Data Protection: No Shared Responsibility for Employee Access

Jul 4, 2025 Benn-Ibler Rechtsanwälte

The Austrian Administrative Court (Verwaltungsgerichtshof, hereinafter VwGH) has determined that a municipality does not qualify as a data controller within the meaning of the GDPR when its employees access the Austrian Central Register of Residents (Zentrales Melderegister, hereinafter ZMR) autonomously and for personal purposes. Given that the municipality does not establish the purpose or means of this data processing, there is no joint responsibility under Article 26 of the GDPR.

Municipal employees accessing ZMR without authorization:

The case at hand examined the concept of ‘joint responsibility’ under Article 26 of the General Data Protection Regulation (GDPR). Employees of a municipality accessed data from the ZMR for personal reasons. The appellant argued that this action violated his right to confidentiality. Additionally, he was not informed which municipal employees had conducted the queries and thus filed a complaint against the municipality.

DSB and BVwG: The municipality is not liable within the context of the GDPR

Both the Austrian Data Protection Authority (Datenschutzbehörde, DSB) and the Austrian Federal Administrative Court (Bundesverwaltungsgerichtshof, BVwG) dismissed the claim. They reasoned that the municipality was not responsible because the employees had accessed personal data without authorization and used it for their own purposes, which were not aligned with the employer's objectives. In such instances, the employee in question is considered the controller and is accountable for the resulting obligations and liabilities.

Under Article 26 of the GDPR, joint responsibility necessitates that two or more controllers collaboratively determine the purposes and means of processing. This condition is not applicable in this instance.

The VwGH consequently determined that the municipality does not qualify as a controller, within the definition provided by Article 4(7) of the GDPR, whether acting independently or in conjunction with the officials involved.

VwGH Ro 2022/04/0023 (27.03.2025)