BVwG - W214 2224204-1
|BVwG - W214 2224204-1|
|Relevant Law:||Article 4(1) GDPR|
Article 6(1)(f) GDPR
Article 17 GDPR
Article 18 GDPR
Article 21 GDPR
Article 22 GDPR
|National Case Number/Name:||W214 2224204-1|
|European Case Law Identifier:||ECLI:AT:BVWG:2022:W214.2224204.1.00|
|Original Source:||Source: Rechtsinformationssystem des Bundes (RIS) (in German)|
|Initial Contributor:||Heiko Hanusch|
The Austrian Federal Administrative Court held that a municipal water provider did not violate the GDPR by measuring the daily water consumption of a user, if this user had in the past exceeded the daily limited allotted to them.
English Summary[edit | edit source]
Facts[edit | edit source]
The controller is a municipality. The data subject owns property in the controller’s district. The data subject won a lawsuit against the controller, obliging it to connect the data subject’s property to the municipal drinking water supply. The judgement was limited to the supply needed for a single-family home. The controller complied with the judgement and connected the data subject’s property to its water supply system. It also installed an analogous water meter (not a smart meter) at the beginning of the water pipe to measure the consumption of the data subject’s property. The water meter is checked once a year by the municipality. The results are stored in the municipality’s software application which is hosted in an Austrian datacenter. The data is retained for thirty years to exercise or defend against possible legal claims.
Moreover, because multiple times in the past the data subject used vast amounts of water, exceeding the need of a single-family home by far, the municipality installed a system that measured the daily consumption of the data subject. At the beginning, the system worked as follows: An incremental encoder was installed on top of the water meter. This incremental encoder sent digital signals to a programmable logic controller (PLC) at the water supply facility of the controller every time water was used by the data subject. The programmable logic controller counted the signals and if the usage of the data subject exceeded the threshold of 950 liters per day, the PLC closed the solenoid valve of the pipe, cutting of the water supply to the data subject's property. The counter was automatically reset each day to zero. After five months the controller switched to a system where the water supply was not automatically shut off by the PLC but an employee was notified to check whether the alarm was accurate and, if yes, to shut off the water supply manually.
After the data subject learned about this conduct of the controller, she asked the controller for the information according to Articles 13 and 14 GDPR, objected to the processing pursuant to Article 21 GDPR and requested the restriction of the processing under Article 18 GDPR. The controller provided the data subject with the information according to Articles 13 and 14 GDPR but denied the request for restriction under Article 18 GDPR. As a consequence, the data subject lodged a complaint with the Austrian DPA (Datenschutzbehörde – DSB) asserting a violation of its rights under Articles 17, 18, 21 and 22 GDPR. The Austrian DPA rejected the complaint as unfounded which lead to the data subject initiating court proceedings.
Holding[edit | edit source]
The Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG) rejected the complaint and upheld the DPA’s decision entirely.
The court held that the controller was processing personal data according to Article 4(1) GDPR because, at least, in (small) private homes measuring the water consumption can give insights into the beaviour of the residents. The court also corrected the view of the DSB which was of the opinion that the controller is not obliged to erase data of its own accord but only if the data subject requested it to do so. It clarified that according to the explicit wording of Article 17(1) GDPR erasing the data of its own accord is an obligation of the controller and a request by the data subject is not necessary. However, it found that Articles 17(1)(c),(d) GDPR and 21(1) GDPR were not violated because the processing was lawful under Article 6(1)(f) GDPR since measuring the water consumption was necessary to fairly distribute the costs among all users, to check whether the data subject exceeds the water supply needed for a single-family home, to ensure daily reliability of the distribution system and to detect damages to it. The court further held that the controller did not violate Article 18 GDPR because the data subject did not show that the data was inaccurate (Article 18(1)(a) GDPR) and the data subject did not oppose the erasure of the data but rather tried to achieve it with its complaint (Article 18(1)(b) GDPR). Moreover, since the controller did not violate Article 21 GDPR, the court found that the requirements of Article 18(1)(d) were also not met, and a violation of Article 18(1)(c) GDPR was not indicated by the data subject's submissions. Lastly, the court did not find a violation of Article 22(1) GDPR. It clarified that Article 22(1) GDPR does not require a request of the data subject – contrary to the DPA’s opinion – because it constitutes a prohibition, although it is systematically listed in Chapter 3 of the GDPR. However, the court found that there was no decision solely based on automated processing as required by Article 21(1) GDPR because the decision to cut off the supply if the data subject exceeds the daily limit was taken by the controller as a kind of "fundamental decision" before the respective system was installed and was not taken again each time when the supply was actually cut off by the automatic system or the employee (the automatic system or the employee just being the means to enforce the "fundamental decision" of the controller). Furthermore, the court reasoned that there was no automated decision making because, even if the decision was taken each time again, the controller switched from an automated system to a system where the accuracy of the counter is checked by an employee, who is also responsible for shutting off the water supply manually, and therefore the decision was not solely based on automated processing.
Comment[edit | edit source]
The court did not address the 30 years’ storage period. The statute of limitations for the majority of claims in Austria is 30 years. However, this should not mean that storing the information is necessary for the establishment, exercise or defense of a claim (Articles 17(3)(e), 18(2), 21(1) sentence 2 GDPR). The requirement the data must be "necessary" for these purposes requires a balancing of interest, taking into account the likelihood of litigation, the significance of the claims concerned and the interests of the data subject. The statute of limitations does not automatically give a controller the right to store the data for the whole period of the statute.
The argument of the court that Article 22(1) GDPR is not violated because the controller took a "fundamental decision" to shut off the water supply before installing the system and not every time the automatic system or the employee actually shut off the water supply is legally incorrect. The court basically argued that the automatic system or the employee were just mere tools to enforce the decision of the controller. Other controllers could use this argument in cases where the tool to enforce the decision is not just a simple counter which measures the daily usage and automatically cuts off the supply, but a more sophisticated algorithm. In such a case a controller might also argue that the decision was taken beforehand and that the programmer just designed the algorithm in the way that the decision is enforced when a certain set of conditions are met. The controller could basically argue as long as there is no (real) artificial intelligence a decision is never solely based on automated processing but is always the pre-formulated human decision of the controller manifested in the source code and the algorithm is just a mere tool to enforce this decision. However, "decision based solely on automated processing" does not mean that a machine/computer needs to make an intelligent decision comparable to a human decision. The purpose of Article 22(1) GDPR is exactly to limit the risks to privacy resulting from the error-proneness of programming and machines/automation in general. Until today no human ever created a machine which worked (forever) flawless.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Postal address: Erdbergstrasse 192 – 196 1030 Vienna Phone: +43 1 601 49-0 Fax: + 43 1 711 23-889 15 41 Email: email@example.com www.bvwg.gv.at decision date 03.02.2022 business number W214 2224204-1/28E I M N A M E N D E R E P U B L I K ! The Federal Administrative Court, through the judge Dr. Eva SOUHRADA-KIRCMAYER as Chair and the expert lay judges Mag. Huberta MAITZ-STRASSNIG and Mag. Claudia KRAL-BAST as assessors on the complaint from XXXX , against the Decision of the data protection authority of August 19, 2019, Zl. DSB-D123.958/0003-DSB/2019 right recognized: a) The complaint will be processed in accordance with Section 28 (2) of the Administrative Court Procedure Act, Federal Law Gazette I No. 33/2013 as amended (VwGVG), rejected as unfounded. b) The revision is not permitted according to Art. 133 Para. 4 B-VG., - 2 - Reasons for decision: I. Procedure: 1. In her to the data protection authority (DSB, authority responsible before the Federal Administrative Court) directed complaint of December 22, 2018, received on December 28, 2018 (improved with submission of January 22, 2019), the complainant made a Violation of the right to erasure, the right to object, the restriction of Processing and, in law, no automated data processing to be subjected to. In summary, it was submitted that the XXXX (participating party, former respondent before the authority concerned) data with regard to the complainant's water consumption in a non-transparent way. It a facility is operated which monitors the complainant and her family through the party involved. The installation of a lawful water meter and water measurement shaft on the complainant's property is denied by the party involved, this allows a review of the Consumption habits, absences or other behavior of complainant. Also going with the water meter in the community-owned Operational facility measured a main supply line, which not only the property the complainant, but also for the mandatory flushing and for others Purposes will be used, so the water data could not do anything about the consumption of the testify to the complainant. The data protection complaint was a letter from the complainant to the party involved Party with which the complainant objects to the data processing regarding their water consumption and asserted the right to restriction made, and the reply letter from the party involved is attached. 2. At the request of the authority concerned on January 28, 2019, the co-involved reimbursed Party on February 15th, 2019 a statement and stated that they with appeal judgment of XXXX was found guilty of XXXX, the property of Appellant with a drinking water supply for the needs of a Detached house to provide, as well as that they are responsible for all damage arising from the Impairment of the water supply on the complainant's property, liable., - 3 - The XXXX was assumed in the appeal judgment that it was in the context of the work on Construction of the public sewage system for the XXXX to an impairment of water supply had come to the complainant's property. be it been determined that in accordance with the judgment of XXXX the property of Complainant to the existing water supply system of the municipality "XXXX" (hereinafter: "XXXX") and connected to this water supply with drinking water be taken care of. In the course of the work to connect the property the complainant has been offered a water meter on her property to incorporate, the complainant had refused this. The reason for this is this Time not ensured frost protection of the house management by the complainant been. The water meter is currently in the well shaft in the " XXXX ". Of the Statement of the XXXX as supervisory authority of XXXX (code: XXXX) is to be accepted see that in the specific case no public municipal water pipe iSd XXXX and of XXXX is available. The complainant has a different water supply and the Installation of a water meter and a water measuring shaft on your property required. However, there is no legal entitlement to the construction of a frost-free one meter shaft by the party involved. The property owner himself has it Obligation to assume the costs for the installation of the water meter to tolerate the work required and the work required to protect the water meter to maintain facilities. The complainant is free to use a water meter to be built into the house line, to which the party involved then has no access had. The party involved is also entitled or obliged to make a possible Detect damage and take appropriate action. With letter dated On June 28, 2018, the complainant was informed that a water meter Record the line harness to your property and to the flushing line and the meter reading in each case determined once a year by reading and stored on measurement documents. The data would be processed to detect any damage such as burst pipes can, in order to split the electricity costs of the water supply system to the individual To be able to make buyers and to be able to check whether the water consumption of the property within the established boundaries, namely for the needs of a family house, successes. On XXXX 2017, the main water meter of the water supply system " XXXX " had a unusually high water consumption of the entire system is displayed, whereupon all The system's water meters had been checked. The high consumption has dem Water pipeline to which the complainant's property is connected, - 4 - is, can be assigned. The complainant stated that she (although absent) left the water running for rinsing purposes. Consequently, she is from the involved party has been advised that hours or even days Letting the drinking water run the obligation to use drinking water carefully contradict. This shows that a water meter is required to check whether the water consumption of the property is within the scope of the judgment of the XXXX for a single-family house specified in line XXXX and at about To be able to quickly limit the damage in the event of pipe bursts. The conditions to delete the collected data would not be available for the reasons mentioned. the Appellant repeatedly claims an exorbitantly high, far beyond the needs of a single-family house, the provisions of the Water law contradicting water consumption and that it is available provided water neither qualitatively nor quantitatively to the judgment of the XXXX correspond to 3. The authority concerned informed the complainant of the results of the preliminary investigation of March 6th, 2019 and sent her the statement of the involved party. According to Section 45 (3) AVG, the complainant was heard as a party granted and given the opportunity to submit a statement. 4. The complainant stated in her statement, received on March 22, 2019, additionally summarized that the only water meter, which for their Water consumption could be used in a locked well shaft involved party and is not accessible to them. One for the complainant accessible, legally compliant, certified and calibrated water meter is not available and will be denied. The installation of such a water meter is through that XXXX and the XXXX set by law. This water meter should only be in one frost-free basement room or in a water measuring shaft at the property boundary to be installed. Neither is due to the current design of the house connection line possible. The flushing line contains 653 liters of water and according to the Drinking Water Ordinance is one daily rinsing required to prevent contamination and accumulation of precipitated prevent minerals. Consequently, any water consumption, measured by this Counters are not assigned to be consumption-neutral. The party involved has in its Opinion claims to control the complainant's water consumption need to be able to take action if necessary. The water supply Complainant can therefore be hired at will, this is in the past also happened several times. Furthermore, the complainant's house was of - 5 - January XXXX to October XXXX hooked up to a no consensus water line/flush been. For years, she and her family had been forced to pollute and consuming unhealthy water. You will continue to execute the Water connection refused. It had also been established that in concrete terms case it is a public water pipe. 5. With the now contested decision of August 19, 2019, the complaint rejected. As a reason, the authority concerned (after repeating the argument of the parties and the course of the proceedings) first of all that the subject of the complaint is the The question is whether the party involved has the right to revoke the complainant erasure, the right to restriction of processing, the right to object and the Right not to be subject to an automated individual decision, violated by the involved party to the request formulated in the letter of 10.06.2018 complainant until the conclusion of the proceedings before the data protection authority have corresponded. The authority concerned found, among other things, that the complainant was the owner who is XXXX. In 2005, work was carried out on a public sewage system Cadastral community XXXX has been carried out. Based on these works, let it be a legal dispute between the complainant and the party involved came. The XXXX decided in its judgment of XXXX XXXX that the involved Party within eight weeks from the title of damages (in rem restitution). have to produce drinking water supply for the needs of a single-family house. with XXXX was the connection of the complainant's property to the water supply system " XXXX " occurs. Up to this point, the water supply system was only available Supply of municipal buildings or facilities served. The technical installations this water supply system (well, treatment systems, UV sterilization system) would be in the " XXXX ". The water meter for the power line on which the The complainant's property has been connected since Installation of the system directly in the well shaft. No fee will be charged for the use of water on property XXXX. Of the Water meters enable the involved party to report the annual water consumption measure, to identify and check damage and broken pipes as quickly as possible to be able to determine whether the water consumption of the complainant's property within the in the said judgment of the XXXX of XXXX, namely for the needs of a single-family house, successes. The water consumption data would only go to these mentioned purposes., - 6 - Legally, the relevant authority stated that water consumption data that as in the present case, to a specific property and thus to a specific one living situation, to handle personal data in accordance with Art. 4 Z 1 GDPR. Furthermore, the authority concerned explained that the exercise of the right to deletion as subjective right of data subject according to Art. 12 Para. 3 DSGVO a corresponding application assume the person responsible that such a request is neither express nor been made implied. Regarding a violation of the right to restriction pursuant to Art. 18 (1) lit. a, lit. b and lit. d GDPR is with regard to lit. a leg. cit. to hold that the correctness of the water consumption data in question had never been disputed. One Violation of the right to rectification in accordance with Art. 16 GDPR is also not alleged been. With regard to lit. b leg. cit. it should be noted that the complainant obviously did not refuse deletion. With regard to lit. d leg. cit. be held tight that the complainant had lodged an objection pursuant to Art. 21 (1) GDPR, however, the complaint should also be dismissed with regard to the right of objection. To the authority concerned explained that according to the wording of Art. 21 Para. 1 DSGVO a data subject the reasons arising from their particular situation within the framework the exercise of the right of objection according to paragraph 1 leg. cit. have to explain. These reasons were not presented to the party involved as responsible, thus is not a claim to the handling of the exercised objection by the co-involved party emerged. Even if you consider the statements in the application of June 10, 2019 [meaning: 06/10/2018], as "explanation of the special situation" in the sense of the above considerations would qualify, the complaint was to be unsuccessful on this point, since the involved party as a municipality acts as responsible for the public area, therefore based on Art. 6 Para. 1 lit. f GDPR, since the procedural Processing was not carried out in fulfillment of their (sovereign) tasks. It is objectively a private water supply system of the party involved, which only supply municipal buildings or facilities with water from the tap and the connection of the complainant's property to the latter Water supply system was only on the occasion of the judgment of XXXX from XXXX to Zl. XXXX takes place in order to implement the "in rem restitution" ordered "by decree". the The involved party bases the processing on legitimate grounds Interests according to Art. 6 Para. 1 lit. f GDPR, which is why Art. 21 Para. 1 GDPR is basically fulfilled. However, the party involved has “mandatory reasons worthy of protection” for the processing, namely the annual to measure water consumption and to prevent damage and pipe bursts as quickly as possible, - 7 - recognize. Albeit for the use of water on the complainant's property no fee is charged, there is also a particular need to check to be able to ensure that the total water withdrawal of the "XXXX" does not exceed 3050 l/day and that the water extraction on the complainant's property within the specified limits, namely for the needs of a single-family home. The opposite there are no compelling reasons worthy of protection recognizable, which is why the co-involved party the processing in question should be omitted. So the complainant only generally brought to the meeting that "profiling" was carried out with the water consumption data without going into more detail about this process. The water consumption data would but - as emerged in the present proceedings - only to the aforementioned purposes and not otherwise used, so no disproportionate Processing or violation of Art. 5 Para. 1 lit. b GDPR is recognizable. Of the involved party should also concede that with regard to the limited Presence of a sufficient amount of drinking water, a certain range in the Distribution of the maximum water volume to the different consumers monitored to avoid that a single user has the total fixed Amount of water (or a disproportionate amount) at the expense of others consumers consume. Right, not subject to any automated individual decision to be, it should be pointed out that the first element of the elements of Art. 22 para. 1 GDPR is not fulfilled and there is no "automated decision". 6. Against the decision in question, the complainant raised with input from 02.10.2019 complaint to the Federal Administrative Court within the deadline and demanded the Deletion of the data unlawfully assigned to you. In it, she reiterated the view that the water supply system "XXXX" is a public one water supply system handle. The complainant must be granted the Amount of water can be granted and only this amount of water can be checked take place. The involved party is not permitted to claim from the authority for a to distribute the amount of water approved for certain properties to other customers. the The party involved has sole power of disposal over the data from the water meter in the blocked well shaft. The water pipe line on which the property of Complainant is connected, also supply other customers. That means that the statutory, regular flushing of the 271 m long water pipe line, the volume of which is 653.21 liters of water, at least once per week must be carried out. This is necessary in order to comply with the Drinking Water Ordinance regarding sterility. Therefore, the measured data are the only - 8 - Counter in the well shaft of the party involved, which is approx. 90 meters from the property of the complainant is situated, not objectifiable. To reprimand that itself the complainant had refused to install a water meter in her shed to leave, she explained that no water meter could be installed in the shed because this is not frost-free. Furthermore, the complainant submitted that the assessment of evidence the authority concerned is largely based on incorrect information, in particular those that have been complained about the reference to the notification of XXXX as the supervisory authority dated XXXX (Code: XXXX ), which is not a legal opinion. Of the the water pipeline in question, on which the property of Complainant was affiliated, also had no water permit. In addition, it is incorrect that the measured data only belong to the interested party would be used for the purposes mentioned, water consumption the complainant is constantly being measured. There is no standard Water meter on the complainant's property, so there is one "As soon as possible" detection of "damage and burst pipes" not possible, because a separation of the public line/data from the private line/data is not feasible. Consequently, it is also not possible to damage the public water line from damage to the complainant's private water line to separate. The water consumption data attributed to the complainant would do not correspond to the data protection regulations, these are directly applicable Clear. Attached to the complaint is a letter from the law-friendly representative of involved party from 13.09.2019. 7. By letter dated October 3rd, 2019 (received on October 9th, 2019), the competent authority submitted the appeal and the administrative act to the Federal Administrative Court for a decision and issued an opinion to the effect that the complaint submissions in their entirety contested and referred to the contested decision. Furthermore, some of the arguments contained in the notification 8. In a letter dated October 29, 2019, the complainant informed that on 23.10.2019 Drinking water withdrawn. You reported this. Enclosed was a letter to XXXX and other attachments, including an e-mail dated October 23, 2019, whereby the complainant was informed by the involved party that that on that day the amount withdrawn from their property exceeded 900 liters and therefore another withdrawal option was prevented for that day., - 9 - 9. In a further letter, received on April 7th, 2020, the complainant brought suggests that, based on previously withheld documents from the party involved, correction was necessary and reiterated some of its previous claims. Next be on October 22nd, 2019 a water counting and shutdown system was installed to to monitor the complainant's water consumption data. This has to automatic shutdown of the water supply on October 23, 2019. First with In a letter dated March 3, 2020, the party involved admitted new facts been. With the installation of this solenoid valve, it is possible at any time to To change the liter setting, this would result in prohibited profiling. These dates would be used to reduce the applicant's water supply be used to use the water volumes for flushing purposes and for other customers be able. Enclosed was a letter from the mayor dated March 3rd, 2020, a letter from XXXX from March 25th, 2020, an excerpt from a judgment of XXXX from XXXX on line XXXX, as well as a Excerpt from XXXX . 10. Due to the decision of the business allocation committee of July 17, 2020, the the legal matter in question to the now competent court division W214 assigned, where it arrived on 07/24/2020. 11. On XXXX 2021, the Federal Administrative Court granted the parties to appeal or opinion of the relevant authority. The party involved was further requested, within the same period, the exact designation and functioning of the to announce both installed water meters, in particular whether these are so-called "smart meters" handle, as well as run, whether through the water meter of exact water consumption of the complainant's property should be given can or whether the water meter connected the total consumption of all real estate and (indistinguishable) consumption for flushing purposes. 12. On November 2, 2021, a letter from the complainant including enclosures was received, in which she essentially repeated her previous submissions. 13. After the extension of the deadline had been approved, the party involved submitted an application on November 12, 2021 submitted a statement in which, to the extent relevant to the proceedings in question, she stated that that there is a water meter (No. XXXX) at the beginning of the water pipe line, on which the complainant's property is attached. This The water pipe then continues to a flushing shaft, where another - 10 - Water meter (No. XXXX) installed. This one additionally installed in 2019 Water meters are used to determine the amount of water during rinsing processes. The slider after the house connection of the complainant's property is only used for rinsing processes opened. There are no further connections or Customer. The water meters in question are analog Ring piston meters, therefore no "smart meters". Once a year, a reading of all takes place customer-side water meter of the water supply system " XXXX ", thereby for all customers determine their annual consumption in order to share the electricity costs to be able to carry out the individual customers. For the property of Appellant, the annual water consumption results from the deduction of Annual water consumption at water meter no. XXXX from annual water consumption Water Meter No. XXXX . This subtraction consideration is due to the fact that a Installing a water meter on the complainant's property was made possible (creation of a frost-free room). Due to an exorbitantly high water consumption of the property The complainant had put an impulse generator on the water meter No. XXXX, A solenoid valve was installed after the water meter. The impulses (1 liter = 1 pulse) of the pulse generator would be via a digital input on the PLC (Programmable logic controller) of the water supply system "XXXX" recorded and are summed up (counter). By exceeding the set limit value of 950 liters, an alarm is set off (call from the building yard employee on duty through the alarm dialer). It is then carried out by the building yard employee on duty Deactivation and notification of this by email to the complainant. The counter in the PLC is reset daily at 00:00 and then starts again at 0 liters counting. During a rinsing process, the pulse count is switched to inactive. It succeeds no storage or visualization of daily values, so there is no profiling. It was noted that the shutdown (the closing of the solenoid valve) initially was done automatically by the controller. In March 2020 this was reprogrammed that the information of reaching the maximum amount of water in the first step automatically sent to the building yard employee on duty, who takes it then switch off manually and inform the complainant. The statement was accompanied by a number of documents, including an explanation of the pipe network of the water supply system in question., - 11 - 14. On December 7th, 2021, the party involved made a statement again and repeated in the essentially their previous submissions. She explained in reference to another who Statement attached letter (which contains explanations to the objective water meters used) that the controller does not have any meter readings would be transmitted or recorded and no way for the party involved insist on reading the current daily counter reading. 15. In a letter dated December 15, 2021, the Federal Administrative Court provided additional specific information Questions for the involved party. 16. By letter dated January 3, 2022 (received at the Federal Administrative Court on 09.01.2022), the party involved commented on the questions. Since installing the second water meter, it is now possible to record exact amounts of flushing water in the log book to note. The logbook is made electronic at the building yard by the building yard employees kept and kept. For the annual percentage breakdown of operating costs at the other water consumers is the inclusion of the water meter, via which the Supply of the complainant's property and the (independent) any flushing was carried out, was in principle sufficient, since the property of the Complainant (as long as [consumption by] the property does not exceed the need of a single-family home) does not have to bear any costs. An exact differentiation between the consumption of the named property and the flushing quantities in the same From the municipality's point of view, the cable harness was therefore not necessary. Until the installation Flushing water meter in the flushing shaft two flushings have taken place. Next were in the Writing transmits the data stored about the water meter. the Data processing is carried out by the party involved, which identifies itself as XXXX serve processors, there is also an order processing agreement. According to the log book, the system control reported on XXXX 2017 that the The water level in the tank had dropped to a minimum, whereupon initially the The main water clock and then the individual water meters had been checked. To that extent the high water consumption of the complainant's property was attributed be able. The daily recording, which the building manager in the interrogation before the BG XXXX addressed only the inlet side of the water supply system " XXXX " and thus the entire system., - 12 - The e-mail notifications to the complainant and the respective replies of the complainant would be stored in the municipal software for evidence purposes. The letter included an excerpt from the logbook and one to the complainant directed letter dated January 29, 2020, with which the answer to a The complainant's request for information and an inspection report on the water quality were transmitted, connected. 17. The comments of the interested party (and the questions of the Federal Administrative Court to the party involved, the complainant and notified to the relevant authority. II. The Federal Administrative Court considered: 1. Findings: The procedure outlined under point I is used as a basis for the findings. In particular, the following facts are established: 1. The complainant is the owner of the XXXX. 2. In 2005, work on a public sewage system was carried out by the parties involved party performed. Based on this work, a legal dispute arose between the complainant and the involved party. 3. With the judgment of XXXX dated XXXX, the complainant was given line XXXX from the title of damages (in kind restitution) the production of a drinking water supply for the need for a single-family house within eight weeks by the party involved awarded. 4. In accordance with the judgment of the XXXX, the property of the complainant on XXXX 2014 to the existing water supply system of the municipality "XXXX" connected and the complainant's property via this water supply supplied with drinking water. Up to this point, the water supply system served only to supply municipal buildings and facilities. The property of The complainant was addressed to the – originally to empty the system intended - line to the undeveloped property land register no. XXXX connected The water meter for this line has been in place since the system was set up right in the well shaft. There are also water meters in the well shaft of the " XXXX " - 13 - of the community center XXXX, for the private house XXXX as well as water meter of the "XXXX" and for the graveyard. The well shaft is closed. have access to the well shaft the building yard employees of the party involved. 5. The water pipe in question is not a public one Community water line iSd XXXX and the XXXX The water supply system is used in addition the primary purpose of supplying community facilities and buildings the fulfillment of the municipality's obligations under the law on damages by supplying two private properties (including that of the applicant). 6. Due to the connection of the complainant's property, the Existing water law permit from BH XXXX from 13.11.2007 for Zl. XXXX and XXXX with a maximum water withdrawal of 1,550 l/d or 380m³/a are complied with, which is why the BH XXXX at the request of the party involved Notice of 05/21/2015 for Zl. XXXX an increase in water use "XXXX" to 3050 3 l/d or 864 m/a approved. As part of the approval process, Official experts for groundwater hydrology stated that the existing Well would have a sufficient yield, whereby for the property the Complainant was assumed to need 900 l/day. 7. No payment is made for the use of water by the complainant's property charged. 8. On June 10, 2018, the complainant submitted the following application to the co-participant Party (reproduced verbatim without salutation and salutation): "[...] Since it has been made known to me that you are using my water consumption data without my Consent, continuously checking, saving and thus profiling, I declare that I object. According to GDPR Art 21 - right of objection, all relevant paragraphs in particular (1), Furthermore according to Art. 18 GDPR - right to restriction (1), in particular a - d. Furthermore, I request the prescribed information according to Art. 13, DSGVO - Obligation to provide information when collecting personal data from the data subject Person, all paragraphs (1) a - f, (3), (4). Art. 14 GDPR – obligation to provide information if the personal data is not with the data subject have been collected. All paragraphs (1) a-f, (2) a-g, (3) a-c, (4), (5) a-d. [...]", -14- 9. The involved party informed the complainant in a letter dated 28.06.2018 that they have data on the meter reading relating to the water meter in question process, with the meter reading once a year in January by reading the water meter is determined and stored on measurement documents. Furthermore, the informed the complainant about the purposes of the data processing. It wouldn't Data transmitted to third parties. The data would be stored for 30 years (for this purpose the purposes stated). There will be no automated individual decision-making process used and no profiling operated. Finally, the complainant informed that the involved party formulated in the letter of 10.06.2018 will not comply with the complainant's request. The writing of involved party from 06/28/2018 is the basis of the findings. 10. The complainant made in her data protection complaint of 22.12.2018 (improved with input from 01/22/2019) a violation of the right to erasure, im Right to object, right to restriction of processing and right none to be subject to automated individual decision-making and argued that the involved party consumption data regarding the water consumption of process the complainant in a non-transparent manner. The appellant therefore applied for Deletion of recorded data regarding your water consumption. 11 By decision of August 19, 2019, Zl. DSB-D123.958/0003-DSB/2019, the authority dismisses the complaint as unfounded. 12. The complainant raised an objection to this decision in a letter dated September 30, 2019 timely appeal to the Federal Administrative Court. 13. At the beginning of the water pipe line to which the property of Complainant is connected, is (since October 22, 2019 due to a calibration change) of the water meter no. XXXX . Before the calibration change, water meter No. XXXX installed. This water pipe runs after the house connection The complainant's property further to a flushing shaft, where the Water meter no. XXXX is installed. This water meter was added in 2019 installed and is used to determine the amount of water in flushing processes. The slider after the house connection of the complainant's property is only used for rinsing processes opened. By deducting the annual water consumption at meter no. XXXX from Annual water consumption of water meter No. XXXX is the determination of water consumption on the complainant's property and can the - 15 - made available to the complainant upon request. Rinsing processes that are carried out the operators of the water supply system are initiated, take place at least twice in year instead. On January 29th, 2020 there were two flushes in 2018 and six flushes a year 2019 documented in the logbook of the water supply system " XXXX ". 14. With the water meters that (also) measure the consumption of the property concern complainant and also with the newly installed water meter, the now measures the water consumption of the rinsing processes, it is/was analogue Piston meters and no "smart meters". 15. The party involved carries out automated data processing in which regarding the water connection of the complainant's property are saved. The water meters of the water supply system are read once a year basically in January. or around the turn of the year. Due to the calibration change in the year At this time in 2019, the final reading of the old water meter and the initial reading of the new water meter can be recorded. The measurement document values of the contract XXXX (XXXX + flushing line) are like those of other relevant contracts annually in the table below showing the Percentages calculated for the billing of operating costs. This table is in the Community software XXXX in E-Akt A-XXXX: 16. The data is processed to detect any damage such as burst pipes to be able to, in combination with the other water meters, the allocation of the To be able to make electricity costs on the individual customers, and to check whether the water consumption of the complainant's property within the with the judgment of XXXX to XXXX, namely for the need of a single-family house takes place. 17. The data mentioned under point 15 for processing the water meter reading for a period of 30 years to fulfill the obligation imposed by the judgment and, - 16 - to assert any liability or unjust enrichment claims kept. 18. The data mentioned under point 15 will be processed by the party involved in the Community software XXXX from the company XXXX processed. The community software XXXX is from hosted by XXXX in an Austrian data center. To login is personalized Citrix access required. There are also those mentioned under point 15 Data physically stored. With the company XXXX there is one Data Processing Agreement. The data will not be given to any other recipients disclosed to. 19. The system control reported on XXXX 2017 that the water level in the tank in Area "XXXX" had dropped to a minimum. Then checked The municipal building yard employees all the water meters of the system and realized that about the water meter on the complainant's property and the flushing pipe affected, an unusually large amount of water ran. The building yard employees could on the property of the complainant, whereupon they House connection valve due to the suspicion of a burst pipe in the house closed the property and the complainant was informed. In further As a result, the complainant informed that she (although absent) for flushing purposes let the water run and presumably there was no ruptured water pipe. Of the The house connection valve was then opened again. The complainant was requested by the party involved in a letter dated November 2nd, 2017, such exorbitant Refrain from withdrawing water, as this will disrupt all other withdrawals of water would be impaired and this in accordance with a careful handling of drinking water contrary to the Water Rights Act. 20. The continued extremely high water withdrawals on the property of Complainant caused the involved party to fear that compliance with the approved total consumption of 3,050 liters per day compared to BH XXXX to be able to guarantee. As early as September 2019, the upstream Main water meter that in 2019 also with the approved total annual consumption 3 of 864 m threatened to be exceeded. The complainant was therefore Letter dated 09/13/2019 from the involved party announced that they are to comply the consensus amount determined by decision of the district authority was forced to stop withdrawal if 900 liters per day were exceeded to foresee. Should this maximum daily, - 17 - withdrawal quantity be required, the complainant has the co-involved party in the To be informed in advance, whereupon the party involved will try to obtain an increased To coordinate water requirements with the other water recipients, so that the specified consensus quantity is not exceeded. 21. For the purpose of determining if the maximum water level has been exceeded of the complainant's property was added to water meter no. XXXX on October 22, 2019 an impulse generator put on. A solenoid valve was installed after the water meter. the Pulses from the pulse generator are transmitted via a digital input on the PLC (programmable logic controller) of the water supply system "XXXX" recorded and accumulated (counter). If the daily maximum amount of water was exceeded, the Shutdown (the closing of the solenoid valve) initially automatically by the controller, since March 2020 the following procedure has been in place: By exceeding the set limit value of 950 liters, an alarm is set off (the person on duty calls building yard employee through the alarm dialer). It is then done by the depot employees on duty and in close temporal relation then the relevant notification by e-mail to the complainant. The counter will resets daily at 00:00 and starts counting from 0 liters again. The impulses are only used directly in the software of the control of the water supply system " XXXX " processed. There is no storage or visualization of daily values. During of a rinsing process, the pulse count is switched to inactive. 22. There has now been an increase in the number of shutdowns due to the Exceeding the daily water consumption of 950 liters on the property complainant came. 23. In 2019, the limits set by the BH XXXX with a decision dated 05/21/2015 approved water withdrawal quantity of 864,000 l/a (for the entire system), because on the complainant's property alone around 725,000 liters instead of for their property consumes an assumed 328,5000 l/a (needs for a single-family house). became. 