DSB (DPA) – Court Ruling (Austria, 2023)

On 28.11.2019, the data subject received their regional government's administrative decision regarding the recognition of previous qualifications and their experience in becoming a mountain sports guide. On 12.02.2020, the controller attempted to challenge the decision and sent an email to further recipients besides the affected authority. They expressed their concerns and included unredacted parts of the administrative decision. On 18.12.2020. the data subject lodged a complaint with the Austrian DPA (DSB) regarding the violation of their right to confidentiality under [https://ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=13.07.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=b2435486-6818-41ec-a0f8-4150a50eb221 §1(1) DSG]. On 09.12.2021, the DPA partly confirmed the data subject's complaint, stating that the the email contained personal data of the data subject under Article 4(1) GDPR. The controller subsequently appealed against the DPA's decision on 05.01.2022, arguing that their actions were justified by legitimate interests in safeguarding professional standards and public safety pursuant to Article 6(1)(f) GDPR. Furthermore, only parts of the administrative decision were cited, thereby adhering to the principle of data minimisation under Article 5(1)(c) GDPR. First, the court held that the data subject had neither consented to the processing of their personal data nor was the processing in their vital interest under [https://ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=13.07.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=b2435486-6818-41ec-a0f8-4150a50eb221 §1(2) DSG]. Second, the controller had the obligation to determine the purpose of the data processing (see 12.02.2020) before executing it rather than throughout the proceedings under Article 5(1)(b) GDPR. The subsequent supplemental citation of the purpose is not reconcilable with the principle of good faith (Article 5(1)(a) GDPR). Third, the court stated that, in reference to the CJEU's decision in [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252 'Meta Platforms and Others' (C-252/21) ECLI:EU:C:2023:537], the burden of proof lies with the controller to demonstrate in a for the data subject understandable way that the data processing was legal, legitimate and necessary under Article 5(2) GDPR. Fourth, the court held that the supplemental citation of the purpose did not justify the processing of the data subject's personal data, since sending a warning to certain recipients with the affected data redacted was feasible. Therefore, the processing was not necessary under Article 6(1)(e) GDPR and Article 6(1)(f) GDPR. Hence, the court dismissed the appeal as unfounded. Fifth, the court held that no appeal to the Austrian Supreme Administrative Court (Verwaltungsgerichtshof) was admissible pursuant to [https://ris.bka.gv.at/eli/bgbl/1930/1/A133/NOR40201324?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=B-VG&Gesetzesnummer=&VonArtikel=133&BisArtikel=&VonParagraf=&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=13.07.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=4c0c3096-fcc5-4494-8001-860e8840f341 Article 133(4) B-VG], as the case was primarily centred on questions of fact, and no legal questions of fundamental importance were raised. The decision was also entirely aligned with established case law.