Franz A – Dismissed (Austria, 2021)

The data subject was a shareholder and managing director of two companies. The controller operated a free online search platform that allowed users to look up companies registered in the Austrian companies register and see, for a given company, which natural persons held positions such as shareholder or managing director, as well as an overlay showing what other companies those persons were connected to. The controller obtained the underlying data from a commercial information provider, which in turn sourced it from the Federal Ministry of Justice under a data-reuse agreement covering companies register documents. The controller funded the free service through advertising displayed on the platform. The data subject had no contractual relationship with the controller. A direct name search for the data subject on the controller's platform returned no results, however, searching for a company in which he held a position returned his name together with his role (managing director, sole shareholder with a 100% stake) and through an „i“ icon, an overlay listing his positions in other companies. The data subject complained to the Austrian DPA, arguing that the controller published his name without any contract between them and without any identifiable legitimate interest justifying the publication. The controller argued that its processing pursued a legitimate commercial interest, enabling business participants to research potential contractual partners and pointed out that companies register data was already public and accessible to anyone under national law, including via other commercial and official information services. First, the DPA rejected the controller's argument that the data was already available and therefore outside the scope of a secrecy interest altogether. It held, citing CJEU case-law C-73/07, that a blanket assumption that lawfully published data cannot be subject to a legitimate secrecy interest is incompatible with EU law requirements. Second, the