24. The e-mail communications to the complainant and their related Responses are stored in the community software XXXX in the E-Akt XXXX in order to to be able to prove that the complainant was duly informed in each case became. Furthermore, the shutdowns are displayed according to months and days and the sum of the shutdowns are processed in a table, which is also located in the file mentioned. The, - 18 - Storage is necessary to fulfill the obligation imposed by the judgment and to Assertion of any liability or unjust enrichment claims for the duration intended for 30 years. The building yard employee on duty notes both the fact that on a specific date from the applicant's property the water consumption of 950 l was exceeded and at what time this took place as well as, that and at what time an e-mail was sent, in the logbook of the Water treatment plant " XXXX ". Any use other than those mentioned purposes is not made. 25. The yard manager carries out daily awards, which, however, are the inflow side of the affect the entire water system. These are transferred to the logbook logs and supplemented by operational measured values. This record serves as proof of Adhering to the water rights consensus with the water rights authority. 2. Evidence assessment: The facts result from the submitted administrative act and the present one Court act, in particular also from the statements of the involved party from 02/15/2019, 11/12/2021, 12/06/2021 and from 01/03/2022 together with the contained therein Screenshots, but also partly from those submitted by the complainant documents. That it is - what the complainant during the proceedings at the authority concerned and also in the proceedings before the Federal Administrative Court was repeatedly denied - in the case of the water supply system by none public water supply, results from the knowledge of the Administrative Court of April 20, 2021, Ro 2021/07/0001-5. That the water pipe line, at the beginning of which water meter No. XXXX is located, only measures the amount of water flowing from the complainant's property is consumed, as well as the flushing processes that take place on a case-by-case basis, which are carried out by the operator of the water supply system are initiated, results from the above Comments of the involved party. This is plausible if only because a Distribution of the electricity costs among the (other) connected customers is not possible would be, their consumption would not be measured by other water meters. For that yet other properties (except those to which the flushing line leads) on the water line and water meter, which affects the complainant's property, are connected there are no clues., - 19 - That the maximum daily water consumption is exceeded through the use of water on the complainant's property, was Appellant not disputed. That this overrun is not due Flushing operations of the operator of the water supply system was caused, results for one from the fact that the complainant herself on the occasion of the incident on XXXX 2017 admitted to having left the water running despite being absent. Also flushing processes are always documented by the operator of the system in the operating log. Furthermore, the list provided by the party involved shows the Exceeding the daily maximum water supply volume, which has been in force since autumn 2019 is that the daily maximum amount of water is repeatedly exceeded occur that can be clearly assigned to the complainant's property. The fact that the party involved already informed the complainant in a letter dated September 13, 2019 announced, in the future, a water withdrawal that exceeds the daily withdrawal amount of 900 liters and to inform the complainant immediately by e- To inform you by mail results from the letter of 05.11.2021 submitted by the Attorney of the involved party from September 13th, 2019. So that was the planned one Procedure from receipt of the letter of 09/13/2019 and thus before the first Shutdown known to the complainant. 3. Legal assessment: 3.1. According to Art. 130 Para. 1 Z 1 B-VG, the administrative courts decide on complaints against the decision of an administrative authority due to unlawfulness. According to § 6 BVwGG, the Federal Administrative Court decides through a single judge, provided that Federal or state laws do not provide for the decision to be made by senates. According to Section 27 of the Data Protection Act (DSG) as amended is decided by the Federal Administrative Court in proceedings about complaints against decisions due to violation of the duty to inform according to § 24 para. 7 and the decision-making obligation of the data protection authority by the Senate. The Senate consists of a chairman and a competent lay judge from among the employers and from among the employees. The procedure of the administrative courts with the exception of the Federal Finance Court is through the VwGVG, Federal Law Gazette I 2013/33 as amended by Federal Law Gazette I 2013/122 (§ 1 leg.cit.). According to § 58 paragraph 2 VwGVG remain conflicting provisions at the time of entry into force of this federal law have already been made public., - 20 - According to § 17 VwGVG, unless otherwise specified in this federal law, Procedure for complaints according to Art. 130 Para. 1 B-VG with the provisions of the AVG Exception to §§ 1 to 5 as well as part IV and others specified in more detail (in in this case not relevant) laws and otherwise those procedural law Provisions in federal or state laws to apply mutatis mutandis, which the authority in applied to the procedure preceding the procedure before the administrative court has or should have applied. According to § 28 para. 1 VwGVG, the administrative court has the legal matter by cognizance deal with, provided that the complaint is not to be dismissed or the proceedings are to be discontinued. According to § 28 para. 2 VwGVG, the administrative court has jurisdiction over complaints according to Art. 130 Para. 1 Z 1 B-VG to decide on the matter itself if the relevant facts is established or the determination of the relevant facts by the administrative court even in the interest of speed or with a significant cost saving connected is. 3.2. Regarding the process requirements: The complaint was made in accordance with § 7 para. 4 VwGVG and there are also the other process requirements. 3.3. Regarding part A): 3.3.1. Legal situation: The relevant authority has its decision - as far as relevant to the proceedings - based on the following legal bases: Art. 12 (2), (3) and (4), Art. 17, Art. 18 (1) lit. a, lit. b and lit. d, Art. 21 (1), Article 22(3), Article 57(1)(f) and Article 77(1) of Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR), OJ No. L 119 of 4.5.2016, p. 1; § 24 paragraph 1 and Paragraph 5 of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999 as amended. These provisions are also in the present complaint proceedings before the Federal Administrative Court In addition, Art. 4 Z 1 and Art. 6 Para. 1 lit. c and f GDPR are relevant. Art. 4 Z 1 GDPR reads: "Article 4 definitions For the purposes of this Regulation, the term means:, - 21 - 1."Personal Data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); as identifiable is a natural person who directly or indirectly, in particular by association with an identifier such as a name, an identification number location data, an online identifier or one or more specific characteristics expressing the physical, physiological, genetic, psychological, economic, cultural or social identity of this natural person, can be identified;" Art. 6 para. 1 lit c. and f DSGVO are: "Article 6 lawfulness of processing (1) The processing is only lawful if at least one of the following conditions are met: c) the processing is necessary for compliance with a legal obligation imposed by the Controller is subject to; f) the processing is to protect the legitimate interests of the person responsible or of a third party required, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail, especially when the data subject is a child Point (f) of the first subparagraph shall not apply to public authorities in the performance of their duties processing carried out.” Art. 12 para. 2, para. 3 and para. 4 GDPR read: "Article 12 Transparent information, communication and modalities for exercising rights the person concerned (2) The person responsible facilitates the exercise of the data subject's rights in accordance with Articles 15 to 22. In the cases referred to in Article 11 paragraph 2, the Controllers only refuse based on the request of the data subject exercise their rights under Articles 15 to 22 to take action if credible makes it impossible to identify the data subject. (3) The person responsible shall provide the data subject with information on the request measures taken in accordance with Articles 15 to 22 without undue delay, but in any event available within one month of receipt of the application. This deadline can Another two months can be extended if this takes into account the complexity and the number of applications required. The person responsible informs the data subject Person within one month of receipt of the request for an extension of time, along with the reasons for the delay. The data subject submits the request electronically, it is to be informed electronically if possible, provided that it states nothing else. (4) If the person responsible does not act upon the request of the data subject, he shall inform the person concerned without delay, but at the latest within one month after receipt of the application about the reasons for this and about the possibility of to lodge a complaint with the supervisory authority or to lodge a judicial remedy.” Art. 17 GDPR reads: "Article 17 Right to Erasure (“Right to be Forgotten”) (1) The data subject has the right to demand that the person responsible relevant personal data will be deleted immediately, and the The person responsible is obliged to delete personal data immediately if one of the following reasons applies: a) The personal data are necessary for the purposes for which they were collected or otherwise way were processed, no longer necessary. b) The data subject withdraws their consent on which the processing is based Article 6(1)(a) or Article 9(2)(a) and lack of another legal basis for the processing. c) The data subject objects to the processing pursuant to Article 21(1). and there are no overriding legitimate grounds for the processing, or the the data subject objects to the processing pursuant to Article 21(2). d) The personal data have been processed unlawfully. e) The deletion of the personal data is necessary to fulfill a legal obligation Obligation required by Union law or the law of the Member States, the the person responsible is subject. f) The personal data was collected in relation to the services offered by Information Society collected in accordance with Article 8(1). (2) Has the person responsible made the personal data public and is he obliged to delete them in accordance with paragraph 1, he shall take into account the available technology and the implementation costs appropriate measures, too of a technical nature, to those responsible for data processing who process the personal process data, to inform that a data subject of them Delete all links to this personal data or any copies or replications requested this personal data. (3) Paragraphs 1 and 2 do not apply if processing is necessary a) to exercise the right to freedom of expression and information; b) to fulfill a legal obligation that requires processing under the law of Union or the Member States to which the person responsible is subject, or for Performance of a task that is in the public interest or in exercise public authority delegated to the controller; c) for reasons of public interest in the field of public health pursuant Article 9 paragraph 2 letters h and i and Article 9 paragraph 3; d) for archival purposes in the public interest, scientific or historical research purposes or for statistical purposes in accordance with Article 89 paragraph 1, to the extent that - 23 - Paragraph 1 of the law is likely to achieve the objectives of this processing renders impossible or seriously impairs, or e) to assert, exercise or defend legal claims.” Art. 18 para. 1 reads: "Article 18 Right to restriction of processing (1) The data subject has the right to have the person responsible restrict the to request processing if one of the following conditions is met: a) the accuracy of the personal data is contested by the data subject, for a period that enables the person responsible to verify the accuracy of the to check personal data, b) the processing is unlawful and the data subject requests the erasure of the personal data and instead restricts the use of the personal data requested; c) the person responsible does not use the personal data for the purposes of processing longer, but the data subject needs them to assert, exercise or Defense of legal claims needed, or d) the data subject objects to the processing pursuant to Article 21(1). filed, as long as it is not certain whether the legitimate reasons of the those responsible outweigh those of the data subject.” Art. 21 Para. 1 GDPR reads "Article 21 Right to object (1) The data subject has the right, for reasons arising from their particular situation arise at any time against the processing of personal data concerning them based on Article 6 paragraph 1 letters e or f to file an objection; this applies also for profiling based on these provisions. The controller processes the personal data no longer, unless he can compelling protection-worthy demonstrate grounds for processing that outweigh the interests, rights and freedoms of the affected person outweigh, or the processing serves to assert, exercise or defense of legal claims.” Art. 22 para. 1 to 3 GDPR read: "Article 22 Automated decisions on a case-by-case basis, including profiling (1) The data subject has the right not to be contacted solely on an automated basis to be subject to a decision based on processing, including profiling, which has a legal effect on it or which affects it in a similar way impaired. (2) Paragraph 1 does not apply if the decision - 24 - a) for the conclusion or performance of a contract between the data subject and is necessary for the person responsible b) on the basis of Union or Member State legislation to which the Controller is subject to, is permissible and appropriate to this legislation Measures to protect the rights and freedoms and legitimate interests of data subject contain or c) with the express consent of the data subject. (3) In the cases referred to in paragraph 2 letters a and c, the person responsible appropriate measures to protect the rights and freedoms and legitimate interests of the data subject, including at least the right to obtain intervention of a person on the part of the person responsible, on the presentation of his own point of view and on challenge the decision.” Article 57 (1) (f) GDPR reads: "Article 57 tasks (1) Without prejudice to other duties set out in this Regulation, each supervisory authority in their territory f) dealing with complaints from a data subject or complaints from a body, a organization or association referred to in Article 80, the subject of Investigate the complaint to a reasonable extent and the complainant within a reasonable period of time about the progress and the result of the investigation inform, particularly when further investigation or coordination with a other supervisory authority is necessary;" Art. 77 para. 1 GDPR reads: "Article 77 Right to lodge a complaint with a supervisory authority (1) Without prejudice to any other administrative or judicial remedy, the right to lodge a complaint with a supervisory authority, in particular in the Member State of their place of residence, their place of work or location of the alleged infringement if the data subject believes that the Processing of the personal data concerning you contrary to this regulation violates. (2) The supervisory authority to which the complaint was lodged shall inform the Complainant about the status and outcome of the complaint including the Possibility of a judicial remedy under Article 78.” § 24 paragraphs 1 and 5 DSG read: - 25 - "Article 24. (1) Every data subject has the right to lodge a complaint with the data protection authority, if she believes that the processing of personal data concerning her Data violates the GDPR or § 1 or Article 2 1st main part. (5) If a complaint proves to be justified, it must be followed. Is a Injury to be attributed to a person responsible for the private sector, so is this to comply with the complainant's requests for information, correction, deletion, Restriction or data transfer to the extent necessary to comply to remedy the identified infringement. As far as the complaint as not proves to be justified, it is to be rejected.” 3.3.2. Applied to the present case, this means the following: First of all, it should be noted that the complainant raised a number of legal issues has, which is not to be dealt with in the context of this procedure. in the representational Complaints are exclusively related to questions relevant to data protection law to refer to. Claims regarding the allegedly polluted drinking water or that the water made available to the complainant was neither qualitative nor quantitatively correspond to the judgment of the XXXX, the alleged disadvantage of the The applicant because of her Jewish roots, the alleged lack of one Water law permit for the water pipeline and the claimed Obligation of the party involved to meet the requirements (frost-free basement room). installing a water meter on the complainant's property or to install a water meter on the complainant's property not subject to the complaints procedure. Any civil claims can if necessary, be asserted in civil courts. The subject of the proceedings is the question of whether by those mentioned in the findings data processing is a violation of the complainant's rights as a data subject, namely the right to erasure, the right to object, the right to restriction the processing and the right, not subject to any automated individual decision to be, by the involved party. To qualify water consumption data as personal data in accordance with Art. 4 Z 1 GDPR: The authority concerned stated in the contested decision that the definition of "Personal data" according to Art. 2 lit. a of Directive 95/46/EC, mutatis mutandis in Art. 4 Z 1 GDPR has been adopted. information "about" a specific person inter alia, if data relate to the situation of a person (cf. the Opinion of the Art. 29 Data Protection Group 4/2007 on the term "personal, - 26 - Data”, WP 136, 01248/07/DE, p. 10). On the water pipe line, which the measures the complainant's water consumption and consumption for rinsing purposes, there are no further connections or consumers. As the party involved in stated in her statement of November 12, 2021, it is possible with the water meters to determine the consumption of the complainant's property. the The authority concerned further explained that water consumption data, which, like in the present case, to a specific property and thus to a specific one living situation, to handle personal data in accordance with Art. 4 Z 1 GDPR. It namely insofar as (also) information would be available "about" the complainant, as based on the water consumption data, for example, the size of your household or any and absences can be closed. The explanations of the authority concerned are to be followed that in (smaller) private Households a recording of the water consumption conclusions about specific people and enables their individual habits (cf. also decisions of Data protection commission from 14.11.2008 to Zl. K121.388/0008-DSK/2008, as well as from 22.10.2008 to Zl. K121.386/0009-DSK/2008, as well as legal aspects of digitization in of urban water management, Karl Weber, May 9, 2019, p. 369). It is at Water consumption data is therefore personal data within the meaning of Art. 4 Z. 1 DSGVO. Violation of certain data subject rights: The complainant alleged a violation of the right to erasure, the right to Objection, restriction of processing and in law, none to be subjected to automated data processing. For the sake of completeness, it is noted that the right to secrecy according to § 1 DSG is not the subject of the proceedings, although this is - apparently - by the authority concerned erroneously - is noted in the course of the contested decision. At long last However, the authority concerned only spoke about a possible violation of the above rights off. It is therefore to be examined below (only) whether a violation of the The rights of the data subject mentioned by the complainant are given: Regarding the right to erasure (Art. 17 GDPR): The authority concerned explained in its legal assessment that the exercise of the Right to erasure as a subjective right of the data subject pursuant to Art. 12 Para. 3 GDPR one, - 27 - corresponding application to the person responsible presupposes that such an application is from the complainant was neither expressly nor implied. misjudged the authority that the right to erasure also includes the duty of the person responsible, to check at regular intervals, even without a request from a data subject, whether 2 processed data are to be deleted (cf. Jahnel/Pallwein-Prettner/Marzi, data protection law 113). This results from the wording of Art. 17 Para. 1 GDPR: "[...] the The person responsible is obliged to delete personal data immediately if one of the following reasons applies” (cf. Data Protection Law (Spring) 2nd edition, September 2020). The statements of the authority concerned that the complainant had none Request for deletion made to the involved party as the responsible party and in the absence of The request is not a claim to the handling of the request for deletion by the party involved arisen, therefore cannot be followed. Rather, it must (also) be checked whether the involved party itself the personal data of the complainant would have to delete. In total, Art. 17 Para. 1 GDPR provides six reasons, after which a Deletion is to be made, among other things, if there is no longer a need for Achievement of purpose or unlawful processing. In order to be able to assess whether one of these facts is fulfilled and the involved party the personal would have to delete the complainant's data, it must first be clarified from which Reason the involved party the personal data of the complainant collected, stored and processed. The authority concerned led in the contested Notice that the party involved is responsible for the processing of the data based on legitimate interests according to Art. 6 Para. 1 lit. f GDPR. The involved The party has given compelling reasons for the processing that are worthy of protection, namely the measure annual water consumption and identify damage and to detect broken pipes. In particular, there is also a need to be able to check that the total water withdrawal of the "XXXX" 3050 l/day is not exceeds and that the water withdrawal on the complainant's property within the specified limits, namely for the needs of a single-family home. The water consumption data would only be used for the aforementioned purposes and not used elsewhere, so that no disproportionate processing or Violation of Art. 5 Para. 1 lit. b GDPR is recognizable. The party involved is also concede that in view of the limited presence of sufficient amount of drinking water has a certain bandwidth when dividing the maximum amount of water will be monitored for the different buyers in order to avoid that an individual, - 28 - user the total stipulated amount of water (or a disproportionately large proportion) consumed at the expense of the other customers. These explanations of the authority concerned are to be followed: This is how the connection of the Property of the complainant based on the judgment of the XXXX of XXXX on line XXXX to produce a drinking water supply for the needs of a single-family home create. In order to be able to ensure that the withdrawal of water within the framework of the with judgement granted extent takes place, it is inevitable that a certain control or to check the water intake. Also the other reasons mentioned for the processing, namely to be able to measure the annual water consumption in order to to be able to identify damage and burst pipes as quickly as possible and for distribution of the electricity costs incurred in connection with the water supply individual customers are to protect the legitimate interests of the person responsible, as well as third parties (the other buyers of the water supply system " XXXX ") in any case to be subsumed under Art. 6 Para. 1 lit. f GDPR. At this point it should be noted that it the subject water meter is an electronic water meter, with which only the water consumption can be recorded. For the reasons mentioned cannot be assumed that the complainant's interests in a Deletion of the water consumption data assigned to the named interests of involved party prevail. With the subject water meter can, with Except for the water consumption of their property, no further data from the Complainant be recorded. There are also no indications that the collected data was used for another purpose. In this context, the principle of data minimization must also be observed will. According to Art. 5 Para. 1 lit. c GDPR, the processed personal Data adequate and relevant to the purpose and to what is necessary for the purposes of the processing be limited to what is necessary ("data minimization"). According to this principle Personal data will only be processed if the purpose of the processing is not in can reasonably be achieved by other means. It follows that on personal data may only be accessed if no alternative method is available in order to achieve the intended purpose of the processing reach. The processing of personal data is appropriate for the purpose if whose purposes are not achieved by using anonymous or anonymized data can become. From the requirement that the personal data processed must also be significant for these purposes, it follows that no data is collected which are not or no longer suitable for achieving the with the processing, - 29 - to contribute to the objectives pursued. The principle of data minimization does not prohibit only the collection of data that may or may not be related to the purpose of processing suitable to contribute to the achievement of the purpose, but also the collection personal data not necessary for the purposes specified at that time are required (cf. Heberlein in Ehmann/Selmayr, DSGVO Art. 5 Rz 22). Since none Possibility exists to get data on water consumption without the help of a water meter collect and this data is necessary and suitable (necessary) to the annual Measure water consumption in order to prevent damage and pipe bursts as quickly as possible recognize in order to be able to check that the total water withdrawal of the " XXXX " 3050 l/day, as well as to be able to check that the water withdrawal on the property of the complainant within the specified limits, namely for the needs of a single-family home, there is no violation of the principle of data minimization. As for the incident on XXXX 2017, the Water consumption of the complainant's property not monitored recognized, but it was first determined that the water level in the Water supply system " XXXX " had fallen to a minimum. Only in further As a result, the other water meters were checked. The processing of the data is limited thus relying on the security of the water supply for a further There are no indications of use. It is also necessary to follow the explanations of the authority concerned that the processing of the personal data of the complainant by the involved party Fulfillment of their sovereign tasks within the meaning of Art. 6 Para. 1 second sentence GDPR. That it the water supply system in question is not a “public Water line” is also the finding of the Administrative Court of April 20, 2021, Ro 2021/07/0001-5. The legitimate interests of In any case, the party involved has no legitimate interests Complainant against, which outweigh them. As far as the complainant in the proceedings before the Federal Administrative Court submitted that their data will be used for their "surveillance" and to the (new) Data processing refers to stopping the water supply after reaching the daily maximum consumption quantity, it should first be noted that this The type of data processing is not part of the proceedings before the Data Protection Authority was., - 30 - Even if this processing were included in the legal considerations, it would remain so The result is the same: With this processing, the collection and Summation of impulses of water consumption measured but not recorded. The impulses are only directly in the software of the control of the water supply system "XXXX" processed. Only if the limit value is exceeded does the on-call building yard employee an alarm on his work cell phone. This then initiates the shutdown and notifies the complainant by e-mail. It there is no storage or visualization of daily values. This takes place Data processing also only for the purpose of compliance with the judgment of XXXX to XXXX specified limits, namely a water consumption for a single family house and to ensure that the involved party fulfills its obligation to comply with the comply with the maximum annual water consumption set by the BH XXXX can. The design of the data processing also corresponds to the principle of Data minimization, as only the data necessary to achieve the purpose is processed will. Thus, in the given case, there are legitimate interests of the party involved of the processing, which do not have overriding interests of the complainant oppose Incidentally, it should be noted that the involved party also offered has to find a solution for a foreseeable exceedance in individual cases, so here overall, no disproportionate procedure can be assumed. Therefore, there are none of the requirements specified in Article 17 (1) GDPR for a deletion before. In particular, it is also due to the overriding interests of those involved 17 (1) (c) GDPR does not apply to the party. Regarding the right to object (Art. 21 GDPR): First of all, it should be noted that according to Art. 21 Para. 1 GDPR the data subject has the right has, for reasons that arise from their particular situation, at any time against the to object to the processing of personal data concerning you based on Article 6 paragraph 1 letters e or f. In this respect, the insertion would be an objection is possible in principle. With regard to the right to object, the authority concerned stated that a data subject had the wording of Art. 21 Para. 1 GDPR the reasons arising from your particular situation arise in the context of exercising the right of objection. This emerges from a comparison with Art. 21 Para. 2 DSGVO, according to which an objection to the processing of personal data is possible without such justification. These reasons are - 31 - has not been explained to the party involved, which is why no claim to treatment of the objection arose. The statements of the authority concerned to follow: The complainant does not have a special situation in the entire procedure be able to explain the reasons that would result in the processing of your personal data would have to be avoided. When weighing the interests, reference is made to the above statements on the right refer to deletion. For the reasons set out above, it can be assumed that the legitimate reasons of the party involved compared to those of the complainant prevail, which is why no justified objection was filed and an infringement the complainant does not have the right to object. As to the complainant's allegation that this would be profiling, The following should be noted: In the application of June 10, 2018, the complainant stated "[...] it has been made known that you have used my water consumption data without my consent continuously check, save and thus carry out profiling, I declare that I file an objection". Also in her statement (submitted in the court proceedings) of April 7th, 2020 brought the complainant a (further) prohibited profiling by the co-involved party before. First of all, it should be noted here that this new processing is not the subject of the Procedure before the relevant authority was and could be. Even if one were to concede to the complainant that she - by Surveillance of her person or her household asserted - reasons that arise from resulting from their particular situation, against profiling (in some cases even before the authorities concerned, but only with regard to the measurement data of the water meters). it appears that the said processing does not fall within the definition of profiling correspond: Art. 4 Z 1 GDPR reads: "For the purposes of this Regulation, the term means: 4. "Profiling" any type of automated processing of personal data contained therein exists that this personal data will be used to establish certain personal Evaluate aspects relating to a natural person, in particular aspects, - 32 - regarding work performance, economic situation, health, personal preferences, Interests, reliability, behavior, whereabouts or relocation of these natural analyze or predict person;" As far as the objection relates to the (general) processing of the water meter ascertained data relates, the following should be noted: In the case of the subject Water meters are analog rotary piston meters. Only the Water consumption of the connected property (in the case of the complainant also nor the mud line) and no additional data that would require an analysis of the Complainant or a creation of a "profile" would allow. Consequently can under no circumstances should it be assumed that profiling is being carried out. Is it about Profiling, as set out in more detail above, namely the collection of certain personal data to evaluate personal aspects of a natural. Alone through the measured water consumption is an analysis regarding personal aspects a natural person within the meaning of this provision is not possible. Also what the automated determination of a possible exceeding of the daily water consumption (which was not part of the proceedings before the authority concerned), it is not a matter of processing that was carried out is "to control certain personal aspects relating to a natural person evaluate", but this procedure serves exclusively to comply with the specifications of the water law decision, which the party involved has to comply with, so that Even in this case, the facts of a profiling are not fulfilled. Thus, the complainant's right to object was not violated either., - 33 - Regarding the right to restriction (Article 18 GDPR): As explained in the literature, the right to restriction must be applied for i.e. asserted by the data subject against the person responsible (Jahnel, Commentary on the General Data Protection Regulation