unnknown data subject – Court Ruling (Austria, 2021)

Both data subject and (alleged) controller are natural persons using Facebook. The controller is the admin of several Facebook groups and the data subject had joined one of these groups that dealt with "stress coping". The data subject and the controller engaged in a chat on Facebook, which the controller took screenshots of and disclosed them to the ex-boyfriend of the data subject. For these reasons, the data subject filed a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB) which, in turns, argued that the GDPR did not apply because the relevant online-activities have not been publicly visible. The DSB interrogated the ex-boyfriend as a witness and then upheld the complaint. It held that the data disclosure violated the right to secrecy under § 1 Austrian Data Protection Act (Datenschutzgesetz - DSG). However, the DSB did not assess the case under the GDPR. The controller filed an appeal against this decision with the Federal Administrative Court. (Bundesverwaltungsgericht - BVwG). The BVwG did not issue a decision on the merits of the case but remitted it to the DSB, ordering it to properly establish the facts of the case by pointing out a variety of omissions and errors. For example, the BVwG held that the DSB failed to assess which personal data of the data subject have actually been disclosed to the witness (ex-boyfriend of the data subject alleged data recipient) and if the witness already had been in possession of these data before. Furthermore, the DSB had failed to address several relevant questions to the witness, ignored several statements of the controller and ambiguities in the data subject's submissions, failed to interrogate the data subject and did not explain its consideration of evidence. On a legal level, the BVwG held that the DSB failed to assess whether the household exemption under Article 2(2)(c) GDPR applied on the case, since the controller is a natural person and the data disclosed stems from a private chat which has only been shared with one other individual. In this regard, the DSB also failed to assess, whether the controller' activity as admin of several Facebook groups was purely personal or - as argued by the data subject - part of the controller's entrepreneurial activities. Consequently, the BVwG ordered the DSB to establish the facts of the case properly and to then assess it under the GDPR, taking into account that the household exemption applies.