Court case W252 2249734-1 – Court Ruling (Austria, 2023)

On 15 June 2020, a USB-stick containing a set of documents, including internal information of a company, was anonymoulsy sent to the Austrian DPA (Datenschutzbehörde - DSB) . The DPA thus started an ex officio investigation and concluded, by decision of 6 November 2021, that the controller, as head of the company, failed to meet security requirements as it saved personal data on a private and unsafe device. Upon learning about the decision, the controller appealed the latter to the Austrian Federal Administrative Court (BVwG), stating, amongst other things, that the DPA was not allowed to start such a procedure against the controller and the decision lacked a reasonable motivation. The controller also submitted that the DPA failed to take into account the fact that the USB-stick had actually been stolen by an employee of the controller. On its part, the DPA claimed that the appeal should be rejected by the Court. The Court considered the appeal to be admissible and held that it cannot be inferred from Article 58 GDPR that competent supervisory authorities may adopt declaratory statements on the unlawfulness of processing activities on the basis of an ex officio investigation. In its decision, the Court referred to the a judgment by the Supreme Administrative Court of Austria (Verwaltungsgerichtshof – VwGH) in case Ro 2020/04/0032-8, and held that Article 58 GDPR does not contain an explicit legal basis for such decisions to be issued. In particular, the Court stressed the fact that according to [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 Article 24 of the Austrian Data Protection Law (Datenschutzgesetz - DSG]), the DPA is only specifically allowed to issue declaratory statements on the infringement of a data protection provision on the basis of a complaint. Consequently, this is not possible in the case of an ex officio investigation by the DPA. In light of this, the Court held that the appeal should be upheld since the decision by the DPA lacked a legal basis and shall thus be repealed.