OSCE – Dismissed (Austria, 2023)

Data subject one is an ambassador of a government and worked for the controller. Data subject two is married to data subject one. The controller is an international organisation, the Organization for Security and Co-operation in Europe (OSCE). The controller initiated an internal investigation against data subject one after a sexual harassment and discrimination complaint about them by a former employee of the controller. Data subject one argued the allegations were not true. During the internal investigation, Whatsapp and Telegram messages between the data subjects were disclosed, which did not reveal any harassing or discriminatory behaviour. The work phone of data subject one was also confiscated during the investigation without their consent. As part of the investigation, a large amount of content of the first complainant's work mobile phone was extracted and analysed. Content that had already been deleted had also been restored. Although the employee's allegations had not been confirmed, data subject one had been informed that the extracted or deleted and restored photos contained both nudity and pornographic content and that therefore proceedings would be initiated against them for violation of the controller’s code of conduct. The extracted data largely concerned the private and family life of data subject one. The health data of data subject one’s parents had also been revealed during the investigation. Therefore, data subject one requested the erasure of the unlawfully obtained data and to indicate which personal data had been obtained and which recipients the personal data was disclosed to. The controller replied that it would not comply with the two requests due to its immunity. The data subjects filed a complaint at the Austrian DPA (“Datenschutzbehörde”). The data subjects claimed there was a violation of their right to confidentiality as the controller analysed the work phone of data subject one on which (sensitive) personal data of the data subjects were stored. The data subjects argued that not only the professional data had been analysed, but also the private content, which had also been labelled as such. They argued there was no legal basis for this. The data subjects further argued that their right to access was violated, because they were not informed of the recipients who received their personal data. The data subjects further argued that their right to erasure was violated. The DPA first examined whether they were competent to decide on the matter. The DPA explained that under Article 4(7) GDPR, international organisations are not excluded from being defined as a controller. The DPA held that the criterion of the territorial scope under Article 3 GDPR was also fulfilled, as the controller had an official seat in Vienna. In general, the material scope under Article 2(1) GDPR would also apply as the DPA found that automated data processing took place. Moreover, the DPA found that there was an agreement in place between the Republic of Austria and the controller which regulated the legal status and immunities of the controller (see [https://www.ris.bka.gv.at/Dokumente/BgblAuth/BGBLA_2018_III_84/COO_2026_100_2_1531327.pdfsig the Headquarters Agreement]). Although international organisations do not enjoy complete immunity from their actions in the host state, the DPA only has jurisdiction if this is provided for or not explicitly denied by a headquarters agreement. The Headquarters Agreement between the controller and the Republic of Austria provided that the laws of Austria (and thus also the GDPR) shall apply to the controller, unless the controller had established their own specific regulation (see Article 5(6)(a) of the Headquarters Agreement). The DPA found that the controller had relevant internal regulations in place for the protection of personal data (the "OSCE Personal Data Protection Administrative Instruction No. 2/2022"), which included a right to appeal and a possibility to be granted legal protection. Therefore, the GDPR did not apply in material terms and thus, the DPA held that the right to lodge a complaint with the DPA must be denied. The DPA did note that the controller’s internal regulations regarding the protection of personal data are not comparable to the GDPR in terms of scope and, in particular, the possibility of legal protection. The DPA noted that the data subject’s constitutionally guaranteed rights may have been violated by the controller’s regulations. However, the DPA held that it could not examine whether these regulations were unconstitutional for this reason, as this was exclusively a matter for the Constitutional Court pursuant to Austrian national law (see [https://www.ris.bka.gv.at/eli/bgbl/1930/1/A140a/NOR40045850 Article 140a B-VG]). Therefore, the DPA dismissed the complaint.