BVwG - W274 2246355-1
From GDPRhub
| BVwG - W274 2246355-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 5(1)(c) GDPR Article 6(1)(f) GDPR |
| Decided: | 22.12.2021 |
| Published: | 18.01.2022 |
| Parties: | anonymous DSB (Austria) |
| National Case Number/Name: | W274 2246355-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2021:W274.2246355.1.00 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (RIS) (in German) |
| Initial Contributor: | Heiko Hanusch |
The Federal Administrative Court held that a cleaning company did not violate the principle of dataminimisation by notifying a property management company it worked with that one of its cleaners was laid off.
English Summary
Facts
The controller is the owner of a building cleaning company. The data subject worked for the controller as a cleaner in several buildings for about three to four years. The data subject also had lived in one of these buildings. In October 2019 the data subject was let go by the controller. After the termination of the employment contract, the controller informed the property management that the data subject was no longer employed and new cleaning staff would take over his role. The controller did not mention which party terminated the employment. About one and half years later, the data subject became aware of the exchange between their former employer and the property management company. As a consequence, a legal action was started.
Holding
The court determined that the controller neither violated the data minimisation principle of Article 5(1)(c) GDPR nor acted unlawfully under Article 6 GDPR. Even though the contract did not stipulate an obligation to inform the property management of a change in the cleaning staff, the court concluded that the controller pursued a legitimate interest which was not overridden by the interests of the data subject (Article 6(1)(f) GDPR). In the eyes of the court, the determining facts were:
- The personal element involved in the cleaning of buildings;
- The small business dimension of the controller providing a personal service to its customers;
- The data subject living in one of the buildings of the complex where they used to work;
- The information of the termination of the employment contract being essentially non-sensitive and unbiased without any pejorative meaning.
Concerning Article 5(1)(c) GDPR the court specified that the minimisation principle is not violated if it is not possible to remove any further data without making it more difficult to achieve the purpose. Phrased reversely: the principle is violated if one can remove information without making it more difficult to achieve the purpose.
Comment
The court did not make any further statement regarding Article 5(1)(c) GDPR. Taking the above reasoning into account, it seems that it deemed the act of informing the property management on the change in cleaning staff necessary for the running of a small building cleaning business.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Postal address:
Erdbergstrasse 192 – 196
1030 Vienna
Phone: +43 1 601 49-0
Fax: +43 1 711 23 – 889 15 41
Email: einlaufstelle@bvwg.gv.at
www.bvwg.gv.at
DECISIONS D A T U M
2 2 . 1 2 . 2 0 2 1
BUSINESS NUMBER
W 2 7 4 2 2 4 6 3 5 5 - 1/2 0 E
I M N A M E N D E R E P U B L I K !
The Federal Administrative Court recognizes Mag. LUGHOFER as chairman through the judge
as well as the expert lay judges Prof. KommR POLLIRER and Dr. GOGOLA as assessor
about the complaint of Ing.XXXX, represented by LTRA RechtsanwälteDr.MartinLEITNER,
dr Ralph TRISCHLER, Dr. Peter KRAUS, BSc. and dr Bernhard HOFMANN, Lindengasse 38/3,
1070 Vienna, against the decision of the data protection authority, Barichgasse 40-42, 1030 Vienna, dated
08/11/2021, GZ. D124.3842, collaborators XXXX , for violation of the right to
Confidentiality, rightly so after a public hearing:
The complaint will be followed and the disputed decision will be amended to the effect that
that his saying is:
"The appeal is dismissed."
The revision is not permitted according to Art. 133 Para. 4 B-VG.
Reasons for decision:
With a complaint sent by e-mail to the data protection authority on March 23, 2021 (im
Hereinafter: authority concerned) claimed XXXX (hereafter: co-participants, MB) a
Violation of the right to secrecy by "Ing.XXXX" (hereinafter: complainant,
BF) and argued that the cleaning company " XXXX , owner Ing. XXXX " was former, - 2 -
Employer of the MB and look after a residential complex in which she lives. The MB got themselves
in a collective complaint from dissatisfied tenants to the property management or the
tenants' association, which resulted in a letter from the property management
in which it is mentioned that the MB was employed by the BF and that on the part of the BF
employment had been terminated. The BF just gave you this information
Clerk of property management XXXX leaked, increasing the credibility of
MB will be questioned and what the property management does not concern. The BF have thereby
breach their duty of confidentiality and the fundamental right to secrecy.