Art. 18 GDPR, as of December 1, 2020, rdb.at). Although one could take the view that a restriction of Responsible in the presence of one of the above conditions on their own would have to be made, this consideration can be made in the present case remain undecided, since the complainant has already submitted a request for restriction of the processing to the party involved. In accordance with Article 18 (1) (a) GDPR, a data subject has the right to request a restriction to request processing if the accuracy of the personal data data subject is disputed, for a period of time that allows the person responsible allows to check the accuracy of the personal data. The authority concerned stated in the contested decision that with regard to lit. a leg. cit. it should be noted that the accuracy of the water consumption data in question has never been had been disputed. However, in the course of the proceedings (in her data protection complaint and in its statement of January 28, 2019 and October 2, 2019), that the water pipeline in question supplies several connections and the Water data could therefore say nothing about their consumption, and that the measured data at the only meter in the well shaft of the involved party are objectifiable or cannot be assigned in a consumption-neutral manner. Dem is however, to counter that the involved party has not claimed that it is the processed water meter data, which is read annually, is data which are attributed to the complainant's property alone, since - like the involved party is known - also the flushing line to this water meter connected. There is no right to restriction of processing according to Art. 18 Para. 1 lit. a GDPR, if the person responsible comes to the conclusion that the personal data contrary to the claim of the person concerned are correct (cf. EU-DSGVO: Short commentary, Feiler Forgó on Article 18 EU-GDPR, 1st edition September 2016, margin no. 3). So the party involved had no reason for the accuracy of the water meter to doubt the measured data, the complainant could not explain it either that the measured consumption data are incorrect. As stated by the - 34 - party has been credibly informed, only the consumption of the water meter is used Property of the complainant and that of the flushing line measured. The consumption of the complainant's property can be determined, however, since the water consumption at rinsing processes is entered in the logbook or in the meantime by its own meter is recorded, and this consumption is to be deducted from the common meter reading. Of the each current consumption of the property is only measured when there is a Exceeding the amount of water comes, in which case the flushing line is switched to inactive. A right to restriction also exists according to Art. 18 Para. 2 GDPR not if the data processing is to protect the rights of another natural or legal person is necessary. The question of whether the rights of the person responsible are protected, the literature on the similar formulations in Art. 15 para. 4 (s Art. 15 margin no. 49), Art. 20 para. 4 (see Art. 20 margin no. 28), Art. 21 para. 1 (see Art. 21 margin no. 42) and Art. 23 para. 1 lit i (s Art 23 Rz 21) affirmed (Haidinger in Knyrim, DatKomm Art. 18 GDPR, as of October 1, 2018, rdb.at). The involved party has explained the reasons for the processing of the data, im The result was no violation of the right to restriction. With regard to Art. 18 Para. 1 lit. b GDPR, the statements of the relevant authority in to follow the contested decision that the complainant's deletion is obvious has not refused, so that the requirements of this provision are not met are. As for the facts of Art. 18 para lit. d GDPR, there was no doubt from the outset that the legitimate reasons of the controller outweigh those of the data subject (see also the considerations on the right to erasure) and this requirement was not either given, which is why there was no violation of the complainant's right to restriction existed and exists. The fact that the facts of Article 18 (c) GDPR were fulfilled was confirmed by the complainant does not claim and there are no indications for this. Thus, the prerequisites for a restriction of data processing were and are not given., - 35 - The right not to be subject to an automated decision in individual cases (Art. 22 GDPR): Art. 22 para. 1 GDPR formulates a right of the data subject, but without one to mention the application. For those responsible, this indirectly means a ban for automated decisions in individual cases (Schulz in Gola, DS-GVO2 Art. 22 Rz 5; Helfrich in Sydow, European General Data Protection Regulation2 Art. 22 Rz40 (due to the "systematic position"); Martini in Paal/Pauly, GDPR/BDSG2 Art. 22 Rz 1, 29). It therefore seems inaccurate that - as the relevant authority explains - the exercise of this right and the associated right in Art. 22 Para. 3 GDPR to the presentation of the own point of view and to contest the decision as a subjective right of the person concerned according to Art. 12 Para. 3 GDPR - a corresponding application to the person responsible requires. Rather, the person responsible has - similar to the right to deletion - from own provision to ensure that this provision is taken into account. The authority concerned sees the processing of water consumption data for measurement of the annual water consumption, as well as to identify damage/pipe bursts and unusually high water consumption by individual consumers to be able to counteract this, rightly no automated processing. She supports her Considerations on the fact (relevant at the time of the decision) that the the present water meter only measures the water consumption, but beyond that no automated processing takes place. For this reason alone, the facts of Art 22 GDPR not fulfilled. Incidentally, the not yet relevant in the proceedings before the relevant authority and facts that only occurred afterwards and are therefore not the subject of the proceedings regarding the period from the installation of the pulse generator and the solenoid valve on October 22nd, 2019: In Art. 22 Para. 1 GDPR, a fundamental prohibition is based solely on one automated processing based decision. Recital 71 of GDPR states that the data subject should have the right, no one subject to a decision to assess personal aspects affecting them are based solely on automated processing and the legal have an effect on the person concerned or they are similarly significant impaired. Art. 22 GDPR is therefore only aimed at those decisions that are made without any human intervention and shall, based on this provision, - 36 - Dangers posed by unchecked automated processing operations for the protection of personality expire, be limited (see Martini in Paal/Pauly, DS- GVO/BDSG², Art 22 DS-GVO margin nos. 2 and 20). The complainant was informed by the involved party in a letter dated September 13, 2019 informed about what happens in the future when the maximum daily water consumption is reached action will be taken. In this respect, the decision was already made by the party involved taken at this time and is not every time the water consumption amount is exceeded, by a new "automated decision in individual cases" to go out This is also because, in the event of an incident, none from the party involved Decisions are made, but the construction workers according to the original decision of the involved party and corresponding instructions Action. For this reason alone, data processing can be used to determine whether The complainant's property was taken from the daily maximum amount of water, not to speak of "automated decisions in individual cases". Furthermore This procedure can also be waived if the complainant Explains in advance that increased water consumption is necessary in individual cases. the Procedure does not constitute a decision that the complainant made in a similar manner, how a decision that produces legal effects is significantly affected. It should also be noted in this context that the processing in question (automatic collection of the data, whereupon when a certain water quantity, an alarm is automatically set off and then the water supply is interrupted) the controller has been programmed since March 2020 in such a way that no the solenoid valve closes automatically when the limit value is exceeded. the Information about reaching the maximum amount of water becomes automatic in the first step transmitted to the building yard employee on duty, who then takes the switch off manually. By involving a building yard employee after triggering the alarm, which can switch off and check the water supply, whether the triggering of the alarm is due to the high water consumption or was incorrect, it is in any case not a question of a decision made without any human intervention takes place. Therefore, without the intervention of a natural person, In the present case, the water supply cannot be shut off. The fact that the processing in question is not profiling has been confirmed already set out above (in the considerations on the right to object). It is therefore also no violation of Art. 22 GDPR., - 37 - 3.4. Pursuant to § 24 para. 1 VwGVG, the administrative court shall, upon application or if it is required to do so for deems it necessary to hold a public oral hearing ex officio. According to § 24 para. 4 VwGVG - unless otherwise stipulated by federal or state law is determined - the administrative court regardless of a party application from a Refrain from hearing if the files show that the oral discussion is a no further clarification of the legal matter can be expected and no hearing neither Art. 6 Para. 1 ECHR nor Art. 47 GRC conflict. In the present case, the omission of an oral hearing could result be supported that the facts were clarified from the file situation. The attraction further evidence was not necessary to clarify the facts. In the present case, the Federal Administrative Court only has jurisdiction over a legal question recognize (cf. ECtHR 20.6.2013, Appl. No. 24510/06, Abdulgadirov/AZE, margin no. 34 ff). Also after the jurisprudence of the Constitutional Court may hold an oral hearing omitted if the facts are undisputed and the legal issue is not addressed by anyone particular complexity (VfSlg. 17.597/2005; VfSlg. 17.855/2006; most recently VfGH June 18, 2012, B 155/12). It was therefore not necessary to conduct an oral hearing. 3.5. Re B) Inadmissibility of the revision: According to § 25a Abs. 1 VwGG, the administrative court in the ruling of its knowledge or Pronounce a resolution as to whether the revision is permissible in accordance with Art. 133 Para. 4 B-VG. Of the Statement must be briefly justified. The present decision does not depend on the resolution of a legal question is of fundamental importance. Neither is there a lack of case law Administrative Court, the decision in question deviates from the Jurisdiction of the Administrative Court; further is the present Jurisdiction of the Administrative Court should also not be judged as inconsistent. It there are also no other indications of a fundamental importance of the to be solved legal questions. The Federal Administrative Court can appeal to all significant Legal questions based on existing case law or an already clear legal situation. Based on this, a legal question within the meaning of Art. 133 Para. 4 B-VG of of fundamental importance cannot be affirmed in this respect either (cf. e.g. VwGH 25.09.2015, - 38 - Ra 2015/16/0085, with further references). It was therefore to be stated that the revision pursuant to Art. 133 Para. 4 B-VG is not permitted in each case. 3.5. It was therefore to be decided accordingly.