Barichgasse 40-42
A-1030 Vienna
Tel.: + 43-1-52152 302597
Republic of Austria
Data Protection
Authority E-mail: [email protected]
GZ: D130.1251 Clerk:
2023-0.585.041
Data protection complaint (Art. 5 and 6 GDPR)
and (IMI No. A56ID 450784)
FINAL DECISION
VERDICT
The Austrian Data Protection Authority decides on the data protection complaint of and
(complainants) of 2 August 2022 against (respondent) for alleged breach
of the general principles and the legality of the data processing pursuant to Art. 5 and Art. 6 GDPR as
follows:
The complaint is dismissed.
Legal basis: Articles 2, 4(7), 5, 6, 51(1), 56, 57(1)(f), 60 and 77(1) of Regulation (EU) 2016/679 (‘General
Data Protection Regulation’: GDPR), OJ L 119 of 4.5.2016 p. 1; §§ 18(1) and 24 (1) and (5) of the
Austrian Data Protection Law (DSG), Federal Law Gazette I No. 165/1999 as amended; § 45 (2) of the
General Administrative Procedure Act 1991 (AVG), Federal Law Gazette No. 51/1991 as amended.
—2—
REASONING
A. Arguments of the parties and the proceeding of the proceedings
1. The complainants claimed in the appeal initiating the proceedings of 2 August 2022, improved
with submissions of 18 August 2022, 14 September 2022 and 16 November 2022, a breach of the
general principles and the lawfulness of the data processing, alleging, in summary, that the respondent
had disclosed the complainants’ personal data to third parties. The complainants had met the respondent
through an online congress and then booked two sessions with her. Subsequently, there were disputes
over the recovery of the fee because the complainants felt betrayed by the respondent. A few weeks
later, the complainants were unable to view Facebook content of a third person they would follow, namely
. had informed the complainants that she had blocked the
complainants on Facebook because she was a very good friend of the respondent and could not
remotely understand the complainants’ actions against the respondent. Although
informed the complainants that she had learned about these circumstances by detours, it was clear to
the complainants that the respondent had passed on personal details to third parties. There may also
be a reputational damage. The complainants submitted undated text messages of
and subsequently a power of attorney from for regarding
the proceedings at issue.
2. By decision of 28 November 2022, CZ: D130.1251 (2022-0.820.918), the Data protection
authority suspended the present proceedings until the finding of the lead supervisory authority and until
the decision of the lead supervisory authority or of the European Data Protection Board in accordance
with Article 56(1) GDPR in conjunction with § 24(10)(2) of the DSG.
3. The Data Protection Authority submitted in the Internal Market Information System of the
European Union (“IMI”) under IMI 450784 a notification of the present complaint and initiated the
investigation of the lead and the concerned supervisory authority(s) in accordance with Art. 56 GDPR.
4. The State Commissioner for Data Protection and Freedom of Information Mecklenburg-
Vorpommern confirmed its role as the lead supervisory authority in the present case, opened the
investigation procedure and submitted a draft provisional decision to the Data Protection Authoprity
under IMI 482366 on 1 February 2023. The draft decision proposed the rejection of the present
complaint. In summary, it was stated that the data processing at issue falls under the so-called
“hoeshold-exemption” in accordance with Article 2(2)(c) GDPR.
5. The Data Protection Authority responded to the State Commissioner for Data Protection and
Freedom of information Mecklenburg-Vorpommern on 17 February 2023 under IMI 482366, in the
context of the informal consultation, that it could not follow the draft decision, since the facts were not
sufficiently clear and, based on the given information at that time, it could not be clearly stated that the
alleged disclosure of data did not take place in a professional context. The State Commissioner for
Data Protection and Freedom of Information Mecklenburg-Vorpommern was therefore requested to set
further investigative measures with regard to the motive for the alleged disclosure of data and to possible
—3—
data processing within the so-called “household-exemption” pursuant to Article 2(2)(c) GDPR.
6. With notification of 18 July 2023, the State Commissioner for Data Protection and Freedom of
information Mecklenburg-Vorpommern submitted to the data protection authority under IMI 539360 a
new draft decision including correspondence with the respondent as part of its further investigative
measures. The new draft decision also proposed the rejection of the present complaint. In summary, it
was stated that the further investigative measures did not provide any evidence for the disclosure of data
claimed by the complainants, which would fall under the scope of the GDPR.
7. The Data Protection Authority responded to the State Commissioner for Data Protection and
Freedom of information Mecklenburg-Vorpommern on 20 July 2023 under IMI 539360 within the
informal consultation that it did not oppose the new draft decision.
8. The State Commissioner for Data Protection and Freedom of Information Mecklenburg-
Vorpommern subsequently issued on 24 July 2023 under IMI 541190 a decision pursuant to Article 60(3)
of the GDPR.
9. By decision of 2 August 2023, the Data Protection Authority removed the suspension in the
proceedings at issue and granted the complainants the right to be heard.
10. The complainants responded by letter of 8 August 2023 and argued in summary that they could
not understand the decision of the lead supervisory authority, as the respondent’s statements were
untrue and unexplainable. The complainants felt that the lead supervisory authority had put itself very
much on the side of the respondent.
B. Subject matter of the complaint
Based on the appellants’ arguments, the subject matter of the proceedings is whether the respondent
disclosed personal data of the complainants to third parties and thereby violated general principles and
the lawfulness of data processing pursuant to Articles 5 and 6 GDPR.
C. Findings
The data protection authority bases its findings on the procedure set out and documented under point
A. and the findings of the lead supervisory authorities. It is apparent from the findings of the lead
supervisory authority that the respondent did not disclose any personal data of the complainants to third
parties.
Assessment of evidence: The findings made are based on the present case file. The finding that the
respondent did not disclose the complainant’s personal data to third parties is based on the findings of
the State Commissioner for Data Protection and Freedom of Information Mecklenburg-Vorpommern as
the lead supervisory authority. In summary, the disclosure of data attributed to the respondent by the
appellants shows a diluted factual substrate as a whole, since the appellants merely rely on general
external indicia (e.g. “blocking” of Facebook content by ) as well as to undated
text messages from , from which it is not clear, however, that
had received data about the complainants from the respondent. Rather, the opposite is claimed there,
—4—
namely that has received the information about the complainants not by the respondent,
but “by detours”, which does not appear impossible according general life experience. As will be shown
in the legal analysis below, although no absolute certainty is needed for the assumption of a fact, it is
necessary to have a certain (minimum) level of proof, which was not achieved in the present case by
the complainants’ arguments.
D. Legal analysis
D.1. The “one-stop-shop” procedure
In accordance with Article 56(1) of the GDPR, without prejudice to Article 55 leg. cit., the supervisory
authority of the main establishment or of the single establishment of the controller or processor shall be
competent to act as lead supervisory authority for the cross-border processing carried out by that
controller or processor.
In this way, the so-called “one-stop-shop” principle is introduced in cases of cross-border processing of
personal data. It is intended to ensure a coherent application of the GDPR in cross-border data
processing (see Peuker in Sydow [eds.], European General Data Protection Regulation, Art. 56 Rz 1).
In order to prevent conflicts of jurisdiction, Art. 56 GDPR stipulates that according to the criteria listed
therein, one of the supervisory authorities concerned becomes the lead supervisory authority. In
principle, it is responsible for the coordination of the conduct of the proceedings and the adoption of
procedural or draft decisions.
In accordance with Article 56(1) of the GDPR, the local jurisdiction of the lead supervisory authority
depends on the main establishment of the controller. Since, in the present case, the respondent is
domiciled in the Federal Republic of Germany, Mecklenburg-Vorpommern, the Land Commissioner for
Data Protection and Freedom of Information Mecklenburg-Vorpommern is competent.
D.2. The binding effect of procedural decisions of the lead supervisory authority
Pursuant to Article 60(1) of the GDPR, the lead supervisory authority shall cooperate with the other
supervisory authorities concerned and endeavour to reach consensus.
In accordance with Article 60(3) of the GDPR, the lead supervisory authority shall immediately provide
the supervisory authorities concerned with relevant information, submit the draft decision to them for
comments and take due account of their positions.
Pursuant to Article 60(4) of the GDPR, the supervisory authorities concerned have the opportunity to
object to it within four weeks of receipt of the draft decision.
If the lead supervisory authority joins the objection – as in the present case – it shall transmit a new
decision (draft) to the supervisory authorities concerned in accordance with Article 60(5) of the GDPR,
which in turn have the opportunity to comment on it within a period of two weeks. If no further objection
is lodged within the deadline, the decision of the lead supervisory authority shall become binding on the
—5—
supervisory authorities concerned in accordance with Article 60(6) of the GDPR.
In the present case, in the absence of a (new) objection the Austrian Data Protection Authority is
bound by the decision of the State Commissioner for Data Protection and Freedom of Information
Mecklenburg-Vorpommern dated 24 July 2023.
In this regard, it should be noted that an objection made according to Article 60(4) of the GDPR may
(also) serve the interests of the complaining party, nevertheless it primarily pursues the purpose of
ensuring an objectively uniform application of law, detached from the individual interest of the parties
(see Recital 135 GDPR and the possibility of initiating the consistency mechanism in accordance with
Article 60(4) in conjunction with Article 63 et seq. GDPR). Similarly, the data protection authority is not
competent for representing the complainants as a party representative in the proceedings.
D.3. On the adoption and service of the order giving effect to proceedings
Depending on its content, the adoption and notification of the decision are governed differently:
In the case of decisions which are fully granted, the lead supervisory authority shall adopt the decision,
notify it to the controller in accordance with Article 60(7) of the GDPR and inform the other supervisory
authorities concerned and the committee thereof. The supervisory authority to which a complaint has
been lodged shall inform the complaining party of the decision.
In the case of dismissing decisions (or in case of rejection), in accordance with Article 60(8) GDPR, in
derogation from paragraph 7 leg. cit., the supervisory authority to which the complaint was lodged (here:
the Data Protection Authority), shall adopt the decision and notify it to the complaining party.
Finally, Article 60(9) of the GDPR provides for shared jurisdiction in cases in which the complaint is
partially rejected or dismissed.
Since, in the present case, the decision of the lead supervisory authority constitutes a rejection of the
complaint, the Austrian Data Protection Authority must adopt the procedural decision against the
complainants in accordance with Article 60(8) GDPR. This ensures effective legal protection, as the
complainants may contest the decision in the Member State in which they lodged their complaint.
D.4. In the matter
In accordance with Article 2(1) GDPR, the GDPR applies to the wholly or partially automated processing
of personal data as well as for the non-automated processing of personal data stored or intended to be
stored in a file system.
In accordance with Article 4(2) of the GDPR, the processing of personal data includes, inter alia, the
reading, consultation, use, disclosure by transmission, dissemination or any other form of provision,
provided that these are within the scope of the GDPR. The respondent is, without doubt, the controller
within the meaning of the law. Article 4(7) GDPR for the processing of personal data of her customers.
—6—
In the present case, the alleged transfer of personal data of the appellants by the respondent to
uninvolved third parties is criticized. External circumstances such as the blocking of Facebook content
as well as undated text messages from are raised as evidence.
states that she has not received such data from the respondent and also does not mention
any details that may have led to her message.
In addition, the respondent’s comments obtained by the lead supervisory authority do not show sufficient
evidence that the complainants’ personal data have been transmitted to and are or
should be stored in a file system. Even if the respondent had mentioned the names of the complainants
in a telephone exchange with her acquaintance regarding the handling of legal
disputes, for the reasons mentioned above, it cannot necessarily be assumed that the scope of
application of the GDPR would have been opened.
In this regard, it should be noted that an oral disclosure of personal data does not fall within the scope
of the GDPR (see, for example, Heißl in Knyrim [eds.], DatKomm, Art. 2 GDPR para 55; as well as
Bergauer in Jahnel [eds.], Comment on the General Data Protection Regulation, Art. 2 GDPR,
paragraph 18).
In contrast, the (national) constitutional right to confidentiality under § 1(1) DSG does not require
processing in a data application or manual file and therefore also protects, for example, the use of data
in conventional or oral form (see the decision of the Austrian Data Protection Authority of 25 May 2020,
Case No. 2020-0.191.240). However, the present case must be assessed solely on the basis of the
GDPR (and not on the basis of § 1 DSG) due to its cross-border nature.
There is also insufficient evidence on the possible transfer of the complainants’ personal data to other
third parties from which such disclosure could be inferred.
As a result, the respondent’s breach is neither plausible nor can it be proved. In this context, it should
be noted that all the facts on which an official decision is to be based, generally require evidence. Unless
otherwise provided by law, full proof of a fact must be provided. This means that the authority must
obtain certainty as to the existence of the factual elements relevant to the decision (i.e. about a factual
transaction, for example).
In the present case, the necessary evidence for a finding in this respect (see § 45(2) of the AVG) is not
reached by the complainants’ mere argument that the respondent has disclosed their personal data to
third parties. That argument alone cannot give rise to an outstanding likelihood of the respondent’s actual
disclosure of personal data by the respondent, especially since the respondent and the third party
dispute such disclosure.
Since no disclosure of their personal data alleged by the complainants could be established, it must be
assumed that there is no such fact (see the ruling of the Austrian Supreme Administrative Court of 16
June 1992, Case No. 92/08/0062).
—7—
The appeal was therefore to be dismissed.
The Data Protection Authority does not overlook the recent ruling of the Austrian Supreme Administrative
Court (see Austrian Supreme Administrative Court, 10.3.2023, Case No. Ra 2020/04/0085-9), according
to which, in the case of disputed written statements, the credibility of persons may be examined in the
context of an oral hearing. In the present case, however, it should be noted that the investigation
procedure is not led by the Austrian Data Protection Authority, but by the lead supervisory authority
within the meaning of the present case. Art. 56 in conjunction with Art. 60 of the GDPR and it is therefore
solely due to the lead authority to adopt the investigative measures required by its national procedural
law.
If the complainants raise a possible damage to their reputation or credit within the meaning of § 1330
Austrian Civil Code or within the meaning of evil impeachment according to § 111 Austrian Criminal
Code, it should be pointed out that neither the lead supervisory authority nor the Austrian Data Protection
Authority are competent to handle such reproach, but the ordinary civil or criminal courts.
EXPLANATION ON RIGHTS TO APPEAL
A complaint against this decision may be lodged in writing to the Federal Administrative Court within
four weeks of notification. The complaint must be lodged with the data protection authority and must
contain:
- the name of the contested decision (GZ, subject)
- the name of the competent authority,
- the grounds on which the allegation of illegality is based,
- the desire and
- the information necessary to assess whether the complaint has been submitted in good time.
The data protection authority has the possibility to amend its decision within two months either by pre -
trial decision or to submit the complaint with the file of the proceedings to the Federal
Administrative Court.
The complaint against this decision is subject to a fee. The fixed fee for a corresponding input including
inserts is EUR 30. The fee must be paid to the account of the Austrian Tax Office, stating the intended
purpose.
In principle, the fee must be transferred electronically with the function “Tax Office payment”. The tax
office Austria – Department of Special Competences should be specified or selected as the beneficiary
(IBAN: AT83 0100 0000 0550 4109, BIC: BUNDATWW). Furthermore, they are Tax number/delivery
account number 10 999/9102, the tax type “EEE Complaint Fee”, the date of the decision as the period
and the amount.
—8—
If the e-banking system of your credit institution does not have the function “Tax Office payment”, the
eps procedure can be used in FinanzOnline. An electronic transfer can only be excluded if no e-banking
system has been used so far (even if the taxpayer has an internet connection). Then the payment must
be made by means of a payment order, whereby attention must be paid to the correct assignment.
Further information can be found at the tax office and in the manual “Electronic payment and reporting
on the payment of self-assessment duties”.
The payment of the fee shall be proved upon submission of the complaint to the data protection
authority by means of a payment document to be connected to the input or a printout of the issue of a
payment order. If the fee is not paid or not paid in full, a report shall be made to the competent tax
office.
A complaint lodged in good time and admissible to the Federal Administrative Court has suspensive
effect. The suspensive effect may have been excluded in the sentence of the notice or may be excluded
by a separate decision.
9 August 2023
For the Head of the Data Protection Authority: