VwGH: Wrong Addressee May End in Repeal without Substitution

Sept 1, 2023 Benn-Ibler Rechtsanwälte

The Austrian Administrative Court (Verwaltungsgerichtshof, hereinafter VwGH) has ruled that it is legitimate for the Federal Administrative Court (Bundesverwaltungsgericht, hereinafter BVwG) to revoke a decision if it is found that the person to whom the decision was addressed was not in fact the data controller. Consequently, dismissal of a data protection complaint is not always mandatory.

In the original case, the co-participant had lodged a complaint with the Austrian data protection authority, DSB, against the Office of the Provincial Government of Vorarlberg. He had received a vaccination reminder and believed that his personal data in the central vaccination register had been unlawfully accessed. DSB agreed with him and found that the Office of the Vorarlberg Provincial Government had violated the co-participant’s right to confidentiality. The Vorarlberg Provincial Government appealed against this decision to the BVwG.

The BVwG held that it was the health officer of the Province of Vorarlberg and not the Office of the Provincial Government of Vorarlberg that was responsible under data protection law, and overturned the notice of the DSB.

The Vorarlberg Provincial Government consequently lodged an appeal against this decision, claiming that the data protection complaint should have been rejected and that a repeal of the notice without substitution did not necessarily end the case.

The VwGH considered this:

Under Section 24(2)(2) of the Austrian Data Protection Act, a complainant is not required to identify the data controller if this is not reasonable. In such cases, DSB must identify the controller without delay. The BVwG rightly assumed that it was not beyond doubt whether the complainant actually intended to direct his complaint against the Office of the Vorarlberg Provincial Government or whether he erroneously assumed that the Provincial Counsellor and the Office of the Provincial Government were the same thing and identical. Since the data protection complaint was therefore not undoubtedly directed against a specific body (that was not the data controller), the data protection complaint was not to be rejected.

The DSB notice was rightfully (as far as the proceedings against the Vorarlberg Provincial Government were concerned) and simply repealed without substitution. The data protection complaint (correctly against the provincial government) is therefore (again) to be continued.

VwGH Ro 2023/04/0013-8 (27 June 2023)