Austrian Data Protection Authority – Court Ruling (Austria, 2023)

The controller, the Public Employment Service in Austria, supports workers in (re)integrating into the labour market by offering various services, including a counsellor that discusses labour market opportunities with the jobseeker. In order to assess the jobseeker’s labour opportunities on the market, the controller used an algorithm to calculate the degree of probability for jobseekers to be employed for a certain number of days, based on: (1) age group, (2) gender, (3) country group, (4) education, (5) health impairment, (6) care responsibilities, (7) occupational group, (8) career history and (9) the regional labour market situation and the duration of cases at the controller. The algorithm did not include motivation, self-help potential of the jobseeker, addiction, debt or housing situation. Based on this, the algorithm divided jobseekers into the following three groups: (1) Service jobseekers with high labour market opportunities, (2) Care jobseekers with low labour market opportunities, (3) Consultancy jobseekers with medium labour market opportunities. The result was used as a starting point for counsellors to work with jobseekers to assess their potential and any obstacles in the labour market integration. The algorithm itself was not used for job placement, but only for targeted support and assistance, meaning, choosing the right support strategy based on which group the jobseeker was assigned to. The controller claimed it had a legal basis under Austrian national law (the Arbeitsmarktservicegezetz, AMSG) to process data with the help of an algorithm. Under Article 4(4) GDPR, this processing of data is considered profiling. According to Austrian data protection law (see [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563 Article 1 §2 DSG]), processing for the performance of a public task needs to be authorised in Asutrian law. However, the DPA found that a legal basis for this processing could not be found in the AMSG. The DPA also held that the case at issue was a case of automated individual decision-making under Article 22 GDPR. Although the results of the algorithm were not binding, as the final decision lies with the counsellor, the DPA noted that it could be ruled out that in individual cases, the decision will be based exclusively on profiling. Therefore, the Austrian Data Protection Authority (DSB) issued a ban due to lack of a sufficient legal basis for the processing. The controller appealed this decision at the Federal Administrative Court (Bundesverwaltungsgerichts, BVwG). The Federal Administrative Court upheld the controller’s appeal against the decision of the DPA. The Court held that the controller is allowed to carry out this processing of personal data in accordance with national law ( [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10008905&Artikel=&Paragraf=25&Anlage=&Uebergangsrecht=  §25(1) AMSG ]) and therefore has a legal basis. Moreover, Article 22 GDPR does not apply, as the final decision lies with the counsellors and therefore the decision-making is not based solely on automated processing. However, the Court held that the controller should provide counsellors with instructions and training to ensure they do not accept the result of the algorithm unquestioningly. The Court concluded that the DPA decision should be annulled due to the lack of violation of the principle of lawful data processing under Article 5(1)(a) GDPR. The DPA appealed the decision before the Supreme Administrative Court (Verwaltungsgerichtshof, VwGH). The DPA argued that the Federal Administrative Court did not take into account the character of profiling as a special processing procedure and challenged the lawfulness of the processing under Article 22 GDPR. The Supreme Administrative Court found that the lawfulness of the data processing at issue in the proceeding must be examined against the background of Article 22 GDPR. The Court found that the controller’s algorithmic process in itself is an automated decision under Article 22(1) GDPR, based on the recent CJEU decision C-634/21 - Schufa. The Court explained that the algorithm decided on the allocation of jobseeker’s group and thus has a legal effect on the jobseekers concerned or similarly significantly affects them. The fact that the final decision on the jobseeker’s group assignment lies with the counsellor, does not prevent the algorithm from being classified as an automated decision under Article 22(1) GDPR. The Supreme Administrative Court found that the instructions and trainings that were provided to ensure counsellors would not accept the algorithm’s results unquestioningly could not exclude the possibility that the algorithm is ultimately decisive for the allocation. The Court further held that the algorithm did not fall under the exceptions of Article 22(2) GDPR. Therefore, the Court concluded that the appeal had to be upheld and that the decision of the Federal Administrative Court needed to be set aside, de facto confirming the violations identified by the DPA.