DSB – Court Ruling (Austria, 2024)

The data subject applied for legal aid for court proceedings. The application for legal aid and the data subject’s objection as well as the decision of the district court to grant legal aid were submitted to the lawyer of the other party in the proceedings, who forwarded these documents, including the declaration of assets, to their client. Subsequently, these documents were forwarded by the other party in the proceedings to a third party. On 6 April 2023, the data subject lodged a complaint with the Austrian DPA (“Datenschutzbehörde – DSB”) against the other party for forwarding the documents to a third party. The DPA held that the forwarding of the application for legal aid, including the declaration of assets, violated the principle of data minimisation pursuant to Article 5(1)(c) GDPR. The other party appealed this decision at the Federal Administrative Court (“Bundesverwaltungsgericht - BVwG”). The court upheld the appeal and annulled the DPA’s decision. The court held that the DPA failed to question the third party, to whom the application for legal aid including the declaration of assets had been forwarded to, whether they had already been aware of the transmitted data beforehand. As the DPA had not made any findings on this question, the court could also not establish facts necessary for a decision on this matter. Therefore, the case should be referred back to the DPA to complete the facts of the case quickly and in a cost-saving manner. The DPA appealed this decision at the Supreme Administrative Court (“Verwaltungsgerichtshof - VwGH”) and argued that it cannot be inferred from the wording of Article 57(1)(f) GDPR that the DPA is obliged to investigate beyond "to the extent appropriate". In the present case, it could not be said that the "appropriate extent" of the investigation was not reached. Moreover, there was also a lack of case law from the Administrative Court on Article 57(1)(f) GDPR. The annulment of the DPA’s decision by the Federal Administr