Public Employment Service – Dismissed (Austria, 2022)

The controller was a service provider in accordance with public law — in particular, they oversaw the federal government’s labor market policy. In order to search for job openings on company websites, the controller used an algorithm — AMS job robot — and subsequently published the results on their own homepage. The background information pertaining to the position from the original advertisement was integrated into the JobRobot web ad. In addition, a link was embedded into the advertisement that took users directly to the job website of the respective company. When an original job advertisement was removed, the advertisement on the controller’s homepage was also deleted. Updates related to job offers would (typically) take place within 24 hours. On 21 September 2021, the data subject argued that the controller violated their right to confidentiality by publishing the data subject’s data from a job advertisement on the controller’s own homepage. Regarding the data subject’s standing According to Section 1 and 24 Data Protection Act (Datenschutzgesetz), legal persons fall within the scope of protection, and can lodge complaints to assert the rights granted therein. Regarding the right to confidentiality Section 1, paragraph 1 Data Protection Act stipulates that everyone has the right to maintain personal data related to them confidential, if there is a legitimate interest in doing so. The exceptions to this is, however, if such data is generally available or cannot be traced back to the person concerned. The GDPR is limited to the processing of personal data of natural persons. In the present case, the data subject was a legal person, so the GDPR was inapplicable and the exception under Section 1, paragraph 1 Data Protection Act had to subsequently be considered. Data is considered ‘generally available’ if it is open to an unlimited and undetermined group of users — this requires a case-by-case assessment. In the present case, the data subject published the j