Barichgasse 40-42
A-1030 Vienna
Tel.:+ 43-1-52152 302563
E-mail:[email protected]
GZ:D130.340 Clerk:
2021-0.049.824
Data protection complaint
D E C I S I O N
S P E E C H
The data protection authority decides on the data protection complaint of
(complainant) dated 12 September 2019 against (respondent) for violation of the right to
erasure as follows:
- The complaint is dismissed.
Legal basis: Art 4 Z 23 lit. b, Art. 51 para. 1, Art. 56 Para. 1, 57 para. 1 lit. f, Art. 60 para. 8, Art. 77 para.
1 and Art. 85 of the Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR), OJ No. L
119, 4.5.2016, p. 1; §§ 18 para. 1 and 24 para. 1 and para. 5 of the Data Protection Act (DSG), BGBl.
I No. 165/1999 as amended.
JUSTIFICATION
A. Arguments of the parties and course of proceedings
1. In her complaint sent to the Austrian data protection authority on 12 September 2019, the complainant
who resides in Austria, essentially alleged that the website shows her personal data.
Obviously, her Swedish mobile phone provider at the time had passed on her data. On 13 June 2019,
she submitted a request for deletion to the respondent by e-mail. However, the respondent did not
respond.
2. Since the case involved a cross-border issue, the Austrian data protection authority placed the case
in the "Internal Market Information (IMI) System" used under the consistency mechanism to handle the
cross-border procedure under the provisions of the GDPR. It turned out that the main establishment of
the respondent is in Sweden. Accordingly, pursuant to Art. 56 Para. 1 GDPR, the Swedish supervisory
—2—
authority is the lead supervisory authority in these proceedings. This fact was communicated to the
complaint by letter dated 23 January 2020.
3. The Swedish supervisory authority submitted a draft decision on 13 November 2020 in accordance
with Art.60 (3) GDPR. This essentially states that so-called publication certificates ("utgivningsbevis")
can be applied for websites under Swedish law. The Swedish Press and Broadcasting Authority is
responsible for issuing the publication certificates. This meant that data protection laws were not
applicable to information published on such websites. The website operated by the respondent had
obtained such a publication certificate. The GDPR allows Member States to make exceptions to the
rules if this is necessary to safeguard the right to freedom of expression and information (Art. 85 GDPR).
The Swedish Constitution (Freedom of the Press Act) allows such information to be published. There
is an exceptional provision pursuant to Art. 85 GDPR, so that the GDPR is not applicable. There is
therefore no competence of the Swedish supervisory authority
B. Subject-matter of the complaint
The subject matter of the complaint is the question whether the respondent has thereby violated the
complainant's right to erasure pursuant to Art. 17 GDPR by not complying with the request for erasure.
C. Establishment of the facts
The data protection authority bases its decision on the facts of the case as set forth in item A. and
documented in the file.
D. From a legal point of view, it follows:
The data processing subject of the complaint is cross-border data processing within the meaning of
Article 4(23)(b) of the GDPR, as the complainant is resident in Austria, but the controller (respondent)
is established in Sweden. The lead supervisory authority was therefore the Swedish supervisory
authority pursuant to Art. 56 para. 1 GDPR.
In the course of the proceedings, the lead Swedish supervisory authority came to the conclusion that
the complaint concerns a matter that is not subject to the scope of application of the GDPR or the
competence of the Swedish supervisory authority. Sweden has in fact - similar to Austria in § 9 para. 1
of the Austrian Data Protection Act - made use of the "opening clause" contained in Art. 85 GDPR and
established exceptions for such data processing operations in order to safeguard the right to freedom
of expression and information.
—3—
The Swedish supervisory authority notified the Austrian data protection authority of this circumstance
pursuant to Art. 60 para. 3 GDPR in its decision of 13. November 2020. There was no occasion for a
relevant and reasoned objection.
If a complaint is rejected or dismissed, the supervisory authority to which the complaint was submitted
shall adopt the decision and notify the complainant and inform the controller, in accordance with Art. 60
para. 8 GDPR. This is the case here. For this reason, the decision in question is issued by the Austrian
data protection authority.
Therefore, the decision had to be made in accordance with the ruling.
LEGAL NOTICE
An appeal against this decision may be lodged in writing with the Federal Administrative Court within
four weeks of notification. The complaint must be lodged with the data protection authority and must be
- the name of the contested decision (GZ, subject)
- the name of the authority being prosecuted,
- the grounds on which the allegation of illegality is based,
- desire and
- the information necessary to assess whether the complaint has been lodged in good time, must be
included.
The data protection authority may within two months either amend its decision by means of a preliminary
decision on the complaint or submit the complaint with the files of the proceedings to the Federal
Administrative Court. The appeal against this decision is subject to a fee. The fixed fee for a
corresponding submission including enclosures is 30 euros. The fee is to be paid into the account of
the tax office for fees, transaction taxes and gambling (IBAN: AT83 0100 0000 0550 4109, BIC:
BUNDATWW), whereby the respective appeal procedure (business number of the notice) is to be stated
as the purpose of payment on the payment order.
In the case of electronic transfer of the appeal fee with the "tax office payment", the tax office for fees,
transaction taxes and gambling (IBAN as before) must be stated or selected as the recipient. In addition,
the tax number/tax account number 109999102, the tax type "EEE - complaint fee", the date of the
notice as the period and the amount must be stated.
The payment of the fee must be proven to the data protection authority when the complaint is lodged
by means of a original payment receipt confirmed by a postal office or a credit institution, which must
—4—
be attached to the submission. If the fee is not paid or not paid in full, a report is sent to the competent
tax office.
A timely filed and admissible appeal to the Federal Administrative Court has suspensive effect. The
suspensive effect may have been excluded in the ruling of the decision or may have been excluded by
a separate decision
January 22, 2021
For the head of the data protection authority: