BVwG - W211 2231475-1
|BVwG - W211 2231475-1|
|Relevant Law:||Article 4(2) GDPR|
Article 6(1)(c) GDPR
Article 28 GDPR
§ 13(8) AVG
§ 25(1) VStG
|National Case Number/Name:||W211 2231475-1|
|European Case Law Identifier:||ECLI:AT:BVWG:2021:W211.2231475.1.00|
|Original Source:||Rechtsinformationssystem des Bundes (RIS) (in German)|
|Initial Contributor:||Heiko Hanusch|
The Federal Administrative Court held that the transmission of personal data from the controller to the processor does not need to be justified under Article 6 GDPR because the processor is to be seen as a mere extension of the controller.
English Summary[edit | edit source]
Facts[edit | edit source]
The data subject called the helpline of the Österreichsiche Post AG (Austrian Postal PLC). He gave his phone number to the employee with the request for a callback, thereby stating that he did not want the phone number be given to a third party. Afterwards the data subject was called twice by a market research institute – the processor. The controller and the processor had concluded a processing-contract under Article 28 GDPR.
Holding[edit | edit source]
The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision of the DSB.
The court determined that the processor is to be seen as a dependent extension of the controller (“verlängerter Arm”) (cmp. Article 29 GDPR). If the processing of data is in accordance with Article 6 GDPR, the controller is free to deploy a processor. As a result, the transmission of data from the controller to the processor itself does not need to be justified under Article 6 GDPR.
In the case at hand, the court came to the conclusion that the processing of data by the controller - and therefore also the transmission to the processor - is justified under Article 6(1)(c) GDPR. The controller in this case - the Österreichsiche Post AG - is obliged under national law (§§ 6(8), 32(3) PMG) to provide for a complaint management system to improve their services. According to § 6(8) PMG a postal service must further develop its service in accordance with the needs of users and to contribute to securing the provision of postal services and to the further development of them by means of appropriate measures and proposals. Pursuant to § 32(3) PMG postal service providers must have a complaints management system in place so that users can raise disputes or complaints.
Besides, the court decided the amendment of the data subject’s complaint was inadmissible pursuant to § 13(8) AVG and a data subject has no subjective right to the initiation of administrative fine proceedings under the GDPR and according to § 25(1) VStG.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the German original. Please refer to the German original for more details.