Barichgasse 40-42
A-1030 Vienna
Tel.: +43-1-52152 302581
E-Mail: [email protected]
Ref. No.: D130.087 clerk:
2020-0.778.655
Data protection complaint (erasure)
/ (IMI-Nr.: A56ID 48938, A61VM 90233, A60DD 164846)
Decision of the data protection authority
DECISION
SPEECH
The data protection authority decides on the data protection complaint of
(complainant) of 7.8.2018 against (respondent) for violation of the right to erasure
as follows:
- The complaint is dismissed.
Legal basis: Art 4 Z 23 lit. b, Art. 51 para. 1, Art. 56 Para. 1, 57 para. 1 lit. f, Art. 60 para. 8, Art. 77
para. 1 and Art. 85 of the Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR),
OJ No. L 119, 4.5.2016, p. 1; §§ 18 para. 1 and 24 para. 1 and para. 5 of the Data Protection Act
(DSG), BGBl. I No. 165/1999 as amended.
JUSTIFICATION
A. Arguments of the parties and course of proceedings
1. In her complaint submitted to the Austrian data protection authority, the complainant, who resides in
Austria, essentially alleged that personal data relating to her was visible on the website
" " operated by the complainant. She had attended a postgraduate course in
Sweden from 2012 to 2013 and had a Swedish cell phone contract at the time. She suspected that the
data published on the website had reached the complainant via this cell phone contract. She had not
consented to any publication.
-2–
She had sent a request for deletion to the respondent by e-mail on July 18, 2018. However, the
respondent had not responded to it.
2. Since the case involved a cross-border issue, the Austrian data protection authority placed the case
in the "Internal Market Information (IMI) System" used under the consistency mechanism to handle the
cross-border procedure under the provisions of the GDPR. It turned out that the main establishment of
the respondent is , located at .
Accordingly, pursuant to Art. 56 Para. 1 GDPR, the Swedish supervisory authority is the lead
supervisory authority in these proceedings. This fact was communicated to the complainant by letter
dated 13.12.2018, GZ DSB-D130.087/0004-DSB/2018.
3. The Swedish supervisory authority submitted a draft decision on 20.11.2020 pursuant to Art. 60 para.
3 GDPR. This essentially states that so-called publication certificates ("utgivningsbevis") can be applied
for for websites under Swedish law. The Swedish Press and Broadcasting Authority is responsible for
issuing the publication certificates. This meant that data protection laws were not applicable to
information published on such websites. The website operated by the respondent had obtained such a
publication certificate. The GDPR allows Member States to make exceptions to the rules if this is
necessary to safeguard the right to freedom of expression and information (Art. 85 GDPR). The Swedish
Constitution (Freedom of the Press Act) allows such information to be published. There is an
exceptional provision pursuant to Art. 85 GDPR, so that the GDPR is not applicable. There is therefore
no competence of the Swedish supervisory authority.
B. Subject-matter of the complaint
The subject matter of the complaint is the question whether the respondent has thereby violated the
complainant's right to erasure pursuant to Art. 17 GDPR by not complying with the request for erasure.
C. Establishment of the facts
The data protection authority bases its decision on the facts of the case as set forth in item A. and
documented in the file.
D. From a legal point of view, it follows:
The data processing subject of the complaint is cross-border data processing within the meaning of
Article 4(23)(b) of the GDPR, as the complainant is resident in Austria, but the controller (respondent)
-3–
is established in Sweden. The lead supervisory authority was therefore the Swedish supervisory
authority pursuant to Art. 56 para. 1 GDPR.
In the course of the proceedings, the lead Swedish supervisory authority came to the conclusion that
the complaint concerns a matter that is not subject to the scope of application of the GDPR or the
competence of the Swedish supervisory authority. Sweden has in fact - similar to Austria in § 9 para. 1
of the Austrian Data Protection Act - made use of the "opening clause" contained in Art. 85 GDPR and
established exceptions for such data processing operations in order to safeguard the right to freedom
of expression and information.
The Swedish supervisory authority notified the Austrian data protection authority of this circumstance
pursuant to Art. 60 para. 3 GDPR in its decision of 20.11.2020. There was no occasion for a relevant
and reasoned objection.
If a complaint is rejected or dismissed, the supervisory authority to which the complaint was submitted
shall adopt the decision and notify the complainant and inform the controller, in accordance with Art. 60
para. 8 GDPR. This is the case here. For this reason, the decision in question is issued by the Austrian
data protection authority.
Therefore, the decision had to be made in accordance with the ruling.
LEGAL NOTICE
An appeal against this decision may be lodged in writing with the Federal Administrative Court within
four weeks of notification. The complaint must be lodged with the data protection authority and must
be
- the name of the contested decision (GZ, subject)
- the name of the authority being prosecuted,
- the grounds on which the allegation of illegality is based,
- desire and
- the information necessary to assess whether the complaint has been lodged in good time,
must be included.
The data protection authority may within two months either amend its decision by means of a
preliminary decision on the complaint or submit the complaint with the files of the proceedings to the
Federal Administrative Court.
The appeal against this decision is subject to a fee. The fixed fee for a corresponding submission
including enclosures is 30 euros. The fee is to be paid into the account of the tax office for fees,
-4–
transaction taxes and gambling (IBAN: AT83 0100 0000 0550 4109, BIC: BUNDATWW), whereby the
respective appeal procedure (business number of the notice) is to be stated as the purpose of
payment on the payment order.
In the case of electronic transfer of the appeal fee with the "tax office payment", the tax office for fees,
transaction taxes and gambling (IBAN as before) must be stated or selected as the recipient. In
addition, the tax number/tax account number 109999102, the tax type "EEE - complaint fee", the date
of the notice as the period and the amount must be stated.
The payment of the fee must be proven to the data protection authority when the complaint is lodged
by means of a original payment receipt confirmed by a postal office or a credit institution, which must
be attached to the submission. If the fee is not paid or not paid in full, a report is sent to the competent
tax office.
A timely filed and admissible appeal to the Federal Administrative Court has suspensive effect. The
suspensive effect may have been excluded in the ruling of the decision or may have been excluded
by a separate decision.
January 7, 2021
For the head of the data protection authority: