DSB (Austria) - 2022-0.332.606
From GDPRhub
| DSB - GZ: 2022-0.332.606 vom 8. Juni 2022 (Verfahrenszahl: DSB-D124.4108) | |
|---|---|
 | |
| Authority: | DSB (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 2(2)(c) GDPR Article 5(1)(a) GDPR GRC Art 52 Abs 1 GRC Art 8 DSG § 1 Abs 1 DSG § 1 Abs 2 DSG § 4 Abs 1 |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 08.06.2022 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | GZ: 2022-0.332.606 vom 8. Juni 2022 (Verfahrenszahl: DSB-D124.4108) |
| European Case Law Identifier: | ECLI:AT:DSB:2022:2022.0.332.606 |
| Appeal: | Not appealed |
| Original Language(s): | German |
| Original Source: | DPA Austria (in DE) |
| Initial Contributor: | edsb.at |
The Austrian DPA dismissed a complaint concerning the recording of a private phone call without consent. The activity was considered to fall under the household exception of Article 2(2)(c) GDPR.
English Summary
Facts
The data subject had a phone call via Whatsapp with a friend (the controller) in which she confessed to misconduct against her ex partner as well as to having had an abortion. She was unaware that the phone call was recorded and later on forwarded to the ex partner and other friends of the data subject.
The data subject filed a complaint with the Austrian DPA alleging a breach of her right to data protection and secrecy by recording and disseminating a phone call conversation without her consent.
Holding
First, the Austrian DPA had to determine whether the GDPR was applicable. The DPA checked whether the material scope was met, in particular whether the case fell under the household exception found in Article 2(2)(c) GDPR. According to this provision, the GDPR does not apply to the processing of personal data by natural persons to carry out exclusively personal or family activities. The absence of any reference to a professional or economic activity was considered as an important factor.
The DPA held that the concept of "family" was not to be interpreted strictly in accordance with family law, but also included other relationships considered as "family" by the general public, regardless of marriage and parenthood. In this respect, it was irrelevant whether there was a formal bond or whether personal relationships between the parties existed on a purely informal basis. The DPA noted that Recital 18 GDPR describes the use of social networks and online activities as part of a personal or family activity. In this case, the data subject had a phone call over the private messaging platform, Whatsapp.
Despite extensive investigations, the DPA found no indications that this data processing was in any way connected to a professional or economic activity. The decisive factor was that the data processing was an exclusively private matter within a limited circle of acquaintances.
Further, the DPA decided whether Section 1(1) DSG, the national data protection law, applied but the conclusion was the same as for the GDPR - the material scope was not met.
The DPA concluded that the GDPR was not applicable because of the house exception under Article 2(2)(c) GDPR and dismissed the complaint.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
text
GZ: 2022-0.332.606 from June 8, 2022 (case number: DSB-D124.4108)
[Editor's note: Names and companies, legal forms and product names, addresses (including URLs, IP and e-mail addresses), file numbers (and the like), etc., as well as their initials and abbreviations may be abbreviated and/or changed for reasons of pseudonymization be. Corrected obvious spelling, grammar, and punctuation errors.]
NOTICE
SAY
The data protection authority decides on the data protection complaint by Caroline A*** (complainant), represented by B*** Rechtsanwälte OG, of May 17, 2021 against Vera N*** (respondent party), represented by C*** Rechtsanwälte OG , due to 1) violation of the right to secrecy and 2) lawfulness of data processing as follows:
- The complaint is dismissed as unsubstantiated.
Legal basis: Article 2 (2) (c) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of 4 May 2016 p. 1; Section 4 (1) of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999 as amended; Article 8 and Article 52(1) of the Charter of Fundamental Rights of the European Union (EU-GRC), OJ No. C 202 of 7 June 2016, p. 389.
REASON
A. Submissions of the parties and course of the proceedings
A.1. In a submission dated May 17, 2021, the complainant alleged a violation of the right to secrecy and unlawful data processing. In summary, it was submitted that the Respondent recorded a telephone conversation on April 23, 2021 and forwarded this recording to third parties.
A.2. In a statement dated July 9, 2021, the Respondent submitted in summary that it had actually recorded a telephone conversation between her and the Complainant. The Respondent was friends with Wolfgang K***. She knew from their mutual friendship that the complainant had committed misconduct within the framework of her relationship with Wolfgang K***. The Respondent felt obliged to inform Wolfgang K*** about this. The information was passed on before the telephone call in question.
A.3. In a statement dated August 25, 2021, the complainant submitted in summary that the respondent was also aware that she had had an abortion. Wolfgang K*** did not know about the misconduct and the abortion. The Respondent passed this information on to Wolfgang K*** orally. As a result, the Respondent also sent a recording of a telephone call to Wolfgang K***. During the telephone call, the complainant's misconduct and her abortion were discussed.
A.4. In statements dated December 17, 2021 and April 19, 2021, the Respondent submitted in summary that Wolfgang K*** had a legitimate interest in being informed about the circumstances. In addition to the oral communication, a recording of a telephone call was also sent so that Wolfgang K*** believed the respondent. The respondent also sent the recording to her sister because the complainant had contacted her on several occasions. In addition, the Respondent sent the recordings to Claudia L***, the wife of one of Wolfgang K***'s best friends. Claudia L*** was the first person to call Wolfgang K*** after receiving information about the applicant's misconduct. According to the knowledge of the tape recording, the complainant herself made several phone calls to friends in order to explain her view of things to the respective friends in advance. Wolfgang K *** also informed several people from the common circle of friends about the misconduct. The respondent submitted two audio files to the data protection authority.
A.5. With statements dated January 11, 2022 and May 4, 2022, the complainant essentially repeated her previous submissions.
B. Subject of Complaint
In her submissions, the complainant expressly relied on a violation of the right to secrecy in accordance with Section 1 (1) DSG and on unlawful data processing in accordance with Art. 6 and Art. 9 GDPR.
Based on this, the subject of the complaint is the question of whether the respondent violates the complainant's right to secrecy in accordance with Section 1 (1) DSG and violates the principle of the legality of data processing in accordance with Art. 5 (1) lit. a in conjunction with Art. 6 GDPR has violated by
a) A phone call led between the complainant and the respondent, in the framework of which misconducts ("side jumps") were discussed in a community and an abortion of the complainant
b) this recording using the instant messaging service "WhatsApp" at least to Wolfgang K*** (the complainant's former partner), Claudia L*** (the wife of a friend of Wolfgang K***) and Esther N* ** (the Respondent's sister) submitted.
Before doing so, however, it must be checked whether the GDPR applies at all.
C. Findings of Facts
The complainant was friends with the respondent. From this friendship, the Respondent had known for some time that misconduct had occurred in the context of the relationship between the Complainant and Wolfgang K***. The misconduct was committed by the complainant. The Respondent was also aware that the Appellant had had an abortion.
On April 23, 2021, the Respondent verbally informed Wolfgang K*** of the Appellant's misconduct. At that time, Wolfgang K*** did not know about the misconduct and the abortion.
In addition, on April 23, 2021, the Respondent used a smartphone to record a telephone conversation with the Appellant. There are two audio files. During the telephone call, the complainant's misconduct ("infidelity") and her abortion were discussed. The Respondent then sent the recording to Wolfgang K*** using the instant messaging service “WhatsApp”. The complainant was not aware that the telephone conversation was being recorded. The two audio files are used as a basis for the findings of fact.
In addition, the Respondent sent the recording to Claudia L***. Claudia L*** was the wife of a friend of Wolfgang K***. Wolfgang K*** called Claudia L*** after receiving the information about the misconduct. According to the Respondent, Claudia L*** asked the Respondent about the recording.
Finally, the Respondent passed the said recording on to her sister, Esther N***. According to the Respondent, the Complainant contacted Esther N*** by telephone several times to discuss the incident.
The complainant did not consent to the creation and transmission of the said recording.
Assessment of evidence: The findings result from the consistent submissions of the complainant and the respondent and are undisputed. In particular, the Respondent expressly conceded the oral communication and the subsequent preparation and transmission of the conversation recording.
The audio files mentioned in the factual findings were submitted as part of the Respondent's statement of December 17, 2021 (AUDIOFILE-XYZ) and are enclosed with the file. The content of the audio files is known to the parties.
D. In legal terms it follows that:
D.1. lawfulness of data processing
a) On the "household exemption" of the GDPR
It is first necessary to check whether the facts at hand are covered by the material scope of the GDPR (and consequently the DSG):
According to Art. 2 Para. 2 lit. c, the GDPR does not apply to the processing of personal data by natural persons to carry out exclusively personal or family activities (colloquially also referred to as "household exception" or "de minimis clause").
The standardization of the budget exception represents a weighing decision by the Union legislator with regard to the right to protection of personal data laid down in Art. 8 EU-GRC under primary law. According to Art. 52 (1) EU-GRC, restrictions on the rights and freedoms guaranteed by them must therefore be corresponding be provided for by law and respect the essence of those rights and freedoms.
The absence of any reference to a professional or economic activity is considered a criterion for differentiation. The central criterion for the applicability of the "household exception" - and thus for the non-applicability of the GDPR - is the attribution of the data processing to the private sector (cf. Heissl in Knyrim [ed.], DatKomm Art. 2 GDPR, para. 70).
It should be noted that the terms "personal" and "family" refer to the activity of the person processing personal data and not to the person whose data is being processed. (cf. the judgment of the ECJ of July 10, 2018, C-25/17 para. 41 with further references).
The concept of "family" is not to be interpreted strictly in accordance with family law, but also includes other relationships that are considered "family" by the general public, regardless of marriage and parenthood. In this respect, it is irrelevant whether there is a formal bond or whether personal relationships exist on a purely informal basis (cf. Ernst in Paal/Pauly [ed.], Data Protection Basic Regulation. Commentary, Art. 2, para. 18; cf. the judgment of the Supreme Court of June 23, 2021, 6 Ob 56/21k, according to which even “loose acquaintances” in the form of “Facebook friends” who are not known in detail do not prevent the application of the “household exception” if it is a private Facebook profile and this is not used for professional or commercial purposes).
In this regard, the GDPR itself mentions, for example, correspondence or the use of social networks and online activities as part of a personal or family activity (cf. recital 18 GDPR). However, this only applies to the extent that data is exchanged in closed groups that are not related to the professional or economic activities of the user (cf. Ennöckl in Sydow [ed.], European General Data Protection Regulation. Manual Commentary, Art. 2, margin no. 13; cf . Also the previously cited judgment of the ECJ of July 10, 2018, C-25/17, paragraph 42 with further references, according to which an activity "cannot be regarded as exclusively personal or family within the meaning of this provision if aims to make personal data accessible to an unlimited number of people, or if it extends, even partially, to the public sphere and is thereby directed to an area outside the private sphere of the person processing the data").
Based on this ruling by the ECJ, the OGH has already stated that data processing in connection with a private Facebook profile that is not connected to a professional or economic activity is covered by the "household exception" (cf. the judgment cited above of the Supreme Court of June 23, 2021, 6 Ob 56/21k).
Accordingly, the "household exception" also applies to the exclusively private use of services such as WhatsApp, provided that this is not accompanied by unrestricted publication of personal data on the Internet (cf. Bergauer in Jahnel [ed.], GDPR. Commentary, Art. 2, para. 27) .
b) In the matter
Applied to the present case, these considerations mean the following:
As established, the Respondent made the recording in question available to a closed and limited group of people using the instant messaging service "WhatsApp" - namely Wolfgang K*** (the former partner of the Complainant), Claudia L*** (the wife of a friend of Wolfgang K***) and Esther N*** (the Respondent's sister) - transmitted.
Despite extensive investigations, there are no indications that this data processing is in any way connected to a professional or economic activity.
The Respondent has convincingly argued that the recording was only made and subsequently sent to the persons named in order to provide evidence of what they called "the Complainant's misconduct".
Whether the relationship between the Respondent and Wolfgang K*** was a friendship or - as the complainant put it - merely a "loose acquaintance" can remain undecided (cf. again the previously cited judgment of the Supreme Court of June 23 2021, 6 Ob 56/21k and the above considerations).
The decisive factor is that the data processing relevant here is an exclusively private matter within a limited circle of acquaintances.
c) Summary and result
The exemption provision of Art. 2 Para. 2 lit. c GDPR is applicable, since the preparation and transmission of the recording in question using "Whatsapp" to individually determined recipients (and not to an indefinite or unlimited public group of addressees) on the occasion of a personal connection correspondence was carried out.
Since the regulation is not applicable, there can be no violation of the principle of lawfulness of data processing according to Art. 5 Para. 1 lit. a in conjunction with Art. 6 GDPR.
D.2. right to secrecy
a) Relationship between Section 1 (1) DSG and Art. 2 (2) GDPR
The next step is to deal with the relationship between the GDPR and the DSG with regard to the exceptions mentioned in Art. 2 Para. 2 GDPR.
According to Art. 16 (2) TFEU, there is a Union competence to enact regulations on the protection of natural persons with regard to the processing of personal data by the Member States in the course of activities that fall within the scope of Union law.
Insofar as a situation falls within the scope of Art. 8 EU-GRC, any constitutional provisions that offer the same guarantee must remain “dormantly in force” to the extent of this agreement and the assessment is based exclusively on the Union law provision (cf. on this recently the decision of the German Federal Constitutional Court of November 6, 2019, GZ 1 BvR 276/17, Rz 47 ff; cf. further VfSlg. 19.632/2012, where the Constitutional Court has already stated that in the event of a match between rights with the EU-GRC using the latter as a control standard).
In the present case it cannot be said that the scope of protection of Section 1 DSG goes beyond that of Art. 8 EU-GRC, so that Section 1 (1) DSG does not apply at all.
But even if one were to see an application of § 1 DSG, the complaint would not be successful:
The (simple legal) provision of § 4 Para. 1 DSG declares the GDPR to be applicable in addition to the DSG for the fully or partially automated processing of personal data as well as for the non-automated processing of personal data that is stored or will be stored in a file system, without specific to refer to the exceptions in Art. 2 Para. 2 GDPR.
In this regard, however, the provisions of the GDPR are opened up to a fundamentally unrestricted area of application at national level (cf. Kunnert in Bresich/Dopplinger/Dörnhöfer/Kunnert/Riedl, DSG § 4, Note 3), so that based on Art. 2 para. 2 lit . c GDPR processing operations excluded from the scope of application of the GDPR are also not covered by the DSG (cf. ErlAB, 1761 BlgNR. XXV GP, p. 4).
The data protection authority does not overlook the fact that the "household exemption" standardized in Art. 2 Para. 2 lit. c GDPR corresponds essentially to the previous provision of Art. 3 Para according to the relevant case law of the ECJ, the member states were not prevented from extending the scope of national legislation that was enacted in implementation of the GDPR to areas not covered by the scope of the GDPR, provided that no other provision of Community law conflicted with this (cf . the judgment of the ECJ of November 6, 2003, C-101/01, paragraph 98 already cited).
The Austrian legislator had made use of this possibility created under the GDPR and laid down specific data protection regulations for processing activities for private or family purposes in the earlier provision of § 45 DSG 2000 (cf. original version of Federal Law Gazette I No. 165/ 1999). The provision just cited did not provide for any general exception to the fundamental right to data protection, which would not have been possible due to its non-statutory character (cf. Jahnel, Handbuch Datenschutzrecht, p. 433 ff).
With a view to the current legal situation, it should be emphasized that the GDPR itself - due to the provision of the "household exception", which is essentially adopted word for word - does not fall behind the scope of protection of the GDPR, but a provision similar to Section 45 DSG 2000 by the Austrian legislature in the DSG does was not (or no longer) provided for in the following.
From this it can be concluded that the Austrian legislature did not want to extend the scope of protection of the DSG to circumstances that relate exclusively to personal or family matters.
b) Result
On the basis of the above considerations, the provision of Art. 2 Para. 2 lit. c GDPR also applies in connection with an alleged violation of Section 1 Para. 1 DSG and consequently the scope of the DSG is also not open.
Consequently, in the absence of application of § 1 Para. 1 DSG, there can be no violation of the right to secrecy.
It was therefore to be decided accordingly.
