VfGH Overturns Media Data Privilege

Feb 10, 2023 Benn-Ibler Rechtsanwälte

The Austrian Constitutional Court (Verfassungsgerichthof, VfGH) has overturned the media’s privilege provided for in Section 9 (1) of the Austrian Data Protection Act (Datenschutzgesetz, DSG) as unconstitutional. Lawmakers are now required to adopt a revised and more nuanced regulation by the middle of 2024.

Section 9(1) of the Austrian Data Protection Act provides that the Data Protection Act and parts of the EU’s General Data Protection Regulation (GDPR) do not apply to data processing by media owners, publishers, and employees of media companies and media services.

In the original proceedings, a man had complained to the Austrian Data Protection Authority. His business card had been displayed in an unredacted form in an article and on pictures of a house search featured on a media company’s website. The Data Protection Authority rejected the complaint because it did not consider itself competent as the media company was exempt from DPA compliance. He then complained to the Federal Administrative Court, which consequently submitted a law review application to the Austrian Constitutional Court.

In its ruling, the Austrian Constitutional Court found that Section 9 (1) of the Data Protection Act violates the fundamental right to data protection as guaranteed under Section 1 (1) of the Data Protection Act.

According to Art 85 (1) of the GDPR, EU member states are required to regulate the relationship between data protection and the right to freedom of expression and information.

Firstly, the Austrian Constitutional Court made it clear that while Section 9 (1) of the Austrian Data Protection Act provides certain exemptions from the Data Protection Act, the constitutional provision of Section 1 (1) of the Austrian Data Protection Act (i.e., an individual’s fundamental right to data protection) nevertheless applies. This provides for a balancing of the interests of the person affected and the opposing, legitimate interests of other persons for an encroachment on this fundamental right.

The complete and absolute exclusion of the application of all provisions of the DPA and large parts of the GDPR contradicts this necessary proper balancing. Therefore, legislators are required to provide for a nuanced and adequate balancing of an individual's interests regarding data protection vis-à-vis the media and the requirements of journalistic activity protected by Art 10 ECHR. For example, restrictions in terms of manpower, time or material or more stringent requirements regarding internal organisation, documentation, and security of the collected data must be taken into consideration.

VfGH G 287/2022-16, G 288/2022-14 (14.12.2022)