BVwG - W258 2243523-1/9E
From GDPRhub
| BVwG - W258 2243523-1/9E | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 6(1)(f) GDPR Article 17 GDPR |
| Decided: | 11.01.2024 |
| Published: | 07.02.2024 |
| Parties: | |
| National Case Number/Name: | W258 2243523-1/9E |
| European Case Law Identifier: | ECLI:AT:BVWG:2024:W258.2243523.1.00 |
| Appeal from: | DSB (Austria) |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | RIS (in German) |
| Initial Contributor: | co |
An Austrian court reversed a decision by the Austrian DPA, holding that a controller did not fail to comply with a data subject’s deletion request under Article 17 GDPR.
English Summary
Facts
A real estate development company, the controller, contacted an owner of real estate, the data subject, asking her whether she would be interested in selling her property. The data subject claimed to have requested deletion of her personal data under Article 17 GDPR but kept receiving messages from the controller thereafter. Thus, on 26 April 2020, the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde, DSB).
In its submissions, the controller argued that it obtains data about real estate properties on sale by requesting access to the land registry of property addresses and it processes personal data according to Article 6(1)(f) GDPR. Further, the controller stated that it nonetheless complied with the deletion request as it pseudonymised the data of the data subject and added a note next to the address of her property that it should no longer be consulted in the land registry.
The DSB held that the controller did violate the data subject’s right to deletion as it failed to fully erase her personal data. First, according to the DSB, the interests of the data subject outweighed those of the controller and that it was still possible to identify the data subject using the address of her property.
The controller decided to appeal the DSB’s decision on 14 May 2021 to the Austrian Federal Administrative Court (Bundesverwaltungsgericht, BVwG), claiming that the DSB failed to properly assess the case. The controller submitted that it deleted the data of the data subject when she requested it and then her data mistakenly reappeared in her database, which is why she was contacted again by the controller. However, the controller remedied this by pseudonymising her data. Hence, the DSB should have differentiated between the two processing activities: the data subject only requested deletion of her data with respect to the first set of processing activities. As regards the second set of processing activities, the data subject never asked for erasure.
Holding
On 13 November 2023, the BVwG issued its judgment.
First of all, the court reassessed the facts of the case and came to the conclusion that the controller did comply with the data subject’s deletion request under Article 17 GDPR. The fact that the controller then found the data about the address of her property in the land registry and contacted the data subject again, was due to the fact that the controller had deleted all data regarding her, hence it could not know that the address was hers. Also, the court underlined that the deletion request did not refer to this second set of processing activities.
In this respect, the BVwG also held that the controller deleted the contact and address data relating to the data subject, thereby fulfilling the data subject’s request under Article 17 GDPR but it lawfully kept storing the correspondence data with the data subject for purposes of defence or establishment of legal claims under Article 17(3) GDPR.
As regards the second set of processing, the BVwG found that the data subject did not have a right to deletion of such data, but she could have requested the DSB to order the controller to stop processing her personal data, which she did not. Concludingly, the BVwG held that the DSB’s decision should be dismissed.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Decision date 01/11/2024 standard B-VG Art 133 Paragraph 4 GDPR Art 17 B-VG Art. 133 today B-VG Art. 133 valid from January 1st, 2019 to May 24th, 2018 last changed by Federal Law Gazette I No. 138/2017 B-VG Art. 133 valid from January 1st, 2019 last changed by Federal Law Gazette I No. 22/2018 B-VG Art. 133 valid from May 25th, 2018 to December 31st, 2018 last changed by Federal Law Gazette I No. 22/2018 B-VG Art I No. 164/2013 B-VG Art by BGBl amended by BGBl. No. 211/1946 B-VG Art. 133 valid from December 19, 1945 to December 24, 1946 last amended by StGBl. No. 4/1945 B-VG Art. 133 valid from January 3, 1930 to June 30, 1934 saying W258 2243523-1/9E Written copy of the findings announced orally on November 13, 2023: IN THE NAME OF THE REPUBLIC! The Federal Administrative Court has judge Mag. Gerold PAWELKA-SCHMIDT as chairman and the expert lay judges Dr. Gerd TRÖTZMÜLLER and Gerhard RAUB as assessors on the complaint of XXXX, represented by Mag. Stefan OBERLOJER, lawyer in 1010 Vienna, Franz-Josefs-Kai 31/I/6c, co-participating party before the Federal Administrative Court XXXX, against the decision of the data protection authority XXXX, GZ XXXX, in a data protection matter after holding an oral hearing on November 13th, 2023, rightly recognized: The Federal Administrative Court, through the judge Mag. Gerold PAWELKA-SCHMIDT as chairman and the expert lay judges Dr. Gerd TRÖTZMÜLLER and Gerhard RAUB as assessors on the complaint of roman XXXX, represented by Mag. Stefan OBERLOJER, lawyer in 1010 Vienna, Franz-Josefs-Kai 31/I/6c, co-involved party before the Federal Administrative Court roman XXXX, against the decision of the data protection authority Roman XXXX, GZ Roman XXXX, rightly recognized in a data protection matter after an oral hearing on November 13, 2023: A) The complaint is followed and the contested decision is amended to read: “The complaint is dismissed.” B) The revision is not permitted in accordance with Article 133 Paragraph 4 B-VG.The revision is not permitted in accordance with Article 133 Paragraph 4 B-VG. text Reasons for the decision: I. Process: Roman one. Process: 1. With an application dated April 26, 2020, amended on April 29, 2020, the party involved (complainant in the administrative procedure) filed a complaint with the data protection authority (hereinafter “authority concerned”) and alleged a violation of the right to deletion “due to failure to comply with a request for deletion “applies. In support, she stated that the complainant (respondent in the administrative proceedings), a real estate developer, had written to her as the owner of a property several times to ask whether she was interested in selling her property. Although she asked the respondent to delete the data concerning her, she wrote to the respondent again regarding any interest in purchasing. She is therefore requesting a declaration of a violation of the right to deletion. 2. In the hearing of the parties on July 3, 2020, the complainant submitted in a letter dated August 28, 2020 that there was no violation of the right to deletion because the party involved had not asserted any of the statutory reasons for deletion in Article 17 of the GDPR. To identify potential buyers, she writes to property owners using publicly available land registry data. She has a legitimate interest in this according to Article 6 Paragraph 1 lit f GDPR. Data processing is therefore permitted. In addition, the complainant complied with the requests for deletion anyway by replacing the name of the party involved with a pseudonym and attaching a blocking note to the property address stating that no more land register extract should be obtained with regard to the address.2. In a hearing from the parties on July 3, 2020, the complainant submitted in a letter dated August 28, 2020 that there was no violation of the right to deletion because the party involved had not asserted any of the statutory reasons for deletion in Article 17, GDPR. To identify potential buyers, she writes to property owners using publicly available land registry data. She has a legitimate interest in this according to Article 6, paragraph one, letter f, GDPR. Data processing is therefore permitted. In addition, the complainant complied with the requests for deletion anyway by replacing the name of the party involved with a pseudonym and attaching a blocking note to the property address stating that no more land register extracts should be obtained with regard to the address. 3. With the contested decision, the authority concerned upheld the complaint, found that the complainant had violated the participating party's right to deletion by not completely deleting their personal data (point 1.) and paid the complainant to delete all personal data of the party involved within two weeks if otherwise executed (point 2). In summary, the authority concerned stated that the property address in question was still a personal date because, taking into account the means available to the complainant, such as a query in the land register, it was still possible to identify the party involved does not involve any disproportionate effort. The note made by the complainant, according to which no more land register extract should be carried out for the property in question, does not change this because the complainant can override this at any time. A balancing of interests leads to the conclusion that the interest of the co-involved party outweighs the (economic) interests of the complainant, because the complainant not only contacted the co-involved party once, but repeatedly and also at a time after the co-involved party had already contacted her with a deletion request had contacted. This approach appears to be disproportionate, which is why the data processing was ultimately unlawful. 4. The complainant's complaint of May 14, 2021 is directed against this because of the illegality and inadequacy of the procedure, in which she submitted in a meaningful and essential summary that she had deleted all of the co-involved party's personal data based on the request for deletion of the co-involved party and has therefore fully complied with the request for deletion. Due to the complete deletion, the data of the party involved no longer appeared in the complainant's personal database. The party involved was then accidentally added to the complainant's database again, which is why contact was made again. A distinction must be made between these two types of data processing. With regard to the (first) data processing at issue, the complainant fully complied with the request for deletion; with regard to the subsequent second data processing, the party involved did not raise a data protection complaint. Regardless of this, the complainant also ended the second data processing by deleting it because, on the one hand, she pseudonymised the name and address of the party involved and, on the other hand, she added a blocking note to the property address, which is not a personal data worthy of protection anyway. The complainant also did not violate the principle of data minimization because simply storing a property address separately from information about ownership represents extremely little intrusive data processing. In addition, the authority concerned fails to recognize that the complainant could only identify the party involved by obtaining additional information, which is why the right to deletion in accordance with Article 11 of the GDPR does not apply. In addition, the authority concerned fails to recognize that the complainant could only identify the party involved by obtaining additional information, which is why the right to deletion in accordance with Article 11 of the GDPR does not apply. 5. In a letter dated May 31, 2021, amended on June 17, 2021, the authority concerned submitted the decision complaint to the adjudicating court along with the administrative act, disputed the complaint in its entirety and requested that the complaint be dismissed. 6. In a party hearing dated June 22, 2021, the co-involved party responded in a statement dated June 25, 2021 (OZ 3) to the effect that, in order to comply with the data protection regulations, the complainant must take organizational measures within the company to prevent repeated contact with property owners despite the data being deleted . 7. On November 13, 2023, the matter was heard and the decision was announced orally. The authority concerned submitted an application for the report to be issued. Evidence was taken by inspecting the administrative act and hearing XXXX, the complainant's informed representative, as a party.Evidence was taken by inspecting the administrative act and hearing the Roman XXXX, informed representative of the complainant, as a party. II. The Federal Administrative Court has considered: Roman II. The Federal Administrative Court has considered: 1. The following facts are established: 1.1. General: 1.1.1. The party involved is the owner of the property XXXX in XXXX Vienna. The complainant is a real estate company specializing in the development of properties. To determine potential sales interests, it collects data from the land register and writes to property owners based on the data collected. 1.1.1. The party involved is the owner of the Roman XXXX property in Roman XXXX Vienna. The complainant is a real estate company specializing in the development of properties. To determine potential sales interests, it collects data from the land register and writes to property owners based on the data collected. 1.1.2. At a point in time that cannot be determined in autumn 2019, the complainant queried the Austrian land register for the property address XXXX and, in the course of this query, found out the contact details of the party involved (name and address). She then contacted the party involved and asked whether there was any interest in selling the property in question. 1.1.2. At a point in time that cannot be determined in autumn 2019, the complainant queried the Austrian land register for the property address in Roman XXXX and, in the course of this query, found out the contact details of the party involved (name and address). She then contacted the party involved and asked whether there was any interest in selling the property in question. 1.1.3. The co-involved party then sent a request for information to the complainant in a letter dated October 2, 2019 and asked for information about what data the complainant processed about the co-involved party in the period from 2017 to 2019. 1.1.4. In accordance with the request for information, the complainant provided the following information in an undated letter: “[…] Name: XXXX Name: Roman XXXX Address: XXXX Address: Roman XXXX Property address: XXXX Property address: Roman XXXX […]" 1.2. Regarding the deletion request and its fulfillment: 1.2.1. The party involved requested that the data provided be deleted in a letter to the complainant dated March 12, 2020. 1.2.2. The complainant then basically deleted all data regarding the co-involved party, including their property address, and informed the co-involved party of this in a letter dated March 16, 2020. She did not delete the deletion request of March 12, 2020 and the complainant's response of March 16, 2020 in order to be able to use them to defend legal claims. 