BVwG - W252 2247042-1
From GDPRhub
| BVwG - W252 2247042-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 12(3) GDPR Article 15(1) GDPR Article 15(2) GDPR Article 15(3) GDPR Article 16 GDPR Article 20 GDPR Article 63 GDPR § 24(1) DSG § 24(6) DSG |
| Decided: | 22.01.2024 |
| Published: | 20.02.2024 |
| Parties: | |
| National Case Number/Name: | W252 2247042-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2024:W252.2247042.1.00 |
| Appeal from: | DSB (Austria) |
| Appeal to: | Not appealed |
| Original Language(s): | German |
| Original Source: | Legal Information System of the Republic of Austria (in German) |
| Initial Contributor: | stella |
A court held that the right of access does not entitle a data subject to copies of entire documents or attachments and that a controller may send an access response on paper if the data subject rejects electronic delivery.
English Summary
Facts
The controller, an Public Employment Service Austria, processed the personal data of the data subject in connection with his file. On 21 February 2019, 15 March 2019 and 25 November 2020, the data subject sent access requests to the controller by fax, each time explicitly insisting on delivery of the response by registered post, addressed personally and refusing delivery by email. With the November 2020 request, he also sent a blank DVD-R by post, asking the controller to copy the data onto it. The controller responded to each request with a printed access response sent by registered letter, the responses were substantially identical and the DVD-R was returned unused. The controller's usual practice is to provide access electronically through an online account. The access responses included the data subject's basic data, insurance and benefit periods and a chronological log of case notes "Informationen/Gesprächsnotizen/Vermerke", which listed attachments where relevant but did not include copies of entire documents. The data subject was aware of the content of the documents listed as attachments, since he himself had submitted them to the controller.
None of the three responses referred to a specific case note dated 17 October 2018, recording a phone call between the controller and the data subject's family doctor about his health. The data subject repeatedly and specifically requested this note. The controller only produced it during the proceedings before the Federal Administrative Court, in a submission of 29 June 2023, which the Court forwarded to the data subject in July 2023.
The data subject lodged a complaint with the Austrian DPA in February 2020, arguing that the access provided was deficient because copies of documents were missing, unexplained abbreviations were used, the response was not delivered in a common electronic format and it contained incorrect data. The DPA partially upheld the complaint (ordering the controller to explain certain abbreviations) but rejected the remainder, holding that the right of access does not include a right to copies of documents. The data subject appealed only the rejecting part of the DPA's decision to the Federal Administrative Court.
Holding
First, the court held that the data subject was entitled, in the specific circumstances, to receive a copy of the case note of 17 October 2018. Citing CJEU case-law, the court noted that "personal data" must be interpreted broadly and that a "copy" means a faithful reproduction, not a mere general description or reference to categories of data. Because the data subject had specifically identified and requested this particular note as early as February 2019, the controller's asserted practice of a staged, multi-step access process could not be relied on to justify withholding it.
However, the court held that this part of the complaint became moot once the controller supplied the missing note during the court proceedings, since the data subject's interest in access was thereby satisfied, even though the note reached him via the court rather than directly from the controller. Referring to national case-law, the court noted that there is no separate right to a formal declaration that a past infringement of the right of access occurred, once the substantive right has been satisfied. It also stated that any dispute about the accuracy of the date shown on the note was a matter for the right to rectification, not the right of access.
Second, the court held that the right of access does not, in general, entitle a data subject to copies of entire documents or file attachments. Reproduction of extracts or whole documents is only necessary where needed to make the disclosed personal data intelligible. Since the data subject already knew the content of the referenced attachments (he had submitted them himself and had annotated copies of the responses identifying their content), the court held that further disclosure of the attachments was not necessary for comprehensibility and the access already given was complete.
Third, the court rejected the data subject's argument that the access responses should have been delivered in a "common electronic format." While the GDPR provides that a request submitted electronically should, in principle, be answered electronically unless the data subject indicates otherwise, the court held that the data subject himself had explicitly and repeatedly requested delivery by registered post rather than email and this constituted "otherwise" within the meaning of that provision. The court also held that there is no obligation on a controller to use a physical data carrier (such as the data subject's own DVD-R) to provide access. It rejected the argument that paper delivery was designed to prevent the data being machine-searchable, noting that the right of access, unlike the right to data portability, does not guarantee a right to further processing of the data.
The appeal was dismissed and the court declared that an appeal on points of law (Revision) was not admissible, since the relevant questions were already settled by existing CJEU and national supreme administrative court case-law.
