BVwG - W252 2289522-1
From GDPRhub
| BVwG - W252 2289522-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 4(1) GDPR Article 4(7) GDPR Article 5 GDPR Article 6(1)(f) GDPR Article 6(1)(c) GDPR Article 6(1)(a) GDPR Article 6(1)(e) GDPR Article 7 GDPR |
| Decided: | 23.04.2026 |
| Published: | 02.06.2026 |
| Parties: | MP (Data subject) BF (controller) |
| National Case Number/Name: | W252 2289522-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2026:W252.2289522.1.00 |
| Appeal from: | DSB (Austria) |
| Appeal to: | Not appealed |
| Original Language(s): | German |
| Original Source: | RIS (in German) |
| Initial Contributor: | Ava Lang |
A court held that a public broadcaster violated a caller's right to confidentiality by recording a service-line call without a valid legal basis under Article 6 GDPR.
English Summary
Facts
In December 2023, callers to a service telephone number operated by a public broadcaster (the controller) heard an automated message stating that calls were recorded and could also be broadcast.
Several times during December 2023, the data subject called the service number. The controller recorded the call.
On 12 December 2023 and again on 18 December 2023, the data subject complained to the DPA that the controller recorded calls without obtaining consent.
The controller argued that the recordings formed part of its statutory quality-assurance obligations. It relied on national legislation requiring it to maintain a quality-assurance system and submitted that the recordings supported that objective. During the proceedings, it also stated that it would adapt its system so that future callers could prevent or interrupt recordings.
The DPA upheld the complaint and found that the recording violated the data subject's right to confidentiality. The controller appealed to the Federal Administrative Court.
Holding
First, the court held that the recording constituted processing of personal data and that the broadcaster acted as controller under Article 4(7) GDPR.
Second, the court rejected the broadcaster's reliance on Article 6(1)(c) GDPR. Although national law required the broadcaster to operate a quality-assurance system, the court found that those provisions did not impose a sufficiently specific legal obligation to record callers. Recording service-line calls was not necessary to fulfil the statutory quality-assurance requirements, which could be achieved through other measures such as representative audience surveys, studies and audience consultations.
Third, the court rejected using Article 6(1)(e) GDPR as a basis. While the broadcaster's quality-assurance activities served a task in the public interest, recording callers was not necessary for carrying out that task because less intrusive alternatives were available.
Fourth, the court rejected Article 6(1)(f) GDPR. The court accepted that the broadcaster had a legitimate interest in maintaining and improving the quality of its public-service activities. However, it found that recording callers was not necessary for achieving that objective. Referring to the principle of data minimisation in Article 5(1)(c) GDPR, the court held that the same purpose could be achieved through less intrusive methods.
Finally, the court rejected Article 6(1)(a) GDPR. The court noted that consent requires an active indication of agreement and that the controller must be able to demonstrate it under Article 7(1) GDPR. The fact that the data subject called the service number again after hearing the recording notice did not constitute valid consent. The broadcaster failed to prove that the data subject had actively agreed to the recording.
The court therefore upheld the DPA's decision and held that the recording lacked a valid legal basis under Article 6 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Decision Date April 23, 2026 Legal Norm Federal Constitutional Law (B-VG) Art. 133 para. 4 General Data Protection Regulation (GDPR) Art. 4 no. 1 General Data Protection Regulation (GDPR) Art. 4 no. 7 General Data Protection Regulation (GDPR) Art. 5 General Data Protection Regulation (GDPR) Art. 6 para. 1 lit. a General Data Protection Regulation (GDPR) Art. 6 para. 1 lit. c General Data Protection Regulation (GDPR) Art. 6 para. 1 lit. f General Data Protection Regulation (GDPR) Art. 7 Federal Constitutional Law (B-VG) Art. 133 currently in force; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019 to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019, last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 133 valid from May 25, 2018 to December 31, 2018, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 valid from 01.08.2014 to 24.05.2018, last amended by BGBl. I No. 164/2013; B-VG Art. 133 valid from 01.01.2014 to 31.07.2014, last amended by BGBl. I No. 51/2012; B-VG Art. 133 valid from 01.01.2004 to 31.12.2013, last amended by BGBl. I No. 100/2003; B-VG Art. 133 valid from 01.01.1975 to 31.12.2003, last amended by BGBl. No. 444/1974; B-VG Art. 133 valid from 25.12.1946 to December 31, 1974, last amended by Federal Law Gazette No. 211/1946. Federal Constitutional Law, Article 133, valid from December 19, 1945, to December 24, 1946, last amended by State Law Gazette No. 4/1945. Federal Constitutional Law, Article 133, valid from January 3, 1930, to June 30, 1934. Ruling W252 2289522-1/9E IN THE NAME OF THE REPUBLIC! The Federal Administrative Court, through Judge Elisabeth Schmut, LL.M., has ruled... The Federal Administrative Court, with Judge Elisabeth Schmut LL.M. presiding and lay judges Dr. Claudia Rosenmayr-Klemenz and Adriana Mandl, MA, as associate judges, has ruled in a non-public session on the appeal of [Name Redacted], represented by Schönherr Rechtsanwälte GmbH, against the decision of the Data Protection Authority dated March 4, 2024, file number [File Number Redacted], in a data protection matter, as follows: A) The appeal is dismissed. B) An appeal on points of law is not permitted. Text Reasons for the Decision: I. Procedural History: 1. By submission dated December 12, 2023, the now-participating party (hereinafter referred to as MP) filed a data protection complaint with the respondent authority, stating in summary that when it called a specific telephone number of the complaining party (hereinafter referred to as BF), a recorded message played informing it that the call was being recorded and could also be broadcast. 2. On December 13, 2023, the respondent authority issued MP with a request to rectify the deficiencies. 3. By letter dated December 18, 2023, MP explained that it had made a call on December 18, 2023, that this call had been recorded without consent and could be broadcast without consent, and that a corresponding message had played before the recording began. 4. By letter dated January 18, 2024, the BF submitted a statement. 5. By letter dated January 24, 2024, the MP also submitted a statement. 6. By decision dated March 4, 2024, the respondent authority upheld the data protection complaint and determined that the BF had violated the MP's right to confidentiality by calling the BF's service number at 4:35 p.m. on December 18, 2023, and the BF unlawfully recording the MP's telephone conversation. 5. The BF filed an appeal against this decision. 6. The respondent authority dismissed the appeal, attaching the administrative act, by letter dated April 2, 2024. Received on April 3, 2024, the appellant filed a complaint and, referring to the reasoning of the contested decision, requested that the appeal be dismissed. Evidence was gathered by reviewing the administrative and court files. II. The Federal Administrative Court considered the following: 1. Findings: 1.1. The BF operates, among other things, the transmitter XXXX. The BF offers the public a specified service number for contacting XXXX. 1.1. The BF operates, among other things, the transmitter 40. The BF offers the public a specified service number for contacting 40. 1.2. At the beginning of a call to the aforementioned service number in December 2023, an automated message was played indicating that the call was being recorded and could also be broadcast. 1.3. The MP called this service number on December 18, 2023. This call was recorded. 1.4. During the proceedings before the respondent authority, the BF stated that the corresponding message would be adapted so that future call recordings could be prevented or interrupted. 1.5. The BF's quality assurance system dated September 15, 2022, forms the basis for these findings. The relevant excerpt reads as follows: "XXXX Representative Survey" Roman numeral 40 Representative Survey A representative survey is used to determine audience satisfaction with XXXX and its programming and content offerings. Since 2003, the method of a comprehensive survey has been employed. This ensures continuity and allows for long-term, comparable audience evaluations on a representative basis. The survey determines the level of general interest in the program areas of information, entertainment, culture, and sports across television, radio, teletext, and the internet, as well as satisfaction with XXXX's offerings in these program areas. A representative survey is used to determine audience satisfaction with XXXX and its programming and content offerings. Since 2003, the method of a comprehensive survey has been employed. This ensures continuity and allows for long-term, comparable audience evaluations on a representative basis. The survey determines the level of general interest in the program areas of information, Entertainment, culture, and sports across television, radio, teletext, and the internet, as well as satisfaction with the offerings in these program areas. (...) Audience and expert discussions Audience and expert discussions are a qualitative measure of XXXX quality assurance. Annually, based on the requirements of the XXXX core mission and the XXXX program guidelines, the content areas of information, culture/religion, sports, entertainment, and science/education/life skills are addressed across television, radio, teletext, and the internet and reviewed through external feedback from the audience and experts. and reviewed by experts. Public Discussions As part of public discussions, the XXXX invites selected audience groups to participate in structured group discussions. These discussions, held in dialogue with representatives of the XXXX committees or program managers, allow them to express their views on various program measures and to identify their requirements for the XXXX. This provides information and insights regarding the acceptance of the XXXX and, if necessary, its further development. Furthermore, audience engagement is actively fostered, and the demand for audience proximity and participation is met. The Roman numeral 40 invites selected audience groups to participate in structured group discussions. These discussions, held in dialogue with representatives of the Roman numeral 40 committees or program managers, allow them to express their views on various program measures and to identify their requirements for the Roman numeral 40. This provides information and insights regarding the acceptance of the Roman numeral 40 and its further development. Furthermore, audience engagement is actively fostered, and the demand for audience proximity and participation is met. fulfilled. Expert Discussions Expert discussions, in their form as moderated group events, represent a measure to deepen the dialogue between program representatives and experts in the respective subject area. This provides ample opportunity for the expertise and opinions of scientists and experts involved in the respective topic. (...) 2. Evaluation of Evidence: 2.1. The findings in 1.1. are based on the uncontested contents of the file. They are undisputed. 2.2. The findings in 1.2. are based on the uncontested submissions of the Member of Parliament (see the letter from the Member of Parliament dated December 12, 2023, in conjunction with the letter from the Member of Parliament dated December 18, 2023). 2.2. The findings in 1.2. The findings in section 1.3 are based on the uncontested submissions of the Member State Authority (see the letter from the Member State Authority dated December 12, 2023, in conjunction with the letter from the Member State Authority dated December 18, 2023). 2.3. The findings in section 1.3 are based on the letter from the Member State Authority dated December 18, 2023. The defendant was unable to demonstrate that the call on December 18, 2023, was not recorded. 2.4. The findings in section 1.4 are based on the submissions of the defendant (see the letter from the defendant dated January 18, 2024). 2.5. The findings in section 1.5 are based on the defendant's quality assurance system dated September 15, 2022 (available at XXXX, last accessed on March 18, 2026). The following information is derived from the BF's quality assurance system dated September 15, 2022 (available at Roman numeral 40, last accessed on March 18, 2026). 3. Legal Assessment: Regarding A) The admissible appeal is unfounded. 3.1. Subject Matter of the Appeal: The subject matter of the appeal is derived from the ruling in conjunction with point B (Subject Matter of the Appeal) of the contested decision. The respondent authority ruled on the question of whether there was a violation of the right to confidentiality concerning the recording of the MP's call on December 18, 2023. The subject matter of the appeal is derived from the ruling in conjunction with point B (Subject Matter of the Appeal) of the contested decision. The respondent authority ruled on the question of whether there was a violation of the right to confidentiality concerning the recording of the MP's call on December 18, 2023. It is immaterial that the heading of the decision states that the respondent authority is deciding on the data protection complaint filed by the Member of Parliament on December 12, 2023. Based on the reasoning provided in the decision, there is no doubt that the respondent authority ruled on the alleged violation of rights on December 18, 2023. In summary, the reasoning states that the Member of Parliament, through her letter of December 18, 2023, effected a change in the facts of the case and thus a change in the nature of the application. The respondent authority correctly interprets the decision as a tacit withdrawal of the application of December 12, 2025, coupled with the simultaneous submission of a new application (see Austrian Administrative Court [VwGH] February 16, 2017, Ra 2016/05/0026, para. 48). It is immaterial that the header of the decision states that the respondent authority is deciding on the data protection complaint filed by the Member of Parliament (MP) on December 12, 2023. Based on the grounds for the decision, there is no doubt that the respondent authority addressed the alleged violation of law on December 18, 2023. In summary, the grounds state that the MP, through its letter of December 18, 2023, effected a change in the facts and thus a change in the nature of the application. The respondent authority correctly interprets the application of December 12, 2025, as a tacit withdrawal of the application submitted on December 12, 2025, while simultaneously filing a new application (see Austrian Administrative Court [VwGH] decision of February 16, 2017, Ra 2016/05/0026, para. 48). 3.2. Applicability of the GDPR: It is undisputed that personal data within the meaning of Article 4(1) GDPR were processed in this case and that the GDPR applies. No circumstances have emerged during the proceedings that would preclude the applicability of the GDPR. It has not been disputed that the applicant is the controller within the meaning of Article 4(7) GDPR for the data processing in question. It is undisputed that personal data within the meaning of Article 4(1) GDPR were processed in this case and that the GDPR applies. No circumstances have emerged during the proceedings that would preclude the applicability of the GDPR. It was not disputed that BF is the data controller within the meaning of Article 4, point 7, GDPR for the data processing in question. 3.3. Regarding the lawfulness of processing: In particular, all processing of personal data must comply with the principles for the processing of such data set out in Article 5 of this Regulation and meet the legal requirements listed in Article 6 of the Regulation (see CJEU 03.04.2025, C-710/23, Ministerstvo zdravotnictví (Data relating to a legal person's representative), paragraph 33). 3.3.1. Regarding Article 6(1)(c) GDPR: 3.3.1. Regarding Article 6, paragraph 1, letter c, GDPR: According to Article 6, paragraph 1, letter c, GDPR, processing is lawful if it is necessary for compliance with a legal obligation to which the controller is subject. According to Article 6, paragraph 3, GDPR, this always requires an additional legal provision in Union law or the law of the Member State that establishes a legal obligation to process the data. The legal obligation must relate directly to the data processing. Contractual agreements are excluded; processing based on a contractual obligation is to be assessed according to Article 6, paragraph 1, letter b (see Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Art 6 GDPR, para. 39). According to Article 6, paragraph 1, letter c, GDPR, processing is lawful if it is necessary for compliance with a legal obligation to which the controller is subject. According to Article 6, paragraph 3, GDPR, this always requires an additional legal provision in Union law or the law of the Member State that establishes a legal obligation to process the data. The legal obligation must relate directly to the data processing. Contractual agreements are excluded; processing based on a contractual obligation is to be assessed according to Article 6, paragraph 1, letter b (see Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Article 6, GDPR, para. 39). Applied to the present case, this means: In its appeal against the decision, the applicant argues that the data processing in question is covered by Article 6, paragraph 1, letter c GDPR due to the provisions in Section 4a XXXX, since Section 4a XXXX establishes a legal obligation within the meaning of the GDPR. Article 6(1)(c) GDPR. In its appeal against the decision, the BF argues that the data processing in question is covered by Article 6(1)(c) GDPR due to the provisions in Section 4a, Roman numeral 40, since Section 4a, Roman numeral 40 constitutes a legal obligation within the meaning of Article 6(1)(c) GDPR. Section 4a(1) and (2) XXXX stipulates that the Director General must establish a quality assurance system, which requires the approval of the Board of Trustees. Section 4a(1) and (2) XXXX stipulates that the Director General must establish a quality assurance system, which requires the approval of the Board of Trustees. According to Section 4a(5) XXXX, the quality assurance system must include continuous, representative, and qualitative audience monitoring, with the involvement of external experts from the respective fields, to verify audience satisfaction with the programming and content. To establish and regularly revise the criteria for ensuring balance and consideration of the diverse interests of listeners and viewers, the results of regularly conducted, representative participant surveys by recognized market research institutes independent of XXXX or its subsidiaries, or representative studies and surveys by professionally qualified institutions, must be taken into account. According to Section 4a, Paragraph 5, Roman numeral 40, the audience's satisfaction with the program and content offerings must be verified within the framework of the quality assurance system through continuous, representative, and qualitative audience monitoring with the involvement of external experts from the respective fields. To establish and regularly revise the criteria for ensuring balance and consideration of the diverse interests of listeners and viewers, the results of regularly conducted, representative participant surveys by recognized market research institutes independent of XXXX or its subsidiaries, or representative studies and surveys by professionally qualified institutions, must be taken into account. ... Like the respondent authority, the adjudicating panel also does not see that Section 4a XXXX establishes a legal obligation within the meaning of Article 6(1)(c) GDPR that would justify the data processing in question. Similarly, the adjudicating panel does not see that Section 4a, Roman numeral 40, establishes a legal obligation within the meaning of Article 6(1), letter c, GDPR that would justify the data processing in question. If one reduces Section 4a(5) XXXX to its relevant content, it must be noted that "[i]n the framework of the quality assurance system (...) the satisfaction of the audience with the program and content offerings [must] be reviewed." No sufficiently concrete legal obligation can be derived from this passage that would justify data processing such as that at issue here. If we analyze Section 4a, Paragraph 5, Roman numeral 40, in its relevant context, it states that "[i]n the framework of the quality assurance system (...) the audience's satisfaction with the program and content offerings must be reviewed." This passage does not establish a sufficiently concrete legal obligation to justify data processing such as that in question. Even assuming a processing obligation arising from Section 4a, Paragraph 5 XXXX, the processing in this case would not have been necessary. Legal scholars argue that the requirement of necessity under Article 6(1)(c) GDPR is even stricter than under Article 6(1)(b) GDPR (Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Art 6 GDPR, para. 39). Even assuming a processing obligation arising from Section 4a, Paragraph 5, Roman numeral 40, the processing in this case would not have been necessary. The prevailing view in legal literature is that the requirement for data processing under Article 6(1)(c) GDPR is even stricter than under Article 6(1)(b) GDPR (Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Article 6 GDPR, para. 39). The quality assurance system of BF, relevant at the time of the alleged infringement, does not provide for the recording of telephone callers to service numbers for the purpose of quality assurance as stipulated in Section 4a XXXX. Instead, the quality assurance system is to be implemented through continuous, representative, and qualitative audience monitoring. It follows that quality assurance measures should not rely solely on active calls from listeners to the service number, but should also consider, in particular, the results of regularly conducted, representative participant surveys by accredited market research institutes independent of BF or its subsidiaries, representative studies and surveys by professionally qualified institutions, audience and expert interviews, etc. The BF's quality assurance system relevant at the time of the alleged infringement does not provide for the recording of callers to service numbers for quality assurance purposes, as stipulated in Section 4a, Roman numeral 40. Rather, the quality assurance system is to be implemented through continuous, representative, and high-quality audience monitoring. It follows that quality assurance should not rely solely on active calls from listeners to the service number, but should also take into account the results of regularly conducted, representative participant surveys by recognized market research institutes independent of BF or its subsidiaries, representative studies and surveys by professionally qualified institutions, audience and expert discussions, etc. The omission of the data processing in question does not prevent BF from carrying out efficient and effective quality assurance in accordance with the requirements of Section 4a XXXX. This is demonstrated by BF's declaration of change, announced during the official proceedings and noted under point 1.4, that such quality assurance will continue to be guaranteed in the future. For these reasons as well, the data processing in question is not necessary. The processing cannot therefore be based on Article 6(1)(c) GDPR. 3.3.2. Regarding Article 6(1)(e) GDPR: The legal basis for processing personal data under Article 6(1)(e) GDPR is a classic legal basis for the processing of personal data by public authorities or bodies. For Article 6(1)(e) to be applicable, the data processing must be necessary for a task carried out in the public interest or in the exercise of official authority. In both cases, it is a prerequisite that the processing is necessary for the performance of the respective task (Bergauer/Gosch, Datenschutzrecht [Data Protection Law] (2024), p. 135). The legal basis for processing personal data under Article 6(1)(e) GDPR is a classic legal basis for the processing of personal data by public authorities or bodies. For Article 6(1)(e) to be applicable, the data processing must be necessary for a task carried out in the public interest or in the exercise of official authority. In both cases, the processing must be necessary for the performance of the respective task (Bergauer/Gosch, Datenschutzrecht [Data Protection Law] (2024), p. 135). Applied to the present case, this means: The BF argued that the data processing in question is necessary for the performance of a task carried out in the public interest. This is correct insofar as the obligation to establish a quality assurance system (§ 4a XXXX) constitutes a legal requirement that is in the public interest. However, the data processing in question cannot be based on Article 6(1)(e) GDPR, as the recording of telephone calls to service numbers for the purpose of quality assurance is not necessary for the BF. The data processing in question cannot be based on Article 6(1)(e) GDPR, as recording calls to service numbers is not necessary for BF's quality assurance purposes. As already explained with regard to Article 6(1)(c) GDPR, the data processing in question was not necessary due to less intrusive alternatives. As already explained with regard to Article 6(1)(c) GDPR, the data processing in question was not necessary due to less intrusive alternatives. Therefore, the processing cannot be based on Article 6(1)(e) GDPR. The processing cannot be based on Article 6(1)(e) GDPR. Regarding Article 6(1)(f) GDPR: The processing of personal data pursuant to Article 6(1)(f) GDPR is lawful under three cumulative conditions: First, the controller or a third party must pursue a legitimate interest; second, the processing of personal data must be necessary for the purposes of that legitimate interest; and third, the interests or fundamental rights and freedoms of the data subject whose data is to be protected must not override the legitimate interests of the controller or a third party. In the absence of a definition of the term "legitimate interest" in the GDPR, a broad range of interests can, in principle, be considered legitimate. Regarding the second requirement, the necessity of processing personal data for the purposes of pursuing the legitimate interest, it must be examined whether the legitimate interest in processing the data can be achieved just as effectively by other means that are less intrusive on the fundamental rights and freedoms of the data subjects. Such processing must, however, remain within the bounds of what is strictly necessary to achieve this legitimate interest. In this context, it should also be noted that the requirement of necessity for data processing must be examined in conjunction with the principle of data minimization, enshrined in Article 5(1)(c) GDPR, which requires that personal data be adequate, relevant, and limited to what is necessary for the purposes for which they are processed (see CJEU 09.01.2025, C-394/23, Mousse, paras. 45 et seq.). The processing of personal data pursuant to Article 6(1)(f) of the GDPR is lawful under three cumulative conditions: First, the controller or a third party must pursue a legitimate interest; second, the processing of personal data must be necessary for the purposes of that legitimate interest; and third, the interests or fundamental rights and freedoms of the data subject whose data are to be protected must not override the legitimate interests of the controller or a third party. In the absence of a definition of the term "legitimate interest" in the GDPR, a wide range of interests can, in principle, be considered legitimate. Regarding the second condition, the necessity of processing personal data for the purposes of pursuing the legitimate interest, it must be examined whether the legitimate interest in processing the data can be achieved just as effectively by other means that are less intrusive on the fundamental rights and freedoms of the data subjects, provided that such processing remains within the bounds of what is strictly necessary for the purposes of pursuing that legitimate interest. In this context, it should also be noted that the requirement of necessity for data processing must be examined in conjunction with the principle of data minimization, which is enshrined in Article 5(1)(c) of the GDPR and requires that personal data be adequate, relevant, and limited to what is necessary for the purposes for which they are processed (see CJEU 09.01.2025, C-394/23, Mousse, para. 45 et seq.). Applied to the present case, this means: The applicant's argument is valid insofar as it states in its appeal against the decision that the applicant has a legitimate interest in maintaining and ensuring the quality of its legally mandated core public-law task (and the associated data processing). The applicant's argument is valid insofar as it states in its appeal against the decision that the applicant has a legitimate interest in maintaining and ensuring the quality of its legally assigned core public-law mandate (and in the associated data processing). ``` ``` ```` ``` `` `` `` `` ` 1. `` `` `) `` `` `` `) ... the data processing associated with it is valid in the present case. ```` However, due to the lack of necessity for the data processing in question, the BF cannot rely on Article 6(1)(f) GDPR either: The processing is not necessary for the performance of the BF's quality assurance tasks, as already explained regarding Article 6(1)(c) GDPR. However, due to the lack of necessity for the data processing in question, the BF cannot rely on Article 6(1)(f) GDPR either: The processing is not necessary for the performance of the BF's quality assurance tasks, as already explained regarding Article 6(1)(c) GDPR. Therefore, the processing cannot be based on Article 6(1)(f) GDPR. The processing cannot be based on Article 6(1)(f) GDPR. The processing therefore cannot be based on Article 6(1)(f) GDPR. Regarding Article 6(1)(a) GDPR: According to Article 6(1)(a) GDPR, processing is lawful if the data subject has given consent to the processing of their personal data for one or more specific purposes. According to Article 7(1) GDPR, where processing is based on consent, the controller must be able to demonstrate that the data subject has consented to the processing of their personal data. According to Article 7(1) GDPR, where processing is based on consent, the controller must be able to demonstrate that the data subject has consented to the processing of their personal data. According to the case law of the European Court of Justice, Article 6(1)(a) GDPR requires active consent (see ECJ 01.10.2019, C-673/17, Planet49, para. 60 et seq.). Applied to the present case, this means: The plaintiff argued for the first time in its appeal against the decision that the data processing in question was also lawful under Article 6(1)(a) GDPR. The plaintiff asserted that the MP had acted "with an obvious intention to consent" during its second call on December 18, 2023. In this regard, reference should be made to the aforementioned case law of the European Court of Justice, according to which data protection consent must be given "actively." Neither does such consent emerge from the established facts, nor could the plaintiff demonstrate such consent within the meaning of Article 7(1) GDPR. The mere fact that the MP called the service number in question again does not constitute an active act of consent. In this regard, reference should be made to the aforementioned case law of the European Court of Justice, according to which data protection consent must be given "actively." Neither does such consent arise from the established facts, nor could the BF demonstrate such consent within the meaning of Article 7, paragraph 1, GDPR. The mere fact that the MP called the service number in question again does not constitute an active act of consent. 3.4. Conclusion: As the respondent authority correctly stated, the BF failed to demonstrate compliance with the principles for the processing of personal data within the framework of its accountability obligation pursuant to Article 5, paragraph 2, GDPR. As the respondent authority correctly stated, the BF failed to demonstrate compliance with the principles for the processing of personal data within the framework of its accountability obligation pursuant to Article 5, paragraph 2, GDPR. The data processing in question was unlawful, and the respondent authority was therefore correct in its decision to determine a violation of the right to confidentiality under Section 1 Paragraph 1 of the Data Protection Act (DSG). The appeal against this decision was therefore dismissed. 3.5. Regarding the dispensing with an oral hearing: An oral hearing was deemed unnecessary because the facts essential to the legal decision had already been fully established by the administrative authority in a proper investigative procedure and, at the time of the court's decision, still possess the legally required relevance and completeness. Since these issues are purely legal and do not exhibit any particular complexity, a hearing was also unnecessary. In particular, it was not apparent how an oral hearing would have led to any further clarification of the case (cf. VwGH 19.10.2022, Ro 2022/04/0001, RS 5). Article 6(1) ECHR and Article 47 of the Charter of Fundamental Rights of the European Union did not preclude the dispensing with a hearing. Therefore, pursuant to Section 24(4) of the Administrative Court Procedure Act (VwGVG), an oral hearing could be dispensed with. An oral hearing could be dispensed with because the facts essential to the legal decision had already been fully established by the administrative authority in a proper investigative procedure and still possessed the legally required relevance and completeness at the time of the adjudicating court's decision. Since these issues are purely legal and do not exhibit any particular complexity, a hearing was also unnecessary. In particular, it was not apparent how an oral hearing would have led to further clarification of the case (see VwGH 19.10.2022, Ro 2022/04/0001, RS 5). The dispensing with the hearing was not precluded by Article 6, paragraph 1, of the ECHR or Article 47 of the Charter of Fundamental Rights. Therefore, pursuant to Section 24, paragraph 4, of the Administrative Court Procedure Act (VwGVG), the oral hearing could be dispensed with. Regarding B) Inadmissibility of the appeal: Pursuant to Section 25a, paragraph 1, of the Administrative Court Procedure Act (VwGG), the Administrative Court must state in the operative part of its judgment or decision whether the appeal is admissible pursuant to Article 133, paragraph 4, of the Federal Constitutional Law (B-VG). This statement must be briefly reasoned. This ruling requires a brief explanation. The appeal is inadmissible pursuant to Article 133, paragraph 4 of the Austrian Federal Constitutional Law (B-VG) because the decision does not depend on the resolution of a legal question of fundamental importance. The present decision neither deviates from the established case law of the Administrative Court nor is there a lack of relevant case law; furthermore, the existing case law of the Administrative Court cannot be considered inconsistent.
