Ex-employee (data subject) – Complaint Upheld (Austria, 2021)

The data subject worked for the former Austrian Federal Office for the Protection of the Constitution and Counterterrorism (BVT). In 2018, the Austrian Federal Ministry of the Interior submitted files to the BVT parliamentary inquiry committee of the Austrian National Council (BVT-UA). The ministry transferred the files with the classification level “Confidential”. However, the files contained unredacted personal data relating to the data subject and details about the data subject’s professional activities. The disclosure reached the 18 members of the inquiry committee, while all members of the Austrian National Council could inspect the documents. The ministry argued that a federal constitutional law obliged public bodies to provide parliamentary inquiry committees with complete and unredacted files within the scope of the investigation. The data subject filed a complaint with the Austrian DPA, arguing that the disclosure violated the right to confidentiality under local laws and the GDPR. First, the DPA noted that the federal constitutional law generally required authorities to provide inquiry committees with unredacted files. However, the DPA stressed that there is an exception for information whose disclosure could endanger intelligence sources. It found that the data subject qualified as such a protected intelligence source. Therefore, the ministry should not have disclosed information revealing the data subject’s intelligence-related activities without redactions. Second, the DPA held that the ministry breached the proportionality requirement under [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=1&Paragraf=1&Anlage=&Uebergangsrecht= § 1(2) DSG], as it should have used the least intrusive means available. According to the DPA, the ministry could have achieved its goals by submitting redacted files instead of fully identifiable documents. Third, the DPA held that the disclosure also violated Article 5(1)(a) GDPR and Article 5(1)(c) GDPR, as the data subject could not reasonably expect the ministry to disclose unredacted information about intelligence-related activities to the inquiry committee and the committee’s investigative purpose could have been achieved with redacted documents. The DPA upheld the complaint and found that the ministry violated the data subject’s right to confidentiality.