2018, 188 [189 ff.];
Blocher/Wieser, Of privileged journalists and data in (almost) lawless
Raum - For a unilateral solution to the conflict of fundamental rights between data protection
56 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
and freedom of expression through § 9DSG, in: Jahnel [ed.], yearbook data protection law
2019, 2019, 303 [305 ff.]; Jahnel, photo reporting and data protection, in:
Berka/Holoubek/Leitl-Staudinger [eds.], Privacy and Media, 2019, 73 [84 ff.];
Jahnel/Krempelmeier, Media and data protection in Austria, in: Lachmayer/von
Lewinski [ed.], Data Protection in Legal Comparison, 2019, 179 [186 ff.]). the
Objection to § 9 para. 1 DSG with Union law is in relation to Art. 85
Paragraph 2 GDPR justified.
The Federal Administrative Court follows the opinion of the Constitutional Court 27
conceivable that Art. 85 Para. 2 GDPR is not the
Application of § 9 paragraph 1 DSG. The Federal Administrative Court has
moreover - due to the inseparable connection of all provisions in
§ 9 para. 1DSG (cf. VfGH26.9.2022, G 200/2022 etc.) - the contested regulation
to be applied in its entirety in the tempering process.
1.4. Since there were no other obstacles to the process either, 28
the applications of the Federal Administrative Court as admissible.
2. In case 29
The Constitutional Court decided in a procedure initiated upon application 30
to examine the constitutionality of a law in accordance with Art. 140B-VGonthe
to limit the discussion of the concerns raised (cf.
VfSlg. 12.691/1991, 13.471/1993, 14.895/1997, 16.824/2003). So he has
Finally, to assess whether the contested provision reflects the
given reasons is unconstitutional (VfSlg. 15.193/1998, 16.374/2001,
16.538/2002, 16.929/2003).
The requests are justified. 31
2.1. The applying court lays down the reasons it needs to file the application on 32
Constitutional Court, summarized as follows:
The assertion of the basic right to data protection according to § 1 DSG will be in the 33
Scope of application of § 9 Para. 1 DSG actually "undermined". The one in this
57 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
envisaged exclusion of the applicability of the provisions of the
Data Protection Act - and thus in particular § 24 DSG - as well as certain
Chapter of the GDPR has the effect that a data subject is not subject to national
supervisory authority is available to investigate a violation of the fundamental right to data
to assert data protection. It is a "flat rate" or "total
acceptance" of the applicability of data protection regulations. A
constitutional interpretation is due to the unambiguous wording
te of § 9 Abs. 1 DSG out of consideration. The processing
situations data subjects would have the rights to assert a
breach of data protection law in its entirety.
According to the case law of the Administrative Court, only 34
§ 24 DSG a person whose basic right to data protection has been violated
her ability to establish an infringement of rights that has happened to her.
In the cases mentioned in § 9 para. 1 DSG there is no possibility to
determine a data protection violation, why the provision
unconstitutional. Even a judicial assertion is not
not because Art. 79 GDPR only refers to violations of the GDPR
but for violations of national legislation. For this reason be the
Legal protection in the present constellations completely excluded.
Even if one assumes that the ordinary courts have jurisdiction, 35
§ 9 paragraph 1 GDPR unobjective, because the right to complain to the data protection authority
can be perceived more easily than when a lawsuit is filed
the ordinary courts
the exercise of the right to lodge a complaint with the data protection authority is less than
in the event of a judicial assertion. In addition, be (also) the ordinary
chen courts by excluding the applicability of Chapter II of
GDPR withdrawn from the substantive legal test standard of Art. 5 et seq. GDPR,
unless one judges this exclusion to be contrary to Union law.
The blanket exclusion of the applicability of chapters of the GDPR is entitled- 36
which is not in line with Art. 85 GDPR, which only allows such exceptions if
as far as this is necessary. An exclusion of any possibility of complaint to the
However, a supervisory authority is by no means necessary. The data provided for in Section 9 (1) DSG
any exceptions to the applicability of data protection regulations
58 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
therefore violated the fundamental right to data protection according to § 1 DSG, the
Principle of equality according to Art. 7 B-VG and Art. 2 StGG, the right to a
drive before the statutory judge according to Art. 83 Para. 2 B-VG, the right to
Protection of personal data according to Art. 8 GRC and the right to privacy
according to Art. 8 ECHR.
2.2. The data protection authority whose decisions were the subject of the complaint before 37
are applying to the Federal Administrative Court, considers this constitutional
The following summarizes the concerns of the Federal Administrative Court
opposite:
The statutory provision of § 9 Para. 1 DSG supersedes the constitutional 38
ranked basic right to data protection according to § 1 DSG not. Also in
Scope of application of the media privilege is of a limited jurisdiction
authority of the data protection authority according to § 24 DSG. § 9 para. 1 DSG
believe that media privileges should be limited to "classic media companies
men", although Art. 85 DSGVO is actually foreign to such a restriction,
because this provision refers to "processing for journalistic purposes"
will tie. The data protection authority is therefore in its case practice to
gone, § 9 para. 1 DSG to be interpreted narrowly and a limited jurisdiction
accept to deal with complaints. Only the in are privileged
Section 9 (1) DSG named actors.
In addition, only data processing that is part of journalistic 39
purposes. According to the case law of the European Court of
European Union is only the case if the processing is solely for the purpose
pursuing to disseminate information, opinions or ideas to the public
ten.For this reason, not every information published on the Internet that
refer to personal data, under the notion of journalistic
Task. Corresponding publications would have to have a minimum level of journalistic
cal editing and a sufficiently journalistic-editorial level
point out. From the ruling practice of the data protection authority it follows that § 9 para. 1
DSG does not lead to a "total exclusion" of the competence of the data protection authority
lead.
59 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
For the reasons mentioned, Section 9 (1) DSG is not unconstitutional; the loading 40
Mood is also amenable to a constitutional interpretation. It
only then there is no competence of the data protection authority according to § 24 DSG,
if personal data by the in § 9Abs. 1 DSG
would be processed for journalistic purposes. Otherwise it is a responsibility
given by the data protection authority, for example when processing personal data
ten as part of a private internet blog. Therefore it cannot be said
that § 9 Para. 1 DSG completely "off-
pry".
2.3. The legal development relevant here and the applicable legal situation represent 41
are as follows:
2.3.1. Already § 48 DSG 2000, Federal Law Gazette I 165/1999, which is Art. 9 of Guideline 42
95/46/EC for the protection of natural persons in the processing of personal
general data and the free movement of data, OJ 1995 L 281, 31, as amended OJ 2003
L 284, 1 ("Data Protection Directive"), saw a data protection
che Special regulation for data processing for journalistic purposes before: So-
far media companies, media services or their employees data directly
cash used for their journalistic activities within the meaning of the Media Act,
were in accordance with § 48 para. 1 DSG 2000 of the ordinary legal provisions
of the Data Protection Act 2000 only sections 4 to 6, 10, 11, 14 and 15 apply.
Linked to this, § 48 Para. 2 DSG 2000 stipulated that the use of data
for activities according to paragraph 1 leg.cit. was only permissible insofar as this was necessary for fulfilment
the information task of media entrepreneurs, media services and their
workers exercising their fundamental right to freedom of expression
Art. 10 para. 1 ECHR was required.
2.3.2. A new regulation was initially introduced in Section 9 of the Data Protection Adaptation Act 43
2018, Federal Law Gazette I 120/2017. This regulation had the following wording: "So-
far this is necessary to exercise the right to protection of personal data
consistent with freedom of expression and freedom of information
to bring, in particular with regard to the processing of personal
data by media companies, media services or their employees
indirectly for their journalistic activities within the meaning of the Media Act [...]
of the GDPR Chapter II (Principles), with the exception of Art. 5, Chapter III
60 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
(Rights of the data subject), Chapter IV (Responsible and
workers), with the exception of Art. 28, 29 and 32, Chapter V (transmission of personal
related data to third countries or to international organizations), Chapter VI
(Independent Regulators), Chapter VII (Cooperation and Consistency)
and Chapter IX (Regulations for special processing situations) on the
work that is used for journalistic purposes or for scientific, artistic
technical or literary purposes, no application.
In accordance with this federal law, § 6 (data secrecy) is to be applied in such cases.
den." However, this legal regulation never came into force. In its place
the now (partially) contested § 9 DSG, which with the data protection de-
Regulation Act 2018, Federal Law Gazette I 24/2018.
2.3.3. § 9 para. 1 DSG, which goes back to an amendment request in the Nationalrat- 44
goes, sees - in implementation of the Union legal obligation according to Art. 85
Para. 1 DSGVO - that on the processing of personal data by
Media owners, publishers, media employees and employees of a media
service company or media service within the meaning of the Media Act to journal
listic purposes of the media company or media service, the provisions
provisions of the Data Protection Act and Chapters II (Principles), III (Rights of the
data subject), IV (responsible person and processor), V (transmission
transfer of personal data to third countries or to international organizations
tion), VI (Independent supervisory authorities), VII (Cooperation and cohesion
renz) and IX (regulations for special processing situations) of the GDPR
not apply.
2.3.4. Section 9, paragraph 1, first sentence of the DSG stipulates a complete exception in the 45th
Sense that data processing by certain specified in the provision
Stakeholders (media owners, publishers, media workers and employees
nes media company or media service within the meaning of the Media Act).
journalistic purposes of the media company or media service
Entirely from the provisions of the Data Protection Act and from the provisions in § 9
Paragraph 1 DSG designated chapters of the GDPR are excluded.
2.3.5. The current and now contested version of Section 9 (1) DSG deviates from Section 46
(the one that has been decided but has not entered into force) § 9 data protection
Amendment Act, Federal Law Gazette. I120/2017, insofar as this does not contain any categorical,
61 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
absolute priority to freedom of expression and information
freedom of action, particularly with regard to the processing of personal
data by media companies, media services or their employees
indirectly for their journalistic activities within the meaning of the Media Act
journalistic purposes of the media company or media service,
but only the primacy of freedom of expression and the right to information
stipulated "to the extent necessary" to protect the right to the protection of personal
collected data with freedom of expression and information
to reconcile. This so-called requirement of necessity applies
now only in § 9 Abs. 2 DSG.
2.4. In view of the fact that the legislature with § 9 Abs. 1 DSG its 47th
Obligation according to Art. 85 para. 2DSGVO, it is initially obvious to
Interpretation of the term "for journalistic purposes" approaches those criteria
which the Court of Justice of the European Union in its
in accordance with Art. 9 of the Data Protection Directive, the previous provision of Art. 85
GDPR, in connection with the concept of "journalistic activity"
has developed. Accordingly, the term is to be interpreted broadly, according to the judgment
of the Court of Justice of the European Union of December 16, 2008, Case C-73/07,
SatakunnanMarkkinapörssiund Satamedia to consider the following criteria
are: The concept of data processing (solely) for journalistic purposes
refers in personal terms not only to institutionalized mass
media, but to all citizens who are journalists; it is immaterial
whether there is a profit to be made from the journalism in question; it is not
decisive whether the data is processed in a conventional manner and
are transmitted or whether the processing is carried out by a modern method (e.g
by uploading data to the Internet); finally can acts
be regarded as journalistic activities in the light of these criteria if
they have for the purpose of publicizing information, opinions or ideas
to spread. When asked whether the activity aims to obtain information,
Disseminating opinions or ideas in public is after the verdict
of the Court of Justice of the European Union of February 14, 2019, Case C-345/17,
Buivids, as criteria of contribution to a debate of general interest, of
level of awareness of the data subject, the subject of the reporting,
the previous conduct of the data subject, content, form and
Effects of publication, the manner and circumstances under which
62 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
which the information was obtained and its accuracy
into account (cf. e.g. Jahnel, picture reporting and data protection, in:
Berka/Holoubek/Leitl-Staudinger [eds.], Privacy and Media, 2019, 73 [80]).
However, § 9 Para. 1 DSG does not cover any journalistic activity in the above 48
cited meaning by whomever, but takes a closer
Restriction to a certain group of people. It's (only) about them
Processing of personal data by media owners, publishers,
Media staff and employees of a media company or
Media service within the meaning of the Media Act for journalistic purposes
media company or media service. According to § 1 Para. 1 Z 8 MedienG,
Federal Law Gazette 314/1981, as amended by Federal Law Gazette I 125/2022, is a media owner "who a) is a media
company or operates a media service or b) otherwise the content
Creation of a media work concerned and its production and distribution
either concerned or caused; or c) otherwise in the case of an electronic
Medium takes care of its content design and its charisma,
Retrievability or distribution either concerned or caused or d) otherwise the
content design of a medium for the purpose of the subsequent
radiation, retrievability or distribution". According to § 1
Para. 1 Z 9 MedienG, "who the basic direction of the periodic medium
determined". As a media company, § 1 Para. 1 Z 6 MedienG designates "a
Company in which the content design of the medium is taken care of as well as
a) its production and distribution or b) its broadcasting or retrievability
either be concerned or arranged". As a media service, § 1 para. 1
Z 7MedienGeincompany viewed,"the media company returns
provided with contributions in word, writing, sound or image". § 9 paragraph 1 DSG takes
i.e. data processing by the actors named in the provision only
then based on the data protection regulations mentioned below,
if these are for journalistic purposes for a media company or a
media service take place.
