DPA case 2022-0.876.190 – Order (Austria, 2022)

In the case at hand, a data subject complained about the embassy of the Republic of N*** in Vienna (the controller) to the Austrian DPA. (The concerned Republic had been censored in the published decision.) As part of the N*** 2022 elections, an electoral roll, which included the data subject’s name, date of birth and voter register number, was posted on the outside of the controller’s office building. This electoral roll was therefore accessible to the general public. The subject of the complaint was the question of whether the controller violated a data subject's right to secrecy by publishing their personal data. Before the DPA addressed the concrete substance of the allegation it first had to assess its competence. In its decision, DPA found itself not competent. It did so based on two lines of reasoning. One related to the Articles 55 and 56 GDPR, the other based on the Vienna Convention on Diplomatic Relations. First, the DPA assessed the provisions of the GDPR. Pursuant to Article 55(1) GDPR, any supervisory authority responsible for the fulfilment of the tasks and the exercise of the powers assigned to it by the GDPR, have jurisdiction in the territory of their own Member State. The data protection authority is therefore the supervisory authority responsible for the sovereign territory of the Republic of Austria (see §18(1) of the Austrian Data Protection Law). Nevertheless, in this case the DPA noted that the complaint is directed against the embassy of a third country. It pointed out that modern international law does not count embassies among the exclaves of another state, but assigns them to the receiving state. Therefore, since the embassy of the Republic of N*** is in Vienna, it is part of Austrian territory and the responsible DPA for data processing in the Embassy would therefore, in principle, be the Austrian DPA pursuant to Article 55(1) GDPR. However, the DPA further considered the exception of Article 55(2) GDPR which states that local DPA's