doctor and sole managing director of the laboratory (first data subject) – Complaint Upheld (Austria, 2023)

In August 2021, an unprotected Excel file containing the names and PCR test results of several thousand individuals was sent from the compromised email account of the first data subject, which was administered by the second data subject. The file was then forwarded by a third party to the first and second controller, who reported about the case on 01. September 2021 in their online news portals. On 02. September 2021, the second data subject requested the deletion of the news articles. The first controller forwarded this request alongside their response to the second controller. Both controllers rejected the deletion request on grounds of the journalistic exemption (Medienprivileg) under [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A2P9/NOR40201397?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=9&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=BGBl+I+Nr+24%2f2018&Position=1&SkipToDocumentPage=true&ResultFunctionToken=b49884a7-7ca2-4b7e-b190-c849f2424782 § 9(1) DSG], and also asked further questions about the case. On 09. September 2021, the second data subject requested information from both controllers regarding the processing, transmission and purpose of their data and trade secrets. Only the second controller replied to the request, stating that the data processing was for journalistic purposes and, hence, there was no right to deletion in this specific case under the media law (Mediengesetz). On 10. September 2021, the first data subject requested the provision of all their data under Article 15 GDPR from both controllers. The second controller replied on 11. October 2021, and the first controller on 15. April 2022 by essentially providing master data and other data in relation to their services. On 26. November 2021, the data subjects lodged a complaint with the DPA regarding the violations of their right of access, and, additionally, for the second data subject, their rights to erasure and confidentiality. First, the DPA held that the controllers did not violate the second complainant's right to deletion. After the controllers refused the deletion request, the second data subject replaced it with an information request and, therefore, was not upheld when the complaint was lodged. The DPA would not have decided differently in the reverse case, as the right to deletion under Article 17(3)(a) GDPR did not apply since the processing of the affected data was necessary to exercise the right of freedom of expression and information. Furthermore, the right to deletion under Article 17(3)(e) GDPR did not apply for the defence of legal claims, as these proceedings proved that. Second, the DPA held that the disclosure of the deletion request to the second controller did not constitute a violation of the second data subject's right of confidentiality. The second data subject was aware that both controllers were operating within a research community. In a democratic society, the media have a central role in the public interest as 'public watchdogs' (e.g. [https://hudoc.echr.coe.int/eng#{%22itemid%22:[%22001-167828%22]} ECHR in 'Magyar Helsinki Bizottság v. Hungary' (18030/11)]; or [https://www.ris.bka.gv.at/Dokument.wxe?Abfrage=Vfgh&Entscheidungsart=Undefined&Sammlungsnummer=&Index=&SucheNachRechtssatz=True&SucheNachText=False&GZ=E4037%2f2020&VonDatum=&BisDatum=23.08.2026&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=f8d93555-6ad8-40bb-929a-def3ef47bf20&Dokumentnummer=JFR_20210304_20E04037_01 VfGH 04. March 2021, E4037/2020]). Thus, the information exchange constitutes a legitimate interest arising from the freedom of expression under [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 10 ECHR] and [https://eur-lex.europa.eu/legal-content/EN-DE/TXT/?from=DE&uri=CELEX%3A12016P%2FTXT&qid=1786588233314 Article 11 EU-CFR]. In addition, since both controllers had received an identical request on 02. September 2021, a shared approach as a research community was necessary, constituting the least intrusive means. Third, the DPA held that both controllers had to comply with both the first and second data subject's request and to provide the following missing information relating to the media reporting on 01. September 2021 under Article 15(1)(a)-(d) GDPR. However, the controllers rightfully denied the disclosure of their source, as this would undermine the journalistic privilege (Redaktionsgeheimnis) under [https://www.ris.bka.gv.at/eli/bgbl/1981/314/P31/NOR40095086?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=Mediengesetz&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=31&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=06.10.2023&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=4860f0ff-ef61-4bd3-b0bd-2369c7d77435 § 31 Mediengesetz].