Federal Minister of Finances – Violation Found (Austria, 2022)

On 16 December 2021, the corruption inquiry committee ordered the Minister of Finances as a controller to disclose information regarding potential criminal financial proceedings initiated against an Austrian politician, as data subject. On 24 January 2022, in an attempt to prevent such disclosure from happening, the data subject requested the Austrian DPA to issue a ban on the processing pursuant to Article 58(2)(f) GDPR. The data subject stated that the issue therein lay not in the transmission of information itself, but rather in the inquiry’s lack of confidentiality, citing past leaks to the media. Moreover, the data subject noted an absence of a legal basis for the processing of his personal data, claiming that this would constitute a violation against Article 5 GDPR and Article 6 GDPR. The Federal Minister of Finances denied the competence of the DPA, relying on recent decisions stating that the GDPR does not cover core legislative activities as provided for in Article 2(2)(a) GDPR. He argued that in this case he did not act in his role as part of the executive branch, but rather on behalf of the legislative branch, acting as an auxiliary body thereof and being subject to submission to the parliament’s inquiry committee. Furthermore, the Federal Minister of Finances pointed out that the threat to confidentiality interests worthy of protection would arise only, if at all, in the sphere of the inquiry committee in parliament. The DPA denied the Federal Minister of Finances’ claim to function solely on behalf of the legislative branch, as he is not obliged to submit to the inquiry commission in every case and thus retains his function as an organ of the executive branch. As a consequence, the DPA asserted to have the general competence of reviewing the actions of the Federal Minister of Finances under the GDPR. However, the DPA nevertheless rejected the data subject’s request, stating that its role is limited to ex-post control. The DPA held that ex-ante control