Recent decisions of the Austrian Data Protection Authority

1. Disclosure of trade union data (16.9.2020, DSB-D123.431/0003-DSB/2018):

The Austrian Data Protection Authority had to deal with a complaint regarding the right to confidentiality (§ 1 of the Austrian Data Protection Act).
The complainant was an employee of the respondent. After terminating her employment, the respondent informed her co-workers, her clients and the mayor of the termination in a letter, also disclosing the complainant's trade union membership.

Trade union membership is considered "particularly sensitive data" under Article 9(1) of the GDPR, and the principle of prohibition therefore applies. The respondent relied on the permissive element of Article 9(2) lit e GDPR and argued that the complainant had already made her trade union membership public. Furthermore, the procedure had also been justified in order to avert an eminent evil (i.e. possible claims for damages) within the meaning of Article 9(2) lit f GDPR.

In this regard, the DPA has stated that the exceptions in Article 9 (2) GDPR are to be interpreted narrowly. The fact of "obvious own publication" within the meaning of lit e leg.cit. requires an own act of will on the part of the data subject. Neither the fact that the complainant allowed herself to be photographed in public with members of the trade union, nor her activity as a works council member and the related cooperation with the trade union, can be considered as an own act of will to publish.

Also the existence of a legal claim pursuant to Art 9(2) lit f GDPR was denied, as the respondent had only expressed fears that claims for damages could arise in the future, but no concrete legal claims existed or were asserted

In the absence of a permissive provision under Article 9 (2) GDPR, the disclosure of the trade union membership was therefore unlawful and the complainant's right to confidentiality was violated.

The decision is legally binding.

2. Publication of personal data in the context of election advertising (21.8.2020, 2020-0.208.921 [DSB-D124.141]):

The DPA had to deal with the publication of personal data by an election campaigning party for the purpose of election advertising. The DPA came to the conclusion, that the disclosure was not in the predominant interest of eligible voters and granted the complaint.

The respondent, which was an election campaigning party, published a leaflet in the context of pre-elections for a municipal representation election, to which the electoral register of the municipality was attached. This contained the first name and surname, address and year of birth of the complainant and numerous other persons. In the subsequent complaint proceedings before the DPA, the respondent argued that the electoral roll had been permissibly made available to it by the municipality and that the subsequent disclosure was in the overriding interest of those entitled to vote, as all eligible persons had thus been listed in a transparent manner.

In the opinion of the DPA, the respondent, as a legal person under private law, could in principle rely on "legitimate interests of third parties". However, due to the fact that the Voters' Card Act allows for the inspection of the electoral roll at the respective municipality, there was no outweighing of the interests against the complainant's interest in secrecy.

The decision is not yet legally binding.

Article provided by: Clemens Thiele (Eurolawyer, Austria)

Discover more about INPLP, the INPLP-Members and the GDPR-FINE database

Dr. Tobias Höllwarth (Managing Director INPLP)