DSB (Austria) - DSB-D130.217
From GDPRhub
| DSB - DSB-D130.217 | |
|---|---|
 | |
| Authority: | DSB (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 3 GDPR Article 4(7) GDPR Article 5(1)(d) GDPR Article 17 GDPR Article 17(3)(a) GDPR Article 85 GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 09.01.2023 |
| Published: | 29.03.2024 |
| Fine: | n/a |
| Parties: | Wikimedia Foundation Inc |
| National Case Number/Name: | DSB-D130.217 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | German |
| Original Source: | RIS (in DE) |
| Initial Contributor: | ec |
The DPA found that the principle of accuracy does not always impose an obligation on the controller to keep data updated. Completeness is required only when it is necessary to fulfil the purpose of the processing.
English Summary
Facts
The data subject is an Austrian artist who is known to a wider public in Austria through his work as a filmmaker, screenwriter and cameraman.
The controller, Wikimedia Foundation Inc, is the operator of Wikipedia.org.
The data subject requested the controller to erase all his data under Article 17 GDPR, because the data was inaccurate and not up to date. The registered films were not up to date and there were also errors with certain films, in which he was either not correctly listed or the films had incorrect titles.
The controller refused the erasure request based on two reasons. Firstly, the controller claimed that it did not fall under the territorial scope of the GDPR (Article 3 GDPR) as it was based exclusively in the USA and under US law, and thus the GDPR is not applicable. It also did not provide any goods or services to persons such as the data subject. Secondly, the data processing was lawful due to the legitimate interest of the public as the data subject is a public figure and the processing was carried out for journalistic purposes. Even if the GDPR was applicable, the controller claimed that the data subject would not be entitled to erasure because the media privilege would apply.
The data subject filed a complaint with the Austrian DPA (Datenschutzbehörde, DSB), claiming that data processed by the controller was not factually accurate or up to date. The principle of accuracy under Article 5(1)(d) GDPR obliges the controller to ensure that the data is both factually correct and, if necessary, up to date.
Holding
Regarding the applicability of the GDPR, the DPA found that, although the controller was based in the USA, it had a total of 38 national branch associations with at least one of them located in Austria. There was also an automatic redirection (after entering a search term) from "http://wikipedia.at" to "https://de.wikipedia.org", which clearly showed the close links between the controller’s (branch) associations and the controller itself and the aim of facilitating access for Austrian users. Moreover, the article of the data subject was only available in English and German. Thus, the information service about the data subject is obviously aimed at the German-speaking area and not only at the US. The controller obviously intended to attract Austrian users to its information service, thus fulfilling the requirement under Article 3(2)(a) GDPR. The DPA therefore held that the material and territorial scope of application were met and thus, the GDPR is applicable.
The DPA also held that the controller must at least be qualified as a joint controller with its users under Article 4(7) GDPR as the controller was responsible for raising funds, controlling the servers, developing the software and public relations work to support all its projects and its website and intervene directly in cases where swift action is required.
Regarding the controller’s claim they have media privilege, Article 85 GDPR allows for Member States to provide for exemptions for processing carried out for journalistic purposes to the purpose of academic artistic or literary expression. According to the DPA’s established national practice, two conditions must be met cumulatively for the media privilege to apply:
- Personal data must be processed by the media owner, publisher, media employees and employees of a media organisation or media service within the meaning of the Austrian Media Act;
- this processing must be for journalistic purposes of the media organisation or media service.
Since the person who is ultimately responsible for the content and editing of the content distributed via the network is understood to be the media owner, the DPA found that in this case the controller was not involved in the content design and cannot be qualified as a media owner. Therefore, the first condition was not met and media privilege did not apply and the DPA was responsible for handling the complaint.
Regarding the inaccuracy of data, the DPA found that the film titles were correct and thus no inaccuracy could be established. On the not up to date data, the DPA explained that the controller's legal obligation to complete the data only exists in those cases in which the added information is actually relevant to the processing of data in order to ensure the objective accuracy of the data. The purpose of the processing by the controller in this case is to provide general information about the data subject for users of the website. The DPA found that it does not mean that all works in which the data subject has participated needs to be listed exhaustively. Merely an overview of the filmography is sufficient to fulfill the processing purpose. Therefore, the DPA held that the processing purpose within the meaning of Article 5(1)(d) GDPR had not been violated.
Regarding the data subject’s right to erasure, the DPA explained that there is an exception under Article 17(3)(a) GDPR if the processing is necessary for exercising the right to freedom of expression and information. This is not absolute and must be weighed against the fundamental rights in the Charter. Because the data subject was a public figure who is known to a broad public and the data could not be qualified as false, untrue or inaccurate, the intensity of the interference was classified by the DPA as low. Therefore, the DPA held that the legitimate interests of the general public pursuant to Article 11 of the Charter of Fundamental Rights in access to information outweigh the flawed legitimate interests of the data subject. Thus, the exception of Article 17(3)(a) GDPR applies and therefore the DPA found that the controller correctly did not comply with the data subject’s request.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
text GZ: 2022-0.479.809 from January 9, 2023 (procedure number: DSB-D130.217) [Editor's note: Names and companies, legal forms and product names, addresses (including URLs, IP and email addresses), file numbers (and the like), etc., as well as their initials and abbreviations may be abbreviated and/or changed for pseudonymization reasons be. Obvious spelling, grammar and punctuation errors have been corrected. The name of the respondent was not pseudonymized because editing the content of the decision, which would have made it impossible or at least significantly more difficult to identify the respondent, would only have been possible by largely eliminating the comprehensibility of the content of the decision. The right to secrecy (Section 1 DSG) and interest in secrecy of the respondent, a legal entity whose lawful actions were established in the decision, are offset by the legal mandate in accordance with Section 23 Paragraph 2 DSG, whereby this is a decision of fundamental importance for the general public, as some legal issues have been dealt with here for the first time. Despite the impossibility of complete pseudonymization, the decision had to be included in the data protection authority's decision documentation because of the predominance of the general interest in publication.]The name of the respondent was not pseudonymized because editing the content of the decision would make it impossible to identify the respondent or would have made it significantly more difficult and would only have been possible by largely eliminating the comprehensibility of the content of the decision. The right to secrecy (paragraph one, DSG) and interest in secrecy of the respondent, a legal entity whose lawful actions were established in the decision, are offset by the legal mandate according to paragraph 23, paragraph 2, DSG, which is a decision of fundamental importance Significance for the general public, as some legal issues have been dealt with here for the first time. Despite the impossibility of complete pseudonymization, the decision had to be included in the data protection authority's decision documentation because of the predominance of the general interest in publication.] NOTICE SAYING The data protection authority decides on the data protection complaint from Mr. Walter A*** (complainant) dated February 14, 2019 against the Wikimedia Foundation Inc. (respondent), represented by B*** Rechtsanwälte GmbH in 1010 Vienna, due to the alleged violation of the law to delete as follows: The complaint is dismissed as unfounded. Legal bases: Art. 3, Art. 4, Art. 5, Art. 17, Art. 51 Para. 1, Art. 57 Para. 1 lit. f and Art. 77 Para. 1 of Regulation (EU) 2016/679 ( General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of May 4, 2016, p. 1; §§ 9, 18 paragraph 1 and 24 paragraph 1 and paragraph 5 of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999 as amended; §§ 13 Paragraph 8, 59 Paragraph 1 of the General Administrative Procedure Act 1991 (AVG), Federal Law Gazette No. 51/1991 as amended; § 1 of the Media Act (MedienG), Federal Law Gazette No. 314/1981 as amended: Article 3, Article 4, Article 5, Article 17, Article 51, paragraph one, Article 57, paragraph one, letter f, as well as Article 77, paragraph one, of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of May 4, 2016, p. 1; Paragraphs 9, 18 paragraph one, as well as 24 paragraph one and paragraph 5 of the Data Protection Act (DSG), Federal Law Gazette Part one, No. 165 from 1999, as amended; Paragraph 13, paragraph 8, 59 paragraph one, of the General Administrative Procedure Act 1991 (AVG), Federal Law Gazette No. 51 from 1991, as amended; Paragraph one of the Media Act (MedienG), Federal Law Gazette No. 314 from 1981, as amended. REASON A. Submissions of the parties and course of proceedings 1. In the submission initiating the proceedings dated February 14, 2019, amended on February 21, 2019, the complainant submitted that he considered his right to deletion violated by the respondent because it did not comply with his deletion request of June 29, 2018 have. To explain this, the complainant stated that the respondent was not a media company, but rather a social network where users can publish and edit posts anonymously and without editorial staff or editorial statutes. The original data set concerning him was not created inadequately by the respondent based on her research, but by himself. However, he no longer wants to be part of the respondent's network and insists on deleting all of his data. It is also sensitive data because it concerns his date of birth, his origin and his family circumstances. The complaint was accompanied by the request for deletion dated July 29, 2018 and the respondent's response. 2. In the opinion of October 29, 2020, ho. The same content was received by letter on November 3, 2020, the respondent, represented by counsel, stated in summary that the respondent was exclusively a foundation established in the USA and under US law, which runs the online encyclopedia www.wikipedia.org brought into being. The respondent does not have any branches, group companies or other affiliated companies in the EU. The foundation also does not offer any goods or services to people such as the complainant. The respondent herself does not make any selection of the topics to be written about. These are made by the contributors themselves, who rely on publicly available sources such as newspaper articles or other contributions. The respondent merely publishes the encyclopedia entries, which are neither created by itself nor under its responsibility, but rather are written and edited by a community of contributors. There is also no monitoring. Therefore, the respondent came to the conclusion that the GDPR was not applicable. Since, according to the respondent's legal opinion, the GDPR is not included in the territorial scope of the GDPR, it does not have to appoint a representative in accordance with Article 27 of the GDPR. Regardless of the inapplicability of the GDPR, data processing based on a legitimate public interest is still lawful. The respondent operates a platform that enables the preservation and further development of what is probably the best-known online encyclopedia by voluntary and honorary authors. The contributions have always been created by multiple authors and are continually edited and discussed according to the principle of collaborative writing. Wikipedia currently has over 50 million articles on every topic imaginable. The data processing is not carried out in the interests of the respondent, but rather in the interests of the general public in obtaining information. In addition, the processing of personal data, which was generally criticized by the complainant, was carried out exclusively for journalistic purposes. The facts in question can therefore be assigned to the core area of journalistic activity. In addition, the complainant is a public figure, including an author, filmmaker, cameraman and director, about whom there are numerous articles. Among other things, he runs a website with the URL. The respondent does not have any branches, group companies or other affiliated companies in the EU. The foundation also does not offer any goods or services to people such as the complainant. The respondent herself does not make any selection of the topics to be written about. These are made by the contributors themselves, who rely on publicly available sources such as newspaper articles or other contributions. The respondent merely publishes the encyclopedia entries, which are neither created by itself nor under its responsibility, but rather are written and edited by a community of contributors. There is also no monitoring. Therefore, the respondent came to the conclusion that the GDPR was not applicable. Since, in the respondent's legal opinion, the GDPR is not included in the territorial scope of the GDPR, it does not have to appoint a representative in accordance with Article 27, GDPR. Regardless of the inapplicability of the GDPR, data processing based on a legitimate public interest is still lawful. The respondent operates a platform that enables the preservation and further development of what is probably the best-known online encyclopedia by voluntary and honorary authors. The contributions have always been created by multiple authors and are continually edited and discussed according to the principle of collaborative writing. Wikipedia currently has over 50 million articles on every topic imaginable. The data processing is not carried out in the interests of the respondent, but rather in the interests of the general public in obtaining information. In addition, the processing of personal data, which was generally criticized by the complainant, was carried out exclusively for journalistic purposes. The facts in question can therefore be assigned to the core area of journalistic activity. In addition, the complainant is a public figure, including an author, filmmaker, cameraman and director, about whom there are numerous articles. Among other things, he operates a website with the URL http://waltera***.com. There is therefore no doubt that there is public interest in him. The complainant's processed data would be relevant and up-to-date. The complainant's information is not only visible on the respondent's platform, but also on his own homepage and other publicly accessible websites (for example https://www.imdb.com/name/nm*4**0*9/) . The right to deletion is also not absolute and is therefore not applicable. 3. In the statement of 20 November 2020, the complainant essentially argued that he was maintaining his complaint and that the GDPR was also applicable. This was demonstrated by the fact that the respondent operated under the term Wikipedia with corresponding country codes or the domain extension in individual countries. If the respondent's argument were followed, the GDPR would not be applicable to Facebook, Twitter or other media. The complainant further stated that the original entry on Wikipedia had been created by him and not by the respondent's community. It was also a fact that the entries on the platform were edited by third parties, which would de facto constitute an editorial department. This was a characteristic of a media provider. The respondent also offered services in the form of data from living and already different people and made money from this. The information on the platform was also prepared for specific countries. In the respondent's statement of October 29, 2022, it also confirmed on page 3, paragraph 3, that it is a social network in which the design of the content is left to the user without having to use a real name. Although the authors work voluntarily and on a voluntary basis, the respondent is commercially active, which is an essential characteristic of a social network. The respondent is therefore not a public medium. The data set that he had created had not been updated since July 1, 2020. He himself could not update his own data set because the respondent or the anonymous authors refused to do so. Finally, the complainant pointed out that the respondent's arguments were very contradictory. On the one hand, it claims to be merely a platform in the form of a social network, and on the other hand, deletion is refused for journalistic reasons. 4. In the request for a supplementary statement dated 7 January 2021, the complainant was asked by the data protection authority to explain to what extent his data set was not up to date. 5. In the statement dated 13 January 2021, the complainant stated that the last films entered were from 201*. Since then, however, he has worked on a documentary film, a feature film and a series. [Editor's note: The complainant's information on his roles at two organizations has been removed for pseudonymization reasons.] In addition, there were also errors in his "vita" on the respondent's platform. He did not act as lead cameraman for the films "F***" and "G***". The films "J***", "K***", "L***" and "M***" were given incorrect titles - "N***" [Editor's note: name of the main character] was not part of the film titles. The linked pages to the films in the N*** series are all defective or faulty. None of the pages mention the producer Xaver V***, O***film, who played a significant role in the creation and appearance of the films. For the film "M***", completely incorrect cameramen are listed - and he is also the sole author. The list of defects shows that the work of the Wikipedia "editors" consists exclusively of copying and pasting from other websites. There is no journalistic review of the information, nor is it kept up to date. 6. In a letter dated 31 March 2021, the data protection authority asked the complainant to explain why he was prevented from changing or correcting the errors in his contribution on the respondent's website. 7. In his statement of 9 April 2021, the complainant replied that the respondent's editors would not allow him to make changes to the entry. In particular, a user with the pseudonym "Spacehawk**4" is preventing the changes without giving any editorially relevant reasons. Between June 2013 and February 2014, he tried unsuccessfully to make changes or delete the content himself, but was then blocked as a user and has not been able to edit his own post since then. He then requested that the respondent delete the entry, but this was refused. The version histories of the complainant's page and the blocking can be seen on the links: https://de.wikipedia.org/wiki/Walter_A***?action=history&offset=*5**25*7 and https://xtools.wmflabs.org/topedits/de.wikipedia.org/Spacehawk**4/0/Walter%20A***. 8. In its statement of 27 April 2021, the respondent stated that Wikipedia is not intended to enable people to spread information or opinions about themselves or to promote themselves. Rather, the online encyclopedia's purpose is to make neutral and factual information about relevant topics and people available to the general public. The complainant originally created the article himself and has since repeatedly tried to add new information about his activities. Changes that do not comply with the respondent's specifications will be corrected by the Wikipedia community. On 7 January 2009, the complainant attempted to add an incomprehensible website (www.hof***.at). On 22 June 2013, the complainant added further information without citing the relevant sources, thereby de facto promoting himself. Since the changes made did not comply with the guidelines, they were deleted by the community and documented in a comprehensible manner. Only when the complainant's changes, which were purely for self-promotion, were not accepted did he decide to reduce the post about him to "Walter A*** is a filmmaker and author" or to delete the post. However, the complainant is a person who is well known in Austria. For this reason, the respondent's community decided that there was a fundamental public interest and that a factual, neutral presentation of his activities could therefore contribute to the exchange of information. The complainant was dissatisfied with the result and repeatedly tried to change the post. This ultimately led to his account being blocked. 9. In its supplementary statement of 28 April 2021, the respondent again argued, with reference to its statement of 29 October 2020, that the GDPR was not applicable in this case. The processing was not a service, nor was it a product that was being offered to the complainant. Even if the GDPR were applicable, the persons concerned would not have a right to deletion because media privilege would apply. In addition, the article about the complainant only consists of general and neutral information about a well-known public figure. In addition, the complainant's data is publicly accessible, partly disclosed by him himself. The respondent's website is the first collective, universal, multilingual and non-profit online encyclopedia. The respondent applies the relevance principle. This means that no articles are added if they do not have sufficient encyclopedic value. Only when the criteria of this principle are met, the article does not have any quality defects and another contributor has reviewed the article will it be published. The community consists of experienced editors and also of people who have just registered. However, this is not a collection of raw data, a directory of natural persons, a rumor mill or platform for advertising, propaganda or conspiracy theories, and also not a platform for self-promotion. There are also separate relevance criteria for each language version of the website. The German version has detailed guidelines for assessing the relevance of living people. The respondent can be actively involved in disputes or can be involved by the community. This includes, among other things, persistent vandalism, for example repeatedly editing articles with nonsense or inappropriate content or changing IP addresses to bypass the IP blocks set up by the community, or harassment of other users or community members. The respondent only intervenes if the community is unable to resolve the problem itself for some reason. Every user of the respondent's website - whether registered or not - can contribute to the online encyclopedia. A registered user can choose a user name and also has the option of providing their email address. As long as the user does not reveal their real name by providing the data, the respondent cannot know the actual identity of the person behind it. If the user is not registered, only his IP address is used as the user name. Contributors are free to create new content or add to, correct, move, merge or delete contributions from others. A backup system is also built in, which can also restore the previous version of an entry. The online encyclopedia is not a platform for articles that contributors write about themselves in their own interests. Hosting and curating such content is not a service that the respondent offers to the persons concerned. With regard to the complainant's contribution, it should be stated that this is a short and completely factual, non-controversial article, which covers almost exclusively his professional career. No information was disclosed that was not available on the complainant's own website or on the IMdB platform. Some users have access to special technical tools aimed at protecting the encyclopedia. These are administrators who act as “admins”, “sysop” or “operators”. You have the option to decide whether to delete irrelevant posts, secure articles or block users who violate the basic principles. These people are volunteers and have no employment or other contractual relationship with the respondent. They are therefore just as free in their contributions as any other contributor. The respondent is not involved in the creation of new articles or contributions to existing articles. No editorial controls would be exercised by the respondent. Furthermore, the latter neither plays a special role in the publication of contributions nor does it ensure this. Likewise, the respondent does not have an editor-in-chief, an editorial committee or an administrative office or similar institution. As already mentioned, any contributor - any regular user of the site - can review and edit a post (including approving new articles). The respondent does not check, control or decide on content, except in rare cases, a so-called office action (vandalism), when all community measures fail. The respondent focuses on raising funds, distributing grants, controlling servers, developing and using software, and public relations to support the Wikimedia projects. The respondent provides the technical tools for the majority of the contributions. In principle, the deletion of articles can only be carried out by the administrators, but the respondent has the right to intervene. In practice, deletion occurs in the event of copyright infringement, for child protection reasons or in cases in which the safety of people is at risk. As a rule, this happens in all cases where quick action is required. 10. As part of the statement of May 10, 2021, the complainant noted in the final hearing that he did not see any new information value in the respondent's submission. At the beginning of the letter, reference is made to freedom of the press and at the same time it is pointed out that the respondent does not carry out any editorial activity and is therefore not a medium. In any case, this argument is not conclusive. Six years have now passed between the entry created by the complainant about him and the first attempt to update it. A correct update or deletion can also be expected from the respondent. The question also arises as to why the GDPR is not applicable if the Austrian website explicitly refers to it. In any case, the respondent is not a medium. B. Subject of the complaint The subject of the complaint is the question of whether the complainant's right to deletion was violated because the respondent refused to comply with his request for deletion dated June 29, 2018. C. Findings of Fact 1. The complainant is an Austrian artist who is known to a broader public in Austria through his role as a filmmaker, screenwriter and cameraman. The respondent is an operator of an Internet platform under the URL wikipedia.org, on which information on a wide variety of subject areas is written or modified by website visitors in the form of a reference work. The respondent has a total of 38 branch associations that have secured the respective country-specific domain endings (e.g. Greece, Sweden, Spain, Finland, Denmark and Austria) within the European Union. Via wikipedia.eu you will be redirected directly to the respondent's website. On the other websites it is first necessary to enter a search term in the search bar and only then will you be redirected to the respondent's website www.wikipedia.org with country-specific language settings. The website www.wikipedia.at is operated by the Wikimedia Oesterreich Society for the Promotion of Free Knowledge. This is a Wikimedia branch association located in Austria and based at Ö***platz 6*, **** L***dorf, which was founded on February 2, 2022. Wikimedia Austria supports the respondent's websites. Screenshot of the Whois query regarding the website with the URL www.wikipedia.at (formatting not shown 1:1): [Editor's note: The document reproduced here as a graphic file cannot be pseudonymized with reasonable effort and has therefore been removed. It states, among other things, that the association “Wikimedia Oesterreich Society for the Promotion of Free Knowledge” is the registrant (owner) of the domain.] Screenshot of the Whois query for the website with the URL www.wikipedia.org (formatting not shown 1:1): [Editor's note: The document reproduced here as a graphic file cannot be pseudonymized with reasonable effort and has therefore been removed. It states, among other things, that the respondent is the registrant (owner) of the domain.] Screenshot of the Whois query for the website with the URL www.wikipedia.fr (formatting not shown 1:1): [Editor's note: The document reproduced here as a graphic file cannot be pseudonymized with reasonable effort and has therefore been removed. It states, among other things, that the association “ASSOCIATION WIKIMEDIA FRANCE” is the registrant (owner) of the domain.] Screenshot regarding the availability of the European domain endings from “wikipedia” (formatting not shown 1:1): [Editor's note: The document reproduced here as a facsimile (graphic file) cannot be pseudonymized with reasonable effort and has therefore been removed. It states, among other things, that the domain name “Wikipedia” is assigned in all national versions listed.] Assessment of evidence: These findings result from the complainant's submission initiating the proceedings dated February 14, 2019, amended on February 21, 2019, as well as from the statement of the respondent, represented by counsel, dated October 28, 2019 and the ex officio search of December 12, 2022 on the websites with the URL https://who.is/whois and www.world4you.com/de. 2. Every user of the respondent's website - regardless of whether they are registered or not - can write, correct, add to or delete a contribution. Administrators are elected by the community of users. These have extended rights (right to delete and protect non-relevant contributions, block users). The administrators and other contributors have no employment or other contractual relationship with the respondent. This does not have an editor-in-chief, an editorial committee or an administrative office or any similar institution. The content of individual user contributions is also not checked, controlled or decided in advance. The respondent is primarily responsible for financing (raising funds), controlling the servers, developing and using the software, distributing grants and public relations for all projects. It also has the right to intervene in rare, exceptional cases (so-called “office actions”) where rapid action is required (copyright violations, child protection, endangering the safety of people) or for conflicts of interest that cannot be resolved by the users themselves within its platform . In these cases, due to the short period of time for action, there is not enough time to go through the normal community processes. Assessment of evidence: These findings are based on the respondent’s statement dated April 28, 2021. 3. The complainant made an entry about himself on the respondent's website at the URL https://de.wikipedia.org/wiki/Walter_A*** on February 26, 2006 at 10:44 a.m. under his user name Waltera*** written. Screenshot of the original source text from February 26, 2006 at 10:44 a.m. (formatting not shown 1:1): [Editor's note: The document reproduced here as a facsimile (graphic file) cannot be pseudonymized with reasonable effort and has therefore been removed. It states, among other things, that a person with the username Waltera*** made a change to the Wikipedia entry concerning the complainant on February 26, 2006.] Assessment of evidence: These findings arise from the complainant's submission initiating the proceedings dated February 14, 2019, amended on February 21, 2019, as well as from the statement of the respondent, represented by counsel, dated October 28, 2019 and the ex officio research dated December 12, 2022 and December 14 December 2022 (access the URL: https://de.wikipedia.org/w/index.php?title=Walter_A***&oldid=*5*7**2). 4. The entry about the complainant was changed both by himself and by several users between February 26, 2006 and June 13, 2021. The complainant's entry was last edited on June 13, 2021 at 7:54 a.m. Timing of the edits (formatting not shown 1:1): [Editor's note: The document reproduced here as a facsimile (graphic file) cannot be pseudonymized with reasonable effort and has therefore been removed.] Screenshot of the latest version of the entry about the complainant (formatting not 1:1): [Editor's note: The document reproduced here as a facsimile (graphic file) cannot be pseudonymized with reasonable effort and has therefore been removed.] Assessment of evidence: These findings are based on both the consistent submissions of the parties and on the respondent's website, where it is also possible to compare the individual processing. 5. The complainant submitted a request for deletion to the respondent on June 29, 2018 at 7:50 p.m. Screenshot of the request for deletion from June 29, 2018 at 7:50 p.m. (formatting not shown 1:1): [Editor's note: The document reproduced here as a facsimile (graphic file) cannot be pseudonymized with reasonable effort and has therefore been removed. It was addressed to the email address info-de@wikimedia.org and requested the deletion of the “page” specifically identified by a URL with the Wikipedia entry about the complainant.] 6. The respondent did not comply with the complainant's request. Assessment of evidence: These findings arise from the complainant's undisputed initiating submission of February 14, 2019, amended on February 21, 2019. 7. The information disclosed on the respondent's website about the complainant is also published on other websites. Excerpt from the publicly available information on the page https://noev1.orf.at/magazin/daheiminnoe/****.html (formatting not 1:1): [Editor's note: The documents reproduced here as facsimiles (graphic files) cannot be pseudonymized with reasonable effort and have therefore been removed. This is an excerpt from an article from the online regional and social reporting of the Austrian Broadcasting Corporation (ORF), which also refers to the complainant's previous work.] Assessment of evidence: These findings are based on the official research of December 14, 2022 on the websites with the URL https://www.society***.org/ events/a***-walter/, https://www. mkmnoe.at/****/referentin/walter-a***, https://freelancer***experts.com/de/Walter-A***_*44*08.html, https:// noev1.orf.at/magazin/daheiminnoe/****.html and https://www.imdb.com/name/nm*4**0*9/ and the officially conducted ZMR query about the complainant on 16 December 2022. D. In legal terms it follows: D.1. Name of the respondent Although the complainant named Mr. Charles Tr***, Legal Counsel of Wikimedia Foundation, as the respondent in his complaint, if the complaint is assessed intelligently, it can be assumed that the complaint was directed against the Wikimedia Foundation Inc. (cf. the decision of the Administrative Court dated April 28, 2021, Ra 2019/04/0138). The respondent also assumed that the complaint was directed against her. referred to as the respondent, if the complaint is assessed intelligently, it can be assumed that the complaint was directed against the Wikimedia Foundation Inc. (see the decision of the Administrative Court of April 28, 2021, Ra 2019/04/0138). The respondent also assumed that the complaint was directed against her. D.2. Subject of the proceedings According to Article 57 (1) (f) GDPR, the data protection authority must investigate the subject of the complaint to an appropriate extent. The “subject matter of the complaint” is the information provided by the GDPR. According to Article 57, paragraph one, letter f, GDPR, the data protection authority must investigate the subject matter of the complaint to an appropriate extent. The “subject of the complaint” is the administrative matter determined in terms of scope by the party’s submissions when the application was submitted (here: when the complaint was filed), the “matter under negotiation” in accordance with Section 59 Para. 1 AVG. It follows that the complainant (here: when filing a complaint) is entitled to the scope of the administrative matter, the “matter under negotiation” in accordance with paragraph 59, paragraph one, AVG. It follows that the complainant is not free to expand the subject matter of the complaint by making new submissions during the ongoing proceedings. The sole subject of the proceedings is the deletion of the post about the complainant on the respondent's platform (cf. submission initiating the proceedings of February 14, 2019 and improvement of February 21, 2019). is free to expand the subject matter of the complaint by making new submissions during the ongoing proceedings. The sole subject of the proceedings is the deletion of the post about the complainant on the respondent's platform (see the submission initiating the proceedings from February 14, 2019 and the improvement from February 21, 2019). According to Section 13, Paragraph 8, Second Sentence of the AVG, the change in the application may not change the nature of the matter and may not affect the subject-matter and local jurisdiction. The Administrative Court also decided in its decision of May 26, 2021, Ra 2019/04/0071, that if the application is changed within the framework of Section 13 Para. 8 AVG, it may only decide if the nature of the matter has not changed and In addition, the boundary of the subject of the complaint and the subject matter and local jurisdiction are not affected. The Administrative Court also decided in its ruling of May 26, 2021, Ra 2019/04/0071, that if the application is changed within the framework of paragraph 13, paragraph 8, AVG, it may only decide if the essence of the matter does not change and in addition, the limit of the subject of the complaint is not exceeded (see also Köhler, § 28 VwGVG, in: , Paragraph 28, VwGVG, in: Köhler/Brandtner/Schmelz [ed.], VwGVG commentary [2021] para. 41). The articles put forward by the complainant in the statement of January 13, 2021 and linked to his contribution about individual films in which he appeared are not the subject of the complaint in these proceedings. The subject of the complaint is clear from the submission initiating the procedure. D.3. On the applicability of the GDPR and the responsibility of the data protection authority The respondent is a non-profit foundation based in the USA. The USA should be viewed as a third country in the context of European law. The respondent operates an online encyclopedia in which the complainant's personal data (first and last name, date of birth, career, filmography) are processed automatically. At the time the decision was issued, the respondent, as an umbrella organization, had 38 associations (referred to by the respondent as branch associations), at least one of which was located in Austria (see point 1 of the findings). ), at least one of which is in Austria (see point 1 of the findings). According to Art a data subject in the Union Goods or Pursuant to Article 3, Paragraph 2, Letter a, GDPR, the GDPR applies to the processing of personal data of data subjects located in the European Union by a controller not established in the Union if the data processing is related to the provision of goods or services to a data subject in the Union, regardless of whether a payment is to be made by that data subject. The respondent itself offers Austrian website visitors information on a wide variety of topics through its online encyclopedia. The (Austrian) users can access information about the complainant via the respondent's website, which is prepared in German. The term service is not explained in more detail in the GDPR, but it must be interpreted very broadly. It is obvious that the respondent offers information services and has also aimed these at the Austrian market (“market location principle”). It is also expressly clear from Art. 3 Para. 2 lit. It is obvious that the respondent offers information services and has also aimed these at the Austrian market (“market location principle”). Article 3, paragraph 2, letter a, second half of the GDPR also expressly states that whether they are paid or free of charge does not play a role ( A search engine operator generally does not demand any payment from the end consumer for the provision of information, see Ernst in Paal/Pauly, GDPR Art. 3 Rz. 17)., GDPR Article 3, Rz. 17). According to Article 3 Paragraph 2 Letter a GDPR, data processing must be related to an offer of goods or services “in the Union”. Even if the wording does not speak of “alignment”, as was the case in the previous version of the Commission’s proposal (“According to Article 3, Paragraph 2, Litera a, GDPR, data processing must be linked to an offer of goods or services “in the Union”. Even if the wording does not speak of “directing”, as was called for in the previous version of the Commission’s proposal (“directed to”) and an earlier draft proposal from Parliament (“aimed at”), it follows from recital. 23 it is clear that the offer must be aimed at affected persons residing in the Union in the sense of the market location principle (see Klar in commentary Kühling/Buchner 2017). In the case of Pammer/Reederei Karl Schlüter GmbH & Co and Hotel Alpenhof/Heller (joined cases C-585/08 and C-144/09), the ECJ states that the individual components must always be considered as a whole and that, among other things, the endings the top level domain address, the use of a language, the location of the customer base and the ease of access to the website are essential factors to be taken into account. The linguistic design of the information service can be used in accordance with Recital. 23 be an indication of offering for the European (specifically the Austrian) market. As already stated above, the respondent has a total of 38 national associations, some of which are based in the European Union (including Austria, France, Germany, Belgium and Sweden). The individual national websites redirect to the respondent's homepage either directly or via an intermediate step. Due to the structure and close branching of the websites of the national branch associations and those of the respondent, there is undisputed ease of access. If the complainant's name is entered on the website "http://wikipedia.at", which is aimed at the Austrian market location and which also has the country-specific top-level domain extension ".at", it will be automatically redirected to https:// de.wikipedia.org/wiki/Walter_A***. The data protection authority does not ignore the fact that the Austrian site is registered with the organization Wikimedia Oesterreich Gesellschaft zur Foerderungfreie Wissen, which is a branch in the form of an association of the respondent in Austria. However, this obviously shows the close connection between the (branch) associations of the respondent and the respondent itself and also the associated goal of making access easier for Austrian users. Due to the automatic redirection (after entering a search term) from “http://wikipedia.at” to https://de.wikipedia.org, the website visitor does not have to take any further intermediate steps. In addition, the article about the complainant is only available in two languages (German and ***ish). The information service about the complainant is therefore obviously aimed at the German-speaking area, and not just the US. The film productions in which the complainant took part are also marked with a connection to Austria. It should be emphasized that the complainant's page is not available in English, which is the official language of the country where the respondent has its headquarters. This means that information is prepared specifically for individual countries or regions. From these individual points alone, the overall picture shows that the respondent obviously intends to attract Austrian users to its information service. Internet users are also deliberately redirected from the website with the “at.” domain ending (from a nationally established association of the respondent) to their own homepage. The factual and spatial scope of application is present and the GDPR is therefore applicable. D.4. On the responsible status The determination of the distribution of roles under data protection law is of crucial importance for the complaint procedure according to Section 24 DSG or Art. 77 Paragraph 1 GDPR, especially since it is determined who is responsible for compliance with the respective data protection regulations. The determination of the distribution of roles under data protection law is of crucial importance for the complaint procedure according to paragraph 24, DSG or Article 77, paragraph one, DSGVO, especially since it is determined who is responsible for compliance with the respective data protection regulations. According to Article 4, Paragraph 7, GDPR, the “responsible person” is the natural or legal person, authority, institution or other body that which alone or jointly with others decides on the purposes and means of processing personal data. The essential criterion is the decision-making component. The role of the controller therefore arises primarily from the fact that a specific body has decided to process personal data for its own purposes. The “purpose” describes an expected result, while the “means” determines the way in which the expected result is to be achieved (see Article 29 Data Protection Working Party, Opinion 1/2010 on the terms “controller” and “processor”, WP 169, nor in relation to Article 2 lit. d of the Data Protection Directive 95/46/EC). The role of the controller therefore arises primarily from the fact that a specific body has decided to process personal data for its own purposes. The “purpose” describes an expected result, while the “means” determines the way in which the expected result is to be achieved see Article 29 -, D, a, t, e, n, s, c, h, etc , t, z, g, r, u, p, p, e,, Opinion 1/2010 on the terms “controller” and “processor”, WP 169, nor with reference to Article 2, Litera d, of Data Protection Directive 95/46/EC). The decisive factor in assigning responsibility is therefore who decides on the essential aspects of the means of processing. In order to attribute the status of controller, it is not necessary that the controller itself processes data, is in possession of the processed data or has physical control. If he decides that data is to be processed, all persons and bodies that carry out data processing steps under his supervision or instructions (auxiliary bodies) are to be assigned to him. In fact, in the statement dated April 28, 2021, the respondent states that it is not the person responsible for the content. In response to this, the respondent states in the same statement that it is responsible for raising funds, controlling the servers, developing the software and public relations to support all of its projects - including, logically, its website - and that it intervenes directly in those cases , where quick action is required, ie. in cases of copyright infringement, child protection, blocking of IP addresses or when the safety of people is at risk, and also mediate in those conflicts where the community (consisting of users and administrators) cannot find a solution on the platform itself. Administrators are elected by the community of users. As stated in point 2 of the findings, these are entitled to normal (writing, correcting, adding to and deleting posts) and extended rights (right to delete and protect non-relevant posts, blocking users). The administrators and other contributors (remaining users) have no employment or other contractual relationship with the respondent. Therefore, the respondent is to be qualified as at least a joint controller under data protection law in accordance with Art. 4 Z 7 GDPR, particularly in light of the administrators who also decide on the purposes and means. to qualify according to Article 4, Section 7, GDPR. D.5. Applicability of media privilege With regard to the argument that the data protection authority lacks jurisdiction in the respondent's statement of October 4, 2021, it should first be generally pointed out that if the requirements of Section 9 (1) DSG are met, legal protection is only possible through the ordinary courts according to the Media Act and the data protection authority has no jurisdiction With regard to the argument that the data protection authority lacks jurisdiction in the respondent's statement of October 4, 2021, it should first be generally pointed out that if the requirements of paragraph 9, paragraph one, DSG are met, legal protection is only possible through the ordinary courts according to the Media Act and the data protection authority has no jurisdiction. The national regulation in Section 9 DSG is linked to Article 85 GDPR, a fundamental provision including an opening clause (cf. The national regulation in Paragraph 9, DSG is linked to Article 85, GDPR, a fundamental provision including an opening clause, see Suda/Veigl in Gantschacher /Jelinek/Schmidl/Spanberger, Data Protection Act1 § 9 Rz. 1, also with reference to § 9 DSG as amended by Federal Law Gazette I No. 165/1999 as amended by Federal Law Gazette I No. 120/2017 [Data Protection Adaptation Act 2018]). Paragraph 9, para. 1, also with reference to paragraph 9, DSG in the version of the Federal Law Gazette Part One, No. 165 from 1999, in the version of the Federal Law Gazette Part One, No. 120 from 2017, [Data Protection Adaptation Act 2018]).Article 85 of the GDPR regulates the processing and freedom of expression and freedom of information and stipulates in paragraph 1 that “the provisions of the DSG and the more specifically mentioned chapters of the GDPR do not apply to the processing of personal data by media owners, publishers, media employees and employees of a media company or media service within the meaning of the Media Act – Media Act, Federal Law Gazette No. 314/1981, for journalistic purposes of the media company or media service (…). Article 85 of the GDPR regulates the processing and freedom of expression and freedom of information and stipulates in paragraph 1 that “the provisions of the DSG and the more specifically mentioned chapters of the GDPR do not apply to the processing of personal data by media owners, publishers, media employees and employees of a media company or media service within the meaning of the Media Act – Media Act, Federal Law Gazette No. 314 of 1981, for journalistic purposes of the media company or media service (…). According to the consistent case law of the data protection authority, two conditions must be met cumulatively for the media privilege to apply: Firstly, personal data must be processed by media owners, publishers, media staff and employees of a media company or media service within the meaning of the Media Act, and secondly, this processing must be carried out for the journalistic purposes of the media company or media service (see, among others, the decision of 2 December 2019, GZ: DSB-D124.352/0003-DSB/2019, and of 18 December 2019, GZ: DSB-D123.768/0004-DSB/2019).: Firstly, personal data must be processed by media owners, publishers, media staff and employees of a media company or media service within the meaning of the Media Act, and secondly, this processing must be carried out for the journalistic purposes of the media company or media service (see, among others, the decision of 18 December 2019, GZ: DSB-D123.768/0004-DSB/2019). the decision of 2 December 2019, GZ: DSB-D124.352/0003-DSB/2019, and of 18 December 2019, GZ: DSB-D123.768/0004-DSB/2019). It can therefore be assumed that only if the two requirements of Section 9, Paragraph 1, DSG are met, legal protection is only possible through the ordinary courts under the Media Act and the data protection authority has no jurisdiction (see the DSB decision of August 13, 2018, GZ: DSB-D123.077/0003-DSB/2018).It can therefore be assumed that only if the two requirements of Section 9, Paragraph 1, DSG are met, legal protection is only possible through the ordinary courts under the Media Act and the data protection authority has no jurisdiction (see the DSB decision of August 13, 2018, GZ: DSB-D123.077/0003-DSB/2018). In all other cases, the data protection authority is responsible for dealing with the content, but must take into account the right to freedom of expression under Article 11 of the Charter of Fundamental Rights of the European Union or Article 10 of the European Convention on Human Rights when making a balancing assessment.In all other cases, the data protection authority is responsible for dealing with the content, but must take into account the right to freedom of expression under Article 11 of the Charter of Fundamental Rights of the European Union or Article 10 of the European Convention on Human Rights when making a balancing assessment. According to Section 1, Paragraph 1, Item 1 of the Media Act, a "medium" is any means of distributing messages or presentations with intellectual content in word, writing, sound or image to a larger group of people by way of mass production or mass distribution.According to Paragraph 1, Paragraph 1, Item 1 of the Media Act, a "medium" is any means of distributing messages or presentations with intellectual content in word, writing, sound or image to a larger group of people by way of mass production or mass distribution. According to Section 1, Paragraph 1, Item 6 of the Media Act, a “media company” is a company in which the content of the medium is taken care of and its production and distribution (Item 1, leg. cit.) or its broadcasting or availability (Item 2, leg. cit.) are either taken care of or arranged for. According to Paragraph 1, Paragraph 1, Item 6 of the Media Act, a “media company” is a company in which the content of the medium is taken care of and its production and distribution (Item 1, leg. cit.) or its broadcasting or availability (Item 2, leg. cit.) are either taken care of or arranged for. According to Section 1, Paragraph 1, Item 11 of the Media Act, a “media employee” is an employee of a media company or media service who contributes journalistically to the content of a medium or to communications from the media service, provided that he or she carries out this journalistic activity on a permanent basis as an employee of the media company or media service or as a freelancer and not merely as an economically insignificant secondary occupation.According to Paragraph 1, Paragraph 1, Item 11 of the Media Act, a “media employee” is an employee of a media company or media service who contributes journalistically to the content of a medium or to communications from the media service, provided that he or she carries out this journalistic activity on a permanent basis as an employee of the media company or media service or as a freelancer and not merely as an economically insignificant secondary occupation. In its consistent case law, the OGH states, among other things, in its decision on 6 Ob 6/14x of 15 December 2014, that a media entrepreneur within the meaning of Section 1 Paragraph 1 Item 6 of the Media Act only becomes a media entrepreneur if, in addition to the purpose of merely privately distributing content, it operates a company - with a minimum of entrepreneurial structures - whose corporate purpose is the content design of the website, which is carried out by an editorial team and a large number of employees or freelance media workers (cf. RIS-Justiz RS01298 and compare RIS-Justiz RS01298 and Noll in Berka/Höhne/Noll, Media Act³ [2012] § 1, paragraph 25, 48)., Media Act³ [2012] Paragraph one, paragraph 25, 48). As stated in point 2 of the findings, the respondent has neither an editor-in-chief, an editorial committee, an administrative office nor any similar institution. Nor does the respondent check or control the content on the website "www.wikipedia.org" or decide which user contributions are published or not. This is done solely by the users of the website themselves. Only in the few cases of "office actions" that occur, where the "normal community processing process" cannot be applied due to the need for rapid action, does the respondent intervene itself. These are exceptional cases that concern child protection, copyright cases or disputes that escalate to such an extent that the community of users cannot resolve itself. The latter is also the case in the complaint. The subject of the complaint could not be resolved within the "community" and for this reason the complainant filed a complaint directly against the respondent. The respondent neither researched nor prepared the content of the article beforehand. This was all done by the complainant or other users. From what has been said so far, it follows that the respondent does not carry out any editorial work. On the one hand, because the corresponding structures - as stated by the respondent itself in its statement of April 28, 2021 - do not exist (no editor-in-chief, editorial committee or similar) and on the other hand - apart from a few exceptional cases of office actions - the articles are created, revised and also deleted by the users of the website themselves. Thus, in principle, the content is neither written nor controlled by the respondent. The individual contributions to the websites are created, modified or deleted by users, as the respondent has explained in detail throughout the entire procedure; users are not in any contractual or professional relationship with the respondent. These users are neither employees nor freelancers of the respondent. The community forms its own "ecosystem" in which the respondent does not intervene, except in the exceptional cases mentioned above. Editorial editing or final approval of the individual published articles is never carried out by the respondent itself or by anyone attributable to it. Since the media owner is understood to be the person who has the ultimate responsibility for the content and editorial aspects of the content distributed over the Internet (cf. OGH 4 Ob 226/05x of January 24, 2006), it must be stated that the respondent is not involved in the content design, which means that it lacks the elementary qualifications to be qualified as a media owner. Liability under the Media Act also requires this qualification, which is not present in this case. This also applies to the electronic sector (for content distributed over the internet, see OGH 4 Ob 226/05x of January 24, 2006). It should be noted that the respondent was not involved in the design of the content, which means that it lacks the elementary qualifications to be classified as a media owner. Liability under the Media Act also requires this qualification, which is not present in this case. This also applies to the electronic sector (Litzka/Strebinger, MedienG5 § 1 Rz 17 with further references). Paragraph one, Rz 17 with further references). In summary, it emerges from the investigation that the respondent only provides the financial, technical and structural requirements for the users, but does not participate in the content design of the encyclopedia, which contains over two million articles on a wide variety of topics in German . Thus, the first requirement of Section 9 Paragraph 1 DSG (“Thus the first requirement of Paragraph 9, Paragraph One, DSG” is “the processing of personal data by media owners, publishers, media employees and employees of a media company or media service within the meaning of the Media Act “) is not given and it can remain open whether the second requirement is met. As a result, Section 9 Paragraph 1 of the DSG applies. As a result, Paragraph 9, Paragraph One of the DSG does not apply. Consequently, the data protection authority is responsible for handling the complaint (cf. also the decision of December 18, 2019, GZ: DSB-D123.768/0004-DSB/2019). The data protection authority is therefore responsible for handling the complaint see also the decision of December 18, 2019, GZ: DSB-D123.768/0004-DSB/2019). D.6. Compliance with data processing principles When processing personal data, all data processing principles listed in Art. 5 GDPR must be adhered to. In fact, the complainant complains that the data entered does not correspond to the factual accuracy or is not up to date (see Art. 5 Para. 1 lit. d GDPR). The principle of accuracy obliges those responsible to ensure that the data is, on the one hand, factually correct and, on the other hand, if necessary, up to date. With regard to factual accuracy, only factual information can be applied and not value judgments. The personal data provided by the complainant with regard to his name, date of birth, marital status, artistic employment (filmmaker, director, cameraman and author) and career are correct and have not been disputed by him during the investigation. When processing personal data, all data processing principles listed in Article 5 of the GDPR must be adhered to. In fact, the complainant complains that the data entered does not correspond to the factual accuracy or is not up to date (see Article 5, paragraph one, letter d, GDPR). The principle of accuracy obliges those responsible to ensure that the data is, on the one hand, factually correct and, on the other hand, if necessary, up to date. With regard to factual accuracy, only factual information can be applied and not value judgments. The personal data provided by the complainant with regard to his name, date of birth, marital status, artistic employment (filmmaker, director, cameraman and author) and career are correct and have not been disputed by him during the investigation. With regard to the works specified, he stated in his statements of January 13, 2021 and April 9, 2021 that the titles listed were not correct and that the most recent works were not registered. It should be noted that the titles given are correct, but the fictitious name of the main actor [Editor's note: probably meant: the main character] has been given as an addition. This obviously serves the purpose of giving the respective website user the option of clicking either on the film title or on the name of the fictional film character. This will redirect you to two different entries, on the one hand to the film entry, which also contains the original film title (https://de.wikipedia.org/wiki/J***(Film)), and on the other hand to the entry about the fictional one Film character (see above, on the other hand for the entry about the fictional film character see https://de.wikipedia.org/wiki/N***). Therefore, no inaccuracy can be determined. This is the structure of the website in order to provide the respective user with more information. The results do not contain any data that can be classified as false, untrue, inaccurate or falsifying. With regard to the complainant's arguments regarding the incompleteness of his contribution, it must be stated that the overall context must be taken into account, taking all circumstances into account. The specific processing context must be taken into account. The controller's legal obligation to complete the data only exists in those cases where the added information is actually relevant to the processing process in order to ensure the objective accuracy of the data. The present purpose is to prepare general information about the complainant, which corresponds to the internal relevance criteria, for users of the respondent's website. However, this does not mean that all the works in which the complainant has participated must be listed exhaustively; rather, merely an overview of the filmography is sufficient to adequately fulfill the purpose of the processing. There is also no inaccurate picture of the complainant that would have to be corrected by adding further data (see to understand that all works in which the complainant took part must be listed conclusively, but simply an overview of the filmography is sufficient for this The processing purpose is sufficiently fulfilled. There is also no inaccurate picture of the complainant, which would have to be corrected by adding further data (see autumn in GDPR comment Kühling Buchner 2017). Furthermore, it is also noted in the entry itself that the filmography is only a selection (see point 4 of the findings). see point 4 of the findings). Therefore, the purpose of processing within the meaning of Article 5 Paragraph 1 Letter d of the GDPR has not been violated. Therefore, the purpose of processing within the meaning of Article 5, Paragraph 1, Letter d of the GDPR has not been violated. D.7. Right to deletion D.7.1. General In terms of the proceedings, the complainant complained that his right to deletion in accordance with Article 17 GDPR had been violated. In terms of the proceedings, the complainant complained that his right to deletion in accordance with Article 17 of the GDPR had been violated. Pursuant to Article 17 GDPR, a data subject has the right to request that the person responsible immediately delete the personal data concerning him or her, provided that one of the conditions set out in paragraph 1 is met. According to Article 17, GDPR, a data subject has the right to request that the person responsible immediately delete the personal data concerning him or her, provided that one of the conditions listed in paragraph one is met. However, the right to deletion according to Art. 17 Para. 1 GDPR does not exist according to Art. 17 Para. 3 lit. a GDPR if the processing is necessary to exercise the right to freedom of expression and information. The purpose of this exception is to prevent the freedom of expression and the right to erasure pursuant to Article 17, paragraph one, GDPR, however, pursuant to Article 17, paragraph 3, letter a, GDPR, this does not apply to the extent that the processing is carried out to exercise the right freedom of expression and information is necessary. The purpose of this exception is to prevent freedom of expression and information, which form an essential basis of democracy, from being undermined by citing data protection (cf. , which form an essential foundation of democracy by citing data protection see Koreng/Feldmann ZG 2012, 311). The exception is not only limited to the area of journalism or “professional” media, but also includes expressions of opinion in the non-professional area, for example by (occasional) bloggers or on social media. There is no regulation that would give absolute priority to freedom of expression and information over the fundamental right to data protection and would not be compatible with the Charter of Fundamental Rights. The rights involved must therefore be weighed up against each other in terms of their respective importance and the respective degree of threat. The opening clause of Article 85 GDPR also provides for such a consideration for national legislators. An assessment of the legitimate interests of the respondent (as an information service provider) and third parties (the general public that uses the information service) must therefore be carried out within the meaning of Article 6 Paragraph 1 Letter f of the GDPR and these are consistent with the to weigh up the interests and possible consequences for the complainant that arise from the processing in question. is limited solely to the area of journalism or “professional” media, but also includes expressions of opinion in the non-professional area, for example by (occasional) bloggers or in social media. There is no regulation that would give absolute priority to freedom of expression and information over the fundamental right to data protection and would not be compatible with the Charter of Fundamental Rights. The rights involved must therefore be weighed up against each other in terms of their respective importance and the respective degree of threat. The opening clause of Article 85 of the GDPR also provides for such a consideration for national legislators. An assessment of the legitimate interests of the respondent (as an information service provider) and third parties (the general public who uses the information service) must therefore be carried out within the meaning of Article 6, paragraph one, letter f, GDPR and these are consistent with the to weigh up the interests and possible consequences for the complainant that arise from the processing in question. The balance must include, on the part of the person concerned, his fundamental rights to respect for private and family life and the protection of personal data, guaranteed by Articles 7 and 8 of the EU-GRC and Article 8 ECHR, and on the part of the person responsible or third parties, the fundamental right freedom of expression or freedom of information in accordance with Article 11 Para. 1 EU-GRC and Article 10 Para. ECHR guarantees fundamental rights to respect for private and family life and to protection of personal data and, on the part of the controller or third parties, the fundamental right to freedom of expression or information in accordance with Article 11, paragraph one, EU CFR and Article 10, paragraph one, ECHR. The European Court of Human Rights (ECHR) and subsequently the ECJ have developed a number of relevant criteria in their case law for the purpose of balancing the right to respect for private life and the right to freedom of expression (see, for example, the judgment of the ECHR dated February 7, 2012, 39954/08 [The European Court of Human Rights (ECHR) and subsequently the ECJ have in their case law a number of relevant criteria for the purpose of balancing the right to respect for private life and the right to freedom of expression developed compare, for example, the judgment of the ECHR of February 7, 2012, 39954/08 [Axel Springer gg Germany] or the judgment of the ECJ of February 14, 2019, C-345/17 [Buivids]). Accordingly, the following criteria must be taken into account in such a consideration: - The role of the data subject in public life and the public's interest in information; - the factual accuracy of the information published; - the purpose and context of publication; - the type of information concerned, in particular its sensitivity to the private life of the data subject, and the likelihood or actual occurrence of material or non-material damage as a result of the data processing; as well as - the time elapsed since the data was published. The weighting of these criteria must be carried out on a case-by-case basis and depends on the circumstances of each case. Therefore, the legitimate interests of the respondent and third parties (the general public, which reads the respondent's encyclopedia) on the one hand and the interests of the complainant on the other hand must be weighed up. The respondent's interest lies in operating an online encyclopedia that makes information services available to the general public. The interest of the general public is to use this information service, which is offered free of charge (cf. the DSB's decision of January 15, 2019, GZ: DSB-D123.527/0004-DSB/2018, according to which the information in Article 11 EU The right to freedom of expression and information is enshrined in the GRC. The respondent's interest lies in operating an online encyclopedia that makes information services available to the general public. The interest of the general public is to use this information service, which is offered free of charge, see the DSB's decision of January 15, 2019, GZ: DSB-D123.527/0004-DSB/2018, according to which this is enshrined in Article 11, EU-GRC Right to freedom of expression and freedom of information) is enshrined. On the other hand, it is the complainant's interest to have his data deleted from the respondent's website. The data protection authority notes that the complainant is a public figure who is known to a broad public. An indication of “publicity” is when information about a person's public role and activities can be found. In general, it can be said that a public figure is a natural person who is reported in the media due to their functions or their obligations (cf. The data protection authority notes that the complainant is a person of the public life, which is known to a broad public. An indication of “publicity” is when information about the public role and activities of a person can be found. In general, it can be said that a public figure is a natural person which are reported in the media due to their functions or their obligations (see Art 29 Data Protection Working Party, Guidelines for the implementation of the judgment of the Court of Justice of the European Union in case C-131/12, WP 225, p. 16) . The Federal Administrative Court has already stated that people who are reported on in the media due to their function/obligations are to be viewed as public figures (finding of May 20, 2021, GZ W214 2232956-1 mwN). The complainant is a filmmaker, director, cameraman and author (see point 1 of the findings). It is therefore undisputed that he meets the qualifications for a public figure. The complainant is a filmmaker, director, cameraman and author (see point 1 of the findings). It is therefore undisputed that he meets the qualifications for a public figure. As already under D.6. Based on the legal assessment, this is not data that can be qualified as false, untrue, inaccurate or falsifying. All information about the complainant published on the respondent's website is available to everyone online on various other Internet websites, including that of the complainant himself. The Austrian broadcaster also reports on the complainant (see point 7 of the findings). All information about the complainant published on the respondent's website is available to everyone online on various other internet websites, including that of the complainant himself. The Austrian broadcaster also reports on the complainant (see point 7 of the findings). The intensity of the intervention can be classified as low due to the nature and disclosure of the relevant information from the complainant by the respondent. D.7.2. Result Against the background of all these considerations, the data protection authority comes to the conclusion that the legitimate interests of the general public in accordance with Article 11 EU-GRC in access to information outweigh the stated impairments of the complainant's legitimate interests. Against the background of all these considerations, the data protection authority comes to this Result that the legitimate interests of the general public in accordance with Article 11, EU-GRC in access to information outweigh the stated impairments of the complainant's legitimate interests. The facts of Article 17, Paragraph 3, Letter a of the GDPR are therefore fulfilled, which is why the respondent rightly did not comply with the complainant's request rightly did not comply with the complainant's request. Accordingly, there is no violation of the right to deletion, which is why the decision had to be made in accordance with the verdict.
