First complainant (data subject) – Court Ruling (Austria, 2024)

The data subject participated in a hunting event on 3 November 2018. During the event, another person (the controller) filmed and photographed the hunt and the data subject in order to document hunting practices and publish the material online. At the time of the recording, the data subject received no information about the the identity of the controller, the purposes of data processing, or the recipients of the data (Article 13 GDPR). On 6 November 2018, the data subject submitted an access request under Article 15 GDPR. He asked about the purposes of the processing, the categories of data processed, recipients, storage periods, legal basis, and requested a copy of all personal data concerning him. The controller did not respond. The data subject then filed a complaint at the Austrian DPA on 09 January 2019. The controller argued before the Austrian DPA that the recordings served journalistic purposes and therefore fell under the Austrian media privilege in § 9 DSG. He claimed that he acted as a form of “citizen journalist” and that complying with access requests would obstruct investigative journalism. The DPA rejected the argument that the media privilege applied. It nevertheless dismissed the data subject's complaint concerning Article 13 GDPR because it considered that the data subject already knew enough about the controller and the intended publication. However, the DPA upheld the complaint concerning Article 15 GDPR and ordered the controller to answer the access request. Both parties appealed to the Federal Administrative Court. First, the court held that the controller processed personal data within the meaning of Article 4(1) and Article 4(2) GDPR by recording photo and video material showing the data subject during the hunting event. Second, the court held that the Austrian media privilege in § 9 DSG did not apply. The court found that the controller was neither a media undertaking nor a media service within the meaning of Austrian media law. The controller published material on a private Facebook account and lacked the minimum organisational and economic structures required for a media enterprise. The court also rejected an extension of the exemption to “citizen journalists”. It noted that the Austrian legislature had intentionally drafted § 9 DSG narrowly and that an expansive interpretation would contradict the wording and legislative intent. The court further held that even a broader interpretation of § 9 DSG would not exempt the controller from complying with Article 15 GDPR because answering an access request would not undermine freedom of expression or journalistic activity in the circumstances of the case. Third, the court confirmed that the controller violated Article 15 GDPR by failing to answer the access request. Fourth, the court overturned the DPA’s finding regarding Article 13 GDPR. The court held that the controller violated Article 13 GDPR because he failed to provide the required information at the time he collected the image data. The court rejected the argument that the data subject already possessed the relevant information under Article 13(4) GDPR. The court also clarified that a later disclosure of information during proceedings could not retroactively remedy a violation of Article 13 GDPR. Finally, the court dismissed the controller’s appeal, upheld the access request by the data subject, and amended the decision to additionally establish a violation of Article 13 GDPR.