BVwG - W211 2230221-1
From GDPRhub
| BVwG - W211 2230221-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 15(1)(c) GDPR Article 267 TFEU |
| Decided: | 03.09.2021 |
| Published: | 01.10.2021 |
| Parties: | 1) unknown data subject (complainant in the procedure before the DSB) 2) unknown address publishing company (controller and respondent before the DSB) 3) DSB |
| National Case Number/Name: | W211 2230221-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2021:W211.2230221.1.00 |
| Appeal from: | DSB (Austria) |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (RIS) (in German) |
| Initial Contributor: | n/a |
The Austrian Federal Administrative Court stalled an appeal procedure until the CJEU's decision on the Austrian Supreme Court's request for preliminary ruling regarding the interpretation of Article 15(1)(c) GDPR is published.
English Summary
Facts
The data subject filed a complaint with the Austrian Data Protection Authority (DSB) against the controller, requesting to be provided with recipients to whom the personal data had been shared under Article 15(1)(c) GDPR, rather than mere categories of recipients.
The controller refused, arguing that a controller has a right to choose whether to provide a data subject with information on actual data recipients or rather just categories thereof. Further, the controller argued that the disclosure of actual data recipients would reveal its trade secrets.
The DSB upheld the data subject's complaint and ordered the controller to provide the data subject with information on the actual data recipients. The controller filed an appeal against that decision with the Austrian Federal Administrative Court (BVwG), repeating its arguments brought forward before the DSB.
Holding
The BVwG did not (yet) take a decision on the merit of the case but stalled the procedure because the Austrian Supreme Court (OGH) had already filed a request for preliminary ruling on the question the interpretation of Article 15(1)(c) GDPR in February 2021. Once the CJEU has passed its judgment on the matter, the BVwG will reopen the case.
Comment
This GDPRhub entry will be adapted accordingly after the BVwG has reopened the case.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
DECISION The Federal Administrative Court decides through the judge Mag.a Barbara SIMMA LL.M. as chairwoman and the expert lay judge Margareta MAYER-HAINZ and the expert lay judge Dr. Ulrich E. ZELLENBERG as observer on the complaint of XXXX, represented by XXXX, against the decision of the data protection authority of XXXX, XXXX, in a data protection matter: A) In accordance with Section 17 VwGVG in conjunction with Section 38 AVG, the proceedings are suspended until the Court of Justice of the European Union has issued a preliminary ruling on the question submitted by the Supreme Court of Justice on February 18, 2021, 6 Ob 159 / 20f. B) The revision is not permitted in accordance with Art. 133 Para. 4 B-VG. text Reason: The Federal Administrative Court has considered: 1. Procedure / findings: 1. With a data protection complaint dated XXXX 2019, the party now involved (hereinafter referred to as mP) complained about the incompleteness of a given information according to Art. 15 GDPR by the XXXX (hereinafter: BF). 2. With its opinion of XXXX 2019, the BF stated that on this data protection complaint, in response to MP's allegation that it had not been informed to whom its data had been transmitted, further detailing at individual recipient level was the disclosure of the distribution channels of BF and their individual customer relationships would mean. Art. 15 GDPR does not imply any obligation to disclose individual recipients; this would also mean disclosure of business and company secrets. The information was given about the categories of recipients. The work of the BF as an address publisher and direct marketing company is also explained in the data protection information. It is requested that the complaint be dismissed. 3. With the contested decision of XXXX 2020, mP's complaint was upheld and it was established that the current BF had thereby violated mP's right to information by disclosing mP's personal data to the recipients in the information from XXXX 2019 had not been informed (ruling point 1.) The BF was further instructed in other execution to designate the specific recipients of the personal data within a period of four weeks. 4. With a complaint of XXXX 2020, the BF stated in summary that the person responsible had the right to choose whether information should be given to specific recipients or recipient categories. The wording of Art. 15 GDPR clearly speaks in favor of such an option. The data protection authority had also not taken into account the protection of trade and business secrets. 5. With a supplementary statement dated XXXX 2020, the data protection authority submitted that a more detailed information provided by the BF would prove that it was not impossible to provide information to specific recipients, as claimed. 6. By decision of the Supreme Court of February 18, 2021, 6 Ob 159 / 20f, the following question was referred to the Court of Justice of the European Union for a preliminary ruling in accordance with Art. 267 TFEU: "Is Art 15 Paragraph 1 lit c of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data, on the free movement of data and on the repeal of Directive 95/46 / EC (General Data Protection Regulation, OJ L 119/1 of May 4, 2016, S 1; hereinafter "GDPR") to the effect that the claim is limited to information about recipient categories if specific recipients have not yet been determined in the case of planned disclosures However, the right to information must also extend to the recipients of these disclosures if data has already been disclosed? " 7. On XXXX 2021, the BF filed an application to stay the proceedings because of the pending request for a preliminary ruling by the Supreme Court of February 18, 2021. 8. On XXXX 2021, the BF replied to the supplementary statement of the data protection authority of XXXX 2020. 2. Evidence assessment: The findings are based on the administrative act as well as on the request for a preliminary ruling from the OGH of February 18, 2021, which is available under RIS - 6Ob159 / 20f - Decision text - Justiz (OGH, OLG, LG, BG, OPMS, AUSL) (bka.gv.at) . These findings are not in dispute. 3. Legal assessment: To A) 3.1. According to § 38 AVG, which according to § 17 VwGVG is to be applied accordingly in administrative court proceedings, an authority can suspend proceedings until a final decision on a preliminary question, which would have to be decided by other administrative authorities or by the courts as the main question, if the preliminary question already has forms the subject of pending proceedings before the competent court, among others, or such proceedings are pending at the same time. 3.2. A main question in this sense can also be a question referred to a preliminary ruling procedure pending at the ECJ. It entitles to suspension according to § 38 AVG if it is prejudicial for the administrative court proceedings (cf. eg VwGH 13.12.2011, 2011/22/0316). A legal question is also prejudicial to a “merely” similar legal question, even if the same legal regulation of the same legislature is not affected (cf. most recently VwGH 13.9.2017, Ra 2017/12/0068). 3.3. In the case at hand, the mP complains that the BF lacks information about recipients or specific categories of recipients of personal data. 3.4. Opinions in the literature differ on the question of whether priority should be given to naming the recipients or just categories of recipients within the framework of Art. 15 Para. 1 lit c GDPR. 3.5. In addition, a request for a preliminary ruling from the Supreme Court of February 18, 2021 at the Court of Justice of the European Union is pending on the following grounds: "There are different doctrines on the first question in Austria and Germany: 1.1.1. For a right of choice for the person responsible: According to Haidinger in Knyrim, DatKomm Art 15 GDPR margin no. 39, the word "or" implies that the person responsible has the right to choose to disclose recipients or only categories of recipients. Paal in Paal / Pauly, DS-GVO / BDSG2 Art 15 DSGVO margin no. 6 states that there is a right to choose between "recipients" and "categories of recipients" in favor of the person responsible; this could therefore always be limited to the specification of categories of recipients. 1.1.2. Against a right of choice of the person responsible: Dix in Simitis / Hornung / speaks against a right of choice on the part of the person responsible, insofar as future disclosures of the data subject's data to specific recipients have already been determined, and for a "mandatory" extension of the right to information to the names of the recipients if disclosure has already taken place. Spiecker gen. Döhmann, data protection law [2019] Art 15 margin no.20. Bäcker in Kühling / Buchner, DS-GVO / BDSG2 Art 15 DSGVO margin no. 16 f also takes the position that the person responsible basically has no right to choose: If he still or already knows the recipient of the data, he must name them on request. If this leads to a collision between the data subject's data protection right to information and conflicting confidentiality interests of the data recipients, the data subject's right will prevail in accordance with Art.15 GDPR. In this case, the person concerned can also request information about the categories of recipients. Ehmann in Ehmann / Selmayr, DSGVO2 Art 15 Rz 20 argues initially that a comparison with Art 30 Para 1 lit d DSGVO shows that, within the scope of the right to information, the naming of the (specific) recipients of personal data not named there takes precedence over the ones exclusively named there Naming the categories of recipients, and then based on the purpose of the right to information: Only the naming of the specific recipient makes it possible to check the lawfulness of the processing. Schantz in Schantz / Wolff, Das neue Datenschutzrecht [2017] margin no. 1198 mwN assumes that the data subject can choose whether he or she would like to know the names of the recipients or just the categories of the various recipients from the person responsible. If the person responsible was left to decide on the content of the information, this would considerably impair the practical effectiveness of the right to information, because knowledge of the specific recipient is often of great importance for the person concerned. Schmidt-Wudy in Wolff / Brink, BeckOK Datenschutzrecht32 (as of May 1, 2020) Art 15 GDPR margin no. 58 takes the view that it is questionable whether the “or” between “recipient” and “categories of recipients” implies an alternative factual situation or should be understood as "and". The interpretation of the wording leaves the person responsible to choose whether to provide information to the recipients or the categories of recipients; Recital 63 seems to support the view that the "recipients" must be informed in any case and the categories of recipients can be optionally informed. It seems appropriate to assume an obligation to provide information about recipients in any case, but only to accept such an obligation with regard to the categories of recipients if data has been or is to be provided repeatedly, since only then "categories of recipients" exist. 1.2. Supreme Court Considerations: The wording of Art 15 (1) (c) GDPR does not allow a conclusive assessment of the question. By referring to the scope of the data subject's right to information and not, for example, the correlating obligation of the person responsible to provide information, the German version indicates that the person concerned has a right to choose. Nothing else results from the wording of the corresponding text section in the English (arg: “[…] the right to obtain […] access to […] the following information: […] the recipients or categories of recipient to whom the personal data have been or will be disclosed ") and the French language version (arg:" [...] le droit d'obtenir [...] les informations suivantes: les destinataires ou catégories de destinataires auxquels les données à caractère personnel ont été ou seront communiquées [... ] "). In contrast to Art 15 GDPR, Art 13 Paragraph 1 lit e and Art 14 Paragraph 1 lit e GDPR does not state the data subject's right to information about “recipients or categories of recipients”, but rather an obligation of the person responsible to provide information. In addition, the information obligation stipulated in Articles 13 and 14 GDPR is linked to the time of data collection - which is inevitably prior to data processing, so that the information must always be given in advance, i.e. at a stage in which there is no actual disclosure of data Third party may have come. The right to information according to Art.15 GDPR, on the other hand, extends not only to the data subject's currently processed data, but also, according to its intended purpose, to the data stock processed in the past (fundamentally ECJ Rs C-553/07, Rijkeboer, ECLI: EU: C: 2009: 293, Rz 51 ff; the convincing considerations of this decision based on the telos of the right to information are also to be transferred to the right to information according to Art 15 GDPR, especially since it can be derived from recitals 9 and 10 of the GDPR that the European legislator is reducing the Level of protection in relation to Directive 95/46 / EC in general not intended). Recital 63 of the GDPR states that "every data subject should therefore have a right to know and learn ... who the recipients of the personal data are ...". So here we are not just talking about “categories of recipients”, which also suggests that the person responsible must name the individual recipients. Against this background, the interpretation of Article 15 (1) (c) GDPR must primarily be based on the purpose of the norm: First of all, reference should be made to the telos of the right to information as an auxiliary claim for effective legal enforcement, in particular the rights of data subjects under Article 16 ff GDPR . This purpose of the regulation clearly speaks in favor of an understanding - which is well covered by the wording of the provision - to the effect that the person responsible does not have a discretionary vote with regard to the question of how specifically he wants to comply with the request for information about the recipients of personal data; Rather, the data subject should basically have the choice of whether he wants information only about abstract recipient categories or about the specific recipients of his data. The opposite understanding of the norm, on the basis of which the person responsible could ultimately always withdraw from merely providing information about the recipient category, led to a considerable impairment of the effectiveness of the legal remedies available to the data subject for the protection of his data, which is aimed at by the European legislator: As the appellate court and the defendant believe - the free choice, a person responsible will hardly ever give detailed information about specific recipients, which is associated with considerable additional effort. In this case, the person concerned will usually only be informed via abstract recipient categories. " 3.6. The question that was submitted to the Court of Justice of the European Union is similar to the legal question to be resolved in the present proceedings within the meaning of the above-mentioned case law; It is also prejudicial: the question of whether specific recipients are to be informed within the framework of Art. 15 Paragraph 1 lit c GDPR, or whether the person responsible has the right to choose to provide specific recipients or categories of recipients, is the subject of the pending Complaints procedure. 3.7. The complaint procedure will therefore be suspended - with a decision that is not merely a procedural guide (cf. VwGH December 20, 2017, Ra 2017/12/0019) - until the preliminary ruling by the Court of Justice of the European Union on the decisions made by the Supreme Court of February 18, 2021, Zl 6 Ob 159 / 20f, the question submitted resolved. Regarding B) Inadmissibility of the revision: Pursuant to Section 25a (1) VwGG, the administrative court has to state in the verdict of its decision or decision whether the revision is admissible according to Article 133 (4) B-VG. The statement must be briefly justified. According to Art. 133 para. 4 B-VG, the appeal is not permissible because the decision does not depend on the solution of a legal question which is of fundamental importance. With regard to the application of Section 38 AVG, the judging court could rely on a - in each case cited - established case law of the Administrative Court. An assessment - as here - within the framework of these principles established by the Administrative Court of Justice of a legal question pending before another court as being prejudicial for the present proceedings is irreversible (see VwGH 13.9.2017, Ra 2017/12/0068). Catchwords Request for information Suspension of data protection data protection proceedings ECJ Legal question Union law Request for a preliminary ruling European Case Law Identifier (ECLI) ECLI: AT: BVWG: 2021: W211.2230221.1.00 In RIS since 10/01/2021 Last updated on 10/01/2021 Document number BVWGT_20210903_W211_2230221_1_00
