DSB (Austria) - D124.1177/0006-DSB/2019
From GDPRhub
| DSB (Austria) - DSB-D124.1177/0006-DSB/2019 | |
|---|---|
 | |
| Authority: | DSB (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 5(1)(e) GDPR Article 5(1)(b) GDPR Article 9(1) GDPR Article 9(2)(j) GDPR Article 17(1)(d) GDPR Article 17(1)(c) GDPR Article 17(3)(d) GDPR Article 21(6) GDPR Article 89(1) GDPR Article 89(3) GDPR § 2b(12) FOG § 2d(6)(3) FOG § 2d(6)(6) FOG § 7(2)(1) DSG § 2f(1) FOG |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | 22.01.2021 |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | DSB-D124.1177/0006-DSB/2019 |
| European Case Law Identifier: | ECLI:AT:DSB:2021:DSB.D124.1177.0006.DSB.2019 |
| Appeal: | Not appealed |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (RIS) (in DE) |
| Initial Contributor: | n/a |
The controller labelled the Complainant as member of the extreme right on a website archiving the history of fascism. The complainant requested that all information about him be deleted from the website. The DPA found that none of the grounds for erasure, in particular Article 17(1)(c) and (d) GDPR, were fulfilled.
English Summary
Facts
The controller pursues, among other things, the purpose of scientific research on the history of fascism and National Socialism, the resistance to the latter movements and on political manifestations of right-wing extremism, including the purpose of documentation and archiving. The controller operates different types of archives. Relevant here is the so-called "cut archive", in which clippings from various media, in particular daily newspapers, are stored. These articles are stored and key-worded online. The respondent made media contributions by the complainant accessible on its website and labelled the complainant as "extreme right-wing". An employee of the controller had also made corresponding statements to the media.
The complainant requested the controller to delete the aforementioned articles. This was based on the claim that the controller cannot rely on a legal basis under the GDPR to process such special categories of personal data. Also, it was stated that the controller does not use such data for scientific purposes, as claimed, but for daily political purposes.
The respondent rejected the request. It stated that the processing served purposes pursuant to Article 89(1) GDPR and was exempted from the right to deletion by § 2d (6) of the Austrian Research Organization Act (FOG). Further, the controller referred to Article 9 (1) and (2) (e) GDPR. The political conviction of the complainant was not a secret and was based on verifiable statements made publicly by the complainant.
The complainant filed a complaint with the Austrian DPA (Datenschutzbehörde - DSB).
Holding
Exclusion of the Right to Erasure under National Law not Applicable
With § 2d(6)(3) FOG, there is a national provision that excludes the right to erasure insofar as this is likely to render impossible or seriously impair the achievement of purposes pursuant to Article 89(1) GDPR.
In principle, Article 89(3) GDPR contains an opening clause. This provision was also applied in the present case. The DSB decided that the maintenance of the "cut archive" falls under data processing for an archiving purpose in the public interest pursuant to Article 89(3) GDPR. The complainant's contrary assertion that the controller pursues "day-to-day political purposes" and is therefore not scientifically active did not apply. For this to be the case, it would have to be proven that the archive management pursued the sole purpose of serving political goals not further described by the complainant. However, there was not even a sufficiently substantiated factual allegation for the inclusion of such evidence. The fact that the controller takes a basic political stance and repeatedly expresses this publicly, does not harm the scientific purpose of the respondent's activity.
However, § 2d(6)(3) FOG was not applied in the present case due to the primacy of national law. Article 89(3) GDPR does not provide for an opening clause for the exclusion of the right of erasure, as there is no reference to Article 17 GDPR.
Article 17(1)(d) GDPR
The DSB decided that there is no ground for erasure under Article 17(1)(d) GDPR.
According to the DSB there is a legal basis for processing. Union law, together with complementary national law, also covers the processing of special categories of data for archiving purposes in the public interest, including "political background information" on individuals who are the subject of archived documents. In any case, a categorization is covered which, as is the case here, makes it possible to find media reports attributing a " nationalist " or " German nationalist " attitude to the complainant.
Specifically, the DSB cites Articles 5(1)(b) and (e), 9(2)(j), 89(1) GDPR and Section 7(1)(1) and (2)(1) GDPR. In particular, it follows from Article 9(2)(j) GDPR that the processing of data relating to the political conviction of a data subject may be carried out for archiving purposes. Ultimately, the DSB relies on §2f(1)(6)(a) FOG, which provides accordingly.
Article 17(1)(c) GDPR
For a right of erasure pursuant to Article 17(1)(c) GDPR, the first requirement, namely a justified right of objection, was already missing.
The DPA noted that Article 17(1)(c) GDPR, by its logical and systematic context, also applies to the right to object under Article 21(6) GDPR. Pursuant to Article 21(6) GDPR, where personal data are processed for scientific or historical purposes or statistical purposes, the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out in the public interest.
The complainant had not succeeded in justifying this right to object. The accusation of day-to-day political influence did not suffice. This is because processing with the addition of "political background information" is - as has been seen - expressly permitted. According to the DSB, the complainant would rather have been free to take legal action against the statement itself by way of civil or media law.
Comment
It remains unclear why the DSB has not addressed the question of whether the right to object applies. After all, with § 2d(6)(6) FOG, Austria made use of the opening clause of Article 89(3) GDPR and excluded the right to object. as the DSB also recognized.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Decisive authority
Data protection authority
Decision date
01/22/2021
Business number
DSB-D124.1177 / 0006-DSB / 2019
Appeal at the BVwG / VwGH / VfGH
This decision is final.
text
GZ: DSB-D124.1177 / 0006-DSB / 2019 of January 22, 2021
[Note processor: Names and companies, legal forms and product names, addresses (incl. URLs, IP and e-mail addresses), file numbers (and the like), etc., as well as their initials and abbreviations can be abbreviated and / or changed for reasons of pseudonymisation be. Obvious spelling, grammar, and punctuation errors have been corrected.
The name of the respondent has not been pseudonymized, since processing the content of the notification that would have made identification of the respondent impossible or at least significantly more difficult would only have been possible by largely removing the intelligibility of the content of the decision. The right of confidentiality (§ 1 DSG) and confidentiality interests of the respondent, a legal person whose lawful action was determined in the decision, is opposed to the legal mandate according to § 23 paragraph 2 DSG, whereby this is a decision of fundamental importance for the general public acts, since some legal issues have been dealt with here for the first time. Therefore, despite the impossibility of complete pseudonymisation, the decision had to be included in the decision-making documentation of the data protection authority due to the prevailing general interest in publication.]
NOTIFICATION
Proverb
The data protection authority decides on the data protection complaint of the Univ. Prof. Dr. Julius A *** (complainant) from ****, dated August 1, 2019 against the Foundation Documentation Archive of the Austrian Resistance (short: DÖW, respondent) from Vienna, represented by the lawyers B *** and D *** Ges .mbH from Vienna, due to violation of the right to erasure as a result of rejection of the request for erasure dated July 2, 2019 by letter from the respondent dated July 29, 2019 as follows:
The complaint is rejected.
Legal basis: Art. 5 para. 1 lit. b and e, Art. 9 para. 1 and para. 2 lit. j, Art. 17 para. 3 lit. d, Art. 21 para. 6 and Art. 89 para. 1 and para. 3 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of 4 May 2016 p. 1 as amended, in conjunction with Section 2b Z 12, Section 2d para. 6 Z 3 and Z 6 and § 2 f paragraph 1 of the Research Organization Act (FOG), Federal Law Gazette No. 341/1981 as amended.
REASON
A. Arguments of the parties and course of the procedure
1. This complaint procedure follows on from the complaint procedure Zl. DSB-D123.582, which dealt with a dispute between the same parties over the provision of information under data protection law (Art. 15 GDPR). That procedure was terminated (after the respondent had subsequently provided information) through discontinuation in accordance with Section 24 (6) DSG.
