DSB (DPA) – Court Ruling (Austria, 2023)

On 4 October 2020, the controller sent a non-anonymised court judgement of the Regional Criminal Court (Landesgericht für Strafsachen) as a PDF file to a different recipient via WhatsApp. Less than a year later, on 28 July 2021, the same non-anonymised court judgement was sent to the same recipient again, this time via email. The data subject lodged two complaints with the DPA (DSB) regarding the violation of their right to secrecy under [https://ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=05.07.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=431b02ed-230a-4be2-a50e-f77708a2abbc § 1(1) DSG]. In the first proceedings (DSB-D124.5125), the DPA ruled on the transmission of the judgement via WhatsApp and notably highlighted that the transmission via email was not the subject of the proceedings. In the second procedure (DSB-D124.0310/22) concerning the transmission via email, the DPA dismissed the complaint on the grounds that the data subject had no legitimate interest of legal protection and referred to its first administrative decision. The data subject appealed against the second decision of the DPA and asked the court to decide in that subject matter. In their opinion, the two transmissions of the judgement at different times represent two separate data processing operations. First, the court held that, in this specific case, there was no identity of the subject matter in comparison with the first proceedings within the meaning of § 68(1) AVG. In accordance with established legal practice ([https://ris.bka.gv.at/Dokument.wxe?ResultFunctionToken=2498006d-98c9-4ef7-88cb-e77a1951304e&Position=1&SkipToDocumentPage=True&Abfrage=Vwgh&Entscheidungsart=Undefined&Sammlungsnummer=&Index=&SucheNachRechtssatz=True&SucheNachText=False&GZ=&VonDatum=&BisDatum=07.07.2026&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=2006%252f05%252f0158&Dokumentnummer=JWR_2006050158_20060731X02 VwGH 31.07.2006, 2006/05/0158]; [https://www.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Vwgh&Dokumentnummer=JWR_2006100093_20070621X02 VwGH 21.06.2007, 2006/10/0093] etc.), the court based its decision on the legal and temporal identity of the case. On the one hand, the data processing operation via email took place at a later date. On the other hand, the resulting time difference could lead to a potentially different legal assessment compared to the previous proceedings. Second, the court ruled that it could only examine the rightfulness of the dismissal of the complaint and therefore could not rule on the subject matter itself (See, for example, [https://ris.bka.gv.at/Dokument.wxe?ResultFunctionToken=49e294ba-c55a-46d0-90dc-55b0cd6363be&Position=1&SkipToDocumentPage=True&Abfrage=Vwgh&Entscheidungsart=Undefined&Sammlungsnummer=&Index=&SucheNachRechtssatz=True&SucheNachText=False&GZ=2014%2525252f07%2525252f0002&VonDatum=&BisDatum=07.07.2026&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Dokumentnummer=JWR_2014070002_20141218L01 VwGH 18.12.2014, Ra 2014/07/0002]). Third, the court held that no appeal to the Austrian Supreme Administrative Court (Verwaltungsgerichtshof) was admissible pursuant to [https://ris.bka.gv.at/eli/bgbl/1930/1/A133/NOR40201324?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=B-VG&Gesetzesnummer=&VonArtikel=133&BisArtikel=&VonParagraf=&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=07.07.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=93ea127c-63af-4e72-8a63-8d95bb8fb1bc Article 133(4) B-VG], as the decision raised no legal questions of fundamental importance. Therefore, the court quashed the DPA's administrative decision DSB-D124.0310/22.