2.5. The GDPR does not regulate the relationship between data protection and freedom of the media 49
itself, but delegates this legislative task to the Member States.
According to Art. 85 Para. 1 GDPR, the Member States have legal provisions
the right to the protection of personal data in accordance with this regulation
63 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
the right to freedom of expression and information, including
of processing for journalistic purposes.
For processing for journalistic (and other) purposes, the co- 50
member states according to Art. 85 Para. 2 DSGVO "deviations or exceptions" from
Chapter II (Principles), Chapter III (Rights of the data subject), Chapter IV (Ver-
responsible and processor), Chapter V (Transfer of personal
ner data to third countries or to international organizations), Chapter VI (Un-
dependent supervisors), Chapter VII (Cooperation and Consistency) and
Chapter IX (Regulations for special processing situations) of the GDPR
see, "to the extent necessary to exercise the right to protection of personal
data with the freedom of expression and freedom of information
To reconcile". According to Art. 85 Para. 2 GDPR, the Member States may thus
the applicability of Chapter I (General Provisions), Chapter VIII (Legal
remedies, liability and penalties), Chapter X (Delegated Acts and Implementing
legal acts) and Chapter XI (Final Provisions) neither exclude nor
restrict. The legislator has in § 9 para. 1 DSG - for the regulated therein,
limited personal and material scope (see
Point IV.2.4.) - not only individual, but all in Art. 85 Para. 2 DSGVO
named chapters of the GDPR without any limitation or differentiation
closed (and not merely provided for deviations). In contrast, he has
§ 9 Para. 2 DSG - in contrast to the provision in § 9 Para. 1 DSG - for the
included personal and factual scope no absolute exclusion
conclusion of the mentioned chapters of the GDPR, but the exclusion of
individual chapters of the GDPR subject to a reservation of necessity (in individual cases)
posed. In doing so, the legislature obviously wanted to distinguish between
cunning activity of media companies to that of scientific,
artistic and literary purposes. This objective is
fundamentally not objectionable and also stipulated by Art. 85 GDPR.
2.6. According to the consistent case law of the Constitutional Court (VfSlg. 51
15.106/1998, 15.204/1998, 15.683/1999, 20.209/2016 and many others) is an Austrian
cal law, with which a Union legal regulation is executed and in Austria
chinese law is implemented is legally doubly necessary: the legislature remains
in the execution of Union law to the extent (also) related to the Federal Constitutional Law
bound by legal requirements than an implementation of Union law requirements
64 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
this is not inhibited. In these cases, the legislature is subject to a
double commitment, namely a commitment to EU law and a commitment
to the framework laid down by constitutional law.
Union law does not require the Austrian legislature to issue Decree 52
a provision according to which any data processing by media owners,
Editors, media workers and employees of a media company
mensor media service within the meaning of the Media Act for journalistic purposes
completely exempt from the application of the provisions of the Data Protection Act
and certain chapters of the GDPR are excluded. On the contrary
Article 85 (1) GDPR obliges the Member States to regulate the relationship between data
protection and freedom of expression (freedom of the media) by legislation
to develop more closely and in this way for a proper compensation of
to ensure conflicting fundamental rights positions (cf. on
Status of opinion already point IV.1.3.).
Since the regulatory content of Section 9 (1) DSG is not mandatory under Union law 53
is specified, the determination is subject to the control of the Constitutional
court as to their compliance with domestic constitution
right. Whether § 9 Para. 1 DSG complies with the requirements of Union law (completely)
speaks, the Constitutional Court does not have to judge and is for the
Decision of the Constitutional Court irrelevant (cf. e.g
VfSlg. 20.088/2016, 20.291/2018).
2.7. In the opinion of the Constitutional Court, Section 9 (1) DSG violates 54
the fundamental right to data protection in accordance with Section 1 (1) DSG.
2.7.1. § 9 para. 1 DSG initially orders undifferentiated that "the provisions 55
of this federal law" are not applicable. This is stated in parts of the literature
understood that the constitutional provision of § 1 DSG (by
the ordinary legislature) is declared inapplicable (see Jahnel, loc. cit., 86;
the same, Art. 85 GDPR, comment on the General Data Protection Regulation, rdb.at,
as of December 1, 2020, margin no. 42; Jahnel/Krempelmeier, loc. cit., 193 f.). Such an interpretation
prohibited because the simple legislator the constitutional provision as
Standard for the constitutional conformity of the contested § 9 Abs. 1 DSG not
able to rule out; the Constitutional Court has much more to examine whether the
65 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
contested provision in accordance with the constitution, including Section 1(1).
DSG, stands.
2.7.2. The basic right to data protection according to § 1 Para. 1 DSG guarantees every- 56
man right to secrecy of personal data concerning him
ten, insofar as he has an interest worthy of protection, in particular with regard to
respect for private life.
§ 1 Para. 2DSG contains a substantive legal reservation. Apart from 57
the use of personal data in the vital interest of the
taken or with his consent are limitations of the claim
Confidentiality therefore only to protect overriding legitimate interests
s of another permitted.
2.7.3. From § 1 para. 1 in conjunction with para. 2 DSG (and the related case law 58
of the Constitutional Court) it follows that in principle - if not
the consent or vital interests of the person concerned are present - a
Intervention in the fundamental right to data protection according to § 1 Abs. 1 DSG by the
legislature is only permissible if such an intervention to safeguard
gender legitimate interests of another is necessary. The legislature is
therefore on the basis of the fundamental right to data protection according to § 1 paragraph 1 in conjunction with paragraph 2
DSG always kept a balance between the interests of the person concerned
Protection of his personal data and the opposing (authorized)
to provide for the interests of another. Only if the observance of the contrary,
legitimate interests of another the right to data protection of the person concerned
prevails, a legal intervention in the fundamental right to data protection is permitted.
2.8. The absolute and complete - and thus undifferentiated - 59
- Exclusion of the application of all (simple legal) regulations of the
Data Protection Act and Chapter II (Principles), III (Rights of the data subject
person), IV (responsible person and processor), V (transmission of personal
personal data to third countries or to international organizations),
VI (Independent Regulators), VII (Cooperation and Consistency) and
IX (Regulations for special processing situations) of the GDPR in more detail
defined data processing for journalistic purposes of a media company
66 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
company or media service contradicts the provisions standardized in Section 1 (2) DSG
demand that the legislator recognize the interest in the protection of personal data
ten with the interest of media owners, publishers, media workers and
Employees of a media company or media service (within the meaning of
Media Act) in the context of their journalistic work to be properly
has gene.
2.8.1. In a democratic society, the media act as "public watch- 60
dog" plays a central role in the public interest (cf. EGHR 8.11.2016
[GK], Magyar Helsinki Bizottság case, Appl. 18.030/11; VfGH 4.3.2021,
E 4037/2020). The (special) regulation of Art. 85
Para. 1 GDPR bill, according to which the national legislator legislation
has to enact, through which "the right to protection of personal data
in accordance with this regulation with the right to freedom of expression and information
freedom of information, including processing for journalistic purposes […]
should be brought into line". For the processing of personal data
the national legislature has
accordingly deviations or exceptions from those in Art. 85 Para. 2
GDPR designated chapters of the GDPR insofar as this is for the
Perception of the tasks of the media and their corresponding journalistic
cal activity appears to be necessary.
2.8.2. In the opinion of the Constitutional Court, the right to 61
freedom of expression and information that the legislature of the
authorization of the order within the meaning of Art. 85 GDPR
and the applicability of certain privacy laws that
not compatible with the peculiarities of the exercise of journalistic activity
are excluded from data processing for journalistic purposes.
Limited applicability of all data protection regulations
on data processing for journalistic purposes by media companies
and media services would be suitable, journalistic activity in disproportionate
to impede or even make it impossible in a reasonable way. The legislator
is held, however, an appropriate, differentiated balance between the
Interests of individual persons in data protection also towards the media and the
requirements of journalistic activity protected by Art. 10 ECHR
see.
67 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
In this context, one should think about restrictions in personnel 62
(as currently provided for in § 9 para. 1 DSG, e.g. with regard to media companies
and media services), temporal (possibly only until publication
of a report) or factual (e.g. with regard to certain data processing).
or data subject rights) regard. Likewise, the legislature could - as compensation
for the exclusion of (certain) data protection regulations - increased
Requirements for internal organization, documentation and technical security
provide for the processing of the data.
2.8.3. However, the fundamental right to data protection according to Art. 1 Para. 1 DSG allows 63
not that the legislature categorically
fresh, ie. for the recorded activity for journalistic purposes par excellence
freedom of expression and information takes precedence over the protection of personal
of personal data by granting the applicability of all data
protection regulations of a content and procedural nature
of the GDPR and the Data Protection Act in its entirety. In the
Categorical privileging of a fundamental right ordered under Section 9 (1) DSG,
namely the right to freedom of expression and freedom of information against
on the fundamental right to data protection does not correspond to the constitutional
stipulations of § 1DSG and the related case law of the constitution
sungsgerichtshof (cf. e.g. VfSlg. 16.986/2003, 18.643/2008, 19.892/2014,
20.012/2015, 20.356/2019, 20.359/2019).
2.9. For the constitutional conformity of § 9 para. 1 DSG can incidentally after Auf- 64
version of the Constitutional Court also not be brought into the meeting that
an assertion of data protection violations through processing
journalistic purposes not before the data protection authority, but before the
ordinary courts is possible.
The jurisprudence of the Supreme Court as of the 65th
earlier media privilege of § 48 paragraph 1 DSG 2000 interpret. saw this destiny
before (cf. already point IV.2.3.1.) that when data is used by media
companies, media services or their employees directly for their public
Table activity within the meaning of the Media Act from the simple statutory provisions
Provisions of the Data Protection Act 2000 only sections 4 to 6, 10, 11, 14 and 15
were to be applied. The Supreme Court ruled that this provision
68 of 71 G 287/2022-16,
G 288/2022-14
14.12.2022
to be reduced teleologically and the assertion of injunctive relief
on the basis of Section 1 (1) DSG 2000 (cf.
OGH January 17, 2018, 6 Ob 144/17w).
However, it is unclear whether this case law is based on what is now specified in Section 9 (1) DSG 66
regulated media privilege can be transferred: First, the last
mentioned provision - in contrast to § 48 para. 1 DSG 2000 - not just individual ones
ordinary legal provisions from the applicability to data processing
for journalistic purposes, but all provisions of the
Data Protection Act and the chapters of the GDPR mentioned in the provision.
Secondly, the opposing view would reflect the will of the legislature, the
ten provisions for data processing for journalistic purposes
To bring application, obviously undermined (cf. in this context
also recently OGH February 2, 2022, 6 Ob 129/21w).
2.10. In its statement, the data protection authority basically correctly points 67
point out that those affected - in addition to the provisions of the Data Protection Act -
zes and the GDPR - in certain constellations otherwise legal protection
is guaranteed. In this context, particular attention should be paid to the
§§ 7 ff. MedienG or provisions of the ABGB (e.g. § 16 in conjunction with § 1330 ABGB). in the
However, the present context is about which special data protection
Legal regulations of the legislature with regard to Art. 10 EMRK for journalism
can declare crafty activity not applicable or only applicable in a modified way, with which
Consequence that this activity is (merely) subject to the aforementioned media and civil law
succeeded, insofar as they are applied in the respective individual case.
2.11. Section 9 (1) DSG therefore proves to be constitutional for the reasons presented
illegal.
2.12. With this result, it is unnecessary to refer to the other concerns of the application 69
Federal Administrative Court in terms of other basic rights
enter into.
69 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
V. Result
1. § 9 para. 1 DSG is therefore due to a violation of the constitutionally 70
guaranteed right to data protection according to § 1 Abs. 1 DSG as unconstitutional
cancel. With this result, it is not necessary to go into the further in
concerns set out in the applications.
2. Determination of a deadline for the repealed laws to expire. 71
cession office is based on Art. 140 Para. 5 third and fourth sentence B-VG.
3. The statement that previous legal provisions are not reinstated 72
occur, is based on Art. 140 para. 6 first sentence B-VG.
4. The Federal Chancellor's obligation to announce the 73rd
repeal and the other related statements
flows from Art. 140 Para. 5 first sentence B-VG and § 64 Para. 2 VfGG in conjunction with § 3 Z 3 BGBlG.
5. This decision could be made in accordance with § 19 Para. 4 VfGG without oral hearings
be made in closed session.
6. The parties involved are not charged for the statement made. 75
speak, because in the case of a legal action initiated at the request of a court
examination procedure is a matter for the applicant court to decide on any costs
claims for damages according to the regulations applicable to his procedure
recognize (e.g. VfSlg. 19.019/2010 mwN).
Vienna, December 14, 2022
The Vice President:
dr MADNER
Secretary:
dr SELIM, BA
70 of 71G 287/2022-16,
G 288/2022-14
14.12.2022
71 of 71