Enclosed was an e-mail from XXXX to XXXX with another recipient in Cc dated
March 9th, 2021, which also contains the following sentence:
"I would also like to note that your client was employed by the company XXXX,
However, the employment relationship (on the part of the XXXX company) with her client was terminated
would".
Upon request, the BF initially stated in an email dated April 8, 2021 that he could
Complaint letters do not recognize a violation of the GDPR, they are not data
processed nor passed on. The property management have the data of the MB
necessarily because she lives and works there. MB already employs many
Employees of the authority concerned (hereinafter referred to as the BF several business figures
apparently the authority concerned). There is also a question for the relevant authority as to whether
have no possibility of imposing penalties in the event of obvious abuse or
to charge expenses.
With a second request, the authority concerned turned to the BF and asked him
to announce whether the statement should be understood in such a way that the BF
Management of the MB not about the fact that the MB had been terminated,
have informed.
In a further statement by email dated May 6th, 2021, the BF stated that he had the
Property management not informed that the MB had been terminated/dismissed, but have
he has a duty to inform his customers about a change in personnel and the departure of a
To inform an employee who had free access to his property in order to
Customers given the opportunity to change the locks or a ban on entry
to impose if he deems it necessary. Also in the enclosed letter from
Property management is informed of a "dissolved employment relationship" and no "termination"
or "dismissal" spoken., - 3 -
This letter was sent to the MB to be heard by the parties.
In an email dated May 16, 2021, MB initially referred to the letter dated March 9, 2021
regarding the notification of the termination of the employment relationship (by the BF). be it
an absolute no-go if the (also former) employer with personal
peddle stories. The BF gave two pieces of information, namely the
Termination of the MB by him and the address of the MB. The question arises why the
mentioned information in 2021 for the lessor/business partner of the BF
represented important information if the MB had already left the company in 2019.
It was the BF's right to demand that the cleaning work be carried out in relation to the amount of the
To justify operating costs, but this must be done differently, such as by
logged notes regarding the presence of the respective employees, but not with
the data of the MB. The BF discredited the person of the MB.
Attached to the statement was, among other things, a confirmation of the
Key handover from the MB to the BF on October 28th, 2019.
With the contested decision, the relevant authority upheld the complaint and filed
determined that the BF had violated the MB's right to secrecy by
Property management about the termination of the existing between him and the MB
informed of the employment relationship.
The authority concerned established the following facts (the designations of the parties
have been adapted to the complaints procedure):
"1. The BF is the owner and managing director of the company " XXXX ".
2. There was an agreement between the MB and the company "XXXX" operated by the BF
Employment relationship, which was terminated by the BF in October 2019 by notice. the
MB returned all of her to the BF in October 2019 as part of her employment
handed out key.
3. The MB was with the BF as a cleaner until the end of the employment relationship
employed, with the company of the BF for the care of the housing complex with the
Address XXXX where the MB resides.
4. In December 2020, MB and other tenants of the in question resigned
Residential complex as part of a collective complaint to their property management "XXXX
Non-profit housing and settlement cooperative GmbH”., - 4 -
5. The BF informed the named property management at an unspecified point in time
about the fact that the employment relationship between him and the MB has been terminated.
6. A clerk from the housing association then contacted the
Residential community of property XXXX with the following letter:
Dear Mag. XXXX!
With reference to correspondence, among other things, we would like to inform you that in the contract
unfortunately a careless mistake must have been made. The exact address of the property is
XXXX (there used to be a staircase 3) - we will fix these mistakes as soon as possible
correct. Furthermore, on our part (after receipt of the first complaints -
mainly from Mrs. XXXX and Mr. XXXX ) just in November/December 2020
several personal inspections and checks (incl. photo documentation) carried out
no serious misconduct or breach of duty could be determined - the
WHA or the stairwell was always cleaned/cared for
found. Due to the fact that continues (in our opinion unfounded)
Complaints were received, the tenant survey included in the supplement
accomplished. From 31 interviewed main tenants, we have enclosed 4 negative ones
get feedback. Then the "problem" with the care company
discussed or even exchanged the staff for the housing complex.
As you correctly pointed out, due to the retirement of HB-alt, it has one
Tender for house cleaning and maintenance cleaning given in 2016
(Best and cheapest bidder XXXX).
€ 14,500 (same as in 2013 and 2014 - almost the same amounts)
dejected. From 2017 - the first full accounting year of the company XXXX - were annually
€ 8,450.00/net charged over the operating costs. I.e. it could for the
Residents massive savings can be achieved. The costs have increased due to the
Index adjustment increased to €9,227.08/net annually in 2020.
