BVwG - W176 2234682-1

BVwG - W176 2234682-1

Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 4 GDPR Article 13 GDPR § 9 DSG
Decided:	29.04.2024
Published:	24.05.2024
Parties:	First complainant (data subject) Second complainant (controller) DSB (data protection authority)
National Case Number/Name:	W176 2234682-1
European Case Law Identifier:	ECLI:AT:BVWG:2024:W176.2234682.1.00
Appeal from:
Appeal to:	Not appealed
Original Language(s):	German
Original Source:	RIS (in German)
Initial Contributor:	Ava Lang

An court held that an animal rights activist violated Articles 13 and 15 GDPR by filming a hunter without providing information at the time of collection and by failing to answer an access request.

English Summary

Facts

The data subject participated in a hunting event on 3 November 2018. During the event, another person (the controller) filmed and photographed the hunt and the data subject in order to document hunting practices and publish the material online.

At the time of the recording, the data subject received no information about the the identity of the controller, the purposes of data processing, or the recipients of the data (Article 13 GDPR).

On 6 November 2018, the data subject submitted an access request under Article 15 GDPR. He asked about the purposes of the processing, the categories of data processed, recipients, storage periods, legal basis, and requested a copy of all personal data concerning him. The controller did not respond. The data subject then filed a complaint at the Austrian DPA on 09 January 2019.

The controller argued before the Austrian DPA that the recordings served journalistic purposes and therefore fell under the Austrian media privilege in § 9 DSG. He claimed that he acted as a form of “citizen journalist” and that complying with access requests would obstruct investigative journalism.

The DPA rejected the argument that the media privilege applied. It nevertheless dismissed the data subject's complaint concerning Article 13 GDPR because it considered that the data subject already knew enough about the controller and the intended publication. However, the DPA upheld the complaint concerning Article 15 GDPR and ordered the controller to answer the access request.

Both parties appealed to the Federal Administrative Court.

Holding

First, the court held that the controller processed personal data within the meaning of Article 4(1) and Article 4(2) GDPR by recording photo and video material showing the data subject during the hunting event.

Second, the court held that the Austrian media privilege in § 9 DSG did not apply. The court found that the controller was neither a media undertaking nor a media service within the meaning of Austrian media law. The controller published material on a private Facebook account and lacked the minimum organisational and economic structures required for a media enterprise. The court also rejected an extension of the exemption to “citizen journalists”. It noted that the Austrian legislature had intentionally drafted § 9 DSG narrowly and that an expansive interpretation would contradict the wording and legislative intent.

The court further held that even a broader interpretation of § 9 DSG would not exempt the controller from complying with Article 15 GDPR because answering an access request would not undermine freedom of expression or journalistic activity in the circumstances of the case.

Third, the court confirmed that the controller violated Article 15 GDPR by failing to answer the access request.

Fourth, the court overturned the DPA’s finding regarding Article 13 GDPR. The court held that the controller violated Article 13 GDPR because he failed to provide the required information at the time he collected the image data. The court rejected the argument that the data subject already possessed the relevant information under Article 13(4) GDPR.

The court also clarified that a later disclosure of information during proceedings could not retroactively remedy a violation of Article 13 GDPR.

Finally, the court dismissed the controller’s appeal, upheld the access request by the data subject, and amended the decision to additionally establish a violation of Article 13 GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Decision Date

April 29, 2024

Legal Norm

Federal Constitutional Law (B-VG) Art. 133 para. 4
GDPR Art. 13

Federal Constitutional Law (B-VG) Art. 133 currently in force: Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019 to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019, last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 133 valid from May 25, 2018 to December 31, 2018, last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 133 valid from August 1, 2014 to May 24, 2018, last amended by Federal Law Gazette I No. 164/2013 Article 133 of the Federal Constitutional Law (B-VG) valid from 01.01.2014 to 31.07.2014, last amended by Federal Law Gazette I No. 51/2012; Article 133 of the Federal Constitutional Law (B-VG) valid from 01.01.2004 to 31.12.2013, last amended by Federal Law Gazette I No. 100/2003; Article 133 of the Federal Constitutional Law (B-VG) valid from 01.01.1975 to 31.12.2003, last amended by Federal Law Gazette No. 444/1974; Article 133 of the Federal Constitutional Law (B-VG) valid from 25.12.1946 to 31.12.1974, last amended by Federal Law Gazette No. 211/1946; Article 133 of the Federal Constitutional Law (B-VG) valid from 19.12.1945 to 24.12.1946, last amended by Federal Law Gazette No. 4/1945, Federal Constitutional Law, Article 133, valid from January 3, 1930 to June 30, 1934

Judgment

W176 2234682-1/8E

W176 2234682-2/6E

IN THE NAME OF THE REPUBLIC!

The Federal Administrative Court, composed of Judge Mag. Newald as presiding judge and lay judges Mag. Bogendorfer and RAUB as associate judges, renders the following decision on the appeals of (1.) XXXX and (2.) XXXX against the decision of the Data Protection Authority dated March 27, 2020, file number D124.296 2020-0.203.901:

A1.) The appeal of the second appellant is dismissed as unfounded.

] ( ) ... A2.) The appeal of the first appellant is granted, and the contested decision is amended in point 1 to state that the second appellant violated the obligation to provide information when collecting personal data (image data) from the first appellant on November 3, 2018, by failing to provide the first appellant with the information required under Article 13 of the GDPR at the time this image data was collected.

A2.) The appeal of the first appellant is granted, and the contested decision is amended in point 1 to state that the second appellant violated the obligation to provide information when collecting personal data (image data) from the first appellant on November 3, 2018, by failing to provide the first appellant with the information required under Article 13 of the GDPR at the time this image data was collected. B) The appeal is inadmissible pursuant to Article 133, paragraph 4 of the Austrian Federal Constitutional Law (B-VG).

Text

Reasons for the Decision:

I. Procedural History:

1.1. By submission dated January 9, 2019, amended by submissions dated January 29, 2019 and February 25, 2019, the first complainant filed a data protection complaint with the Data Protection Authority (also: respondent authority) against the second complainant, alleging a violation of his rights to confidentiality, information, and access, and essentially arguing the following: The second complainant had taken photographs of him without his consent during a hunting event on November 3, 2018. No information within the meaning of Article 13 GDPR had been provided. The first complainant perceived this through corresponding "clicking sounds" from the camera used by the second complainant, which was pointed at the first complainant's face. Despite requests from the first complainant to cease this activity, the second complainant continued to take photographs and videos. The first complainant subsequently submitted a request for information to the second complainant but has not yet received any information pursuant to Article 15 of the GDPR. The second complainant's animal welfare organization is not deterred from publishing these images on its website. The data collected from the first complainant contains "ethnic" and "racial" information, which is why it constitutes sensitive data and qualifies as special categories of personal data. Furthermore, it was requested that criminal proceedings be initiated against the second complainant and that a fine be imposed. 1.1. By submission dated January 9, 2019, and amended by submissions dated January 29, 2019, and February 25, 2019, the first complainant filed a data protection complaint with the data protection authority (also referred to as the respondent authority) against the second complainant, alleging a violation of his rights to confidentiality, information, and access, and essentially arguing the following: The second complainant had taken photographs of him without his consent during a hunting event on November 3, 2018. No information as required by Article 13 of the GDPR had been provided. The first complainant had perceived this through the clicking sounds of the camera used by the second complainant, which was pointed at the first complainant's face. Despite requests from the first complainant to cease, the second complainant continued to take photographs and videos. The first complainant subsequently submitted a request for information to the second complainant but has not yet received any information within the meaning of Article 15 of the GDPR. The second complainant's animal welfare organization is not deterred from publishing these images on its website. The data collected from the first complainant contains "ethnic" and "racial" information, which is why it constitutes sensitive data and qualifies as special categories of personal data. Furthermore, it was requested that criminal proceedings be initiated against the second complainant and that a fine be imposed.

1.2. Subsequently, the respondent authority divided the proceedings into one concerning the violation of the right to confidentiality (then referred to file number D124.296) and the other concerning the violation of the rights to information and access (relevant in the present case).

2. By letters dated March 11, 2019, and April 9, 2019, the respondent authority requested a statement from the second appellant.

3. In a written submission dated April 12, 2019, the second appellant stated that he had recorded video footage during a hunting event on November 3, 2018, to document how a hunt was conducted. The recordings were intended for publication by an unspecified group of people to disseminate information about the handling of birds during and before such hunting events. There was a significant public interest in such reporting. The public should be informed and sensitized to these events through informational videos. The recordings in question were made exclusively for journalistic purposes and invoked the media privilege under Section 9 Paragraph 1 of the Data Protection Act. 3. In his written submission of April 12, 2019, the second appellant stated that he had recorded video footage during a hunting event on November 3, 2018, to document how a hunt was conducted. The recordings were intended for publication by an unspecified group of people to disseminate information about the handling of birds during and before such hunting events. He argued that there was a significant public interest in such reporting. The public should be informed and sensitized to these processes through informational videos. The recordings in question were made exclusively for journalistic purposes and invoked the media privilege under Section 9, Paragraph 1, of the Data Protection Act (DSG).

4. In a letter dated July 10, 2019, the respondent authority informed the second appellant that the provision of Section 9, Paragraph 1, of the Data Protection Act (DSG) did not apply, as the requirements of the aforementioned provision (existence of a media company, etc.) were not met. 4. By letter dated July 10, 2019, the respondent authority informed the second appellant that the provision of Section 9, paragraph 1, of the Data Protection Act (DSG) did not apply, as the requirements of the aforementioned provision (existence of a media company, etc.) were not met.

5. Subsequently, by letter dated August 9, 2019, the second appellant referred to a ruling by the European Court of Justice (ECJ) according to which citizen journalists also fall within the scope of Article 9 of the Data Protection Directive. The term "media company" should, due to the required interpretation in conformity with EU law, also be extended to citizen journalists and thus to the second appellant. No publications had yet taken place, as the creation and collection of materials had not yet been completed. Furthermore, personal data would be removed before publication, for example, by pixelation. The publication would generally take place on the second appellant's private Facebook account. The photographs had been taken for personal interest. The fulfillment of the obligations under Articles 13 and 14 of the GDPR, as well as Article 15 of the GDPR, is not required due to Section 9 of the Data Protection Act (DSG). Fulfilling these obligations would significantly hinder the research, investigation, and discussion of such treatment of animals. 5. Subsequently, in a written submission dated August 9, 2019, the second appellant referred to a ruling by the European Court of Justice (ECJ) according to which citizen journalists also fall within the scope of Article 9 of the Data Protection Directive. The term "media company" should, due to the required interpretation in conformity with EU law, also be extended to citizen journalists and thus to the second appellant. No publications have yet taken place, as the creation and collection of materials were not yet complete. Furthermore, personal data will be removed before publication, for example, by pixelation. The publication will generally take place on the second appellant's private Facebook account. The photographs were taken out of personal interest. Compliance with the obligations under Articles 13, 14, and 15 of the GDPR is not required due to Section 9 of the GDPR. Fulfilling these obligations would significantly hinder research, investigation, and discussion regarding such treatment of animals.

6. In his statement of October 2, 2019, the first complainant essentially argued that the second complainant was not a "media entrepreneur or journalist" and therefore did not fall under Section 9 of the Data Protection Act (DSG).

7.1. By decision of March 27, 2020, the respondent authority dismissed the first complainant's data protection complaint regarding the alleged violation of the right to information (Point I of the decision). Regarding the alleged violation of the right of access, the data protection authority upheld the complaint and found that the second complainant had violated the first complainant's right of access by failing to comply with the latter's request for information dated November 6, 2018 (Judgment II). The second complainant was ordered to comply with the first complainant's request for access within two weeks, failing which enforcement proceedings would be initiated, or to inform the first complainant of the failure to act pursuant to Article 12(4) GDPR (Judgment III). The first complainant's request for the initiation of criminal proceedings and the imposition of a fine against the second complainant was dismissed (Judgment IV). 7.1. By decision dated March 27, 2020, the respondent authority dismissed the first complainant's data protection complaint regarding the alleged violation of the right to information (Judgment I). Regarding the alleged violation of the right to information, the data protection authority upheld the complaint and found that the second complainant had violated the first complainant's right to information by failing to comply with the latter's request for information dated November 6, 2018 (Ruling II). The second complainant was ordered to comply with the first complainant's request for information within two weeks, failing which enforcement proceedings would be initiated, or to inform the first complainant of the failure to act pursuant to Article 12(4) of the GDPR (Ruling III). The first complainant's request for the initiation of criminal proceedings and the imposition of a fine against the second complainant was dismissed (Ruling IV).

The second complainant was ordered to comply with the first complainant's request for information within two weeks, failing which enforcement proceedings would be initiated (Ruling IV). The respondent authority reasoned that the second appellant could not invoke the media privilege stipulated in Section 9 Paragraph 1 of the Data Protection Act (DSG), and therefore this provision did not preclude the finding of a violation of the first appellant's rights to information and access. Regarding the violation of the right to information, the first appellant had already pointed out in his data protection complaint that the second appellant was a member of the Association Against Animal Factories and for what purpose and in what manner the second appellant generally published the recordings. Since the first appellant thus already possessed the relevant information, the provisions of Article 13 Paragraphs 1 to 3 of the GDPR did not apply, pursuant to Article 13 Paragraph 4 of the GDPR. With regard to the alleged violation of the right of access, it should be noted that the second appellant had not complied with the first appellant's request for access. The respondent authority reasoned that the second appellant could not invoke the media privilege stipulated in Section 9, Paragraph 1, of the Data Protection Act (DSG), and therefore this provision did not preclude the finding of a violation of the first appellant's rights to information and access. Regarding the violation of the right to information, the first appellant had already pointed out in his data protection complaint that the second appellant was a member of the Association Against Animal Factories and for what purpose and in what manner the second appellant generally published the recordings. Since the first appellant thus already possessed the relevant information, the provisions of Article 13, Paragraphs 1 to 3, of the GDPR did not apply, pursuant to Article 13, Paragraph 4. With regard to the alleged violation of the right of access, it should be noted that the second appellant had not complied with the first appellant's request for access.

With respect to the alleged violation of the right of access, it should be noted that the second appellant had not complied with the first appellant's request for access. Finally, the respondent authority provided reasons for rejecting the data protection complaint regarding the application to initiate criminal proceedings and impose a fine against the second appellant.

8.1. The first appellant filed a timely appeal against point I of this decision, arguing as follows: The information pursuant to Article 13(2) GDPR must be provided before the data is collected. The first appellant should therefore have been informed by the second appellant about all the requirements of Article 13 GDPR before the data was collected. 8.1. The first appellant filed a timely appeal against point I of this decision, arguing as follows: The information pursuant to Article 13(2) GDPR must be provided before the data is collected. The first appellant should therefore have been informed by the second appellant about all the requirements of Article 13 GDPR before the data was collected.

8.2. In a timely written submission, the second appellant lodged an appeal (clearly) against points II and III of the decision (which were unfavorable to him), essentially reiterating that the photographs in question were taken exclusively for journalistic purposes and, in his legal opinion, under the media privilege pursuant to Section 9 Paragraph 1 of the Data Protection Act (DSG). The first appellant had contacted him on November 6, 2018, with a request for information, which he had not complied with, as he relied on his media privilege. The numerous requests for information were causing a massive workload. Twelve requests for information had already been submitted by hunters from the hunting association in question, which were severely hindering investigative journalism. The second complainant also suggested, firstly, that an application be submitted to the Constitutional Court to declare the phrase "within the meaning of the Media Act - MedienG, Federal Law Gazette No. 314/1981", or alternatively the phrase "by media owners, publishers, media staff and employees of a media company or media service within the meaning of the Media Act - MedienG, Federal Law Gazette No. 311/1981", [and subsequently the phrase] "of the media company or media service" in Section 9 Paragraph 1 of the Data Protection Act (DSG) unconstitutional, or, secondly, that the question be referred (in abbreviated form) to the European Court of Justice as to whether Article 85 of the GDPR is to be interpreted in such a way that a national legislature may, by means of a statutory provision, define the scope of application of the provision in such a way as to exclude citizen journalists pursuing journalistic purposes. 8.2. In a timely written submission, the second appellant lodged an appeal (clearly) against points two and three of the decision (which were unfavorable to him), essentially reiterating that the photographs in question were taken exclusively for journalistic purposes and, in his legal opinion, under the media privilege pursuant to Section 9, Paragraph 1, of the Data Protection Act. The first appellant had contacted him on November 6, 2018, with a request for information, which he had not complied with, as he relied on his media privilege. The numerous requests for information were causing a massive workload. Twelve requests for information had already been submitted by hunters from the hunting association in question, which were severely hindering investigative journalism. The second appellant also suggested, firstly, that an application be filed with the Constitutional Court to declare the phrase "within the meaning of the Media Act (MedienG, Federal Law Gazette No. 314/1981)," or alternatively, the phrase "by media owners, publishers, media staff, and employees of a media company or media service within the meaning of the Media Act (MedienG, Federal Law Gazette No. 311/1981)," [and subsequently the phrase] "of the media company or media service" in Section 9, Paragraph 1, of the GDPR, unconstitutional; and secondly, that the Court refer the question (in abbreviated form) to the European Court of Justice (ECJ) as to whether Article 85(1) of the GDPR is to be interpreted in such a way that a national legislature can define the scope of the provision by means of a statutory regulation in such a way as to exclude citizen journalists pursuing journalistic purposes.

``` 9. By decision dated May 4, 2021, file number D124.003, the respondent authority dismissed the first appellant's data protection complaint regarding the alleged violation of the right to confidentiality.

10. By letter dated August 13, 2020, the respondent authority submitted the complaints of the first and second appellants to the Federal Administrative Court for a decision. It stated that there is no right to a declaration that the right to information was violated in the past if this deficiency had been remedied by the time of the administrative decision.

11. Subsequently, it submitted the first appellant's appeal against the decision described in point 9.

12. By decision of August 24, 2023, file number W274 223598-1, the Federal Administrative Court, after conducting appeal hearings on October 21, 2021, and October 20, 2022, dismissed the first appellant's appeal concerning a violation of the right to confidentiality. It was established, among other things, that the second appellant filmed at a distance of two meters in the direction of the first appellant during the hunting event on November 3, 2018. Furthermore, the court found that the first appellant was not within the second appellant's field of view at that time, nor did it establish that the second appellant had created any film or photographic documentation depicting the first appellant on that day.

II. The Federal Administrative Court considered the following: Roman numeral two. The Federal Administrative Court considered the following:

1. Findings:

The first appellant participated in a hunting event in hunting area XXXX on November 3, 2018. During the hunting event, the second appellant took photographs and videos to document the hunt. Photographs of the first appellant were also taken. Up to that point, the first appellant did not know the identity of the second appellant. The first appellant participated in a hunting event in hunting area 40 on November 3, 2018. During the hunting event, the second appellant took photographs and videos to document the hunt. Photographs of the first appellant were also taken. Up to that point, the first appellant did not know the identity of the second appellant.

The second complainant did not provide the first complainant with any information within the meaning of Article 13 GDPR at the time the images were taken.

The second complainant did not provide the first complainant with any information within the meaning of Article 13 GDPR at the time the images were taken. The first appellant submitted a request for information to the second appellant by letter dated November 6, 2018, asking for answers to the following questions:

“a.) For what purposes were my images and/or videos stored and processed?

b.) What specific content do the images and videos contain?

c.) What personal data have you obtained from them, or what personal data do you process about me?

d.) To whom was or is this data transmitted?

e.) How long do you store my personal data?

f.) What criteria have you established for the duration of storage?

g.) On what contractual or legal basis was/is my personal data stored or processed?”

Furthermore, he requested a copy of all personal data stored about him.

``` The second appellant did not respond to the request for information submitted to him by the first appellant on November 6, 2018, at the time of the decision.

2. Evaluation of Evidence:

The finding regarding the second appellant's taking of photographs of the first appellant is based on the first appellant's submissions on this matter in conjunction with the second appellant's unambiguous statement in his appeal against the decision, according to which he "made video footage of the hunting event on November 3, 2018, […] in which [the first appellant] was also depicted […]". Insofar as the Federal Administrative Court made a negative finding in this regard in the ruling mentioned under point 12, it must be noted that no such unambiguous statement from the second appellant was present in the proceedings in question. Rather, he had stated that while the first appellant had been within the potential recording area, he denied having filmed him, "because it's not exciting to film someone talking on the phone." Moreover, the contested decision had already established that the first appellant had been filmed by the second appellant, and the accuracy of this finding was not disputed in the latter's appeal.

[The text abruptly ends here, so the context is unclear.] The finding that the first appellant did not know who the second appellant was until the photographic material was taken on November 3, 2018, is based on the credible testimony of the first appellant in the appeal hearing held on October 21, 2022, in the appeal proceedings under file number W274 223598-1, according to which he did not know at that time that the person who had suddenly appeared (and added: filmed) was the second appellant (see the relevant transcript of the hearing, p. 3). The fact that the first appellant (as correctly stated in the contested decision) pointed out in his data protection complaint – dated January 8, 2019 – that the second appellant was an activist or campaign manager of the Association Against Animal Factories, does not contradict this, especially since the first appellant, in the aforementioned hearing, when asked whether he had seen the second appellant at a hunting event after the hunt in question, stated that the latter now appears at all hunts (i.e., only hunts organized by Mr. Flucher). The finding that the first appellant did not know who the second appellant was until the photographic material was taken on November 3, 2018, is based on the credible testimony of the first appellant in the appeal proceedings under file number W274 223598-1. The first appellant stated in the appeal hearing held on October 21, 2022, that he did not know at the time that the person who had suddenly appeared (and added: filmed) was the second appellant (see the relevant hearing transcript, p. 3). The fact that the first appellant (as correctly noted in the contested decision) pointed out in his data protection complaint dated January 8, 2019, that the second appellant was an activist or campaign manager for the Association Against Factory Farming, does not contradict this, especially since, in the aforementioned hearing, when asked whether he had seen the second appellant at a hunting event after the hunt in question, the first appellant stated that the second appellant now appears at all hunts (i.e., only those organized by Mr. Flucher).

The fact that the first appellant (as correctly noted in the contested decision) pointed out in his data protection complaint dated January 8, 2019, that the second appellant was an activist or campaign manager for the Association Against Factory Farming does not contradict this, especially since the first appellant, when asked in the aforementioned hearing whether he had seen the second appellant at a hunting event after the hunt in question, stated that the second appellant "now appears at all hunts" (i.e., only hunts organized by Mr. Flucher).

The finding that the second appellant did not provide the first appellant with information within the meaning of Article 13 GDPR at the time the photographic material was taken is based on the credible submissions of the first appellant, which the second appellant has not disputed.

3. Legal Assessment:

3.1. Regarding the Senate's Jurisdiction:

Pursuant to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court decides through a single judge, unless federal or state law provides for a decision by a panel. Regarding the Senate's jurisdiction: According to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court decides by a single judge unless federal or state law provides for a decision by a panel.

Therefore, pursuant to Section 27 of the Data Protection Act (DSG), the Senate has jurisdiction in this case.

3.2. Regarding point A1 of the ruling:

3.2.1. Article 15 GDPR states: Article 15 of the GDPR reads:

"Article 15

Right of access by the data subject

(1) The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

a) the purposes of the processing;

b) the categories of personal data concerned;

c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

f) the right to lodge a complaint with a supervisory authority;

g) where the personal data are not collected from the data subject, the controller shall, without undue delay the processing is necessary for compliance with a legal obligation to which the controller is subject; The personal data collected from the data subject shall be provided with all available information concerning the source of the data;

(h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

(2) Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer. ....“

Article 4(1), (2) and (7) GDPR read: Article 4(1), (2) and (7) GDPR read:

“Article 4

Definitions

For the purposes of this Regulation, the term:

1. ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;

2. “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;

7.“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for by Union or Member State law;

``` Section 9, paragraph 1 of the Data Protection Act (DSG) reads: Section 9, paragraph one, of the Data Protection Act (DSG) reads:

"Section 9. (1) The provisions of this Federal Act and Chapters II (Principles), III (Rights of the Data Subject), IV (Controller and Processor), V (Transfers of Personal Data to Third Countries or International Organizations), VI (Independent Supervisory Authorities), VII (Cooperation and Consistency), and IX (Provisions for Specific Processing Situations) of the GDPR do not apply to the processing of personal data by media owners, publishers, media staff, and employees of a media company or media service within the meaning of the Media Act – MedienG, Federal Law Gazette No. 314/1981, for journalistic purposes of the media company or media service. The Data Protection Authority must observe the protection of editorial confidentiality (Section 31 MedienG) when exercising its powers with respect to the persons mentioned in the first sentence." "Section 9. (1) The processing of personal data by media owners, Publishers, media employees, and employees of a media company or media service within the meaning of the Media Act (MedienG, Federal Law Gazette No. 314 of 1981), for journalistic purposes of the media company or media service, are exempt from the provisions of this Federal Act and from Chapters II (Principles), III (Rights of the Data Subject), IV (Controller and Processor), V (Transfers of Personal Data to Third Countries or International Organizations), VI (Independent Supervisory Authorities), VII (Cooperation and Consistency), and Ninth (Provisions for Specific Processing Situations) of the GDPR. The Data Protection Authority, when exercising its powers with respect to the persons mentioned in the first sentence, must observe the protection of journalistic confidentiality (Section 31, MedienG).

``` Section 1, paragraphs 6 and 7 of the Media Act read as follows:

Section 1. (1) For the purposes of the provisions of this Federal Act, the following definitions apply:

6. “Media company”: a company that is responsible for the content creation of the medium as well as

a) its production and distribution or

b) its broadcasting or availability

either procures or arranges for it;

7. “Media service”: a company that provides media companies with recurring contributions in the form of text, writing, audio, or video;

3.2.2. In this specific case, this means:

Pursuant to Article 15 of the GDPR, the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed; If this is the case, the data subject has the right to access this personal data and the information specified in points (a) to (h) of Article 15(1) GDPR. According to Article 15 GDPR, the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the information specified in points (a) to (h) of Article 15(1) GDPR.

... It should first be noted that, in the present case, personal data of the first complainant within the meaning of Article 4(1) GDPR was processed by the second complainant by the second complainant taking photographs and videos at the aforementioned hunting event, in which the first complainant also appears.

The GDPR defines the term "processing" in Article 4(2) GDPR by listing a number of possible uses. This includes the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The fact that such processing is taking place in this case was not disputed by either party in the administrative proceedings. The GDPR defines the term "processing" in Article 4, paragraph 2, by listing a range of possible operations. This includes the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The fact that such processing is taking place in this case was not disputed by either party in the administrative proceedings.

The GDPR defines the term "processing" in Article 4, paragraph 2, by listing a range of possible operations. Regarding the definition of "collection": Collection is the acquisition of data about a data subject. Collection thus refers to a process by which the collecting entity gains knowledge of the data in question or establishes the power to control the data. Collection requires active action by the controller. Data can be collected in a targeted manner by technically capturing it – for example, through a sensor, a camera, or another data recording device. Alternatively, a person can perceive the data and enter it into an information technology system (see Roßnagel in Simitis/Hornung/Spiecker, Data Protection Law, Article 4, No. 2, para. 15). Alternatively, a person can also perceive the data and enter it into an information technology system (see Roßnagel in Simitis/Hornung/Spiecker, Data Protection Law, Article 4, No. 2, para. 15).

Regarding the definition of "capture": The process of capture is closely related to the collection of personal data and refers to the technical formatting of the collected data. It is "captured" in a specific format that enables further technical processing (see Roßnagel in Simitis/Hornung/Spiecker, Data Protection Law, Article 4, No. 2, para. 16).

``` According to Section 9 Paragraph 1 of the Data Protection Act (DSG), the provisions of this Federal Act and Chapters II (Principles), III (Rights of the Data Subject), IV (Controller and Processor), V (Transfers of Personal Data to Third Countries or International Organizations), VI (Independent Supervisory Authorities), VII (Cooperation and Consistency), and IX (Provisions for Specific Processing Situations) of the GDPR do not apply to the processing of personal data by media owners, publishers, media staff, and employees of a media company or media service within the meaning of the Media Act (MedienG), Federal Law Gazette No. 314/1981, for journalistic purposes of the media company or media service. Roman numeral II (Principles), Roman numeral III (Data Subject Rights), Roman numeral IV (Controller and Processor), Roman numeral V (Transfers of Personal Data to Third Countries or International Organizations), Roman numeral VI (Independent Supervisory Authorities), Roman numeral VII (Cooperation and Consistency), and Roman numeral Ninth (Provisions for Specific Processing Situations) do not apply.

3.2.2. Although the second appellant claimed to have pursued a journalistic purpose with the photographs taken, the photographs in question were not processed by a media owner, publisher, media employee, or employee of a media company or media service within the meaning of the Media Act (MedienG, Federal Law Gazette No. 314/1981) for the journalistic purposes of the media company or media service. 3.2.2. Although the second appellant claimed to have pursued a journalistic purpose with the photographs taken, the photographs in question were not processed by a media owner, publisher, media employee or employee of a media company or media service within the meaning of the Media Act (MedienG), Federal Law Gazette No. 314 of 1981, for the journalistic purposes of the media company or media service.

To the extent that the second appellant opposes the respondent authority's view that the provision of Section 9 of the Data Protection Act (DSG) is not applicable in the present case, arguing that he should be considered a "one-person media company" under Section 1 of the Media Act (MedienG) and is therefore covered by the exception in Section 9, Paragraph 1 of the DSG, his argument is unfounded:

According to Section 1, Paragraph 2 of the Austrian Commercial Code (UGB), a company is any organization engaged in independent economic activity on a permanent basis, even if it is not profit-oriented. Section 1(1)(6) of the Media Act defines a "media company" as a company that is responsible for the content creation of a medium and either produces or arranges its production and distribution (lit. a) or its broadcasting or availability on demand (lit. b). According to Section 1(1)(7) of the Media Act, a "media service" is a company that regularly provides media companies with content in text, writing, audio, or video format. According to the Austrian Supreme Court (OGH), a media owner only becomes a media company within the meaning of Section 1(1)(6) of the Media Act if, beyond the mere private distribution of content, they operate a company—with a minimum level of entrepreneurial structure—whose business purpose is the content creation of a website [or other medium], carried out by an editorial team and numerous employed or freelance media staff (OGH 15.12.2014, 6 Ob 6/14x). This undoubtedly does not apply to the second appellant, especially since he himself stated that the photos were generally published on his private Facebook account and that the photographs were taken for his own personal benefit. According to Section 1, Paragraph 2 of the Austrian Commercial Code (UGB), a company is any organization engaged in independent economic activity on a permanent basis, even if it is not profit-oriented. Section 1, Paragraph 1, Clause 6 of the Austrian Media Act (MedienG) defines a "media company" as a company that is responsible for the content creation of the medium and either produces or arranges its production and distribution (Clause a) or its broadcasting or availability on demand (Clause b). According to Section 1, Paragraph 1, Clause 7 of the Austrian Media Act (MedienG), a "media service" is a company that regularly provides media companies with content in the form of words, writing, sound, or images. According to the Austrian Supreme Court (OGH), a media owner only becomes a media entrepreneur within the meaning of Section 1, Paragraph 1, Item 6 of the Media Act if, beyond the mere private distribution of content, they operate a business—with a minimum level of entrepreneurial structure—whose business purpose is the content creation of a website [or other medium], carried out by an editorial team and a large number of employed or freelance media staff (OGH 15.12.2014, 6 Ob 6/14x). This clearly does not apply to the second appellant, especially since they themselves stated that the photos were generally published on their private Facebook account and that the photographs were taken for their own personal benefit.

Even though, according to the legal opinion cited by the second appellant, a specific organizational structure or a certain size is not required for classification as a media company, the second appellant has not specifically argued, nor has it otherwise become apparent, that he possesses a minimum level of entrepreneurial structure, actually engages in economic activity, and/or bears entrepreneurial risk. Therefore, the second appellant cannot be classified as a "one-person media company," a "media company" within the meaning of Section 1 Paragraph 1 Item 6 of the Media Act, or a "media service" within the meaning of Section 1 Paragraph 1 Item 7 of the Media Act. The second appellant cannot be classified as a "one-person media company" within the meaning of Section 1, Paragraph 1, Item 6 of the Austrian Media Act (MedienG) or as a "media service" within the meaning of Section 1, Paragraph 1, Item 7 of the Austrian Media Act (MedienG).

The analogous application of Section 9 Paragraph 1 of the Austrian Data Protection Act (DSG) to the present case is also precluded, as the restriction stipulated in Section 9 Paragraph 1 of the DSG was not included in the originally planned implementation of Article 85 Paragraph 2 of the GDPR in the version of the 2018 Data Protection Adaptation Act. Therefore, this represents a deliberately restrictive approach by the Austrian legislature (see Austrian Administrative Court [VwGH] decision of October 10, 2018, Ra 2018/08/0189, Rs 4, with further references, according to which analogy is generally permissible in public law, but requires the existence of a genuine legal gap). An interpretation in conformity with EU law in the sense of extending it to “citizen journalism”, as proposed by the second appellant, is not possible due to the unambiguous wording and the associated, clearly discernible will of the legislator. It is not the legislator's intention that any person can rely on Section 9 Paragraph 1 of the Data Protection Act (DSG). The analogous application of Section 9 Paragraph 1 of the DSG to the present case is also precluded, because the restriction stipulated in Section 9 Paragraph 1 of the DSG was not provided for in the originally planned implementation of Article 85 Paragraph 2 of the GDPR in the version of the Data Protection Adaptation Act 2018. Therefore, this represents a deliberately restrictive approach by the Austrian legislator (see the Austrian Administrative Court decision of October 10, 2018, Ra 2018/08/0189, Rs 4 with further references, according to which analogy is generally permissible in public law, but requires the existence of a genuine legal gap). An interpretation compliant with EU law, extending the scope to "citizen journalism" as proposed by the second appellant, is not possible due to the unambiguous wording and the clearly discernible intent of the legislator. It is not the legislator's intention that any individual could invoke Section 9, Paragraph 1 of the GDPR.

Even assuming the possibility of an interpretation of Section 9, Paragraph 1 of the GDPR compliant with EU law, it must be considered that Section 9, Paragraph 1 lacks a necessity clause, as required by Article 85 of the GDPR ("where this is necessary to reconcile the right to the protection of personal data with the freedom of expression and information"). Therefore, an exception to, for example, Chapter III could only be accepted to the extent necessary to reconcile the right to the protection of personal data with the freedom of expression and information. In the present case, however, the first complainant's right of access under Article 15 GDPR does not infringe upon the second complainant's freedom of expression and information, which is why even an interpretation in conformity with EU law does not lead to a different result. Even assuming the possibility of an interpretation of Section 9, paragraph 1, of the GDPR in conformity with EU law, it would have to be considered that Section 9, paragraph 1, of the GDPR lacks a necessity clause, such as the one prescribed in Article 85 GDPR ("where this is necessary to reconcile the right to the protection of personal data with the freedom of expression and information"). Therefore, an exception to, for example, Chapter III could only be assumed to the extent that this is necessary to reconcile the right to the protection of personal data with the freedom of expression and information. In the present case, however, the first complainant's right of access under Article 15 GDPR does not infringe upon the second complainant's freedom of expression and freedom of information, which is why even an interpretation in conformity with EU law does not lead to a different result.

In the present case, the first complainant's right of access under Article 15 GDPR does not infringe upon the second complainant's freedom of expression and freedom of information, and therefore a legally compliant interpretation does not lead to a different result. The second appellant cannot therefore rely on the media privilege under Section 9 Paragraph 1 of the Data Protection Act (DSG) with regard to the refusal to provide the requested information (see the decision of the Federal Administrative Court (BVwG) of February 28, 2023, file no. W214 2255545-1/4E, concerning a comparable case).

The second appellant cannot therefore rely on the media privilege under Section 9 Paragraph 1 of the Data Protection Act (DSG) with regard to the refusal to provide the requested information (see the decision of the Federal Administrative Court (BVwG) of February 28, 2023, concerning a comparable case, file no. W214 2255545-1/4E). Furthermore, the Constitutional Court, in its ruling of December 14, 2022, file number G 287/2022-16 et al., declared Section 9 Paragraph 1 of the Data Protection Act (DSG) as amended by Federal Law Gazette Part I No. 24/2018 unconstitutional (Point I of the Ruling), stipulated that the repeal would enter into force on June 30, 2024 (Point II of the Ruling), that previous legal provisions would not be reinstated (Point III of the Ruling), and that the Federal Chancellor was obligated to publish these rulings immediately in the Federal Law Gazette Part I (Point IV of the Ruling). Furthermore, the Constitutional Court, in its ruling of December 14, 2022, file number G 287/2022-16 et al., declared Section 9 Paragraph 1 of the Data Protection Act (DSG) as amended by Federal Law Gazette Part One, No. 24, unconstitutional. In 2018, it was declared unconstitutional (Ruling 1), it was stated that the repeal would take effect on June 30, 2024 (Ruling 2), and that previous legal provisions would not come back into force (Ruling 3), and that the Federal Chancellor is obliged to publish these pronouncements immediately in the Federal Law Gazette (Ruling 4).

On specifically defined concerns regarding the legality of a legal provision, a decision can only be made once. This decision has legal force not only with respect to the applicant or the party in the initial proceedings, but also in all respects ("erga omnes") (VfSlg 5872/1968).

Therefore, a (renewed) appeal to the Constitutional Court by the Federal Administrative Court—as suggested by the second appellant in his appeal against the decision—was also out of the question.

Since Section 9(1) of the Data Protection Act (DSG) has already been declared unconstitutional, a referral of the question proposed by the second appellant to the European Court of Justice (ECJ) is also unnecessary.

Since Section 9(1) of the DSG has already been declared unconstitutional, a referral of the question proposed by the second appellant to the ECJ is also unnecessary. For the sake of completeness, it should be noted that – with regard to the right to negative information (cf. Fritz: The right of access under Art. 15 GDPR in the case law and jurisprudence in Jahnel [ed.], Data Protection Law: Yearbook [2022], according to which a request for information must be answered even if no data of the [potentially] data subject is processed) – an infringement of the first complainant's right of access would also have to be assumed if (contrary to the findings made) it were to be assumed that the second complainant had not collected any image data from him in this case. For the sake of completeness, it should be noted that – with regard to the right to negative information (see Fritz: The Right of Access under Article 15 GDPR in Case Law and Legal Practice in Jahnel [ed.], Data Protection Law: Yearbook [2022], according to which a request for access must be answered even if no data of the [potentially] data subject is being processed) – a violation of the first complainant's right of access would also have to be assumed if (contrary to the findings made) it were to be assumed that the second complainant had not actually collected any image data from him.

It must therefore be noted that the second complainant did not respond to the first complainant's request for access in violation of Article 15 GDPR.

It must therefore be noted that the second complainant did not respond to the first complainant's request for access in violation of Article 15 GDPR. The alleged illegality of points 2 and 3 of the contested decision is therefore unfounded, and the second appellant's appeal must be dismissed.

3.3. Regarding point A2:

3.3.1. Article 13 GDPR states: 3.3.1. Article 13 of the GDPR reads:

"Article 13

Information to be provided where personal data are collected from the data subject

(1) Where personal data are collected from the data subject, the controller shall, at the time when personal data are collected, provide the data subject with the following information:

a) the name and contact details of the controller and, where applicable, of the controller’s representative;

b) where applicable, the contact details of the data protection officer;

c) the purposes for which the personal data are to be processed and the legal basis for the processing;

d) where processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

e) where applicable, the recipients or categories of recipients of the personal data; and

f) where applicable, the controller’s intention to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission or, in the case of transfers referred to in Article 46 or Article 47 or Article 49(1), second subparagraph, a reference to the relevant provision." on the appropriate or suitable safeguards and how to obtain a copy of them or where they are available.

