unknown teacher (claimant) – Court Ruling (Austria, 2022)

In 2019, the first defendant (the "developer") developed an app for students to rate school teachers (the "app"). In December 2019 the developer founded the second defendant (the "platform"), a limited liability company, and offered the app for download using the platform. In early 2020, the Austrian Data Protection Authority conducted an ex officio investigation into the platform's data protection conduct. This investigation was later ceased without a formal decision. The claimant was a school teacher whose name and school could be seen in the app, making him subject to ratings by users of the app. They argued that the data processing on the app violated their rights to data protection. They never consented to be subject to ratings on the app and argued that there was also no other legal basis under Article 6(1) GDPR that the app could rely on to make the data processing lawful. They further argued that the app didn't provide sufficient safeguards to prevent people other than their students to rate them. In their lawsuit, the teacher demanded the first instance court, Landesgericht Wien (LG Wien), to disallow the possible future processing of his personal data by the defendants and to order the defendants to erase the data relating to the teacher under Article 17 GDPR. The LG Wien dismissed the lawsuit, holding in essence that the legitimate interests to provide ratings on the teacher outweighed their interests under Article 6(1)(f) GDPR. Hence the court considered the processing to be lawful. The teacher filed an appeal. The second instance court, Oberlandesgericht Wien (OLG Wien), upheld the lawsuit and ordered the developer and the platform to stop the processing until it was ensured that only actual students of the teacher could rate them. It argued that, as the app offered no safeguards against unjustified ratings by random strangers, the teacher's interest under Article 6(1)(f) overrode that of the developer and the platform and the data were to be deleted un