BVwG - W176 2265906-1

BVwG - W176 2265906-1

Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 4 GDPR Article 5 GDPR Article 6 GDPR § 1 DSG
Decided:	24.01.2024
Published:	17.04.2024
Parties:	Datenschutzbehörde (DPA) Company (Controller) Employees (data subjects)
National Case Number/Name:	W176 2265906-1
European Case Law Identifier:	ECLI:AT:BVWG:2024:W176.2265906.1.00
Appeal from:	DSB (Austria) D124.0278/22, 2022-0.737.249
Appeal to:	Not appealed
Original Language(s):	German
Original Source:	RIS (in German)
Initial Contributor:	avalang

A court held that a controller violated Article 5(1)(c) GDPR by searching employees’ email logfiles without necessity after a suspected leak, and could not rely on legitimate interest in Article 6(1)(f) GDPR.

English Summary

Facts

The controller was an Austrian social security body and the data subjects were three employees.

On 30 July 2020, the controller’s administrative board had a a non-public meeting and created a transcript of that meeting that only 26 people had access to.

On 15 August 2020, a website published an article containing verbatim statements from named participants in the confidential transcribed meeting.

On 16 October 2020, the controller started an internal investigation into the handling of meeting records and data security. In February 2021, it carried out a search of the email server logfiles of all employees for communications sent to a specific recipient domain.

The search covered 6,000 employees’ mail server logfiles and produced a list containing sender and recipient email addresses, delivery status, subject line, size, and date and time of sending, but the controller did not review email content.

The controller involved the works council chair of the head office, but it did not involve the local works councils representing the three data subjects, despite the controller’s internal works agreement requiring the local works council to be involved.

The data subjects complained to the DPA on 15 February 2022. They argued that the controller had unlawfully searched employees’ email data without a valid legal basis and not with the correct procedure. The DPA upheld the complaint. The controller appealed to the Federal Administrative Court.

Holding

First, the court held that the searched logfiles contained personal data within the meaning of Article 4(1) GDPR. The sender and recipient email addresses identified employees because they contained their first and last names, so searching those logfiles therefore amounted to processing under Article 4(2) GDPR.

Second, the court rejected the DPA’s view that the controller needed a specific statutory basis because it was a public body. The court held that, in its relationship with employees, the controller acted under private law rather than in the exercise of official authority. In principle, the controller could therefore rely on Article 6(1)(f) GDPR.

Third, the court accepted that the controller had a legitimate interest in investigating a possible breach of confidentiality and protecting confidential meeting material.

However, the court held that the search was not necessary for that purpose under Article 6(1)(f) GDPR. The controller had searched the logfiles of all 6,000 employees, even though only 21 people attended the meeting and only 26 people had access to the stored transcript. The court found that the controller should first have considered those narrower groups.

The court then held that the search was not even capable of achieving its stated purpose. The controller wanted to identify who might have sent the transcript to the media between 30 July 2020 and 15 August 2020, but because logfiles were stored for only 90 days, that relevant period was no longer available when the search took place on 22 February 2021. The court therefore held that the processing breached the data minimisation principle in Article 5(1)(c) GDPR. Because the processing was not necessary, the controller could not rely on Article 6(1)(f) GDPR.

Finally, the court noted that the controller had also acted contrary to its own works agreement. This supported the conclusion that the measure was unlawful.

The court therefore dismissed the controller’s appeal and confirmed that the controller had violated the data subjects’ right to confidentiality by unlawfully searching their email logfiles.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Decision Date

January 24, 2024

Legal Norm

Federal Constitutional Law (B-VG) Art. 133 para. 4
Data Protection Act (DSG) § 1
General Data Protection Regulation (GDPR) Art. 4
General Data Protection Regulation (GDPR) Art. 5
General Data Protection Regulation (GDPR) Art. 6

Federal Constitutional Law (B-VG) Art. 133 currently in force; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019 to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019, last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 133 valid from May 25, 2018 to December 31, 2018, last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 133 valid from August 1, 2014 to May 24, 2018, last amended by Federal Law Gazette I No. 164/2013, Federal Constitutional Law, Article 133, valid from 01.01.2014 to 31.07.2014, last amended by Federal Law Gazette I No. 51/2012; Federal Constitutional Law, Article 133, valid from 01.01.2004 to 31.12.2013, last amended by Federal Law Gazette I No. 100/2003; Federal Constitutional Law, Article 133, valid from 01.01.1975 to 31.12.2003, last amended by Federal Law Gazette No. 444/1974; Federal Constitutional Law, Article 133, valid from 25.12.1946 to 31.12.1974, last amended by Federal Law Gazette No. 211/1946; Federal Constitutional Law, Article 133, valid from December 19, 1945 to December 24, 1946, last amended by Federal Law Gazette No. 4/1945; Federal Constitutional Law Art. 133, valid from January 3, 1930 to June 30, 1934

Data Protection Act Art. 1 § 1, now Data Protection Act Art. 1 § 1, valid from January 1, 2014, last amended by Federal Law Gazette I No. 51/2012; Data Protection Act Art. 1 § 1, valid from January 1, 2000 to December 31, 2013

Ruling

W176 2265906-1/10E

IN THE NAME OF THE REPUBLIC!

Data Protection Act Art. 1 § 1, valid from January 1, 2014 to December 31, 2013 The Federal Administrative Court, composed of Judge Mag. Newald as presiding judge and lay judges Mag. Bogendorfer and RAUB, has ruled in a non-public session on the appeal of XXXX against point 1 of the decision of the Data Protection Authority dated December 7, 2022, file no. D124.0278/22, 2022-0.737.249 (participating parties: 1. XXXX, 2. XXXX and 3. XXXX, all represented by HAIDER / OBEREDER / PILZ, Attorneys at Law: INNEN), concerning a violation of the right to confidentiality, as follows: The Federal Administrative Court, composed of Judge Mag. Newald as presiding judge and lay judges Mag. Bogendorfer and RAUB, has ruled on the appeal of [name omitted] against point 1 of the decision of the Data Protection Authority dated December 7, 2022, file no. D124.0278/22, 2022-0.737.249 (Parties involved: 1. Roman numeral 40, 2. Roman numeral 40, and 3. Roman numeral 40, all represented by HAIDER / OBEREDER / PILZ, Attorneys at Law: INNEN), concerning a violation of the right to confidentiality, the following judgment was rendered in a non-public session:

A) The appeal is dismissed as unfounded, and point 1 of the contested decision is upheld, with the proviso that it shall read as follows:

"The appeal is granted, and it is determined that the respondent violated the appellants' right to confidentiality by unlawfully searching the appellants' technical mail server logs (log files) on February 22, 2021, with regard to communication with the recipient domain 'XXXX'." "The appeal is granted, and it is determined that the respondent..." The respondent violated the complainant's right to confidentiality by unlawfully searching the complainant's technical mail server log files on February 22, 2021, with regard to communication with the recipient domain "Roman numeral 40".

The respondent violated the complainant's right to confidentiality by unlawfully searching the complainant's technical mail server log files on February 22, 2021, concerning communication with the recipient domain "Roman numeral 40". B) The appeal is inadmissible pursuant to Article 133, paragraph 4 of the Federal Constitutional Law (B-VG).

Text

Reasons for the Decision:

I. Procedural History

1. By joint submission dated February 15, 2022, to the Data Protection Authority (the respondent authority before the Federal Administrative Court), the parties involved (MP) filed a data protection complaint against the now appellant (BF), submitting several documents and alleging a violation of their fundamental right to privacy and their right not to the processing of their personal data. In summary, the MPs argued that, based on the suspicion of an internal breach of confidentiality, BF had accessed all email accounts and mailboxes of its approximately 6,000 employees with the domain "XXXX" for emails sent to the domain "XXXX" during the evaluation period from July 30, 2022. The parties involved filed a joint complaint on February 15, 2022, with the Data Protection Authority (the respondent authority before the Federal Administrative Court), submitting several documents and arguing that the BF had searched all email accounts and mailboxes of its approximately 6,000 employees with the domain "40" during the evaluation period from July 30 to August 15, 2020. Furthermore, it was requested that the BF be ordered to destroy the results obtained from the search of the email accounts. Furthermore, it was requested that the BF be ordered to destroy the results obtained from the search of the email accounts.

2. In written submissions dated April 4 and 11, 2022, the BF responded to the data protection complaint as follows, submitting several documents:

No data search had taken place in the email accounts; rather, the log data of the email system had been evaluated. On August 15, 2020, information from a confidential internal BF document, the verbatim transcript of a meeting recording, and the personal data of meeting participants (their full names and statements attributable to these individuals) contained therein, were published on the website “XXXX” under the title “XXXX”. A comparison of the verbatim transcript with the published text passages revealed that several longer sections were worded identically. This constitutes a breach of trade secrets, combined with a breach of confidentiality regarding personal data. No data search was conducted in the email accounts; rather, the log data of the email system was analyzed. On August 15, 2020, information from a confidential internal BF document, the verbatim transcript of a meeting recording, and the personal data of meeting participants (their full names and statements attributable to these individuals) were published on the website "Roman 40" under the title "Roman 40." A comparison of the verbatim transcript with the published text passages revealed that several extended sections were worded identically. This constitutes a breach of trade secrets, combined with a breach of confidentiality regarding personal data.

... Subsequently, an investigation was initiated, involving the Data Protection Officer, the Corporate Governance (HCG) department, and the Chairwoman of the Works Council at the main office, XXXX (hereinafter referred to as S), who is also a member of the Central Works Council. S informed the Chairman of the Central Works Council on February 19, 2021, and spoke with him by telephone before implementing the measure; he did not object to the evaluation.

Subsequently, an investigation was initiated, involving the Data Protection Officer, the Corporate Governance (HCG) department, and the Chairwoman of the Works Council at the main office, Roman numeral 40 (hereinafter referred to as S), who is also a member of the Central Works Council. S informed the Chairman of the Central Works Council on February 19, 2021, and spoke with him by telephone before implementing the measure; he did not object to the evaluation. To minimize the infringement on the rights and fundamental freedoms of any potentially affected individuals and to avoid placing all employees under general suspicion, a multi-stage evaluation scenario was planned for this specific case, based on the model of phased control intensification. The first stage of the evaluation involved analyzing the technical mail server log files (excluding email content) for the sender and/or recipient domain "XXXX" between July 30, 2020, and February 22, 2021 (the date of the evaluation). If the recipient domain contained the term "XXXX," the result was a list including the recipient's email address, sender's email address, delivery status, subject, size, and the date and time of transmission. No further restrictions were applied, as the suspicion of a breach of confidentiality did not relate to any specific person, group, or department. Since the initial evaluation revealed no evidence of a breach of trade secrets or a violation of the confidentiality of personal data through the transmission of relevant data to the recipient domain in question, the investigation was terminated and no further evaluation was conducted. The log data has since been deleted. The log file evaluation was based on Article 6(1)(f) GDPR in conjunction with Article 9(2)(f) GDPR. The evaluation was a preparatory step for the potential assertion or defense of legal claims and also served to verify the lawfulness of the processing of personal data by employees. BF's legitimate interest lies in the lawfulness of processing personal data and in protecting trade secrets. To minimize the infringement on the rights and fundamental freedoms of any potentially affected individuals and to avoid placing all employees under general suspicion, a multi-stage evaluation scenario was planned for this specific case, based on the model of intensified control. The first stage of the evaluation involved analyzing the technical mail server logs (log files) without email content, searching for the sender and/or recipient domain "Roman numeral 40" between July 30, 2020, and February 22, 2021 (the date of the evaluation). If the recipient domain contained the term "Roman numeral 40," the result was a list containing the recipient's email address, sender's email address, delivery status, subject, size, date, and time of sending. No further restrictions were imposed, as the suspicion of a breach of confidentiality did not relate to a specific person, group, or department. Since the initial evaluation revealed no evidence of a breach of trade secrets or a breach of the confidentiality of personal data through the transmission of relevant data to the recipient domain in question, the investigation was terminated and no further evaluation was conducted. The log data has since been deleted. The BF based its log file analysis on Article 6, paragraph 1, letter f, of the GDPR in conjunction with Article 9, paragraph 2, letter f, of the GDPR. The analysis was a preparatory step for the potential assertion or defense of legal claims and also served to verify the lawfulness of the processing of personal data by employees. The BF's legitimate interest lies in the lawfulness of the processing of personal data and in the protection of trade secrets.

3. In their statement of May 27, 2022, the MPs summarized that it could not be verified whether the BF had evaluated log files instead of email accounts, but that this would not change the fact that the personal data of all employees was being processed unlawfully without a legal basis. Furthermore, it was established that the BF employees had never given their consent. Moreover, there was a violation of the principle of data minimization under Article 5 of the GDPR, as the BF had not imposed any restrictions on the evaluation of the email accounts, either in terms of time, subject matter, or personnel. Furthermore, there was a violation of the principle of data minimization under Article 5 of the GDPR, as the BF had not imposed any restrictions on the evaluation of the email accounts, neither in terms of time, content, nor personnel.

4. In its statement dated July 11, 2022, the BF summarized its position by stating that a total of 26 people had potentially had access to the aforementioned meeting minutes, but that, due to the lack of any concrete suspicion, no meaningful limitation had been imposed on the mail server log files to be searched. Excerpts from meeting minutes are sometimes published, but only when their accuracy has been confirmed by the signatures of the chairman and a senior employee of the insurance provider. This information is not subject to confidentiality.

4. In its statement dated July 11, 2022, the BF argued that it had the potential to have access to the aforementioned meeting minutes to a total of 26 people, but that, due to the lack of any concrete suspicion, no meaningful restriction had been placed on the mail server logs (log files) to be searched. 5. In their statement of August 25, 2022, the MPs argued, in summary, that there was no evidence that only the log files of all employees, and not the emails and their contents, had been searched. Furthermore, the MPs argued that the considerable time lapse between the alleged breach of trade secrets and the access to the email accounts was not convincingly explained. In particular, they asserted that the fact that the Directorate General's order was neither subject to a deadline nor implied any particular urgency did not justify the extensive and unlawful processing of personal data. They maintained that, based solely on the Board of Directors' rules of procedure, access to both email accounts and log files was unlawful.

... 6. In its written submission of September 27, 2022, the plaintiff argued that the Directorate General had instructed the Corporate Governance (HCG) department to review the technical mail server log files (excluding email content) on October 16, 2020, but that this instruction had not been given any particular urgency. The initial investigations were initiated promptly after the instruction was given, but the evaluation took place at a later date. Since the transcript had already been published, the plaintiff maintained that while there was a legitimate interest in clarification to prevent future occurrences, there had been no time pressure. The relevant email exchange was submitted as evidence that the evaluation was limited in both time and scope. The central works council was responsible for the review because the interests of more than just the employees of a single company were affected. For the Central Works Council to exercise its relative responsibilities, it is sufficient if a matter directly affects only the employees of one establishment, but also indirectly affects the employees of at least one other establishment.

7. In their written submission of October 12, 2022, the MPs argued, in summary, that the email exchange submitted by the BF showed that the evaluation had been carried out indefinitely from July 30, 2020; only a full-text search had been limited to the period up to August 15, 2020. Furthermore, the MPs found it hardly conceivable that an order from the Director General regarding a breach of confidentiality would have been issued only two months after the publication of the report in question. In the MPs' view, the Central Works Council lacked jurisdiction. Even if the central works council had been responsible, this would not change anything, since BF knew that S was not the chair of the central works council and therefore not authorized to represent it.

8. By decision dated December 7, 2022, the respondent authority upheld MP's appeal and found that BF had violated MP's right to confidentiality by unlawfully searching the technical mail server log files (excluding MP's email content) for the period from July 30, 2020, to at least August 15, 2020, with regard to communication with the recipient domain "XXXX" (Point 1). At the same time, the request for the destruction of the data search results was rejected (Point 2). By decision dated December 7, 2022, the respondent authority upheld MP's appeal and determined that BF had violated MP's right to confidentiality by unlawfully searching, at least on February 19, 2021, the technical mail server log files (excluding MP's email content) for the period from July 30, 2020, to at least August 15, 2020, with regard to communication with the recipient domain "Roman numeral 40" (Point 1). At the same time, the request for the destruction of the data search results was rejected (Point 2).

(Since BF's appeal is directed solely against Point 1, the following statements refer only to this point.)

Legally, the respondent authority essentially stated the following regarding Point 1:

BF is a government agency and therefore requires a legal basis for its actions, which is lacking in the present case. As a public authority, the BF cannot rely on Article 6(1)(f) GDPR, but even if this provision were applicable, there would be no legitimate interest because the data processing was disproportionate. The respondent authority finds it incomprehensible why the investigation only took place approximately six months after the incident; moreover, the investigation should have been limited to technical mail server logs of specific individuals or workgroups, instead of indiscriminately searching 6,000 technical mail server logs of BF employees, including the MP. The BF also failed to explain why monitoring the MP specifically was necessary. There was no delegation of authority to the central works council, nor was the works council of the main office consenting to the measure in question. Overall, the monitoring of the MP was unnecessary. The BF is a public authority and therefore requires a legal basis for its actions, which is lacking in this case. As an authority, the BF could not rely on Article 6, paragraph 1, letter f, of the GDPR. However, even if this provision were applicable, there would be no legitimate interest because the data processing was disproportionate. The respondent authority found it incomprehensible why the investigation only took place approximately six months after the incident. Furthermore, the investigation should have been limited to technical mail server log files of specific individuals or workgroups, instead of indiscriminately searching 6,000 technical mail server log files of BF employees, including the MP. The BF also failed to explain why monitoring the MP specifically was necessary. There was no delegation of authority to the central works council, nor was the works council of the main office authorized to conduct the investigation. In conclusion, the monitoring of the MP was unnecessary.

Furthermore, the investigation was not required. 9. The company filed a timely appeal with the Federal Administrative Court against point 1 of this decision, arguing the following in summary:

The central works council had not issued a negative statement regarding the planned project to either the chairwoman of the works council at the main office or to management. The chairwoman of the works council at the main office had approved the permissibility of the planned measure from the works council's perspective via email on February 19, 2021. The search was limited to the evaluation of technical mail server logs from the period between July 30, 2020, and August 15, 2020. There was no restriction to specific groups of people, as the suspicion of a violation did not relate to any particular person, group, or department. The mail server log concerning 6,000 employees of the company was searched. The data processing was carried out in connection with a suspected breach of official duty due to a violation of the duty of confidentiality pursuant to Section 460a of the Austrian General Social Insurance Act (ASVG). It was suspected that the potential breach of duty had occurred through the use of the email system provided by the fire department to its employees. Therefore, evaluating the log data of this system was the appropriate means for the necessary investigations. With regard to the legitimate interest pursuant to Article 6(1)(f) GDPR, the fire department argued, in particular, that the time span of the suspected breach of duty and the described data processing had no bearing on the assessment of proportionality, as the delayed data processing did not alter the intensity of the interference with the rights and fundamental freedoms of the data subjects.No restriction to a specific group of people was imposed because no specific group of people was suspected. Limiting the investigation to those individuals who had access to the information stored on the server would not have been productive, as the aim was not to determine who had accessed or printed the document, but rather whether a copy of this document had been passed on to unauthorized third parties. This could have been virtually anyone who had lawful or unlawful access to the electronic document or a copy thereof. The technical query was designed so that a concrete link to the sender was only established if the sender had actually sent data to the domain "XXXX". All other affected individuals were not identified during this analysis. Since the MPs (Members of Parliament) belong to the bodies of the works council or central works council, the title of the publication and the mention of "works councils" therein strongly suggest that works council meeting minutes should be included in this investigation. BF could assume that the works council at the main office and even the central works council had given effective consent to the data processing in question. Whether or not authority had been delegated to the central works council was irrelevant to the legality of BF's data processing, because BF had received a declaration of consent. The central works council had not issued any negative statement to either the chairwoman of the works council at the main office or to management regarding the planned project. The chairwoman of the works council at the main office had approved the permissibility of the planned measure from the works council's perspective via email on February 19, 2021. The search was limited to the evaluation of technical mail server logs from the period July 30, 2020, to August 15, 2020. There was no restriction to specific groups of people, as the suspicion of a violation did not relate to any particular person, group, or department. The mail server logs concerning 6,000 BF employees were searched. The data processing was carried out in connection with a suspected breach of duty due to a violation of the duty of confidentiality pursuant to Section 460a of the Austrian General Social Insurance Act (ASVG). There was a suspicion that the potential breach of duty had occurred through the use of the email system provided by the Federal Employment Agency (BF) to its employees. Therefore, the evaluation of the log data from this system was the appropriate means for the necessary investigations. With regard to the legitimate interest pursuant to Article 6(1)(f) of the GDPR, the BF stated in particular that the timeframe of the suspected breach of duty and the described data processing had no bearing on the assessment of proportionality, as the delayed data processing did not alter the intensity of the infringement on the rights and fundamental freedoms of the data subjects. No restriction to a specific group of persons was imposed because no specific group of people was suspected. Limiting the investigation to those individuals who had access to the information stored on the server would not have been productive, because the aim was not to determine who had accessed or printed the document, but rather whether a copy of this document had been passed on to unauthorized third parties. This could have been virtually anyone who had lawful or unlawful access to the electronic document or a copy thereof. The technical query was designed so that a concrete link to the sender was only established if they had actually sent data to the domain "Roman 40". All other affected individuals were not identified during this evaluation. Since the MPs (Members of Parliament) belong to the bodies of the works council or central works council, the title of the publication and the mention of "works councils" therein strongly suggest that works council protocol data should be included in this investigation. The BF (Federal Office for Information Security) could assume that the works council of the main office and even the central works council had given valid consent to the data processing in question. Whether a transfer of authority to the central works council had taken place is irrelevant with regard to the legality of the data processing by the Federal Employment Agency (BF), because the BF had received a declaration of consent.

10. The respondent authority submitted the administrative act to the Federal Administrative Court, filed a statement, and argued essentially that a monitoring measure could no longer be considered necessary six months later. Furthermore, the temporal connection between the breach of duty and the monitoring measure had to be taken into account, because the legitimate interest had to be current. Moreover, the publication of information about a planned relocation could not justify a monitoring measure after six months. Finally, a mere passage in an email could not be used to assume lawful consent from the works council.

11. Subsequently, in a letter dated February 22, 2023, the Federal Employment Agency (BF) essentially replied that although the data processing had taken place six months after the suspected breach of duty, even with timely data processing, the evaluation would have covered the same period and the same groups of data subjects. The respondent authority's view that restricting the inquiry to certain individuals or work groups could have reduced the intensity of the infringement of fundamental rights is incorrect, as there was no concrete suspicion against any specific individuals or work groups, and the data contained in the log files did not allow for such a restriction. Therefore, the inquiry, as it was conducted, constituted the least intrusive measure. The BF's interest in clarifying a breach of duty was not speculative; it was concrete and legally required. The email from the works council chairman of the main office constituted a concrete response; in its reply, the works council specifically confirmed the permissibility of one of the described measures.

12. In their statement of March 6, 2023, the MP fully agreed with the respondent authority's statements of January 13, 2023, and essentially argued that a mere relocation, which they themselves had communicated to 900 employees via email, was by definition not a trade secret. There was no legitimate interest in the inspection on February 22, 2021, because the relocation had been public knowledge for seven months by that time, a different relocation site had been decided upon at a further board meeting on October 29, 2020, and part of the premises had already been handed over to the BF on February 15, 2021, i.e., before the inspection. Furthermore, the alleged breach of confidentiality by the BF employees was merely asserted, but not proven. Recital 47 of the GDPR clearly states that, at the time the personal data are collected and in light of the circumstances under which this occurred, the data subject must reasonably expect that their data will be processed for this purpose. Therefore, the time lapse between the alleged breach of duty and the inspection of the email accounts of 6,000 employees is significant, especially since all employees had long been aware that a relocation was imminent.

Furthermore, the alleged breach of duty by the BF employees was merely asserted, but not proven. II. The Federal Administrative Court considered: (Roman numeral II.) The Federal Administrative Court considered:

1. Findings

The procedural history described in Section I forms the basis for the findings, in particular the following is established regarding the administrative procedure: The procedural history described in Section I forms the basis for the findings, in particular the following is established regarding the administrative procedure:

1.1. The XXXX is a social insurance institution and a public corporation. The supervisory authority is the Federal Ministry of Social Affairs, Health, Care and Consumer Protection. 1.1. The BF is a social insurance institution and a public corporation. The supervisory authority is the Federal Ministry of Social Affairs, Health, Care and Consumer Protection.

The BF's organization consists of a main office in Vienna and several regional and branch offices. The BF employs approximately 6,000 people.

1.2. The MPs are employees of the BF (Financial Services), MP 1 at the regional office XXXX, MP 2 at the regional office XXXX, and MP 3 at the XXXX Accident Hospital in XXXX. They belong to their respective local works councils. They are not represented by the works council of the main office, whose chairperson is S. 1.2. The MPs are employees of the BF, MP 1 at the regional office (Roman 40), MP 2 at the regional office (Roman 40), and MP 3 at the XXXX Accident Hospital (Roman 40) in XXXX. They belong to their respective local works councils. They are not represented by the works council of the main office, whose chairperson is S.

The MPs have email addresses provided to them by the BF for both professional purposes and for carrying out their respective works council functions. These email addresses are structured as follows: firstname.lastname@XXXX.at. The MPs have email addresses provided to them by the BF for both professional purposes and for carrying out their respective works council functions. These email addresses are structured as follows: firstname.lastname@ (Roman numeral 40).at.

1.3. On July 30, 2020, a meeting of the BF Board of Directors took place regarding a possible relocation of the BF staff. The intention was to move the staff from a building owned by BF to the building of XXXX at XXXX in Vienna.

Only MP 2 participated in the Board of Directors meeting on July 30, 2020; MP 1 and MP 3 were not present.

A verbatim transcript of the Board of Directors meeting on July 30, 2020, was prepared. Such meeting minutes are stored on a dedicated server of the Federal Office of Justice (BF), accessible only to 26 people (seven from the Presidential Affairs department, seven from the Directorate General including their assistants, and 12 from the ICT department). If such meeting minutes are used outside the company, they are exclusively excerpts, the accuracy of which must be confirmed by the signature of the chairperson and a senior employee. Only these excerpts constitute reports that may be published and are not subject to any trade secrets. All other minutes are confidential and subject to appropriate confidentiality measures.

On the same day, all employees of the BF headquarters and the regional office XXXX were informed about the planned relocation.

1.4. On August 15, 2020, the website "XXXX" published an article entitled "XXXX". On August 15, 2020, the website "Roman 40" published an article titled "Roman 40".

This article quoted verbatim statements from named participants in the minutes of the meeting held on July 30, 2020. In particular, the following passages refer to the verbatim transcript of the meeting of July 30, 2020:

"Vienna, August 15, 2020 | XXXX "Vienna, August 15, 2020 | Roman numeral 40

XXXX Roman numeral 40

1.5. Due to the publication of the article on "XXXX" concerning the Board of Directors meeting of July 30, 2020, the Directorate General of the BF commissioned an initial "investigation into the processes of recording the minutes of the meetings, from the preparation of the minutes to their approval, with particular attention to data security and data integrity" on October 16, 2020. 1.5. Following the publication of an article on "Roman 40" concerning the Board of Directors meeting of July 30, 2020, the BF's General Directorate commissioned an initial investigation on October 16, 2020, into the processes for recording meeting minutes, from their creation to their approval, with particular attention to data security and data integrity.

On February 19, 2021, an evaluation of the email log files of all employees from July 30, 2020, onward, limited to the recipient domain "XXXX," was commissioned. This evaluation, conducted on February 22, 2021, involved searching the email log files and yielded a list containing the following information: recipient email address, sender email address, delivery status, subject, size, and date and time of sending. No further restrictions were imposed (e.g., on specific groups of people or departments), and a total of 6,000 technical mail server log files were searched without email content. Since this initial evaluation revealed no indications of a breach of trade secrets, no further evaluations were initiated. The results list of the initial evaluation specifically includes 13 communication events between the email address "XXXX" and the press office of the Federal Fire Brigade (BF) at "kommunikation@XXXX.at" between January 11, 2021, and January 29, 2021. Because log files are only available for 90 days, an evaluation for the period from July 30, 2020, to August 15, 2020, was not possible. On February 19, 2021, an evaluation of the email log files of all employees from July 30, 2020, onward was commissioned, limited to the recipient domain "40". This evaluation was conducted on February 22, 2021, based on a search of email log files and yielded a list containing the following information: recipient email address, sender email address, delivery status, subject, size, date, and time of sending. No further restrictions were applied (e.g., to specific groups of people or departments), and a total of 6,000 technical mail server log files were searched, excluding email content. Since this initial evaluation revealed no indication of a breach of trade secrets, no further evaluations were initiated. The results list from the initial evaluation specifically includes 13 communication events between the email address "Roman 40" and the press office of the Federal Fire Brigade (BF) at "kommunikation@roman 40.at" during the period from January 11, 2021, to January 29, 2021. Since log files are only available for 90 days, an evaluation for the period from July 30, 2020, to August 15, 2020, was not possible.

The chairwoman of the works council at the main office and member of the central works council, Mr. S, was involved in the planned data processing, but not the local works councils at the MP's offices. The MP became aware of this on February 19, 2021.

The central works council and the local works councils of the MP did not approve the evaluation of the employees' email log files.

1.6. The company agreement on the use of electronic information and communication media at BF was concluded between BF and its central works council, entered into force on May 21, 2015, and has not been terminated to date.

The relevant excerpt reads as follows:

"[...]

4.1. Email

Employees at workstations with computer access are permitted to send and receive emails.

[...]

Logging

Every email is logged with regard to its transmission process on the email servers of the BF and the main association. This is purely a transport log (i.e., recording the sender, recipient, subject, number of attachments, and email size).

Due to the installed virus and spam protection, affected emails are automatically moved to the BF's quarantine folder. The email data remains in this folder for a few days.

All logging is solely for the purpose of identifying, analyzing, and resolving errors.

Access

The administrators of the BF's email system (HTR) have the technical capability to access the elements on the The administrator has access to email servers – specifically, to open emails. However, this access is limited to active emails (those not yet deleted by the employee). Emails deleted or removed from the "Deleted Items" folder can be restored by the user for 7 days. For restored emails, as with any other active emails, the administrator has the technical capability to read the email content. Such administrator access is logged.

[…]

It is expressly stated that the administrator may only access email system data for system security reasons. The administrator is prohibited from retrieving, viewing, or disclosing the personal data of employees of the email server for performance or conduct monitoring purposes. Violations will result in disciplinary action.

[…] Should the BF need to access the log or the contents of emails due to a well-founded suspicion of misuse, breach of confidentiality obligations, or unauthorized access to third-party emails, the local works council must be consulted. Access to the log or the contents of emails may only be granted upon the order of the Director General, or, in their absence, upon the order of the Deputy Director General or the responsible regional director, or, in their absence, upon the order of the Deputy Regional Director of the BF. Access to the data may only be granted with the involvement of the works council. Access to the content of private emails is not permitted without the employee's explicit consent.

Access to the log or the contents of emails is only permitted upon the order of the Deputy Director General or, in their absence, upon the order of the Deputy Regional Director of the BF. […]

2. Evaluation of Evidence

The findings are based on the uncontested administrative act, in particular the documents submitted by the parties to the proceedings.

2.1. The findings regarding point 1.1 are based on the BF's website (https://www.XXXX, last accessed on December 12, 2023).

2.2. The findings regarding point 1.2 are based on the undisputed submissions of the MP (statement of August 25, 2022, page 2; data protection complaint of February 15, 2022, page 2).

2.3. The findings regarding point 1.3 are based on the submitted documents and the undisputed submissions of the parties to the proceedings.

That the The fact that MP 2 participated in the Board of Directors meeting on July 30, 2020, is evident from the document submitted by MP, which lists the individuals who attended the meeting (statement dated May 27, 2022, Appendix ./C).

The finding that verbatim transcripts were prepared and stored on a dedicated server accessible only to certain individuals, and the determination of the extent to which such verbatim transcripts are public, are based on the undisputed submissions of the BF (see BF's statement dated July 11, 2022, pages 2 and 5).

The finding that the employees of the BF headquarters and the regional office XXXX were informed of the planned relocation on the same day is based on the BF email dated July 30, 2020, submitted by the MPs (statement dated August 25, 2022, Appendix ./E).

2.4. The findings regarding point 1.4 are based on the submissions of the parties to the proceedings and the article published online on August 15, 2020 (XXXX, last accessed December 12, 2023). The findings regarding point 1.4 are based on the submissions of the parties to the proceedings and the article published online on August 15, 2020 (Roman numeral 40, last accessed on December 12, 2023).

2.5. The findings regarding point 1.5 are based in particular on the submissions of the plaintiff in its statements of April 4, 2022, April 11, 2022, July 11, 2022, and September 27, 2022, as well as the email of February 19, 2021, in which XXXX (hereinafter: H), Head of the Information and Communication Technology (ICT) Department of XXXX (hereinafter: B), and advisor to the Corporate Governance (HCG) Department, is requested, among other things, to conduct email analyses. The investigation was intended to determine whether emails were sent to the domain "XXXX" from July 30, 2020 onwards, and to evaluate all relevant data, such as time, sender, and recipient ("Email to domain "XXXX" from July 30, 2020"). By email dated February 22, 2021, H requested one of his technicians to perform the corresponding evaluation. H received an evaluation in the form of a JPG file on the same day, with the note that an evaluation for the period from July to August 2020 was not possible because log files were only available for 90 days (Appendix 1 to the BF's statement of September 27, 2022). Furthermore, in its statement of July 11, 2022, the BF stated that the Corporate Governance (HCG) department had first been informed by email from H dated March 15, 2021, that the retention period for log files of the processing activity in question was only 90 days. Thus, querying the data for the relevant period would not have been possible at all (see statement of July 11, 2022, page 1 in conjunction with Appendix 1). Therefore, the corresponding findings could be made. 2.5. The findings regarding point 1.5. arise in particular from the submissions of the plaintiff in its statements of April 4, 2022, April 11, 2022, July 11, 2022, and September 27, 2022, as well as the email of February 19, 2021, in which Roman 40 (hereinafter: H), Head of the Information and Communication Technology (ICT) Department of Roman 40 (hereinafter: B), Advisor to the Corporate Governance (HCG) Department, is requested, among other things, to conduct email analyses. These analyses were to investigate whether emails had been sent to the domain "Roman 40" from July 30, 2020, onwards, and were to include all relevant data. The data to be analyzed includes details such as the time, sender, and recipient ("Mail to domain "Roman numeral 40" from July 30, 2020"). By email dated February 22, 2021, H requested a corresponding analysis from one of his technicians. H received an analysis in the form of a JPG file on the same day, with the note that an analysis for the period from July to August 2020 had not been possible because log files were only available for 90 days (Appendix 1 to the BF's statement of September 27, 2022). Furthermore, the BF stated in its statement of July 11, 2022, that the Corporate Governance (HCG) department had first been informed by email from H dated March 15, 2021, that the retention period for log files of the processing in question was only 90 days, and therefore a query of the data for the relevant period would not have been possible at all (see statement of July 11, 2022, page 1). (with Appendix 1). Thus, the corresponding findings could be made.

The fact that the chairwoman of the works council at the main office was involved in the data processing, but not the local works councils at the MP's offices, is evident from the BF's submissions, according to which only the chairwoman of the works council at the main office was involved and the chairman of the central works council was informed (statement of April 4, 2022, page 2; see also the BF's statement of July 11, 2022, page 6).

The finding The point in time at which MP became aware of the data processing is based on the corresponding statement in MP's data protection complaint of February 15, 2022 (page 8) and an email submitted by BF dated February 19, 2021 (Appendix 2 to BF's statement of April 4, 2022).

BF's assertion that the central works council approved the monitoring measure in question cannot be verified. BF refers to an email from the chairwoman of the works council at the main office to B and H, in which, referring to "the informational email concerning the evaluation in connection with the review of the 'VR protocols'," she states that "point one, the email to domain 'XXXX' from July 30, 2020, onwards, is permissible from our perspective." Among others, MP2, the chairman of the central works council, was copied on the email. The appellant argues that this constitutes approval of this measure not only by the works council of the main office but also by the central works council. The central works council was aware of the analysis of the log data and did not object to the measure, even though there was ample time and opportunity to do so (appeal against the decision, page 10). It follows that while the central works council was informed of the data processing in question, its consent cannot be inferred from the appellant's statements and the email of February 19, 2021 (Appendix 1 to the appellant's statement of February 16, 2023). Therefore, the arguments of MP2 and the respondent authority, namely that the central works council did not give its consent, are to be accepted. In this context, MP2 plausibly explained that it had assumed only the employees of the main office were involved, especially since S, as chair of the works council for the employees of the main office, had been contacted (MP statement of August 25, 2022, page 10). Furthermore, it did not emerge during the proceedings that the local works councils of the MP were consulted regarding the relevant action taken by BF. Therefore, it was established that the central works council and the local works councils of the MP did not consent to the evaluation of the employees' email log files. BF's assertion that the central works council consented to the monitoring measure in question is not substantiated. The BF refers here to an email from the chairwoman of the works council at the main office to B and H, in which, referring to "the informational email concerning the evaluation in connection with the review topic 'VR protocols'", she states that "point one, email to domain 'Roman numeral 40' from July 30, 2020, is permissible from our perspective." MP2, the chairman of the central works council, was among those copied in. The BF argues that this means not only the works council at the main office, but also the central works council, has approved this measure. The central works council was aware of the analysis of the protocol data and did not object to the measure, even though there was ample time and opportunity to do so (appeal against the decision, page 10). It follows that while the central works council was informed of the data processing in question, the statements made by the Federal Employment Agency (BA) and the email of February 19, 2021 (Appendix 1 to the BA's statement of February 16, 2023) do not indicate the central works council's consent. Therefore, the statements of the Federal Employment Agency (BA) and the respondent authority, according to which the central works council's consent was not obtained, must be followed. In this context, the BA explained plausibly that it had assumed only the employees of the main office were involved, especially since S, as chair of the works council for the employees of the main office, had been contacted (BA statement of August 25, 2022, page 10). Furthermore, it has not emerged from the proceedings that the local works councils of the BA were consulted regarding the BA's relevant action. In summary, it was therefore determined that the central works council and the local works councils of MP did not consent to the evaluation of the employees' email log files.

2.6. The findings regarding point 1.6. are based on the company agreement submitted with MP's statement of August 25, 2022 (Appendix ./F).

3. Legal Assessment

3.1. Regarding point A):

3.1.1. Pursuant to Article 130, paragraph 1, item 1 of the Federal Constitutional Law (B-VG), the administrative courts have jurisdiction over appeals against decisions of administrative authorities on grounds of illegality.

Pursuant to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court decides by a single judge, unless federal or state law provides for a decision by a panel of judges. According to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court decides through a single judge, unless federal or state laws provide for a decision by a panel of judges.

The Senate has jurisdiction in this matter pursuant to Section 27 of the Data Protection Act (DSG).

3.1.2. The appeal was filed within the time limit pursuant to Section 7, Paragraph 4 of the Administrative Court Procedure Act (VwGVG), and the other procedural requirements are also met.

3.1.3. Applicable Law:

The relevant provisions of the Federal Act on the Protection of Natural Persons with regard to the Processing of Personal Data (Data Protection Act - DSG) as amended by Federal Law Gazette Part I No. 24/2018, read in part as follows:

Article 1

(Constitutional provision)

Fundamental Right to Data Protection

Section 1 (1) Everyone has the right to the confidentiality of their personal data, particularly with regard to respect for their private and family life, insofar as there is a legitimate interest in doing so. The existence of such an interest is precluded if data, due to its general availability or because it cannot be traced back to the data subject, is not subject to a claim of confidentiality. Paragraph 1, (1) Everyone has a right to the confidentiality of their personal data, particularly with regard to respect for their private and family life, insofar as there is a legitimate interest in this. The existence of such an interest is precluded if data, due to its general availability or because it cannot be traced back to the data subject, is not subject to a claim of confidentiality.

(2) Insofar as the use of personal data is not in the vital interest of the data subject or with their consent, restrictions on the right of confidentiality are only permissible to protect overriding legitimate interests of another party, and in the case of interventions by a state authority, only on the basis of laws that are necessary for the reasons stated in Article 8(2) of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210/1958. Such laws may permit the use of data that are particularly sensitive by nature only to safeguard important public interests and must simultaneously establish appropriate safeguards for the protection of the data subjects' privacy interests. Even in the case of permissible restrictions, the interference with the fundamental right may only be carried out in the least intrusive manner necessary to achieve the objective. (2) Insofar as the use of personal data is not in the vital interest of the data subject or with their consent, restrictions on the right to confidentiality are only permissible to safeguard overriding legitimate interests of another, and in the case of interference by a state authority, only on the basis of laws that are necessary for the reasons stated in Article 8, paragraph 2, of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210 of 1958. Such laws may permit the use of data that are particularly sensitive by nature only to safeguard important public interests and must simultaneously establish appropriate safeguards for the protection of the data subjects' privacy interests. Even in the case of permissible restrictions, the interference with the fundamental right may only be carried out in the least intrusive manner necessary to achieve the objective.

[…]

The relevant provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016 (hereinafter: GDPR), read in part as follows:

Article 4

Definitions

For the purposes of this Regulation, the term:

(1) ‘personal data’ means any information relating to an identified or identifiable natural person (hereinafter referred to as ‘data subject’); An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;

(2) “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;

(3) “Restriction of processing” means the marking of stored personal data with the aim of limiting their processing in the future;

(4) ‘Profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;

(5) ‘Pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

(6) ‘Filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

(7) ‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for by Union or Member State law;

(8) ‘Processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

(9) ‘Recipient’ means a natural or legal person, public authority, agency or another body, to which personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

(10) ‘Third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;

(11) ‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

(12) - (17) …

(18) ‘Undertaking’ means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity;

(19) ‘Group of undertakings’ means a group consisting of a controlling undertaking and its controlled undertakings;

(20) …

(21) ‘Supervisory authority’ means an independent public authority established by a Member State pursuant to Article 51;

(22) – (26) …

Article 5

Principles relating to the processing of personal data

(1) Personal data must be

a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be deemed incompatible with the original purposes in accordance with Article 89(1) (‘purpose limitation’);

c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimization’);

d) be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data which are inaccurate in relation to the purposes for which they are processed are erased or rectified without delay (“accuracy”);

e) be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed; personal data may be stored for longer periods insofar as the personal data are processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to the implementation of appropriate technical and organisational measures required by this Regulation to safeguard the rights and freedoms of the data subject (“storage limitation”);

(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical and organizational measures (“integrity and confidentiality”);

(2) The controller is responsible for compliance with paragraph 1 and must be able to demonstrate such compliance (“accountability”).

Article 6

"Lawfulness of processing"

(1) Processing shall be lawful only if at least one of the following conditions is met:

a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

c) processing is necessary for compliance with a legal obligation to which the controller is subject;

d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;

e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child This concerns...

Paragraph 1(f) shall not apply to processing carried out by public authorities in the performance of their tasks.

[...]

Article 88

Data processing in the employment context

(1) Member States may, by law or by collective agreement, provide for more specific rules to ensure the protection of the rights and freedoms with regard to the processing of employees' personal data in the employment context, in particular for the purposes of recruitment, the performance of the employment contract, including the fulfillment of obligations laid down by law or by collective agreement, the management, planning and organisation of work, equality and diversity at work, health and safety at work, the protection of the property of employers or customers, and for the purposes of exercising individual or collective rights and benefits relating to employment and for the purposes of terminating the employment relationship.

(2) Such rules shall include appropriate and specific measures to safeguard human dignity, the legitimate interests and the fundamental rights of the data subject, in particular with regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of companies engaged in a joint economic activity, and workplace monitoring systems.

(3) Each Member State shall notify the Commission by 25 May 2018 of the legislation it adopts pursuant to paragraph 1 and of any subsequent amendments to that legislation without delay.

Recital 155:

Member State law or collective agreements (including ‘works agreements’) may contain specific provisions for the processing of employees’ personal data in the employment context, in particular provisions on the conditions under which personal data may be processed in the employment context on the basis of the employee’s consent, on the processing of such data for the purposes of recruitment, the performance of the employment contract, including the fulfillment of obligations laid down by law or collective agreements, the management, planning and organisation of work, equality and diversity at work, health and safety at work, and for the purposes of exercising individual or collective rights and benefits related to employment and for the purposes of termination of employment. Employment relationship.

3.1.4. On the merits:

The respondent authority found that MP's right to confidentiality was violated insofar as BF unlawfully searched the technical mail server log files (excluding email content) of MP on February 19, 2021, for the period from July 30, 2020, to at least August 15, 2020, with regard to communication with the recipient domain "XXXX". The respondent authority found that MP's right to confidentiality was violated insofar as BF unlawfully searched the technical mail server log files (excluding email content) of MP on February 19, 2021, for the period from July 30, 2020, to at least August 15, 2020, with regard to communication with the recipient domain "Roman numeral 40".

The respondent authority found that MP's right to confidentiality was violated insofar as BF unlawfully searched the technical mail server log files (excluding email content) of MP on February 19, 2021, for the period from July 30, 2020, to at least August 15, 2020, with regard to communication with the recipient domain "Roman numeral 40". So-called email log files are protocol data containing information about connections used in email communication. These log files record when, for how long, and between which servers or email and/or IP addresses a connection existed; furthermore, they record the amount of data transferred in this context. It is also technically possible to log the subject line of an email. However, the log file itself contains neither the actual message text nor the attachments (Thüsing/Traut in Thüsing, Beschäftigungsdatenschutz und Compliance 20213, § 9. Lagerung und Aussichtung von Emails und Email-Logfiles, Rz 12f). So-called email log files are protocol data containing information about connections used in email communication. These log files record when, for how long, and between which servers or email and/or IP addresses a connection existed; Furthermore, the log file records the amount of data transferred in this context. It is also technically possible to log the subject line of an email. However, the log file itself contains neither the actual message text nor the attachments (Thüsing/Traut in Thüsing, Beschäftigungsdatenschutz und Compliance 20213, Paragraph 9, Lagerung und Sichtung von E-Mails und E-Mail-Logfiles, Rz 12f).

``` The email address, which contains the first and last name of the data subject, constitutes personal data within the meaning of Article 4(1) GDPR (Thiele/Wagner, Commentary on the Data Protection Act (DSG)2 § 1 [as of January 1, 2022, rdb.at] para. 28).

As determined, the email log file data of the approximately 6,000 employees of the Federal Fire Brigade (BF), including the log file data of the Parliamentary Control Committee (MP), were searched and used as the basis for an analysis on February 22, 2021. Since log files are only available for 90 days, only data from the 90 days prior to the evaluation date could be processed. The email log file data includes, among other things, the recipient's and sender's email addresses. These email addresses are composed of the first and last names of the individuals concerned. It follows that BF processed personal data of all participants who used the email service within the 90 days prior to the evaluation date.

According to Section 1 Paragraph 1 of the German Federal Data Protection Act (BDSG), everyone has the right to the confidentiality of their personal data, provided there is a legitimate interest in doing so. Such an interest is excluded if data is not subject to a confidentiality claim due to its general availability or because it cannot be traced back to the data subject. A restriction of this right is permissible – unless the use of personal data is in the vital interest of the data subject or occurs with their consent – only to safeguard overriding legitimate interests of another party, and in the case of interventions by a state authority, only on the basis of laws that are necessary for the reasons stated in Article 8(2) of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210/1958. Such laws may only permit the use of data that is particularly sensitive by its nature to safeguard important public interests and must simultaneously establish appropriate safeguards for the protection of the data subjects' privacy interests. Even in the case of permissible restrictions, the interference with the fundamental right may only be carried out in the least intrusive manner that achieves the objective (Section 1(2) of the Data Protection Act). According to Section 1, Paragraph 1 of the Data Protection Act, everyone has the right to the confidentiality of their personal data, insofar as there is a legitimate interest in doing so. The existence of such an interest is precluded if data, due to its general availability or its inability to be traced back to the data subject, is not subject to a right of confidentiality. A restriction of this right is permissible—insofar as the use of personal data is not in the vital interest of the data subject or with their consent—only to safeguard overriding legitimate interests of another party. In the case of interventions by a state authority, such restrictions are only permissible on the basis of laws that are necessary for the reasons stated in Article 8, paragraph 2, of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210 of 1958. Such laws may only permit the use of data that is particularly worthy of protection to safeguard important public interests and must simultaneously establish appropriate safeguards for the protection of the data subjects' confidentiality interests. Even in the case of permissible restrictions, the interference with the fundamental right may only be carried out in the least intrusive manner that achieves the objective (Section 1, paragraph 2, GDPR).

The term "state authority" is not defined in the Data Protection Act (DSG). The legislative materials for the DSG 2000 state that it should be understood as a "state body acting in an official capacity" (RV 1613 BlgNR 20. GP 35). It follows that the existence of a state authority is determined solely by functional aspects, not organizational ones. State authorities are therefore to be understood as all those bodies of a legal entity that generally have the power to issue sovereign acts. Since the organizational structure is irrelevant, sovereign acts performed by private entities under delegated authority also fall under the definition of authority (Ennöckl in Kahl/Khakzadeh/Schmid, Commentary on Federal Constitutional Law B-VG and Fundamental Rights Art. 1 DSG [as of January 1, 2021, rdb.at] para. 34). State activities of private sector administration, on the other hand, are not covered, nor are non-sovereign activities of private entities. The state's right to intervene only applies within this functional scope (Lachmayer in Knyrim, DatKomm Art. 1 GDPR [as of 01.12.2018, rdb.at] para. 119). The term "state authority" is not defined in the GDPR. The legislative materials for the GDPR 2000 state that it should be understood as a "state body acting in an official capacity" (Government Bill 1613, Annex to the National Council Proceedings, 20th Legislative Period, p. 35). It follows that the existence of a state authority is determined solely by functional, not organizational, aspects. State authorities are therefore to be understood as all those bodies of a legal entity that generally have the power to issue sovereign acts. Since the organizational structure is irrelevant, sovereign acts performed by private entities under a power of representation also fall under the definition of "authority" (Ennöckl in Kahl/Khakzadeh/Schmid, Commentary on Federal Constitutional Law B-VG and Fundamental Rights Article 1, GDPR [as of January 1, 2021, rdb.at] para. 34). State activities of private sector administration, on the other hand, are not covered, nor are non-sovereign activities of private entities. The reservation of state intervention applies only within this functional scope (Lachmayer in Knyrim, DatKomm Article 1, GDPR [as of December 1, 2018, rdb.at] para. 119).

According to the jurisprudence of the Administrative Court, whether a task to be performed by administrative authorities falls under sovereign administration or private sector administration is determined by the legal forms in which the matter in question is to be carried out. Only when the authority is tasked with enforcement through a sovereign act (ordinance, decree, exercise of direct official command and coercive power) is it considered sovereign administration; in this respect, the administrative authority exercises "imperium"; otherwise, it is private sector administration. It should be noted that private sector administration, as non-sovereign administrative action, occurs in both private and public law, and therefore the distinction between sovereign administration and private sector administration does not coincide with that between public and private law (see, among others, Austrian Administrative Court [VwGH] 22.09.1995, 93/11/0221; Austrian Administrative Court [VwGH] 26.06.2012, 2011/11/0005). The Constitutional Court has classified the conclusion of employment contracts for contract employees as an act of private sector administration (VfSlg 18.616). According to the jurisprudence of the Administrative Court, whether a task to be carried out by administrative authorities falls under public administration or private sector administration depends on the legal forms in which the matter is to be carried out. Only if the authority is tasked with carrying out the task in a sovereign form of action reserved exclusively for the state (ordinance, decree, exercise of direct official command and coercive power) is it considered public administration; in this respect, the administrative authority exercises "imperium"; otherwise, it is private sector administration. It should be noted that private-sector administration, as a non-sovereign administrative act, occurs in both private and public law, and that therefore the distinction between sovereign and private-sector administration does not coincide with that between public and private law (see, among others, the Austrian Administrative Court decisions of September 22, 1995, 93/11/0221; and June 26, 2012, 2011/11/0005). The Constitutional Court has, for example, classified the conclusion of employment contracts for contract employees as an act of private-sector administration (VfSlg 18.616).

It is undisputed that the BF, as an institution of the Austrian social security system, is a public corporation. The employment relationships for the employees of the insurance carriers are governed by private-law contracts and not by administrative decisions (Section 460 Paragraph 1 Sentence 1 of the Austrian General Social Insurance Act). Therefore, the BF does not engage in sovereign action in relation to its employees. Contrary to the assertion of the respondent authority, no legal basis within the meaning of Section 1 Paragraph 2 of the Data Protection Act (DSG) is required in this regard. It is undisputed that the BF, as an institution of the Austrian social security system, is a public corporation. The employment relationships for the employees of the insurance carriers are governed by private-law contracts and not by administrative acts (Section 460, Paragraph 1, Sentence 1 of the General Social Insurance Act (ASVG)). Therefore, the BF does not act in an official capacity with respect to its employees. Contrary to the assertion of the respondent authority, no legal basis within the meaning of Section 1, Paragraph 2 of the Data Protection Act (DSG) is required in this regard.

It is undisputed that the BF, as an institution of the Austrian social security system, is a public corporation. Every processing of personal data must, firstly, comply with the principles for data processing set out in Article 5 of the GDPR and, secondly, comply with one of the principles regarding the lawfulness of processing listed in Article 6 of the GDPR (ECJ 22 June 2021, Latvijas Republikas Saeima [Penalty Points], C-439/19, EU:C:2021:504, para. 96).

Every processing of personal data must, firstly, comply with the principles for data processing set out in Article 5 of the GDPR and, secondly, comply with one of the principles regarding the lawfulness of processing listed in Article 6 of the GDPR (ECJ 22 June 2021, Latvijas Republikas Saeima [Penalty Points], C-439/19, EU:C:2021:504, para. 96). According to the principle of purpose limitation (Art. 5 para. 1 lit. b GDPR), it must be ensured that personal data collected for a specified purpose is not further processed in a manner incompatible with those purposes. Pursuant to Art. 5 para. 1 lit. c GDPR, personal data must be adequate, relevant, and limited to what is necessary for the purposes for which they are processed ("data minimization"). Art. 5 para. 1 lit. c GDPR explicitly bases the limitation of the scope of data on the processing purpose. By focusing on the processing purpose, the principle of Art. 5 para. 1 lit. c GDPR complements the principle of purpose limitation under Art. 5 para. 1 lit. b GDPR. It ensures that the processing of personal data is limited by the specified purpose. Conversely, the principle of purpose limitation complements the principle of data minimization by making normative statements regarding the definition and modification of purposes, thus ensuring that the "purpose," which constitutes the relevant benchmark for data minimization under Article 5(1)(c) GDPR, is fixed in a specific way and cannot be arbitrarily chosen and changed. The principle of data minimization does not require an absolute reduction or limitation of the amount of data; if the purpose of the processing can only be achieved by processing large amounts of data, such data processing does not violate this principle (Herbst in Kühling/Buchner, GDPR/BDSG3, Article 5, para. 55f). The data are appropriate to the purpose if they have any connection to the processing purpose at all, and they are relevant if their processing is suitable for promoting the defined purpose. The requirement to limit data processing to what is necessary means, in particular, that the amount of data must be restricted in such a way that additional data – even if individually appropriate and significant – may not be processed if the processing purpose can be achieved without it (Herbst in Kühling/Buchner, GDPR/BDSG3, Art. 5 para. 57). The infringement of fundamental rights must also be minimized by keeping the number of data subjects as limited as possible (Roßnagel in Simitis/Hornung/Spiecker, GDPR with BDSG, Art. 5 para. 131). The requirement that the processed personal data must also be relevant for these purposes means that no data may be collected that is not, or is no longer, suitable for contributing to the achievement of the purposes pursued by the processing (Heberlein in Ehmann/Selmayr, General Data Protection Regulation: GDPR², Art. 5 para. 22). According to the principle of purpose limitation (Article 5, paragraph 1, letter b, GDPR), it must be ensured that personal data collected for a specified purpose is not further processed in a manner incompatible with those purposes. Pursuant to Article 5, paragraph 1, letter c, GDPR, personal data must be adequate, relevant, and limited to what is necessary for the purposes of the processing ("data minimization"). Article 5, paragraph 1, letter c, GDPR explicitly bases the limitation of the scope of the data on the processing purpose. With its focus on the purpose of processing, the principle of Article 5, paragraph 1, letter c, GDPR complements the principle of purpose limitation according to Article 5, paragraph 1, letter b, GDPR.It ensures that the processing of personal data is limited by the defined purpose. Conversely, the principle of purpose limitation complements the principle of data minimization by making normative statements regarding the definition and modification of purposes, thus ensuring that the "purpose," which constitutes the relevant benchmark for data minimization under Article 5(1)(c) GDPR, is fixed in a specific way and cannot be arbitrarily chosen and changed. The principle of data minimization does not require an absolute reduction or limitation of the amount of data; if the purpose of the processing can only be achieved by processing large amounts of data, such data processing does not violate this principle (Herbst in Kühling/Buchner, GDPR/BDSG3, Article 5, para. 55f). The data are adequate for the purpose if they have any connection to the processing purpose at all, and they are relevant if their processing is suitable for promoting the defined purpose. The requirement to limit data processing to what is necessary means, in particular, that the amount of data must be restricted in such a way that additional data—even if individually appropriate and significant—may not be processed if the processing purpose can be achieved without it (Herbst in Kühling/Buchner, GDPR/BDSG3, Article 5, para. 57). The infringement of fundamental rights must also be minimized by keeping the number of data subjects as limited as possible (Roßnagel in Simitis/Hornung/Spiecker, GDPR with BDSG, Article 5, para. 131). The requirement that the processed personal data must also be relevant for these purposes means that no data may be collected that is not, or is no longer, suitable for contributing to the achievement of the purposes pursued by the processing (Heberlein in Ehmann/Selmayr, General Data Protection Regulation: GDPR2, Article 5, para. 22).

The infringement of fundamental rights must also be minimized by keeping the number of data subjects as limited as possible (Roßnagel in Simitis/Hornung/Spiecker, GDPR with BDSG, Article 5, para. 131). According to Article 6(1)(f) GDPR, the processing of personal data is only permitted if the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Thus, according to this provision, the processing of personal data is permissible under three cumulative conditions: firstly, the controller or a third party must pursue a legitimate interest; secondly, the processing of the personal data must be necessary for the purposes of the legitimate interest; and thirdly, the interests or fundamental rights and freedoms of the data subject whose data are to be protected must not override those interests (see CJEU 17 June 2021, C-597/19, M.I.C.M., ECLI:EU:C:2021:492, para. 106, with further references). According to Article 6(1)(f) GDPR, the processing of personal data is only permissible if the processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Thus, according to this provision, the processing of personal data is permissible under three cumulative conditions: first, the controller or a third party must pursue a legitimate interest; second, the processing of the personal data must be necessary for the purposes of that legitimate interest; and third, the interests or fundamental rights and freedoms of the data subject whose data is to be protected must not override that interest (see CJEU 17 June 2021, C-597/19, M.I.C.M., ECLI:EU:C:2021:492, para. 106, with further references).

... Regarding the requirement that the processing of personal data is necessary for the pursuit of a legitimate interest, it should be noted that the exceptions and limitations concerning the protection of personal data must be limited to what is absolutely necessary (see CJEU 17 June 2021, C-597/19, M.I.C.M., ECLI:EU:C:2021:492, para. 110, with further references).

] As previously explained, the Federal Office for Migration and Refugees (BAMF) was not acting in an official capacity when searching its employees' email log files, but rather within the scope of private sector administration, and therefore can rely on Article 6(1)(f) of the GDPR.

Since individual passages from the verbatim transcript of the Administrative Board meeting of July 30, 2020, had appeared in an article published by XXXX on August 15, 2020, the BAMF searched the email log files of approximately 6,000 employees, including those of the MP, on February 22, 2021, in order to identify the person(s) who might have transmitted the verbatim transcript to XXXX. Since excerpts from the verbatim transcript of the Board of Directors meeting of July 30, 2020, had appeared in a Roman 40 article published on August 15, 2020, the Federal Financial Supervisory Authority (BaFin) searched the email log files of approximately 6,000 employees, including those of the MP (presumably a company or organization), on February 22, 2021, in order to identify the person(s) who might have transmitted the verbatim transcript to Roman 40.

BaFin stated that it based the processing of personal data for the purpose of log file analysis on Article 6(1)(f) in conjunction with Article 9(2)(f) of the GDPR, as a preparatory step for the potential assertion of legal claims or the defense against third-party legal claims. Its legitimate interest in this processing operation arose from its interest in the lawfulness of the processing of personal data by its employees and its interest in protecting trade secrets. In its appeal against the decision, the BF also cites as the reason for the data processing its suspicion that the potential breach of duty occurred through the use of the email system provided by the BF to its employees. In its statement of February 16, 2023, the BF also maintains that it has an interest in clarifying a potential breach of duty. The BF explained that it bases the processing of personal data with regard to log file analysis on Article 6, paragraph 1, letter f, in conjunction with Article 9, paragraph 2, letter f, of the GDPR, as a preparatory measure for the possible assertion of legal claims or the defense against third-party legal claims. The legitimate interest in this processing operation arises from its interest in the lawfulness of the processing of personal data by its employees and its interest in protecting trade secrets. In its appeal against the decision, the Federal Fiscal Court (BF) also cites as the reason for the data processing its suspicion that the potential breach of duty occurred through the use of the email system provided by the BF for its employees. In its statement of February 16, 2023, the BF also maintains that it has an interest in clarifying any potential breach of duty.

The Parliamentary Group's (MP) view that the BF has no interest in maintaining the confidentiality of trade secrets or in establishing a breach of a trade secret cannot be accepted. The MP refers to the fact that all employees were informed of the planned relocation on the same day, that resolutions of the Board of Directors are published online, and that the names of the individuals to whom the quotes in the published article referred are publicly accessible on the BF's website. However, the MPs fail to recognize that excerpts from the transcript of a closed-door meeting, containing verbatim statements from named speakers – as quoted in the XXXX article of August 15, 2020 – are not publicly available and therefore constitute a trade secret. The MPs' view that BF has no interest in maintaining the confidentiality of trade secrets or in establishing a breach of such secrets cannot be accepted. The MPs base this on the fact that all employees were informed of the planned relocation on the same day, that board resolutions are published online, and that the names of the individuals referenced in the published article are publicly accessible on BF's website. However, the MPs fail to recognize that excerpts from the verbatim transcript of a closed session, which reproduce the exact words of named speakers—as quoted in the Roman 40 article of August 15, 2020—are not publicly available and therefore constitute a trade secret:

One of the administrative bodies of the social insurance institutions is the board of directors (§ 419 No. 1 ASVG), and meetings of these administrative bodies are not public (§ 435 para. 1 ASVG). The non-public nature of the meeting implies that the minutes should only be accessible to the participants or members of the respective administrative body (Thomas Müller in Mosler/Müller/Pfeil, Der SV-Komm § 435 ASVG [as of March 1, 2022, rdb.at] para. 1). According to Section 424 of the Austrian General Social Insurance Act (ASVG), members of the administrative bodies of the social insurance institutions and the umbrella organization must observe legal regulations when performing their duties and are obligated to maintain official secrecy and to perform their duties conscientiously and impartially. If facts are already public and generally known, there is no obligation of confidentiality. In this case, the person concerned no longer has an overriding interest in confidentiality (Riesz in Mosler/Müller/Pfeil, Der SV-Komm § 424 [as of July 1, 2020, rdb.at], para. 8). One of the administrative bodies of the social insurance institutions is the board of directors (Section 419, paragraph 1, ASVG), and meetings of these bodies are not public (Section 435, paragraph 1, ASVG). The fact that the meeting was not public implies that the minutes should only be accessible to the meeting participants or the members of the relevant administrative body (Thomas Müller in Mosler/Müller/Pfeil, Der SV-Komm Paragraph 435, ASVG [as of March 1, 2022, rdb.at] para. 1). According to Paragraph 424 of the ASVG, members of the administrative bodies of the insurance carriers and the umbrella organization must observe the legal regulations when performing their duties and are obligated to maintain official secrecy and to perform their duties conscientiously and impartially. If facts are already public and generally known, there is no obligation to maintain confidentiality. In this case, the person concerned no longer has an overriding interest in confidentiality (Riesz in Mosler/Müller/Pfeil, Der SV-Komm Paragraph 424, [as of July 1, 2020, rdb.at] para. 8).

Since the published personal data (verbatim statements from named speakers) in this case were not already publicly known at the time of publication, a duty of confidentiality exists in this regard—given that this data was collected during a closed session. Therefore, the BF is correct in asserting that at least those individuals whose names and statements are included in the disclosed transcript have had their interests violated. Contrary to the MP's view, it is understandable that the BF, or third parties (individuals whose names and statements were excerpted from the transcript), have a legitimate interest in the lawfulness of the processing of personal data by BF employees, or in clarifying a possible breach of duty by BF employees.

The BF, or third parties (individuals whose names and statements were reproduced in part from the transcript), have a legitimate interest in the lawfulness of the processing of personal data by BF employees, or in clarifying a possible breach of duty by BF employees. However, in light of the following considerations, it is not comprehensible that the processing of personal data is necessary to protect the legitimate interests of BF or a third party:

In the present case, BF conducted an analysis of the email log files of all employees, restricting the analysis to the recipient domain "XXXX". No further restrictions were applied (e.g., to specific groups of people or departments), and a total of 6,000 technical mail server logs (log files) were searched without any email content. While BF argued that virtually anyone who had lawful or unlawful access to the electronic document of the verbatim transcript or a copy thereof was able to send the document to the domain "XXXX", and thus restricting the analysis to a specific group of people was not possible, the arguments presented in its complaint must be countered. These arguments state that the title of the publication and the mention of "works councils" therein strongly suggest that a specific group of people, namely the works councils, should be included in the query. According to the Federal Fiscal Court (BF), the MPs were a subset of individuals potentially suspected of breaching their official duties or confidentiality obligations. Thus, according to the BF's own statements, there were indeed groups of people who were more "suspicious" than others, and therefore, the data processing should have been restricted to these specific groups. However, since the MPs belong to the bodies of the works council or central works council, their log files would have been included in the data processing even if the data processing had been restricted to specific individuals. Therefore, in the present complaint, the MPs cannot claim that the data processing was not restricted to a specific group of people and consequently violates the principle of data minimization. In this case, the BF analyzed the email log files of all employees, restricting the search to the recipient domain "40". No further restrictions were applied (e.g., to specific groups of people or departments), and a total of 6,000 technical mail server log files were searched without any email content. Insofar as the BF argued in this context that virtually anyone who had lawful or unlawful access to the electronic document of the verbatim transcript or a copy thereof was able to send the document to the domain "Roman 40", and thus a restriction to a specific group of people was not possible, the arguments in its complaint must be countered. According to these arguments, the title of the publication and the "works councils" mentioned therein actually support including a specific group of people, namely the works councils, in the query. According to the BF, the MPs were a subset of the persons potentially suspected of a breach of duty or a breach of confidentiality. Thus, according to the BF's own statements, there were indeed groups of people who were "more suspicious" than others, and a restriction to these specific groups should therefore have been made. Since the MPs are members of the works council or central works council, their log files would have been included in the data processing even if the processing had been restricted to specific individuals. Therefore, in the present complaint, the MPs cannot claim that the processing was not restricted to a specific group of people and consequently violated the principle of data minimization.

Furthermore, the approach taken by the appellant does not correspond to its assertion that – based on the model of intensified control – a multi-stage scenario for the evaluation in this specific case was planned in order to minimize the infringement on the rights and fundamental freedoms of any potentially affected individuals and to avoid placing all employees under general suspicion (statement of April 11, 2022, page 2). This is because all employees were placed under general suspicion, even though only 21 people (including MP 2) participated in the board meeting at which the verbatim transcript was taken, and 26 people had access to the stored transcript. Therefore, as a first step, the BF could have investigated a possible breach of duty by the individuals participating in this meeting or those who had access to the recorded transcript. Processing the personal data of all approximately 6,000 employees was not necessary to determine a breach of confidentiality or other official duty in connection with a transcript that was only known to a limited number of people.

It should be noted that the evaluation of the email log files of all employees, starting on July 30, 2020, with a restriction to the recipient domain "XXXX," was commissioned due to the article published on "XXXX" on August 15, 2020. The BF's purpose was to clarify which of its employees might have transmitted the transcript of the board meeting to XXXX between July 30, 2020 (the day of the board meeting) and August 15, 2020 (the day of the article publication). However, as the email correspondence of February 22, 2021, shows, an evaluation of the email log files for the period from July 30, 2020, to August 15, 2020, was no longer possible at the time of the actual data processing, as the log files are only available for 90 days. Therefore, only log file data from the 90 days prior to the evaluation on February 22, 2021, was processed. The BF (presumably the company or organization) has not explained how the evaluation of the email log files from the 90 days prior to January 22, 2021, would have been necessary for its purpose. Finally, the control measure implemented by the BF was entirely unsuitable for detecting any potential forwarding of individual text passages from the minutes of the board meeting of July 30, 2020, by evaluating email log files. The board meeting took place on July 30, 2020, and the article was published on August 15, 2020. According to their in-house technician, an analysis for the relevant period was no longer possible at the time of the request. It should be noted that the analysis of the email log files of all employees from July 30, 2020, onward, limited to the recipient domain "Roman 40," was commissioned due to the article published on "Roman 40" on August 15, 2020. The purpose of this analysis was to determine which of their employees might have transmitted the verbatim transcript of the board meeting to Roman 40 between July 30, 2020 (the day of the board meeting) and August 15, 2020 (the day of the article publication). However, as the email correspondence of February 22, 2021, shows, an evaluation of the email log files for the period from July 30, 2020, to August 15, 2020, was no longer possible at the time of the actual data processing, as the log files are only available for 90 days. Therefore, only log file data from the 90 days prior to the evaluation on February 22, 2021, was processed. The BF (presumably the company or organization) has not explained how the evaluation of the email log files from the 90 days prior to January 22, 2021, would have been necessary for its purpose. Finally, the control measure implemented by the BF was entirely unsuitable for detecting any potential forwarding of individual text passages from the minutes of the board meeting of July 30, 2020, by evaluating email log files. The board meeting took place on July 30, 2020, and the article was published on August 15, 2020. According to their in-house technician, an evaluation for the relevant period was no longer possible at the time of the request.

The processing of MP's personal data was therefore no longer suitable for achieving the purpose for which it was processed. BF thus violated the principle of data minimization pursuant to Article 5(1)(c) GDPR.

The processing of MP's personal data was therefore no longer suitable for achieving the purpose for which it was processed. BF thus violated the principle of data minimization pursuant to Article 5(1)(c) GDPR. For the sake of completeness, it should also be mentioned that, according to the company agreement on the use of electronic information and communication media, the local works council must be consulted if, in the event of a well-founded suspicion of misuse, breach of confidentiality obligations under employment law, or unauthorized access to third-party emails, the company needs to review the logs or content of emails. In the present case, however, it was established that only the chairwoman of the works council at the main office S was involved in the planned data processing, but not the local works councils of the MP branches. The company thus violated the aforementioned provision in the company agreement by failing to involve the local works councils of the MP branches in its planned review of the employees' email log data, including those of the MP branches. It was also determined that the central works council had not given its consent to the evaluation of the email log files of all employees. The involvement of S as chair of the works council at the main office and member of the central works council was insufficient for the evaluation carried out. Therefore, further explanations regarding the competence of the employee representative bodies in this case are unnecessary.

Against this background, the processing of personal data for the purposes of the BF's interest in investigating a potential breach of duty by its employees could not have been necessary. The BF therefore cannot rely on lawful processing pursuant to Article 6(1)(f) GDPR.

In light of this, the processing of personal data for the purposes of the BF's interest in investigating a potential breach of duty by its employees could not have been necessary. The BF therefore cannot rely on lawful processing pursuant to Article 6(1)(f) GDPR. Consequently, the BF's appeal against the decision was to be dismissed as unfounded and – since the log files were evaluated on February 22, 2021, log files are only available for 90 days and a search of the MP's log files for the period from July 30, 2020 to August 15, 2020 was therefore practically impossible – point 1 of the contested decision was to be upheld with the proviso that the BF violated the MP's right to confidentiality by unlawfully searching the MP's technical mail server logs (log files) on February 22, 2021, with regard to communication with the recipient domain "XXXX". From July 30, 2020, to August 15, 2020, it was therefore practically impossible – point 1 of the contested decision is to be upheld with the proviso that the appellant violated the MP's right to confidentiality by unlawfully searching the MP's technical mail server log files on February 22, 2021, with regard to communication with the recipient domain "Roman numeral 40".

3.2. The relevant facts could be considered sufficiently clarified by the case file. The appeal did not raise any factual questions requiring clarification in a concrete and substantiated manner, nor was there a complex legal question to be resolved (Austrian Administrative Court [VwGH] July 31, 2007, 2005/05/0080). Therefore, it was unnecessary to hold an oral hearing. Article 6(1) of the ECHR and Article 47 of the Charter of Fundamental Rights of the European Union do not preclude dispensing with a hearing in this case. Furthermore, neither party requested a hearing nor offered any specific evidence. Therefore, for these reasons as well, a hearing could be dispensed with (Austrian Administrative Court [VwGH] 19 October 2016, Ra 2016/12/0073). 3.2. The relevant facts were deemed sufficiently clarified by the case file. The appeal did not raise any factual issues requiring clarification in a concrete and substantiated manner, nor was there a complex legal question to be resolved (Austrian Administrative Court [VwGH] 31 July 2007, 2005/05/0080). Thus, an oral hearing could be dispensed with. Article 6(1) of the ECHR and Article 47 of the Charter of Fundamental Rights of the European Union do not preclude dispensing with a hearing in this case. Finally, neither party requested a hearing on the appeal nor submitted any specific offers of evidence. Therefore, for these reasons as well, a hearing could be dispensed with (Austrian Administrative Court [VwGH] 19 October 2016, Ra 2016/12/0073).

3.3. Regarding point B) of the ruling (Inadmissibility of the appeal on points of law):

Pursuant to Section 25a Paragraph 1 of the Administrative Court Act (VwGG), the Administrative Court must state in the operative part of its judgment or decision whether the appeal on points of law is admissible pursuant to Article 133 Paragraph 4 of the Austrian Federal Constitutional Law (B-VG). The statement must be briefly reasoned.

Pursuant to Section 25a, Paragraph 1, of the Administrative Court Act (VwGG), the Administrative Court must state in the operative part of its judgment or decision whether the appeal on points of law is admissible pursuant to Article 133 Paragraph 4 of the Austrian Federal Constitutional Law (B-VG). The statement must be briefly reasoned. According to Article 133, paragraph 4 of the Austrian Federal Constitutional Law (B-VG), an appeal against a decision of the Administrative Court is admissible if it depends on the resolution of a legal question of fundamental importance, in particular because the decision deviates from the jurisprudence of the Administrative Court of Cassation, such jurisprudence is lacking, or the legal question to be resolved is not answered uniformly in the existing jurisprudence of the Administrative Court of Cassation.

According to Article 133, paragraph 4 of the Austrian Federal Constitutional Law (B-VG), an appeal against a decision of the Administrative Court is admissible if it depends on the resolution of a legal question of fundamental importance, in particular because the decision deviates from the jurisprudence of the Administrative Court of Cassation, such jurisprudence is lacking, or the legal question to be resolved is not answered uniformly in the existing jurisprudence of the Administrative Court of Cassation. The appeal is inadmissible because no legal question of fundamental importance within the meaning of Article 133, paragraph 4, of the Austrian Federal Constitutional Law (B-VG) was to be decided.

Therefore, the decision was rendered as stated above.