Barichgasse 40-42
A-1030 Vienna
Tel.: + 43-1-52152
E-mail: [email protected]
GZ: D130.992 Clerk:
2023-0.917.292
Data protection complaint (right of access)
(A56 337342)
FINAL DECISION
VERDICT
The Data Protection Authority decides on the data protection complaint of
(complainant) represented by of 23 September 2021 against
, as legal successor of (respondent) for alleged infringement
of the right of access as follows:
- The complaint is dismissed.
Legal bases: Articles 15, 51(1), 56, 57(1)(f), 60 and 77(1) of Regulation (EU) 2016/679 (‘General Data
Protection Regulation’: GDPR), OJ L 119 of 4.5.2016 p. 1; §§ 18(1) and 24 (1) and (5) of the Austrian
Data Protection Law (DSG), Federal Law Gazette I No. 165/1999 as amended; § 45 (2) of the General
Administrative Procedure Act 1991 (AVG), Federal Law Gazette No. 51/1991 as amended.
REASONING
A. The parties’ arguments and the proceeding of the proceedings
1. By letter of 23 September 2021, the appellant (hereinafter also “BF”), represented by
filed a data protection complaint against a company established in in the Czech
Republic, which provides medical services in the field of reproductive medicine (hereinafter also “BG”),
for an infringement of its right of access pursuant to Article 15 of the GDPR.
In summary, the BF claimed that she was conceived in the fertility clinic in operated by the BG
in November 2019 (meaning: 2011). The BG used her father’s sperm on the one hand and the egg of
a donor on the other. Doctors of the BG used her mother’s fertilised egg, which carried the BF and gave
birth on 11 July 2012. The parents had subsequently informed the BF about the origin of their
procreation and on their behalf on the 21st. December 2019 (meaning: 21. December 2018) she asked
—2–
for information about the donor’s identity on 28 August 2020. The BG denied her the desired information
about her genetic ancestry.
2. By decision of 8 November 2022, CZ: D130.992 (2021-0.667.972), the Austrian Data Protection
Authority suspended the present proceedings until the finding of the lead supervisory authority and until
the decision of the lead supervisory authority or of the European Data Protection Board in accordance
with Article 56(1) GDPR in conjunction with § 24(10)(2) of the DSG.
3. The Data Protection Authority submitted in the Internal Market Information System of the European
Union (“IMI”) under IMI 337342 a notification of the present complaint and initiated the investigation of
the lead and the concerned supervisory authority(s) in accordance with Art. 56 GDPR.
4. The Czech Data Protection Authority confirmed its role as the lead supervisory authority in the
present case, and submitted a draft decision to the DPA under IMI 488471 on 20 March 2023. The draft
decision proposed the rejection of the present complaint. In summary, it was justified that the Czech
legislation adopted in transposition of Directive 2004/23/EC precludes the identification of sperm
donors.
5. By decision of the Federal Administrative Court of 28 September 2023, GZ: W245 2251375-1/11E
the decision of the AT DPA on the suspension of the national proceeding has been remedied without
replacement (see 2.).
B. Subject matter of the complaint
The subject matter of the complaint is whether the controller thereby infringed the complainant’s right
of access by refusing to comply with her request of access.
C. Findings
The data protection authority shall base its findings on the procedure set out in point A. and documented
in the file.
Assessment of evidence: The findings are based on the appellant’s arguments and on the contents of
the file.
D. Legal Analysis
D.1. The “one-stop-shop” procedure
In accordance with Article 56(1) of the GDPR, without prejudice to Article 55 leg. cit., the supervisory
authority of the main establishment or of the single establishment of the controller or processor shall be
competent to act as lead supervisory authority for the cross-border processing carried out by that
controller or processor.
—3–
In this way, the so-called “one-stop-shop” principle is introduced in cases of cross-border processing of
personal data. It is intended to ensure a coherent application of the GDPR in cross-border data
processing (see Peuker in Sydow [eds.], European General Data Protection Regulation, Art. 56 Rz 1).
In order to prevent conflicts of jurisdiction, Art. 56 GDPR stipulates that according to the criteria listed
therein, one of the supervisory authorities concerned becomes the lead supervisory authority. In
principle, it is responsible for the coordination of the conduct of the proceedings and the adoption of
procedural or draft decisions.
In accordance with Article 56(1) of the GDPR, the local jurisdiction of the lead supervisory authority
depends on the main establishment of the controller. Since, in the present case, the respondent is
domiciled in the Czech Republic the Czech SA is competent LSA.
D.2. The binding effect of procedural decisions of the lead supervisory authority
Pursuant to Article 60(1) of the GDPR, the lead supervisory authority shall cooperate with the other
supervisory authorities concerned and endeavour to reach consensus.
In accordance with Article 60(3) of the GDPR, the lead supervisory authority shall immediately provide
the supervisory authorities concerned with relevant information, submit the draft decision to them for
comments and take due account of their positions.
Pursuant to Article 60(4) of the GDPR, the supervisory authorities concerned have the opportunity to
object to it within four weeks of receipt of the draft decision.
If no further objection is lodged within the deadline, the decision of the lead supervisory authority shall
become binding on the supervisory authorities concerned in accordance with Article 60(6) of the GDPR.
In the present case, in the absence of an objection the Austrian Data Protection Authority is bound by
the decision of the Czech Republic – SA dated 20. March 2023.
In this regard, it should be noted that an objection made according to Article 60(4) of the GDPR may
(also) serve the interests of the complaining party, nevertheless it primarily pursues the purpose of
ensuring an objectively uniform application of law, detached from the individual interest of the parties
(see Recital 135 GDPR and the possibility of initiating the consistency mechanism in accordance with
Article 60(4) in conjunction with Article 63 et seq. GDPR). Similarly, the data protection authority is not
competent for representing the complainants as a party representative in the proceedings.
D.3. On the adoption and service of the order giving effect to proceedings
Depending on its content, the adoption and notification of the decision are governed differently:
—4–
In the case of decisions which are fully granted, the lead supervisory authority shall adopt the decision,
notify it to the controller in accordance with Article 60(7) of the GDPR and inform the other supervisory
authorities concerned and the committee thereof. The supervisory authority to which a complaint has
been lodged shall inform the complaining party of the decision.
In the case of dismissing decisions (or in case of rejection), in accordance with Article 60(8) GDPR, in
derogation from paragraph 7 leg. cit., the supervisory authority to which the complaint was lodged (here:
the Data Protection Authority), shall adopt the decision and notify it to the complaining party.
Since, in the present case, the decision of the lead supervisory authority constitutes a rejection of the
complaint, the Austrian Data Protection Authority must adopt the procedural decision against the
complainants in accordance with Article 60(8) GDPR. This ensures effective legal protection, as the
complainants may contest the decision in the Member State in which they lodged their complaint.
D.4. In the matter
In accordance with Article 15(1) of the GDPR, the data subject has the right to obtain confirmation from
the controller as to whether personal data concerning him or her are being processed; and, where that
is the case, access to the personal data and the following information referred to in paragraph 2 leg. cit.
The BF, which was born according to an IVF procedure, stated that the BG had not complied with its
request for access, since the BG refused to provide information on the identity of the donor of the
reproduction material used for the IVF procedure.
It was therefore necessary to examine whether the personal data of a donor of reproduction material
can be regarded as personal data of the BF within the meaning of Article 15 GDPR and whether, within
the framework of Article 15 leg. cit., the BF has the right to access information about its origin or the
identity of the donor.
Directive 2004/23/EC of the European Parliament and of the Council of 31 March 2004 laying down
standards of quality and safety for the donation, procurement, testing, processing, preservation, storage
and distribution of human tissues and cells provides that programmes for the application of tissues and
cells should, in principle, be based on the philosophy of voluntary and unpaid donation, the anonymity
of both the donor and the recipient, the donor’s altruism and solidarity between donor and recipient.
It also states that the identity of the recipient or recipient should not be disclosed to the donor or his/her
family and vice versa, without prejudice to the legislation in force in the Member States on the disclosure
conditions which, in exceptional cases, in particular in the case of gamete donation, could allow the
abolition of donor anonymity.
In accordance with Article 14(3), Member States shall take all necessary measures to ensure that the
identity of the recipient(s) is not disclosed to the donor or his family and vice versa; this is without
—5–
prejudice to the current legislation of the Member States on the conditions for disclosure, in particular
in the case of gamete donations.
In accordance with Directive 2004/23/EC and its principles, the Czech legal system, in particular Law
No 373/2011 Coll., on specific health services, as amended (‘Law No 373/2011 Coll.’), obliges the
institution which is entitled to carry out assisted reproduction procedures and methods to ensure the
reciprocal anonymity of the anonymous donor and the sterile couple and the child born with the help of
assisted reproduction.
