Franz A – Dismissed (Austria, 2021)

The data subject was a shareholder and managing director of two companies. The controller operated a free online search platform that allowed users to look up companies registered in the Austrian companies register and see, for a given company, which natural persons held positions such as shareholder or managing director, as well as an overlay showing what other companies those persons were connected to. The controller obtained the underlying data from a commercial information provider, which in turn sourced it from the Federal Ministry of Justice under a data-reuse agreement covering companies register documents. The controller funded the free service through advertising displayed on the platform. The data subject had no contractual relationship with the controller. A direct name search for the data subject on the controller's platform returned no results, however, searching for a company in which he held a position returned his name together with his role (managing director, sole shareholder with a 100% stake) and through an „i“ icon, an overlay listing his positions in other companies. The data subject complained to the Austrian DPA, arguing that the controller published his name without any contract between them and without any identifiable legitimate interest justifying the publication. The controller argued that its processing pursued a legitimate commercial interest, enabling business participants to research potential contractual partners and pointed out that companies register data was already public and accessible to anyone under national law, including via other commercial and official information services. First, the DPA rejected the controller's argument that the data was already available and therefore outside the scope of a secrecy interest altogether. It held, citing CJEU case-law C-73/07, that a blanket assumption that lawfully published data cannot be subject to a legitimate secrecy interest is incompatible with EU law requirements. Second, the DPA held that the controller's processing constituted a new form of data use requiring independent justification, because the controller did not merely reproduce publicly accessible companies register data, but recombined and cross-linked it, thereby creating additional informational value beyond what a simple companies register search would reveal. Third, applying the balancing test under Article 6(1)(f) GDPR and Section 1(2) DSG, the DPA found that the controller had a legitimate interest in operating its platform, both a commercial interest of its own (generating advertising revenue) and a legitimate interest of platform users and market participants generally in being able to assess a business partner's other company affiliations. The DPA weighed this against the data subject's interest in secrecy and concluded that the balance favoured the controller, for three reasons: 1. the underlying data's general availability in the companies register reduced (though did not eliminate) its protection-worthiness 2. the data related exclusively to the data subject's professional sphere as someone who had voluntarily chosen to participate in commercial life as a shareholder and managing director 3. the resulting interference with his data protection rights was accordingly of low intensity. The DPA therefore rejected the complaint as unfounded.