BVwG - W256 2235360-1

BVwG - W256 2235360-1

Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 5(1)(a) GDPR Article 22(1) GDPR
Decided:	01.09.2025
Published:	05.09.2025
Parties:
National Case Number/Name:	W256 2235360-1
European Case Law Identifier:	ECLI:AT:BVWG:2025:W256.2235360.1.00
Appeal from:
Appeal to:	Unknown
Original Language(s):	German
Original Source:	RIS (in German)
Initial Contributor:	ap
A Court stated that an AI model developed by the Public Employment Service to predict jobseekers' future chances of integrating into the labour market had a valid legal basis under national law. Furthermore, it did not constitute automated decision-making due to the significant role the advisors had during the decision-making process.
English Summary

Facts

The Public Employment Service (the controller) is a body responsible for implementing the federal government’s labour market policy. The controller developed a model for calculating jobseekers’ labour market opportunities (“AMAS”), as a tool for advisors to use in assessing jobseekers’ labour opportunities. This model uses data subjects’ personal characteristics (e.g. age, gender, education, previous career) to predict their future chances of integrating into the labour market.
The controller planned on making its use mandatory from 2021 onwards. However, it also implemented measures to ensure that AMAS was used as a secondary opinion only; for example, advisors were trained to use AMAS and assess labour market opportunities independently. Advisors were also obliged to explain data subjects the conclusions reached by AMAS, and discuss any possible concerns.
The DPA initiated an ex officio investigation, and prohibited the controller from processing personal data using AMAS because the controller did not have a suitable legal basis. Furthermore, the processing was profiling within the meaning of Article 4(4) GDPR, and the prohibition of automated decision-making under Article 22 GDPR applied in any case.
The controller appealed the decision to the Federal Administrative Court (BVwG), who annulled the decision of the DPA. According to the BVwG, the controller is allowed to carry out this processing of personal data in accordance with national law. The DPA appealed the case to the Supreme Administrative Court (VwGH)^[1]. The VwGH stated that there was a possibility that AMAS constituted automated decision-making within the meaning of Article 22(1) GDPR. This was the task of the BVwG to investigate; according to the VwGH, the processing would be prohibited if there was automated decision-making unless the exceptions under Article 22(2) GDPR were met.
Holding

The Court first stated that AMAS engaged in profiling in accordance with Article 4(4) GDPR. The Court also clarified that the questions of lawfulness of processing under Article 6 and 9 GDPR must be separated from the question of prohibition of automated decision-making under Article 22 GDPR.
The Court assessed whether the value calculated by AMAS fell under the scope of automated decision-making, in accordance with Article 22(1) GDPR. The Court referred the CJEU’s reasoning in case C-634/21 (SCHUFA). In SCHUFA, the model used by the credit information agency was based solely on automated processing, as there was no evidence of significant human involvement. In addition, the CJEU stated that the score has a legal effect or significantly affects the data subject, as the value plays a decisive role in granting the data subject credit. The Court, however, stated that the present case was different to that in SCHUFA. The Court's investigations demonstrated that the advisors had a substantive role in the decision-making process, rather than a merely formal one. Furthermore, the Court stated that the controller implemented clear internal guidelines and measures to comply with them. Therefore, there the Court concluded that there was no automated decision-making. The Court saw no need to assess whether the decision had a legal effect or similarly significantly affected data subjects.
Finally, the Court stated there was no violation of Article 5(1)(a) GDPR, because the controller could rely on national law provisions as a legal basis for processing personal data.
The Court upheld the appeal, and revoked the decision by the DPA.
Comment

Share your comments here!
Further Resources

Share blogs or news articles here!
English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.
Decision Date

September 1, 2025

Standard

AMSG §1
AMSG §25
B-VG Art. 133 Para. 4
GDPR Art. 22
GDPR Art. 4 Z4
GDPR Art. 5 Para. 1 lit. a
GDPR Art. 5 Para. 1 lit. c
GDPR Art. 6
GDPR Art. 9
VwGVG §28 Para. 1
VwGVG §28 Para. 2

AMSG § 1 (current AMSG § 1) valid from July 1, 1994

AMSG § 25 (current AMSG § 25) valid from June 1, 2025, last amended by Federal Law Gazette I No. 20/2025. AMSG § 25 valid from May 25, 2018 to May 31, 2025, last amended by Federal Law Gazette I No. 32/2018. AMSG § 25 valid from 01.01.2014 to 24.05.2018 last amended by BGBl. I No. 138/2013 AMSG § 25 valid from 01.01.2014 to 31.12.2013 last amended by BGBl. I No. 3/2013 AMSG § 25 valid from 01.01.2014 to 31.08.2013 last amended by BGBl. I No. 71/2013 AMSG § 25 valid from 01.09.2013 to 31.12.2013 last amended by BGBl. I No. 138/2013 AMSG § 25 valid from 01.01.2012 to 31.08.2013 last amended by BGBl. I No. 122/2011 AMSG § 25 valid from January 1, 2008, to December 31, 2011, last amended by Federal Law Gazette I No. 104/2007 AMSG § 25 valid from January 1, 1998, to December 31, 2007, last amended by Federal Law Gazette I No. 148/1998 AMSG § 25 valid from January 1, 1997, to December 31, 1997, last amended by Federal Law Gazette No. 757/1996 AMSG § 25 valid from July 1, 1994, to December 31, 1996

B-VG Art. 133 now B-VG Art. 133 valid from January 1, 2019, to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017 B-VG Art. 133 valid from 01.01.2019 last amended by BGBl. I No. 22/2018 B-VG Art. 133 valid from 25.05.2018 to 31.12.2018 last amended by BGBl. I No. 22/2018 B-VG Art. 133 valid from 01.08.2014 to 24.05.2018 last amended by BGBl. I No. 164/2013 B-VG Art. 133 valid from 01.01.2014 to 31.07.2014 last amended by BGBl. I No. 51/2012 B-VG Art. 133 valid from 01.01.2004 to 31.12.2013 last amended by BGBl. I No. 100/2003 B-VG Art. 133 valid from 01.01.1975 to 31.12.2003 last amended by BGBl. No. 444/1974 B-VG Art. 133 valid from 25.12.1946 to 31.12.1974 last amended by BGBl. No. 211/1946 B-VG Art. 133 valid from 19.12.1945 to 24.12.1946 last amended by StGBl. No. 4/1945 B-VG Art. 133 valid from January 3, 1930 to June 30, 1934

VwGVG § 28 now VwGVG § 28 valid from January 1, 2019, last amended by Federal Law Gazette I No. 138/2017 VwGVG § 28 valid from January 1, 2014 to December 31, 2018

VwGVG § 28 now VwGVG § 28 valid from January 1, 2019, last amended by Federal Law Gazette I No. 138/2017 VwGVG § 28 valid from January 1, 2014 to December 31, 2018

Ruling

W256 2235360-1/36E

IN THE NAME OF REPUBLIC!

The Federal Administrative Court, with Judge Caroline Kimm presiding, Dr. Claudia ROSENMAYR-KLEMENZ, an expert lay judge, and Adriana MANDL, an expert lay judge, as assessors, has rightly ruled on the appeal filed by the Public Employment Service (AMS), represented by Brauneis Klauser Prändl Rechtsanwälte GmbH, Bauernmarkt 2, 1010 Vienna, against the Data Protection Authority's decision of August 16, 2020, Ref. No. DSB-D213.1020, 2020-0.513.605, after conducting a public oral hearing:

A) The appeal is upheld pursuant to Section 28, Paragraphs 1 and 2 of the Administrative Court Act (VwGVG), and the decision is rescinded without replacement.

B)       The appeal is inadmissible pursuant to Article 133, paragraph 4, of the Federal Constitutional Law. B)       The appeal is inadmissible pursuant to Article 133, paragraph 4, of the Federal Constitutional Law.

Text

Reasons for the decision:

I.       Procedure in Rome. Procedure

By letter dated March 10, 2020, the respondent authority informed the complainant (see Administrative Court, December 21, 2023, Ro 2021/04/0010, para. 2) that it had taken its intention to calculate the labor market prospects of job seekers using a mathematical model (known in the media as the "AMS algorithm") as an opportunity to initiate an ex officio review procedure pursuant to Article 57 (1) (h) in conjunction with Article 58 (1) (b) and (2) (a) GDPR in conjunction with Section 22 (1) DSG. The complainant was requested to answer the questions outlined in more detail and to submit a statement. By letter dated March 10, 2020, the respondent authority informed the complainant (see VwGH, December 21, 2023, Ro 2021/04/0010, para. 2) that it had taken its plan to calculate the labor market opportunities of job seekers using a mathematical model (known in the media as the "AMS algorithm") as an opportunity to initiate an ex officio review procedure pursuant to Article 57, paragraph 1, letter h, in conjunction with Article 58, paragraph 1, letter b and paragraph 2, letter a, GDPR in conjunction with Section 22, paragraph 1, DSG. The complainant was requested to answer the questions outlined in more detail and to submit a statement.

The complainant complied with this request by letter dated August 11, 2020, simultaneously submitting various documents relating to the project in question, the "Labor Market Opportunities Assistance System" (hereinafter: AMAS). Specifically, an excerpt from the Federal Public Employment Service's guideline "Core Process Supporting Workforces" (GZ: XXXX , valid from January 1, 2020, with a transition period for AMAS until July 1, 2020) and an AMAS manual were submitted. The complainant complied with this request in a letter dated August 11, 2020, simultaneously submitting various documents relating to the project in question, "Labor Market Opportunities Assistance System" (hereinafter: AMAS). Specifically, an excerpt from the Federal Public Employment Service's guideline "Core Process Supporting Workforces" (GZ: roman 40 , valid from January 1, 2020, with a transition period for AMAS until July 1, 2020) and an AMAS manual were submitted.

The contested decision, in paragraph I, prohibited the complainant from "processing data in connection with the determination of labor market opportunities for job seekers with the aid of the Labor Market Opportunities Assistance System (AMAS), effective from January 1, 2021, unless a suitable legal basis for the data processing exists by that date." The decision, in paragraph II, excluded the suspensive effect of any timely and admissible appeal. The decision, in paragraph Roman one, prohibited the complainant from "processing data in connection with the determination of labor market opportunities for job seekers with the aid of the Labor Market Opportunities Assistance System (AMAS), effective from January 1, 2021, unless a suitable legal basis for the data processing exists by that date." The decision, in paragraph Roman II, excluded the suspensive effect of any timely and admissible appeal.

In its decision, the authority concerned stated that, with the assistance of AMAS, data processing was carried out within the scope of the performance of the public tasks assigned to the complainant pursuant to Section 1 Paragraph 1 AMSG. According to Section 1 Paragraph 2 DSG, a public authority requires that its data processing be based on sufficiently specific statutory authorization. Sections 29 and 31 Paragraph 5 AMSG only generally define the complainant's objective and the performance of its tasks, but do not authorize data processing. The data processing in question constituted profiling within the meaning of Article 4(4) GDPR, which created "informational added value," to which explicit reference must be made in the law. The data processing in question could not be based on any suitable statutory basis. Furthermore, this constituted a case of Article 22 GDPR, namely an automated individual decision. It must be acknowledged that the final decision rested with the complainant's advisors based on internal guidelines. However, it cannot be ruled out that in "individual cases" the decision may be based solely on profiling. In its decision, the authority concerned stated that, with the assistance of AMAS, data processing was carried out within the scope of the performance of the public tasks assigned to the complainant pursuant to paragraph 1, section 1, AMSG. According to paragraph 1, section 2, DSG, a public authority must base its data processing on a sufficiently specific legal authorization. Paragraphs 29 and 31, section 5, AMSG only generally define the complainant's objective and the performance of its tasks, but do not authorize data processing. The data processing in question constitutes profiling within the meaning of Article 4, paragraph 4, GDPR, which creates "informational added value," to which the law must expressly refer. The data processing in question cannot be based on a suitable legal basis. Furthermore, this constitutes a case of Article 22, GDPR, namely an automated individual decision. While it must be acknowledged that the final decision rests with the complainant's advisors based on internal guidelines, it cannot be ruled out that in "individual cases" the decision is based exclusively on profiling.

In its decision of December 18, 2020, W256 2235360-1/5E, the Federal Administrative Court (BVwG) upheld the complainant's appeal against the decision of the authority concerned and annulled the contested decision without replacement. In its legal assessment, the Federal Administrative Court summarized that it follows from Article 6 (1) (e) GDPR and Article 9 (2) (d) GDPR that the processing of personal data can be lawful if the processing is necessary for a sovereign or other task in the public interest or, in the case of the processing of special categories of personal data, due to a substantial public interest.In this context, according to the provisions of the GDPR, it is irrelevant whether the controller is a public authority or a private body and in what form - sovereign or private sector - the controller may operate. Rather, the decisive factor is whether a matter is necessary in the public or substantial public interest and whether legally regulated data processing is carried out. Article 6 (3) GDPR sets out the substantive requirements for a corresponding legal basis, which, in conjunction with Recital 41 of the GDPR, should be clear, precise, and foreseeable for those subject to the law. The provisions of EU law - Articles 6 and 9 GDPR - generally require a task in the substantial public interest and - thus not limited to sovereign activities - a sufficiently determined legal basis for data processing. The complainant is a service company under public law with its own legal personality, which is responsible for implementing the federal government's labor market policy. Pursuant to Section 29 (1) AMSG, the complainant must therefore work towards the most complete, economically viable, and sustainable matching of labor supply and demand in order to best ensure the supply of labor to the economy and the employment of all persons available on the labor market. Pursuant to Section 29 (2) AMSG, the complainant is obligated to efficiently place suitable workers in jobs that offer, as far as possible, employment in line with the job seeker's wishes, and to help overcome the effects of circumstances that would hinder direct placement in this sense. In doing so, the principles of economy, efficiency, and expediency must be observed, and further care must be taken to ensure that suitable support services are offered to groups of people particularly at risk of unemployment. Section 25 (2) AMSG expressly grants the complainant the authority to process the personal data involved in the proceedings, provided that this is an essential prerequisite for fulfilling the statutory task. The task of ensuring an orderly and well-functioning labor market, which was thus legally assigned to the complainant by Section 29 AMSG, is undoubtedly one of considerable public interest within the meaning of Article 9 (2) (g) GDPR. Furthermore, it is undisputedly necessary to consider the personal characteristics of job seekers in combination with general labor market developments and the resulting employment opportunities for job seekers in the labor market in order to best meet the task of optimally supplying the economy with labor and securing the employment of job seekers. The relevance of the personal data included in the data processing in the present proceedings cannot be denied. There are therefore no concerns that the complainant may use the personal data in question in order to "ensure proper labor market policy" in order to ensure "proper labor market policy." Against the background of the requirements of the GDPR and the DSG, Section 25 (10) AMSG takes the related, comprehensive and appropriate technical and organizational measures to ensure processing complies with the principles of the GDPR and the DSG. In addition to the measures mentioned in Recital 78, Section 25 (10) AMSG provides for additional specific requirements to guarantee data security. The complainant's fundamental right to assess the labor market opportunities of job seekers based on specific personal data is not questioned by the authority concerned. The "informational added value" assumed by the authority concerned in an assessment of labor market opportunities based on the same personal data - whether the assessment is not automated or based on profiling - cannot be recognized from a data protection perspective, because every assessment is also based on the weighting assigned by the evaluator. Furthermore, a different assessment of the lawfulness of data processing cannot be derived from Article 6 (1) (e) or Article 9 (2) (d) GDPR because these provisions do not distinguish between automated and non-automated processing, but merely refer generally to the concept of processing. Article 4 (1) GDPR, on the other hand, defines the operations related to personal data therein as processing based on an exemplary list, without distinguishing whether this is carried out with or without the aid of automated procedures. The fact that Article 4 (4) GDPR specifically refers to exclusively automated processing as profiling highlights this important application and clarifies that this form of processing falls within the scope of the GDPR and must comply with the general criteria set out therein. Article 22 GDPR, in turn, stipulates that a data subject should have the right not to be subjected to a decision evaluating aspects concerning them that is based solely on automated processing and produces legal effects concerning them or similarly significantly affects them. Article 22 GDPR therefore only applies to decisions made without any human intervention. However, this provision does not limit the legal admissibility of profiling as such as part of decision support. The algorithm at issue in the procedure and the labor market opportunities calculated from it are used merely as a source of information for a decision by the complainant's advisors. The final decision regarding the job seeker's labor market opportunities should remain with the advisors. In this regard, the complainant has internally issued guidelines and instructions, and training courses are conducted. The guidelines issued pursuant to Section 4 (2) (2) AMSG are binding for all bodies and institutions for the performance of the complainant's tasks. The updated and valid federal guideline "Core Process Supporting Workforce" (GZ XXXX, valid from July 20, 2020; BRL) - submitted with the complaint - specifies the exact procedure for assessing labor market opportunities and expressly stipulates that the complainant's advisors must discuss the calculated labor market opportunities with the data subject during a consultation, document any opposing view expressed by the data subject, and ultimately decide on this. In view of these clear guidelines, there are no reasons to assume that this is a completely automated decision within the meaning of Art. 22 GDPR. By decision of December 18, 2020, W256 2235360-1/5E, the Federal Administrative Court (BVwG) upheld the complainant's appeal against the decision of the authority concerned and annulled the contested decision without replacement. In its legal assessment, the Federal Administrative Court summarized that it follows from Article 6, paragraph 1, letter e, GDPR and Article 9, paragraph 2, letter d, GDPR that the processing of personal data may be lawful if the processing is necessary for a sovereign or other task carried out in the public interest, or in the case of the processing of special categories of personal data, due to a substantial public interest. In this context, according to the provisions of the GDPR, it is irrelevant whether the controller is a public authority or a private body and in what form - sovereign or private sector - the controller may operate. Rather, the decisive factor is whether a matter is necessary in the public or substantial public interest and whether legally regulated data processing is carried out. Article 6, paragraph 3, GDPR sets out the substantive requirements for a corresponding legal basis, which, in conjunction with Recital 41 of the GDPR, should be clear, precise, and predictable for those subject to the law. The provisions of EU law – Articles 6 and 9 of the GDPR – generally require a task in the substantial public interest and – therefore not limited to sovereign activities – a sufficiently specific legal basis for data processing. The complainant is a service provider under public law with its own legal personality, which is responsible for implementing the federal labor market policy. According to Section 29, Paragraph 1 of the AMSG, the complainant is therefore required to work towards the most complete, economically viable, and sustainable matching of labor supply and demand in order to best secure the supply of labor to the economy and the employment of all persons available on the labor market. According to Section 29, Paragraph 2 of the AMSG, the complainant is required to efficiently ensure the placement of suitable workers in jobs that offer, as far as possible, employment that corresponds to the job seeker's wishes, and to help overcome the effects of circumstances that would hinder direct placement in this regard.In doing so, the principles of economy, efficiency, and expediency must be observed, and care must also be taken to ensure that suitable support services are offered to groups of people particularly at risk of unemployment. Section 25, Paragraph 2, AMSG expressly grants the complainant the authority to process the personal data involved in the proceedings, provided that this is an essential prerequisite for fulfilling the statutory task. The task thus legally assigned to the complainant by Section 29, AMSG, of ensuring an orderly and well-functioning labor market is undoubtedly one of considerable public interest within the meaning of Article 9, Paragraph 2, Letter g, GDPR. Furthermore, it is undisputedly necessary to take into account the personal characteristics of job seekers in combination with general labor market developments and the resulting employment opportunities for job seekers in the labor market in order to best meet the task of optimally supplying the economy with workers and securing the employment of job seekers. The relevance of the personal data included in the data processing in the present proceedings cannot be disputed. Therefore, there are no concerns that the complainant may use the personal data in the present proceedings to "ensure proper labor market policy." Against the background of the requirements of the GDPR and the DSG, Section 25, Paragraph 10, AMSG takes comprehensive, appropriate technical and organizational measures to ensure processing complies with the principles of the GDPR and the DSG. In addition to the measures mentioned in Recital 78, Section 25, Paragraph 10, AMSG provides for additional specific requirements to ensure data security. The complainant's fundamental right to assess the labor market prospects of job seekers based on specific personal data is not questioned by the authority concerned. The "informational added value" assumed by the competent authority in an assessment of labor market opportunities based on the same personal data - whether the assessment is non-automated or based on profiling - cannot be recognized from a data protection perspective, because every assessment is also based on the weighting of the evaluator. Furthermore, a different assessment regarding the lawfulness of data processing cannot be derived from Article 6, paragraph 1, letter e, or Article 9, paragraph 2, letter d, GDPR, because these provisions do not distinguish between automated and non-automated processing, but merely refer generally to the concept of processing. Article 4, paragraph 1, GDPR, in turn, defines the processes related to personal data as processing based on an exemplary list, without distinguishing whether this is carried out with or without the aid of automated procedures. The fact that Article 4, paragraph 4, GDPR specifically refers to exclusively automated processing as profiling highlights this significant application and clarifies that this form of processing falls within the scope of the GDPR and must meet the general criteria set out therein. Article 22, GDPR, in turn, stipulates that a data subject shall have the right not to be subjected to a decision evaluating aspects concerning them that is based solely on automated processing and produces legal effects concerning them or similarly significantly affects them. Article 22, GDPR therefore only applies to decisions that are made without any human intervention. However, this provision does not limit the legal admissibility of profiling as such as part of decision support. The algorithm at issue in the procedure and the labor market opportunities calculated from it are used merely as a source of information for a decision by the complainant's advisors. The final decision regarding the job seeker's labor market opportunities should remain with the advisors. In this regard, the complainant maintains internal guidelines and instructions, and conducts training courses. The guidelines issued pursuant to Section 4, Paragraph 2, Item 2 of the AMSG are binding for all bodies and institutions for the performance of the complainant's duties. The updated and valid federal guideline "Core Process Supporting Workforces" (GZ Römische 40, valid from July 20, 2020; BRL), which was submitted with the complaint, specifies the precise procedure for assessing labor market opportunities and expressly stipulates that the complainant's advisors must discuss the calculated labor market opportunities with the data subject during a consultation, document any opposing views expressed by the data subject, and ultimately decide on them. Given these clear guidelines, there are no reasons to assume that this is a fully automated decision within the meaning of Article 22 of the GDPR.

The Administrative Court of Justice (VwGH) overturned this decision, based on the official appeal by the respondent authority, with a decision of December 21, 2023, Ro 2021/04/0010, due to the unlawfulness of its content. In its reasoning, the Administrative Court stated that neither the advice provided within the framework of job placement itself nor the preparation of the care plan (a care agreement) within the meaning of Section 38c AMSG could be attributed to the complainant's (even simply) sovereign area of activity. For this reason alone, the legality of the data processing at issue in the proceedings had to be examined by applying the relevant provisions of the GDPR, without taking into account the standard of Section 1 (2) DSG. The question of the legality of the processing in question under the provisions of Articles 6 and 9 GDPR had to be separated from the question of the prohibition of automated decision-making under Article 22 GDPR. According to Article 6 (1) (e) GDPR, the processing of personal data is lawful, inter alia, if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Article 9 (2) (g) GDPR, like Article 6 (1) (e) leg. cit., refers as a justification to the need to process for reasons of public interest, which is significant in connection with Article 9 (2) (g). In view of the structural similarities between these two justifications, it can be assumed that, in order to justify the processing of special categories of personal data within the meaning of Article 9 (2) (g) GDPR, it can be assumed that, just as with the justification in Article 6 (1) (e), a sufficiently clear definition of the task to be performed by the processing in the legal basis is required, but also sufficient. In any event, it cannot be assumed that the national legislature is required to stipulate the data processing itself in law in order to fulfill these justifications with regard to a specific data processing operation. Section 29 (1) AMSG defines the complainant's task; Section 29 (2) AMSG states the objectives of the complainant's activities to be pursued in connection with the fulfillment of this task. Section 30 (2) AMSG also explicitly stipulates the complainant's obligation to ensure labor market monitoring and statistics. The detail in Section 31 AMSG of the principles that must be applied to the fulfillment of the task also establishes which requirements must be met in the fulfillment of the task. Section 25 (1) AMSG limits the authorization to process data to the statutory task and to such processing that is an essential prerequisite for the fulfillment of the task. Thus, by listing the data and directly linking them to the permitted processing purpose, it is clearly and predictably regulated for the data subject which data may be processed for which purpose. There is no doubt that Sections 29 to 31 AMSG sufficiently clearly and precisely define the task in connection with which the complainant is authorized to process the data listed in Section 25 (1) AMSG, and thus the framework for the permitted purpose of the data processing. It is obvious that assessing the labor market prospects of a job seeker is a relevant parameter for efficient job placement. It can therefore be assumed that, in view of the task assigned to the complainant and the services to be provided – in particular the support plan to be drawn up pursuant to Section 38c AMSG – it is sufficiently clear to a person subject to the law that processing the data listed in Section 25 (1) AMSG is also useful for assessing the position of the job seeker in question on the labor market and can therefore be used for this purpose, which is necessary for the fulfillment of the public task. Furthermore, with regard to the health data concerned in this case, which are to be classified as special categories of personal data within the meaning of Article 9 (1) GDPR, it should be noted that there can be no doubt that the legislator's objective of ensuring the best possible integration of job seekers into the national labour market constitutes a significant public interest within the meaning of Article 9 (1) GDPR.9 (2) (g) GDPR, since this objective is linked to the efficient use of state support funds and the optimization of social satisfaction among job seekers on the one hand, and the best possible supply of the labor market on the other. The provisions regarding the confidentiality obligation of the complainant's bodies in Section 27 AMSG and the detailed provisions regarding the disclosure and retention of data in Section 25 (2) to (11) AMSG leave no doubt as to the fulfillment of the measures required by Article 9 (2) (g) GDPR to safeguard the essence of the fundamental right to protection of personal data enshrined in Article 8 of the Charter of Fundamental Rights of the European Union, as well as the fundamental rights and interests of the data subjects. With regard to the independent question of the prohibition of automated decisions pursuant to Art. 22 GDPR, the Administrative Court, referring to the statements in the ECJ judgment in C-634/21, paras. 48 and 73, held that automated data processing – such as profiling – itself constitutes an "automated decision in an individual case" within the meaning of Art. 22 (1) GDPR if the result of this automated processing is decisive for a specific – further – decision insofar as the third party's actions are "significantly guided" by the profiling in question, thus significantly affecting the data subject. There is no doubt that the automated processing of the personal data of the job seekers concerned (in AMAS) used by the complainant, based on a mathematical-statistical program, constitutes "profiling" within the meaning of Art. 4 (4) GDPR according to the standard of the ECJ's case law in C-634/21. According to the ECJ's statements, automated processing – in this case, the determination of the IC value, which determines the probability of integration into the labor market – is itself to be regarded as an "automated decision" within the meaning of Art. 22 (1) GDPR, provided that this probability value decisively determines the allocation to the intended customer groups and thus has legal effects on the job seekers concerned or significantly affects them in a similar way. The fact that the final decision regarding the allocation to the customer group lies with the complainant's advisors cannot prevent the AMAS from being qualified as an automated decision within the meaning of Art. 22 (1) GDPR, since the ECJ's ruling is also based on the fact that the potential lender ultimately decides on the question of whether the loan agreement in question is concluded. The – possibly – purely formal separation of the decision significantly influenced by automated data processing from the automated data processing itself does not prevent the latter from being classified as a decision fundamentally prohibited under Art. 22 GDPR. The Federal Administrative Court's finding that instructions and training sessions ensured that the complainant's advisors would not unquestioningly accept the algorithm's results may indeed justify the assumption that the classification into the respective client group is not based exclusively on the AMAS. However, this finding does not rule out the possibility that AMAS – as an automated decision – is ultimately decisive for this classification. Since the Federal Administrative Court, based on its legal opinion – which is to be regarded as incorrect in light of the ECJ ruling – had not made any findings on the precise use of the AMAS – in particular, no concrete findings on the question of which other parameters are taken into account and to what extent, or which procedure is envisaged for the use of the AMAS – the question of the relevance of automated processing in the present case could not be exhaustively assessed from a legal perspective. The Administrative Court, based on the official appeal by the authority concerned, annulled this decision with its decision of December 21, 2023, Ro 2021/04/0010, due to the illegality of the content. In its reasoning, the Administrative Court held that neither the advice provided within the framework of job placement itself, nor the creation of the care plan (a care agreement) within the meaning of Section 38 c of the AMSG (German Employment Promotion Act) could be attributed to the complainant's (even simply) sovereign area of activity. For this reason alone, the legality of the data processing in question had to be examined by reference to the relevant provisions of the GDPR, without considering the standard of Section 1, Paragraph 2 of the DSG (German Data Protection Act). The question of the legality of the processing in question under the provisions of Articles 6 and 9 of the GDPR had to be separated from the question of the prohibition of automated decision-making pursuant to Article 22 of the GDPR. Pursuant to Article 6, Paragraph 1, Letter e of the GDPR, the processing of personal data was lawful, inter alia, if the processing was necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Article 9, paragraph 2, letter g, GDPR, like Article 6, paragraph 1, letter e, leg. cit., refers as a justification to the need for processing for reasons of public interest - which is significant in the context of Article 9, paragraph 2, letter g. In view of the structural similarities between these two justifications, it can be assumed that, in order to justify the processing of special categories of personal data within the meaning of Article 9, paragraph 2, letter g, GDPR - just as with the justification in Article 6, paragraph 1, letter e - a sufficiently clear definition of the task to be performed by the processing in the legal basis is necessary, but also sufficient. In any event, it cannot be assumed that the national legislature is required to determine the data processing itself in law in order to fulfill these justifications with regard to a specific data processing operation. Paragraph 29, paragraph 1, AMSG defines the complainant's task; Paragraph 29, paragraph 2, AMSG sets out the objectives of the complainant's activities in connection with the performance of this task. Paragraph 30, paragraph 2, AMSG also explicitly stipulates the complainant's obligation to ensure labor market monitoring and statistics. The detailed principles that must be applied to the performance of this task in Paragraph 31 AMSG also establishes which requirements must be met in the performance of the task. Paragraph 25, paragraph 1, AMSG limits the authorization to process data to the statutory task and to such processing that is an essential prerequisite for the performance of the task. Thus, by listing the data and directly linking them to the permitted processing purpose, it is clearly and predictably regulated for the data subject which data may be processed for which purpose. There is no doubt that Sections 29 to 31 AMSG sufficiently clearly and precisely define the task in connection with which the complainant is authorized to process the data listed in Section 25, Paragraph 1 AMSG, and thus the framework for the permitted purpose of the data processing. It is obvious that assessing the labor market prospects of a job seeker is a relevant parameter for efficient job placement. It can therefore be assumed that, in view of the task assigned to the complainant and the services to be provided—in particular, the support plan to be drawn up pursuant to Section 38c AMSG—it is sufficiently clear to a person subject to the law that processing the data listed in Section 25, Paragraph 1 AMSG is also useful for assessing the position of the job seeker in question on the labor market and can therefore be used for this purpose, which is necessary for the fulfillment of the public task. Furthermore, with regard to the health data concerned in this case, which are to be classified as special categories of personal data within the meaning of Article 9, paragraph 1, GDPR, it should be noted that there can be no doubt that the legislature's objective of ensuring the best possible integration of job seekers into the national labor market pursues a significant public interest within the meaning of Article 9, paragraph 2, letter g, GDPR, since this objective is linked to the efficient use of state support funds and the optimization of social satisfaction among job seekers on the one hand, and the best possible supply of the labor market on the other. The provisions regarding the confidentiality obligation of the complainant's bodies in Section 27 of the AMSG and the detailed provisions regarding the disclosure and retention of data in Section 25, paragraphs 2 to 11 of the AMSG leave no doubt as to the fulfillment of the measures required by Article 9, paragraph 2, letter g, GDPR to safeguard the essence of the fundamental right to protection of personal data enshrined in Article 8 of the Charter of Fundamental Rights of the European Union, as well as the fundamental rights and interests of the data subjects. With regard to the question of the prohibition of automated decisions pursuant to Article 22 GDPR, which must be assessed independently, the Administrative Court, with reference to the statements in the ECJ judgment in C-634/21, paras. 48 and 73, held that automated data processing - such as profiling - itself constitutes an "automated individual decision" within the meaning of Article 22, paragraph 1, GDPR if the result of this automated processing is decisive for a specific - further - decision insofar as the third party's action is "decisively guided" by the profiling in question and thus significantly affects the data subject.According to the ECJ's case law in C-634/21, there is no doubt that the automated processing of the personal data of the job seekers concerned (in AMAS) used by the complainant, based on a mathematical-statistical program, constitutes "profiling" within the meaning of Article 4(4) GDPR. According to the ECJ's ruling, the automated processing itself—in this case, the determination of the IC value, which determines the probability of integration into the labor market—is itself to be regarded as an "automated decision" within the meaning of Article 22(1) GDPR, provided that this probability value decisively determines the allocation to the intended customer groups and thus has legal effects on the job seekers concerned or significantly affects them in a similar way. The fact that the final decision regarding customer group assignment rests with the complainant's advisors does not prevent the AMAS from being qualified as an automated decision within the meaning of Article 22, paragraph 1, GDPR, since the ECJ's ruling is also based on the fact that the potential lender ultimately decides on the question of whether the loan agreement in question is concluded. The - possibly - purely formal separation of the decision significantly influenced by automated data processing from the automated data processing itself does not prevent the latter from being classified as a decision fundamentally prohibited under Article 22, GDPR. The Federal Administrative Court's finding that instructions and training ensured that the complainant's advisors would not unquestioningly accept the algorithm's results may indeed justify the assumption that the assignment to the respective customer group is not based exclusively on the AMAS. However, this finding does not rule out the possibility that AMAS – as an automated decision – is ultimately decisive for this classification. Since the Federal Administrative Court, based on its legal opinion – which is to be regarded as incorrect in light of the ECJ ruling – did not make any findings regarding the precise use of AMAS – in particular, no concrete findings regarding which other parameters are taken into account and to what extent, or which procedure is intended for the use of AMAS – the question of the relevance of automated processing in the present case cannot be exhaustively assessed from a legal perspective.

At the request of the Federal Administrative Court, the complainant initially pointed out in its statement of February 29, 2024, that AMAS had not been in use since the contested decision prohibiting its use as of January 1, 2021. The complainant had decided at that time to suspend the disputed data processing until the legal matter was resolved. Therefore, when the manner in which AMAS is used is described below, this concerns the situation prior to January 1, 2021. It is important to reiterate that the assessment of labor market opportunities has always been a central component of the complainant's services. In order to best support job seekers in their job search, the most realistic assessment of labor market opportunities possible is important. AMS advisors were required to assess labor market opportunities for each individual case. This applies regardless of the use of AMAS. AMAS is intended to support AMS advisors in mapping labor market opportunities as accurately as possible based on statistical data in order to be able to place and support workers in the best possible and most efficient manner. The use of AMAS is bindingly regulated in the "Federal Guideline Core Process for Supporting Workforces." The federal guideline makes it clear that when using AMAS, AMS advisors continue to have the final decision for assessing labor market opportunities. As the Federal Administrative Court has largely already determined, the values calculated by AMAS serve as the starting point for assessing the potential and, if applicable, obstacles to labor market integration together with the client. The results should therefore be used in the counseling process to reflect on them with the client's self-assessment. This reflection should be documented in the concluded support agreement. Any concerns and fears of the clients must be discussed and taken seriously by the AMS counselors. If the client has a different assessment of labor market opportunities than the AMS counselors, this must also be documented in the support agreement. The federal guideline also explicitly stipulates that the AMS counselors must review AMAS's assessment of labor market opportunities and correct it if they assess them as better or worse. As already stated and partially established, AMS advisors are trained that certain factors important for the labor market, such as motivation, housing situation, addiction, debt, imprisonment, a person's existing or lacking qualifications (AMAS only represents the highest level of education at three levels: compulsory school, apprenticeship, or high school diploma), etc., are not recorded by AMAS and must therefore be considered exclusively by AMS advisors based on their personal contact with the clients. Likewise, when assessing job market opportunities, AMS advisors must consider personal circumstances (e.g., childcare, health restrictions) that have changed during the registration process and adjust the job market opportunities if necessary. The assessment of job market opportunities is not a one-time determination, but is made continuously throughout the entire period in which a job seeker is registered with the AMS. AMAS recalculates job market opportunities at regular intervals. If the calculated labor market opportunity is adjusted by an AMS advisor, the program ensures that this value can no longer be overwritten by AMAS. This ensures that the AMS advisors' assessments take precedence over the calculated values. It should therefore be noted that the assessment and evaluation of labor market opportunities is carried out with the active involvement of AMS advisors and is their responsibility, and that this assessment by AMS advisors is always preceded by a personal interview with the job seeker concerned. Therefore, classification based on labor market opportunities conceptually requires the involvement of AMS advisors. AMAS is not designed to completely relieve advisors of the task of assessing labor market opportunities. Rather, AMAS is an "assistance system" in the sense of an instrument and serves solely to support AMS advisors. The assessment of labor market opportunities is therefore expressly not based on exclusively automated processing. For this reason alone, Article 22 GDPR is inapplicable. It is also important to emphasize, as already stated in the complaint, that the decision on the use of various funding instruments is only made in a subsequent step. The AMS advisors must make a selection decision from the various employment, training, and support measures in each individual case and additionally justify and document this in a labor market policy statement. There is no proposed decision in this regard. A "routine adoption" based on an automatic funding proposal is therefore not possible in this case. For most funding schemes, the previously made classification according to labor market opportunities is irrelevant. Furthermore, the AMS advisors can adjust the classification at any time, so that in principle all funding options (according to the respective guidelines adopted by the Administrative Board) are open to job seekers. The facts of the ECJ judgment of December 7, 2023, C-634/21, SCHUFA Holding [Scoring] are, moreover, not comparable to the present case, and the ECJ's legal considerations are therefore not applicable to AMAS. The order for reference and the questions referred to the ECJ indicate that SCHUFA, as a credit agency, provides creditworthiness assessments to its contractual partners, including banks in particular. To this end, it uses mathematical and statistical methods to predict the probability of a person's future behavior ("score"), such as the repayment of a loan, based on certain characteristics of that person. The determination of the score is based exclusively on automated processing. While in the SCHUFA case the calculation of the score is based exclusively on automated processing, the AMS advisors – as explained above – are involved in determining labor market opportunities and make the final decision regarding classification into the three categories of high, medium, and low labor market opportunities. On this point alone, the facts of the present AMAS proceedings differ fundamentally from the SCHUFA case. In the present case, the assessment of labor market opportunities lies in the hands of the AMS advisors, and the actual selection decision from the various employment, qualification, and support measures is made solely by the AMS advisors.Furthermore, in contrast to the SCHUFA case, AMAS is not about whether a customer receives a measure or not. Rather, it is about finding the appropriate support strategy for each customer. The calculation result therefore has no legal implications for the data subjects and does not otherwise significantly affect them. As already explained, no decision is made based solely on automated processing. Furthermore, the AMS is familiar with the functionality and "logic involved" of AMAS and has access to all data processed in AMAS. The processing results can be monitored in the data warehouse and reviewed for each individual AMS customer and corrected if necessary. In the event of a request for information under data protection law, the AMS discloses all information contained in AMAS (percentages, segment assignment, and how the individual characteristics were incorporated into the probability calculation). In fact, a handful of AMS customers had requested and received such information. Furthermore, according to the federal directive, AMS customers have a right to be heard and to present their own point of view. Therefore, there is no legal gap in the case of AMAS if Article 22 GDPR does not apply. At the request of the Federal Administrative Court (BVwG), the complainant first pointed out in its statement of February 29, 2024, that AMAS had not been in use since the contested decision prohibiting its use from January 1, 2021. The complainant had decided at that time to suspend the disputed data processing until the legal matter was clarified. Therefore, if the method of using AMAS is described below, this refers to the situation before January 1, 2021. It is important to reiterate that the assessment of labor market opportunities has always been a central component of the complainant's services. In order to best support job seekers in their job search, it is important to have the most realistic assessment of labor market opportunities possible. AMS advisors were required to assess the labor market opportunities for each individual case. This applies regardless of the use of AMAS. AMAS should support AMS advisors in mapping labor market opportunities as accurately as possible based on statistical data in order to be able to place and support workers as effectively and efficiently as possible. The use of AMAS is bindingly regulated in the "Federal Guideline Core Process for Supporting Workforces." The federal guideline makes it clear that when using AMAS, AMS advisors retain the final decision regarding the assessment of labor market opportunities. As the Federal Administrative Court has largely already determined, the values calculated by AMAS are the starting point for jointly assessing the potential and, if applicable, obstacles to labor market integration with the client. The results should therefore be used in the counseling process to reflect these with the client's self-assessment. The resulting reflection must be documented in the concluded support agreement. Any concerns and fears of the clients must be discussed and taken seriously by the AMS advisors. If the client has a different assessment of labor market opportunities than the AMS advisors, this must also be documented in the support agreement. The federal guideline further explicitly stipulates that the AMS advisors must review the AMAS assessment of labor market opportunities and correct it if they assess them as better or worse. As already stated and partially established, the AMS advisors are trained that certain factors important for the labor market, such as motivation, housing situation, addiction, debt, imprisonment, a person's existing or lacking qualifications (AMAS only represents the highest level of education across three levels: compulsory schooling, apprenticeship, or high school diploma), etc., are not captured by AMAS and must therefore be considered exclusively by the AMS advisors based on their personal contact with the clients. Likewise, when assessing job market prospects, AMS advisors must take into account personal circumstances (e.g., childcare, health restrictions) that have changed during the registration process and adjust the job market prospects if necessary. The assessment of job market prospects is not a one-time determination, but rather a continuous process throughout the entire period in which a job seeker is registered with the AMS. AMAS recalculates job market prospects at regular intervals. If the calculated job market prospects are adjusted by an AMS advisor, the software ensures that this value can no longer be overwritten by AMAS. This ensures that the AMS advisors' assessments take precedence over the calculated values. It should therefore be noted that the assessment and evaluation of job market prospects is carried out with the active involvement of AMS advisors and is their responsibility, and that this assessment by AMS advisors is always preceded by a personal discussion with the job seeker concerned. The classification according to labor market opportunities therefore requires the involvement of AMS advisors by design. AMAS is not designed to completely relieve advisors of the task of assessing labor market opportunities. Rather, AMAS is an "assistance system" in the sense of an instrument and serves solely to support AMS advisors. The assessment of labor market opportunities is therefore expressly not based on exclusively automated processing. For this reason alone, Article 22 of the GDPR is not applicable. It is also important to emphasize, as already stated in the complaint, that the decision on the use of various support instruments is only made in a subsequent step. The AMS advisors must make a selection decision from the various employment, training, and support measures in each individual case and additionally justify and document this in a labor market policy statement. There is no proposed decision in this regard. A "routine adoption" based on an automatic funding proposal is therefore not possible here. For most subsidies, the previously established classification based on labor market opportunities is irrelevant. Furthermore, the classification can be adjusted by AMS advisors at any time, so that, in principle, all subsidies (according to the respective guidelines adopted by the Administrative Board) are open to job seekers. The facts of the ECJ ruling of December 7, 2023, C-634/21, SCHUFA Holding [Scoring] are, moreover, not comparable with the present case, and the ECJ's legal considerations are therefore not transferable to AMAS. The order for reference and the questions referred to the ECJ indicate that SCHUFA, as a credit agency, provides its contractual partners, including banks in particular, with credit assessments. To this end, it uses mathematical and statistical methods to predict the probability of a person's future behavior ("score"), such as the repayment of a loan, based on certain characteristics of that person. The determination of the score is based exclusively on automated processing. While in the SCHUFA case the calculation of the score is based exclusively on automated processing, the AMS advisors – as explained above – are involved in determining labor market opportunities and make the final decision regarding classification into the three categories of high, medium, and low labor market opportunities. On this point alone, the facts of the present AMAS proceedings differ fundamentally from the SCHUFA case. In the present case, the assessment of labor market opportunities lies in the hands of the AMS advisors, and the actual selection decision from the various employment, qualification, and support measures is made solely by the AMS advisors. Furthermore, in AMAS, in contrast to the SCHUFA case, it is not about whether a customer receives a measure or not. Rather, it is about finding the appropriate support strategy for each customer. The calculation result therefore has no legal impact on the data subjects and does not otherwise significantly affect them. As already explained, no decision is made based solely on automated processing. Furthermore, the AMS is aware of the functionality and "logic involved" of AMAS and has access to all data processed in AMAS. The processing results can be monitored in the data warehouse and reviewed for each individual AMS customer and corrected if necessary. In the event of a request for information under data protection law, the AMS has disclosed all information contained in AMAS (percentages, segment allocation, how the individual characteristics were incorporated into the probability calculation). In fact, a handful of AMS customers have requested and received such information. Furthermore, according to the federal guidelines, AMS customers have a right to be heard and to present their own point of view. Therefore, in the case of AMAS, there is no gap in legal protection if Article 22 of the GDPR does not apply.

In its opinion of March 11, 2024, the respondent authority stated that the core of the ECJ's question was whether the scope of application of Article 22 (1) GDPR should be affirmed, even if a credit agency (such as SCHUFA) only calculates a "credit score" based on certain data, but the decision on whether to conclude a (credit) agreement is made by another company that queries this "credit score." In its judgment of December 7, 2023, the ECJ stated that the decisive factor in this regard is whether the "credit score" provided by the credit agency plays a "significant role" in the granting of a loan. Under this condition, the scope of application of Article 22 (1) GDPR would be open, and it would be irrelevant that an employee of another company ultimately makes the final decision. In this respect, it is irrelevant that – as the complainant argues – it is ultimately a consultant who assesses the complainant's labor market opportunities and awards funding on this basis. The decisive factor is whether the AMAS (or the undisputedly automatically calculated probability values (IC values)) plays a "significant role" in this, i.e., whether they significantly influence the decision-making process. This is the only relevant question in the present proceedings. The complainant takes the position that the value calculated with the help of the AMAS should merely be a "support" for the consultants. However, the mere fact that AMAS was developed over several years and ultimately used shows that this system had a significant influence on the consulting activities and thus the support provided by the complainant. According to the complainant, the purpose is to make the consulting activities more efficient and to allocate funding more effectively. Viewed from a different perspective, it is questionable why the AMAS should be used at all. Moreover, the authority in question assumes that, due to the calculated values, advisors act with a certain prejudice towards the job seeker in question – albeit unconsciously – and that they do not sufficiently exercise their existing human discretion. As is particularly evident from the attached reports on the manipulative effect of profiling on human decisions (Report of the [German] Data Ethics Commission of October 2019, pp. 99 ff. and in particular p. 192, as well as the Socio-Technical Analysis of the Labor Market Opportunities Assistance System of the ITA of November 2020, pp. 78 f. and p. 102), the manipulative effect of profiling could lead to a "routine adoption" of the calculated values or at least a "significant influence" by the AMAS in many advisory cases. To cover these cases, the processing ban issued by the administrative decision is necessary. However, the respondent authority does not take the view that in – literally – all consultation cases, the calculated values are "routinely adopted" or that they are "significantly influenced" by AMAS. This would be unrealistic given the large number of consultation cases and the differences among job seekers. In its opinion of March 11, 2024, the respondent authority stated that the core of the ECJ's question was whether the scope of application of Article 22, paragraph 1, GDPR should be affirmed, even if a credit agency (such as SCHUFA) only calculates a "credit score" based on certain data, but the decision on the conclusion of a (credit) agreement is made by another company that queries this "credit score." In its judgment of December 7, 2023, the ECJ stated that the decisive factor in this regard is whether the "credit score" provided by the credit agency plays a "decisive role" in the granting of a loan. Under this condition, the scope of application of Article 22, paragraph 1, GDPR would be open, and it would be irrelevant that an employee of another company ultimately makes the final decision. In this respect, it is irrelevant that – as the complainant argues – a consultant to the complainant ultimately assesses the labor market opportunities and awards subsidies on this basis. The decisive factor is whether the AMAS (or the undisputedly automatically calculated probability values (IC values)) plays a "decisive role" in this regard, i.e., whether they significantly influence this decision-making process. This is the only relevant question in the present proceedings. The complainant takes the view that the value calculated using AMAS is merely intended to provide "support" for the advisors. However, the mere fact that AMAS was developed over several years and was ultimately implemented shows that this system had a significant influence on the advisory work and thus the support provided by the complainant. According to the complainant, the purpose is to make the advisory work more efficient and to allocate funding more effectively. Looking at it from a different perspective, it is questionable why AMAS should be used at all. The authority in question also assumes that, due to the calculated values, advisors act with a certain prejudice towards the job seeker - albeit unconsciously - and that they do not sufficiently exercise their existing human discretion. As is particularly evident from the attached expert opinions on the manipulative effect of profiling on human decision-making (the expert opinion of the [German] Data Ethics Commission of October 2019, Session 99 et seq. and in particular Session 192, as well as the socio-technical analysis of the ITA's Labor Market Opportunities Assistance System of November 2020, Session 78 et seq. and Session 102), the manipulative effect of profiling could lead to a "routine adoption" of the calculated values or at least to a "significant influence" by the AMAS in many consultation cases. In order to cover these cases, the processing ban issued by the administrative decision is necessary. However, the authority concerned does not take the view that a "routine adoption" of the calculated values or a "significant influence" by the AMAS occurs in – literally – all consultation cases. This would be unrealistic given the large number of counseling cases and the differences among job seekers.

In its response dated January 7, 2025, the complainant essentially reiterated its argument that the facts underlying the ECJ judgment of December 7, 2023, C-634/21, SCHUFA Holding, differ in essential respects from the relevant facts. In contrast to the SCHUFA case, AMS counselors are actively involved in supporting job seekers. As already explained in more detail, AMS counselors are required to discuss and assess labor market opportunities in a personal interview with the individuals concerned, and they bear ultimate responsibility for the classification. They can adjust or correct the computer-generated results at any time if they deem this necessary. The AMS counselors are expressly authorized and obligated to do so and are also trained accordingly by the AMS. In contrast to the SCHUFA case, the AMS advisors therefore have broad scope for action and discretion. The facts of the present proceedings therefore differ fundamentally from the SCHUFA case. The application of Article 22 GDPR in the present case fails due to the requirement of a decision based exclusively on automated processing. The approach of the authority in question, which seeks to derive a "significant influence" of AMAS on the advisory activities from, among other things, the several years of development of AMAS, is also misguided. The development period and the fact that AMAS was actually used do not allow any conclusions to be drawn as to whether AMAS falls within the scope of Article 22 GDPR. Even if AMAS was of course intended to help make advisory activities more efficient and allocate funding more effectively, AMAS was never designed to replace AMS employees. The expert opinions cited by the authority in question are also not suitable for demonstrating AMAS's significant influence. It is not clear to what extent the report of the German Data Ethics Commission is even relevant to the current legal case. In its reply, the authority in question relies on a single quote from the report, according to which human actors would (allegedly) tend to simply accept recommendations from algorithmic systems and not exercise existing discretion. This thesis is neither substantiated in the report nor are any references or empirical evidence cited for it. This in no way allows one to conclude that AMAS employees are significantly influenced by AMAS, as the authority in question attempts to argue. Likewise, the final report submitted by the Institute for Technology Assessment, "A Socio-Technical Analysis of the Labor Market Opportunities Assistance System (AMAS)," does not allow a significant influence of AMAS to be derived: The assessment by the study authors that the working practices of AMS advisors would change significantly as a result of the introduction of AMAS is in any case incorrect and based on a false perception or misconception.The study authors' lack of knowledge about the work of AMS advisors in connection with their comprehensive advisory activities. The study authors also do not doubt that the final decision and responsibility rest with the AMS advisors, but they claim that the system, in AMS practice, creates clear incentives to follow the calculated opportunity value rather than correct it. This mere assertion can be countered by the fact that the federal guideline "Supporting the Workforce," which is binding for advisors, clearly states that the calculated value must be corrected if the advisors arrive at a different assessment. Both in the implementation workshops for the heads of the regional office branches and in the training sessions for the advisors, it is explicitly stated that the evaluation of labor market opportunities remains the responsibility of the advisors, that important placement aspects are to be assessed exclusively by the advisors because they do not appear in AMAS, and that the computer-generated value is only available as an aid. Furthermore, during the development of AMAS, a monitoring system was established to track whether, how often, and in which categories the computer-generated value was adopted by AMS consultants, and when it was corrected. This made it possible to take corrective action if it emerged that the calculated values were being routinely adopted. The planned monitoring and associated evaluation could ultimately no longer take place because AMAS was prohibited by the authority in question and the underlying data was deleted. The concerns of the authority in question that AMS employees were not sufficiently exercising their existing human discretion and were significantly influenced by AMAS were therefore ultimately unfounded. In its response dated January 7, 2025, the complainant essentially reiterated its argument that the facts underlying the ECJ judgment of December 7, 2023, C-634/21, SCHUFA Holding, differ in essential respects from the relevant facts in this case. Quite unlike in the SCHUFA case, AMS advisors are actively involved in supporting job seekers. As already explained in more detail, AMS advisors are required to discuss and assess labor market opportunities in a personal interview with the individuals concerned, and they bear ultimate responsibility for the classification. They can adjust or correct the computer-generated results at any time if they deem this necessary. The AMS advisors are expressly authorized and obligated to do so and are also trained accordingly by the AMS. In contrast to the SCHUFA case, the AMS advisors therefore have broad scope for action and discretion. The facts of the present proceedings are therefore fundamentally different from the SCHUFA case. The application of Article 22 GDPR in the present case fails due to the requirement of a decision based exclusively on automated processing. The approach of the authority in question, which seeks to derive a "significant influence" of AMAS on the advisory activities from, among other things, the several years of AMAS development time, is also misguided. The development time and the fact that AMAS was actually used do not allow any conclusions to be drawn as to whether AMAS falls within the scope of Article 22 GDPR. Even if AMAS was of course intended to help make advisory activities more efficient and allocate funding more effectively, AMAS was never designed to replace AMS employees. The expert opinions cited by the respondent authority are also not suitable for demonstrating a significant influence of AMAS. It is unclear to what extent the expert opinion of the German Data Ethics Commission is even relevant to the present legal case. In its reply, the respondent authority relies on a single quote from the expert opinion, according to which human actors are (allegedly) inclined to simply accept recommendations from algorithmic systems and not exercise existing discretion. This thesis is neither substantiated in the expert opinion nor are any references or empirical evidence cited for it. It cannot in any way be inferred from this that AMAS employees are significantly influenced by AMAS, as the respondent authority attempts to argue. Likewise, the final report submitted by the Institute for Technology Assessment, "A Socio-Technical Analysis of the Labor Market Opportunity Assistance System (AMAS)," fails to infer a significant influence of AMAS: The study authors' assessment that the work practices of AMS advisors would change significantly with the introduction of AMAS is in any case incorrect and based on a misperception or lack of knowledge on the part of the study authors regarding the work of AMS advisors in connection with their comprehensive advisory activities. Furthermore, the study authors do not doubt that the final decision and responsibility lie with the AMS advisors, but they claim that the system creates significant incentives in AMS practice to follow the calculated opportunity value rather than correct it. This mere assertion should be countered by the fact that the federal guideline "Supporting the Workforce," which is binding for advisors, clearly states that the calculated value must be corrected if the advisors arrive at a different assessment. Both in the implementation workshops for the heads of the regional offices and in the training sessions for the advisors, it is explicitly stated that the assessment of labor market opportunities remains the responsibility of the advisors, that important placement aspects are to be assessed exclusively by the advisors because they do not appear in AMAS, and that the computer-generated value is only available as a guide. Furthermore, during the development of AMAS, a monitoring system was established to determine whether, how often, and in which categories the computer-generated value was adopted by AMS advisors, and when it was corrected. This made it possible to take corrective action if it emerged that the calculated values were being routinely adopted. The planned monitoring and the associated evaluation could ultimately no longer take place because the respondent authority had prohibited the use of AMAS and the underlying data had been deleted. The respondent authority's concerns that AMS employees were not adequately exercising their existing human discretion and were significantly influenced by AMAS were therefore ultimately unfounded.

The respondent authority was granted the right to be heard.

On January 29, 2025, the Federal Administrative Court held a public hearing in the presence of the complainant, her legal counsel, and a representative of the respondent authority, in which, among other things, the procedure for using the "AMAS" was discussed.

In a written submission dated February 5, 2025, the complainant submitted further documents, including the specifications for customer segmentation dated July 30, 2018, and the respondent authority was granted the right to be heard.

II. The Federal Administrative Court considered: Roman II. The Federal Administrative Court considered:

1. Findings:

According to Section 1, Paragraph 1 of the Federal Employment Services Act (AMSG), the Public Employment Service is a public service provider with its own legal personality, which is responsible for implementing the federal labor market policy. According to Paragraph 1, Paragraph 1 of the AMSG, the Public Employment Service is a public service provider with its own legal personality, which is responsible for implementing the federal labor market policy.

To support workers in (re-)integrating into the labor market, the Public Employment Service offers various services/support programs, which are (should be) implemented by its consultants, among others.

The detailed procedure for advisors in this regard was set out in the Federal Public Employment Service Guideline "Core Process Supporting the Workforce" ("Core Process Supporting the Workforce with Physical Distancing Regulations" of July 13, 2020, GZ XXXX; hereinafter BRL), effective July 20, 2020.

This guideline stipulates, among other things, that advisors must discuss with their clients their wishes/expectations, their previous career history, and the reasons for their unemployment during a consultation. The job seeker's labor market prospects should also be addressed and discussed.

To support counselors in assessing the labor market prospects of job seekers in the context of their support, the Public Employment Service (AMS) has been developing a concept for calculating the labor market prospects of job seekers (AMAS) since 2016. This model has been used by AMS counselors since the end of 2018. It was to become mandatory starting in 2021. Following the decision of the relevant authority, the complainant stopped the planned implementation.

AMAS is a computer-assisted calculation model that correlates a job seeker's personal characteristics with the labor market and, based on this, predicts their future chances of integration into the labor market.

Specifically, AMAS uses an algorithm (AMAS algorithm) to automatically calculate the probability of currently registered clients being employed for a certain number of days within a certain period of time in the future. For this purpose, a so-called IC was calculated from the following data:

- Age group

- Gender

- Country group

- Education

- Health impairment

- Caregiving responsibilities

- Professional group

- Previous career

- Regional labor market situation

- Duration of the case with the AMS

Based on the calculated IC, a classification into the following groups was made:

- Service customers with high labor market prospects

- Care customers with low labor market prospects

- Counseling customers with medium labor market prospects

AMAS should be used by counselors as support or a "second opinion" in the counseling process. As was the case before the implementation of AMAS, AMS advisors were required to independently assess the labor market prospects for each individual case and compare them with the AMAS results. The AMS advisors were trained in this or were able to independently assess labor market prospects, and they were familiar with the calculation of prospects, criteria, and the AMAS system.

In particular, the AMS advisors were trained that certain factors important for the labor market, such as motivation, housing situation, addiction, debt, incarceration, a person's existing or lacking qualifications (in AMAS, only the highest level of education was represented at three levels: compulsory school, apprenticeship, or high school diploma), etc., were not captured by AMAS and therefore had to be considered exclusively by the AMS advisors based on their personal contact with the clients. Likewise, the AMS advisors were required to consider personal circumstances (e.g., childcare, health restrictions) that had changed during the pre-registration process when assessing labor market prospects and adjust the labor market prospects if necessary.

In addition to the AMAS score and the corresponding group classification, the advisors also received "additional segment information" (also computer-generated), which provided further details on the reasons for the classification (PAMAS manual, section 5.1.4). If an advisor had doubts about the accuracy of the calculation, they could request a plausibility check at any time; every AMS office had an "AMAS representative" who, for example, checked whether certain data had been incorrectly entered into the system.

If the value calculated by the advisors deviated from the AMAS, the advisors had to correct the AMAS score, and this corrected value could no longer be overwritten by AMAS.

The advisors were required to explain and discuss how this score was calculated during the client consultation and to discuss any concerns and fears. If the client had a decidedly different assessment of labor market prospects than the advisors, this had to be documented in the support agreement. In addition, each office had an ombudsman's office, which a client could turn to if they were dissatisfied with a consultation or its outcome.

The final decision regarding client assignment to a group was always made by the advisor. The advisor's personal impression was decisive for the classification. Only after a discussion with the client was the optimal support strategy (support and support services) to be defined by the advisor based on a support agreement.

To ensure that advisors use AMAS only as a second opinion and not exclusively to assess labor market opportunities, the Public Employment Service (AMS) not only provided the guidelines outlined, but also provided corresponding instructions and conducted training sessions. Furthermore, a controlling system was established to continuously monitor reclassifications by advisors. This would have been noticeable, for example, if an individual advisor had never been reclassified or if the calculated value had always been routinely adopted. In such a case, the complainant would have provided the complainant with further instructions.

The decision regarding the use of support instruments was made in a further step. The AMS advisors had to make a selection decision in each individual case from the various employment, training, and support measures provided for the respective group and additionally justify and document this decision in a labor market policy statement. The determined labor market prospects (low, high, or medium) influenced which "funding pool" the advisor could draw from. The specific decision for or against funding from this funding pool was made solely by the advisor.

With regard to classification in the group "service customers with high labor market prospects," the focus of support was on rapid job placement. Clients with medium prospects received intensive support and the full range of support options, but were also placed. External support was reserved for the group with low labor market prospects, and 90-95% of the funding was available, with the exception of, for example, expensive intensive skilled worker training or high-quality nursing training.

2. Assessment of Evidence:

These findings arise, firstly, from the findings made by the respondent authority in the contested decision – based on the information and submissions submitted by the Public Employment Service during the proceedings. The Federal Administrative Court has no reservations about the accuracy of these findings, and no party has asserted this.

Secondly, the findings regarding the (continued) use of AMAS in the counseling process could be based on the credible statements made by the complainant's board member during the oral hearing on January 29, 2025, in conjunction with the documents submitted (the "Federal Guideline Core Process for Supporting Workforces" (BRL), the "PAMAS Manual" of November 20, 2019, and the Specifications - Customer Segmentation of July 30, 2018), as well as the complainant's statements submitted during the proceedings. There are no reasons to doubt the accuracy of these documents and information, and no party has claimed otherwise.

3. Legal Assessment:

The relevant recitals and provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation - GDPR), OJ L 119 of 4 May 2016, p. 1, are as follows:

"[..]

(71) The data subject should have the right not to be subjected to a decision – which may include a measure – evaluating personal aspects concerning him or her, which is based solely on automated processing and which produces legal effects concerning him or her or similarly significantly affects him or her, such as the automatic rejection of an online credit application or online recruitment process without any human intervention. Such processing includes profiling, which consists in any form of automated processing of personal data evaluating personal aspects relating to a natural person, in particular to analyse or predict aspects concerning his or her performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, insofar as it produces legal effects concerning him or her or similarly significantly affects him or her. However, decision-making based on such processing, including profiling, should be permitted if explicitly permitted by Union or Member State law to which the controller is subject, also in order to be in line with the rules, standards and recommendations of the [European] Union institutions or national supervisory bodies, to monitor and prevent fraud and tax evasion and to ensure the security and reliability of a service provided by the controller, or where necessary for the conclusion or performance of a contract between the data subject and a controller, or where the data subject has given his or her explicit consent. In any event, such processing should be subject to appropriate safeguards, including specific information for the data subject and the right to direct human intervention, to express his or her point of view, to have the decision taken following an assessment, and to contest that decision. This measure should not concern a child. In order to ensure fair and transparent processing for the data subject, taking into account the specific circumstances and context in which the personal data are processed, the controller should use appropriate mathematical or statistical procedures for profiling, implement technical and organizational measures appropriately designed to ensure, in particular, that factors leading to inaccurate personal data are corrected and the risk of errors is minimized, and secure personal data in a manner that takes into account the potential threats to the interests and rights of the data subject and, inter alia, prevent discriminatory effects on natural persons based on racial or ethnic origin, political opinions, religion or beliefs, trade union membership, genetic predisposition or health status, or sexual orientation. Automated decision-making and profiling based on special categories of personal data should only be permitted under certain conditions.

[..]

Article 4

Definitions

(1) For the purposes of this Regulation, the following definitions shall apply:

(...)

4. ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

(...)

Article 5

Principles governing the processing of personal data

(1) Personal data must:

a) be processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency');

(...)

c) be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation');

(...)

Article 6

Lawfulness of processing

(1) Processing shall be lawful only if at least one of the following conditions is met:

(...)

c) processing is necessary for compliance with a legal obligation to which the controller is subject;

(...)

e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(...)

(2) Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for the purpose of complying with points (c) and (e) of paragraph 1 by specifying more precisely specific processing requirements and other measures to ensure lawful and fair processing, including for other specific processing situations as referred to in Chapter IX. (2) Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for the purpose of complying with points (c) and (e) of paragraph 1 by specifying more precisely specific processing requirements and other measures to ensure lawful and fair processing, including for other specific processing situations as referred to in Chapter IX.

(3) The legal basis for the processing operations referred to in points (c) and (e) of paragraph 1 shall be:

(a) Union law; or

(b) Member State law to which the controller is subject.

The purpose of the processing must be specified in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, must be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions adapting the application of the rules of this Regulation, inter alia, provisions on the general conditions governing the lawfulness of processing by the controller, the types of data processed, the data subjects concerned, the entities to which and for which purposes the personal data may be disclosed, the purpose limitation, the storage period and the processing operations and procedures that may be used, including measures to ensure lawful and fair processing, such as those for other specific processing situations referred to in Chapter IX. Union or Member State law must pursue an objective in the public interest and be proportionate to the legitimate purpose pursued. The purpose of the processing must be specified in that legal basis or, with regard to the processing referred to in point (e) of paragraph 1, it must be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of the rules of this Regulation, including provisions on the general conditions governing the lawfulness of processing by the controller, the types of data processed, the data subjects concerned, the entities to which and for which purposes the personal data may be disclosed, the purpose limitation, the storage period, and the processing operations and procedures that may be used, including measures to ensure lawful and fair processing, such as those for other specific processing situations pursuant to Chapter IX. Union or Member State law must pursue an objective in the public interest and be proportionate to the legitimate purpose pursued.

(4) Where processing for a purpose other than that for which the personal data were collected is not based on the data subject's consent or on a Union or Member State law which, in a democratic society, constitutes a necessary and proportionate measure to protect the objectives referred to in Article 23(1), the controller shall, in order to determine whether processing for another purpose is compatible with that for which the personal data were initially collected, take into account, inter alia,

a) any link between the purposes for which the personal data were collected and the purposes of the intended further processing;

b) the context in which the personal data were collected, in particular as regards the relationship between the data subjects and the controller;

c) the nature of the personal data, in particular whether special categories of personal data are processed pursuant to Article 9 or whether personal data relating to criminal convictions and offenses pursuant to Article 10 are processed;

d) the possible consequences of the intended further processing for the data subjects;

e) the Existence of appropriate safeguards, which may include encryption or pseudonymization.

(...)

Article 9

Processing of special categories of personal data

(1) The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation, shall be prohibited.

(2) Paragraph 1 shall not apply in the following cases:

(...)

g) processing is necessary for reasons of substantial public interest on the basis of Union or Member State law which is proportionate to the aim pursued, respects the essence of the right to data protection and provides for appropriate and specific measures to safeguard the fundamental rights and interests of the data subject;

h) processing is necessary for the purposes of preventive healthcare or occupational medicine, for assessing the employee's capacity to work, for medical diagnosis, for the provision of health or social care or treatment, or for the management of health or social care systems and services on the basis of Union or Member State law or on the basis of a contract with a healthcare professional and subject to the conditions and safeguards referred to in paragraph 3;

(...)

(3) The personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 if those data are processed by or under the responsibility of a healthcare professional and Specialist personnel are subject to professional secrecy under Union or Member State law or the rules of national competent authorities, or when the processing is carried out by another person who is also subject to an obligation of confidentiality under Union or Member State law or the rules of national competent authorities.

(4) Member States may introduce or maintain additional conditions, including limitations, where the processing of genetic, biometric, or health data is concerned.

(...)

Article 22

Automated individual decision-making, including profiling

(1) The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

(2) Paragraph 1 shall not apply if the decision

a) is necessary for entering into, or the performance of, a contract between the data subject and the controller,

b) is authorized by Union or Member State law to which the controller is subject, and that law lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or

c) is based on the data subject's explicit consent.

(3) In the cases referred to in points (a) and (c) of paragraph 2, the controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

(4) Decisions pursuant to paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and appropriate measures to protect the rights and freedoms and legitimate interests of the data subject have been taken.

In the present case, the respondent authority, with the contested decision, prohibited the Public Employment Service (AMS) from processing data in connection with the determination of labor market opportunities for job seekers with the assistance of the AMAS, with effect from 1 January 2021. In support of its decision, the respondent authority essentially stated that the present assessment could not be based on an appropriate legal basis and, in any case, that the prohibition under Article 22 GDPR applied. In the present case, the respondent authority, with the contested decision, prohibited the Public Employment Service (AMS) from processing data in connection with the determination of labor market opportunities for job seekers with the assistance of the AMAS, with effect from 1 January 2021. In support of its decision, the respondent authority essentially stated that the present assessment could not be based on an appropriate legal basis and, in any case, that the prohibition under Article 22 GDPR applied.

It is undisputed that the method used by the complainant to calculate labor market opportunities It is also beyond doubt (meanwhile) that the data processing program AMAS used by the complainant to calculate labor market opportunities is profiling within the meaning of Article 4(4) GDPR (see VwGH, 21.12.2023, Ro 2021/04/0010, para. 78). It is also beyond doubt (meanwhile) that the present data processing for calculating labor market opportunities is to be examined using the relevant provisions of the GDPR, without taking into account the standard of Section 1 Para. 2 DSG (see in detail VwGH, 21.12.2023, Ro 2021/04/0010, para. 32ff). It is undisputed that the data processing program AMAS used by the complainant to calculate labor market opportunities is profiling within the meaning of Article 4, Para. 4, GDPR (see VwGH, 21.12.2023, Ro 2021/04/0010, para. 78). It is also beyond doubt (meanwhile) that the present Data processing for the purpose of calculating labor market opportunities must be examined by applying the relevant provisions of the GDPR, without taking into account the standard of paragraph 1, paragraph 2, of the Data Protection Act (see in detail VwGH, December 21, 2023, Ro 2021/04/0010, paras. 32 et seq.).

According to the established case law of the ECJ, any processing of personal data must be consistent with the principles for the processing of personal data set out in Article 5 GDPR and, in view of the principle of lawfulness of processing provided for in Article 5(1)(a), must meet one of the conditions for lawfulness of processing set out in Article 6 of that Regulation (see, among others, ECJ, December 7, 2023, C-634/21, para. 66). According to the established case law of the ECJ, any processing of personal data must be consistent with the principles for the processing of personal data set out in Article 5 GDPR and, in view of the In its decision of December 21, 2023, the Administrative Court (VwGH) accordingly clarified that the question of the lawfulness of the processing in question under the provisions of Articles 6 and 9 GDPR must be separated from the question of the prohibition of automated decisions pursuant to Article 22 GDPR. The Administrative Court (VwGH) accordingly clarified that the question of the lawfulness of the processing in question under the provisions of Articles 6 and 9 GDPR must be separated from the question of the prohibition of automated decisions pursuant to Article 22 GDPR.

In its decision, the Administrative Court confirmed the legal opinion of the Federal Administrative Court that Section 25 AMSG, in view of the tasks of the complainant defined in Sections 29 to 31 AMSG and in particular the high priority given to the best possible integration of job seekers into the national labor market in society, can be used as a suitable legal basis within the meaning of Article 6 (1) (e) and Article 9 (2) (g) GDPR for the present data processing, regardless of whether the determination of labor market opportunities on the basis of the data listed therein is carried out with or without the aid of AMAS as profiling. In its decision, the VwGH confirmed the legal opinion of the Federal Administrative Court, according to which Section 25 AMSG, in view of the tasks of the complainant defined in Sections 29 to 31 AMSG and in particular the high priority given to the best possible integration of job seekers into the national labor market in society, can be used as a suitable legal basis within the meaning of Article 6 (1) (e) and Article 9 (2) (g) GDPR for the present data processing, regardless of whether the determination of labor market opportunities based on the data listed there, with or without the aid of AMAS as profiling.

However, in view of the case law of the ECJ in its judgment of December 7, 2023, C-634/21, it has not been conclusively clarified in the present case whether a case under Article 22 (1) GDPR does not apply. The Federal Administrative Court's finding that instructions and training courses ensured that the complainant's advisors would not unquestioningly accept the result of the algorithm does indeed justify the assumption that the classification into the respective customer group is not based exclusively on AMAS. However, this finding does not exclude the possibility that AMAS - as an automated decision - is ultimately decisive for this classification. The - possibly - purely formal separation of the decision significantly influenced by automated data processing from the automated data processing itself does not prevent the classification of the latter as a decision that is fundamentally prohibited under Article 22 GDPR. However, in view of the The ECJ's case law, which has since been issued in its judgment of December 7, 2023, C-634/21, has not conclusively clarified whether Article 22, paragraph 1, of the GDPR does not apply in the present case. The Federal Administrative Court's finding that instructions and training had ensured that the complainant's advisors would not unquestioningly accept the algorithm's results does indeed justify the assumption that classification into the respective customer group is not based exclusively on the AMAS. However, this finding does not exclude the possibility that AMAS - as an automated decision - is ultimately decisive for this classification. The - possibly - purely formal separation of the decision significantly influenced by automated data processing from the automated data processing itself does not prevent the latter from being classified as a decision that is fundamentally prohibited under Article 22 of the GDPR.

In the judgment cited by the Administrative Court, the ECJ had to assess the question of whether the automated creation of a decision based on personal data relating to a person The Court held that the automated creation of a probability value based on personal data relating to a person regarding their ability to meet future payment obligations by a credit reporting agency is to be qualified as an automated decision in an individual case pursuant to Art. 22 (1) GDPR if this probability value is the decisive factor in determining whether a third party to whom this probability value is transmitted establishes, performs, or terminates a contractual relationship with that person. In the judgment cited by the Administrative Court, the ECJ had to assess the question of whether the automated creation of a probability value based on personal data relating to a person regarding their ability to meet future payment obligations by a credit reporting agency is to be qualified as an automated decision in an individual case pursuant to Article 22 (1) GDPR if this probability value is the decisive factor in determining whether a third party to whom this probability value is transmitted establishes, performs, or terminates a contractual relationship with that person.

The ECJ stated that the applicability of the provision of Art. 22 (1) GDPR depends on three cumulative conditions, namely, that, first, a "decision" must exist, second, this decision must be "based exclusively on automated processing, including profiling," and third, it must "produce legal effects concerning [the data subject]" or "similarly significantly" affect him or her (ECJ, 7 December 2023, C-634/21, para. 43). The ECJ stated that the applicability of the provision of Article 22, paragraph 1, GDPR depends on three cumulative conditions, namely, first, a "decision" must exist, second, this decision must be "based exclusively on automated processing, including profiling," and third, it must "produce legal effects concerning [the data subject]" or "similarly significantly" affect him or her (ECJ, 7 December 2023, C-634/21, para. 43).

Regarding the existence of a decision, the ECJ stated, With reference to Recital 71 and the Advocate General's comments in his Opinion, it is clear that not only the granting or non-granting of a loan, but also the assessment of personal aspects that affect a person and may affect that person in many respects, including socially, is to be qualified as a decision within the meaning of Article 22 (1) GDPR and thus the result of the calculation of a person's ability to meet future payment obligations in the form of a probability value must be included (Advocate General's Opinion, 16 March 2023, C-634/21, para. 38 and ECJ, 7 December 2023, C-634/21, para. 46). Regarding the existence of a decision, the ECJ, with reference to Recital 71 and the Advocate General's comments in his Opinion, clarified that not only the granting or non-granting of a loan, but also the assessment of personal aspects that may affect a person and may affect them in many respects, including socially, is in itself to be qualified as a decision within the meaning of Article 22, paragraph 1, GDPR and thus the result of the calculation of a person's ability to meet future payment obligations in the form of a probability value must be included (Opinion of the Advocate General, 16.03.2023, C-634/21, para. 38 and ECJ, 07.12.2023, C-634/21, para. 46).

Regarding the second requirement that this decision must be "based exclusively on automated processing, including profiling," the ECJ stated that the credit rating assessment to be carried out by the credit agency in the present case was carried out exclusively by automated means, namely in the form of profiling within the meaning of Article 4(4) GDPR (ECJ, December 7, 2023, C-634/21, para. 47). In doing so, the ECJ explicitly relied on the Advocate General's observations. In his Opinion, the Advocate General stated that there was nothing in the factual description of the order for reference to indicate that, in addition to the mathematical and statistical procedures used by the credit agency, the score values were in any way significantly determined by an individual evaluation and assessment by a human being. Consequently, according to the Advocate General, it must be assumed that the determination of the score, as an act of the credit agency, is based "exclusively on automated processing" (Advocate General's Opinion, March 16, 2023, C-634/21, para. 36). Regarding the second requirement that this decision must be "based exclusively on automated processing, including profiling," the ECJ stated that the credit rating to be assessed by the credit agency in the present case is carried out exclusively by automated means, namely in the form of profiling within the meaning of Article 4(4) GDPR (ECJ, December 7, 2023, C-634/21, para. 47). In doing so, the ECJ explicitly relied on the Advocate General's statements. In his Opinion, the Advocate General stated that there was nothing in the factual description of the order for reference to indicate that, in addition to the mathematical and statistical procedures applied by the credit agency, the score values were in any way significantly determined by an individual evaluation and assessment by a human being. Consequently, according to the Advocate General, it must be assumed that the determination of the score, as an act of the credit agency, was based "exclusively on automated processing" (Advocate General's Opinion, 16 March 2023, C-634/21, paragraph 36).

With regard to the third requirement, namely that the decision must produce "legal effects" on the data subject or affect him or her "in a similar and significant way," the ECJ also followed the Advocate General's Opinion, according to which the assessment of solvency and the resulting granting or non-granting of credit entails a significant disadvantage for the data subject (ECJ, December 7, 2023, C-634/21, para. 48). It is irrelevant in the present case that the granting or non-granting of credit lies not with the credit agency responsible for the score, but with a financial enterprise as a third party. The decisive factor – probably also with regard to the requirement of "exclusively automated processing" stipulated in Art. 22 (1) GDPR – is solely that the credit agency's profiling-based score plays a decisive and thus decisive role in the financial enterprise's granting of credit agreements. This would be the case if a human were involved in the procurement procedure, but were unable to influence the causal link between the automated processing and the granting of credit (Advocate General's Opinion, 16 March 2023, C-634/21, paras. 41 and 44). With regard to the third requirement, namely that the decision must have "legal effects" on the data subject or affect him or her "in a similar and significant way," the ECJ also followed the Advocate General's Opinion, according to which the assessment of solvency and the resulting granting or refusal of credit entails a significant adverse effect on the data subject (ECJ, 7 December 2023, C-634/21, para. 48). It is irrelevant in the present case that the granting or refusal of credit lies not with the credit agency responsible for the credit score, but with a financial company as a third party. The decisive factor – probably also with regard to the requirement of "exclusively automated processing" stipulated in Article 22, paragraph 1, GDPR – is that the credit agency's profiling-based score plays a decisive and thus decisive role in the financial institution's awarding of credit agreements. This would be the case if a human were involved in this award procedure, but were unable to influence the causal link between the automated processing and the granting of the credit (Advocate General's Opinion, March 16, 2023, C-634/21, paragraphs 41 and 44).

The following conclusions apply to the present case:

Given the broad interpretation of the term "decision" within the meaning of Article 22(1) GDPR, as adjudicated by the ECJ and set out above, there are no concerns about qualifying the assessment of individuals' labor market prospects – prior to the funding decision – as a decision within the meaning of Article 22(1) GDPR, especially since the forecast of aspects of work performance is explicitly mentioned in Recital 71 as an example of such a decision.

Given the broad interpretation of the term "decision" within the meaning of Article 22(1) GDPR, as adjudicated by the ECJ and set out above, there are no concerns about qualifying the assessment of individuals' labor market prospects – prior to the funding decision – as a decision within the meaning of Article 22(1) GDPR, especially since the forecast of aspects of work performance is explicitly mentioned in Recital 71 as an example of such a decision. However, unlike the facts underlying the ECJ's assessment, this assessment is not carried out exclusively in the form of profiling (AMAS). The Administrative Court held that the complainant's instructions and training ensure that the current classification into the respective client group is not based solely on the AMAS. However, this does not preclude the possibility that AMAS – as an automated decision – is ultimately decisive for this classification and thus the involvement of a natural person is merely formal.

The subsequent investigation revealed that in the present case, AMAS is used by the consultants solely as a decision-making aid in assessing labor market opportunities and is not intended to replace them in their work. In the course of their advisory work, the complainant's advisors were instructed and trained to independently assess the labor market prospects of a person concerned based on both existing data and circumstances discovered for the first time during a personal interview, to compare this result with the AMAS value calculated from the available data, and to question themselves and the AMAS value in the event of discrepancies. For this purpose, the advisors had access to computer-generated "additional segment information" containing further details on the reasons for the AMAS classification. In the event of doubts about the accuracy of the AMAS value, the advisors could also request a plausibility check from the complainant. If the value calculated by the advisors continued to deviate from AMAS, the advisors were required to correct the AMAS value, and this corrected value could no longer be overwritten by AMAS. Furthermore, the advisors were required to explain and discuss the calculated labor market prospects (high, medium, low) during the client consultation, as well as to discuss any concerns and fears. If the client had a decidedly different assessment of their labor market prospects than the advisors, this had to be documented in the support agreement. In addition, each office had an ombudsman's office, to which a client could turn if they were dissatisfied with a consultation or the outcome. To ensure that the advisors did not unquestioningly adopt the AMAS value, the complainant also established a monitoring office, which monitored the advisors' reclassifications and, in the event of missing reclassifications, instructed them accordingly by the complainant.

Based on these findings, it can be concluded that the advisors' involvement in the decision-making process is not merely formal, but rather substantive. Not only do they make the final decision regarding the assessment of the labor market prospects of the affected person, but they are also authorized or even obligated, and, due to their information and resources, are also able to deviate from the automatically calculated AMAS score in each individual case.

To ensure that the advisors actually exercise this authority or obligation, the complainant has implemented various preventive measures (training, instructions for action) and follow-up measures (controlling unit, renewed employee training). Furthermore, the affected person has been given the opportunity to reflect on the advisors' assessment during a mandatory personal meeting with the advisors and, furthermore, to have the accuracy of this assessment subsequently reviewed by the complainant's ombudsman.

Given these clear internal guidelines addressed to the counselors and the measures taken to comply with these guidelines, the court sees no reason in the present case to assume that AMAS significantly determines a person's labor market prospects and, therefore, that the calculation is "exclusively automated."

It is also not at all clear or comprehensible to what extent a long development period for AMAS – as claimed by the respondent authority – should, in itself, be considered an indication of such a significant influence by AMAS, especially since the complainant has repeatedly and plausibly pointed to the significant increase in efficiency in counseling sessions associated with AMAS as an explanation for the use and (therefore complex) development of AMAS.

Insofar as the authority concerned, with reference to two expert opinions, points to the manipulative effect of profiling itself and thus to the fact that in many – although in the opinion of the authority concerned not all – advisory cases, a "routine adoption" of the calculated values or at least a "significant influence" by AMAS could occur, it must be noted that the complainant has adequately and specifically counteracted such a circumstance precisely through the control mechanisms available to the complainant, as outlined above, but also to the data subject themselves, with regard to the consultants' assessment. A more detailed examination of a possible manipulative effect of profiling – generally identified in the two expert opinions – could therefore be omitted, given the complainant's measures specifically designed to counteract such an effect. There is no evidence that the advisors would still use AMAS significantly to assess labor market opportunities despite the complainant's clear instructions regarding the use of AMAS and the control mechanisms established for this purpose, and such evidence was not plausibly explained or demonstrated in any way by the authority concerned (including on the basis of the submitted reports).

Since the assessment of labor market opportunities is therefore already carried out primarily by a person and thus not exclusively by automated means within the meaning of Article 22 (1) GDPR, further discussion regarding the third requirement outlined above, namely that the decision must have "legal effects" on the data subject or affect them "in a similar and significant way," can be omitted. Since the assessment of labor market opportunities is therefore already carried out primarily by a person and thus not exclusively by automated means within the meaning of Article 22, Paragraph 1, GDPR, further discussion regarding the third requirement outlined above, namely that the decision must have "legal effects" on the data subject or affect them "in a similar and significant way," can be omitted.

The present data processing could therefore rightly be based on Section 25, Paragraph 1, AMSG, and there was no application of Article 22, Paragraph 1, GDPR.

The present data processing could therefore rightly be based on Section 25, Paragraph 1, AMSG, and there was no application of Article 22, Paragraph 1, GDPR.

The contested decision was therefore to be annulled for lack of a violation of the principle of lawful data processing stipulated in Article 5, Paragraph 1, Letter a, GDPR. The contested decision was therefore annulled for lack of a violation of the principle of lawful data processing stipulated in Article 5, paragraph 1, letter a, GDPR.

Regarding B) Admissibility of the appeal:

According to Section 25a, paragraph 1 of the Administrative Court Act (VwGG), the administrative court must state in its judgment or decision whether the appeal is admissible pursuant to Article 133, paragraph 4 of the Federal Constitutional Court Act (B-VG). The decision must be briefly reasoned.

The present decision does not depend on the resolution of a legal issue of fundamental importance. There is neither a lack of case law of the Administrative Court, nor does the present decision deviate from the case law of the Administrative Court; Furthermore, the present case law of the Administrative Court cannot be considered inconsistent. Furthermore, a (non-reviewable) case-by-case assessment was required.
↑ You can read the GDPRhub summary here: VwGH - Ro 2021/04/0010-11
[1] You can read the GDPRhub summary here: VwGH - Ro 2021/04/0010-11
[1]