Court case G 287/2022-16, G 288/2022-14 – Court Ruling (Austria, 2022)

Prompted by two complaints again decisions of the Austrian DPA, which were brought in before it, the Austrian Federal Administrative Court questioned the constitutionality of § 9(1) Austrian Data Protection Law (DSG) and sent an application to the Austrian Constitutional Court for the assessment of the constitutionality of § 9(1) DSG. Besides through the GDPR, and in contrast to the majority of other EU member states, data protection in Austria is also covered by the constitutional right to data protection and secrecy pursuant to § 1 DSG. This stood in contrast with § 9(1) DSG, which provided a blanket data protection exemption for a broad category of media actors. The first complaint, which the Federal Administrative Court took note of, was the case G 287/2022, which concerned an alleged data protection breach of a media company. The company had published a report and images of a house search, including unredacted pictures of a data subject's business card. The DPA rejected the complaint, arguing that considering the "media privilege" pursuant to § 9(1) DSG, it was not competent to handle the complaint. In complaint number two, concerning case G 288/2022, data subjects argued that a publishing company and a broadcasting company had unlawfully disclosed a "data leak" at an e-mail box attributable to the data subjects. Similar to the complaint mentioned above, the DPA deemed itself not competent pursuant to § 9(1) DSG. The data subjects in both cases appealed to the Federal Administrative Court which further sent an application to the Constitutional Court for the assessment of the constitutionality of § 9(1) DSG. The Austrian Constitutional Court sided with the data subjects and held that the "blanket" exemption, which § 9(1) Data Protection Act gives to media owners and journalists, is unconstitutional and not in line with the requirements of Article 85 GDPR. § 9(1) DSG provides - in implementation of the obligation under EU law pursuant to Article 85(1) GDPR - that the provisions of the DSG (and several chapters of the GDPR) do not apply to the processing of personal data by media owners, publishers, media staff and employees of a media company or media service within the meaning of the Austrian Media Act for journalistic purposes of the media company or media service. In its assessment, the Constitutional Court first noted that the legislator is subject to a double binding, namely a binding to Union law (in this case the opening clause of Article 85 GDPR) and a binding to the framework established by constitutional law. The relevant provision of Union law, Article 85 GDPR, only states that Member State should provide for "derogations or exemptions" to the GDPR for the processing of personal data for journalistic purposes "to the extent necessary to reconcile the right to the protection of personal data with the freedom of expression and information." Therefore, the Court held that Union law does not require the Austrian legislator to enact a provision according to which any data processing of media owners, publishers, media staff and employees of a media enterprise or media service within the meaning of the Media Act is completely exempted from the DSG and the GDPR. On the contrary, Article 85 GDPR obliges the Member States to define the relationship between data protection and freedom of expression in more detail to ensure an appropriate balance between the conflicting fundamental rights positions. As the regulatory content of § 9(1) DSG is not mandatory under EU law, the Constitutional Court held that the provision is subject to its review with regard to its conformity with domestic constitutional law. In the Austrian constitutional law in question, § 1 DSG, the Austrian fundamental right to data protection, § 1(1) DSG guarantees everyone the right to confidentiality of personal data concerning him or her, insofar as he or she has an interest worthy of protection, in particular with regard to respect for private life. § 1(2) DSG contains a material legal limitation in this regard. Apart from the use of personal data in the vital interest of the person concerned or with his or her consent, restrictions on the right to confidentiality are only permissible to protect the overriding legitimate interests of another person. On the basis of the fundamental right to data protection pursuant to § 1(1) DSG in conjunction with § 1(2) DSG, the Court thus held that the legislator is always required to weigh the interests of the data subject in the protection of his or her personal data against the opposing (legitimate) interests of another party. Consequently, the fundamental right to data protection pursuant to §1(1) DSG does not allow the legislator to categorically exclude the applicability of all data protection regulations of a substantive and procedural nature under the DSG in their entirety within the scope of application of the "media privilege". The Court therefore held § 9(1) DPA to be unconstitutional. In addition, although the Court did not elaborate its legal reasoning (or only to a limited extent), it also held that § 9(1) DPA would also have been unconstitutional under other Austrian constitutional law (namely, the principle of equality pursuant to [https://www.jusline.at/gesetz/b-vg/paragraf/artikel7 Article 7 B-VG] and [https://www.jusline.at/gesetz/stgg/paragraf/artikel2 Article 2 StGG], the right to a trial before the lawful judge pursuant to [https://www.jusline.at/gesetz/b-vg/paragraf/artikel83 Article 83(2) B-VG], the right to protection of personal data pursuant to [https://fra.europa.eu/en/eu-charter/article/8-protection-personal-data Article 8 CFR], and the right to privacy pursuant to [https://www.echr.coe.int/documents/convention_eng.pdf Article 8 ECHR]).