Court case W176 2245370-1 – Court Ruling (Austria, 2021)

The controller operates a doctor search and evaluation platform. The data subject is a doctor for skin and venous diseases. In December 2019, the data subject used the reporting function of the platform to request the deletion of a user's review pursuant to Article 17(1) GDPR. The controller did not remove the disputed review from the platform, but instead published the controller's request for deletion on the platform, arguing that there is a legitimate interest for the publication of this information under Article 6(1)(f) GDPR. The data subject objected to the publication and lodged a complaint with the Austrian Data Protection Authority (DSB). The Austrian Data Protection Authority (DSB) disagreed with the controller's view. It stated that, generally, such evaluation platforms and the associated processing of personal data are covered by the right to freedom of expression in accordance with Article 10 ECHR and Article 11 CFR. It further reasoned that, usually, the added social value created by the evaluation platform or the interests of the broader public outweigh the interests of the data subject, so that the publication of comments by users of this platform can in principle be based on Article 6(1)(f) GDPR. The DSB, however, concluded that, since the data subject used the report function and not the comment function of the page, the use of the data was intended exclusively for the purpose of reporting and, therefore, the data subject did not reasonably have to expect the publication of the data. Consequently, the DSB found that the legitimate interests of the controller or the platform users (i.e. the patients) did not outweigh the legitimate interests of the controller and, therefore, the controller violated the data subject's right to deletion. The controller appealed this decision. The Federal Administrative Court of Austria (Bundesverwaltungsgericht - BVwG) agreed with the position of the DSB. In particular, it confirmed the balancing of interests performed by the DSB. Furthermore, it held that the controller was obliged to delete the published request for deletion under Article 17(1)(d) GDPR and that the controller could not invoke Article 17(3) GDPR, because non of its requirements were met in the case at hand.