We would also like to note that your client was employed by the company XXXX,
however, the employment relationship (on the part of the company XXXX) with your client was terminated
… . For the reasons mentioned above, we can accept the complaints on the part of you
client cannot be traced. We will, however, again with the
Contact the management of the company XXXX and the "specifications" exactly
discuss it through or give instructions to work even more precisely., - 5 -
Kind regards
XXXX
property management"
Legally, the authority concerned came to a conclusion based on the provisions of Section 1 (1).
DSG as well as Art. 5 Para. 1 lit. c and Art. 6 Para. 1 lit. f DSGVO, the processing is based on
Legitimate interest basis and three cumulative conditions allowed:
Perception of a legitimate interest by the person responsible or the person(s).
Third parties to whom the data have been communicated; Necessity of processing
personal data for the realization of the legitimate interest and no
Predominance of the fundamental rights and freedoms of the data subject
about the perceived legitimate interest.
The disclosure of the fact of the termination of the employment relationship between the BF
and the MB does not serve any legitimate interests of the MB that override the interests of the MB
BF or other third party. The statements of the BF, according to which he was only doing his duty
would have perceived towards his customer, did not catch, especially after more general
Life experience is not to be assumed that his property management over each individual
Change of staff within the cleaning staff who are cleaning by her
managed properties entrusted to be informed. In addition, disclosure is sufficient
of the personal data of the MB with regard to the fact that the MB after leaving
the employment relationship, all keys handed over to the BF as part of this
have returned, nor the principle of data minimization according to Art. 5 Para. 1 lit. c
GDPR.
The BF's complaint, raised by a lawyer, is directed against this decision
primary application, after conducting an oral hearing, the decision
to be amended so that the application is rejected by MBab-or.Because the MB
already at the end of 2019 knowledge of the notification that she considers to be the subject of the proceedings
the application to initiate the procedure was time-barred on March 23, 2021 in accordance with Section 24 (4) DSG
and the complaint already rejected or dismissed on that basis. Moreover, the BF
a legitimate interest in maintaining its good economic reputation, which is endangered,
if the MB continues to be in contact with the property management or the other roommates
name of the BF or his company. The balancing of interests to be carried out
against this background must clearly be in favor of the BF., - 6 -
The authority concerned submitted the disputed decision and the electronic one
Administrative act before the administrative court, received on September 14th, 2021.
The complaint was made by the MB by the administrative court on September 21, 2021 for any statement
in particular with regard to the objection to the time limit.
The MB commented on October 3, 2021 as follows:
It is not correct to claim that the MB was already aware of it at the end of 2019,
that the BF brought the information to XXXX. If that had been the case, she would have
insisted that this notification be sent to her in writing. It did though
phone calls, but they always made sure that her family, her lawyer
and she herself had been insulted. But if the statement of the BF is correct, the MB is
already announced at the end of 2019, the question arises as to why this was not the case
data protection authority was discussed. To terminate the employment relationship
The MB also stated through the BF that she herself was in possession of a house gate key
The cellar break-in mentioned happened in 2013 and affected her own cellar. It
is not necessary to inform XXXX about the termination of the employment relationship by the BF in
To let the tenants know so that the property manager would know who to contact
concerns could address. One could also trust her to make this correction herself. she
will never pretend to be an employee after the end of the employment relationship
MB on September 8th, 2021 via WhatsApp an offer regarding stairwell care
leave.
The MB sent in the attachment “the entire WhatsApp history and
Memory protocols” and offered their interrogation as evidence.
On October 25, 2021, extensive additional documents were submitted as "supplement to the statement".
of the MB, including an application for approval of legal aid "to represent the
MB at the hearing by a lawyer as well as expenses and travel expenses” and
an attached statement of assets.
This application for legal aid was logged for GZ 2246355-2 and will be used as a separate file
guided.
With a submission dated November 12, 2021, the MB also submitted that meanwhile it was under theirs
Vehicle has been found by her auto mechanic, taking herself a "GPS tracker".
turned out that, according to information from the XXXX customer service, the SIM card that is in the
GPS found on which BF is registered. As a result, the private life of the MB and her - 7 -
Husband massively impaired, as well as their personal rights. A report from both police
had been brought in.
A letter from the relevant authority was also sent to the administrative court on November 12, 2021
with which they submit an entry to the MB from November 10th, 2021 "for information". This
Input from November 10th, 2021 refers in turn to the “GPS tracker” mentioned.
On November 18, 2021, a public oral hearing took place before the Federal Administrative Court
Negotiation took place in which the BF and the MB were heard as parties. further
After being instructed in this regard, the MB's application for approval of the
Legal aid dismissed and through this to the execution of the decision and appeal
waived.
The following facts are certain:
The BF operates as a sole trader in XXXX a pest control and
Building cleaning company and employs cleaning staff on a small scale
totaling about three and a half full-time employees.
The BF and MB have known each other for about eight years.
The MB lives in a community housing complex comprising seven stairwells
Municipality XXXX at address XXXX
“, with which the BF has a home care contract.
The MB was for about three or four years at the BF with about 20 hours a week as a caretaker
entrusted with the cleaning of the seven stairwells of the said facility XXXX. she
did the cleaning there personally, except during her vacation time.
The BF is of the opinion that the MB in the course of their work for the BF at a
made other customers guilty of "working time fraud". According to the BF's point of view
unsuccessful attempts to reach a solution with the MB while maintaining the employment relationship
come, this dissolved the employment relationship with the MB on October 25, 2019. One came
Key handover. Since then, MB has only had keys for the staircase
1.
Immediately after the end of the employment relationship with the MB, the BF informed the long-standing
Housekeeping staff "XXXX, with, the BF now has someone new for you
Supervision of the housing complex mentioned, the MB is no longer employed by the BF., - 8 -
In connection with a complaint problem because of their opinion
insufficient cleaning of the staircase from about July 2020, the MB came to the
tenants' association and had contact with a Mr. XXXX there. As part of an in
this connection between the property management "XXXX" and the tenants' association
conducted correspondence, XXXX XXXX sent the e-mail shown in the procedure above
Mail dated March 9th, 2021, which reads, among other things:
"We would also like to note that your client was employed by the company " XXXX ",
However, the employment relationship (on the part of the company "XXXX") with your client was terminated
would."
The MB became aware of this e-mail on March 9th, 2021. It could not be determined
that the MB was already aware that the BF had called the property management "XXXX"
informed of their departure.
The BF shared the fact that the MB was no longer employed by him
Property management "XXXX" in particular because he considers it "professional"
looked at. There is an obligation to notify the specific employee change
from the caregiving contract between "XXXX" and the BF.
It could not be determined that the MB after leaving the service of the BF
continued to act as caretaker of the XXXX residential complex.
The MB feels the notification of the termination of their employment relationship to "
XXXX " especially as disadvantageous because they live in the complex, some of
need property management and she considers her credibility to be questioned by XXXX.
There are several procedures between the parties - on the initiative of the MB - in particular
a regional court as a labor and social court, before a tax office and before the
Data Protection Authority pending.
Evidence assessment:
The circumstances of the place of residence and the employment relationship of the MB to the BF were
presented in a credible manner and the result is not disputed. Also the information of the BF to
date of termination of employment are credible.
The BF also presented the fact that the MB no longer worked for him in the
determined form (accordingly, this determination was already made by the authority concerned) and, - 9 -
determined point in time credibly. The same applies to the motives mentioned by him
this notice. There was no evidence to the contrary. The fact that that
e-mail written by the XXXX about one and a half years after this notification
the information includes that the employment relationship was terminated by " XXXX " is already
due to the temporal component, there is no compelling indication that the original
notification of the BF also included this circumstance.
Although the BF, in particular in the context of the complaint, alleged circumstances that
then worked, the MB continued to work as an employee after she left
cleaning service issued in the mentioned facility, these proved to be true within the framework
of the evidential process in any way. The BF was unable to give specific circumstances
describe the MB's inappropriate behavior in relation to their previous service
closed for the BF in the house she lives in.
The content of the message from property management by XXXX to the employee of
Tenant Association is evidenced by the reproduced e-mail expression.
The MB stated credibly that it was a notification from the past
of the BF to the property management, the MB no longer works there, only through this e-
to have found out by mail. The BF did not succeed in making the circumstances understandable
indicate an earlier date of this notification.Specific circumstances regarding a
The telephone conversation alleged in this regard did not come out.
Legally follows:
With regard to the objection to a time limit pursuant to Section 24 (4) DSG, the BF is initially entitled to the determination
refer to, according to which the e-mail to which the MB referred in its complaint to the
authority related, this came to the attention of 09.03.2021, which cannot be determined
could that the MB had previously known that the BF the property management "
XXXX " had informed about their departure. Based on this, the complaint is dated
23.3.2021 not late at all.
In the matter:
According to Art. 5 Para. 1 lit. c GDPR, personal data must be appropriate for the purpose
and substantial and limited to what is necessary for the purposes of the processing
(“data minimization”)., - 10 -
Data minimization is the principle of reducing the processing of personal data
data on the inevitable.
The first requirement of data minimization asks whether the data serves the purpose
are appropriate. This applies if the processing of the data is not for the respective purpose
can already be objected to within the framework of an objective evaluation.
Furthermore, the relevance is to be checked
conducive, i.e. suitable within the framework of the fundamental legal doctrine of proportionality.
Is it possible to imagine the processing of certain data without the
achievement of purpose is made more difficult, then these are not significant.
(Hötzendorfer/Tschohl/Kastelitz in Knyrim, Datkomm Art. 5 GDPR, para. 34 ff ).
According to Art. 6 Para. 1 DSGVO, the processing is only lawful if at least one of the
the following conditions are met:
The following condition can be found under lit. f: The processing is to safeguard the
legitimate interests of the person responsible or a third party, unless required
Interests or fundamental rights and freedoms of the data subject requiring protection
require personal data, especially when it comes to the
data subject is a child.
Only lit. f comes into question: that of the ECJ for the previous provision
developed “test scheme”.
1. the existence of a legitimate interest by which for the processing
responsible is perceived,
2. the necessity of processing personal data to achieve the
legitimate interest and
3. no predominance of the fundamental rights and freedoms of the data subject. At its core is
to weigh up the interests affected in each individual case
(Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Art. 6 GDPR, para. 51).
In principle, the relevant authority already considered the two aforementioned to be right
provisions relevant. She came to the view, however, after more general
Life experience cannot be assumed that his property management over each individual
Personnel changes within the cleaning staff who are cleaning the - 11 -
managed properties entrusted to be informed. Especially in view of that
the MB after leaving the employment relationship all the keys handed over to them
returned, the disclosure does not satisfy the principle of data minimization.
On the basis of the now supplementary findings, the administrative court comes to a conclusion
other result of the balancing of interests:
First of all, based on the findings made, it can be assumed that a very
personalized service by the MB for the BF and thus to the
Property management and the residents took place, especially since the MB, apart from times of
vacation, person did the house cleaning of all seven stairwells in person and
moreover due to the fact that she lives in one of the houses belonging to the complex,
there is also a personal close relationship. This is opposed to the fact that the
BF's company is a very small company and so is he as a result
strives to provide “personal services”. As noted, the BF shared -
regardless of the disputed reasons for the termination of the employment relationship - the long-term
Contact person on the part of the contractual partner, the property management " XXXX ", only with,
that the MB at that time no longer carried out the house cleaning of the mentioned facility
distinguished, but someone else. Only this communication is to be judged, but not
which are the responsibility of another person responsible, the " XXXX "
Composition of the e-mail from 09.03.2021. Even if due to the established
content of the contract, there is no obligation on the part of the BF to notify the contractual partner of the change of
In the opinion of the administrative court, there is an obligation to announce the cleaning staff
legitimate interest of the BF as a small business owner, in the specific context presented above
to inform the property management of the change of the specific cleaning staff, this
especially against the background that the MB is also a resident
of the said facility. For the reasons mentioned, one will also
the necessity of processing this data.
The MB considered this communication, in particular in connection with it
Subsequent notification by the property management to the tenants' association, as
discriminatory and questioning their credibility.
In this context, the MB should be pointed out that the responsibility of the
BF is not only limited to the message he sent to the property manager
any other notifications that may result from this. The circumstance - 12 -
the termination of the employment relationship itself is considered neutral factual and not sensitive
View date without rating content.
From the point of view of the property management towards the MB as a resident of the building
there are therefore no comprehensible reasons for the said notification
appear to be discriminatory or pejorative.
Overall, the administrative court assumes that the interests of the BF predominate
compared to those interests of the MB, which means that the legality of the
Data processing (through verbal transmission of information) is given. Can you
thinking away no further data without making it more difficult to achieve the purpose is also
a violation of the principle of data minimization is not evident.
The complaint of the BF was therefore to be followed and the ruling of the contested decision
to change in a negative sense.
It is also stated that the notifications from the MB regarding any
Data protection violation by the BF through the attachment of a completely new GPS tracker
character, are therefore not to be dealt with in the context of this complaint and, at most, for
could be the subject of a new privacy complaint.
The statement of the inadmissibility of the revision follows the fact that based on the
provisions of the GDPR, individual assessments were to be carried out.
