BVwG - W256 2275675-1
From GDPRhub
| BVwG - W256 2275675-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 12(3) GDPR Article 16 GDPR §38 AVG |
| Decided: | 12.10.2023 |
| Published: | |
| Parties: | |
| National Case Number/Name: | W256 2275675-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2023:W256.2275675.1.00 |
| Appeal from: | DSB (Austria) |
| Appeal to: | Appeal not upheld VwGH (Austria) Ra 2023/04/0248 |
| Original Language(s): | German |
| Original Source: | RIS (in German) |
| Initial Contributor: | co |
An Austrian Court held that the Austrian DPA unlawfully suspended proceedings until delivery of a CJEU Judgement on the interpretation of Article 16 GDPR.
English Summary
Facts
On 9 March 2023, a data subject asked the Arbeitsmarktservice (the public employment service), as a controller, to change their gender on the platform from “male” to “divers”. In this, the data subject also submitted an official document proving the change of gender entry in the civil register. On 15 March, the controller replied that it could not do so as it was impossible to with the software used.
A few days later, the data subject filed a complaint with the Austrian DPA (DSB) claiming that their right to rectification under Article 16 GDPR had been violated.
In its submissions, the controller stated that it was planning to implement a system allowing to change one’s gender on the platform, but this would only be available in June 2023, that is, still within the deadline of additional two months foreseen in Article 12(3) GDPR. The controller claimed that, once the technical changes will be implemented, it will proceed to change the data subject’s gender.
The data subject submitted that the controller could have complied with their request by June 2023, if the controller would have informed the data subject about the additional time needed, even though the controller actually had enough time before that in order to duly adapt its technical system. Since the controller did not do that, but instead answered that they will not follow the request, Article 12(3) GDPR is not relevant. Later, however, the controller let the DSB know that it would take it even longer to adopt the technical implementations required to allow the data subject to change their gender on the platform.
The DSB, however, suspended the proceedings on the basis of Article 38 of the General Administrative Procedures Act (AVG) until the CJEU delivers its judgment on the preliminary questions in case C-247/23, received on 18 April 2023, which concerned the interpretation of Article 16 GDPR.
The data subject claimed that the DSB was not allowed to suspend proceedings since the case pending before the CJEU was not relevant to the procedure in question. Hence, the case was submitted for review to the Federal Administrative Court (Bundesverwaltungsgericht - BVwG).
Holding
The BVwG held that the DSB may have a right to suspend administrative proceedings under §38 AVG and in line with the jurisprudence of the Supreme Administrative Court, also in case of a pending preliminary ruling before the CJEU, where such ruling is decisive for the administrative proceedings in question. To be considered decisive for administrative proceedings, a pending ruling by another court or authority must first be a decision concerning a question that is necessary in order to answer the main query in the proceedings; secondly, the pending decision must be binding on the authority.
The questions referred to the CJEU did concern the interpretation of Article 16 GDPR, but as regards the obligation to change a data subject’s gender in a registry upon request. In the case at hand, however, the controller did not refuse to do so, but it stated that it will do so once the technical implementations necessary thereto are adopted.
In the case at hand, the issue regards a delay in complying with the data subject’s request of rectification, the question being whether the controller has a right to delay compliance with the request by another 2 months as foreseen in Article 12(3) GDPR. The preliminary ruling by the CJEU, thus does not have a decisive impact on the proceedings, as it deals with different matters that are not relevant for the DSB to take a decision. The BVwG further clarified that, generally, in order to suspend proceedings before an authority it is sufficient there is at least a “similar” question pending before another court. However, the mere fact that in this case the two procedures both dealt with questions regarding Article 16 GDPR did not make them sufficiently similar, as the actual object of the procedures differed substantially.
The BVwG thus annulled the suspension of proceedings by the DSB.
Comment
Share your comments here!
Further Resources
The data subject's blog post on the topic
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Decision date October 12, 2023 standard AVG §38 B-VG Art 133 Paragraph 4 GDPR Art 12 GDPR Art 16 AVG § 38 today AVG § 38 valid from March 1st, 2013 last changed by Federal Law Gazette I No. 33/2013 AVG § 38 valid from February 1st, 1991 to February 28th, 2013 B-VG Art. 133 today B-VG Art. 133 valid from January 1st, 2019 to May 24th, 2018 last changed by Federal Law Gazette I No. 138/2017 B-VG Art. 133 valid from January 1st, 2019 last changed by Federal Law Gazette I No. 22/2018 B-VG Art. 133 valid from May 25, 2018 to December 31, 2018 last changed by Federal Law Gazette I No. 22/2018 B-VG Art. 133 valid from August 1, 2014 to May 24, 2018 last changed by Federal Law Gazette I No. 164/2013 B-VG Art by BGBl amended by BGBl. No. 211/1946 B-VG Art. 133 valid from December 19, 1945 to December 24, 1946 last amended by StGBl. No. 4/1945 B-VG Art. 133 valid from January 3, 1930 to June 30, 1934 saying W256 2275675-1/4E IN THE NAME OF THE REPUBLIC! The Federal Administrative Court recognizes Judge Mag. Caroline Kimm as presiding judge, the expert lay judge Dr. Claudia Rosenmayr-Klemenz and the expert lay judge Mag. Adriana Mandl as assessors on XXXX's complaint against the data protection authority's decision of July 19, 2023, Zl. D 124.0565/23 (2023-0.490.353), rightly: The Federal Administrative Court recognizes by the judge Mag. Caroline Kimm as chairwoman, the expert lay judge Dr. Claudia Rosenmayr-Klemenz and the expert lay judge Mag. Adriana Mandl as assessors on the complaint by Roman XXXX against the data protection authority's decision of July 19, 2023, Zl. D 124.0565/23 (2023-0.490.353), rightly: A) The complaint is upheld and the contested decision is repealed without replacement. B) The appeal is inadmissible according to Article 133, paragraph 4 B-VG. text Reasons for the decision: I. Process: Roman one. Process: In its (improved) complaint dated March 18, 2023, the complaining party alleges a violation of its right to rectification pursuant to Art. 16 GDPR by the employment service (hereinafter: co-participating party). In the enclosed fax dated March 9, 2023, she asked the party involved to change their gender entry from “male” to “diverse”. The complaining party referred to a ruling by the Vienna Regional Administrative Court dated February 27, 2023, VGW-101/007/15504/2022, which ordered this change to the civil status register. In its email dated March 15, 2023, which was also submitted, the participating party informed the complaining party that it would not comply with their request because this was not technically possible. In its (improved) complaint dated March 18, 2023, the complaining party alleges a violation of its right to rectification under Article 16, GDPR by the Public Employment Service (hereinafter: co-participating party). In the enclosed fax dated March 9, 2023, she asked the party involved to change their gender entry from “male” to “diverse”. The complaining party referred to a ruling by the Vienna Regional Administrative Court dated February 27, 2023, VGW-101/007/15504/2022, which ordered this change to the civil status register. In its email dated March 15, 2023, which was also submitted, the participating party informed the complaining party that it would not comply with their request because this was not technically possible. At the request of the authority concerned, the party involved stated in its statement of April 25, 2023 that the complaining party's application had been checked again and it was determined that - contrary to the statements in the email of March 9, 2023 - but I do not have an active customer relationship (internal status “dormant”) with the party involved. After completion of the business transaction, the data of persons who are not in an active care relationship would only be stored until the end of the respective period in accordance with the applicable retention periods in accordance with Section 25 (9) AMSG. In the absence of further processing purposes, additional processing apart from storage to fulfill retention obligations is not planned. If the complaining party were to enter into a customer relationship again and the data record was reactivated as a result, the processing would be legitimized by different purposes, such as advice and/or mediation. In such cases, there would be no processing beyond pure storage. By assuming the internal status of "dormant", the data record meets the requirements of a restriction in accordance with Article 18 (2) GDPR. At the request of the relevant authority, the participating party stated in its statement of April 25, 2023 that the application was essential here The complaining party was checked again and it was determined that - contrary to the statements in the email of March 9, 2023 - it does not have an active customer relationship (internal status “dormant”) with the other party involved. After completion of the business case, the data of persons who are not in an active care relationship would only be stored until the end of the respective period in accordance with the applicable retention periods in accordance with Section 25, Paragraph 9, AMSG. In the absence of further processing purposes, additional processing apart from storage to fulfill retention obligations is not planned. If the complaining party were to enter into a customer relationship again and the data record was reactivated as a result, the processing would be legitimized by different purposes, such as advice and/or mediation. In such cases, there would be no processing beyond pure storage. By assuming the internal status "dormant", the data record meets the requirements of a restriction in accordance with Article 18, Paragraph 2, GDPR. The party involved has already set up its own project to support gender diversity. Due to the complexity, diversity and advanced age of the AMS IT systems, it is necessary to carry out a comprehensive survey and analysis phase in order to, on the one hand, meet the desired requirements and, on the other hand, to avoid possible negative effects due to an inconsiderate implementation that could impair integrity . For clarification, it should be noted that the applications in question form an integral part of the entire application landscape of the participating party. Any inconsistencies could significantly affect the fulfillment of the legal duties of the party involved. This explains the long and extensive survey and analysis phase. The planned introduction of the changes in the employment service is now scheduled for June 2023. In order to still fulfill the request of the complaining party, the request for correction is saved in the data record and the correction is carried out manually after the planned changeover. The request for correction was received by the party involved on March 9, 2023. According to Article 12 Paragraph 3 GDPR, she would have had until June to respond to the application. Considering the implementation took place in June, this would have been easily implemented within the given time frame. In order to still fulfill the request of the complaining party, the request for correction was saved in the data record and the correction was carried out manually after the planned changeover. The request for correction was received by the party involved on March 9, 2023. According to Article 12, Paragraph 3 of the GDPR, she would have had until June to respond to the application. Considering the implementation took place in June, this could have been easily implemented within the given time frame. In addition, the complaining party stated in its email of April 26, 2023 that the party involved was processing data about the complaining party, even if it was not noted as looking for work. As she informed the party involved in the attached email dated March 15, 2023, she could log in to the eAMS without any problems and, as can be seen in the appendix, the wrong gender was stored there. The participating party would have had until June to respond to the application if it had informed the complaining party of an extension of the deadline. Instead, the party involved informed her that she would not follow the request. In this respect, this deadline is not relevant. Furthermore, the party involved had more than five years to implement the necessary changes in the system. At the request of the authority concerned, the magistrate of the city of Vienna, municipal department 63, informed the authority concerned in a letter dated May 2, 2023 that an ordinary decision was filed against the decision of the Vienna State Administrative Court of February 27, 2023, VGW-101/007/15504/2022 An appeal was filed, but suspensive effect was not applied for. The change in the gender entry from “male” to “diverse” was changed in the Central Civil Status Register (ZPR) on March 22, 2023. The City of Vienna Magistrate, Municipal Department 63, informed the respondent about the request of the authority concerned in a letter dated May 2, 2023 Authority stated that an ordinary appeal had been filed against the decision of the Vienna Regional Administrative Court of February 27, 2023, VGW-101/007/15504/2022, but that a suspensive effect had not been requested. The change in the gender entry from “male” to “diverse” was changed in the Central Civil Status Register (ZPR) on March 22, 2023. Following a further request from the relevant authority, the participating party announced in its statement of June 22, 2023, among other things, that after further coordination with the project team, the option of changing the gender entry would only be available in the course of the fourth quarter, starting in June The first test preparations would take place in 2023. Implementation at this time is not possible and does not deliver the result desired by the complaining party. In this regard, the complaining party stated in its email of July 3, 2023 that, even if the DSG in principle provides that a defect can be remedied subsequently, it is questionable whether this also applies if it takes almost a year and affects a highly sensitive area of life. The complaining party therefore continues to maintain its applications. The contested decision continued the procedure until the final decision by the Court of Justice of the European Union in case C-247/23 "with regard to the question of the interpretation of Article 16 of the GDPR under EU law with regard to the correction of the gender entry in a register and whether the The person concerned who has requested the correction of the data relating to their gender is obliged to provide evidence to justify their request is suspended in accordance with Section 38 AVG. The contested decision continued the procedure until the final decision by the Court of Justice of the European Union in case C-247/23 "with regard to the question of the interpretation of Article 16 of the GDPR under Union law with regard to the correction of the gender entry in a register and whether the The person concerned who has requested the correction of the data relating to their gender is obliged to provide evidence in support of their request is suspended in accordance with paragraph 38, AVG”. The authority concerned explained that the subject of the complaint was the question of whether the party involved had violated the complaining party's right to rectification by not complying with the request to correct the gender from “male” to “diverse”. In this case, it must first be examined whether the proceedings should be suspended in accordance with Section 38 AVG. The party involved is a service company under public law with its own legal personality, which is responsible for implementing the federal labor market policy. There is currently no active customer relationship between the complaining party and the co-involved party. For this reason, the internal status is set to “dormant”. The complaining party's personal data is currently only stored for the duration of the retention period, but is not processed for any other purposes (e.g. advice and mediation). The complaining party did not comply with the complaining party's request for correction dated March 9, 2023 due to a lack of current technical possibilities. The party involved intends to change the system. This is planned for autumn 2023. Changing the gender entry will be possible during the fourth quarter of 2023. On April 18, 2023, a Hungarian court submitted a request for a preliminary ruling to the Court of Justice of the European Union. The subject and relevant facts of the legal dispute are that a data subject, citing Article 16 of the GDPR, requested that the gender stated in a register be corrected to male and that their first name be changed. However, this was refused by the authority with a decision, whereupon the person concerned filed a complaint with the court and the court in turn submitted the following questions to the ECJ: The authority concerned stated that the subject of the complaint was the question of whether the party involved was in the right to represent the complaining party for correction by not complying with the request to correct the gender from “male” to “diverse”. In the present case, it must be examined beforehand whether the procedure should be suspended in accordance with Paragraph 38 of the AVG. The party involved is a service company under public law with its own legal personality, which is responsible for implementing the federal labor market policy. There is currently no active customer relationship between the complaining party and the co-involved party. For this reason, the internal status is set to “dormant”. The complaining party's personal data is currently only stored for the duration of the retention period, but is not processed for any other purposes (e.g. advice and mediation). The complaining party did not comply with the complaining party's request for correction dated March 9, 2023 due to a lack of current technical possibilities. The party involved intends to change the system. This is planned for autumn 2023. Changing the gender entry will be possible during the fourth quarter of 2023. On April 18, 2023, a Hungarian court submitted a request for a preliminary ruling to the Court of Justice of the European Union. The subject and relevant facts of the dispute are that a data subject, citing Article 16 of the GDPR, requested that the gender stated in a register be corrected to male and that their first name be changed. However, this was refused by the authority with a notice, whereupon the person concerned filed a complaint with the court and the court in turn submitted the following questions to the ECJ: "1. Should Article 16 of the GDPR be interpreted as meaning that, with a view to exercising the rights of the data subject, the authority which maintains the registers under Member State law is obliged to correct personal data registered by it relating to the gender of that person if this Data have changed since they were entered into the register and therefore do not comply with the principle of accuracy set out in Article 5 Paragraph 1 Letter d GDPR?"1. Should Article 16 of the GDPR be interpreted as meaning that, with a view to exercising the rights of the data subject, the authority which maintains registers under Member State law is obliged to correct personal data registered by it relating to the gender of that person if the latter data have changed since they were entered into the register and therefore do not comply with the principle of accuracy set out in Article 5, paragraph one, letter d of the GDPR? 2. If question 1 is answered in the affirmative: Should Article 16 GDPR be interpreted as meaning that the person requesting the correction of data relating to their gender is obliged to provide evidence to support their request for correction?2. If question 1 is answered in the affirmative: Should Article 16 of the GDPR be interpreted as meaning that the person requesting the correction of data relating to their gender is obliged to provide evidence in support of their request for correction? 3. If question 2 is answered in the affirmative: Should Article 16 GDPR be interpreted as meaning that the applicant must prove that he or she has undergone gender reassignment surgery?”3. If question 2 is answered in the affirmative: Should Article 16, GDPR, be interpreted as meaning that the applicant must prove that he or she has undergone gender reassignment surgery?” Based on the subject of the complaint brought forward by the complaining party, the right to rectification of gender identity in accordance with Article 16 of the GDPR, the questions referred to the ECJ are also of crucial importance for the treatment of this procedure. On the one hand, this concerns the general Union law interpretation of Article 16 of the GDPR with regard to changes to the gender entry of a data subject, and on the other hand, in particular, the preliminary question 2 and the possible resulting answer to the preliminary question 3. Based on the subject of the complaint raised by the complaining party, right to Correction of gender identity in accordance with Article 16 of the GDPR, the questions submitted to the ECJ are also of crucial importance for the treatment of this procedure. On the one hand, this concerns the general Union law interpretation of Article 16 of the GDPR with regard to changes to the gender entry of a data subject, and on the other hand, in particular, question 2 and the possible resulting answer to question 3. The present complaint is directed against this. The preliminary ruling procedure pending before the ECJ is not comparable to the present procedure and is therefore not procedurally relevant. The preliminary ruling procedure concerns a change to an entry in a state register upon presentation of a medical certificate of the diagnosis “transsexualism” without evidence of a “sex change”. However, it is not the responsibility of the authority concerned to decide on the gender entry in the civil status register. The complaining party's gender entry in the civil status register had already been changed. The complaint in question, however, relates to the fact that the participating party refused to implement this change in its database, so that it was processing incorrect personal data of the complaining party. In addition, the complaining party submitted a public document as proof of the justification for the change, or an official investigation was carried out to determine which gender entry in the civil status register was current. The question of the obligation to provide proof for a change to an entry in a state register does not arise in the present proceedings. The GDPR provides for an extension of the deadline to a total of three months for applications whose complexity or scope goes beyond the usual level. The participating party would have had until June to implement the application, but only if it had also informed the complaining party of such an extension of the deadline. Instead, she informed the complaining party that she would not follow the request. Furthermore, it had been clear since 2018 that it had to be possible to enter entries other than “male” and “female”. This complaint is directed against this. The preliminary ruling procedure pending before the ECJ is not comparable to the present procedure and is therefore not procedurally relevant. The preliminary ruling procedure concerns a change to an entry in a state register upon presentation of a medical certificate of the diagnosis “transsexualism” without evidence of a “sex change”. However, it is not the responsibility of the authority concerned to decide on the gender entry in the civil status register. The complaining party's gender entry in the civil status register had already been changed. The complaint in question, however, relates to the fact that the participating party refused to implement this change in its database, so that it was processing incorrect personal data of the complaining party. In addition, the complaining party submitted a public document as proof of the justification for the change, or an official investigation was carried out to determine which gender entry in the civil status register was current. The question of the obligation to provide proof for a change to an entry in a state register does not arise in the present proceedings. The GDPR provides for an extension of the deadline to a total of three months for applications whose complexity or scope goes beyond the usual level. The participating party would have had until June to implement the application, but only if it had also informed the complaining party of such an extension of the deadline. Instead, she informed the complaining party that she would not follow the request. Incidentally, it has been clear since 2018 that it must be possible to enter entries other than “male” and “female”. The authority concerned submitted the complaint and the administrative act to the Federal Administrative Court. In the statement submitted at the same time, the authority concerned stated that the facts of the procedure in question and the preliminary ruling procedure were partly different, but in both cases it was about the interpretation of the right to rectification in accordance with Article 16 of the GDPR, which was more essential for the procedure in question and has separate meaning. In this regard, the authority concerned referred to the decision of the Administrative Court of February 24, 2022, Ra 2020/04/0187-11. For a suspension in accordance with Section 38 AVG, it is sufficient if a legal question has been brought before the ECJ that is “(merely) similar” to that in the suspended proceedings because it concerns “essentially the same” provisions (VwGH September 19, 2001, 2001/16/0439). The suspension of the proceedings in question is therefore necessary. The complaint is disputed in its entirety. The authority concerned submitted the complaint and the administrative act to the Federal Administrative Court. In the statement submitted at the same time, the authority concerned stated that the facts of the procedure in question and the preliminary ruling procedure were partly different, but in both cases it was about the interpretation of the right to rectification in accordance with Article 16 of the GDPR, which was more essential for the procedure in question and has separate meaning. In this regard, the authority concerned referred to the decision of the Administrative Court of February 24, 2022, Ra 2020/04/0187-11. For a suspension in accordance with Paragraph 38 of the AVG, it is sufficient if a legal question has been brought before the ECJ that is “(merely) similar” to that in the suspended proceedings because it concerns “essentially the same” provisions (VwGH September 19, 2001 , 2001/16/0439). The suspension of the proceedings in question is therefore necessary. The complaint is disputed in its entirety. II. The Federal Administrative Court has considered: Roman II. The Federal Administrative Court has considered: 1. Findings: By fax dated March 9, 2023, the complaining party requested the co-participating party to correct incorrect personal data in accordance with Art. 16 GDPR, namely to change the gender entry from “male” to “diverse”. The complaining party requested the involved party to correct incorrect personal data in accordance with Article 16, GDPR, namely to change the gender entry from “male” to “diverse”. By email dated March 15, 2023, the participating party informed the complaining party of the following: "Good day, In response to your fax request dated March 9, 2023 regarding changing your gender entry, we would like to inform you that we are currently working on implementing non-binary gender identities in our core processes. However, due to the legal and technical complexity, implementation in the IT system will still take a few months. Since you are not currently registered with the Public Employment Service (AMS), your personal data will not be processed beyond mere storage. If you register with the AMS to look for work in the near future, simply inform your advisor about the corresponding change so that you can be addressed correctly in personal contact.” The complaining party replied to the co-participating party in its email dated March 15, 2023 as follows [corrected for spelling errors]: “Although I am not registered with the AMS, the AMS still processes (saves) data about me (e.g. that from the eAMS), which needs to be changed. They also had more than five years to implement solutions for this change. As I said, if the change is not carried out, I will assert a restriction on processing in accordance with Article 18 (1) (a) GDPR. Please inform me about the restriction that has occurred." "Although I am not registered with the AMS, the AMS still processes (stores) data about me (e.g. that from the eAMS), which needs to be changed. They also had more than five years to implement solutions for this change. As I said, if the change is not implemented, I will invoke a restriction on processing in accordance with Article 18, paragraph one, letter a, GDPR. Please inform me about the restriction that has occurred.” The complaining party lodged a complaint with the relevant authority on March 18, 2023 due to an alleged violation of the right to rectification pursuant to Art 16 GDPR by the co-involved party due to non-fulfillment of its request of March 9, 2023. The complaining party lodged a complaint on March 18, 2023 the authority concerned complains about an alleged violation of the right to rectification in accordance with Article 16, GDPR by the party involved due to non-fulfillment of its request of March 9, 2023. As part of the proceedings before the authority concerned, the co-involved party stated in its statement of April 25, 2023 that the complaining party - contrary to the co-involved party's statements in the email of March 9, 2023 - did not have an active customer relationship with the co-involved party party and in this respect their data will only be stored in accordance with the applicable retention periods in accordance with Section 25 Paragraph 9 AMSG until the end of the respective period. In such cases, there would be no processing beyond pure storage. By assuming the internal status "dormant", the data record meets the requirements of a restriction in accordance with Article 18 (2) GDPR. The participating party also pointed out again that they were working on implementing the application, but that this would technically take time. As part of the proceedings before the authority concerned, the co-involved party stated in its statement of April 25, 2023 that the complaining party - contrary to the co-involved party's statements in the email of March 9, 2023 - did not have an active customer relationship with the co-involved party party and in this respect their data will only be stored in accordance with the applicable retention periods in accordance with Section 25, Paragraph 9, AMSG until the end of the respective period. In such cases, there would be no processing beyond pure storage. By assuming the internal status "dormant", the data record meets the requirements of a restriction in accordance with Article 18, Paragraph 2, GDPR. The participating party also pointed out again that they were working on implementing the application, but that this would technically take time. On April 18, 2023, a request for a preliminary ruling from a Hungarian court was submitted to the Court of Justice of the European Union on the following questions: "1. Should Article 16 of the GDPR be interpreted as meaning that, with a view to exercising the rights of the data subject, the authority which maintains the registers under Member State law is obliged to correct personal data registered by it relating to the gender of that person if this Data have changed since they were entered into the register and therefore do not comply with the principle of accuracy set out in Article 5 Paragraph 1 Letter d GDPR?"1. Should Article 16 of the GDPR be interpreted as meaning that, with a view to exercising the rights of the data subject, the authority which maintains registers under Member State law is obliged to correct personal data registered by it relating to the gender of that person if the latter data have changed since they were entered into the register and therefore do not comply with the principle of accuracy set out in Article 5, paragraph one, letter d of the GDPR? 2. If question 1 is answered in the affirmative: Should Article 16 GDPR be interpreted as meaning that the person requesting the correction of data relating to their gender is obliged to provide evidence to support their request for correction?2. If question 1 is answered in the affirmative: Should Article 16 of the GDPR be interpreted as meaning that the person requesting the correction of data relating to their gender is obliged to provide evidence in support of their request for correction? 3. If question 2 is answered in the affirmative: Should Article 16 GDPR be interpreted as meaning that the applicant must prove that he or she has undergone gender reassignment surgery?”3. If question 2 is answered in the affirmative: Should Article 16, GDPR, be interpreted as meaning that the applicant must prove that he or she has undergone gender reassignment surgery?” 2. Assessment of evidence: The findings result from the undoubted and undisputed contents of the file, the arguments of the parties and the documents submitted by them. 3. Legal assessment: To A) According to Section 38 AVG, the authority is entitled to suspend the proceedings until a final decision has been made on a preliminary question if the preliminary question is already the subject of pending proceedings before the competent administrative authority or the competent court or if such proceedings are pending at the same time. According to Paragraph 38 , AVG, the authority is entitled to suspend the proceedings until a final decision has been made on a preliminary question if the preliminary question is already the subject of pending proceedings before the competent administrative authority or court or if such proceedings are pending at the same time. According to the jurisprudence of the Administrative Court, it is in accordance with the law according to § 38 AVG to suspend an administrative procedure in the case of preliminary ruling proceedings pending before the ECJ if the question to be decided is prejudicial to the procedure (cf. e.g. VwGH 28.10.2008, 2008/05/0129; 09.12.2010, 2009/09/0260; 26.04.2011, 2011/03/0015; 09.11.2011, 2011/22/0284; 13.12.2011, 2011/22/0316). According to the case law of the Administrative Court, it corresponds to paragraph 38, AVG the law to suspend an administrative procedure in the case of preliminary ruling proceedings pending before the ECJ if the question to be decided is prejudicial to the procedure, see e.g. VwGH 28.10.2008, 2008/05/0129; 12/09/2010, 2009/09/0260; 04/26/2011, 2011/03/0015; November 9, 2011, 2011/22/0284; December 13, 2011, 2011/22/0316). According to the established jurisprudence of the Administrative Court, a preliminary question within the meaning of Section 38 AVG is to be understood as a legal question which is prejudicial to the decision of the administrative authority and which is considered as the main question by other administrative authorities or by the courts or even by the same authority, but in a different procedure is to decide. Prejudicial - and therefore a preliminary question decision in the procedurally relevant sense - is only a decision which, firstly, concerns a legal question, the answer to which is indispensable for the main question decision, i.e. a necessary basis, and secondly, which regulates this in a manner that is binding on the administrative authority. The fact that the preliminary question must be a question that is to be decided by the other authority as the main question arises from the fact that the special procedural economic meaning of the provision of Section 38 AVG can only be achieved if the other decision, The issue of which is awaited, as a result of which the authority is bound, although such a binding effect only ever develops in a decision on a main question (cf. VwGH June 27, 2019, Ra 2019/02/0017). According to the established case law of the Administrative Court, under a preliminary question within the meaning of paragraph 38, AVG, a legal question is to be understood as a prejudicial question for the decision of the administrative authority, which is to be decided as the main question by other administrative authorities or by the courts or even by the same authority, but in a different procedure. Prejudicial - and therefore a preliminary question decision in the procedurally relevant sense - is only a decision which, firstly, concerns a legal question, the answer to which is indispensable for the main question decision, i.e. a necessary basis, and secondly, which regulates this in a manner that is binding on the administrative authority. The fact that the preliminary question must be a question that is to be decided by the other authority as the main question arises from the fact that the special procedural economic meaning of the provision of paragraph 38 AVG can only be achieved if the other decision , the issue of which is awaited, subsequently binds the authority, although such a binding effect only ever has a decision on a main question (see VwGH June 27, 2019, Ra 2019/02/0017). The preliminary ruling procedure pending before the ECJ on C-247/23 is based on a refusal by an authority to correct a gender entry in accordance with Art. 16 GDPR and, as a result, the question of whether an authority is obliged under Art. 16 GDPR to record the gender entry of a data subject in a register Request to amend if these data have changed since they were entered into the register and are therefore incorrect and to what extent this must be proven by the data subject. The preliminary ruling procedure pending before the ECJ on C-247/23 is based on a refusal by an authority to correct a gender entry in accordance with Article 16, GDPR and, as a result, the question of whether an authority is obliged under Article 16, GDPR, to correct the gender entry of a data subject in one Change the register upon request if this data has changed since it was entered in the register and is therefore incorrect and to what extent this must be proven by the data subject. The present procedure, which was suspended by the authority concerned with the contested decision, is also based on an application for the correction of a gender entry based on Art. 16 GDPR. In contrast to the proceedings before the ECJ, the co-participating party responsible here did not refuse to comply with the complaining party's request of March 9, 2023 in its email of March 15, 2023, but rather stated that it was working on it technical implementation of the application, which will still take a few months due to the legal and technical complexity. The fact that it would not comply with this request for correction after technical implementation did not emerge in the proceedings before the authority concerned. The present procedure, which was suspended by the authority concerned with the contested decision, is also based on an application for the correction of a gender entry based on Article 16 of the GDPR. In contrast to the proceedings before the ECJ, the co-participating party responsible here did not refuse to comply with the complaining party's request of March 9, 2023 in its email of March 15, 2023, but rather stated that it was working on it technical implementation of the application, which will still take a few months due to the legal and technical complexity. The fact that it would not comply with this request for correction after technical implementation did not emerge in the proceedings before the authority concerned. According to Article 16, 2nd sentence of the GDPR, the data subject has the right to immediately request that the person responsible correct incorrect personal data concerning them. Article 12 of the GDPR, which sets out the relevant modalities, states in paragraph 3 that the person responsible must provide the data subject with information about the measures taken upon request in accordance with Articles 15 to 22 immediately, but in any case within one month of receipt of the request has to provide. This deadline may be extended by a further two months if necessary taking into account the complexity and number of applications. The controller will inform the data subject of an extension of the deadline within one month of receipt of the request, together with the reasons for the delay. According to Article 16, 2nd sentence of the GDPR, the data subject has the right to immediately request that the person responsible correct incorrect personal data concerning them. Article 12 of the GDPR, which sets out the modalities in this regard, states in paragraph 3 that the person responsible shall provide the data subject with information about the measures taken upon request in accordance with Articles 15 to 22 without undue delay, but in any case within one month of receipt of the request has to provide. This deadline may be extended by a further two months if necessary taking into account the complexity and number of applications. The controller will inform the data subject of an extension of the deadline within one month of receipt of the request, together with the reasons for the delay. In the present proceedings, the party involved responded to the complaining party's request for correction within one month and, in accordance with Article 12 (3) GDPR, also informed him that the requested correction would take a longer period of time due to the technical complexity. In the present proceedings, the party involved responded to the complaining party's request for correction within one month and, in accordance with Article 12, Paragraph 3, GDPR, also informed him that the requested correction would take a longer period of time due to the technical complexity. This means that the question of the admissibility of the refusal or the obligation to make a correction in accordance with Article 16 of the GDPR, which is pending in the preliminary ruling procedure, is not at all relevant in the present proceedings; rather, the only thing to be assessed here is whether the party involved is right to demand a delayed implementation of the could claim a correction in accordance with Article 12 Paragraph 3 of the GDPR. This means that the question of the admissibility of the refusal or the obligation to make a correction in accordance with Article 16 of the GDPR, which is pending in the preliminary ruling procedure, is not relevant in the present proceedings; rather, the only thing to be assessed here is whether the party involved is right to demand a delayed implementation of the was allowed to claim a correction in accordance with Article 12, Paragraph 3, GDPR. In this respect, it cannot be assumed that a decision of the ECJ in the preliminary ruling procedure cited provides a necessary basis for answering the main question to be clarified by the authority concerned in the present procedure, namely the question of whether the parties involved rely on Article 12 Para. 3 XXXX GDPR was allowed, is. Nothing would be gained for the present case from a decision of the ECJ in the cited preliminary ruling procedure, since the legal question to be answered would remain unanswered. In this respect, it cannot be assumed that a decision of the ECJ in the cited preliminary ruling procedure is a necessary basis for answering the question in the present procedure The main question to be clarified by the authority concerned is the question of whether the participating party was allowed to rely on Article 12, Paragraph 3, Roman XXXX GDPR. Nothing would be gained for the present case from a decision by the ECJ in the preliminary ruling procedure cited, since the legal question to be answered would remain unanswered. According to the case law of the ECJ (on Article 267 TFEU), a national court, whose decisions can no longer be challenged by legal means under domestic law, may resolve a question regarding the interpretation of Union law on its own responsibility if the correct interpretation of Union law is so obvious is that there is no room for any reasonable doubt (see ECJ October 6, 1982, Srl C.I.L.F.I.T. et al., C-283/81, EU:C:1982:335, and ECJ October 6, 2021, Consorzio Italian Management, C-561 /19, EU:C:2021:799, para. 39 ff).According to the case law of the ECJ (on Article 267, TFEU), a national court whose decisions can no longer be challenged using legal remedies under domestic law may raise a question of the interpretation of Union law on their own responsibility if the correct interpretation of Union law is so obvious that there is no room for a reasonable doubt cf. ECJ 6.10.1982, Srl C.I.L.F.I.T. et al., C-283/81, EU:C:1982:335, and ECJ October 6, 2021, Consorzio Italian Management, C-561/19, EU:C:2021:799, paragraph 39 ff). With regard to the decision of the Administrative Court of February 24, 2022, Ra 2020/04/0187, which was brought forward by the authority concerned, with which proceedings were suspended due to a preliminary ruling procedure, it should be stated that this was the case both in the proceedings before the VwGH and The preliminary ruling procedure dealt with the legal question relating to Article 83 of the GDPR as to whether fine proceedings can be conducted directly against a legal person or whether attribution to a natural person is required. In principle, the same legal question was involved in both proceedings. With regard to the decision of the Administrative Court of February 24, 2022, Ra 2020/04/0187, which was brought forward by the authority concerned, with which proceedings were suspended due to a preliminary ruling procedure, it should be stated that this was the case both in the proceedings before the VwGH and The preliminary ruling procedure concerned the legal question relating to Article 83 of the GDPR as to whether fine proceedings can be conducted directly against a legal person or whether attribution to a natural person is required. In principle, the same legal question was involved in both proceedings. The decision of the Administrative Court of September 19, 2001, 2001/16/0439, mentioned by the authority concerned also has no bearing on the matter in the present case, since this decision referred to the so-called “prohibition of enrichment” standardized in two state tax regulations, which is in both regulations the content was essentially the same. There was therefore clearly a comparable case and, as a result, a preliminary question - not only with regard to the European law norm, but also with regard to the questions addressed to the ECJ. For the suspension of proceedings in accordance with Section 38 AVG, it is sufficient if a (merely) similar legal question is pending - but whether a legal question submitted to the ECJ for a preliminary ruling is "similar" to the legal question to be assessed in the pending proceedings in the understanding of the previously cited findings , however, must be examined in each individual case (see VwGH September 13, 2017, Ra 2017/12/0068). For the suspension of proceedings in accordance with Paragraph 38, AVG, it is sufficient if a (merely) similar legal question is pending - whether However, a legal question submitted to the ECJ for a preliminary ruling is "similar" in the understanding of the previously cited finding to the legal question to be assessed in the pending proceedings, but must be examined in each individual case (see VwGH September 13, 2017, Ra 2017/12/0068). The only thing to be assessed in the present procedure is whether the requirements of Article 12 Para. 3 GDPR for a delayed implementation of the requested correction have been met. However, with regard to this legal question, clarification cannot be expected from a decision of the ECJ in the preliminary ruling procedure used. The only thing to be assessed in the present procedure is whether the requirements of Article 12, Paragraph 3, GDPR for a delayed implementation of the requested correction are met. However, with regard to this legal question, clarification cannot be expected from a decision of the ECJ in the preliminary ruling procedure used. In the present proceedings, there are not, as argued by the authority concerned, two “equivalent” or “similar” cases, since the only parallel between the two proceedings is that both are linked to an application based on Article 16 of the GDPR with the correction of a gender entry. Apart from that, however, the two procedures differ fundamentally from one another - particularly with regard to the legal question to be assessed - so that the existence of a preliminary question justifying the suspension must be denied. In the present proceedings there are not, as argued by the authority concerned, two “equivalent” or “similar” cases, since the only parallel between the two proceedings is that both are linked to an application based on Article 16 of the GDPR with the correction of a gender entry. Apart from that, however, the two procedures differ fundamentally from one another - particularly with regard to the legal question to be assessed - so that the existence of a preliminary question justifying the suspension must be denied. Since the reason for suspension assumed by the authority concerned does not exist, the contested decision must be repealed without replacement. Regarding B) Inadmissibility of the appeal: According to Section 25a Paragraph 1 VwGG, the administrative court must state in its ruling or decision whether the appeal is permissible in accordance with Article 133 Paragraph 4 B-VG. The decision must be briefly justified. According to paragraph 25 a, paragraph one, VwGG, the administrative court must state in its decision or decision whether the appeal is permissible in accordance with Article 133, paragraph 4, B-VG. The statement needs to be briefly justified. According to Article 133 Para. 4 B-VG, the appeal is not permissible because the decision does not depend on the resolution of a legal question that is of fundamental importance. The decision in question neither deviates from the previous case law of the Administrative Court, nor is there a lack of case law; Furthermore, the existing case law of the Administrative Court cannot be assessed as inconsistent. There are also no other indications of the fundamental significance of the legal question to be resolved. According to Article 133, Paragraph 4, B-VG, the appeal is not permitted because the decision does not depend on the resolution of a legal question that is of fundamental importance. The decision in question neither deviates from the previous case law of the Administrative Court, nor is there a lack of case law; Furthermore, the existing case law of the Administrative Court cannot be assessed as inconsistent. There are also no other indications of the fundamental significance of the legal question to be resolved.