1.2.3. In response, the participating party stated in its letter to the BF dated March 18, 2020 (error in the original): “[…] In accordance with the General Data Protection Regulation, I have submitted a deletion request. […] What is crucial, however, is that as a data processor […] you are obliged to comply with my request for deletion. You already informed me in a letter that you “of course deleted my personal data” without a date. Now write it again. But I have now received letters from you about this, which is why no one, including the data protection authority, will believe you. Explain how it is that despite the alleged deletion from your computer, I still receive letters from you. It doesn't matter what's in the land register. What matters is what you as a data processor do with the data obtained from it. I tell them you have to delete it, otherwise there will be a complaint to the data protection authority. You can write once, but when I submit a deletion request it's over. That's the judicature. You will have to adapt, willy-nilly.” 1.2.4. The complainant did not delete this letter so that it could only be used to defend legal claims. 1.2.5. After March 18, 2023, the complainant carried out a land register query on the property in question and added the party involved again to the complainant's database. 2. The findings are based on the following assessment of evidence: 2.1. The findings on 1.1.1. and 1.1.2. are based on the complainant's submissions in the administrative procedure. The findings regarding the request for information from the party involved and the complainant's reaction are based on the correspondence presented in the administrative procedure (administrative file, OZ 1, S 9 and 11). 2.2. The findings regarding the deletion request are based on the deletion request contained in the administrative act (administrative act, OZ 1, p. 14). The findings regarding the deletion of the data regarding the co-involved party are based on the credible and conclusive information provided by the informed representative of the co-involved party, who was able to explain conclusively and without contradictions the complainant's approach to requests for deletion in general and with regard to the co-involved party in particular (procedure of the hearing dated November 13, 2023, OZ 5, p. 5). The finding that the complainant informed the co-involved party about the deletion is based on the complainant's letter to the co-involved party dated March 16, 2020 (administrative act, OZ 1, p. 15). The statement regarding the reaction of the party involved is based on its letter dated March 18, 2023 (administrative act, OZ 1, p. 16). The fact that the complainant did not delete the deletion request of March 12, 2020, the BF's response of March 16, 2020 and the reaction of the participating party of March 18, 2020 is based on the following considerations: Although the informed representative was not sure about this in his statement at the oral hearing (negotiation minutes of November 13, 2023, OZ 5, S 6 f), it follows from general life experience that letters that can potentially be used to defend against legal claims , can also be kept for this purpose. The fact that the complainant only added the co-involved party to its database again after March 18, 2020, i.e. after the co-involved party's reaction to the complainant's information about the deletion, is due to the fact that the complainant would not otherwise have written to the co-involved party again would have: In accordance with her usual procedure, the complainant would have responded to the co-involved party's letter of March 18, 2020 by deleting the co-involved party's data (again). If the data of the party involved had been collected again on or before March 18, 2020, the data would have been deleted and would therefore have been available for re-sending. 3. Legally it follows: To A) The admissible complaint is justified. In her complaint, the complainant states, among other things, that she did not violate the participating party's right to deletion because her request for deletion was fulfilled. The complainant was interested in purchasing a property and used a land register query to determine the details of the party involved as the owner of the property. After the co-involved party requested that their data be deleted, the complainant deleted all data relating to the co-involved party. The complainant only noticed the property again after the deletion request had been fulfilled. Since the complainant had also deleted the property address, she was not aware that she had already recorded the property address once, which is why the data of the party involved was added to the complainant's database again after a land register query. However, the participating party's request for deletion does not relate to this new data processing. With this argument the complainant is right: 3.1. On the right to deletion in accordance with Art. 17 GDPR:3.1. On the right to deletion according to Article 17, GDPR: 3.1.1. According to Article 17 Paragraph 1 of the GDPR, a data subject has the right to request that the person responsible delete personal data concerning him or her immediately, and the person responsible is obliged to delete personal data immediately if, among other things, the personal data were processed unlawfully.3.1 .1. Pursuant to Article 17, paragraph one, of the GDPR, a data subject has the right to obtain from the controller the immediate deletion of personal data concerning him or her, and the controller is obliged to delete personal data without undue delay if, among other things, the personal data have been processed unlawfully . 3.1.2. According to paragraph 3 lit. e leg. cit. The data subject does not have the right to deletion if the processing of the data is necessary to assert, exercise or defend legal claims.3.1.2. According to paragraph 3, Litera e, leg. cit. The data subject does not have the right to deletion if the processing of the data is necessary to assert, exercise or defend legal claims. 3.2. Applied to the facts at hand, this means: 3.2.1. The complainant processed personal data relating to the co-involved party, namely name, address and property address (master and property data), as well as correspondence with the co-involved party in connection with a request for deletion (correspondence) sent by the co-involved party to the complainant. 3.2.2. Due to the participating party's request for deletion, the complainant deleted the master and property data. The complainant has thus fulfilled the participating party's request for deletion with regard to these types of data. 3.2.3. Since the complainant is processing the correspondence in order to defend herself against possible legal claims - for example in proceedings before the data protection authority - and it is necessary in order to provide documentary evidence that the deletion request was met or the deletion process was completed, the party involved is entitled to the correspondence Art 17 Paragraph 3 lit e GDPR does not grant you a right to deletion. 3.2.3. Since the complainant is processing the correspondence in order to defend herself against possible legal claims - for example in proceedings before the data protection authority - and it is necessary in order to provide documentary evidence that the deletion request was met or the deletion process was completed, the party involved is entitled to the correspondence Article 17, paragraph 3, letter e, GDPR does not grant you a right to deletion. 3.2.4. The complainant has therefore fulfilled the participating party's request for deletion to the legally required extent, which is why the participating party could not have had its right to deletion violated. 3.2.5. The fact that the complainant - as she argues - after the deletion had taken place, for lack of knowledge that she had already recorded the property of the co-involved party in her database, carried out another land register query and again recorded and processed the master data of the co-involved party cannot change the fact that the complainant had fulfilled the deletion request of the party involved, which expressly referred to the “non-compliance with a deletion request”, by deleting the master data. The party involved did not send any further requests for deletion to the complainant after March 18, 2020, i.e. with regard to the renewed data processing. 3.2.6. The (appropriate) fear expressed by the party involved that the complainant would evade her data protection responsibility by deleting the data in this way and then re-recording the data cannot be followed. It would have been open to the party involved to request that the authority concerned stop processing data concerning them, which - if the data application turns out to be unlawful - can be asserted even after deletion. The authority concerned would have been free - even after deletion - to initiate administrative criminal proceedings within the statute of limitations. In addition to the claim for injunctive relief, it should be noted that the original data processing, in which those affected could be contacted several times at short intervals, could - as stated by the authority concerned - be unlawful. However, if - as argued by the complainant - in the event of a request for deletion, not all of the data subject's data is deleted, but rather the property address including the blocking notice is processed in order to prevent multiple letters from property owners, this is probably the original reason that could lead to the data application being illegal , no longer available. 3.3. Since the complainant did not violate the participating party's right to deletion, the contested decision had to be amended so that the complaint aimed at establishing a violation of the right to deletion was dismissed. 3.4. The decision therefore had to be made in accordance with the verdict. Regarding B) Inadmissibility of the appeal: According to Section 25a Paragraph 1 VwGG, the administrative court must state in its ruling or decision whether the appeal is permissible in accordance with Art 133 Paragraph 4 B-VG. The decision must be briefly justified. According to paragraph 25 a, paragraph one, VwGG, the administrative court must state in its decision or decision whether the appeal is permissible in accordance with Article 133, paragraph 4, B-VG. The statement needs to be briefly justified. The appeal is not admissible because, on the one hand, the legal situation is clear - there is no violation of the right to deletion if the request for deletion is complied with - and, on the other hand, the determination of the facts has no significance beyond the individual case and therefore if - as here - within the framework the principles established by the Administrative Court cannot be revised.