The Czech legislation in the field of assisted reproduction thus constitutes the transposition of Directive
2004/23/EC and therefore maintained the anonymity of the egg donor.
According to Article 4 (1) GDPR, personal data is any information relating to an identified or identifiable
natural person (data subject), where the identifiable person is a person who can be identified directly
or indirectly, in particular by reference to an identification number or to one or more specific factors for
physical, physiological, economic, cultural or social identity.
The purpose of the GDPR is the protection of personal data when processing them. The aim is that
data protection law is not jeopardised and that the person does not lose control of their data. An
undesirable result would be the use of the data protection provisions in situations that are not subject
to the intention of the original legislator and for which the law was not created, for example in the case
of the right of access. The guidelines of Article 29 Group on the concept of personal data state, inter
alia, that the applicable scope of protection of personal data should not be broadened (and, of course,
should not be unlawfully restricted).
In the context to the aforementioned explanation as to the notion of personal data, it is undoubtful that
the complainant does not want to acquire personal data about her own person for the purpose of having
control over her own data to prevent a misuse thereof, but she intends, via the Article 15 of the
Regulation (EU) 2016/679, to receive information about the donor, i.e. about a third person.
In fact the case law of the European Court of Human Rights (hereinafter “the ECHR“) acknowledges,
with growing intensity, the right of a child to know his/her origin whereby this right is gradually projected
into the domestic law including the issue of the anonymous donation of the reproductive material. The
ECHR has already ruled on the issue of the right of a child to have access to information about his/her
origin under different scenarios like information about the childhood and early development (ECHR
judgment No. 10454/83 Gaskin v. The United Kingdom), effective mean for identification of the
biological fatherhood (ECHR judgment No. 53176/99 Mikulic v. Croatia) or disclosure of the mother´s
name in case of an anonymous birth (ECHR judgment No. 42326/98 Odievre v. France). It is necessary
to add in this regard that the ECHR judgments so far has not explicitly applied to the situation of the
disclosure of identity of an anonymous donor of the genetic material. If it were true, it would imply the
—6–
obligation of the Member States to amend the law whereas the present Directive č 2004/23/EC based
on the anonymous donation would have to stand the proof. As a result, the complaint was dismissed.
EXPLANATION ON RIGHTSTO APPEAL
A complaint against this decision may be lodged in writing to the Federal Administrative Court within
four weeks of notification. The complaint must be lodged with the data protection authority and
must:
- the name of the contested decision (GZ, subject)
- the name of the competent authority,
- the grounds on which the allegation of illegality is based,
- the desire and
- the information necessary to assess whether the complaint has been submitted in good time;
The data protection authority has the possibility to amend its decision within two months either by pre
-trial decision or to submit the complaint with the file of the proceedings to the Federal
Administrative Court.
The complaint against this decision is subject to a fee. The fixed fee for a corresponding input including
inserts is EUR 30. The fee must be paid to the account of the Austrian Tax Office, stating the intended
purpose.
In principle, the fee must be transferred electronically with the function “Tax Office payment”. The tax
office Austria – Department of Special Competences should be specified or selected as the beneficiary
(IBAN: AT83 0100 0000 0550 4109, BIC: BUNDATWW). In addition, the tax number/delivery account
number 10 999/9102, the tax type “EEE Complaint Fee”, the date of the decision must be indicated as
the period and the amount.
If the e-banking system of your credit institution does not have the function “Tax Office payment”, the
eps procedure can be used in FinanzOnline. An electronic transfer can only be excluded if no e-banking
system has been used so far (even if the taxpayer has an internet connection). Then the payment must
be made by means of a payment order, whereby attention must be paid to the correct assignment.
Further information can be found at the tax office and in the manual “Electronic payment and reporting
on the payment of self-assessmentduties”.
The payment of the fee shall be proved upon submission of the complaint to the data protection
authority by means of a payment document to be connected to the input or a printout of the issue of a
payment order. If the fee is not paid or not paid in full, a report shall be made to the competent tax
office.
—7–
A complaint lodged in good time and admissible to the Federal Administrative Court has suspensive
effect. The suspensive effect may have been excluded in the sentence of the notice or may be excluded
by a separate decision.
22. December 2023
For the deputy Head of the Austrian Data Protection Authority: