BVwG - W256 2234976-1 and W256 2234976-2

BVwG - W256 2234976-1 and W256 2234976-2

Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 4(1) GDPR Article 4(2) GDPR Article 5 GDPR Article 6(1)(a) GDPR Article 6(1)(f) GDPR § 9(1) DSG
Decided:	10.07.2023
Published:
Parties:
National Case Number/Name:	W256 2234976-1 and W256 2234976-2
European Case Law Identifier:	ECLI:AT:BVWG:2023:W256.2234976.1.00
Appeal from:
Appeal to:	Not appealed
Original Language(s):	German
Original Source:	RIS (in German)
Initial Contributor:	maxbgr

An Austrian Court upheld a decision of the Austrian DPA affirming that the publication of personal data without given consent on the controllers’ websites for advertising purposes was contrary to Article 6(1) GDPR.

English Summary

Facts

The data subject was marksmen from 2012 until about 2017 and participated in competitions. Controller 1 (first appellant in the present case) operates a website that offered shooting accessories and lessons. Controller 2 (second appellant in the present case) also operates a website where they added blogposts concerning these competitions and offered shooting lessons including advertisement for a company.

Several reports by the two controllers, published on their respective websites, included an image and the name (and nickname) of the data subject. However, the data subject had never explicitly consented to this publication nor was there a contractual agreement at any time. The publications were mainly for advertising purposes.

Controller 1 issued two of the reports in question; on 30 July 2015 and on 9 November 2015. Controller 2 published the other two reports, namely on 10 August 2016 and on 18 September 2016.

The controllers took down the reports in September 2018 and November 2018, respectively. On 17 February 2019, the data subject filed two complaints before the DSB (Austria) for infringement of their fundamental right to data protection by the two controllers.

The DSB joined the two cases in its decision of 13 July 2020 accepting the complaint and deciding in favour of the data subject: According to this decision, controller 1 unlawfully processed the data subject’s personal data from 9 November 2015 until 30 September 2018. Controller 2 unlawfully processed the same data from 10 August 2016 until November 2018. Both controllers appealed against this decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG), claiming that their activities were covered by the media exception of § 9(1) Austrian Data Protection Act (Datenschutzgesetz - DSG).

Holding

First, the BVwG considered the application of § 9(1) DSG, which provides for a broad nonapplication of GDPR provisions (among others), notably Article 6 GDPR, which deals with the lawfulness of processing (“Medienprivileg”). The court, making reference to CJEU C-73/07, held that personal data is processed for journalistic purposes if the processing has the sole purpose of disseminating information, opinions or ideas to the public. Since in this case there was at least an element of advertisement in each of the publications, the BVwG held that § 9(1) DSG was not applicable.

Then, the BVwG assessed the lawfulness of processing in light of Article 6(1) GDPR.

First of all, the court noted that none of the controllers could provide with a substantive argument or proof that the processing of data took place on the basis of consent by the data subject under Article 6(1)(a) GDPR.

Hence, pursuant to Article 6(1)(f) GDPR, the court further examined whether processing was necessary for the purposes of the controllers’ legitimate interest. It confirmed that making available to the public their reports on shooting competitions represents a legitimate interest for processing of personal data, however, the court pointed out that none of the four reports constituted an exercise of their right to freedom of expression and information. The reports were not issued as a contribution to a debate of general interest, but, in fact, merely for the purpose of promoting the company of controller 1 and another company as far as controller 2 is concerned. Thus, the controllers could also not rely on Article 6(1)(f) GDPR as a legal basis for processing the data subject's personal data.

As a result, the court held that the publication of personal data in the reports was unlawful and that both controllers infringed the data subject’s right to confidentiality.

Comment

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Postal address:
Erdbergstrasse 192 – 196

1030 Vienna

Tel: +43 1 601 49 – 0
Fax: +43 1 711 23-889 15 41

Email: einlaufstelle@bvwg.gv.at
www.bvwg.gv.at

Decision date

July 10, 2023
business number

W256 2234976-1/19E

W256 2234976-2/19E

I M N A M E N D E R R E P U B L I K!

The Federal Administrative Court, through judge Mag. Caroline KIMM, recognizes KIMM as
Chairman and the expert lay judges Dr. Claudia Rosenmayr-Klemenz and

Mag. Adriana Mandl as assessor on the complaints 1. of XXXX and 2. of XXXX,

both represented by Dr. Peter Zöchbauer, lawyer in 1040 Vienna, Karlsgasse 15/3,
against the data protection authority's decision of July 13, 2020, No. XXXX

Conducting an oral hearing correctly:

A) I. The complaints are (each) upheld with the proviso that the ruling

of the contested decision must read: “The complaint is upheld and

it is stated that the respondents thereby inflicted the complainant on
violated his right to secrecy by: 1. the first respondent

on its website XXXX in a report dated July 30, 2015 and November 9
2015 personal data of the complainant (specifically name and picture) until

published on September 30, 2018 and 2. the second respondent

on its website XXXX in a report dated August 10, 2016 and September 18
2016 personal data of the complainant (specifically name and picture) until

published November 2018”.

II. Otherwise, the complaint is dismissed as unfounded. - 2 -

B) The revision is not permitted in accordance with Art. 133 Para. 4 B-VG.

Reasons for the decision:

I. Process:

In its two complaints dated February 17, 2019, XXXX (hereinafter:

co-participant) a violation of his basic right to data protection by the now
Complainant. The co-participant stated, among other things, that the complainants had –

as can be seen from the attached screenshots – his name and his picture

illegally for advertising purposes or with dubious comments on them
Homepages published. The privacy complaint was related to screenshots

Reports of the first complainant dated July 30, 2015 and November 9, 2015 as well as in
Reference to the second complainant dated August 10, 2016 and September 18, 2016

connected.

At the request of the authority concerned, the first complainant stated in his

Statement of May 9, 2019 essentially states that he has been with the
The people involved were friends and they both attended numerous competitions.