2. With a complaint dated August 1, 2019 (in the version of the correction of deficiencies dated September 10, 2019), the complainant alleged that on July 2, 2019, he requested the respondent to delete all data processed about him. The respondent processes data on his person and classifies him as "right-wing extremist" by using keywords. This relates to media contributions made available online by the Respondent (according to the information given in the complaint procedure Zl. DSB-D123.582) and statements made by Dietmar T ***, an employee of the Respondent, to the media. The respondent could not rely on any authorization under the GDPR to process such special categories of personal data. Furthermore, the Respondent did not use such data for scientific purposes, as claimed, but for day-to-day political purposes. The rejection of the deletion by letter from the Respondent's lawyers dated July 29, 2019 is therefore unlawful.
3. In a statement dated October 11, 2019, the respondent, who was represented in a friendly manner, countered the following: The complainant, who was evidently generally averse to the respondent, had quotes from DÖW employee Dr. Dietmar T ***, responsible for the [note processor: exact area of activity of the person concerned removed, as it is suitable to identify this], taken as an opportunity in a press release by the APA from [note processor: date shortened for reasons of pseudonymisation] in 2018, take action against the respondent with data protection complaints. The Respondent collects relevant media reports and publications for archival purposes in the public interest and scientific-historical research purposes in the so-called "sectional archive" and makes them accessible. This data processing serves purposes in accordance with Art. 89 Paragraph 1 GDPR and is excluded from the right to erasure by Section 2d Paragraph 6 FOG. The statements by Dr. T *** would also be based on their personal knowledge and assessment. According to Art. 9 Para. 1 and Para. 2 lit. e GDPR, the processing of particularly protected data, e.g. for the political conviction of a data subject, is permitted if they have made the latter public themselves. The applicant's political convictions that Dr. T *** was not a secret and was based on verifiable, publicly made statements by the complainant (such as the one that the respondent was "[note processor: quote removed because it seems suitable to identify the complainant]"). The Respondent requested that the proceedings be terminated “in the absence of a complaint”.
4. With the procedural order of October 15, 2019, GZ: DSB-D124.1177 / 0003-DSB / 2019, it was announced to both parties that the data protection authority would ex officio as I will use evidence in this matter too. Both parties were given a hearing on the relevant file contents (the complainant also on the respondent's comments).
5. The complainant submitted a statement dated December 16, 2019 that the information provided by the Respondent proved that the Respondent processed data not "only" for scientific purposes, but also for day-to-day political purposes.
B. Subject matter of the complaint
6. It emerges from the submissions of the parties that the subject matter is the question of whether the respondent was obliged to delete personal data relating to the complainant, which are processed for the purposes of the so-called "cutting archive", at the request of the complainant.
C. Factual Findings
7. The Respondent is organized as a foundation in accordance with the Federal Foundation and Fund Act 2015 (BStFG 2015), has its seat in Vienna and is entered in the register of foundations of the Federal Ministry of the Interior at No. 216.
Evaluation of evidence: This finding, which is undisputed, is based on the information provided by the respondent and the inspection of the foundation register available online https://www.bmi.gv.at/409/files/2019_12_Stiftungs-Administration.pdf, on January 10th 2020).
8. The Respondent pursues, among other things, the purpose of academic research on the history of fascism and National Socialism, the resistance against the latter movements and the political manifestations of right-wing extremism, including the documentation and archiving purpose already mentioned in the name of the institution. The Respondent, who has been the sponsor of the DÖW since 1983, was and is largely financed by the federal government and the City of Vienna.
Evaluation of evidence: This determination is based on generally known facts (Section 45 (1) AVG).
9. The Respondent operates different types of archives. The so-called "cut archive" is relevant here, in which excerpts from various media, especially daily newspapers, are saved. These articles are stored and tagged online.
10. With regard to the complainant, the following media reports are processed in the "editing archive" with the name of the complainant (indexed):
[Editor's note: The list of media reports [including URLs] has been removed as it appears suitable for identifying the complainant and is not absolutely necessary for understanding the decision.]
Assessment of evidence: These findings are based on the contents of the files of the GZ: DSB-D123.582 / 0002-DSB / 2019 and the GZ: DSB-D123.582 / 0003-DSB / 2018 that were brought to the attention of the parties.
11. On July 2, 2019, the complainant sent the following letter to the respondent:
[Editor's note: The document reproduced here as a graphic file cannot be pseudonymized with reasonable effort. It is a request for deletion in accordance with Art. 17 GDPR on a form provided by the data protection authority. The reasons given by the complainant for his right to erasure are: "The DÖW states (...) that the data are stored" for archival purposes in the public interest and for scientific and historical research purposes ". In its press release dated […], the DÖW referred to data stored about me. This press release had the stated intention of exerting political influence on the day. It also aims to reduce my public image. These are neither archiving purposes nor scientific and historical research purposes according to § 2d in conjunction with §2f FOG and Art 89 GDPR. "]
12. The Respondent replied to the Complainant as follows:
[Editor's note: The original reply from July 29, 2019, reproduced here as a graphic file, cannot be pseudonymized with reasonable effort; here is a slightly abbreviated transcription:]
[Letterhead from the law firm representing the Respondent]
“Dear Univ.-Prof. Dr. Julius A ***!
At the beginning we can announce again that we represent the Foundation Documentation Archive of the Austrian Resistance in a legally friendly manner. On behalf of our client, we are able to provide you with the following statement on your request for deletion dated July 2nd, 2019:
From your request for deletion, it is not clear to us which personal data you wish to be deleted, especially since there is no written press release from the DÖW from [Note processor: date shortened for reasons of pseudonymisation] 2018. As already shown in our information provision of March 15, 2019, the quote from Doctor T *** is based on his extensive specialist knowledge on this topic. The response to the APA's request was only given verbally by Doctor T ***.
Numerous copies of the Zeitschrift des Österreichischen [Editor's note: Name of an umbrella organization of school and student associations] are publicly available in the library of the DÖW. However, the authors of the individual articles or the persons named in these articles are neither recorded nor digitally recorded and stored by our client. It is therefore not possible for our client to delete the referenced speech, which is printed in an Austrian magazine [note editor: as last]. It is a physical magazine collection in which the magazines are filed by year.
No personal data is processed or stored in this journal collection; in addition, there are archiving purposes in the public interest as well as scientific and historical research purposes.
According to the statutory provisions, we have to instruct you that you have the right to lodge a complaint with the data protection authority (www.dsb.gv.at) for alleged violations of your rights. "
Evaluation of evidence: These findings are based on the documents submitted by the complainant as enclosures to the complaint.
D. From a legal point of view, it follows:
Total:
13. The complaint has been shown to be unfounded.
Procedural note
14. The complaint procedure in accordance with Art. 77 GDPR is, in particular in the Austrian procedural design by § 24 GDPR, an adversarial multi-party procedure initiated by a party application, the complaint, in which the data protection authority must decide by decision, as far as and as long as the complaint is present. The latter is the case, and the Respondent's request to discontinue the proceedings is therefore out of the question here.
Respondent as a scientific institution
15. The Respondent is a scientific institution according to § 2b Z 12 FOG, since it is a non-profit organization (foundations according to BStfFG are by definition either "non-profit" or "benevolent" according to § 1 paragraph 1 BStfFG, whereby the latter is ruled out in the absence of a corresponding claim ) Carries out research activities. The public interest in its activities can be derived from the respondent's public funding.
16. In the opinion of the data protection authority, the management of the so-called “cutting archive” falls under data processing for an archive purpose in the public interest in accordance with Art. 89 (3) GDPR. The complainant's contradicting assertion that the Respondent pursues “political purposes” and is therefore not scientifically active is not correct. In order to do this, it would have to be proven that the management of the archives only pursued the purpose of serving political goals not detailed by the complainant. However, there was not even a sufficiently substantiated factual assertion for the inclusion of such evidence. However, the fact that the Respondent adopts a basic political stance that can already be deduced from her name and repeatedly expresses this publicly does not harm the academic purpose of the Respondent's work.
Research privilege according to § 2d Paragraph 6 FOG:
17. Contrary to its submission, the Respondent cannot, however, invoke the general protection of Section 2d (6) (3) FOG, which excludes the deletion of personal data from the archives of scientific institutions.
18. Section 2d FOG reads in extracts including the heading:
"Basic provisions for the protection of personal data
§ 2d. (1) […]
(6) The following rights do not apply to the extent that the achievement of purposes according to Art. 89 Para. 1 GDPR is likely to be made impossible or seriously impaired:
1.[…]
3. Right to erasure or right to be forgotten (Art. 17 GDPR),
[...]
6. Right of objection (Art. 21 GDPR). "
19. Pursuant to Section 1 Para. 3 Item 1 FOG, this federal law regulates the framework conditions for processing (Art. 4 Item 2 GDPR) for archiving purposes in the public interest, for scientific or historical research purposes and for statistical purposes within the meaning of Art. 89 Para. 1 GDPR.
20. Paragraph 2d (6) of the FOG is, among other things, a special national provision in Article 89 (3) GDPR (opening clause) in favor of archiving purposes in the public interest.
21. However, this provision violates precisely the point on which the respondent relies, number 3, against the wording of Art. 89 Para. 3 GDPR, the nationally determined exceptions to the right to erasure ("to be forgotten") according to Art. 17 GDPR expressly does not provide for data processing for archiving purposes.
22. In accordance with the principle of priority of application of Union law (see ECJ, judgment of 9 March 1978, C-106/77 - Simmenthal II), Section 2d (6) no.3 FOG must therefore remain unapplied here.
23. In principle, therefore, according to Art. 17 GDPR, data can also be requested to be deleted from processing that pursues archiving purposes in the public interest.
Extended legality check of data processing
24. It therefore remains to be considered whether an application of the right to erasure (“to be forgotten”) according to Art. 17 GDPR might justify the complainant's claim to erasure.
25. According to Art. 17 Para. 1 GDPR, one of the deletion facts listed in lit a to f must be fulfilled.
26. According to lit c, the complainant may object to the processing of his data (under the logical-systematic assumption that a request for deletion always includes an objection to data processing) or according to lit d, the lack of a lawful basis for the Data processing.
a. Legal basis for data processing by the respondent
27. The Union legislators (Council and Parliament) provide several exceptions to the stricter rules of the GDPR for archiving purposes in the public interest and thus express that archiving is in principle a permissible form of data processing. News and press archives, such as the “editing archive”, are also subject to the special protection of Art. 11 GRC (GDPR, recital 153).
28. Article 5 (1) b and e GDPR also refers to the admissibility of data processing for archiving purposes in the public interest.
29. Art. 9 para. 2 lit. j GDPR allows the processing of special categories of data, including those relating to the political convictions of a data subject, on the basis of Union law or the law of a member state that is proportionate to the aim pursued, preserves the essence of the right to data protection and provides appropriate and specific measures to safeguard the fundamental rights and interests of the data subject, for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Art. 89 Para. 1 GDPR.
30. Pursuant to Section 7 (1) no. 1 DSG, the person responsible may process all personal data that are publicly accessible for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes that do not aim to produce personal results.
31. Pursuant to Section 7 (2) (1) DSG, personal data may be processed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes that do not fall under Paragraph 1, among other things in accordance with special statutory provisions.
32. Section 2f FOG reads in extracts including the heading (underlining by the data protection authority):
"Data basis for activities for purposes according to Art. 89 Para. 1 GDPR
§ 2f. (1) Scientific institutions (§ 2b Z 12) may collect, archive and systematically record research material (§ 2b Z 6) for purposes in accordance with Art. 89 Paragraph 1 GDPR and process all data (§ 2b Z 5) required for this purpose are to ensure optimal access to data (§ 2b Z 5) and research material for purposes according to Art. 89 Para. 1 GDPR ("repositories"), such as in particular:
1. Name information in accordance with Section 2g, Paragraph 2, Item 1,
[...]
5. Other data that are required for archiving and classification, such as data on the location or information in accordance with Section 2g Paragraph 2 Nos. 1 and 2 on persons who have made the research material available, and
6. Further information, such as in particular:
a) political background information [...] "
33. It follows from the cited provisions of Section 2 f (1) FOG that the Respondent has a sufficient legal basis to manage the “editing archive”.
34. The reason for deletion in accordance with Article 17 (1) (d) GDPR is therefore not available. Union law, together with supplementary national law, also covers the processing of special categories of data for archiving purposes in the public interest, including “political background information” on persons who are the subject of archived documents. In any case, a categorization is covered which, as is the case here, enables media reports to be found that ascribe the complainant a “völkisch” or “German national” sentiment.
b. Existence of an effective objection
35. Finally, it must be checked whether the respondent had to take into account an objection by the complainant, which, according to Art. 17 (1) (c) GDPR, would also result in an obligation to delete, based on the logical-systematic context of the last-cited provision it is to be concluded that this applies not only to the objection in accordance with Art. 21 Paragraph 1 or 2 GDPR, but also for that in accordance with Paragraph 6 leg. cit. must apply.
36. Only an objection in accordance with Art. 21 (6) GDPR comes into question, which special provision regulates the objection to data processing for the processing purposes mentioned in Art. 89 (1) GDPR.
37. According to Art. 21 (6) GDPR, the data subject has the right, on grounds relating to his or her particular situation, to object to the processing of personal data concerning him or her, which is carried out for scientific or historical research purposes or for statistical purposes in accordance with Art 89 para. 1 takes place, unless the processing is necessary to fulfill a task in the public interest.
38. As is made clear in particular by Recital 156 of the GDPR, the Member States should be allowed, under certain conditions and subject to suitable guarantees for the data subjects, to provide more precise information and exceptions to the rights of deletion and objection to the processing of personal data archiving purposes that are in the public interest, for scientific or historical research purposes or for statistical purposes.
39. The right of objection according to Art. 21 (6) GDPR is a relative right of objection that must be justified. According to Art. 21 Paragraph 6, the person responsible can reject the objection if the processing is necessary for scientific, historical or statistical purposes to fulfill a task in the public interest (according to Haidinger in Knyrim, DatKomm Art. 21 GDPR (as of October 1, 2018 , rdb.at), margin nos. 2 and 45 f).
40. In order to justify his objection or request for deletion, the complainant put forward in summary form that the respondent did not process data for archiving purposes or for scientific and historical research purposes, but used this data or had it in a press release from the [Editor's note: date for reasons of pseudonymisation abridged] 2018 - which according to the Respondent's submission, however, was a statement by a scientific employee of the Respondent to a media service - used to damage his public image and to exert "daily political influence".
41. Whether this is or was so could be left open, because the use of archive data, which according to § 2 f (1) 6 lit. a FOG may be processed expressly with the addition of “political background information”, is public for such purposes Interest in this data processing is unable to cancel (see also above). In order to protect his legally protected interests in this regard, the complainant would be free to proceed against the statement (media report, press release, statement to a media employee or media service, content of an interview, etc.) using the means of civil and media law.
42. However, the complainant has not been able to prove a well-founded objection from which it would have emerged that the processing of data concerning the complainant for scientific, historical or statistical purposes is not necessary for the fulfillment of a public interest task.
43. Therefore, the respondent rightly refused to delete the complainant's data, also on the basis of the right to object pursuant to Section 21 (6) GDPR.
44. The complaint was therefore to be dismissed according to the ruling.
European Case Law Identifier
ECLI: AT: DSB: 2021: DSB.D124.1177.0006.DSB.2019
