Dieter A. (data subject) – Dismissed (Austria, 2024)

In October 2023, a data subject filed a complaint with the DPA under Article 77 GDPR against the Austrian Court of Audit as the controller. The data subject argued that the public disclosure of their political donation on the official website violated their right to confidentiality of sensitive data. The disclosed information included the data subject's name and the donation amount. They asserted that this publication revealed sensitive personal data, in particular political opinions, which they claimed should be protected under Article 9 GDPR. The data subject maintained that despite a national legal transparency requirement (§ 6 PartG), the extent of data published went beyond what was proportionate and necessary. The DPA processed the complaint and suspended proceedings pending a preliminary ruling from the Court of Justice of the European Union (CJEU) on the applicability of the GDPR to certain parliamentary bodies (Case: [https://eur-lex.europa.eu/eli/C/2024/1653/oj/eng C-33/22]). First, the authority found that the controller had a lawful basis in national political party financing law to publish the donation information. Publication served the legitimate public interest in transparency of party financing and was not disproportionate, which falls under Article 9(2)(g) GDPR. Second, the DPA considered that even if the published data could be characterised as revealing political opinions, the specific legal obligation to disclose such information justified the processing and did not infringe Article 9(1) GDPR. The controller’s statutory duty to publish detailed financial information outweighed the data subject’s confidentiality interest. The DPA rejected the complaint as it held that the controller’s publication of the political donation did not constitute unlawful processing of sensitive personal data under Article 9 GDPR.