Barichgasse 40-42
A-1030 Vienna
Tel.: +43-1-52152 302578
E-Mail: [email protected]
Ref. No.: D130.087 2020-0.778.655 clerk:
Data protection complaint (erasure)
(A56ID 48459, A60DD 164838)
Decision of the data protection authority
D E C I S I O N
S P E E C H
The Data Protection Authority decides on the data protection complaint of (complainant)
dated 08 June 2018 against (opponent) for violation of the right to erasure as follows:
— The complaint is dismissed.
Legal basis:Art. 4 subpara 23 lit. b, Art. 51 para 1, Art. 56 para 1, 57 para 1 lit. f, Art. 60 para 8, Art. 77 para
1 and Art. 85 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter:GDPR), OJ
L 119, 4.5.2016 p. 1;§§ 18 para 1 and 24 para 1 and para 5 of the Data Protection Act (DSG), Federal Law
Gazette I No. 165/1999 idgF.
— 2 —
E X P L A N A T O R Y M E M O R A N D
A. Arguments of the parties and proceeding
1. In her complaint sent to the data protection authority, the complainant resident in Austria essentially
argued that the respondent’s website showed personal data from her.She completed
a postgraduate course in Sweden from 2012 to 2013 and had a Swedish mobile phone contract at the
time.It presumed that the data published on the website had reached the complainant via this mobile phone
contract.It did not agree to any publication.
InJune 2018, it submitted a request for deletion to the respondent by e-mail.However, the latter refused to
delete it.
2. Since this is a cross-border matter, the data protection authority put the case in the “Internal Market
Information (IMI) system”, which is used in the context of the coherence procedure to handle the cross-
border procedure in accordance with the provisions of the GDPR.It turned out that the respondent’s main
place of business is in Sweden.
According to Art. 56 (1) GDPR, the Swedish supervisory authority is the leading supervisory authority of this
procedure.This circumstance was communicated to the appellant.
3. The Swedish supervisory authority considered itself responsible for the content handling and submitted
a draft decision on 20 November 2020 in accordance with Art. 60(3) GDPR.This essentially shows that for
websites under Swedish law, so-called “utgivningsbevis” can be applied for.The Swedish Press and
Broadcasting Authority was responsible for issuing the publication certificates.This means that the data
protection laws are not applicable to information published on such websites.The website operated by the
respondent received such a publication certificate.The GDPR allows Member States to make exceptions to
the regulations if this is necessary in order to safeguard the right to freedom of expression and information
(Art. 85 GDPR).The Swedish Constitution (Press Freedom Act) allows such information to be
published.There is a derogation according to Art. 85 GDPR.There was no competence of the Swedish
supervisory authority.
B. Subject-matter of the complaint:
The subject-matter of the complaint is whether the Respondent has thereby infringed the complainant in its
right to erasure in accordance with Art. 17 GDPR by failing to comply with the request for deletion.
C. Establishment of the facts:
The data protection authority shall base its decision on the facts set out in point A. and documented on
time.
— 3 —
D. From a legal point of view, it follows:
The subject-matter data processing is a cross-border data processing in accordance with Art. 4 subpara 23
lit. b GDPR, since the complainant is domiciled in Austria, but the person responsible (opponent) is
established in Sweden.The leading supervisory authority was therefore the Swedish supervisory authority
in accordance with Art. 56 (1) GDPR.
In the course of the proceedings, the leading Swedish supervisory authority came to the conclusion that the
complaint concerns a matter which is not subject to the scope of the GDPR or to the competence of the
Swedish supervisory authority. Sweden has made use of the “opening clause” contained in Art. 85 GDPR,
similar to Austria in § 9 para. 1 DSG, and has set exceptions for such data processing operations in order
to safeguard the right to freedom of expression and information.
In its decision of 20 November 2020, the Swedish supervisory authority informed the Austrian data
protection authority of this circumstance in accordance with Article 60(3) GDPR. There was no reason for a
decisive and reasoned opposition.
If a complaint is rejected or rejected, the supervisory authority with which the complaint has been lodged
shall issue the decision and notify the complainant to the complainant in accordance with Article 60(8)
GDPR. It’s the case here. For this reason, the present decision is taken by the Austrian Data Protection
Authority.
It was therefore appropriate to decide.
L E G A L N O T I C E
A complaint to the Federal Administrative Court may be lodged against this decision in writing within four
weeks of notification.The complaint must be lodged with the data protection authority and must:
- the name of the contested decision (GZ, subject)
- the designation of the authority concerned;
- the grounds on which the allegation of illegality is based,
- desire as well as
- the information necessary to assess whether the appeal has been lodged in time;
— 4 —
included.
The data protection authority has the option, either by means of a preliminary complaint decision, to amend
its decision or to submit the complaint with the files of the procedure to the Federal Administrative
Court.
The appeal against this communication is subject to a fee. The fixed fee for a corresponding input
including supplements is EUR 30.The fee is due to the account of the Tax Office for Fees, Traffic Taxes
and Gambling (IBAN:AT83 0100 0000 0550 4109, BIC:BUNDATWW) where the respective complaint
procedure (the number of transactions of the communication) must be indicated on the payment order as
intended for use.
In the case of electronic transfer of the appeal fee with the “financial payment”, the tax office for fees,
transport taxes and gambling (IBAN as before) shall be indicated or selected as the recipient. Furthermore,
the tax number/tax account number 109999102, the type of tax “EEE complaint fee”, the date of the
decision as the period and the amount must be indicated.
The payment of the fee shall be demonstrated when the complaint is lodged with the data protection
authority by means of an original payment document (original) confirmed by a post office or a credit
institution. If the fee is not paid or not paid in full, a notification shall be sent to the competent tax office.
A timely and admissible appeal to the Federal Administrative Court has suspensive effect. The
suspensive effect may have been excluded in the statement of the decision or may be excluded by an own
decision.
February 10th, 2021
For the Head of the Data Protection Authority: