BVwG - W252 2236355-1

BVwG - W252 2236355-1
Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 10 ECFR Article 11 ECFR § 1(1) DSG
Decided:	20.10.2021
Published:	28.10.2021
Parties:	(School)Teacher Smartphone App Operator
National Case Number/Name:	W252 2236355-1
European Case Law Identifier:	ECLI:AT:BVWG:2021:W252.2236355.1.00
Appeal from:	Datenschutzbehörde (DSB)
Appeal to:	Not appealed
Original Language(s):	German
Original Source:	RIS (in German)
Initial Contributor:	Jannik

The Federal Administrative Court of Austria decided that the publication of teacher’s professional data within an application for the evaluation of schools is legitimate.

English Summary

Facts

The complainant, a teacher working in the profession for 20 years, appeared in a smartphone-app on which both schools and teachers are evaluated by students. The app lists the personal information of the teachers, including their name, academic degree, office title, profession and the associated school. The teacher filed a complaint with the Austrian supervisory authority, alleging a violation of their right to confidentiality and requesting a pseudonymization of the name.

The operator of the app stated that evaluations only refer to the professional and not the private activities of the complainant. In this regard, the processing activities had been approved for legality and admissibility by the supervisory authority in an official procedure. Moreover, the personal data of the complainant was publicly available on the school’s website anyways.

The supervisory authority dismissed the complaint, arguing that the interests of the general public and students were to be valued higher than those of the teachers concerned. In this regard, the processing also serves the exercise of their right to freedom of expression and information under Articles 10, 11 ECFR. The complainant appealed the decision.

Holding

The court upheld the position of the authority that the interest of the public in greater transparency in education and in improving the quality of education and teaching outweighs the confidentiality interests of the teacher. A pseudonymization of the teacher’s names would limit these purposes. The appeal of the complainant was therefore dismissed.

The court argued that the design and safeguards established by the app are sufficient to deal with the teacher’s concerns. The App relates exclusively to the professional sphere of the teacher’s life and evaluations are made only via predefined criteria that do not allow for free text or personal attacks. Furthermore, the evaluations are only displayed when an higher amount evaluations are collected. As an additional safeguard, all students are verified via their telephone numbers minimizing the risk of multiple reviews.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

court
Federal Administrative Court


Decision date
10/20/2021


Business number
W252 2236355-1


Saying
W252 2236355-1 / 4E
IN THE NAME OF THE REPUBLIC!

The Federal Administrative Court recognizes through the judge Mag.a Elisabeth SCHMUT LL.M. as chairperson and the expert lay judges Dr. Claudia ROSENMAYR-KLEMENZ and Mag. Adriana MANDL as assessors on the complaint of the XXXX, involved party before the Federal Administrative Court XXXX GmbH, represented by Preslmayr Rechtsanwälte, Rechtsanwälte in 1010, against the decision of the data protection authority of 08.09.2020, GZ XXXX, in a closed session rightly in a data protection matter:
A)
The appeal is dismissed.
B)
The revision is not permitted in accordance with Art. 133 Para. 4 B-VG.



text
Reasons for the decision:
I. Procedure:
1. With the submission dated January 9th, 2020, improved on March 12th, 2020, the complainant (BF) lodged a complaint with the authority concerned and alleged, in summary, that the party involved, the XXXX, had violated his right to secrecy by providing his data (Name, title, occupation, place of work, etc.) in the app "XXXX" for submitting reviews and have not processed it lawfully. This happened without consent. At the end of 2019, the BF had already made inquiries to those involved. He has been a teacher for around 20 years and there is no public interest in himself or his assessment, especially not worldwide. He had hardly any visitors in his office hours and a maximum of 3 people would come to him on parents' consultation day. The BF currently teaches around 70 students at a school with around 1,000 students. None of this is taken into account in the app. There is no point in making the choice of school of future students dependent on the anonymous evaluation of his person. Not even current students can control which teachers they get. The risk minimization measures taken by those involved are inadequate, as multiple assessments could result. It is also possible that bad reviews have professional consequences. He does not know where the participant got his data from, the source given is in any case incorrect. The use of school-internal abbreviations instead of the full name is also sufficient for submitting an assessment. His rating in the app is very good, so this is not the motive for his data protection complaint.
2. In a statement dated May 14, 2020, the party involved submitted that the data processing had already been checked for legality and admissibility by the authority concerned in an official examination procedure for GZ XXXX. This was discontinued without any conditions being imposed. The processing of the data takes place on the basis of the predominant legitimate interests of the students and outweighs the interest of the teachers concerned in secrecy. There have been no relevant changes since the test procedure. Only the verification process has been improved. The general public has an interest in transparency in the field of education, the improvement of the quality of teaching and, moreover, the assessment takes place in the exercise of the fundamental right to freedom of expression and information according to Article 11 EU-GRC. A mere mention of the teacher's abbreviation is not compatible with the basic right and the measures to prevent multiple assessments are sufficient. The BF's data were obtained from the school's website, where the BF's data can still be found today. The assessment relates to the BF's professional and not private activities, which means that he has no right to anonymity in this area. The BF's fundamental right to secrecy is therefore not violated.
3. With the hearing of the parties on 03.06.2020, the BF repeated his original submission and also stated that the assessment was acting as a virtual pillory. The school already has an established feedback system, so the app is superfluous. The protection against multiple ratings via the telephone number is insufficient, especially since there are 14 million SIM cards for 4 million households in Austria. Geo-blocking is also technically possible to only allow access to the app from Austria. The way in which the BF's name is spelled in this form is only used by the Education Directorate, but appears in a different spelling on the school website, the alleged source of the data. The data source must therefore be a different one.
4. By decision of September 8th, 2020, the authority concerned rejected the complaint regarding the violation of the right to secrecy as unfounded. The authority concerned described the previous history of those involved and the functionality of the app in the notification. The legitimate interests of the general public and especially of the students are to be valued higher than those of the teachers concerned. The established mechanisms against improper use are sufficient, since verification takes place with a telephone number, no open comments are possible and the rating is only displayed from a certain minimum number. The processing also serves to exercise the right to freedom of expression and information according to Art 11 GRC. As a result, the BF's data were lawfully processed.
5. The present complaint of the BF of 11.10.2020 is directed against this decision. In this, the BF repeats his argument and states that his naming does not add any added value and that an abbreviation is sufficient. The authentication by telephone number is insufficient and the use of the school email address is more suitable, although even then students could rate all teachers in their school, although they never have 2/3 of them in class. In addition, he again denies the origin of his data given by the participant.
6. The authority in question submitted the complaint, including the administrative act, with a written statement dated October 16, 2020, received on October 27, 2020, and applied for the complaint to be dismissed with reference to the reasons for the contested decision.
Evidence was obtained through inspection of the administrative file.
II. The Federal Administrative Court has considered:
1. The following facts are certain:
1.1. The BF is a teacher in the XXXX. The participant operates the “XXXX” app, an application for smartphones on which both schools and individual teachers can be rated. The BF appears in the app with his name, academic degree, official title, occupation and the associated school.
The school-internal abbreviation of the BF is "XXXX".
1.2. The functionality of the app is as follows:
1.2.1. In order to be able to submit a rating, users of the app must verify themselves with their phone number. The phone number has to be entered in the app, then the user receives a message on his mobile phone, to which he has to answer from the entered number. If you do this and the user and device match, the verification is complete. Only one verification is possible per phone number.
1.2.2. Before a rating can be submitted, it must be stated which school is attended. Only the teachers in your own school can then be assessed. When changing schools, the school has to be changed in the app and all ratings from the old school are deleted. A teacher can only be rated once per verified user. A subsequent change to the rating is possible. The ratings are only displayed publicly from a certain minimum number, currently 5 and in the future 10-15 ratings. If the number of minimum ratings is subsequently fallen below, the rating will no longer be displayed publicly until the minimum number is reached again.
1.2.3. The evaluation of the teachers, including the BF, is possible on the basis of predefined criteria such as teaching, respect, patience, style of explanation, personality, fairness, motivation and organization. These criteria are explained in more detail and for some it is also possible to justify the evaluation based on predefined selection options, such as variety, documents, explanations and other things. It is not possible to write open comments. The rating is based on a star scale from one to five, with one star standing for “not enough” and five stars for “very good”. The evaluation is anonymous, but tracing is possible for those involved using the telephone number that is required for verification.
1.2.4. It is possible for those affected to report a conspicuous overall rating and have it checked. It is also possible to change the data, for example the place of work.
1.2.5. Both public and private AHS, BHS and new middle schools are recorded in the app. Elementary schools, special schools and their teachers are not listed in the app.
1.3. The BF's complaint is not clearly identified as such. It reads in extracts as follows: “To the
Austrian Data Protection Authority […] XXXX, October 11, 2020
Complaints procedure XXXX XXXX Dear Sir or Madam,
Attached is my opinion / response to the information given in the letter of September 14, 2020 by XXXX GmbH: In the above-mentioned letter, the procedure of XXXX GmbH is presented in great detail, but without going into the essential [sic!] objections on my part or to invalidate this. [...] "
This is followed by explanations on the subject areas of “Naming by name”, “Origin of my data” and “Inadequate authentication”.
2. The findings result from the following assessment of the evidence:
The findings are based on the unobjectionable administrative act, as well as the undisputed submissions of the parties and the documents submitted.
3. Legally it follows from this:
At the outset, it should be noted that the “matter” of the complaint procedure before the administrative court is only that matter which formed the content of the verdict of the authority sued before the administrative court (cf. VwGH December 17, 2014, Ra 2014/03/0049; VwGH September 8, 2015 , Ra 2015/18/0134; etc.). The matter of the administrative procedure therefore in any case limits the authority of the administrative court to examine.
In the present case, the authority concerned only agreed on the violation of the BF's right to secrecy with regard to the processing of his data. If the decision is otherwise unlawful (VwGH June 30, 2016, Ra 2016/11/0044), the Federal Administrative Court is in any case refused to discuss whether the information given by the party to the BF regarding the origin of the data is sufficient or whether the BF as a result, his right to information under Art 15 GDPR - insofar as he has brought forward - is violated. In this regard, the BF is to be referred to the authority concerned.
To A)
The admissible complaint is not justified.
3.1. To qualify the letter as a complaint:
The BF's complaint is not referred to as such, but merely as a "statement / response to the information given in the letter of September 14, 2020". Nevertheless, the requirements for a notice of appeal according to Section 9 (1) VwGVG are met, since the “letter of September 14, 2020” undoubtedly refers to the notice of the authority concerned, also because it mentions the number of the authority concerned in this context. The authority concerned can be clearly identified by addressing and naming the business number. The reasons on which the allegation of illegality is based can be seen from the explanations on the subject areas “Naming by name”, “Origin of my data” and “Inadequate authentication”.
A request or information regarding the timeliness is completely missing, but especially with unrepresented persons, not only the wording, but also the will of the party is noteworthy. The prerequisites may not be interpreted in a strictly formal manner as long as the subject matter of the proceedings - albeit after interpreting the submissions within the meaning of §§ 6 and 7 ABGB and taking into account the attached documents - can be identified beyond doubt, i.e. without the possibility of confusion (VwGH 13.11.2014 , Ra2014 / 12/0010). From the letter of the BF it can be seen that he seeks the determination of the illegality of the processing of his data by the participants due to a violation of his right to secrecy according to § 1 DSG.
The timeliness of the complaint can be assessed from the dates in the letter from the BF.
The letter from the BF is thus to be qualified as a notice of appeal.
3.2. To justify the complaint
The participant has published the name, title and the school in which the BF works in the app. This violated the BF's right to secrecy.
Pursuant to Section 1 (1) of the DSG, everyone, especially with regard to respect for their private and family life, has the right to confidentiality of their personal data, provided there is a legitimate interest in them. The existence of such an interest is excluded if data are not accessible to a confidentiality claim due to their general availability or their lack of traceability to the person concerned.
Since the name and title of the BF are publicly available on the school's website, the published data of the BF would no longer be covered by the scope of Section 1 (1) DSG due to their general availability. This rules out an interest in confidentiality worthy of protection in the case of general availability of the information (VwGH on February 28, 2018, Ra 2015/04/0087; although this decision rather discusses the scope of § 1 DSG 2000 in connection with data processed with automated support). While anyone with Internet access can access the website, the general availability criteria are not met. Because by linking the BF's data with the ratings in the app, there is no mere reproduction, but new information is generated. A lack of protection in terms of Section 1 (1) DSG can therefore not be assumed (RS0130870).
3.2.1. On the legality of the publication of the BF's data in the app
Art 6 para 1 GDPR contains a list of facts according to which data processing is lawful.
According to Art 6 (1) (f) GDPR, data processing is lawful if the processing is necessary to safeguard the legitimate interests of the person responsible or a third party, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, outweigh this.
The ECJ has developed a test scheme according to which the processing of personal data is permitted under three cumulative conditions (ECJ December 11, 2019, C-708/18 [Asociatia de Proprietari bloc M5A-ScaraA] margin no. 40). For the processing to be permissible, there must be a legitimate interest, the processing must be necessary, and the fundamental rights and freedoms of the data subject must not prevail. For this purpose, interests must be weighed up (Jahnel, Commentary on the General Data Protection Regulation (GDPR) Art 6 Rz 71; RS0107203).
The legitimate interest here is that of third parties, namely the public's interest in more transparency in the field of education and the improvement of the quality of training and teaching. It also serves to exercise the right to freedom of expression and information according to Art 11 GRC and Art 10 ECHR. The pupils of the respective schools in particular have this legitimate interest, but also their parents or the schools themselves. Parents and children who are looking for a new or future school have a legitimate interest in the quality of the education and training there Evaluation of the teaching quality of the individual teachers. The individual schools have an interest in the evaluation of the school and the individual teachers in order to be able to remedy any grievances and to continue existing, well-received projects. Since the right to freedom of expression according to Art 10 ECHR includes both pure expressions of opinion and statements of fact (VfGH October 8, 2015, G264 / 2015), the evaluation of teachers via an app in school grade format (1-5 stars) is in any case an expression of opinion and therefore a legitimate interest within the meaning of Art 6 Paragraph 1 lit f GDPR.
The processing of the BF's data must also be necessary to meet the legitimate interests of the general public and in particular of the students. Specifically, the name, title and professional location of the BF are processed here together with the ratings given to him. This processing is necessary to meet the interest in the assessment of the quality of teaching and the above-mentioned interest in freedom of expression. Simply naming the BF abbreviation "XXXX" would not be sufficient for this. It may be correct that the app is primarily aimed at the students of the respective school with regard to the submission of ratings, but there is public interest in seeing the ratings beyond the visitors of the respective school. Parents of future pupils have an interest in the evaluation of the school and the individual teachers in order to ultimately select the most suitable school. The BF does not have to agree if he thinks that students have no influence on the choice of teachers. In smaller schools in particular, there is often only one new class whose teachers are already known when registering. But even in larger schools, like that of the BF, it is possible to choose individual teachers within the framework of electives, optional subjects and project work. It also does not seem credible if the BF thinks that each of the 1000 students can immediately assign each abbreviation of each teacher. And if this is not even possible for everyone in the school, it is certainly not possible for future schoolchildren or relatives. The processing of the BF's data is therefore in any case objectively appropriate for the intended use and also significant for the purpose. The data processing is also limited to what is necessary for the purpose of the evaluation and is therefore necessary in the result (Jahnel, Commentary on the General Data Protection Regulation (GDPR) Art 6 margin no.76).
However, the interests and fundamental rights of the BF must not be disregarded. He has an interest in not appearing publicly with his full name on a rating platform for teachers and being put in a virtual pillory. He is also not interested in public feedback, especially since he prefers the feedback culture established within the school. In general, this can be summarized as an interest in secrecy within the meaning of Section 1 (1) DSG. A violation of respect for private and family life within the meaning of Art 8 ECHR is out of the question, since the assessment of the BF in the app only affects the professional sphere of his life. There is no risk that areas of the BF's private life are made public through reviews in the app, or that personal attacks are carried out in the form of hateful comments. The evaluation is only possible on the basis of the predefined criteria, which are purely professional. The option to give a rating or opinion in the form of a free text does not exist.
If one now carries out a weighing of interests, the interests must first of all be weighted. The interest of students, parents, relatives and the general public in improving the quality and transparency of teaching, as well as the interest of students in expressing their opinion about the quality of teaching, can be rated as very high. The possibility for each student to evaluate the schools and their teachers individually creates the opportunity for students to praise the teaching methods of the individual teachers, but also to point out grievances and points of criticism. On the other hand, the BF's interest in keeping his data confidential is to be assessed as low, especially since it only affects his professional and not his private sphere. There is also little interference with the interests of the BF, as no free-text evaluations are possible and evaluations can only be carried out by the students of the respective school. According to Recital 47 GDPR, the reasonable expectations of the data subject at the time of processing must also be set aside. Although the recital is primarily aimed at the relationship between the person concerned and the processor, in the opinion of the judgment court it is also applicable to this case. According to its own statements, the BF practices the feedback system established within the school and has been confronted with both positive and negative criticism in many of its activities for almost 30 years in the private sector, at universities and also at school. It is therefore clear that the BF expected feedback on the quality of his teaching in the course of his work at the school. The processing by those involved in the form of the generally accessible app was initially new to him, but not the basic existence of feedback on his professional activity. In any case, the interests of the students and the general public outweigh those of the BF, which means that the processing of his data by those involved is permissible within the meaning of Art 6 Paragraph 1 lit f GDPR.
The legitimate interests of third parties, in this case the students and the general public, outweigh those of the BF, which means that the requirements of Section 1 (2) DSG are also met.
The processing of the BF's data by those involved was therefore lawful.
3.2.2. To protect against incorrect or multiple evaluations
The BF cites so-called geoblocking as a way of restricting local access to the data published in the app. As he himself writes, however, this practice was largely prohibited when the Geoblocking Regulation [VO (EU) 2018/302] came into force on December 3rd, 2018 and is therefore neither suitable nor permissible.
If the BF states that the protection against multiple evaluations is insufficient, because there are more telephone numbers in Austria than residents and virtual telephone numbers can also be generated in the app for verification, then it must be stated that the data is still adequately protected is. In general, the risk of excessive multiple evaluations is generally low due to the general restriction to one evaluation per teacher and telephone number. It may be true that there is a possibility that a person could create multiple accounts using different phone numbers in order to be able to submit multiple reviews, but the risk is small as it would be cumbersome and extremely costly.
Reviews are also only displayed from a minimum number, which means that individual incorrect reviews do not matter. The minimum number is currently 5 assessments, and in the future a minimum number of 10-15 assessments per teacher is envisaged. In addition, each teacher has the option of using the “Report change” button to subject the evaluation to a control by those involved, who can then delete any abusive multiple evaluations.
3.2.3. To an objection by the BF according to Art 21 GDPR
According to Article 21 Paragraph 1 GDPR, every person concerned has the right to object at any time to the processing of personal data relating to them based on Article 6 Paragraph 1 Letter e or f for reasons that arise from their particular situation.
The BF clearly expressed an objection with its data protection complaint of January 9th, 2020 or March 12th, 2020 - albeit not expressly designated as such. However, he did not give reasons arising from the BF's special situation. Some of his statements are general and are aimed at the entire teaching staff. If he gives information specifically about his person and his situation, by naming his school-internal abbreviation, or describing his access to feedback with students, then these are not a unique selling point, but rather apply in this form to almost all teachers. There is therefore no special situation that would justify an objection under Art 21 GDPR.
3.3. Oral hearing was not requested and could also be omitted, since the facts that are essential for the legal assessment had already been collected by the administrative authority in full and in a proper investigation and at the time of the decision of the court that made the decision, it was still up-to-date and complete as required by law. In the complaint, no relevant facts that conflicted or went beyond the result of the official investigation were alleged (VwGH on February 24, 2015, Ra 2014/19/0171). Rather, the BF's submission in the notice of appeal was to be qualified as a mere unsubstantiated denial. For the most part, the BF repeated his submissions and in some cases was even verbatim with the one before the authority concerned (VwGH on May 27, 2015, Ra 2015/18/0021). In particular, the statements made by the BF on the subject areas mentioned by him regarding naming, data origin and defective authentication coincide with the submissions made to the authority.
3.4. The complaint is therefore not entirely justified. It was therefore to be decided according to the ruling.
Regarding B) Inadmissibility of the revision:
According to § 25a Abs 1 VwGG, the administrative court has to pronounce in the verdict of its decision or decision whether the revision is admissible according to Art 133 Abs 4 B-VG. This statement must be justified briefly.
The revision is not permissible according to Art. 133 para 4 B-VG, because the decision does not depend on the solution of a legal question, which is of fundamental importance and has the character of an individual case. There are also no other indications for the existence of a legal question of fundamental importance: The legal situation is clear with regard to the data protection classification of rating portals. The weighing of interests carried out is not reversible as a case-by-case decision made within the framework of the guidelines drawn up by the Administrative Court.
Especially with regard to the decision of the OGH (OGH 27.06.2016, 6Ob48 / 16a), in which there was a similar case constellation with regard to the balancing of interests and the latter viewed the interests of the general public in an evaluation platform as predominant, this knowledge does not deviate from the highest court case law . Even if this case law does not come from the VwGH but from the Supreme Court, this does not justify a legal question of fundamental importance, if one does not even exist in the case of contradicting case law (VwGH May 27, 2019, Ra 2017/12/0047).


European Case Law Identifier
ECLI: AT: BVWG: 2021: W252.2236355.1.00