GDPR – Is it Allowed to Publish Workplace Email Addresses?

Nov 22, 2024 Benn-Ibler Rechtsanwälte

The Austrian Administrative Court (Verwaltungsgerichtshof, hereinafter VwGH) has ruled on whether the publication of school teachers’ official email addresses on the school website is in breach of the General Data Protection Regulation (GDPR).

The appellant in the case at hand is a teacher at a vocational school. The school operates a public website which publishes teachers’ names, surnames, academic degrees, and work email addresses. The purpose of the list of teaching staff was to enable students and parents to contact individual teachers for work-related purposes in an easy and direct manner. It also allowed potential students to get to know the teaching staff.

The appellant in the appeal proceedings considered that his right to confidentiality had been violated by the publication of his personal data, and claimed that Articles 5 and 6 of the GDPR had been infringed. Consequently, he filed a data protection complaint against the school’s headmaster with the data protection authority. The data protection authority as well as the Austrian Federal Administrative Court dismissed the complaint as unfounded, as the publication of the email addresses was justified under Art. 6 (1) (e) GDPR.

The case was then referred to the VwGH, which upheld the decision of the lower courts.

According to Article 6(1)(e) of the GDPR, the processing of personal data is lawful if it is necessary for the performance of a task carried out in the public interest. It therefore depends on whether such tasks in the public interest are adequately described in Section 56 of the Austrian School Education Act (Schulunterrichtsgesetz, SchUG) and whether the data in question serves one of these purposes.

One of the responsibilities of a headmaster is to handle ‘external relations and providing access to the school’. This includes, in particular, active contact with parents and guardians. Given this, there is no doubt that the tasks described, which ultimately aim to ensure that a school runs smoothly, are in the public interest.

This means that publishing this type of data is necessary to ensure the smooth running of the school. In addition, there is no reasonable alternative that would be just as effective in fulfilling this task. The principle of data minimisation was therefore not violated by the publication of this data.

VwGH Ro 2022/04/0031 (3 September 2024)