Comment
This decision applies the CJEU's ruling in C-487/21 (Österreichische Datenschutzbehörde). It also usefully clarifies that a data subject's own delivery preference (e.g., insisting on postal rather than electronic delivery) can constitute "otherwise" under Article 12(3) GDPR, shifting the format obligation away from electronic delivery.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Decision Date
January 22, 2024
Legal Norm
Federal Constitutional Law (B-VG) Art. 133 para. 4
Data Protection Act (DSG) § 24
General Data Protection Regulation (GDPR) Art. 12
General Data Protection Regulation (GDPR) Art. 15
Federal Constitutional Law (B-VG) Art. 133 currently in force; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019 to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019, last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 133 valid from May 25, 2018 to December 31, 2018, last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 133 valid from August 1, 2014 to May 24, 2018, last amended by Federal Law Gazette I No. 22/2018 Article 133 of the Federal Constitutional Law (B-VG) was amended by Federal Law Gazette (BGBl.) No. 164/2013, valid from January 1, 2014 to July 31, 2014. Article 133 was last amended by Federal Law Gazette (BGBl.) No. 51/2012. Article 133 was valid from January 1, 2004 to December 31, 2013. Article 100/2003 of the Federal Constitutional Law (B-VG) was valid from January 1, 1975 to December 31, 2003. Article 133 was last amended by Federal Law Gazette (BGBl.) No. 444/1974. Article 133 was valid from December 25, 1946 to December 31, 1974. Article 133 was last amended by Federal Law Gazette (BGBl.) No. 211/1946. Article 133 was valid from December 19, 1945 to... Last amended by the Federal Law Gazette on 24 December 1946. No. 4/1945 B-VG Art. 133 valid from January 3, 1930 to June 30, 1934
Data Protection Act (DSG) Art. 2 § 24 now DSG Art. 2 § 24 valid from July 15, 2024, last amended by Federal Law Gazette I No. 70/2024; Data Protection Act (DSG) Art. 2 § 24 valid from May 25, 2018 to July 14, 2024, last amended by Federal Law Gazette I No. 120/2017; Data Protection Act (DSG) Art. 2 § 24 valid from January 1, 2010 to May 24, 2018, last amended by Federal Law Gazette I No. 133/2009; Data Protection Act (DSG) Art. 2 § 24 valid from January 1, 2000 to December 31, 2009
Judgment
,
W252 2247042-1/10E
W252 2247042-1/10E,
IN THE NAME OF THE REPUBLIC!
The Federal Administrative Court, composed of Judge Elisabeth SCHMUT LL.M. as presiding judge and lay judges Claudia ROSENMAYR-KLEMENZ and Adriana MANDL as associate judges, has rendered the following judgment in a non-public session concerning the appeal of XXXX, XXXX, (party before the Administrative Court XXXX), against point 2 of the decision of the Data Protection Authority dated August 20, 2021, file number XXXX: The Federal Administrative Court, composed of Judge Elisabeth SCHMUT LL.M. As presiding judge, and with lay judges Dr. Claudia Rosenmayr-Klemenz and Mag. Adriana Mandl as associate judges, the Court, in a non-public session concerning the appeal of [file number] (participant before the Administrative Court [file number]), against point 2 of the decision of the Data Protection Authority dated August 20, 2021, file number [file number], rendered the following judgment in a data protection matter:
A) The appeal is dismissed.
B) An appeal on points of law is not permitted.
Text
Reasons for the Decision:
I. Procedural History:
1. By submission dated February 19, 2020, the appellant (hereinafter referred to as "the appellant") filed a data protection complaint with the respondent authority, arguing, in summary, that his right to information had been violated by the MP. The information provided by the MP was deficient because copies of documents were missing, it contained incomprehensible abbreviations, it was not provided in a common electronic format, and it contained incorrect data.
2. The MP provided the BF with two further pieces of information during the course of the proceedings.
3. By decision dated August 20, 2021, the respondent authority partially upheld the complaint regarding a violation of the right to information, as the MP had failed to explain certain abbreviations and issued a corresponding order for performance (points 1 and 3). In all other respects, it dismissed the complaint as unfounded (point 2). The right to information does not include a right to copies of documents.
4. The BF's present appeal of September 28, 2021, is directed against point 2 of the decision. He argues that he has a right to receive the data in a common electronic format; providing the information on paper violates this right. Furthermore, he did not receive copies of the meeting notes and file entries from the MP.
5. The respondent authority filed the appeal, including the administrative file, by letter dated October 4, 2021, received by the Federal Administrative Court on October 5, 2021, and requested – with reference to the reasoning of the contested decision – that the appeal be dismissed.
6. The MP submitted a file entry dated November 7, 2018, with a statement dated June 29, 2023. This statement, along with the file entry, was served on the appellant by the Federal Administrative Court on July 12, 2023, with a hearing.
Evidence was taken by reviewing the administrative and court files.
II. The Federal Administrative Court considered the following:
1. Findings:
1.1. On February 21, 2019, March 15, 2019, and November 25, 2020, the plaintiff submitted requests for information to the Ministry of the Interior by fax. In these requests, the plaintiff expressly stated that he insisted on receiving the information by mail ("Registered mail! Personal delivery! Not to authorized postal agents!") and refused transmission by email (see, among others, the request for information dated November 25, 2020, OZ 1, p. 224). The plaintiff also sent the request for information dated November 25, 2020, by mail, enclosing a blank DVD-R with the request that the data be transferred to it. 1.1. On February 21, 2019, March 15, 2019, and November 25, 2020, the plaintiff submitted requests for information to the Ministry of the Interior by fax. In his requests for information, the plaintiff expressly stated that he insisted on receiving the information by mail ("Registered mail! Personal delivery! Not to authorized postal agents!") and refused transmission by email (see, among others, the request for information dated November 25, 2020, OZ 1, p. 224). The plaintiff also sent the request for information dated November 25, 2020, by mail, enclosing a blank DVD-R with the request that the data be transferred to it.
1.2. The MP sent the plaintiff a total of three printed copies of the information by registered mail (February 22, 2019, March 18, 2019, November 27, 2020), which were essentially identical. The DVD-R was returned unused. The MP normally provides its information electronically via the XXXX account. The Medical Service (MP) sent the client three printed statements of information by registered mail (February 22, 2019, March 18, 2019, and November 27, 2020), which are essentially identical. The DVD-R was returned unused. The MP normally provides its information electronically via account number 40.
1.3. The statements of information include, among other things, the client's basic personal data as well as insurance and benefit periods. In addition, the statements contain a "chronological documentation" that reflects the client's case history. The chronological documentation contains several so-called "information/meeting notes/remarks." If the caseworker has entered comments in the MP system for these file notes, these are visible. Some of these file notes document the receipt of documents from the client without a separate note. The respective attachments are listed. The information provided does not include copies of entire documents or letters sent by the applicant to the Member State Authority (MP). The applicant is aware of the documents the MP holds concerning the applicant.
1.4. The information provided omitted reference to a file note dated November 7, 2018, which the applicant had repeatedly requested with detailed justification. The MP subsequently submitted this file note in its statement of June 29, 2023, which was forwarded to the applicant on July 12, 2023, with the opportunity for the applicant to be heard (OZ 5). This file note refers to a telephone conversation between the MP and the applicant's family doctor regarding the applicant's state of health on August 31, 2018 (see OZ 3). Until the Federal Administrative Court forwarded the file note, the applicant was unaware of its contents.
1.5. The appellant's appeal against the decision reads in part (formatting not verbatim):
“[…] According to point 2), my appeal was rejected on the remaining points.
I must therefore appeal on some points. […]” (OZ 1, p. 509).
2. Evaluation of Evidence:
2.1. The appellant's requests for information from the MP and the information provided are evident from the uncontested contents of the file (OZ 1, pp. 23 ff., 55 ff., 221 ff.). Since the MP responded to each of the appellant's requests for information, and the appellant referred to these responses in his statements, there is no doubt that both the appellant and the MP were aware of them.
2.2. The manner in which the requests for information and the information provided were transmitted is clearly evident from the administrative act. The fact that the applicant insisted on postal delivery is evident from his statement that he was unable to reliably receive emails and therefore insisted on registered mail. Furthermore, the applicant's instruction "Registered mail! Personal delivery! Not to authorized postal recipients!" is a clear request to send the information by registered mail (OZ 1, pp. 21, 146). The information provided on November 27, 2020, shows, among other things, that the MP complied with the applicant's request for postal delivery and sent the information by registered mail (OZ 1, p. 236). The applicant's statement, which the MP did not contest, indicates that the DVD-R provided by the applicant was not used in this process (see, among others, OZ 1, pp. 128 f., 145). The MP's fundamental procedure for transmitting information via the user account was clearly explained in its statement of June 27, 2023 (OZ 3, p. 2). 2.2. The method of transmitting the requests for information and the information provided is clearly evident from the administrative act. The appellant's insistence on postal delivery is evident from his statement that he was unable to reliably receive emails and therefore insisted on registered mail. Furthermore, the appellant's instruction "Registered mail! Personal delivery! Not to authorized postal representatives!" is a clear request to send the information by registered mail (OZ 1, pp. 21, 146). Among other things, the information provided on November 27, 2020, shows that the MP complied with the appellant's request for postal delivery and sent him the information by registered mail (OZ 1, p. 236). The submissions of the plaintiff, which the MP did not contest, indicate that the DVD-R provided by the plaintiff was not used in this case (see, among others, OZ 1, pp. 128 f., 145). The MP's general procedure for transmitting information via the user account was explained comprehensibly in its statement of June 27, 2023 (OZ 3, p. 2).
2.3. The content of the information provided is clearly evident from the file contents to which the information is attached (OZ 1, pp. 168 ff., 194 ff., 236 ff.). The information also includes the case workers' notes and the corresponding attachments. The fact that the information does not contain copies of entire documents is evident from the administrative file and is undisputed by both parties. The finding that the applicant is familiar with the "attachments" listed in the chronological documentation is based on the fact that the applicant submitted annotated information from the MP during the proceedings, in which he marked certain passages or made comments, indicating in each case which document was missing and its content (see, among others, OZ 1, pp. 181, 183, 192). As an example, the file note dated February 16, 2015, is mentioned here, which contains no further description of its contents, but only the notation "received." In his statement of April 1, 2021, the applicant convincingly explained the content of the letter received on February 16, 2015 (see the applicant's letter of April 1, 2021, p. 3; OZ 1, p. 144).
2.4. The file note dated November 7, 2018, which was subsequently submitted by the MP on June 29, 2023, does not appear in any of the three statements of information. The specific content of the file note dated November 7, 2018, is evident from the copy submitted as part of the MP's statement of June 29, 2023 (see OZ 3). That the appellant was unaware of the exact content of this memorandum is unequivocally evident from his own statements on the matter, in which he repeatedly points out that this memorandum has been withheld from him for years. While the appellant has a general idea of its content, he explained why the exact content or a copy was important to him (OZ 1, p. 511). The delivery to the appellant is confirmed by the postal return receipt, which shows that the appellant accepted the hearing notice, including the memorandum, on July 18, 2023 (see OZ 5).
2.5. The cited content of the appeal against the decision is contained within the appeal itself. It is attached to the unobjectionable administrative act (OZ 1, p. 509).
3. Legal Assessment:
Regarding A)
The admissible appeal is unfounded.
3.1. Regarding the scope of the appeal:
The wording chosen by the appellant in his appeal against the decision clearly indicates that he intended to appeal "only" against point 2 of the decision, which was the rejection (OZ 1, p. 509). This is consistent with the argumentation in the appeal, which is directed solely against the rejection part of the decision.
3.2. Regarding the right of access:
As stipulated in Article 15(1) GDPR, every data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. Where that is the case, he or she has the right to access such personal data. In addition, the information specified in Article 15(1)(a) to (h) and (2) GDPR must be provided. In addition, the information specified in Article 15, paragraph 1, letters a, to h, and paragraph 2 of the GDPR must be provided.
Article 15(3) of the GDPR lays down the practical modalities for fulfilling the right of access by specifying, among other things, in the first sentence, the form in which the "personal data undergoing processing" must be provided, namely in the form of a "copy." Therefore, there is no general right to receive copies of entire documents within the context of access. To ensure that the information provided is easily understandable, however, the reproduction of excerpts from documents, or even entire documents, may prove essential if contextualizing the processed data is necessary to guarantee its comprehensibility (see, in this regard, CJEU 04.05.2023, C-487/21, Austrian Data Protection Authority, paras. 31 et seq.; 41, 45). Article 15(3) GDPR lays down the practical modalities for fulfilling the right of access by specifying, among other things, in the first sentence, the form in which the "personal data undergoing processing" must be provided, namely in the form of a "copy". There is therefore no general right to receive copies of entire documents within the context of access. To ensure that the information provided is easily understandable, the reproduction of excerpts from documents, or even entire documents, may prove essential if contextualizing the processed data is necessary to guarantee its comprehensibility (see, in this regard, ECJ 04.05.2023, C-487/21, Austrian Data Protection Authority, paras. 31 et seq.; 41, 45).
3.3. In the specific case, this means:
In his complaint, the complainant stated that he had not been provided with a file note concerning a telephone consultation between the medical practitioner and his doctor on October 17, 2018. This note contained personal data. Furthermore, the applicant claimed to have "requested" copies and eight additional file notes (see the applicant's appeal against the decision, in which he refers to a document entitled "2019 0315 GM AMS missing copies ordered.pdf", which contains corresponding markings; OZ 1, p. 510, 55 ff.). He stated that these had also not been provided to him. Moreover, he objected to the manner in which the information was transmitted.
