DSB-D124.4462

, as well as their initials and abbreviations may have been abbreviated and/or altered for pseudonymization purposes. ] DECISION RULING The Data Protection Authority decides on the data protection complaint filed by Mag. Alfons A*** (complainant) on July 17, 2021, against the Regional Court of Wiener Neustadt (respondent) regarding a violation of the right to erasure as follows: - The complaint is dismissed. Legal basis: Article 51(1), Article 55(3), Article 57(1)(f) and Article 77(1) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ No. 2016, p. 1; Sections 1, 18(1) and 24(1) and (5) of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999 as amended; Section 80 of the Court Organization Act (GOG), Imperial Law Gazette. No. 217/1896 as amended. Legal basis: Article 51, paragraph 1, Article 55, paragraph 3, Article 57, paragraph 1, letter f, and Article 77, paragraph 1, of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), Official Journal No.

Pölten, and the Public Prosecutor's Office of St. Pölten. The respondent did not respond to the deletion request. ” The asset data was already incorrect at the time it was created, and furthermore, the data was collected illegally. ” The asset data was already incorrect at the time it was created, and furthermore, the data was collected illegally. 2. In a letter dated November 25, 2021, the respondent argued, in summary, that the processing of personal data in question was exempt from supervision by the data protection authority pursuant to Article 55 Paragraph 3 of the GDPR and Section 31 Paragraph 1 of the German Data Protection Act (DSG). Furthermore, the requirements of Section 75 of the StPO were not met, and the inaccuracy was merely alleged by the appellant. 2. In a letter dated November 25, 2021, the respondent argued, in summary, that the processing of personal data in question was exempt from supervision by the data protection authority pursuant to Article 55(3) GDPR and Section 31(1) of the Austrian Data Protection Act (DSG).

Furthermore, the respondent argued that the requirements of Section 75 of the Austrian Code of Criminal Procedure (StPO) were not met and that the appellant was merely alleging the inaccuracy of the data. 3. In a letter dated December 26, 2021, the appellant, in the context of the granted right to be heard, argued, in summary, that all proceedings had been based solely on false accusations and that the data should be deleted pursuant to Section 75(1) of the Austrian Code of Criminal Procedure (StPO). The respondent further argued that the data protection authority was competent to handle the matter. B. Subject of the Complaint Based on the complainant's submissions, the subject of the complaint is whether the respondent violated the complainant's right to erasure by not complying with the request. First, it must be determined whether the data protection authority has jurisdiction to make a substantive assessment.

C. 1. 2. The respondent did not respond to this request before the complaint was filed. During the proceedings before the data protection authority, the respondent refused the erasure. Evaluation of evidence: These findings are based on the complaint of July 17, 2021, and the accompanying letter of May 3, 2021, as well as – particularly with regard to the refused deletion – on the respondent's statement of November 25, 2021. D. 1. On the jurisdiction of the data protection authority: Pursuant to Article 55(3) GDPR, supervisory authorities are not competent to supervise processing carried out by courts in the exercise of their judicial functions, with Recital 20 of the GDPR stating that this is intended to serve the independence of the judiciary in the exercise of its judicial functions, including decision-making. Article 20 of the GDPR states that this is intended to serve the independence of the judiciary in the performance of its judicial functions, including decision-making.

13; Selmayr in Ehmann/Selmayr, GDPR [2017] Article 55, paras. ). 848/0001-DSB/2019). Ref. No. 461/0004-DSB/2018, and of January 22, 2019, Ref. No. 848/0001-DSB/2019). Ref. No. 848/0001-DSB/2019 In its judgment of 24 March 2022 in Case C-245/20, the CJEU held the following regarding the interpretation of Article 55(3) GDPR (emphasis added by the Data Protection Authority): “28. In order to determine the scope of the concept of processing carried out by courts in the course of their judicial activities within the meaning of Article 55(3) of Regulation 2016/679, it should be noted that when interpreting a provision of EU law, it is necessary to take into account not only its wording but also its context and the objectives pursued by the legislation of which it forms part (see, to that effect, inter alia, judgment of 6 October 2020, Jobcenter Krefeld, 2016/679). C-181/19, EU:C:2020:794, paragraph 61 and the case-law cited therein).

“28 In determining the scope of the concept of processing carried out by courts in the course of their judicial activities within the meaning of Article 55(3) of Regulation 2016/679, it should be noted that when interpreting a provision of EU law, it is necessary to take into account not only its wording but also its context and the objectives pursued by the rules of which it forms part (see, to that effect, inter alia, judgment of 6 October 2020, Jobcenter Krefeld, C-181/19, EU:C:2020:794, paragraph 61 and the case-law cited therein). 29. It is clear from Article 55 of Regulation 2016/679 that this article establishes the competence for the supervision of the processing of personal data and, in particular, limits the competence conferred on the national supervisory authority. 30. Article 55(3) of Regulation 2016/679 therefore provides that national supervisory authorities are not competent for processing carried out by courts “in the course of their judicial activities”.

30. Article 55(3) of Regulation 2016/679 therefore provides that national supervisory authorities are not competent for processing carried out by courts “in the course of their judicial activities”. ” Recital 20 of Regulation 2016/679, in the light of which Article 55(3) of the Regulation must be interpreted, states that the supervision of processing operations carried out by courts “in the course of their judicial activities” should be entrusted to specific bodies within the judicial system of the Member State concerned, and not to its supervisory authority, so that “the independence of the judiciary in the exercise of its judicial functions, including its decision-making, remains unaffected. 32. As the Advocate General stated in points 80 and 81 of his Opinion, it is clear from the wording of recital 20 of Regulation 2016/679, and in particular from the use of the word ‘including’, that the scope of the objective pursued by Article 55(3) of the Regulation, namely to safeguard the independence of the judiciary in the exercise of its judicial functions, cannot be limited solely to guaranteeing judicial independence in the context of the adoption of a specific judicial decision.

The safeguarding of the guarantees of independence and impartiality required under Union law presupposes the existence of rules that make it possible to dispel any legitimate doubt among those subject to the law as to the imperviousness of the institution in question to external factors and to its neutrality with regard to the interests concerned; see, in this sense, inter alia, Judgments of 27 February 2018, Associação Sindical dos Juízes Portugueses, C-64/16, EU:C:2018:117, paragraph 44; of 25 July 2018, Minister for Justice and Equality [Deficiencies of the Justice System], C-216/18 PPU, EU:C:2018:586, paragraph 63; of 24 June 2019, Commission v Poland [Independence of the Supreme Court], C-619/18, EU:C:2019:531, paragraph 72; and of 21 December 2021, Euro Box Promotion and Others, C-357/19, C-379/19, C-547/19, C-811/19, C-840/19, EU:C:2021:1034, paragraph 225). 34. Consequently, the reference in Article 55(3) of Regulation 2016/679 to processing carried out by courts “in the course of their judicial activities” must be understood in the context of the Regulation as not being limited to the processing of personal data carried out by the courts in the context of specific legal cases, but rather encompassing, in a broader sense, all processing operations carried out by the courts in the course of their judicial activities, so that processing operations are excluded from the supervisory authority’s jurisdiction if its control could directly or indirectly affect the independence of the members or decisions of the courts.

34 Consequently, the reference in Article 55(3) of Regulation 2016/679 to processing carried out by courts “in the course of their judicial activities” must be understood in the context of the Regulation as not being limited to the processing of personal data carried out by courts in specific cases, but rather encompassing, more broadly, all processing operations carried out by courts in the course of their judicial activities. This means that processing operations are excluded from the supervisory authority’s jurisdiction if its oversight could directly or indirectly affect the independence of the members or decisions of the courts. ” 35 It must be noted that the term "judicial activity" is an autonomous concept under EU law, which cannot be interpreted based on the national understanding of the term in the context of monocratic or collegial judicial administration. As the cited judgment makes clear, the concept of judicial activity extends beyond the national understanding of judicial administration.

The processing in question here relates to the maintenance of judicial files, which is also part of fulfilling the tasks of the ordinary courts. Based on the CJEU's broad understanding of the term "judicial activity," it must be assumed that the processing of personal data relating to the content of judicial files in the eJustice system pursuant to Section 80(2) of the Courts Act (GOG) must also fall under this definition. In particular, it must be assumed that a review and – as requested by the complainant – deletion of his personal data from the automated judicial system (which could also entail deletion from the paper file) requires the action of a judge in the exercise of his judicial office. Based on the broad understanding of the term "judicial activity" adopted by the CJEU, it must be assumed that the processing of personal data in connection with the content of court files in the eJustice system pursuant to Section 80, Paragraph 2, of the Courts Act (GOG) must also be subsumed under this term.

In particular, it must be assumed that a review and – as requested by the complainant – deletion of his personal data from the automated judicial system (which could also entail deletion from the paper file) requires the action of a judge in the exercise of his judicial office. ] ... The Federal Administrative Court (BVwG) correctly states – with regard to the judgment of the European Court of Justice (ECJ) of 24 March 2022 – that even an indirect influence on the independence of a court's decisions is sufficient to preclude the supervisory authority of the national supervisory authority pursuant to Article 55(3) GDPR. Since judges can access information in the case file – such as evidence, decisions and their reasoning, which have been used in other – similar – proceedings – data processing in the case file may influence the formation of opinions and thus the decisions of courts. Control of data processing in the VJ by the data protection authority is therefore precluded in accordance with the cited case law of the CJEU in C-245/20.

284 that the data protection authority lacks jurisdiction to address the matter. The Federal Administrative Court (BVwG) correctly states – with regard to the judgment of the European Court of Justice (ECJ) of 24 March 2022 – that even an indirect influence on the independence of a court's decisions is sufficient to preclude the supervisory authority of the national supervisory authority pursuant to Article 55(3) GDPR. Since judges can access information in the case file – such as evidence, decisions, and their reasoning, which have been used in other – similar – proceedings – data processing in the case file may influence the formation of opinions and thus the decisions of courts. Therefore, in accordance with the cited ECJ case law in C-245/20, the data protection authority is not permitted to monitor data processing in the case file. 2. Result Based on the reasoning presented by the Federal Administrative Court (BVwG) and the cited judgment of the European Court of Justice (ECJ), which interprets the term "judicial activity" broadly, the requirements of Article 55(3) GDPR are met in this case. Therefore, the decision was rendered accordingly.