Court case Ro 2022/04/0026 – Court Ruling (Austria, 2024)

The data subjects, joint operators of a hotel and restaurant business, ran their establishment through a family business. The controller operates an online travel platform accessible in Austria, on which registered users can post reviews and experience reports about listed establishments, in addition to general information. The data subjects' business was listed on the platform without their consent and was reviewed by users a few times per month, in comments that identified the data subjects by name, including both positive and negative reviews. On 27 June 2019, the data subjects requested that the controller erase all their personal data from the platform. The controller did not comply. On 28 August 2019, the data subjects lodged a complaint with the Austrian DPA, alleging unlawful processing and a violation of their right to erasure under Article 17(1)(d) GDPR. The DPA rejected the complaint on 18 September 2020, relying on Article 6(1)(f) GDPR (legitimate interests) as the legal basis for the processing. The data subjects appealed to the Federal Administrative Court (BVwG), which held an oral hearing and dismissed the appeal on 13 May 2022. The BVwG found that the platform's processing served a legitimate interest in freedom of expression and information that the reviews concerned the data subjects' social andprofessional sphere rather than their private sphere, that it was reasonable to expect the data subjects to monitor the platform for unjustified criticism and that the controller had taken adequate measures against abusive reviews. The BVwG declared an appeal on points of law (Revision) admissible, citing the absence of Supreme Administrative Court case-law on the principles governing the balancing of interests for review platforms under Article 6(1)(f) GDPR. The data subjects appealed to the Supreme Administrative Court. The court dismissed the appeal as unfounded, addressing each contested element of the three-part test under Article 6(1)(f) GDPR (legitimate interest, necessity, no overriding interest of the data subject). On legitimate interest: The court held that the exercise of freedom of expression and information can constitute a legitimate interest under Article 6(1)(f) GDPR. It reasoned that both service recipients' freedom to express opinions about service quality and the conduct of those providing the service and prospective recipients' freedom to access such opinions, were protected by this provision and that the platform served this purpose by enabling reviews and structured searches. The court held that the controller's pursuit of commercial interests alongside this function did not undermine the legitimate interest, since Article 6(1)(f) GDPR expressly covers interests of the controller "or a third party" and the data subjects had not substantiated their claim that the controller had abandoned a neutral intermediary role. It also rejected the argument that the public's interest was too narrow to qualify as legitimate merely because the hotel's clientele was limited, holding that such considerations belong to the separate balancing-of-interests stage, not to the threshold question of whether a legitimate interest exists at all. On the sphere of privacy affected: The court agreed with the lower court that the reviews concerned the data subjects' social sphere (specifically, their professional sphere as hotel operators) rather than their private sphere, since the criticised conduct occurred in public in the course of providing services to third parties. It held that this classification does not change merely because the business could hypothetically be sold to a third party in future, such a change of circumstances could be considered if and when it actually occurred, but did not retroactively reclassify the current processing. On the reasonableness of monitoring the platform: The court held that requiring the data subjects to check the platform for reviews was not excessive, given the low frequency of reviews, the availability of an email notification service and the fact that hotel operators offering services to the public must accept a degree of observation and criticism. The court limited the relevant comparison to the controller's own platform, not all review platforms on which the business might be listed, since only a claim against this controller was at issue. On protection against abuse: The court held that the absence of identity verification for reviewers was a relevant factor in the balancing exercise, but that a blanket requirement for reviewers to identify themselves would be disproportionate, given the recognised value of anonymous expression online. It held that the controller's existing measures allowing establishment representatives to report abusive reviews for removal, were sufficient, although it criticised the lower court's findings on this point as underdeveloped. However, since the data subjects failed to show that any specific personal data would have been removed had a stricter verification system existed, this shortcoming did not establish unlawfulness in the specific case. On the second data subject's claim of heightened risk as a former political figure: The court held that a data subject wishing to invoke a "particular situation" under Article 21 GDPR must lodge an actual objection to processing on that basis; simply mentioning a past political role during proceedings did not amount to such an objection and the erasure request had in fact been based solely on unlawful processing under Article 17(1)(d) GDPR, not the objection-based ground under Article 17(1)(c) GDPR. Finally, the court declined the data subjects' request for a preliminary reference to the CJEU, noting that the CJEU has already made clear that the case-specific balancing of interests under Article 6(1)(f) GDPR is a matter for the national court. (C-252/21)