3.3.1. Regarding the file note of October 17, 2018:
As the CJEU clarified, the term "personal data" is to be interpreted broadly. It potentially encompasses all types of information in the form of opinions or assessments, provided that it is information "about" the person in question. In this respect, information about a person exists if, due to its content, purpose, or effects, it is linked to an identifiable person. In this respect, the Court has already ruled that the term "copy," as used here, refers to a faithful reproduction or transcript, so that a purely general description of the data being processed or a reference to categories of personal data would not meet this definition (see CJEU 04.05.2023, C-487/21, Austrian Data Protection Authority, paragraphs 21, 23, 24). As the CJEU clarified, the term "personal data" is to be interpreted broadly. It potentially encompasses all types of information in the form of opinions or assessments, provided that this information relates "to" the person in question. In this sense, information relating to a person exists if, by virtue of its content, purpose, or effects, it is linked to an identifiable person. In this respect, the Court has already ruled that the term "copy," as used here, refers to a faithful reproduction or transcription, so that a purely general description of the data being processed or a reference to categories of personal data would not meet this definition (see CJEU 04.05.2023, C-487/21, Austrian Data Protection Authority, paragraphs 21, 23, 24).
The memorandum of the MP dated 17 October 2018 contains personal data of the applicant in a specific case, precisely because it concerns information about the applicant's state of health on 31 August 2018. Furthermore, the purpose and effect of this information is to clarify the applicant's eligibility for emergency assistance. The exact content of this memorandum was unknown to the BF until its submission during the hearing of the parties on July 12, 2023 (OZ 5), which is why the precise content of this document was crucial here.
The MP's argument that it pursues a multi-stage information process and, due to the volume of data it processes, does not immediately disclose all data, is fundamentally conceivable with regard to Recital 63, seventh sentence, of the GDPR (see the MP's statement of June 26, 2023, p. 4; OZ 3, p. 4; and Haidinger in Knyrim, DatKomm Art. 15 GDPR, para. 11/1). In this specific case, however, the MP cannot rely on this argument, as the BF already explicitly requested the file note, which shows a telephone conversation with the BF's doctor, in his request for information dated February 21, 2019 (OZ 1, p. 21). Due to the BF's clarification, the MP's argument is invalid. The MP's argument that it follows a multi-stage information process and, due to the volume of data it processes, does not immediately disclose all data, is generally conceivable with regard to Recital 63, seventh sentence, GDPR (see the MP's statement of June 26, 2023, p. 4; OZ 3, p. 4; and Haidinger in Knyrim, DatKomm Article 15, GDPR, para. 11/1). In this specific case, however, the MP cannot rely on this argument, as the BF (Federal Commissioner) explicitly requested the file note, which documents a telephone conversation with the BF's doctor, in his request for information dated February 21, 2019 (OZ 1, p. 21). Due to the BF's clarification, the MP's argument is invalid.
Interim conclusion: In this specific case, the BF is entitled to receive a copy of the file note dated October 17, 2018.
Section 24 Paragraph 6 of the Data Protection Act (DSG), which, pursuant to Section 17 of the Administrative Court Procedure Act (VwGVG), is to be applied mutatis mutandis in administrative court proceedings, stipulates that a respondent may subsequently remedy the alleged violation of rights until the conclusion of the proceedings before the Data Protection Authority by complying with the appellant's requests. In this case, the respondent authority must, in principle, terminate the proceedings without any formal requirements. Section 24 of the Data Protection Act (DSG) is intended to grant data subjects the right to enforce any violations of their rights arising from the DSG or the GDPR (see Bresich/Riedl in Bresich/Dopplinger/Dörnhöfer/Kunnert/Riedl, DSG § 24 para. 7). The wording of Section 24 para. 6 does not indicate that this response must necessarily be directed at the complainant during the proceedings. Therefore, the appellant's interest in legal protection remains safeguarded even by the court's transmission of the data within the framework of the parties' right to be heard (cf. in this regard Thiele/Wagner, Praxiskommentar zum Datenschutzgesetz (DSG)2 § 24 para. 258 et seq.). Section 24, paragraph 6, of the DSG, which, pursuant to Section 17 of the Administrative Court Procedure Act (VwGVG), is to be applied mutatis mutandis in administrative court proceedings, provides that a respondent may subsequently remedy the alleged infringement of rights until the conclusion of the proceedings before the data protection authority by complying with the appellant's requests. In this case, the respondent authority must, in principle, terminate the proceedings informally. Section 24 of the DSG is intended to grant data subjects the right to enforce any infringements of rights arising from the DSG or the GDPR (cf. Bresich/Riedl in Bresich/Dopplinger/Dörnhöfer/Kunnert/Riedl, DSG Section 24, para. 7). The wording of paragraph 24, subsection 6, does not indicate that this response must necessarily be made to the appellant during the proceedings. Therefore, the appellant's legitimate interest in legal protection remains safeguarded even by the transmission of the information by the court within the framework of the parties' hearing (see, in this regard, Thiele/Wagner, Commentary on the Data Protection Act (DSG)2, Section 24, para. 258 et seq.).
The Austrian Administrative Court (VwGH) has already ruled with regard to the predecessor provision of Section 24 of the Data Protection Act (Section 31 of the Data Protection Act 2000), that no right to a determination of a past violation of the right to information can be derived from it (see VwGH 27.09.2007, 2006/06/0330). The VwGH has applied this jurisprudence to the current legal situation (see VwGH 19.10.2022, Ro 2022/04/0001, para. 24 et seq.). The VwGH has already ruled with regard to the predecessor provision of Section 24 of the Data Protection Act (Section 31 of the Data Protection Act 2000), that no right to a determination of a past violation of the right to information can be derived from it (see VwGH 27.09.2007, 2006/06/0330). The Austrian Administrative Court (VwGH) has applied this jurisprudence to the current legal situation (see VwGH 19.10.2022, Ro 2022/04/0001, para. 24 et seq.).
The Minister of the Interior (MP) submitted the relevant file note as part of its statement of 27 and 28 June 2023 (OZ 3; OZ 4). The objective of the complaint regarding a violation of the right to information was achieved by the MP's submission of the (missing) file note. Therefore, a violation of this right is no longer possible with respect to this file note. A subjective public right to a declaration of a past violation of the right to information – or of delayed disclosure – is not covered by the right of appeal under Section 24 of the Data Protection Act (DSG) in conjunction with Article 15 of the GDPR. The Minister of the Interior (MP) submitted the relevant file note as part of its statement of 27 and 28 June 2023 (OZ 3; OZ 4). The procedural objective of the complaint regarding a violation of the right to information was achieved by the MP's transmission of the (missing) file note. A violation of this right is therefore no longer possible with respect to this file note. A subjective public right to a declaration of a past violation of the right to information – or of delayed disclosure – is not covered by the right of appeal under Section 24 of the Data Protection Act (DSG) in conjunction with Article 15 of the General Data Protection Regulation (GDPR).
The appeal against the decision was therefore to be dismissed in this respect.
3.3.1.1. Regarding the incompleteness of the information provided by the appellant concerning the file note of October 17, 2018:
In his statement of July 26, 2023 (file reference 6), the appellant argued that the information was still incomplete because the (correct) date of the subsequently submitted file note of October 17, 2018, was missing. He explained that the stated date might be incorrect (see OZ 6).
As noted, the appellant has now received a complete copy of the file note dated October 17, 2018. This note also contains a date. If the appellant objects to the accuracy of this date, he should be advised that, within the framework of a complaint based on the right to information, only the completeness of this information can be reviewed. If the appellant believes that this date is incorrect, he is free to assert this under his right to rectification pursuant to Article 16 GDPR. However, the "subject matter" of the present complaint proceedings can only be the completeness of the information (cf. regarding the "subject matter" of the complaint proceedings, Austrian Administrative Court [VwGH] February 8, 2022, Ro 2021/04/0033, para. 8). The fact that the right to information must be distinguished from the right to rectification is also evident from Article 15(1)(e) GDPR. Accordingly, the information provided must include a statement regarding "the existence of a right to rectification." This right can be exercised after receiving the data from the information provided. As established, the appellant has now received a complete copy of the file note dated October 17, 2018. This note also contains a date. If the appellant objects to the accuracy of this date, they should be advised that, within the framework of a complaint based on the right to information, only the completeness of this information can be reviewed. If the appellant believes that this date is incorrect, they are free to assert this within the framework of their right to rectification pursuant to Article 16 of the GDPR. However, the "subject matter" of the present complaint proceedings can only be the completeness of the information provided (see the Austrian Administrative Court decision of February 8, 2022, Ro 2021/04/0033, para. 8, regarding the "subject matter" of the complaint proceedings). The distinction between the right of access and the right to rectification is also evident from Article 15, paragraph 1, letter e, of the GDPR. Accordingly, the information provided must include details of "the existence of a right to rectification." This right can be exercised after receiving the data from the information provided.
3.3.2. Regarding the “information/meeting notes/remarks” marked by the applicant:
If the applicant demands the release of all file notes, in particular those he marked in the information provided on February 22, 2019, on March 15, 2019 (see “2019 0315 GM AMS missing copies ordered.pdf”; OZ 1, pp. 56 ff.), he must be advised that the right of access does not, in principle, provide for the release of entire documents or file copies (see again ECJ May 4, 2023, C-487/21, Austrian Data Protection Authority, paras. 31 f; 41, 45). With regard to the present case, the right of access – as the MP correctly noted – must not be conflated with the right to inspect files (see Holzer, The Right of Access under Art. 15 GDPR as an Extended Form of Inspection of Files?, ZIIR 2021, 36). The purpose of the right of access is to be aware of the processing and to be able to verify its lawfulness (cf. Recital 63 GDPR). If the applicant demands the release of all file notes, in particular those he marked in the information dated 22 February 2019 on 15 March 2019, see “2019 0315 GM AMS missing copies ordered.pdf”. (See OZ 1, p. 56 ff.), it should be noted that the right of access does not generally provide for the release of entire documents or copies of files (see again ECJ 04.05.2023, C-487/21, Austrian Data Protection Authority, paras. 31 f; 41, 45). With regard to the present case, the right of access – as the MP correctly noted – must not be confused with the right to inspect files (see Holzer, The Right of Access under Article 15 GDPR as an Extended Form of File Inspection?, ZIIR 2021, 36). The purpose of the right of access is to be aware of the processing and to be able to verify its lawfulness (see Recital 63 GDPR).
As can be seen from the information provided, the MP also provided substantive information on its file notes, insofar as these contained annotations. See, among other things, the file note dated September 4, 2018:
"September 4, 2018 Information / Meeting Notes / Memoranda
Written apology received. Client will submit medical certification and photos by mail. See attachment." (see the information dated March 18, 2019, p. 24; OZ 1, p. 87).
As established, the applicant is aware of the attachments to the relevant file notes, as he himself sent them to the authority in question. The release of the attachments to the file notes is not necessary for the comprehensibility of the information provided in the present case (see the applicant's letter of April 1, 2021, p. 3; OZ 1, p. 144; in which he explains the exact content of the file note; and ECJ May 4, 2023, C-487/21, Austrian Data Protection Authority, para. 41). As established, the applicant is aware of the attachments to the relevant file notes, as he himself sent them to the respondent authority. The release of the attachments to the file notes is not necessary for the comprehensibility of the information provided in the present case (see the applicant's letter of April 1, 2021, p. 3; OZ 1, p. 144; in which he explains the exact content of the file note). (see also ECJ 04.05.2023, C-487/21, Austrian Data Protection Authority, para. 41).
The right of access does not include an obligation to provide a log of transmission times. A log listing all documents received would not be useful for verifying the lawfulness of the processing (see, in this regard, Haidinger in Knyrim, DatKomm Art. 15 GDPR, para. 40/1, regarding the disclosure of information to recipients).
The right of access does not include an obligation to provide a log listing transmission times. A log listing all documents received would not be useful for verifying the lawfulness of the processing (see, in this regard, Haidinger in Knyrim, DatKomm, Art. 15 GDPR, para. 40/1, regarding the disclosure of information to recipients). Furthermore, in its response dated November 27, 2020, the MP already provided more detailed information on the file notes "requested" or marked by the BF and listed the respective attachments, thus making the response comprehensible for the BF and rendering the transmission of the attachments unnecessary for clarity (see, among others, the entry dated June 11, 2018, in the response dated November 27, 2020, p. 29; OZ 1, p. 265). 29; OZ 1, p. 265).
Since the information was thus provided in full, the appeal against the decision was also to be dismissed in this respect.
3.3.3. Regarding the common electronic format:
Article 12(3), fourth sentence, GDPR provides – as the appellant correctly argues – that a data subject who submits their application electronically must, where possible, be informed electronically unless they specify otherwise (see also ECJ 04.05.2023, C-487/21, Austrian Data Protection Authority, para. 52).
The data controller submitted his request for information electronically, but stated that he was unable to conduct secure email communication. He therefore expressly insisted on receiving the information by registered mail. He also sent the data controller a blank DVD-R so that they could transfer the information to it and return it to him by mail.
The data controller generally provides information electronically via free file download from the XXXX account. However, the data controller unequivocally stated that he insisted on delivery by post – and thus on paper – and thereby indicated "other" within the meaning of Article 12(3), sentence 4 of the GDPR. Article 12 of the GDPR does not impose an obligation on the data controller to provide data subjects with physical data carriers or to use data carriers provided by them. The data controller therefore had a reasonable electronic means of providing the data controller with the information, which he nevertheless rejected. As requested, the data controller received the information by registered mail. The use of the DVD-R provided by the data controller was therefore unnecessary. The data controller generally provides information electronically via free file download from account number 40. However, the data controller unequivocally insisted on delivery by post – and thus on paper – and thereby indicated "other" within the meaning of Article 12, paragraph 3, sentence 4 of the GDPR. An obligation for the data controller to provide data subjects with physical data carriers or to use data carriers provided by them cannot be derived from Article 12 of the GDPR. The data controller thus had a reasonable electronic means of providing the data controller with information, which the data controller, however, rejected. As requested, the data controller received information by registered mail. The use of the DVD-R provided by the data controller was therefore unnecessary.
The data controller's argument that the data controller wanted to prevent the information from being compared or searched by keywords by sending it on paper is equally unfounded. In the case of information requests under Article 15 GDPR, the possibility of further processing is not required – unlike with the right to data portability under Article 20 GDPR (see Haidinger in Knyrim, DatKomm Art. 15 GDPR, para. 21). The appellant's argument that the MP wanted to prevent the information from being comparable or searched by keywords by providing it on paper is also unfounded. In the case of information requests under Article 15 GDPR, the possibility of further processing is not required – unlike with the right to data portability under Article 20 GDPR (see Haidinger in Knyrim, DatKomm Art. 15 GDPR, para. 21).
The appeal against the decision was therefore to be dismissed.
3.4. The decision was therefore to be rendered accordingly.
3.5. Pursuant to Section 24 Paragraph 1 of the Administrative Court Procedure Act (VwGVG), the Administrative Court must hold a public oral hearing upon request or, if it deems it necessary, ex officio. Pursuant to Section 24, paragraph 1, of the Administrative Court Procedure Act (VwGVG), the Administrative Court must hold a public oral hearing upon request or, if it deems it necessary, ex officio.
Pursuant to Section 24, paragraph 4, of the VwGVG, the Administrative Court may—unless otherwise provided by federal or state law—dispense with a hearing, irrespective of a party's request, if the case file indicates that an oral hearing would not provide any further clarification of the case, and neither Article 6, paragraph 1, of the European Convention on Human Rights (ECHR) nor Article 47 of the Charter of Fundamental Rights of the European Union (CFR) precludes dispensing with a hearing.
Pursuant to Section 24, paragraph 4, of the VwGVG, unless otherwise provided by federal or state law, the Administrative Court may, irrespective of a party's request, dispense with a hearing if the case file indicates that an oral hearing would not provide any further clarification of the case, and neither Article 6, paragraph 1, of the ECHR nor Article 47 of the Charter of Fundamental Rights of the European Union (CFR) precludes dispensing with a hearing. The oral hearing was unnecessary because the facts essential for the legal assessment had already been fully and properly established by the administrative authority in a formal investigation and, at the time of the court's decision, still possessed the legally required relevance and completeness. The appeal also did not allege any relevant facts that contradicted or went beyond the outcome of the administrative investigation (Austrian Administrative Court [VwGH] 24.02.2015, Ra 2014/19/0171). The appellant's arguments regarding the incompleteness of the information, which he justified by the necessity of providing copies or the inaccuracy of certain details, as well as his arguments regarding the method of transmission, are directed against the authority's legal assessment, but not against the facts relevant to the decision.
The appellant's arguments regarding the incompleteness of the information, which he justified with the necessity of providing copies or the inaccuracy of certain details, as well as his arguments regarding the method of transmission, are directed against the legal assessment of the authority, but not against the facts relevant to the decision.
... The Federal Administrative Court must therefore rule exclusively on a question of law in this case (see ECtHR 20 June 2013, Application No. 24510/06, Abdulgadirov/AZE, paras. 34 et seq.). Neither Article 6(1) ECHR nor Article 47 of the Charter of Fundamental Rights precludes the dispensation of a hearing.
The Federal Administrative Court must therefore rule exclusively on a question of law in this case (see ECtHR 20 June 2013, Application No. 24510/06, Abdulgadirov/AZE, paras. 34 et seq.). Neither Article 6(1) ECHR nor Article 47 of the Charter of Fundamental Rights precludes the dispensation of a hearing. Regarding point B) Inadmissibility of the appeal:
Pursuant to Section 25a Paragraph 1 of the Administrative Court Act (VwGG), the Administrative Court must state in the operative part of its judgment or decision whether the appeal is admissible under Article 133 Paragraph 4 of the Federal Constitutional Law (B-VG). This statement must be briefly reasoned.
The appeal is inadmissible under Article 133 Paragraph 4 of the Federal Constitutional Law (B-VG) because the decision does not depend on the resolution of a legal question of fundamental importance. With regard to the interpretation of Article 15 GDPR relevant in this specific case, the court was able to rely on the cited case law of the Court of Justice of the European Union (CJEU). Regarding past violations of the right to information and the "substance" of the appeal proceedings, the court was able to rely on the cited case law of the Austrian Administrative Court (VwGH). The appeal on points of law is inadmissible pursuant to Article 133, paragraph 4, of the Austrian Federal Constitutional Law (B-VG) because the decision does not depend on the resolution of a legal question of fundamental importance. With regard to the interpretation of Article 15 GDPR relevant in this specific case, the court was able to rely on the cited case law of the European Court of Justice (ECJ). Regarding past violations of the right to information and the "substance" of the appeal proceedings, the court was able to rely on the cited case law of the Austrian Administrative Court (VwGH).