The person involved agreed to the publication of the pictures and was himself

I approached the co-involved in 2015 and asked for his consent
the publications requested. Through various control applications, the

Those involved felt disadvantaged and were increasingly hostile to the first complainant

faced. The first complainant finally has a private lawsuit against
brought against the co-participants for insult. Since the co-participant with the judgment of the BG

XXXX was sentenced to a fine on June 8, 2018, he has a
Have a lawyer's letter sent to the first complainant, in which the inadmissible

Publication of photos including the name of those involved on the

The homepage of the first complainant was alleged. Those from the co-participant in the
The images and reports submitted in the complaint have no longer been available since the end of September 2018

available on the homepage of the first complainant. In addition, there is
There is also no interest in confidentiality regarding personal data of the person involved, because

he took part in public competitions and the data is therefore general

be available. Various documents were attached to the statement. - 3 -

At the request of the authority concerned, the second complainant stated in his
Statement from May 9, 2019 essentially states that this has only been in place since February 2019

be entrepreneurial. Previously, his homepage was private with an online blog

been. The co-participant approached the second complainant and asked
I consent to the publication of the images. Based on a letter from a lawyer,

Second appellant received the report in question from his in November 2018

Homepage removed. Various documents were attached to the statement.

In his statement dated June 8, 2019, the co-participant stated that he was exercising the
Shooting has been a sport since 2012, although discretion is very important to him since his career is in...

public and social sectors. He and his wife have been doing this for years

Founding a childcare facility in cooperation with XXXX.
Due to minor successes in this hobby, it was challenging to keep his name

completely off the public web, although he largely succeeded in doing so,

by regularly pointing out photos to organizers and fellow shooters
of his person with a weapon, videos and critical, defamatory texts. Pure

Result lists with his name are not critical because there is no direct conclusion to his identity

and sport can be drawn. In the spring of 2018 he became aware that
that the first complainant on his company page XXXX, unauthorized and not

approved, a photo of the person involved is published along with their name

have. In the spring of 2018 he became aware that the
Second complainant on his company page XXXX, unauthorized and not

approved to publish photos of the person involved along with their name.

The obvious goal was to compare his person and his achievements with the
To associate companies XXXX or XXXX in order to successfully advertise with them

to be able to operate what was not desired by the co-participant. Also have it
no consent was given in this regard. He also has his sponsorship contracts

lost when they found his pictures and name on XXXX's company website

or XXXX were made aware and it appeared that the
Co-participants have a business connection with the company XXXX or XXXX.

The person involved suffered damages of €6,500 per year. He already has

an injunction has been filed and a claim for damages is currently being prepared.

In a letter dated October 23, 2019, the complainants submitted that
The personal data of those involved are in connection with editorial

Reporting has been published based on the consent of those involved. The 4 -

Reporting by the first complainant is also entirely true, since the
Those involved were actually part of the teams, especially in XXXX. Because of this

The person involved posed with their T-shirts at public competitions. As well

the second complainant's reports were entirely true. The processing of the
personal data is for the exercise of the right to freedom of expression and

Public information required. Any legitimate interests of the

This would not affect anyone involved. The co-participant has
participated in public competitions; the data on this is generally available.

In addition, all publications are now on the complainants' websites

been completely removed. Various documents were presented for this purpose.

In his statement dated November 20, 2019, the co-participant stated his
personal data could be used for advertising purposes without his permission

published for marketing purposes. The complainants would not

Operate media companies with journalistic content. The purpose of all content and
Contributions on the websites are purely for the marketing and promotion of your products and

services oriented. It was pointed out again that the co-participant

at no time part of the complainants' business activities or in a sponsorship
contract was linked to the companies mentioned. The complainants

regularly give out T-shirts and other paraphernalia to club and shooting colleagues

given away to advertise their products and services. Do this
However, no one automatically becomes part of their company, or is wearing it

of a T-shirt does not give consent to be used as an advertising figure on a website for advertising purposes

to be published. Various documents were attached to the statement.

With the contested decision, the co-participant's complaint was upheld

and found that the complainants thereby violated the co-participants' right to
breached confidentiality by the first complainant (at least) during the period

from November 9, 2015 to September 30, 2018 and the second complainant (at least)

in the period from August 10, 2016 to November 2018, personal data
Co-participants (specifically names and pictures) are published on the XXXX and XXXX websites

would have. The relevant authority explained that the personal data

of the person involved (specifically picture and name) by the end of September 2018 or by November
2018 in numerous reports on the complainants' pages mentioned above

had been published. In the present case, media privilege is lacking

The existence of a media company and journalistic activity is not - 5 -

Application. The data in question is:
personal data of the co-participant that has a claim to confidentiality

would be subject to. The complainants' alleged consent to

This publication was not published. Nor is there a predominant one
legitimate interest of the complainants in publication. That's how they would have

numerous published pictures of the person involved in connection with

Shooting sports competitions do not indicate to what extent this contribution contributes to a debate
can contribute to the general interest. It is also not overlooked that the

Coverage of sporting events generally of general interest to

is a specific target group. The person involved did take part in public competitions
participated, but the co-participant was in connection with the XXXX

Website XXXX or named as XXXX. The reports about the

Sporting events have not been designed in such a way that general results of the
respective events have been made available online. This means (at least)

the impression of a close relationship between the co-participant and the company

Complainant was awakened. It would also have been possible to have pictures like this
(e.g. from behind, without a face) that no personal reference is made

could become. It should also be taken into account that the complainants
Publication also for commercial interest for the purpose of increasing sales

the business they carried out.

The present complaint is directed against this. At the beginning it is criticized that...

The decision in the contested decision was incorrectly cited

The first complainant is responsible for the website XXXX and the
Second complainant responsible for the website XXXX. The wording of the saying

suggest that both complainants have publications on both websites
had made, which, however, was not correct. To confirm this theme of evidence

a request was made for the complainants to be summoned and questioned. Furthermore, it was

submitted that the co-participant in view of the enforceable settlement
XXXX of the LG XXXX of XXXX already has a legally effective and enforceable

Legal remedy to restore the lawful situation and the co-participants

in this respect we can no longer complain. A gradual use of the defendants
Authority in the same matter is out of the question, especially since the person's need for legal protection is met

The parties involved had already been fully taken into account by the settlement.

To prove that all contributions incriminated by the co-participant (including
Photographs and name of the person involved) on the XXXX websites with express - 6 -

The consent of the co-participant was kept publicly available
Summons and hearing of the complainants requested. Both the co-participant and

The complainants are also XXXX sport shooters. The first complainant is

also XXXX Region Austria and XXXX . As of 2014, the co-participant has been in the
Sports shooting scene unpopular due to his lack of insight and argumentative nature

made. The co-participant then asked the first complainant to keep him in mind

of “positive campaigning” in posts on the XXXX website in order to present it
to avoid exclusion in the sports shooting scene. After another incident

the first complainant called in the second complainant, who

Fellow participants also participated in “positive campaigning” in contributions to his website
Website XXXX. From that time onwards, the second appellant and the

Those involved spent a lot of time together and went to competitions together

and in the scene the XXXX was named. They would have pictures and result lists together
as well as match reports and shared them on social networks. Because of

multiple unsportsmanlike behavior on the part of a fellow participant during competitions

The first complainant subsequently filed an application for the exclusion of the co-participant from the proceedings
XXXX provided. The second complainant, as the organizer of a competition, has

Participants were disinvited from a match due to aggressive behavior.
The person involved is now banned from several shooting ranges. The

The co-participant's complaint, which is the subject of the proceedings, can therefore only be seen as an act of revenge

be considered. Contrary to the statements made by the authority concerned in the contested case
The first complainant only had a post on his website with one

Photograph kept available. In addition, there are XXXX in the incriminated post on the website

General results of the event have been kept available. The incriminated post
A report on the process and results is public on the XXXX website

held sporting events (competitions). That such a contribution does nothing

contribute to a debate of general interest is downright absurd. In addition, be
the incriminated contribution is completely true, since the co-involved actually dated 2015

was sponsored by the first complainant's company. It is therefore one

clear predominance of the first complainant's interests in freedom of
expression of opinion. The second complainant has already stated in his statement

dated May 9, 2019, that he had only been active in business since XXXX and before
At that time I ran the website XXXX privately as an online blog. The processing is

in the context of incriminated reporting to exercise the right to freedom

Expression of opinion and also necessary to inform the public. Thereby would
no legitimate interests of those involved are affected. The co-participant - 7 -

I also took part in public competitions; the data on this is general
available. Furthermore, the incriminated posts on the XXXX website are entirely true.

The co-involved party made XXXX T-shirts with the inscription XXXX out of his own hands

let. The complaint was the lawsuit of the co-participant to XXXX of the LG XXXX, the
the complainants' preparatory brief and the one since December 17, 2019

legally effective and enforceable settlement to XXXX of the LG XXXX of XXXX

(including confirmation of legal validity).

The authority concerned submitted the complaint along with the administrative act
Federal Administrative Court.

Based on the notice of complaint, the co-participant stated in his statement dated:
August 10, 2022 is essential here that there is no consent at any time

Publication of his photos or his name, and certainly not for advertising purposes

given for marketing purposes. The complainants would make false allegations
by presenting a purely fictional story. It has neither aggressiveness

nor quarrelsomeness on his part. In reality, from XXXX onwards there are unfair actions

came from the complainants. This even has a warning from
rifle association to the first complainant.

In their statements of January 26, 2023 and March 29, 2023, they repeated

The complainants essentially made their argument that it was legally valid

Consent from the person involved to the publication in question.

In his statement dated February 12, 2020, the co-participant again stated that
I do not give my consent to the publication in question and will never be part of it

companies named therein.

The Federal Administrative Court will hold an oral hearing on April 14, 2023

Presence of the complainants, their legal representative, the co-participant and one
carried out by representatives of the authority concerned.

II. The Federal Administrative Court considered:

1. Findings: - 8 -

The co-participant practiced the sport of XXXX between 2012 and approximately 2017
In this context, he also took part in competitions at home and abroad.

The first complainant operates the homepage XXXX. On this page the
First complainant shooting accessories for online sale and courses on shooting sports

at.

The first complainant wrote an entry on his homepage on July 30, 2015,

according to which “XXXX-shirts” had arrived and the named co-participant had received them
would already wear. This entry was made by the first respondent for promotional purposes

written.

Likewise, on November 9, 2015, the first respondent submitted a report on his

Participation in the XXXX State Championships 2015 with the title “Austrian XXXX
State Championships 2015 – the track record of the XXXX - 33 medals” published.

It also talks about the XXXX's success story with the Austrians

State championships 2015 in Vienna and Graz reported on his homepage. Literally
it states, among other things:

“The balance of the XXXX shooters at the ÖStM 2015 in Vienna and Graz is 33 medals

considerable. I have listed the shooters and their clubs by name below and would like to thank them

Thank you to everyone who trusts in XXXX.”

In the following, only the XXXX results are given and the

Those involved were mentioned several times by name. There is also a picture of the in this article
Participants during an award ceremony.

The first complainant wanted to inform the public about the participation report

Inform about sporting events. The report contained therein about the success story of the

XXXX and thus the co-participant was named as XXXX along with the publication of the picture
by the first complainant, however, solely for advertising purposes.

The co-participant has neither declared nor otherwise clearly confirmed that he is the

agrees to the publication of his name and picture in these posts. There was also

There is no other agreement between the co-participant and the first complainant
contractual agreement. - 9 -

The second complainant operates the homepage XXXX. On this page he has
Second appellant blog entries in the period from August 10, 2016 to November 2018

written about matches. At this time there were also reports on this homepage from

The second complainant was offered and was offered shooting sports courses by the company XXXX
Otherwise, the second complainant advertised this company on the homepage

made. The second respondent was an officer of the company at that time

XXXX (negotiation document, page 13ff).

The second respondent submitted a report of his attendance on September 18, 2016
and experiences at the “XXXX Championship 2016” are published on his homepage.

It also details the services of the co-participant, who is referred to as XXXX,

reported and pictures of those involved are published.

Through his report, the second complainant wanted to inform the public about the

Inform about sporting events. The name XXXX is not an official name of the
Co-participants and is not known to them or to the general public.