(2) In addition to the information referred to in paragraph 1, the controller shall, at the time when the personal data are collected, provide the data subject with the following additional information necessary to ensure fair and transparent processing:

a) the period for which the personal data will be stored, or, if that is not possible, the criteria used to determine that period;

b) the existence of the right to request from the controller access to the personal data concerning the data, as well as the right to rectification or erasure of the personal data or restriction of processing, or to object to such processing, and the right to data portability;

c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

d) the right to lodge a complaint with a supervisory authority;

e) whether the provision of the personal data is required by law or contract or for the conclusion of a contract, whether the data subject is obliged to provide the personal data and what the possible consequences of failure to provide such data would be, and

f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

(3) Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall, prior to such further processing, provide the data subject with information on that other purpose and any other relevant information referred to in paragraph 2.

(4) Paragraphs 1, 2 and 3 shall not apply where and to the extent that the data subject already has the information.

While Article 13 GDPR establishes an active obligation for the controller to provide information to the data subject, Article 15 GDPR provides a different set of guidelines. The data subject has a right to information from the controller, which they are free to exercise. The exercise of this right of access is in no way dependent on whether the controller has fulfilled their information obligations or not (Ehmann in Ehmann/Selmayr, General Data Protection Regulation², Art. 15 GDPR, para. 5), which is why both rights can be asserted simultaneously. While Article 13 of the GDPR establishes an active obligation for the controller to provide information to the data subject, Article 15 grants the data subject a right to information from the controller, which they are free to exercise. The exercise of this right of access is in no way dependent on whether the controller has fulfilled their information obligations or not (Ehmann in Ehmann/Selmayr, General Data Protection Regulation², Art. 15 GDPR, para. 5), which is why both rights can be asserted simultaneously.

While Article 13 of the GDPR establishes an active obligation for the controller to provide information to the data subject, Article 15 of the GDPR grants the data subject a right to information from the controller, which they are free to exercise. Article 13(4) GDPR limits the aforementioned information obligations to cases in which the data subject does not already possess the information.

3.3.2. In this specific case, this means:

As established above – with regard to the credible testimony of the first complainant in the complaint hearing held on October 21, 2022, under file number W274 223598-1 – the first complainant was unaware of the second complainant's identity at the time the photographic material was taken.

Therefore, it cannot be assumed that the first complainant was already aware of information concerning the second complainant relevant under Article 13 GDPR at that time. Therefore, it cannot be assumed that the first appellant was already aware of information concerning the second appellant that was relevant under Article 13 of the GDPR at that time.

The argument put forward by the respondent authority in its appeal that there is no right to a declaration of a past violation of the right to information if this deficiency had been remedied by the time of the authority's decision cannot be accepted:

The Administrative Court, in its ruling of March 6, 2024, file number Ro 2021/04/0030-4 et al., held that the fact that the information was provided after the actual obligation to provide information under Article 13 of the GDPR should have been fulfilled does not preclude a finding of a violation of that right. The obligation to provide information differs from the rights to access, rectification, erasure (etc.) regulated in Articles 15 et seq. of the GDPR in that the right to receive information under Article 14 GDPR – unlike the rights under Articles 15 et seq. GDPR – is not dependent on a request from the data subject. The infringement therefore lies in the failure to provide the (non-requested) notification, which cannot be retroactively remedied by subsequent information provided in response to a request from the data subject within the meaning of Article 15 GDPR. The Administrative Court, in its ruling of March 6, 2024, file number Ro 2021/04/0030-4 et al., held that the fact that the information was provided after the actual obligation to provide information under Article 13 GDPR should have been fulfilled does not preclude a finding of an infringement of the relevant right. The obligation to provide information differs from the rights to access, rectification, erasure (etc.) regulated in Articles 15 et seq. of the GDPR in that the right to obtain information under Article 14 of the GDPR – unlike the rights under Articles 15 et seq. of the GDPR – is not dependent on a request from the data subject. The infringement therefore lies in the failure to provide the (non-requested) notification, which cannot be retroactively remedied by subsequent information provided in response to a request from the data subject within the meaning of Article 15 of the GDPR.

Therefore, the fact that the second appellant provided the first appellant with information relevant under Article 13 of the GDPR during the course of these proceedings cannot (at least partially) remedy the infringement of rights caused by the failure to provide the relevant information at the time the images were taken.

The contested decision was therefore to be amended accordingly with respect to point 1 of the ruling.

3.4. Pursuant to Section 24 Paragraph 4 of the Administrative Court Procedure Act (VwGVG), an oral hearing was not required. The holding of an oral hearing was dispensed with pursuant to Section 24, Paragraph 4, of the Administrative Court Procedure Act (VwGVG).

3.5. Regarding Point B) of the Decision: Inadmissibility of the Appeal:

Pursuant to Section 25a, Paragraph 1, of the Administrative Court Act (VwGG), the Administrative Court must state in the operative part of its judgment or decision whether the appeal is admissible pursuant to Article 133, Paragraph 4, of the Federal Constitutional Law (B-VG). The statement must be briefly reasoned.

The present decision does not depend on the resolution of a legal question of fundamental importance. There is neither a lack of case law from the Administrative Court nor does the present decision deviate from the case law of the Administrative Court. Furthermore, the existing case law of the Administrative Court cannot be considered inconsistent. There are also no other indications of the fundamental importance of the legal questions to be resolved. It must therefore be declared that the appeal is inadmissible pursuant to Article 133, paragraph 4 of the Federal Constitutional Law. The present decision does not depend on the resolution of a legal question of fundamental importance. There is neither a lack of case law from the Administrative Court nor does the present decision deviate from the case law of the Administrative Court; furthermore, the existing case law of the Administrative Court cannot be considered inconsistent. There are also no other indications of the fundamental importance of the legal questions to be resolved. It must therefore be declared that the appeal is inadmissible pursuant to Article 133, paragraph 4 of the Federal Constitutional Law.