Court case W256 2275675-1 – Court Ruling (Austria, 2023)

On 9 March 2023, a data subject asked the Arbeitsmarktservice (the public employment service), as a controller, to change their gender on the platform from “male” to “divers”. In this, the data subject also submitted an official document proving the change of gender entry in the civil register. On 15 March, the controller replied that it could not do so as it was impossible to with the software used. A few days later, the data subject filed a complaint with the Austrian DPA (DSB) claiming that their right to rectification under Article 16 GDPR had been violated. In its submissions, the controller stated that it was planning to implement a system allowing to change one’s gender on the platform, but this would only be available in June 2023, that is, still within the deadline of additional two months foreseen in Article 12(3) GDPR. The controller claimed that, once the technical changes will be implemented, it will proceed to change the data subject’s gender. The data subject submitted that the controller could have complied with their request by June 2023, if the controller would have informed the data subject about the additional time needed, even though the controller actually had enough time before that in order to duly adapt its technical system. Since the controller did not do that, but instead answered that they will not follow the request, Article 12(3) GDPR is not relevant. Later, however, the controller let the DSB know that it would take it even longer to adopt the technical implementations required to allow the data subject to change their gender on the platform. The DSB, however, suspended the proceedings on the basis of [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10005768&FassungVom=2017-07-12&Artikel=&Paragraf=38&Anlage=&Uebergangsrecht= Article 38 of the General Administrative Procedures Act (AVG)] until the CJEU delivers its judgment on the preliminary questions in case C-247/23, received on 18 April 2023, which concerned the interpretation of Article 16 GDPR. The data subject claimed that the DSB was not allowed to suspend proceedings since the case pending before the CJEU was not relevant to the procedure in question. Hence, the case was submitted for review to the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG held that the DSB may have a right to suspend administrative proceedings under [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10005768&FassungVom=2017-07-12&Artikel=&Paragraf=38&Anlage=&Uebergangsrecht= §38 AVG] and in line with the jurisprudence of the Supreme Administrative Court, also in case of a pending preliminary ruling before the CJEU, where such ruling is decisive for the administrative proceedings in question. To be considered decisive for administrative proceedings, a pending ruling by another court or authority must first be a decision concerning a question that is necessary in order to answer the main query in the proceedings; secondly, the pending decision must be binding on the authority. The questions referred to the CJEU did concern the interpretation of Article 16 GDPR, but as regards the obligation to change a data subject’s gender in a registry upon request. In the case at hand, however, the controller did not refuse to do so, but it stated that it will do so once the technical implementations necessary thereto are adopted. In the case at hand, the issue regards a delay in complying with the data subject’s request of rectification, the question being whether the controller has a right to delay compliance with the request by another 2 months as foreseen in Article 12(3) GDPR. The preliminary ruling by the CJEU, thus does not have a decisive impact on the proceedings, as it deals with different matters that are not relevant for the DSB to take a decision. The BVwG further clarified that, generally, in order to suspend proceedings before an authority it is sufficient there is at least a “similar” question pending before another court. However, the mere fact that in this case the two procedures both dealt with questions regarding Article 16 GDPR did not make them sufficiently similar, as the actual object of the procedures differed substantially. The BVwG thus annulled the suspension of proceedings by the DSB.