The second complainant also has a report dated August 10 on his homepage

Published in 2016 about the “XXXX Cup 2016”. Among other things, it also reports on the results of the

XXXX reports and in this context the co-participant by name and his
Results mentioned and pictures of those involved published. The

The second complainant wanted to inform the public about the events through his attendance report

Inform about sporting events. The report on the results of the XXXX and thus the
However, the complainant was named and the picture was published

advertising purposes.

The co-participant has neither declared nor otherwise clearly confirmed that he is the

agrees to the publication of his name and picture in these posts. There was also
between the co-participant and the second complainant or the company XXXX

no other contractual agreement.

On April 8, 2019, the complainant filed a complaint against the complainants

Injunction at the XXXX Regional Court due to the publication of photographs
including mentioning their names on their homepages with the number XXXX. This was done

The complainants stated that these photos had since been removed

but have not subjected themselves to any obligation to cease and desist that is punishable by law. In this respect - 10 -

It is requested that the complainants make such publications in the future
had failed to do so (including a complaint with notices and attachments).

On December 17, 2019, the complainant and co-participants concluded in the above
In civil court proceedings, a settlement is reached, according to which the complainants each agree to do so

obliged to publish photographs of the co-participants for advertising purposes

to refrain from doing so in the future. This settlement became legally binding (including the appeal from
including supplements).

2. Assessment of evidence:

The facts established above arise, among other things, from the administrative act submitted and

among other things, from the evidence listed in brackets.

The second complainant himself stated during the oral hearing that

that he wrote the contributions in question and is solely responsible for them

was (negotiation document, page 14: “VR: Who was the owner of the homepage at the time of
Contributions relevant to the proceedings? BF2: My person. For the publications was

I am also responsible. [..] and page 19: “DSB: You meant, in

You were responsible for the website during the period in question. The
Course content met the company XXXX. Were made without your consent or intervention

However, no content was posted on the site. Is that right? BF2: Yes.”). There are none
Reasons to doubt this argument.

That the designation XXXX is not an official designation of the co-participant and this or

is also not known to the general public, results from the consensus
Submissions of the parties during the oral hearing (negotiation document,

Page 15: VR: Why is the MP listed there as XXXX? BF2: If you look at some photos

If you look at the inserts, you will see that his self-designed T-shirt has a white one
Tiger is pictured and this is how the nickname XXXX was formed. [..] VR: Is or was that

his official name at sporting events? BF2: No, that was just a nickname. Be

The official name at events was XXXX. VR: The MP thinks that you are using this to him
wanted to degrade the name. What do you think? BF2: I can't do much about that

say, because I don't know what a derogation is here. He has himself on the t-shirt

wore the head of a tiger and he was just as fast as a tiger. He has that too
often said myself.” and page 20: VR: Who called you XXXX? Was that your official one?

Nickname? MP: No. Nobody called me that.”; Negotiation document, page 21: RV: War - 11 -

the MP in the community and among the XXXX sports shooters under the name XXXX
known? BF2: Yes, not everyone knew him by that name, but he was by that name

known. BF1: I see it the same way. His profile picture on Facebook was white

Tiger.").

That the first complainant submitted the contribution of July 30, 2015 and the report on the

published the results of XXXX from November 9, 2015 for its own advertising purposes,

This is clear from the text itself. On the one hand, it advertises the T-shirt
The first complainant was made and the co-participant was named as the carrier. For the

Others report (exclusively) on the results of the team

The first complainant reported at the state championships and therein again the
Placement of the person involved as part of the team. Incidentally, he brought

The first complainant also stated during the oral hearing that

The report on the T-shirts is for advertising purposes and not for editorial purposes
is. When asked specifically about this, he also stated during the oral hearing that

he described his report on his experiences at the state championships as “editorial

Reporting” see the mention of the results of the XXXX and in this
However, the naming of the person involved was for advertising purposes

(Negotiation document, page 5: “VR: Why do you have the above contributions on your
Homepage published? BF1: The reason was simple, on the one hand, to advertise myself

do, on the other hand also for the MP. The blog was very positive. It was about him

gained more popularity. The better known you are, the higher your chances are
you get sponsors. The MP had top results.” and page 7: VR: In yours

In your statement dated October 23, 2019, you stated that publication was in

In connection with “editorial reporting”. What do you mean by that? BF1:
It's simply a coverage of the match, what happened. VR: What about the T-

Shirts? BF1: It was about advertising. But I also advertised for the MP. VR:

As already stated above, you will report here about your own experiences with the
State Championships, the results of your XXXX and the sale of your t-shirt. Wherein

Do you see your journalistic activity here? BF1: The report from the match.”).

The same applies to the second complainant's report of August 10, 2016
about the results of the XXXX. It only reports on the results of the XXXX

The second complainant also reports and explains that the meaning and purpose of the
Publication has been positive coverage of this team's shooters

should be (negotiation document, page 15: “VR: Why did you say in your report of 10.

August 2016 reported on the results of the XXXX? BF2: Because we have all the members of the - 12 -

XXXX were present, we also achieved some good results there. It was a part
the verbal sponsor agreement that we receive positive reports about these shooters

write.”).

due to the lack of consent of the co-participant or any other contractual agreement
Commitment to:

During the proceedings, the co-participant consistently stated that he had neither the established

Publications relating to his person towards the first and the
Second complainant agreed, nor that there was any other contract

have. This was also repeated in the oral hearing before the Federal Administrative Court

the co-participant made his submissions in this regard (to the first complainant:
Negotiation document, page 11: “VR: BF1 stated earlier that he not only saw you in the car

I asked for permission to publish it on his homepage, but you

I also called them before the two reports in question were published
These reports will be read out verbatim and you will ask for your consent to publish them

requested on his homepage. You would have given him this consent. What do you say

in addition? MP: That is absolutely incorrect. I never knew that he even had one
Writes articles on his homepage. VR: Have you ever talked to the BF1 about that

Disclosure of personal data on your homepage? BF1: No. [...]
VR: Were you part of the XXXX? MP: Absolutely not, I don't know how the BF1 responds to that

Idea comes. He once approached me and said he wanted me a T-shirt

give. The sport was very expensive. You are happy when you are given a T-shirt
receives, which is why most shooters walk around with gifted T-shirts. The idea is,

Of course, to advertise it, but that doesn't mean that the wearers of these T-shirts

had agreed to be published on homepages. [..] VR: What do you say?
that the BF1 states that you were involved in publishing the contributions? MP:

I didn't even know about it, so I wouldn't know how to get involved in publishing it

should have. VR: What do you say about the fact that the BF1 states that you are also involved in the design
of the T-shirt? MP: Contributed is an exaggeration. He told me then,

that he sent me a T-shirt and gave it to me.”; to the second complainant:

Negotiation document, page 19: “MP: At no time do I have any authorization
or consent given for any publication. I never was either

involved in the publication of these contributions. Back then, just for fun, I bought a T-
Have a shirt made and designed, even with logos. These were fictitious logos or a fictitious one

Sponsorship, there was no sponsorship. It all developed out of fun,

so other shooters also started designing T-shirts. Then there are - 13 -

Small businesses came up with the idea of giving shooters T-shirts with their logos.
That was the case in my case too. The BF2 then paid for my T-shirt because he said if

I have his logo at the top, be it advertising for him. At no time does it have any

There was an agreement that I would be part of a team or something similar.”).

to the first complainant:

On the other hand, the first complainant argued throughout the proceedings that:

The co-participants have indeed given their consent to the publication in question
granted and he was also part of the team. He was able to do this throughout the entire process

However, neither make a valid argument nor provide any other evidence.

In particular, it was not possible for him to give his alleged consent to this
present publication concretely and, above all, uniformly. While

In his statement of May 9, 2019, he stated that he himself was in 2015

I approached those involved and asked him for his consent
The co-participant made a request for publications in the appeal

I asked him in 2014 to please the co-involved (due to bad

popularity ratings in the shooting sports scene) on its website. In the
During the oral hearing, the first complainant again stated that

He had agreed with the person involved during a car ride that he would pick him up
I will present it positively on his website in order to help him become a professional. Before the

If the two reports were published, he would have called the person involved again, him

the reports were read out and his consent was asked again (negotiation document, page
5: “VR: Why did you publish the above articles on your homepage? BF1: That one

The reason was simply to advertise myself on the one hand, but also for the MP on the other.

The blog was very positive. It was about him becoming more famous. The same
The more well-known you are, the higher your chances of getting sponsors. The MP

had top results. VR: Was there a declaration of consent from the MP for this? BF1: We have

agreed upon at our joint meetings, training sessions, we are together
sat in the car for hours. That's where we discuss things. Some of them came

Advertising strategies even from the MP. VR: Can you please explain this specifically. How did it come

to this declaration of consent? When did MP explain to you and in what form
that he agrees to the publication of which data on your homepage? BF1: The MP has

explained to me on a long journey that he spends the whole time thinking about how
he could become a professional. At the time he said that he would even forego a new car

would invest everything in his career and become a professional athlete. He asked me,

whether it would be okay for me if I included him in this XXXX community. […]”). - 14 -

The first complainant conducted further questioning during the oral hearing
Negotiation in turn states that he is the co-participant with those in question

Publications wanted to rehabilitate him and the person involved had him out

requested publication for this reason (negotiation document, page 6: “VR: He has you
also asked to present him as XXXX or as part of your team on your homepage? BF1:

Yes, because the MP had problems. He had already had a suspension due to

Disputes with referees. It was about us rehabilitating him again
to smooth the waves. VR: Did he ask you to rehabilitate him? BF1: Yes, him

asked me, I made sure that he wasn't excluded. VR:

He also asked you to list him as XXXX and as part of your team on the homepage
to represent? BF1: Yes. VR: When did he ask you to do this? BF1: That was 2015. That has to be in

must have been spring. That must have been what happened with the shirts. That was

yes, his idea with the shirts. He had shirts designed, I got them from the same manufacturer
also have t-shirts made. VR: What kind of idea did the MP have? Own shirts or

To create your t-shirts? BF1: He created his own t-shirt and then gave it to me too

recommended to create your own t-shirts. He insisted that his name be mine
T-shirts are just to show that he is part of the XXXX. VR: Do you have one for that?

Written contract concluded with MP? BF1: No, that's also unusual in the
Industry.”).

Given these different and vague descriptions, this is not the case

it can be assumed that there is an act of consent by the co-participant in relation to
the publications in question have come. It may be true that it is

also between the complainant and the other party involved in various discussions

came into connection with the shooting sport. That the co-participant dem
Clearly and unambiguously explained or understood to the complainant

has given that he consented to the publication of his name and his

agrees to the image or if there was any other contractual agreement
but not to accept.

It should also be taken into account that the first complainant, according to his own statements, 15

He is said to have been the head of an aviation company for years and therefore about his importance
must have known about a declaration of consent (negotiation document, page 6:

“[..] There is a reason why I am publishing this. I don't publish just anyone or anything
anything without consent. I was the managing director of one for 15 years

Aviation company with 350 employees. I know how sensitive data is and how

It is important to obtain consent for the processing of such data. VR: Is there - 15 -

evidence for this? BF1: I have no written evidence. It would also be alien to life.
We were friends. We traveled so much together. I wouldn't have a reason

seen to require additional written proof. VR: You said

that you were the head of an aviation company for 15 years. Didn't you realize that?
Can such declarations of consent be obtained in writing? BF1: What for? We were friends. [...]

He insisted that his name be on my t-shirts just to show that he

Part of XXXX. VR: Have you concluded a written contract with MP about this?
BF1: No, that is also unusual in the industry. VR: You were 15 years old

Managing director in an aviation company. Why is it not common in this industry?

BF1: Contracts are concluded in aviation. But in this industry that is not the case
usual, it doesn't involve a lot of money. The contract would cost more to set up.”).

Against this background, he did not provide a written declaration of consent from the other party involved

or has obtained another contractual agreement with the co-participant is not
understandable and, conversely, leads to the conclusion that it is not

(clear) declaration of consent from the co-participant or other relevant information

agreement has come to him.

In view of these considerations, there are no reasons to reject the argument of the co-participant

I do not have the publications in question by the first complainant
agreed or was in no way aware of it, to doubt. To it

It doesn't change the fact that the other participants only participate in competitions or otherwise

wore T-shirts with the logo of the first complainant and also appeared in photos
the first complainant is shown because this alone constitutes consent to the

Publication of his name and picture on the homepage of the

First complainant cannot be derived for marketing purposes, among other things. As well
Little can be learned from the mere fact that the person involved - according to the information provided by the

First complainant – originally friends and part of the first complainant

his team was involved in the first complainant due to various incidents
wanted to take revenge, as sufficient evidence of the existence of a declaration of consent

be evaluated (negotiation document, page 4: “BF1: [..] He was part of the team and therefore

he was also mentioned in the report. That was also intentional, the MP and I were
very good friends. We met at XXXX after a certain amount of time

We became friends and became good friends. He was very talented, we have
trained together and also spent a lot of time together, during training and at

competitions. We also had a lot of personal contact. The MP has gotten better and better, that

was also the purpose of all the training. The MP then also thought about how - 16 -

he could become a professional. In my opinion, this complaint is unjustified
Return coach after an argument in which the MP insulted me and a

showed very aggressive behavior, which was not the first time.”).

to the second complainant:

The second complainant also claimed throughout the proceedings that he was a co-participant

I agreed to the publication in question and was also part of the team

been. However, he couldn't provide any evidence or anything concrete about this either
and, above all, do not make a uniform submission. While he is in his

In the statement dated May 9, 2019, the co-involved party was in 2016

When he himself approached him about this, he referred to one in his complaint
The first complainant's request to him in 2016 that he do so

those involved (due to poor popularity in the shooting sports scene).

on his website in a positive way. During the oral hearing he brought
Again, he stated that he asked the complainant whether this contribution was okay with him

although he did not ask him whether he could represent him XXXX and as XXXX

(Negotiation document, page 16: “VR: Does the MP agree to this
Publication granted? BF2: He did. VR: Can you please explain this in more detail! How did it come

to this declaration of consent? When does the MP tell you and in what form
declares that he agrees to the publication of which data on your homepage? BF2: Him

knew about every post and also knew the content of these posts because he wrote them for

Part even proofread it and he knew when the article would be published
became. He had the opportunity to speak up at any time if something wasn't right. He has

I also often pointed out spelling errors. VR: But there is also a specific one

MP approval? BF2: I asked the MP at the “XXXX Championship 2016” if
This post is okay for him and also whether the selected photos are appropriate

would. He agreed to publish it. VR: Is there any evidence of this? BF2: Me as

Person. As I said, it was all verbal. It was for friendship reasons for me
Also not necessary to sign a contract as we were very good friends. VR: Did

he also asks you to refer to him as XXXX and as XXXX? BF2: He doesn't have me

asked for it, but he had no objections." and page 15: "VR: The MP has so far
denied in the proceedings that he was part of this team? What do you think? BF2:

Why does someone wear the XXXX logo on their shirt if they have nothing to do with it?
wants. VR: Was there a sponsorship agreement for this? BF2: There were verbal sponsorship contracts,

which look so that the shooter can buy at reduced prices, or material

can be provided inexpensively. VR: Between who was this - 17 -

Contract? BF2: Between the company XXXX and the MP. I had one myself too
Sponsorship agreement with the company where I was employed. I didn't have one

written contract.”).

Given this contradictory information, it cannot be assumed that it is
there has been a declaration or act of consent from the co-participant, especially since the

The second complainant himself stated during the oral hearing that

the co-participant of a publication that is the subject of the proceedings here as XXXX and as
XXXX did not explicitly agree, but simply expressed no objections.

However, silence or inaction on the part of the person concerned cannot be considered as such

Declaration of consent or action can be viewed (cf. Jahnel, comment on
General Data Protection Regulation (GDPR) Art 4 Z 11, Rn 4).

In view of the vague and contradictory descriptions of the

second complainant and the fact that there is no other evidence of a
If such consent is available, there are therefore no reasons to support the argument

Fellow participants said he did not give his consent or that he was not part of the team

been to doubt. As with the first complainant, this is also changing
Nothing that the person involved only wears T-shirts at competitions or otherwise

the logo XXXX and also in photos with the second complainant
is shown because this alone constitutes consent to the publication of his name and

his picture on the homepage of the second complainant or another contractual agreement

No obligation to do so can be derived.

3. Legal assessment:

Section 1 Paragraph 1 and 2 DSG read:

“§ 1. (1) Everyone has, especially with regard to respect for their private and
Family life, right to confidentiality of personal data concerning him

Data to the extent that there is a legitimate interest in it. The existence of such

Interest is excluded if data is due to its general availability or
because of their lack of traceability to the person affected

confidentiality claim are not accessible.

(2) To the extent that the use of personal data is not vital
The interests of the person concerned or with their consent are restrictions

Right to secrecy only to protect overriding legitimate interests - 18 -

another is permissible, and in the case of interventions by a state authority only on the basis of
Laws arising from the provisions of Article 8 paragraph 2 of the European Convention for the Protection of the

Human rights and fundamental freedoms (ECHR), Federal Law Gazette No. 210/1958, mentioned reasons

are necessary. Such laws permit the use of data that is, by their nature
are particularly worthy of protection, only to protect important public interests

and at the same time must provide appropriate guarantees for the protection of the

Determine the confidentiality interests of those affected. Even in the case of permissible
The interference with fundamental rights may only be limited in the mildest possible way

leading type.”

Section 9 Paragraph 1 DSG reads:

“§ 9. (1) On the processing of personal data by media owners,

Editors, media employees and employees of a media company or

Media service within the meaning of the media law - MedienG, Federal Law Gazette No. 314/1981
journalistic purposes of the media company or media service

Provisions of this Federal Law as well as Chapters II (Principles), III of the GDPR

(Rights of the data subject), IV (Controller and processor), V
(Transfer of personal data to third countries or international

Organizations), VI (Independent Supervisory Authorities), VII (Cooperation and Coherence)
and IX (regulations for special processing situations) do not apply. The

When exercising its powers, the data protection authority has to comply with those in the first sentence

The persons mentioned must observe the protection of editorial confidentiality (Section 31 Media Act).”

Art. 4 Z 1, 2 and 7 GDPR read:

“Article 4

Definitions

For the purposes of this Regulation, the term means:

1. “personal data” means any information relating to an identified or

relate to an identifiable natural person (hereinafter “data subject”); as
A natural person is considered identifiable, directly or indirectly, in particular

by assigning it to an identifier such as a name or an identification number

Location data, an online identifier or one or more special ones
Characteristics that express the physical, physiological, genetic, psychological, - 19 -

economic, cultural or social identity of that natural person,
can be identified;

2. “Processing” means anything carried out with or without the aid of automated processes

Process or any such series of processes related to personal data
such as collecting, recording, organizing, arranging, storing, etc

Adaptation or modification, reading, querying, use, disclosure

through transmission, distribution or another form of provision, the comparison
or the linking, restriction, deletion or destruction;

7. “Responsible person” means the natural or legal person, authority, institution or

other body which, alone or jointly with others, determines the purposes and means of the
processing of personal data decides; are the ends and means of this

Processing dictated by Union law or the law of the Member States

The person responsible or the specific criteria for his or her nomination can be used
be provided for by Union law or the law of the Member States;'

Art. 5 Para. 1 GDPR reads:

“Article 5

Principles for processing personal data

(1) Personal data must

a) lawfully, in good faith and in a manner favorable to the data subject

processed in a comprehensible manner (“lawfulness, fair processing and

Faith, Transparency”);

b) collected for specified, explicit and legitimate purposes and may not be collected in a

be further processed in a manner that is incompatible with these purposes; one

Further processing for archiving purposes in the public interest
scientific or historical research purposes or for statistical purposes applies in accordance with

Article 89(1) is not deemed to be incompatible with the original purposes (“earmarking”);

c) appropriate and relevant to the purpose and relevant to the purposes of processing
be limited to the necessary extent (“data minimization”);

d) be factually correct and, where necessary, up to date; it's all of them

to take appropriate measures to ensure that personal data relating to - 20 -

the purposes of their processing are incorrect, will be deleted or corrected immediately
("Accuracy");

e) be stored in a form that only allows the identification of the data subjects

for as long as is necessary for the purposes for which they are processed;
Personal data may be stored longer as long as the personal data

Data subject to the implementation of appropriate technical and organizational measures

Measures provided for by this Regulation to protect the rights and freedoms of
data subject can only be requested for reasons that are in the public interest

Archival purposes or for scientific and historical research purposes or for

processed for statistical purposes in accordance with Article 89(1) (“storage limitation”);

f) processed in a way that ensures appropriate security

personal data is guaranteed, including protection against unauthorized or

unlawful processing and accidental loss
Destruction or accidental damage through appropriate technical and

organizational measures (“integrity and confidentiality”);”

Art. 6 Para. 1 GDPR reads:

“Article 6

Lawfulness of processing

Processing is only lawful if at least one of the following

Conditions are met:

a) The data subject has his or her consent to the processing of data concerning him or her
personal data given for one or more specific purposes;

b) the processing is for the performance of a contract to which the data subject is a party

Person is required or to carry out pre-contractual measures upon request
the person concerned;

c) the processing is necessary to fulfill a legal obligation which the

responsible person is subject to;

d) the processing is necessary to protect the vital interests of the data subject

or another natural person; - 21 -

e) the processing is necessary for the performance of a task carried out in public
interest or is carried out in the exercise of official authority, which is the responsibility of the person responsible

was transferred;

f) the processing is to protect the legitimate interests of the controller or
of a third party is necessary, unless the interests or fundamental rights and freedoms are violated

of the data subject, which require the protection of personal data, outweigh

especially if the person concerned is a child.

Point (f) of the first subparagraph does not apply to public authorities in the performance of their duties

processing carried out.”

First of all, it should be noted that the subject matter of the proceedings relates to
First complainant is an alleged violation of the right to secrecy because

he has the name and picture of the person involved on his homepage XXXX

In connection with the application of his company from July 30, 2015 to the end
Published September 2018. Subject of the proceedings in relation to the

Second appellant is an alleged violation of the right to confidentiality because

he has the name and picture of the person involved on his homepage XXXX
In connection with the application of the company XXXX or in connection with

with the designation XXXX from August 10, 2016 to November 2018.

The complainants deny such publication for advertising purposes or in

There is no connection with the name XXXX. However, this is (also) within limits

editorial reporting and thus for journalistic purposes within the framework of
Media privileges under Section 9 of the DSG are granted and the person involved has such privileges

I also always consent to publication.

According to Section 9 Paragraph 1 DSG, two requirements must be met cumulatively in order to be included in the
privileged scope of application: Firstly, processing must be carried out

personal data by media owners, publishers, media employees and

Employee of a media company or media service within the meaning of the Media Act
and, secondly, this processing is for journalistic purposes

media company or media service.

Processing of personal data for journalistic purposes is subject to this
Understanding of the ECJ if the processing has the sole aim of - 22 -

to disseminate information, opinions or ideas to the public (cf. ECJ,
December 16, 2008, C-73/07, paragraph 62).

It is undisputed that the first complainant submitted the report dated July 30, 2015 (application

his T-shirt) published on his homepage exclusively for advertising purposes,
hence the media privilege according to the above in relation to this publication

cannot be used under any circumstances.

But also with regard to the other reports here from November 9, 2015
and from August 10, 2016 there is no room for the provision of Section 9 DSG. Although they report

Complainants talk about their own experiences and experiences at various events

Shooting events and will undoubtedly also receive information about them
made available to the general public. The mention here

Co-participants including publication of images in the first complainant's report dated 9.

November 2015 and also in the second complainant's report of August 10, 2016
However, as stated, it was done for the purpose of presenting oneself positively

Training teams and therefore not in the context of editorial reporting.

The report of the second complainant dated September 18, 2016 can also be viewed as
general information to the public about the place attended by the second respondent

sporting event can be understood. However, the co-participant is listed as XXXX
designated. As stated, this designation is not an official one

Name of the person involved, this is still available to the general public and also that

known to those involved. The second complainant stated that the name
result from the participant's obvious preference for this predator. So wear

the participants wore T-shirts printed with this animal during sporting events

There is also a picture of it on his Facebook page. This means he overlooks it
Second complainant, however, that the mere preference for an animal does not automatically mean that

must mean that someone wants to be called such an animal. Actually

The very name of an animal can, under certain circumstances, be seen as humorous.
In particular, the combination of the animal's name and the chosen by the second complainant

In the present case, the (last) name of the person involved raises serious doubts as to whether the

The second complainant here has a factual debate about the co-participant and his
wanted to bring about achievements. The mention made in this context

However, co-participants as XXXX including the publication of images go beyond a general one
reporting beyond. - 23 -

As a whole, these publications are not intended for journalistic purposes
have taken place, the media privilege cannot be applied for this reason alone

application.

If the complainants also argue that the co-participant is due to the
The court settlement of December 17, 2019 no longer complains

and therefore simultaneous proceedings before the authority concerned are inadmissible

(have been), they overlook the fact that the basis of the settlement and the lawsuit dated 8.
Proceedings initiated in April 2019 solely to prevent future proceedings

Publications and not, as here, on the determination of a legal violation

Publications in the years 2015 or 2016 to 2018 were addressed. Already
Due to the lack of identity of the matter, the complainants' considerations cannot be accepted

be followed.

In the matter:

First of all, it should be noted that the co-participant objects to the

Complainant's name and picture in their reports in connection with the

Application of your or a specified company or with dubious ones
have published names.

It is undisputed that the name of the plaintiff and his picture constitute personal data within the meaning of Art 4 Z 1
GDPR are. By publishing this data on their homepage, the complainants

you have processed this data in accordance with Art 4 No. 2 GDPR.

Art 6 GDPR regulates the facts that justify the processing of data. The
Complainants rely on the permissible facts of Article 6 Paragraph 1 Letters a and f

GDPR.

According to this provision, the processing is lawful if the data subject
Consent to the processing of personal data concerning you

or has several specific purposes (lit. a) or if it is intended to protect the

the legitimate interests of the controller or a third party are necessary, provided that
not the interests or fundamental rights and freedoms of the data subject

Require protection of personal data, especially when it is

the person concerned is a child.

As was established, the complainants were able to do what they claimed

Consent of the co-participant to the publications in question neither - 24 -

prove or make credible. One based on the consent of the co-participant
based authorization for this publication is therefore not possible.

But there are no other reasons for the admissibility of this

Publication recognizable.

According to Art 6 Paragraph 1 lit f GDPR, the processing of personal data is subject to three

cumulative conditions permitted: Firstly, the processing must be carried out

A legitimate interest is exercised by those responsible or by a third party
secondly, the processing of personal data must be carried out

the legitimate interest may be necessary and thirdly, the interests or

Fundamental rights and freedoms of the person whose data is to be protected are not
outweigh (including OGH, February 2, 2022, 6Ob129/21w).

The interest in data processing is broadly understood. Be considered

legal, economic and non-material interests. A legitimate interest in
Data processing can result from the exercise of the right to freedom of expression and

Freedom of information arises (again OGH, February 2nd, 2022 m.w.H.).

According to the case law of the European Court of Human Rights (ECtHR), for
the purposes of balancing the fundamental right to secrecy (Article 8 EU-GRC)

and freedom of expression (Art. 11 EU-GRC) in particular on the contribution
a debate of general interest, the level of awareness of the person concerned,

the subject of the reporting, content, form and effects of the publication,

the manner and circumstances under which the information was obtained
and to remedy their accuracy (ECHR February 14, 2019, C-345/17, paragraph 66).

The possibility must also be taken into account that for processing

Takes responsible measures that make it possible to limit the extent of the interference in the
to reduce the right to privacy (see again ECJ February 14, 2019 C-345/17).

The complainants see their legitimate interest in data processing in the fact that they

make shooting sports accessible to a broad public through their reports.

In principle, these statements cannot be contradicted. How, however

As has already been stated, the report was published on July 30, 2015

the first respondent entirely for advertising purposes and found none in it at all
Reporting by this takes place. A arising from the exercise of the right to

Legitimate interest in the - 25 - resulting from freedom of expression and information

The publication in question can therefore neither be seen nor argued.
But also with regard to the incriminated publication of the name and image of the

co-participants in the reports dated November 9, 2015 and August 10, 2016

It should be noted that, as has already been stated, this is not a contribution to a debate
of general interest, but solely for the purpose of promoting the company

of the first complainant or in the case of the second complainant for the purpose of

Application from the company XXXX has been made. Also with regard to these publications
is therefore a result of the exercise of the right to freedom of expression and information

It is not possible to recognize the legitimate interest of the complainants. same for

ultimately also for the report from September 18, 2016. Here too, the naming of the
co-participants as XXXX - as already stated - about general reporting

out. The description of the person involved as a predator and published images

cannot therefore be based on a legitimate interest of the second complainant
and would be such a publication for the stated purpose of a factual one

Incidentally, reporting is not even necessary.

If the complainants point out that sporting events or their
Results are publicly available and therefore have no claim to secrecy

are accessible, they overlook the fact that in this case it is not a general one
reporting, but rather a publication for advertising purposes or with

questionable comments.

As a result, the confidentiality interests of the co-participants outweigh, so that
In this case, the legal basis for admissibility is Article 6 Paragraph 1 Letter f of the GDPR

data processing is also out of the question. Other reasons for the

The admissibility of the publications in question is not apparent
These were not even raised by the complainants.

This meant that the actual publication of the name and picture of the

Co-participants are not permitted in these reports. It was therefore admissible
decide, whereby the decision of the contested decision is in accordance with

The complaints had to be made more specific.

Regarding point B)

According to Section 25a Paragraph 1 VwGG, the administrative court has in its decision or

to decide whether the appeal is permissible in accordance with Article 133 Paragraph 4 B-VG. The
The statement must be briefly justified. - 26 -

The appeal is not permissible according to Art 133 Paragraph 4 B-VG because the decision was not made by the
The solution to a legal question that is of fundamental importance depends on the solution.

There is no lack of case law from the Administrative Court (see above

cited findings of the Administrative Court), the present one still differs
Decision depends on the previous jurisprudence of the Administrative Court; this is

not inconsistent either.

There are other indications of the fundamental importance of the legal question to be resolved
not before.