VwGH - Ro 2021/04/0010-11: Difference between revisions

From GDPRhub
(edit massi feedback)
mNo edit summary
 
(2 intermediate revisions by one other user not shown)
Line 1: Line 1:
{{DISPLAYTITLE:VwGH - Ro 2021/04/0010-11}}
{{COURTdecisionBOX
{{COURTdecisionBOX


Line 62: Line 61:
|Party_Link_4=
|Party_Link_4=


|Appeal_From_Body=BVwG
|Appeal_From_Body=BVwG (Austria)
|Appeal_From_Case_Number_Name=W256 2235360-1
|Appeal_From_Case_Number_Name=W256 2235360-1
|Appeal_From_Status=
|Appeal_From_Status=
Line 75: Line 74:
}}
}}


The Supreme Administrative Court held that an algorithm determining the likelihood of job applicants to be hired is automated decision making under Article 22 GDPR, even if the result is used exclusively by a public body to provide job seekers with targeted employment counseling
The Supreme Administrative Court held that an algorithm determining the likelihood of job applicants to be hired is automated decision making under Article 22 GDPR, even if the result is used exclusively by a public body to provide job seekers with targeted employment counseling.


== English Summary ==
== English Summary ==

Latest revision as of 14:50, 27 March 2024

VwGH - Ro 2021/04/0010-11
Courts logo1.png
Court: VwGH (Austria)
Jurisdiction: Austria
Relevant Law: Article 4(4) GDPR
Article 9(2)(g) GDPR
Article 22 GDPR
Article 1 §2 DSG
§25(1) AMSG
§38(c) AMSG
Decided: 21.12.2023
Published: 20.02.2024
Parties: Austrian Data Protection Authority
Public Employment Service Austria
National Case Number/Name: Ro 2021/04/0010-11
European Case Law Identifier: ECLI:AT:VWGH:2023:RO2021040010.J09
Appeal from: BVwG (Austria)
W256 2235360-1
Appeal to: Unknown
Original Language(s): German
Original Source: VwGH (in German)
Initial Contributor: ec

The Supreme Administrative Court held that an algorithm determining the likelihood of job applicants to be hired is automated decision making under Article 22 GDPR, even if the result is used exclusively by a public body to provide job seekers with targeted employment counseling.

English Summary

Facts

The controller, the Public Employment Service in Austria, supports workers in (re)integrating into the labour market by offering various services, including a counsellor that discusses labour market opportunities with the jobseeker.

In order to assess the jobseeker’s labour opportunities on the market, the controller used an algorithm to calculate the degree of probability for jobseekers to be employed for a certain number of days, based on: (1) age group, (2) gender, (3) country group, (4) education, (5) health impairment, (6) care responsibilities, (7) occupational group, (8) career history and (9) the regional labour market situation and the duration of cases at the controller. The algorithm did not include motivation, self-help potential of the jobseeker, addiction, debt or housing situation. Based on this, the algorithm divided jobseekers into the following three groups:

(1) Service jobseekers with high labour market opportunities,

(2) Care jobseekers with low labour market opportunities,

(3) Consultancy jobseekers with medium labour market opportunities.

The result was used as a starting point for counsellors to work with jobseekers to assess their potential and any obstacles in the labour market integration. The algorithm itself was not used for job placement, but only for targeted support and assistance, meaning, choosing the right support strategy based on which group the jobseeker was assigned to.

The controller claimed it had a legal basis under Austrian national law (the Arbeitsmarktservicegezetz, AMSG) to process data with the help of an algorithm. Under Article 4(4) GDPR, this processing of data is considered profiling. According to Austrian data protection law (see Article 1 §2 DSG), processing for the performance of a public task needs to be authorised in Asutrian law. However, the DPA found that a legal basis for this processing could not be found in the AMSG. The DPA also held that the case at issue was a case of automated individual decision-making under Article 22 GDPR. Although the results of the algorithm were not binding, as the final decision lies with the counsellor, the DPA noted that it could be ruled out that in individual cases, the decision will be based exclusively on profiling.

Therefore, the Austrian Data Protection Authority (DSB) issued a ban due to lack of a sufficient legal basis for the processing.

The controller appealed this decision at the Federal Administrative Court (Bundesverwaltungsgerichts, BVwG).

The Federal Administrative Court upheld the controller’s appeal against the decision of the DPA. The Court held that the controller is allowed to carry out this processing of personal data in accordance with national law (  §25(1) AMSG ) and therefore has a legal basis. Moreover, Article 22 GDPR does not apply, as the final decision lies with the counsellors and therefore the decision-making is not based solely on automated processing. However, the Court held that the controller should provide counsellors with instructions and training to ensure they do not accept the result of the algorithm unquestioningly. The Court concluded that the DPA decision should be annulled due to the lack of violation of the principle of lawful data processing under Article 5(1)(a) GDPR.

The DPA appealed the decision before the Supreme Administrative Court (Verwaltungsgerichtshof, VwGH). The DPA argued that the Federal Administrative Court did not take into account the character of profiling as a special processing procedure and challenged the lawfulness of the processing under Article 22 GDPR.

Holding

The Supreme Administrative Court found that the lawfulness of the data processing at issue in the proceeding must be examined against the background of Article 22 GDPR.

The Court found that the controller’s algorithmic process in itself is an automated decision under Article 22(1) GDPR, based on the recent CJEU decision C-634/21 - Schufa. The Court explained that the algorithm decided on the allocation of jobseeker’s group and thus has a legal effect on the jobseekers concerned or similarly significantly affects them. The fact that the final decision on the jobseeker’s group assignment lies with the counsellor, does not prevent the algorithm from being classified as an automated decision under Article 22(1) GDPR. The Supreme Administrative Court found that the instructions and trainings that were provided to ensure counsellors would not accept the algorithm’s results unquestioningly could not exclude the possibility that the algorithm is ultimately decisive for the allocation.

The Court further held that the algorithm did not fall under the exceptions of Article 22(2) GDPR. Therefore, the Court concluded that the appeal had to be upheld and that the decision of the Federal Administrative Court needed to be set aside, de facto confirming the violations identified by the DPA.

Comment

In paragraph 15 and 20 of the decision, the Supreme Administrative Court refers to Article 9(2)(d) GDPR, which is incorrect. It should be Article 9(2)(g) GDPR, which is about the substantial public interest.

Moreover, it seems that the Supreme Administrative Court interprets Article 22(1) GDPR very broadly. The Court does not substantiate how the algorithm produces legal effects for the data subject or similarly significantly affects the data subject. It merely states it does in paragraph 79 of the decision. This is interesting, because it does state that the algorithm cannot be used for a job placement itself, but only for choosing the right support strategy for the jobseeker. Moreover, according to paragraph 7 of the decision, the jobseeker can have a different assessment of the labour market opportunities than the counsellor, which will be then be documented in the support agreement that is made between the counsellor and jobseeker.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Ro 2021/04/0010-11
                                                                 December 21, 2023






        I M N A M E N D E R R E P U B L I K!

        The Administrative Court has through the presiding Senate President

        Dr. Kleiser, Councilor Dr. Mayr, court councilor Mag. Hainz-Sator and the court councilors

        Dr. Pürgy and Mag. Brandl as judges, with the participation of the secretary
        Mag. Vonier, about the data protection authority's appeal against the finding

        of the Federal Administrative Court of December 18, 2020,
        Zl. W256 2235360-1/5E, concerning a data protection matter

        (Participating party: Employment Service, represented by Brauneis Klauser
        Prändl Rechtsanwälte GmbH in 1010 Vienna, Bauernmarkt 2;

        other party: Federal Minister of Justice), rightly recognized:

        The contested finding is due to illegality of the content

        lifted.

        Reasons for the decision:


1 1. The contested finding is based on the following undisputed facts
        remove:

2 The co-participating party (hereinafter: mP), in the proceedings before the

        Administrative Court regularly referred to as the “Austrian Labor Market Service”

        referred to, is responsible according to Section 1 Paragraph 1 of the Employment Services Act (AMSG).
        Implementation of the federal labor market policy” and it is referred to as “a

        Service companies under public law with their own
        Legal personality” is defined.


3 To help workers (re)integrate into the labor market
        To support this, the mP offers various services. The

        The detailed procedure of the consultants employed for this purpose can be found in the
        “Federal Guideline” of the Labor Market Service “Core Process Workers

        support”. This states that consultants in the process
        a consultation with job seekers

        Wishes/expectations, their previous life course and the reasons for their

        have to explain unemployment. The labor market opportunities of
        Job seekers should be addressed and discussed.




        Administrative Court
        Judenplatz 11, 1010 Vienna
        www.vwgh.gv.at Ro 2021/04/0010-11
                                                                 December 21, 2023

                                                                 2 of 53




4 To help the consultants assess the labor market opportunities of the

        The mP has been developing a concept to support job seekers since 2016
        for calculating labor market opportunities

        Labor Market Opportunities Assistance System (AMAS). This model should be from

        mP consultants will be mandatory from January 1, 2021.

5 This statistical model uses an algorithm to determine the degree of

        Probability for job seekers automatically calculated,
        a certain number within a certain period of time in the future

        to be busy for days. Specifically, this is based on the following
        Data an “IC” is calculated:

        age group,

        Gender,

        group of states,

        Education,
        health impairment,

        care obligations,

        professional group,

        pre-career,
        regional labor market events as well

        Duration of the business case at mP.

6 Based on the “IC”, job seekers are divided into the following

        three groups:

        Service customers with job market opportunities are high
        Care customers with labor market prospects low

        Advice clients with medium labor market prospects.

7 The results of the AMAS should be used in the consultation process and for

        The consultants can be a starting point to work together with the customers
        Assessment of the respective potential and, if necessary, the obstacles

        of labor market integration. Based on these

        The aim is to define the optimal care strategy. Has he



        Administrative Court

        Judenplatz 11, 1010 Vienna
        www.vwgh.gv.at Ro 2021/04/0010-11
                                                                 December 21, 2023

                                                                 3 out of 53




         Job seekers expressly have a different assessment of the

         Labor market opportunities than the consultants, this is in the
         Document care agreement.


 8 AMAS does not take into account criteria such as motivation, self-help potential
         Customers, addiction, debts, housing situation, etc.


 9 2. After the initiation of an ex officio examination procedure in accordance with
         Art. 57 Para. 1 lit. h in conjunction with Art. 58 Para. 1 lit. b and Para. 2 lit. a GDPR in conjunction with

         Section 22 Paragraph 1 DSG was notified to the mP by the appeal applicant

         from August 16, 2020 data processing in connection with
         Determination of labor market opportunities for job seekers

         With the help of the Labor Market Opportunities Assistance System (AMAS).
         Effective January 1, 2021, “unless there are any by this point in time.”

         there is a suitable legal basis for data processing.”

10 In summary, the appellant gave reasons in her decision

         that data processing takes place with the help of AMAS
         Within the framework of the exercise of the rights transferred to the mP in accordance with Section 1 Paragraph 1 AMSG

         public tasks. For an authority it is in accordance with Section 1 Paragraph 2 DSG

         it is necessary that their data processing is sufficient
         determined legal authorization. The § 29 mentioned by the mP

         and Section 31 Paragraph 5 AMSG would only generally describe the goal and the
         Specify the fulfillment of tasks by the mP, but not for data processing

         authorize. The data processing in question is the issue
         This is a profiling within the meaning of Art. 4 Z 4 GDPR, through which a

         “informational added value” comes about, which is stated in the law

         must be expressly referred to. The present
         Data processing cannot be based on a suitable legal basis

         support. In addition, there is a case of Art. 22 GDPR, namely an automated one
         individual decision. It should be admitted that the final decision

         due to internal guidelines lies with the mP consultants. This

         However, internal instructions for action would not bind the mP
         unfold and are therefore not subject to any verification controls. In addition




         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                 December 21, 2023

                                                                 4 out of 53




         It cannot be ruled out that in individual cases the decision will be made exclusively

         based on profiling.

11 3. The Federal Administrative Court issued the contested finding

         (BVwG) of the mP's complaint against the appeal applicant's decision

         Followed and repealed the contested decision without replacement. The audit explained it
         below one for permissible.


12 In addition to the findings already presented at the beginning, the BVwG made in
         his reasons also include the findings that only after the

         Discussing the optimal support strategy with customers

         would be defined by the consultants based on a supervision agreement.
         To ensure that the consultants do not have the result of the algorithm

         would take over without question, have the mP in addition to those shown
         Guidelines also provide appropriate instructions for action

         Training conducted.

13 In its legal assessment, the BVwG stated in an ex officio manner

         The appellant is responsible for the examination proceedings initiated

         Supervisory authority in the event of a violation of the GDPR being detected
         the power to order various remedial measures. Matter

         The complaint procedure before the BVwG can only be examined
         Legality of the specific order made in connection with

         the violation on which the supervisory authority is based. In the

         In the present case, it can be assumed that the appellant is
         Prohibition issued by official notice solely because of the lack of one

         sufficient legal basis for official action.
         A legality assessed in the contested decision

         The BVwG is prohibited from further checking data processing.

14 Art. 9 Paragraph 2 Letter h GDPR refers, according to its wording, to one

         Data processing for health-related purposes. In the present case be

         this provision cannot therefore be relied upon without further ado.

15 It follows from Art. 6 Para. 1 lit. e GDPR and Art. 9 Para. 2 lit. d GDPR that

         the processing of personal data can be lawful if


         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023
                                                                  5 out of 53





         the processing for a sovereign or other public interest
         underlying task or in the case of processing special categories

         personal data due to significant public interest

         was required. In this context it is according to the provisions of
         GDPR is irrelevant whether the person responsible is an authority or

         a private body and in which - sovereign or
         private sector - form the controller may take action if necessary.

         What is more important is whether a matter is public
         or significant public interest is required and a legal requirement

         regulated data processing is carried out. Art. 6 Paragraph 3 GDPR
         specifies content requirements for an appropriate legal basis,

         which are clear and precise in the context of recital 41 of the GDPR
         and should be predictable for those subject to the law. Related

         Art. 9 Para. 2 lit. g GDPR also stipulates that the corresponding
         Legal basis appropriate and specific measures to safeguard the

         should provide for the fundamental rights and interests of the persons concerned. Nothing

         otherwise see § 1 Para. 2 DSG, Federal Law Gazette I No. 165/1999 as amended by Federal Law Gazette I No. 14/2019,
         provided that the data processing is carried out by the state authorities. The

         Union law provisions - Art. 6 and Art. 9 GDPR - would generally
         a task in the considerable public interest and - accordingly

         not limited to sovereign activities - one is sufficient
         Demand a specific legal basis for data processing. It

         It can therefore remain open in the present case whether the mP
         procedural data processing in sovereign or

         in a private law form. Rather, it comes because of the
         data processing that is the subject of the procedure also includes health data and

         thus special categories of data within the meaning of Art. 9 Para. 1 GDPR
         are included, depends on whether the data processing that is the subject of the procedure

         on an appropriate legal basis and for a task by the MP

         is necessary in the significant public interest.

16 The mP is a service company under public law with its own
         Legal personality, which is responsible for the implementation of the labor market policy of the

         federal responsibility. According to Section 29 Paragraph 1 AMSG, the mP has a



         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                 December 21, 2023

                                                                 6 out of 53




         as complete, economically sensible and sustainable as possible

         Bringing together labor supply and labor demand
         to work towards supplying the economy with workers and the

         Employment of all people available on the labor market
         to secure it as best as possible. The mP is held in accordance with Section 29 Paragraph 2 AMSG

         efficient placement of suitable workers
         To create jobs that, as far as possible, correspond to the placement wishes

         provide the job seeker with appropriate employment and the

         Effect of circumstances that have a direct mediation in this
         to help overcome the senses. The principles are:

         Economy, economy and practicality must be taken into account and it is
         It is also important to ensure that groups of people who are particularly affected by

         If people are threatened with unemployment, appropriate support services are offered
         would.


17 Section 25 Paragraph 2 AMSG expressly authorizes the mP to do so
         Processing of those involved in the proceedings

         personal data, provided this is necessary to fulfill legal requirements
         Task is an essential prerequisite. That of the mP is therefore legal

         The task of ensuring an orderly system assigned by Section 29 AMSG

         and well-functioning labor market is undoubtedly a significant one
         public interest within the meaning of Art. 9 Para. 2 lit. g GDPR.

18 In addition, it is undisputed that it is also necessary to take into account personal characteristics

         of job seekers in combination with the general

         Labor market events and the resulting application opportunities
         of job seekers on the labor market to take into account the

         The task of optimally supplying the economy with workers and the
         To secure employment for job seekers in the best possible way

         can. The relevance of the procedural subject matter in data processing
         The personal data included cannot be disputed

         become. There are therefore no concerns that the MP should be used to “ensure

         “Ordinary labor market policy” is the subject matter of the proceedings
         may use personal data to ensure a “proper




         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                 December 21, 2023

                                                                 7 out of 53




         to secure labor market policy”. § 25 Para. 10 AMSG meets before the

         Background to the requirements of the GDPR and the DSG
         Related comprehensive appropriate technical and

         organizational measures to ensure compliance with the principles of

         GDPR and processing in accordance with the DSG. About the of
         In addition to the measures mentioned in recital 78, see Section 25 (10) AMSG

         additional specific requirements to ensure the
         Data security.


19 The fundamental right of the mP to evaluate the
         Labor market opportunities for job seekers based on certain personal characteristics

         The appellant does not doubt that data should be provided
         pulled. An “informational” accepted by the appeal applicant

         Added value” of one based on the same personal data

         Assessment of labor market opportunities can - whether the assessment is not
         automated or based on profiling - for data protection reasons

         View cannot be recognized because each evaluation is also weighted
         the evaluator is based on.


20 In addition, a different assessment could affect the legality of a
         Data processing relating to Article 6 Paragraph 1 Letter e or Article 9

         Paragraph 2 lit. d GDPR cannot be derived because these provisions do not

         distinguish between automated and non-automated processing
         would only focus on the concept of processing in general

         would. Art. 4 Z 1 GDPR in turn defines using an example
         List the processes there in connection with personal data

         Data as processing, regardless of whether this is done with or without help
         automated procedures are carried out. That Art. 4 Z 4 GDPR

         I exclusively refer to automated processing separately as profiling,

         highlight this significant use case and make it clear that these
         Form of processing falls within the scope of application of the GDPR and the

         must meet the general criteria there.

21 Art. 22 GDPR in turn states that a data subject has the right

         should have no decision to evaluate aspects that concern them


         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                         December 21, 2023
                                                         8 out of 53





to be subjected exclusively to an automated
Processing would be based and legal effect for the data subject

develop or significantly impair them in a similar way. Art. 22 GDPR

I therefore only aim at decisions that are devoid of any human touch
intervention would take place. However, this provision limits profiling

not as such in its legal admissibility as part of a
Decision support. As stated, they should

algorithm used in the procedure and those calculated from it
Labor market opportunities merely as a source of information for a decision

of the mP consultants can be used. The final decision
about the job seekers' labor market opportunities should be with the consultants

remain. In this regard, internal guidelines and guidelines would be issued by the mP
Instructions for action exist and training courses are carried out. The according to § 4

Paragraph 2 Z 2 AMSG guidelines are for the fulfillment of the tasks
the mP is binding for all bodies and institutions. In the federal guidelines

“Supporting the workforce as a core process” is the exact process in relation to

the assessment of labor market opportunities is specified and explicit
stipulated that the mP consultants would use the calculated labor market opportunities

to be discussed with the person concerned during a consultation
would have to document a contrary view of the person concerned and

ultimately have to decide about it. Given these clear guidelines
There would be no reasons for this to be a completely automated decision

within the meaning of Art. 22 GDPR. With the argument of
Appellant, it was not due to the shortened consultation times

to rule out that ultimately a completely automated decision
would be available because the mP consultants calculated it from AMAS

would routinely adopt this value, overlooking the fact that the assessment,
whether data processing is lawful in accordance with Art. 5 Para. 1 lit. a GDPR

is, from the assessment of whether the person responsible is the legality of a

to ensure such data processing. At the
Assessment of the lawfulness of data processing is based on the actual

Processing process and possible violations by third parties do not apply
enter into. Whether the MP ultimately fulfills its obligation in accordance with Article 5




Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                                 December 21, 2023

                                                                 9 out of 53




         Paragraph 1 lit. f GDPR adequately and unauthorized use

         excludes the data processing in question
         The subject of the complaint procedure at issue. Ultimately

         In this context, it should be noted that the applicant for appeal in

         contested decision itself assumes that the mP
         Appropriate measures “internal to the organization” to protect the

         Job seekers hit and thus an abusive use
         data processing by their employees is appropriately excluded

         have.

22 In summary, it should be noted that the mP according to Section 25 Paragraph 1 AMSG

         is fundamentally entitled to evaluate personal data
         to be carried out. That from the mere use of an automated

         Processing does not result in “informational added value”.

         to accept. The case frowned upon in Article 22 of the GDPR is just on one
         The decision based on automated data processing does not lie here

         because - as shown - the final decision lies with the consultants.
         Whether the mP fulfills its obligation under the GDPR to prevent an unauthorized person

         Excluding use by taking appropriate measures is sufficient

         has complied with is not the subject of the assessment of the
         Legality of limited present proceedings. Since the present one

         Data processing can therefore rightly be based on Section 25 Paragraph 1 AMSG
         can, the contested decision is due to a lack of violation of the provisions of Article 5

         Paragraph 1 lit. a GDPR standardized principle of a lawful
         to cancel data processing.


23 The appeal is admissible because (among other things) it comes to the highest court
         Case law on Articles 6, 9 and 22 GDPR in connection with profiling

         missing.

24 4. The ordinary appeal of the defendant is directed against this decision

         authority before the administrative court.

25 The mP filed a complaint in the preliminary proceedings before the BVwG

         Revision response.



         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023

                                                                  10 out of 53




         5. The Administrative Court considered:


26 The revision refers to the statements of the BVwG regarding
         Admissibility of the appeal and that the highest court case law

         on the requirement of certainty of legal regulations against the background of
         GDPR and the question of the interpretation of the criterion of “similar

         “significant impairments” within the meaning of Article 22 GDPR are missing.

27 For these reasons, the appeal is admissible and ultimately justified.


28 5.1. The legal basis:

29 5.1.1. The case-specific relevant recitals and provisions of the

         Regulation (EU) 2016/679 of the European Parliament and of the Council of
         April 27, 2016 on the protection of natural persons during processing

         personal data, the free movement of data and the abolition of the
         Directive 95/46/EC (General Data Protection Regulation - GDPR), OJ L 119

         dated May 4, 2016, p. 1, are as follows:

         “(10) In order to ensure a uniform and high level of data protection for natural persons
         to ensure people and the barriers to traffic
         to eliminate personal data in the Union, the level of protection should be increased

         for the rights and freedoms of natural persons during processing
         this data must be equivalent in all Member States. The regulations for
         Protection of the fundamental rights and freedoms of natural persons
         Processing of personal data should be uniform and uniform across the Union

         be applied uniformly. Regarding processing
         personal data to fulfill a legal obligation or
         to carry out a task that is in the public interest or in
         The exercise of public authority is carried out and is transferred to the person responsible
         Member States should have the possibility to adopt national ones

         Provisions ensuring the application of the provisions of this Regulation
         to be maintained or introduced in more detail. Combined with
         the general and horizontal legislation on data protection
         There are several implementations of Directive 95/46/EC in the Member States
         sector-specific legislation in areas that are more specific

         regulations require. This regulation also offers Member States
         a scope for the specification of their regulations, including for the
         Processing of special categories of personal data (in
         “Sensitive Data” below). This regulation is not exclusive in this regard

         Legislation of Member States where the circumstances are particular


         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                        December 21, 2023

                                                        11 of 53




Processing situations can be determined, including a more precise one

Determination of the conditions under which the processing
personal data is lawful.
(...)

(40) For the processing to be lawful, personal data must
with the consent of the data subject or otherwise permitted
The legal basis for processing is this regulation

or - whenever referred to in this Regulation
other Union law or the law of the Member States, as follows
other things on the basis that they comply with legal requirements
Obligation to which the controller is subject or to fulfill one
Contract to which the data subject is a party, or for which
Implementation of pre-contractual measures at the request of those affected

person is required.
(41) If this Regulation refers to a legal basis or a
Legislative measure referred to does not require this

necessarily one adopted by a parliament
legislative act; Requirements in accordance with the remain unaffected
Constitutional system of the Member State concerned. The corresponding
However, the legal basis or legislative measure should be clear and precise
and their application should be for those subject to the law in accordance with
Case law of the Court of Justice of the European Union (hereinafter

‘Court of Justice’) and the European Court of Human Rights
be predictable.
(...)

(45) If the processing is carried out by the person responsible on the basis of a request to him
applicable legal obligation or is the processing for
Carrying out a task in the public interest or in exercise

If public authority is required, there must be a basis for this in Union law
or exist in the law of a Member State. This regulation will not
a specific law requires each individual processing. A law as
Basis for multiple processing operations may be sufficient if
the processing is based on a legal obligation incumbent on the person responsible
Obligation takes place or if the processing is carried out for the purpose of carrying out an obligation
Task in the public interest or in the exercise of official authority

is required. The same should be done in Union law or in the law of the
Member States regulate the purposes for which the data is processed
may be. Furthermore, the general conditions could be included in this law
this regulation regulating the lawfulness of processing
personal data would be clarified and it could specify how
the person responsible must determine what type of personal data




Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                         December 21, 2023

                                                         12 of 53




Data is processed, which people are affected, which ones

Institutions disclose the personal data and for what purposes
and how long they may be stored and what other measures
be taken to ensure that the processing is lawful and
carried out in good faith. The same should be done in Union law or in
The law of the Member States determines whether this is the case
Responsible person who carries out a task that is in the public interest

lies or takes place in the exercise of official authority, to an authority or to
another natural or legal entity covered by public law
Person or, if this is justified by the public interest including
health purposes, such as public health or social
security or the administration of health care services,
is justified, a natural or legal person under private law, such as

for example a professional association, should act.
(...)

(71) The data subject should have the right not to decide what
a measure may include - to evaluate what affects it
to be subjected to personal aspects that are exclusively based on one
is based on automated processing and the legal effect for that

the person concerned develops or significantly affects them in a similar way,
such as the automatic rejection of an online loan application or
Online recruitment process without any human intervention. To a
Such processing also includes 'profiling' in any form
automated processing of personal data under assessment of the
personal aspects exist in relation to a natural person, in particular
to analyze or predict aspects related to work performance,

economic situation, health, personal preferences or interests,
Reliability or behavior, whereabouts or change of location
data subject, insofar as this has legal effect for the data subject
unfolds or significantly affects them in a similar way. One on one
such processing, including profiling
However, decision-making should be allowed if this is according to the

Union law or the law of the Member States responsible for the processing
Controller is subject to, is expressly permitted, also in accordance with
the regulations, standards and recommendations of the institutions
[European] Union or national supervisory bodies fraud and
to monitor and prevent tax evasion and security and
Reliability of a service provided by the person responsible

guarantee, or if this is necessary for the conclusion or fulfillment of a
Contract between the data subject and a controller
is necessary or if the data subject expressly expresses their consent
has given consent to this. In any case, such processing should




Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                        December 21, 2023
                                                        13 out of 53





be accompanied by appropriate guarantees, including specific ones
Informing the person concerned and the right to direct action
Intervention by a person to present their own point of view
Explanation of the decisions taken after an appropriate assessment
decision and the right to challenge the decision. This
Measure should not affect any child. In order to take into account the

special circumstances and framework conditions under which the
personal data processed is that of the data subject
To ensure fair and transparent processing, the
suitable mathematical or statistical data controllers
Use procedures for profiling, technical and organizational

Take measures to ensure appropriate security in particular
that factors that lead to inaccurate personal data
be corrected and the risk of errors is minimized, and
secure personal data in such a way that the potential
Threats to the interests and rights of the data subject
is worn and, among other things, prevent it from becoming natural

people based on race, ethnic origin, political opinion,
Religion or belief, trade union membership, genetic
Dispositions or health status as well as sexual orientation
discriminatory effects or processing that occurs
has such an effect. Automated decision making and profiling

on the basis of special categories of personal data
only be allowed under certain conditions.
(...)

Article 4

Definitions
(1) For the purposes of this Regulation, the term means:

(...)

4. 'Profiling' any type of automated processing of personal data
    Data that consists of using personal data
    be to certain personal aspects that relate to a natural
    person, to evaluate, especially aspects relating to

    work performance, economic situation, health, personal preferences,
    Interests, reliability, behavior, location or change of location
    to analyze or predict that natural person;

(...)







Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                         December 21, 2023
                                                         14 out of 53





Article 5
Principles for processing personal data

(1) Personal data must

a) in a lawful manner, in good faith and in a manner for which
    data subject are processed in a comprehensible manner
    (“Legality, fair processing, transparency”);

(...)
c) appropriate and relevant to the purpose and relevant to the purposes of the

    Processing must be limited to the extent necessary ('data minimization');
(...)

Article 6

Lawfulness of processing
(1) Processing is only lawful if at least one of the

the following conditions are met:
(...)

c) the processing is to fulfill a legal obligation
    required to which the controller is subject;

(...)
e) the processing is necessary for the performance of a task that

    is in the public interest or in the exercise of official authority
    carried out, which was transferred to the person responsible;

(...)
(2) Member States may provide more specific adaptation provisions
the application of the provisions of this Regulation in relation to

Processing to comply with paragraph 1 letters c and e maintained or
introduce specific requirements for processing as well
determine other measures more precisely in order to ensure a lawful and faithful action
and to ensure processing carried out in faith, including for
other special processing situations in accordance with Chapter IX.

(3) The legal basis for the processing pursuant to paragraph 1 letter c
and e is determined by

a) Union law or

b) the law of the Member States to which the controller is subject.
The purpose of the processing must be specified in this legal basis or
with regard to the processing referred to in paragraph 1 letter e for fulfillment




Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                       December 21, 2023

                                                       15 out of 53




be necessary for a task that is in the public interest or in

The exercise of public authority is carried out and is transferred to the person responsible
became. This legal basis may contain specific provisions for adaptation
the application of the provisions of this Regulation, among others
Provisions on what general conditions govern the
The lawfulness of the processing by the controller applies
Types of data processed determine which individuals are affected

which facilities and for what purposes the personal data
may be disclosed, what purpose they are subject to and for how long
they may be stored and which processing operations
and procedures may be applied, including measures to
Ensuring that the service is carried out lawfully and in good faith
Processing, such as those for other special processing situations

according to Chapter IX. Union law or the law of the Member States must
pursue a goal that is in the public interest and in one
be proportionate to the legitimate purpose pursued.

(4) If the processing is based on a purpose other than that of
which the personal data was collected, not on the consent
the data subject or on a law of the Union or the
Member States that have a necessary and
proportionate measure to protect the persons referred to in Article 23(1).
represents goals, the person responsible takes them into account - to determine whether the

Processing for a purpose other than that for which the
personal data was originally collected is compatible - under
other
a) any connection between the purposes for which the personal data

    Data was collected and the purposes intended
    further processing,
b) the context in which the personal data was collected

    were, particularly with regard to the relationship between the
    affected persons and the person responsible,
c) the type of personal data, in particular whether special

    Categories of personal data are processed in accordance with Article 9
    or whether personal data about criminal convictions and
    offenses are processed in accordance with Article 10,

d) the possible consequences of the intended further processing for the
    affected persons,
e) the existence of appropriate guarantees, including encryption or

    Pseudonymization can include.
(...)




Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                         December 21, 2023
                                                         16 of 53





Article 9
Processing of special categories of personal data

(1) The processing of personal data from which the racial and
ethnic origin, political opinions, religious or ideological
beliefs or union membership, as well as the
Processing of genetic data, biometric data for unique purposes

Identification of a natural person, health data or data on
sex life or sexual orientation of a natural person
prohibited.

(2) Paragraph 1 does not apply in the following cases:
(...)

g) the processing is based on Union law or law
    of a Member State that is proportionate to the one being prosecuted
    The aim is to preserve the essence of the right to data protection and

    appropriate and specific measures to safeguard fundamental rights
    and interests of the data subject, for reasons of one
    significant public interest required,

h) the processing is for health care purposes or
    Occupational medicine, for assessing the employee's ability to work,
    for medical diagnostics, care or treatment in
    Health or social sector or for the administration of systems
    and health or social services based on the

    Union law or the law of a Member State or based on one
    Contract with a healthcare professional and
    subject to the conditions and guarantees set out in paragraph 3
    necessary,

(...)

(3) The personal data mentioned in paragraph 1 may be included in
Paragraph 2 letter h are processed if these

Data is processed by or under the responsibility of specialist personnel
and these professionals in accordance with Union law or the law of a
Member State or the regulations of national competent bodies
is subject to professional secrecy, or if the processing is carried out by another party
Person who is also under Union law or the law of a
Member State or the regulations of national competent bodies

subject to confidentiality.







Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                         December 21, 2023
                                                         17 of 53





(4) Member States may impose additional conditions, including
introduce or maintain restrictions insofar as the processing of
genetic, biometric or health data is affected.

(...)
Article 22

Automated decisions in individual cases including profiling

(1) The data subject has the right not to rely solely on one
automated processing - including profiling
to be subjected to the decision, which has legal effect on it
unfolds or significantly affects them in a similar way.

(2) Paragraph 1 does not apply if the decision

a) for the conclusion or fulfillment of a contract between the
    the person concerned and the person responsible is required to

b) under Union or Member State law,
    which the person responsible is subject to, is permissible and this
    Legislation appropriate measures to safeguard rights and
    freedoms and the legitimate interests of the data subject
    contain or

c) takes place with the express consent of the data subject.

(3) In the cases mentioned in paragraph 2 letters a and c
Responsible for taking appropriate measures to protect rights and freedoms
as well as to protect the legitimate interests of the data subject, for what purpose
at least the right to obtain human intervention on the part of the
those responsible, to present their own point of view and to contest it

belongs to the decision.
(4) Decisions under paragraph 2 may not be based on special categories
personal data pursuant to Article 9 paragraph 1, unless

Article 9(2)(a) or (g) applies and appropriate measures to be taken
Protection of the rights and freedoms as well as the legitimate interests of the
affected person.”














Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023

                                                                  18 of 53




30 5.1.2. § 1 of the Federal Act for the Protection of Natural Persons

         Processing of personal data (Data Protection Act - DSG),
         Federal Law Gazette I No. 165/1999 as amended by Federal Law Gazette I No. 51/2012 reads in part:

         “Article 1 (constitutional provision)

         Basic right to data protection

         § 1. (1) Everyone has, especially with regard to respect for their own
         Private and family life, right to secrecy of those concerning him
         personal data to the extent that there is a legitimate interest in doing so.
         The existence of such an interest is excluded if data as a result
         their general availability or because of their lack of traceability

         are not accessible to those affected by a claim of confidentiality.
         (2) To the extent that the use of personal data is not permitted

         vital interest of the person concerned or with his consent,
         are restrictions on the right to confidentiality only for reasons of protection
         overriding legitimate interests of another are permissible, namely at
         Intervention by a state authority only on the basis of laws arising from the
         in Article 8 paragraph 2 of the European Convention for the Protection of the

         Human rights and fundamental freedoms (ECHR), Federal Law Gazette No. 210/1958,
         reasons mentioned are necessary. Such laws permit the use
         of data that is particularly worthy of protection due to its nature, only for preservation purposes
         important public interests and must be provided for at the same time
         appropriate guarantees to protect the confidentiality interests of the

         Determine those affected. Even in the case of permissible restrictions, the
         Interference with fundamental rights only in the slightest way that achieves the desired result
         type.

         (...)"

31 5.1.3. The relevant provisions of the Federal Law on
         Labor Market Service (Labor Market Service Act - AMSG),

         Federal Law Gazette No. 313/1994, namely § 1, § 25 and § 27 as amended by Federal Law Gazette I No. 32/2018,
         § 29 as amended by Federal Law Gazette I No. 3/2013, § 31 as amended by Federal Law Gazette I No. 90/2009, § 32 as amended

         Federal Law Gazette I No. 71/2005 and § 38c as amended by Federal Law Gazette I No. 77/2004 read in extracts:












         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                        December 21, 2023

                                                        19 of 53




“Labor market service

§ 1. (1) The implementation of the federal labor market policy is the responsibility of the
'Labour market service'. The employment service is one
Service companies under public law with their own

Legal personality.
(...)

Data processing

§ 25. (1) The employment service, the Federal Administrative Court and the
Federal Ministry of Labor, Social Affairs, Health and Consumer Protection
are for the processing of personal data within the meaning of
Data Protection Act, Federal Law Gazette I No. 165/1999, insofar as this is authorized
Fulfillment of legal tasks is an essential prerequisite. The
The types of data in question are:

(...)

(2) The labor market service or the Federal Ministry of Labor,
Social, health and consumer protection data processed in accordance with
Paragraph 1, with the exception of health data in accordance with Paragraph 1 Item 4, may
other authorities, courts, social security institutions and the
Federal Statistical Institute Austria by means of automation-supported

Data processing will be disclosed to the extent that the relevant data is for
the execution of the respective legally assigned tasks
form an essential prerequisite. Other authorities, courts and the carriers
The social security authorities may process data they process in accordance with paragraph 1
Exception of health data in accordance with paragraph 1 item 4, the employment service
and the Federal Ministry of Labor, Social Affairs, Health and

Consumer protection through automated data processing
disclose to the extent that this data is necessary for the execution of the
Employment Service and the Federal Ministry of Labor, Social Affairs,
tasks assigned by law to health and consumer protection
form an essential prerequisite. From the social security providers
Data transmitted in accordance with Paragraph 1 Z 9 may be used by the employment service and by

Federal Ministry of Labor, Social Affairs, Health and Consumer Protection
personally for the purposes of sustainable labor market integration
group of people are processed.

(...)
(4) The data processed by the employment service in accordance with paragraph 1 may be sent to
the Bundesrechenzentrum GmbH and to institutions that are responsible for the tasks of the

are transferred to the Labor Market Service (§ 30 para. 3 and § 32 para. 3), within the framework
the services to be provided by them by way of
automated data processing.



Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                        December 21, 2023

                                                        20 out of 53




(5) The Labor Market Service and the Federal Ministry of Labor, Social Affairs,

Health and consumer protection may use the data they process
in accordance with paragraph 1, with the exception of health data in accordance with paragraph 1 item 4
commissioned legal entities by means of automated support
Transmit data processing to the extent that the relevant data is a
an indispensable prerequisite for the fulfillment of an assessment requirement
Services, aid and other financial benefits

research contracts awarded by the Labor Market Service. For in public
Interested scientific and statistical studies may be carried out
the Federal Ministry of Labor, Social Affairs, Health and
Consumer protection and the employment service provide the necessary support
Data in accordance with paragraph 1 (except Z 1 lit. a and e to h), linked to the
encrypted bPK AS, the Austrian Federal Statistical Institute for the purpose of

Merging with indirectly personal data from others
Authorities or social security institutions or at the Federal Agency
transmit existing data on the working population. These are also allowed
other authorities or social insurance providers in accordance with legal regulations
Data processed in accordance with the regulations of the state's own area of activity,
linked to the encrypted bPK AS, transmitted to the Federal Agency.

A return transfer of merged data or the enabling of this
Restoring a direct personal connection is not permitted. The
The Federal Institute prepares the scientific or statistical evaluations
after commissioning by the Federal Minister of Labor, Social Affairs and Health
and consumer protection. The federal agency provides its services
this federal law against reimbursement of costs in accordance with Section 32 Paragraph 4 Z 2 of
Federal Statistics Act 2000. The merged data is as soon as it is

are no longer needed for the purpose of the investigation, at the latest
three years to delete.
(6) The Austrian Federal Statistical Institute may process master data

the employer in accordance with paragraph 1 item 6 and data on training in accordance with paragraph 1
Z 2 lit. b and Z 7 lit. b to the employment service and the Federal Ministry
for work, social affairs, health and consumer protection through the
disclose automated data processing, insofar as this data is for
Scientific purposes that fall within their legal area of responsibility
or labor market statistical studies that are not personal

Aiming to achieve results (§ 7 DSG) is an essential prerequisite.
(7) If this is necessary for the fulfillment of legal tasks,
Health data (paragraph 1 no. 4) may be disclosed by the employment service to the

responsible social security institutions, the Ministry of Social Affairs,
the responsible social assistance providers and institutions that carry out their tasks
are transferred to the employment service (§ 30 para. 3 and § 32 para. 3) as well
must be disclosed by them to the employment service.




Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                        December 21, 2023

                                                        21 of 53




(8) Employers may only disclose data in accordance with paragraph 1

for the establishment of an employment relationship and the assessment
the professional suitability of the job seekers are needed.
Health data may not be disclosed to employers.

(9) The data according to paragraph 1 is seven years after the end of the respective period
business case. The retention period is extended by
Periods in which the data is used to assert, exercise or
Defense of legal claims are still needed or others
Legal regulations provide for longer deadlines. The deletion of data is
for economic and technical reasons on one or two dates

year to focus. Until then, there is no entitlement to early payment
Deletion.
(10) The employment service has to take into account the economic

Justifiable and the state of the art adequate precautions for the
Ensuring data security within the meaning of Articles 24, 25 and 32 of the
Regulation (EU) No. 2016/679 on the protection of natural persons
Processing of personal data, free movement of data and
Repeal of Directive 95/46/EC (General Data Protection Regulation),
OJ No. L 119 of May 4, 2016 p. 1, (hereinafter: GDPR) and Section 6 DSG

hold true. In particular, recordings or changes are personal
Data only by the responsible organizational units
(employees) permitted. When transmitting
of personal data to third parties is due to technical or organizational reasons
Measures to ensure that only the intended recipients
Recipients gain access to the data. Access and reading rights are
according to the tasks (roles) of the respective organizational units and

to design servants. Access to personal data as well as any
Transmission of health data must be recorded. Log data
may not be used for personal purposes unless this is necessary
Enforcement or defense of legally asserted claims
Ensuring the lawful use of data processing or
necessary for technical reasons.

(11) Based on paragraphs 1 to 10, Section 69 AlVG and Sections 27 and
27a AuslBG, the data processing to be carried out meets the requirements
Requirements of Art. 35 Para. 10 GDPR for the omission of the

Data protection impact assessment.
(...)

Obligation of confidentiality

§ 27. (1) The bodies of the employment service are, to the extent not permitted by law
otherwise is intended to maintain confidentiality about all of them from their official position
Facts that have become known during the activity are obliged to keep them confidential



Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                        December 21, 2023
                                                        22 of 53





interest in maintaining public peace, order and
Security, comprehensive national defense, foreign
Relationships, in the economic interest of the employment service, to
Preparation of a decision or in the overriding interests of the parties
is required. The responsible supervisor has to waive this obligation
To release the request of a court or an administrative authority if

this is in the interests of justice or in other public interests
lies.

(2) The obligation of confidentiality in accordance with paragraph 1 also applies after
Leaving the position and after termination of the employment relationship.
The obligation of confidentiality in accordance with paragraph 1 also applies to persons
a committee of the board of directors, the state directorate or the
Member of the regional advisory board.

(...)

Goal and task fulfillment
§ 29. (1) The aim of the employment service is, within the framework of

The federal government's full employment policy for prevention and elimination
of unemployment while maintaining social and economic principles
In the sense of an active labor market policy, the most complete,
economically sensible and sustainable merging
supply and demand for labor, and thereby the supply
the economy with workers and the employment of all people who

are available to the Austrian labor market in the best possible way
to back up. This includes securing economic existence during the
Unemployment within the framework of the legal provisions.

(2) In order to achieve this goal, the labor market service has to do so within the framework of
legal provisions to provide services aimed at:

1. the placement of suitable workers in an efficient manner
    To create jobs that are as close as possible
    Employment appropriate to the job seeker's placement wishes
    offer,

2. the effects of circumstances that require direct mediation
    hinder the senses of Z 1, to help overcome them,

3. to counteract the confusion of the labor market,
4. quantitative or qualitative imbalances between
    reduce labor supply and demand,

5. the preservation of jobs if this makes sense within the meaning of paragraph 1
    is to enable and





Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                        December 21, 2023

                                                        23 out of 53




6. to secure the economic existence of the unemployed.

(3) The tasks of the employment service include in particular:
Ensuring vocational training opportunities for young people
through placement of suitable apprenticeships and additional measures such as

the commissioning of training institutions for inter-company purposes
Apprenticeship training in accordance with Section 30b of the Vocational Training Act (BAG),
Federal Law Gazette No. 142/1969, or from training institutions in accordance with Section 2 Paragraph 4 of
Agricultural and Forestry Vocational Training Act,
Federal Law Gazette I No. 298/1990.

(4) The tasks of the employment service also include:
Promoting the re-employment of those with health impairments
people through placement in suitable jobs and supplementary ones
or preparatory measures. Particular attention is paid to the individual

Performance, the development and expansion of on the labor market
usable qualifications and securing economic existence
to pay attention.

(...)
Principles in the performance of tasks

§ 31. (1) The services of the employment service that are not covered by the authorities
Procedures can be carried out by anyone at all branches and
Make use of the employment service facilities that provide this
Offer services unless the principles stated in paragraph 5 are met

oppose.
(2) If there is no legal entitlement to benefits from the employment service
exists, the choice, type and, if necessary, combination of the

services used according to the requirements of the individual case
from the point of view that they achieve the aim stated in § 29 as best as possible
are equivalent to. When fulfilling its tasks, the employment service has to
an appropriate balance between the interests of employers and
respect employees.

(3) For people who either because of their personal circumstances or
their belonging to a group that is disadvantaged in the labor market
particular difficulties in obtaining or maintaining a job
the services of the employment service within the meaning of paragraph 2 are as follows

design and, if necessary, use it more intensively so that a
The greatest possible equality of opportunity with other workers is achieved
becomes. In particular, through appropriate use of the services
gender-specific division of the labor market and discrimination
of women in the labor market.





Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                         December 21, 2023

                                                         24 out of 53




(4) The activity of the employment service is, as far as it is

- ensuring compliance with and implementation of labor market policy
    the federal government,

- the equal treatment of similar matters,

- the necessary uniformity of approach and
- achieving the highest possible efficiency and practicality
    performance

allow to be carried out decentrally. The services of the employment service
are, unless expressly stated otherwise, by the
regional organizations.

(5) In all activities, the public employment service adheres to the principles of
Economy, economy and practicality from the point of view
the best possible achievement of the goal stated in § 29

take. To assess the efficiency of the activities of the labor market service
to set up internal controlling.
(6) The employment service has particular responsibility for projects relating to:

Ensuring vocational training opportunities for young people
in accordance with Section 29 Paragraph 3 to the different needs of each individual
Federal states should be taken into account and fulfilled in the best possible way
Tasks require the participation and appropriate financial participation of the
to strive for in the respective federal state.

(7) When planning measures, the employment service must ensure that
that for groups of people who are particularly at risk of unemployment,
appropriate support services are offered.

(8) The measures are intended in particular to maintain and expand
promote marketable skills among employees. The
The labor market service can participate in measures taken by other legal entities
Improving the framework conditions for long-term maintenance

participate in health.
(...)

Services

§ 32. (1) The employment service has its services in the form of
to provide services whose purpose is to provide
Job seekers on vacancies, job security and the
Securing one's existence within the meaning of Section 29 is.







Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                        December 21, 2023
                                                        25 out of 53





(2) Services to prepare, enable or facilitate a
such placement or job security are particularly important
1. Information about the labor market and the professional world,

2. Advice on choosing a career,

3. Assistance in the production or maintenance of the
    ability to place workers,

4. Supporting the qualification of workers and
5. Supporting companies in finding and selecting suitable ones

    workforce and the design of the internal company
    workforce planning,
6. Assisting job seekers in searching and choosing one

    workplace and
7. Supporting businesses and workers to create and

    Preservation of jobs.
(3) To the extent that the employment service does not provide services within the meaning of paragraph 2
can provide itself or its provision is inappropriate or

If it were uneconomical, it must ensure that such services are provided
based on contractual agreements, e.g. through transfer to suitable persons
Facilities may be provided by other means. Allowed to do so
third party interests worthy of protection within the meaning of Section 1 Paragraph 1 of
Data protection law is not violated.

(4) Services are generally free of charge. For special ones
Services such as testing and pre-selection of applicants or special ones
Advertising measures and personnel consulting measures for companies can

the board of directors shall set an appropriate remuneration that corresponds to the
to the labor market service. Services for employees, unemployed people
and jobseekers must in any case be provided free of charge.

(5) If services of the employment service are covered by the provisions
of Section 2 of the Labor Market Promotion Act (AMFG), Federal Law Gazette No. 31/1969,
the provisions of Sections 3 to 7 AMFG apply to them.

(...)
Care plan

§ 38c. The regional office has one for every unemployed person
Create a care plan based on what is expected
Care needs in particular the type of care and the in

Measures taken and a justification for them
contains the intended procedure. In particular, the care plan includes:
the relevant aspects in accordance with Section 9 Paragraphs 1 to 3 AlVG are taken into account



Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023

                                                                  26 of 53




         take. When communicating and taking measures to improve the
         Placement opportunities are those that can be exploited on the labor market
         Qualifications (professional and technical knowledge and skills
         Nature) of the unemployed person and these are to be taken into account if possible

         maintained or expanded if necessary. When changing the for incorporation
         Circumstances significant in the labor market is the care plan
         adjust accordingly. The regional office has an agreement
         with the unemployed person via the care plan. Can one
         If agreement is not reached, the care plan is from the regional

         Office with the greatest possible consideration of the interests of the
         unemployed person unilaterally. The care plan is this
         brought to the attention of the unemployed person. To a specific one
         Care plan or measures planned in the care plan
         taken, there is no legal claim. The board of directors has one

         Guideline to ensure a consistent approach to the
         Creation and adjustment of care plans.
         (...)"

32 5.2. To assess the relevant action of the AMS as sovereign or

         private sector and on the question of the applicability of Section 1 Paragraph 2 DSG

         the present facts

33 5.2.1. The revision argues that the data processing in question is carried out

         the mP takes place within the framework of sovereign administration. Nobody spoke
         understandable reasons for the processing to be in the area of

         To be attributed to private sector administration, especially since Section 29 AMSG covers the mediation
         of suitable workers for jobs as the goal and task of the mP

         statue. However, the task of providing employment is one
         inseparable connection with the Unemployment Insurance Act

         (AlVG). AMAS cannot be separated from official activities according to the
         AlVG are considered because this data processing is ultimately considered

         Basis for decision-making for job placement and thus

         serve in conjunction with unemployment insurance claims.
         Since the data processing in question takes place within the framework of sovereign administration

         is carried out, Section 1 Paragraph 2 DSG requires the respective legislator
         Matter-specific regulations in the sense that the cases are more admissible

         Interventions in the fundamental right to data protection are specified and limited
         would.




         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                 December 21, 2023

                                                                 27 of 53




34 The response to the appeal counters that the AMSG regulates the same

         Essentially the “services” of the employment service (AMS) and
         thus the private sector tasks of the mP, in particular their

         Employment placement activities including organization and
         Carrying out training and awarding aid. The

         Procedural processing - AMAS - is used for activities of the
         mP used in the private sector. These in Sections 29 ff AMSG

         The tasks envisaged by the mP would be carried out using the means of private law

         carried out, the basis for the procedure essentially being:
         Supervision agreement in accordance with Section 38c AMSG. On any possible

         There is no entitlement to services. See Section 32 AMSG in this sense
         suggests that the MPs describe their services in more detail

         have to provide services to which expressly no reference is made
         legal claim exists. This also applies to the awarding of aid. The

         The appellant herself assumes that the matter at issue in the proceedings

         Data processing for the purposes of job placement in accordance with
         §§ 29 ff AMSG is used. It should be noted that AMAS is not for

         the job placement itself, but only for the targeted person
         Support and support can be used. The program

         serve to choose the right care strategy. The employment agency itself
         success regardless of the calculated opportunities on the labor market. From all

         The result is that the requirement of Section 1 Paragraph 2 DSG, according to which an intervention in the
         Basic right to data protection by a state authority only on the basis

         should be made on a qualified legal basis, this is not the case

         application succeed.

35 5.2.2. The balancing of interests stipulated in Section 1 Paragraph 2 DSG requires:
         Admissibility of official interventions in data protection secrecy

         an (express) legal regulation resulting from the provisions set out in Article 8 Para. 2 ECHR

         reasons mentioned is necessary. The explanations for this provision
         understand authorities as state bodies acting sovereignly; that is what is meant

         sovereign action by administrative authorities (cf. Pürgy/Zavadil,
         The state authority within the meaning of Section 1 Paragraph 2 DSG 2000 in Bauer/Reimer,

         Handbook on data protection law [2009], 141 ff [147], with reference to



         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                   December 21, 2023

                                                                   28 out of 53




         ErlRV on the StF of § 1 DSG 2000, 1613 BlgNR 20. GP 34 f; Eberhard in

         Korinek/Holoubek, B-VG, 12th Lfg [2016], § 1 DSG, Rn. 58, mwN).

36 5.2.3. Sovereign administration occurs when the administrative bodies

         “Empire”, i.e. using specific state command and control
         Coercive force occurs. They act in those legal sentence forms that...

         public law for the exercise of official powers

         (cf. VfGH March 3, 2001, KI-2/99).

37 The determination that an administrative body is an act of society

         services of general interest, thus a public administrative task,
         excludes the qualification of such an activity as

         Private sector administration not out. For the delimitation of the area
         Private sector administration from that of the sovereign administration it depends on the

         motives and the purpose of the activity, what is more important is
         what legal technical means the legislation can use to implement the

         fulfilling tasks. Does the legislature have the administrative authority?

         not endowed with coercive powers, there is no sovereign administration,
         but rather private sector administration (see VfGH October 18, 1957, KI-1/57;
                                                                                     6
         see also the comments in Raschauer, General Administrative Law,
         2021, paragraph 694 ff).


38 According to the statements in - the still relevant
         “leading case” - VfSlg. 3262/1957 it is official for qualification

         Acting as a sovereign administration, it is irrelevant whether the authority in question has one
         performs a “public task” because not everything “public” is sovereign

         is carried out. Furthermore, it is not decisive that it is one

         regulation in the field of public law. Not everyone is either
         Act of a body endowed with official powers is an act of sovereignty.

         The fact that the relevant authority in connection with the
         Works with public funds to fulfill the task does not make a decision either

         about the questions of sovereign action, because also within the framework of

         Private sector administration the state deals with public funds.
         The only decisive factor is what legal means the legislature uses

         has provided, i.e. whether there is a legal authorization to do something sovereign


         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                   December 21, 2023

                                                                   29 of 53




         action is given and whether such action is used in the specific case

         is made (cf. on all the Raschauer, ibid).

39 The term “simple sovereign administration” refers to administrative action

         recorded, which is not of a private economic nature, but rather belongs to the area of
         sovereign administration, even if in the specific case there is no sovereign act

         is set. In the simple sovereign administration the
         Administrative bodies not in the forms of action of the decision

         direct administrative command and coercive power as well as the
         Regulation acts, although this limits its power to order and enforce

         is present in the background. In this sense it is simple

         Sovereign administration a potentially sovereign administration that can be achieved through deployment
         can go from empire to current sovereign administration; it deals

         It is therefore a matter of “different intensity” of an administrative activity
         overall belongs to the area of sovereign administration (cf. VwGH April 15, 2016,

         Ra 2016/02/0028). There may be administrative acts that are not
         have independent normativity, but undoubtedly - preparatory,

         accompanying, implementing - within the framework of the sovereign administration.
         In some cases it is even expressly provided that the refusal

         Such an (actual) performance should be made with a notice, which is probably the case

         The clearest indication of this is also the case of positive approval
         or fulfillment can be qualified as sovereign action. The simple one

         Sovereign administration can no longer be based solely on the limited
         Number of typified forms of sovereign acts can be determined.

         What is crucial is that certain actions are taken that both
         in the area of sovereign administration as well as in the area of

         Private sector administration can be found. To act sovereignly
         this action the context in which they are placed

         (cf. again Raschauer, ibid).

40 5.2.4. It is undisputed that the mP has both private and sovereign interests

         To fulfill tasks (see Section 31 Paragraph 1 AMSG) because they

         Job seekers both as a (contractual) partner and as a sponsor
         confronted with state sovereignty.




         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023

                                                                  30 out of 53




41 5.2.4.1. The mP acts in the area of sovereign administration, provided that it has

         Benefits to which there is a legal claim - for example under the AlVG - are decided

         consists. The care activity in question including that in this context
         the planned creation of a care plan/a care agreement

         but takes place without the law granting the mP coercive powers or
         the job seeker has a legal right to what is considered expedient there

         The prospect of supporting measures opens up. Rather, the mP

         theirs in the service of “the federal government’s full employment policy
         Preventing and eliminating unemployment while preserving social and

         “Economic Principles” fulfillment of tasks

         (see Section 29 Paragraph 1 AMSG) to be provided in the form of services,
         which anyone can take advantage of (Section 31 Paragraph 1 AMSG). The

         Case-related relevant activity of the MP is therefore not considered a sovereign activity
         in a narrower sense.


42 5.2.4.2. The possibility of this happening simply needs to be questioned
         sovereign action because - as the appeal argues - the

         Employment placement in an “inseparable connection with the AlVG”

         stand.

43 According to the undisputed findings, the results of the AMAS should be

         Consultation process can be used and a starting point for the consultants
         be in order to make an assessment together with the job seeker

         Potentials and, if necessary, obstacles to labor market integration
         to determine. Because of this dispute, the optimal one is

         Care strategy - funding and care services

         define. The final decision about assignment to one of the
         The consultant meets customer groups. Does the job seeker have a dedicated one?

         different assessment of the labor market opportunities than the consultant
         document this in the supervision agreement.


44 Based on this, the following should be considered:

45 Against the background of the AMSG, the task of the mP is the prevention and

         Elimination of unemployment while preserving social and economic



         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                 December 21, 2023

                                                                 31 out of 53




         Principles in the sense of an active labor market policy (Section 29 Paragraph 1 AMSG).

         According to the materials on the AMSG (RV 1468 BlgNR 18. GP, 32; AB 1555
         BlgNR 18. GP) the sole purpose of the law is reform

         the labor market administration and the associated re-achievement of the
         Full employment and the participation of job seekers in working life

         The central aim of the provisions of the AMSG is to achieve one
         the highest possible level of employment through the organization of the mP

         should be achieved, for whose services the rapid placement of a

         Productive and individually satisfying employment is the top priority.
         According to Section 29 AMSG, the economic existence should be maintained during the period of

         Job search is guaranteed, securing a living in form
         Recurring benefits to job seekers are therefore part of the

         Labor market policy. This is the basic idea of active labor market policy
         through specific measures tailored to the individual case and under

         Consideration of the greatest possible compatibility of full employment

         and achieve economic growth. From this objective
         The AMSG shows that, on the one hand, the AMS unites the job seeker

         Overview of the domestic labor market and orientation towards it
         enable, on the other hand, through targeted advice and assistance

         Identify a position that is appropriate to the individual's individual abilities
         should do (see OGH January 30, 2001, 1 Ob 257/00a).


46 The entitlement to unemployment benefit (§ 47 para. 1 AlVG) is of a sovereign nature;
         when deciding whether you are entitled to unemployment benefit

         official tasks are fulfilled. The placement of job seekers
         However, as can be seen from Section 31 Paragraph 1 AMSG, it is in any case not sovereign

         (see OGH November 24, 2015, 1 Ob 208/15t, mwN).

47 The relevant advice according to the findings, within the framework of which this

         The data processing in question is carried out - regardless of the narrow subject matter
         Context - intentionally not about the preparation of the agreement

         Claims from unemployment insurance, but rather the purpose of the

         Bringing together supply and demand in the labor market. The
         Legally designed advisory process as a service, which is in accordance with




         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023
                                                                  32 out of 53





         Section 31 Paragraph 1 AMSG is also open to job seekers who are not recipients of
         Unemployment benefits are not provided through sovereign means

         carried out this still ends - given the lack of reciprocal

         Rights and obligations - in a sovereign act. The purely objective one
         Connection between unemployment and possible support

         According to the AlVG, in the event of an unsuccessful job search, advice is provided
         Reintegration into the labor market itself is not one

         Preparatory act for official activities at the
         Granting support, namely in the absence of a sufficient normative one

         Connexes does not apply even if it is made to people who are already in the
         Receipt of benefits according to the AlVG.


48 This also applies to the “care plan”: according to the
         The Labor Market Reform Act 2004, BGBl. I No. 77, inserted Section 38c AMSG has this

         AMS to create a care plan for every unemployed person
         “Based on the expected need for care, in particular the type and

         Type of care and the measures envisaged as well as a
         Justification for the intended course of action”. The explanations

         of the legislature, ErlRV 464 BlgNR 22. GP 9, excerpts read:

         “The basic principles of the employment service have already been good so far
         Experiences in the care plan used should now be expressly legal
         be anchored. The care plan is not the sovereign administration
         to be attributed, but should only be the framework conditions for which the

         Mediation and placement services associated with the private sector administration
         the employment service's placement-supporting activities.
         The care plan should provide a consistent, meaningful, predictable and
         Proceedings in accordance with the principle of trust in the care and
         Placement of the unemployed must be ensured. Depending on the to
         Part of very different conditions for success

         Reintegration into the labor market involves different requirements
         to provide care for the unemployed. This results in tiered ones
         Requirements for the care plan. Discussions to clarify the situation
         and the care process will usually take this into account
         (must) whether the unemployment is only temporary and expected

         appears to be remediable in the foreseeable future without special measures or
         With regard to age, lack of qualifications, health, for example
         Restrictions, care obligations or structural problems on the




         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023
                                                                  33 out of 53





         Special efforts are required in the labor market. (...) The
         Agreement on the care plan is within the framework of the existing one
         discretion. If the ideas of the (des)
         Unemployed people are not in compliance with the applicable regulations
         clarification in this regard should be provided. Still can't agree
         achieved, the care plan is one-sided from the regional one

         Establish office. The care plan is for the unemployed person
         in any case in an appropriate manner, for example by handing it over or sending it
         to bring knowledge. The care plan should define the framework,
         within which placement efforts and qualification or other
         to improve employment opportunities on the labor market

         necessary measures should be taken. In the agreements should
         also the planned personal activities of the unemployed
         be held. The care plan is for the actions of the
         Labor market service as well as the unemployed as long as he
         not changed - usually after a new consultation
         became. (...) On the one hand, the support plan is intended to provide for the unemployed

         higher degree of personal action orientation as well
         Predictability of the actions of the employment service and on the other hand
         Overall, it is even more planned, easier to understand and, if necessary, targeted
         changeable approach of the employment service can be guaranteed. The
         The tried and tested 'agreement culture' should be continued and expanded. (...)"

49 According to the declared will of the legislature, the mP is given the task

         the creation of the care plan/care agreement within the framework
         the private sector administration. This corresponds to the explicit one

         Exclusion of a legal right to a specific care plan or

         on measures that are envisaged in the care plan
         (see also Julcher in AlV-Komm § 9 AlVG Rz 79). Furthermore is

         decisive for the classification of the relevant cases
         mP's advisory activity as a private sector activity that

         Creation of the care plan in accordance with the reasonableness criteria
         Section 9 paragraphs 1 to 3 AlVG must be taken into account; one from the

         Binding terms that can be derived directly from the care plan/care agreement
         Determination of the limits of the reasonableness of employment in the sense of

         § 9 AlVG or just a binding definition of the individual case-related criteria
         However, the law does not provide for the assessment of these limits,

         so that the care plan, against this background, limits the

         Reasonableness of employment - especially in connection with



         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                 December 21, 2023

                                                                 34 out of 53




         possible sanctions according to § 10 AlVG - neither expand nor restrict

         can. There can also be no sanction directly following the care plan
         § 10 AlVG. Section 9 (8) AlVG also changes this consequence

         nothing, because the provision there does reduce the justification effort of the mP for

         Reintegration measures for the job seeker - under
         certain requirements - in connection with an existing one

         Care plan modified, but which itself does not develop any bond and the
         Authority is also not relieved of its obligation to present one

         comprehensible - and in this sense independent - justification

         which is subject to verification (cf. in this direction
         pointing VwGH March 28, 2012, 2010/08/0250).

50 From what has been said above it follows that neither the advice

         as part of the job placement itself, the creation of the

         Care plan (a care agreement) within the meaning of Section 38c AMSG
         to be attributed to the (even if simply) sovereign area of activity of the mP

         is. Rather, this is part of the private sector
         actions of the mP, against the background of the functional concept of authority

         Section 1 Paragraph 2 DSG does not correspond to this in terms of data protection law

         determinate standard for encroachments on fundamental rights
         Personal data is subject to confidentiality in accordance with Section 1 Paragraph 1 DSG.


51 For this reason alone, the controversial legality of the
         data processing that is the subject of the procedure using the

         to examine the relevant provisions of the GDPR without the standard of
         Section 1 Paragraph 2 DSG must be taken into account.


52 5.3. On the question of the existence of sufficient justification reasons
         Articles 6 and 9 GDPR


53 5.3.1. The BVwG supported its argument regarding legality
         the processing in question is based on the conclusion in accordance with Article 6

         Paragraph 1 lit. e GDPR and Art. 9 para. 2 lit. g GDPR can be processed
         personal data or special categories of personal data

         Data will be lawful if this processing is based on the law of



         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                 December 21, 2023
                                                                 35 out of 53





         Member State of the person responsible for a matter in the public interest
         underlying task or with regard to the processing of special categories

         personal data based on significant public interest

         was required. The legal basis corresponding to Art. 6 Para. 3 GDPR
         according to Recital 41 of the GDPR, I have made it clear and precise and for the

         to be predictable for those subject to the law. Art. 9 paragraph 2 lit. g GDPR requires
         additional appropriate and specific measures to safeguard the

         Fundamental rights and interests of the persons concerned. Summarized
         The BVwG believes that the mP has the right to it in accordance with Section 29 Paragraph 1 AMSG

         assigned tasks in accordance with Section 31 Paragraph 5 AMSG
         required principles of thrift, economy and

         expediency must be met. Section 25 Paragraph 2 AMSG grants the mP one
         Authorization to process personal data, insofar as this

         are an essential prerequisite for fulfilling legal tasks.
         The task assigned to the mP in accordance with Section 29 AMSG is undoubtedly one of

         significant public interest. In order to achieve the set goal of optimal

         Supplying the economy with workers and employing everyone
         In order to secure people in the best possible way, it is undeniably necessary to focus on the

         personal characteristics of the job seekers in combination with the
         Labor market events to be taken into account. That those brought in

         personal data of job seekers for the assessment of the job seekers
         Labor market opportunities can be relevant, also from the appeal applicant

         not been disputed. There are none in this case
         Concerns that the mP is intended to ensure a “proper

         Labor market policy” the personal data in accordance with Section 25 Paragraph 1 AMSG
         may use. There are indications that such data processing is carried out in

         § 25 AMSG is not sufficiently clearly expressed
         recognizable. Section 25 Paragraph 10 AMSG takes precautions to ensure that the

         Processing and warranty in accordance with the principles of the GDPR

         data security.

54 5.3.2. In order to answer the appeal's submissions, we must first look at the
         The question of whether the requirements of Articles 6 and 9 of the GDPR are met will be addressed

         and to say in advance that the question of the legality of the



         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023

                                                                  36 out of 53




         Processing against the background of these provisions is one of the questions

         the ban on automated decisions in accordance with Art. 22 GDPR
         represents a dividing legal question.


55 5.3.2.1. The processing of personal data is in accordance with
         Art. 6 Para. 1 lit. e GDPR - among other things - lawful if the

         Processing is necessary for the performance of a task that is...

         is in the public interest or is carried out in the exercise of official authority
         was transferred to the person responsible.


56 Art. 6 Para. 1 lit. e GDPR is closely related to Art. 6
         Paragraphs 2 and 3, which contain more detailed requirements for the legal basis.

         The legal basis for the processing is in accordance with Article 6 Paragraph 1 Letter e of the GDPR
         may in accordance with Art. 6 para. 3 leg. cit. by Union law or the law of the

         Member States to which the controller is subject must be determined. The
         The purpose of the processing must - unlike the processing according to

         Art. 6 Para. 1 lit. c GDPR - not necessarily in a legal basis

         be expressly provided for. According to Art. 6 Para. 3 Sentence 2 GDPR, it is sufficient
         if the purpose of the processing is necessary to complete a task

         fulfill which is in the public interest or in the exercise of a public purpose
         Violence occurs.


57 Recital 41 of the GDPR again provides that the corresponding
         Legal basis or legislative measure clear and precise and their

         Application should be predictable for those subject to the law. However
         Recital 45 of the GDPR expressly does not require each individual

         Processing a specific law. Rather, a law can serve as a basis

         be sufficient for multiple processing operations when processing
         is necessary to carry out a task in the public interest.


58 In light of the wording of these relevant provisions
         It cannot be assumed that the national legislature is responsible for fulfilling the

         Justification of Article 6 Paragraph 1 Letter e GDPR with regard to a
         certain data processing is in any case held, the data processing

         to determine themselves in the law. Rather, it is the justification fact



         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023

                                                                  37 out of 53




         fulfilled if the task to be performed is in the legal basis

         is adequately described and the relevant data processing
         the purpose of fulfilling this task. However, this assumes that

         such a task is sufficiently clear and defined by the law
         is described. The legal basis in question may be more specific

         Regulations are included, but this is not mandatory (arg.: “can”
         in Art. 6 Para. 3 third sentence GDPR). Ultimately sees

         Art. 6 Para. 3 fourth sentence GDPR also applies to processing

         Art. 6 Para. 1 lit. e leg. cit. proposes that the legislation be a public one
         Pursue a goal that is of interest and in an appropriate proportion

         must be consistent with the legitimate purpose pursued (see also this view
         supporting Kastelitz/Hötzendorfer/Tschohl in Knyrim, the DatKomm, 2020,

         Art. 6 para. 47; see also Buchner/Petri in Kühling/Buchner, DS-GVO, BDSG,
         3rd edition, 2020, Art. 6 GDPR, paragraph 120 f).


59 5.3.2.2. The purpose of the provisions of Article 9 Paragraph 1 GDPR is to provide a
         to ensure increased protection against such data processing

         a particularly difficult one due to the particular sensitivity of this data
         Interference with the fundamental rights guaranteed by Articles 7 and 8 of the Charter

         Respect for private life and protection of personal data

         can (cf. the comments of the ECJ on the purpose of protection in the judgment of
         September 24, 2019, C-136/17, GC and others, paragraph 44).

60 Core of - Art. 6 Paragraph 1 Letter e GDPR

         reproduced - legality of Article 9 Para. 2 lit. g GDPR

         is that the processing is carried out for reasons of significant public concern
         interest must be required. While accordingly for processing

         personal data is generally in the public interest
         (Art. 6 Para. 1 lit. e GDPR), the processing of sensitive data is required

         Within the meaning of Article 9 Para. 1 GDPR - according to its wording - such
         considerable interest. This means that specific consideration is required

         a special legitimation for the use of such data (cf. to

         Interpretation of the corresponding legal situation in Germany
         Explanations in Kühling/Buchner, DS-GVO, BDSG, 3rd edition, Art. 9 Rz. 91,




         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                   December 21, 2023
                                                                   38 out of 53





         cf. on Art. 9 Para. 2 lit. g GDPR also already ECJ September 24, 2019, C-136/17,
         GC et al. [Delisting of sensitive data], paragraph 61).


61 The requirements for the legal basis are not specified in more detail
         Art. 9 GDPR. Art. 9 Para. 2 lit. g GDPR refers as well as Art. 6

         Paragraph 1 lit. e leg. cit. as a justification for the requirement of
         Processing for reasons of - in connection with Art. 9 Para. 2 lit. g

         considerable - public interest. With regard to the structural
         What these two justification facts have in common and the respective one

         Reference to Union law or the law of a Member State as well

         In the absence of an order to the contrary, this is also necessary to justify the
         Processing of special categories of personal data within the meaning of

         Art. 9 Para. 2 lit. g GDPR assumes that - just like with
         Justification for Article 6 Paragraph 1 Letter e - the sufficiently clear definition

         the task to be performed with the processing - which is related
         This data must have a special quality (arg.: “significant

         public interest”) - is necessary but also sufficient (cf. the
         Statements by Schörghofer/Warter, The legal basis of a

         Data processing in FS Pfeil, 2022, 721ff [734]). This view corresponds
         the opinion of the ECJ in C-136/17, according to which Art. 9 Para. 2 lit. g GDPR

         Processing of the special categories of data referred to in Article 9 is permitted,
         if it is necessary for reasons of significant public interest,

         on the basis of Union law or the law of a third party

         Member State that is proportionate to the objective pursued,
         preserves the essence of the right to data protection and appropriate and

         specific measures to safeguard the fundamental rights and interests of the
         data subject, whereby the ECJ in the manner provided for by Article 11 of the Charter

         protected right to free information a possible justification
         The legal basis for the data processing in dispute there is (cf. ECJ ibid.,

         61, 66 and 68). In this examination, the ECJ in no way relies on
         whether the justifying legal basis is the disputed data processing itself

         designated.






         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                 December 21, 2023

                                                                 39 out of 53




62 5.3.2.3. Case-related arises against the background of this legal situation

         the following:

         First of all, it should be noted that the question of the existence of a public one

         Interest in the assets transferred to mP by Sections 29 ff AMSG
         Tasks - including those of the audit department - are not disputed.

63 Section 29 Paragraph 1 AMSG defines the task of the mP; Section 29 Paragraph 2 AMSG mentions this

         The goals to be achieved in connection with the fulfillment of this task

         Activity of the mP. Section 30 Paragraph 2 AMSG also explicitly norms this
         Commitment of the mP to labor market monitoring and statistics

         care for. By detailing the principles governing task fulfillment
         must be taken as a basis; Section 31 AMSG also states which

         Demands must be met when fulfilling tasks. Section 25 Paragraph 1 AMSG
         limits the authorization for processing to the statutory task and

         to such processing that is essential for the fulfillment of the task

         are prerequisites. This is done by listing the data and the
         direct connection between the same and the permitted processing purpose

         It regulates in a predictable manner for the data subject which data and for what purpose
         may be processed. There is no doubt that this violates §§ 29

         up to 31 AMSG the task in connection with which the mP is to be processed
         the data listed in Section 25 Paragraph 1 AMSG is authorized, and thus the

         Framework for the permitted purpose of data processing is sufficiently clear and
         describe precisely. That the assessment of the labor market opportunities of one

         a relevant parameter for an efficient person looking for work

         Employment placement is obvious. It can therefore be assumed
         that a subject to the law is given in view of the mP

         Task and the services to be provided - in particular the
         The care plan to be drawn up in accordance with Section 38c AMSG - is sufficiently clear

         It is clear that processing in accordance with Section 25 Paragraph 1 AMSG
         The data listed also helps to assess the positioning of each

         relevant job seekers on the labor market and thus for

         this purpose, which is necessary for the fulfillment of the public task,
         can be used.




         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023

                                                                  40 out of 53




64 Furthermore, with regard to the health data affected on a case-by-case basis,

         the special categories of personal data within the meaning of
         Art. 9 Para. 1 GDPR must be counted, it should be noted that it is in accordance with the requirements

         There is no doubt about the case law of the ECJ cited above

         can ensure the best possible integration of job seekers
         The legislative objective applicable to the national labor market is significant

         pursues public interest within the meaning of Article 9 Paragraph 2 Letter g GDPR
         but this objective in connection with efficient use

         state support resources and optimization of social satisfaction

         job-seekers on the one hand and the best possible care for the
         labor market on the other hand. That case-related data processing in one

         appropriate relationship to the task assigned by law
         pursued goals is not and is not in dispute

         visible. This is particularly because, according to the findings in
         According to the contested finding, only those health data are processed

         which restrict the exercise of activities in the labor market and therefore

         are directly related to the employment placement.

65 The provisions regarding the duty of confidentiality of the bodies of the mP in

         § 27 AMSG and the detailed provisions on disclosure and
         Storage of the data in Section 25 Paragraphs 2 to 11 AMSG leaves no room for doubt

         to fulfill the measures required by Art. 9 Para. 2 lit. g GDPR
         Preservation of the essence of the fundamental right enshrined in Article 8 GRC

         Protection of personal data (see the concept of the essential content guarantee
         ECJ April 8, 2014, Digital Rights Irefond et al., C‑293/12 and C‑594/12, para. 40;

         see also bakers in Kühling/Buchner, DSG-VO, BDSG, comment,

         3rd edition, 2020, Art. 23 Rn. 57) as well as the fundamental rights and interests of the
         affected persons. The revision does not bring forward anything concrete,

         which calls this view into question.

66 Insofar as the appeal repeatedly points out that the BVwG has the

         Character of profiling as a special processing procedure
         There is no connection with the requirements of Articles 6 and 9 GDPR

         observed, it is not clear from the statements to what extent the mentioned



         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023

                                                                  41 out of 53




         There are other requirements for this form of processing

         should provide a justifying legal basis, especially since neither Article 6 nor
         Art. 9 GDPR refer to Art. 4 Z 4 GDPR. That of revision in it

         It may be agreed that profiling is a special form of processing
         does not change this view per se. The peculiarity of the

         Rather, profiling is taken into account in Art. 22 GDPR, whereby the
         Dangerous nature of this form of processing as formulated there

         prohibition or in the reasons for justification there

         Precipitation finds.

         In this respect, the revision - including in this context - is based on the

         Requirements of Section 1 Paragraph 2 DSG, the case law of
         Constitutional Court on the legality principle of Article 18 B-VG and the

         insufficient legal basis of the federal directive because of it
         refers to insufficient commitment, please refer to the comments on point

         5.2. to point out.

67 Does the revision point out that in order to exercise the rights concerned,

         It is necessary that “the data collection is carried out in a way that is suitable for those affected by it
         [...] foreseeable manner and in a manner that is at most contestable

         “duly verifiable form”, it should be noted that the
         Data collection itself is not even an issue in this case.

         The subject of the appeal proceedings is rather that of the
         Prohibition issued by the appellant regarding the appeal

         Processing of data. The data to be collected itself is also set out in Section 25

         Paragraph 1 AMSG is listed in detail so that there is no doubt about it
         There is predictability about the type of data to be collected.

68 If the appeal further refers to this, it follows from

         Recital 41 second sentence GDPR that from the legal basis itself

         It must be clear and predictable which data processing will take place
         carried out, this is not reflected in the wording of the recital

         to bring harmony. This states that “the corresponding legal basis
         or legislative measure [...] should be clear and precise and their

         Application [...] for those subject to the law in accordance with the jurisprudence of



         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023

                                                                  42 out of 53




         Court of Justice of the European Union and the European Court of Justice for

         “Human rights [should] be predictable.” To what extent this recital
         the order of Article 6 Paragraph 1 Letter e GDPR, according to which the purpose of the

         Processing may be necessary for the performance of a public task

         It is not clear that the content should be determined in more detail.
         Art. 6 Para. 3 GDPR, on the other hand, expressly speaks of the need for one

         Legal basis from which the purpose of the processing can be derived
         must, or the relevant task in the public interest to which the

         data processing must be attributed. In this respect, the revision in this

         In this context, the second sentence of Section 1 (2) of the DSG is repeatedly referred to
         these in turn refer to the statements under point 5.2. to refer to what

         this legal provision does not apply in each case.

69 This is used by the revision as a yardstick for the sufficient specification of a

         The legal basis for the decision of the ECJ of October 6, 2020,
         C-511/18, C-512/18 and C-520/18, were issued on the interpretation of Article 15(1).

         Directive 2002/58/EC of the European Parliament and of the Council of
         July 12, 2002 on personal data processing and protection

         privacy in electronic communications (Privacy Policy

         for electronic communications, OJ 2002, L 201, p. 37). This into the meeting
         The judgment of the ECJ is not relevant because it violates the principle of

         Data minimization is treated in accordance with Art. 5 lit. c GDPR. On this
         The appellant's decision was not supported in principle.


70 The appeal must be agreed that when processing special data
         Categories of personal data within the meaning of Article 9 Paragraph 1 GDPR

         special intervention circumstances of Art. 9 Para. 2 GDPR are relevant. She
         In this context, criticizes the reasoning of the BVwG, according to which a

         Review of Section 25 Paragraph 10 AMSG to ensure compliance with the requirements

         necessary data security measures did not have to be taken,
         because this is not the subject of the review by the appeal applicant

         has been.

71 However, even if this view of the BVwG were not correct, the appeal

         does not show to what extent the guarantees for data security in this case


         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                 December 21, 2023

                                                                 43 out of 53




         Case - different from that under 5.3.2.1. shown

         assessment - would be inadequate. So nothing comes of the appeal applicant
         brought forward, which would lead to the assumption that with the

         Obligations of confidentiality of the organs and in particular with the prohibition of

         Disclosure of health data in accordance with Section 25 Paragraph 8 AMSG
         employers and the legal precautions regarding storage

         and ensuring data security on a case-by-case basis is not for one in mind
         Sufficient data protection is ensured in accordance with the provisions of the GDPR

         be.

         5.4. On the question of the existence of an automated decision within the meaning of

         Art. 22 Para. 1 GDPR

72 The appeal repeatedly points out that the BVwG has the character of

         Profiling is not taken into account as a special processing procedure. It will happen
         from Recital 41, second sentence of the GDPR, that from the

         The legal basis itself must be clearly visible and predictable

         Data processing is carried out. The job seekers also ran
         There is a risk that AMAS' assumptions will be changed without further processing

         could be taken over.

73 With this argument, the appeal concerns the legality of the

         processing that is the subject of the proceedings against the background of
         Art. 22 GDPR.


74 5.4.1. The ECJ has in its - for the present appeal decision
         to be seen - recent judgment of December 7, 2023, C-634/21,

         SCHUFA Holding [Scoring] on the request for a preliminary ruling
         Art. 267 TFEU, submitted by the Wiesbaden Administrative Court

         (Germany) by decision of October 1, 2021, submitted question

         regarding the interpretation of Article 22 Para. 1 GDPR as follows:

         “40 With its first question, the referring court essentially wants:
         know whether Article 22 Para. 1 GDPR is to be interpreted as meaning that a
         “automated decision in individual cases” within the meaning of this provision
         exists if a claim is based on personal data about a person
         Probability value in relation to their ability to fulfill future requirements



         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                         December 21, 2023

                                                         44 out of 53




Payment obligations are created automatically by a credit reporting agency

will, provided that this probability value significantly determines whether a
Third party to whom this probability value is transmitted
The contractual relationship with this person is established, executed or terminated.

41 To answer this question, it should first be noted that:
the interpretation of a provision of Union law not only its wording,
but also the context in which it stands, as well as the purposes and
objectives pursued by the legal act to which it is a part
must be taken into account (judgment of June 22, 2023, Pankki S, C‑579/21,
EU:C:2023:501, paragraph 38 and the case law cited therein).

42 As far as the wording of Article 22 Para. 1 GDPR is concerned, this is what it looks like
Provision stipulates that a data subject has the right, not one
solely based on automated processing - including

Profiling - to be subjected to decision based on it
has legal effect or is similarly significant
impaired.

43 The applicability of this provision therefore depends on three cumulative factors
prerequisites, namely that, firstly, a 'decision'
must be available, secondly, this decision 'exclusively on one
automated processing, including profiling, must be based on and
thirdly, they have ‘legal effect vis-à-vis [the person concerned]’
or must affect it ‘in a similar significant way’.

44 As regards, first, the requirement for the existence of a decision,
It should be noted that the term 'decision' within the meaning of Article 22
Paragraph 1 GDPR is not defined in this regulation. Already from the

However, the wording of this provision shows that this term does not apply
only refers to actions that have legal effect on the person concerned
person develop, but also on actions that this person is similar to
significantly affect.

45 The broad meaning of the term 'decision' is defined by the
Recital 71 of the GDPR confirms that a decision on
Assessment of personal aspects that affect a person, 'a measure
[may] include', which either has 'legal effect for the person concerned
Person' develops or 'significantly affects him in a similar way', whereby
the data subject should have the right not to make such a decision

to be subjugated. According to this recital, the
The term 'decision', for example, means the automatic rejection of a decision
Online loan application or online hiring process without any
human intervention.

46 Since the term 'decision' within the meaning of Article 22 Paragraph 1 GDPR,
as the Advocate General pointed out in point 38 of his Opinion, several



Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                         December 21, 2023

                                                         45 out of 53




Actions can involve the affected person in many ways

can affect, this term is broad enough to cover the result of the
Calculation of a person's ability to fulfill future needs
Payment obligations in the form of a probability value
to include.

47 Secondly, as regards the requirement that the decision in the sense
of Art. 22 Para. 1 GDPR 'exclusively on an automated basis
Processing, - including profiling - [must be based]', it says
Advocate General stated in point 33 of his Opinion that one
Activity like that of SCHUFA in the definition of 'profiling'

Art. 4 No. 4 GDPR corresponds and that this requirement is therefore in place
present case is fulfilled; the wording of the first question refers
Furthermore, we expressly refer to the automated creation of one
personal data about a person based probability value
regarding their ability to service a loan in the future.

48 Thirdly, as regards the requirement that the decision against
the data subject has 'legal effect' or it has 'a similar effect'
The content of the document must have a significant impact on it
first question that the actions of the third party, the

Probability value is transmitted, 'relevant' from this value
is directed. According to the facts of the case submitted by the presenter
Court in a case addressed to a bank by a consumer
Loan application has an insufficient probability value in almost all
In some cases, the bank may refuse to grant the requested loan.

49 Consequently, it can be assumed that the third requirement, of which
the application of Art. 22 Para. 1 GDPR depends, is fulfilled because a
Probability value like that at issue in the main proceedings
affected person is at least significantly impaired.

50 Therefore, in circumstances such as those in the main proceedings, in which
that determined by a credit reporting agency and reported to a bank
Probability value plays a significant role in granting a
Credit plays, the determination of this value as such is a decision

to be classified as a person within the meaning of Article 22 Paragraph 1 GDPR
data subject has legal effect or in a similar way
significantly impaired'.

51 This interpretation is influenced by the context in which Article 22
Paragraph 1 GDPR stands, as well as the purposes and objectives associated with it
Regulation to be pursued is supported.

52 In this regard, it should be noted that, as the Advocate General stated in point 31
in its Opinion stated that Art. 22 Para. 1 GDPR was the data subject
Person who gives the 'right', not one solely based on an automated one



Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                         December 21, 2023

                                                         46 out of 53




Processing - including profiling - subject to decision

to become. This provision imposes a fundamental ban on
Violation cannot be claimed individually by such a person
are needed.

53 As can be seen from Article 22 Para. 2 GDPR in conjunction with
As can be seen from recital 71 of this regulation, the adoption of a
based exclusively on automated processing
Decision only permissible in the cases mentioned in Article 22 paragraph 2, i.e. H.,
if they are necessary for the conclusion or performance of a contract between the
the person concerned and the person responsible is required (letter a),

if they are based on Union or Member State law,
which the controller is subject to, is permissible (letter b) or if they are with
express consent of the data subject (letter c).

54 Furthermore, Article 22 Paragraph 2 Letter b and Paragraph 3 GDPR provides that
appropriate measures to safeguard rights and freedoms as well as the
legitimate interests of the data subject must be taken into account. In
the cases referred to in Article 22(2)(a) and (c) of this Regulation
the person responsible grants the data subject at least the right to
Obtaining the intervention of a person upon presentation of one's own

position and to challenge the decision.
55 Furthermore, according to Art. 22 Para. 4 GDPR, automated decisions may be made
in individual cases within the meaning of this Article 22 only in certain special cases

special categories of personal data in accordance with Article 9 Paragraph 1 of this
Regulation based.
56 In addition, in the case of an automated

Decision-making such as that within the meaning of Art. 22 Para. 1 GDPR
one of the persons responsible has additional information obligations in accordance with Article 13
Paragraph 2(f) and Article 14(2)(g) of this Regulation. On the other hand
is the responsibility of the data subject in accordance with Article 15 Paragraph 1 Letter h GDPR
Right to information to the person responsible for processing
in particular 'meaningful information about the logic involved as well
the scope and intended effects of such

Processing for the data subject concerns.
57 These higher requirements for the legality of an automated
Decision-making and the additional information obligations of the

Those responsible and the associated additional information rights
The data subject explains the purpose pursued by Article 22 of the GDPR
and which consists in protecting people from the particular risks to their rights and
Protect freedoms associated with automated processing
personal data - including profiling.





Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                        December 21, 2023

                                                        47 out of 53




58 This processing requires, as follows from

Recital 71 of the GDPR results in the assessment of personal aspects
in relation to the natural person affected by this processing,
especially for analyzing or predicting aspects related to them
work performance, economic situation, health, preferences or interests,
Reliability or their behavior, their location or change of location.

59 These particular risks are, according to this recital, capable of:
to impair the interests and rights of the data subject, in particular
with regard to any discriminatory effects compared to natural ones
people based on race, ethnic origin, political opinion,

Religion or belief, trade union membership, genetic
Dispositions or health status as well as sexual orientation. Therefore should
According to this recital, fair and fair treatment to the data subject
transparent processing can be guaranteed, in particular by the
Use of suitable mathematical or statistical methods for this
Profiling and through technical and organizational measures with which in

appropriately ensuring that the risk of errors is minimized
becomes.
60 The interpretation set out in paragraphs 42 to 50 of this judgment and

in particular the broad meaning of the term 'decision' in the sense of
Art. 22 Para. 1 GDPR strengthens the effective protection to which this is based
purpose.

61 However, in circumstances such as those in the main proceedings, this would be the case
involving three actors, there is a risk of circumvention
Art. 22 GDPR and consequently a gap in legal protection if a narrow one
Interpretation of this provision would be given preference according to which the
Determination of the probability value only as a preparatory action
and only the action taken by the third party
if applicable, as a “decision” within the meaning of Article 22 Paragraph 1 of this

Regulation can be classified.
62 In this case, the determination of a
probability value such as that at issue in the main proceedings

does not meet the special requirements of Article 22 Paragraphs 2 to 4 GDPR
are subject to, although this procedure is based on automated processing
is based and has effects that have a significant impact on the person concerned
affect the actions of the third party to which this
Probability value is transmitted, is largely guided by this.

63 Furthermore, the data subject could, as the Advocate General did in point 48
in his opinion, on the one hand with the credit reporting agency,
which determines the probability value that concerns them, their right to
Information about the specific ones mentioned in Article 15 Paragraph 1 Letter h GDPR




Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                        December 21, 2023

                                                        48 out of 53




Do not claim information if not automated

decision-making by this company. On the other hand it would be
the third party - assuming that the action taken by him
would fall under Art. 22 Para. 1 GDPR, as it meets the requirements for the
Application of this provision met - unable to comply with this specific
to provide information because he generally does not have it.

64 That the determination of a probability value like that in
The main proceedings in question are covered by Article 22 (1) GDPR,
has the effect, as stated in paragraphs 53 to 55 of this judgment,
that it is prohibited, unless one of the things mentioned in Art. 22 Para. 2 GDPR

Exceptions is applicable and the special requirements of Article 22
Paragraphs 3 and 4 GDPR are fulfilled.
65 What concerns in particular Article 22 Paragraph 2 Letter b GDPR, to which the

The reference to the referring court is clear from the wording of that court
Provision that national legislation authorizing the adoption of a
allow automated decision-making in individual cases
Measures to safeguard the rights and freedoms of those entitled to them
must contain the interests of the person concerned.

66 In the light of recital 71 of the GDPR, such
Measures include in particular the obligation of the person responsible to
to use appropriate mathematical or statistical methods, technical
and to take organizational measures in an appropriate manner

ensures that the risk of errors and errors is minimized
be corrected, and to secure personal data in a way that
the potential threats to the interests and rights of those affected
Person is taken into account and in particular to prevent it from happening to her
discriminatory effects occur. These measures
also include at least the right of the data subject
Obtaining the intervention of a person on the part of the person responsible

Presenting your own point of view and challenging those against it
issued decision.
67 It should also be noted that, according to settled case law

Court of Justice any processing of personal data with the in
Art. 5 GDPR stipulated principles for processing
personal data are consistent and in view of the provisions of Article 5
Paragraph 1 letter a of the principle of legality of the
Processing one of the conditions listed in Article 6 of this Regulation
for the lawfulness of the processing (judgment of

October 20, 2022, Digi, C‑77/21, EU:C:2022:805, paragraph 49 and there
cited case law). The person responsible must ensure compliance with this
Principles in accordance with the principle laid down in Article 5 Para. 2 GDPR




Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                        December 21, 2023

                                                        49 out of 53




be able to demonstrate accountability (cf. in this sense judgment of

October 20, 2022, Digi, C‑77/21, EU:C:2022:805, paragraph 24).
68 Is required by the legislation of a Member State in accordance with Article 22
Paragraph 2 letter b GDPR the issuance of an exclusively on one

Decision based on automated processing is permitted, this must be the case
Processing therefore not only those in the last-mentioned provision and in
22 Paragraph 4 GDPR, but also
the requirements in Articles 5 and 6 of this Regulation. Consequently, they may
Member States do not have legislation under Article 22
Paragraph 2 letter b GDPR enacted, according to which profiling is disregarded

the requirements of these Articles 5 and 6 as interpreted by the
The case law of the Court of Justice is admissible.
69 What in particular is that in Article 6 Paragraph 1 Letters a, b and f GDPR

the conditions for legality provided for in a case
like that in the main proceedings can apply
Member States are not authorized to apply additional rules
of these conditions, since such a power is provided for in Article 6
Paragraph 3 GDPR refers to those in Article 6 Paragraph 1 Letters c and e of this Regulation
reasons mentioned is limited.

70 What also concerns Article 6 Paragraph 1 Letter f GDPR in detail, may
the Member States are not affected by the GDPR in accordance with Article 22 Paragraph 2 Letter b of the GDPR
Requirements differ from the case law of the Court

according to the judgment of December 7, 2023, SCHUFA Holding
(Residual debt discharge) (C‑26/22 and C‑64/22, EU:C:2023:XXX), result,
especially not because they are the result of weighing each other up
conclusively prescribe conflicting rights and interests (cf. in
to this effect, judgment of October 19, 2016, Breyer, C‑582/14, EU:C:2016:779,
62).

71 In the present case, the referring court points out that only
§ 31 BDSG is a national legal basis within the meaning of Article 22 Paragraph 2
Letter b GDPR could represent. Regarding the compatibility of this
However, § 31 BDSG with Union law applies to this court

profound concerns. This provision should be considered consistent with Union law
are viewed as incompatible, SCHUFA would not only be without it
legal basis, but would ipso iure violate the provisions of Article 22
Paragraph 1 of the GDPR.

72 In this respect, it is for the referring court to examine whether Section 31 BDSG
qualifies as a legal basis within the meaning of Article 22 Paragraph 2 Letter b GDPR
according to which it would be permissible to use one exclusively on one
to adopt a decision based on automated processing. should that
The referring court comes to the conclusion that Section 31 is such




Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023

                                                                  50 out of 53




         legal basis, it would still have to examine whether the provisions in Article 22
         Paragraph 2 letter b and paragraph 4 GDPR and in Articles 5 and 6 GDPR
         requirements are met in this case.

         73 In view of the foregoing, the answer to the first question is that Article 22
         Paragraph 1 of the GDPR must be interpreted as meaning that an “automated decision”.
         in individual cases' within the meaning of this provision if a
         personal data about a person based probability value in

         Regarding their ability to meet future payment obligations
         is created automatically by a credit reporting agency, provided that it does so
         The probability value depends significantly on whether a third party is responsible for this
         Probability value is transmitted, a contractual relationship with this
         Person establishes, carries out or terminates.”


75 5.4.2. From the reasons for the judgment given above
         of the ECJ it can be concluded that the application of an automated

         Processing - such as AMAS - as such already constitutes a decision
         of Art. 22 Para. 1 GDPR can represent, without justification

         legal basis within the meaning of Article 22 Paragraph 2 Letter b GDPR - the
         Justifications for the necessity of automated

         Decision to conclude a contract within the meaning of Article 22
         Paragraph 2 lit. a GDPR or the existence of consent within the meaning of

         Article 22 Paragraph 2 Letter c GDPR is not at issue on a case-by-case basis - the ban

         of Article 22 Paragraph 1 GDPR. Is there such an automated one?
         Before making a decision, the relevant national legislation must comply with the

         Allow the automated decision to be made in individual cases and also
         appropriate measures to safeguard rights and freedoms as well as the

         legitimate interests of the data subject (cf. the
         Statements by the ECJ in C-634/21, paragraph 65).


76 According to the statements in the ECJ judgment cited, one
         Automated data processing - such as profiling - itself an “automated

         Decision in individual cases” within the meaning of Article 22 Paragraph 1 GDPR if
         the result of this automated processing for a

         certain - further - decision is decisive insofar as the action

         of the third party is “significantly guided” by the profiling in question, and so on
         significantly affects those affected (cf. the statements of the ECJ in

         C-634/21, paragraphs 48 and 73).



         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023

                                                                  51 out of 53




77 5.4.3. Depending on the case, this results in the following:


78 5.4.3.1. First of all, it should be noted that the classification of the
         mP applied automated, based on a mathematical-statistical

         program processing of personal data
         affected job seekers (in AMAS) as “profiling” in the sense

         of Art. 4 Z 4 GDPR in accordance with the case law of the ECJ

         in C-634/21 cannot be doubted.

79 According to the ECJ, this is already automated

         Processing - here the determination of the IC value, which is the probability
         integration into the labor market - itself (already) identified as one

         “automated decision” within the meaning of Article 22 Paragraph 1 GDPR,
         provided that this probability value determines the allocation to the

         intended customer groups, and thus those affected
         legal effect towards job seekers or similar

         Significantly impaired.

80 That the final decision on the customer group allocation lies with the

         Consultants of the mP are able to qualify the AMAS as one

         automated decision within the meaning of Art. 22 Para. 1 GDPR is not applicable
         prevent, the judgment of the ECJ is based on the facts that

         Ultimately, the potential lender decides on the question of how the loan comes about
         the credit agreement in question there. The - possibly - pure

         formal separation of data processing from automated data processing is crucial
         decision influenced by the automated data processing itself,

         prevents the latter from being classified against the background of Art. 22 GDPR

         This is a fundamentally forbidden decision (cf. again
         ECJ C-634/21, paragraph 73). The finding of the BVwG that through

         Instructions and training ensured that the
         mP consultants do not question the result of the algorithm unconditionally

         would take over, may now justify the assumption that

         Classification into the respective customer group is not exclusive
         due to the AMAS. However, this finding does not rule out that




         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023

                                                                  52 out of 53




         AMAS - as an automated decision - is ultimately decisive for this

         Classification is.

81 Since the BVwG based on its - against the background of the judgment of

         ECJ does not make any findings on the legal opinion that is to be regarded as incorrect

         precise use of the AMAS - especially not specific ones
         Findings on the question of which other parameters and to what extent

         Take into account, or what procedure to use the
         AMAS is provided - has already taken the question of

         Automated processing is not relevant in this case

         be assessed exhaustively legally.

82 5.4.3.2. Should the use of AMAS fall within the scope of Article 22

         Paragraph 1 of the GDPR would result in it being prohibited unless
         one of the exceptions mentioned in Article 22 Paragraph 2 GDPR is applicable and

         the special requirements of Article 22 Paragraphs 3 and 4 GDPR are met.

83 Art. 22 Paragraph 2 Letter b GDPR contains an opening clause that allows the Union

         and the Member States open up legislation for automated

         to create decisions. The relevant - justifying - national ones
         However, legislation would need to allow for the adoption of the automated

         Allow decisions to be made in individual cases and also take appropriate measures
         Safeguarding the rights and freedoms as well as the legitimate interests of the

         the person concerned (cf. the ECJ's comments in C-634/21,

         65). Furthermore, these would have to comply with the requirements of Articles 5 and 6 of the GDPR
         the interpretation of which is sufficed by the case law of the Court of Justice

         (cf. again ECJ C-634/21, para. 68).

84 The AMSG now obviously does not contain any provision with regard to the

         case-related processing - the AMAS - the justification of the
         Article 22 Paragraph 2 Letter b GDPR would be fulfilled.


85 The GDPR understands “legal basis” - and therefore also under
         “Legal provision” in Article 22 Paragraph 2 Letter b GDPR - Recital 41

         not necessarily one “adopted by a parliament”.

         legislative act”. However, whether this is the case for the application of AMAS


         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2021/04/0010-11
                                                                  December 21, 2023

                                                                  53 out of 53





         profiling, the claims of recital 41
         legal requirements sufficient in terms of clarity, precision and predictability

         A basis exists that meets the ECJ's requirements for the opening clause

         (cf. again C-634/21, paras. 65 and 68), was by
         BVwG - based on the legal opinion that AMAS does not constitute an automated system

         Decision within the meaning of Article 22 Paragraph 1 GDPR - not examined.

86 5.5. According to the above, the appeal was ultimately upheld

         and the contested finding as a result of the existence of the provisions under point 5.4.
         secondary deficiencies in the findings due to the illegality of the

         content in accordance with Section 42 Paragraph 2 Z 1 VwGG.


87 The BVwG will continue the proceedings as part of an oral hearing
         Negotiation against the background of point 5.4. shown

         Legal situation to discuss the legal situation with the parties and take this opportunity
         to provide a statement or additional facts.


         Vienna, December 21, 2023






























         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at