W211 2230221-1

M. as chairwoman and the expert lay judge Margareta MAYER-HAINZ and the expert lay judge Dr. Ulrich E. ZELLENBERG as observer on the complaint of XXXX, represented by XXXX, against the decision of the data protection authority of XXXX, XXXX, in a data protection matter: A) In accordance with Section 17 VwGVG in conjunction with Section 38 AVG, the proceedings are suspended until the Court of Justice of the European Union has issued a preliminary ruling on the question submitted by the Supreme Court of Justice on February 18, 2021, 6 Ob 159 / 20f. B) The revision is not permitted in accordance with Art. 133 Para. 4 B-VG. text Reason: The Federal Administrative Court has considered: 1. Procedure / findings: 1. With a data protection complaint dated XXXX 2019, the party now involved (hereinafter referred to as mP) complained about the incompleteness of a given information according to Art.

(hereinafter: BF). 2. With its opinion of XXXX 2019, the BF stated that on this data protection complaint, in response to MP's allegation that it had not been informed to whom its data had been transmitted, further detailing at individual recipient level was the disclosure of the distribution channels of BF and their individual customer relationships would mean. Art. 15 GDPR does not imply any obligation to disclose individual recipients; this would also mean disclosure of business and company secrets. The information was given about the categories of recipients. The work of the BF as an address publisher and direct marketing company is also explained in the data protection information. It is requested that the complaint be dismissed. 3. ) The BF was further instructed in other execution to designate the specific recipients of the personal data within a period of four weeks.

4. With a complaint of XXXX 2020, the BF stated in summary that the person responsible had the right to choose whether information should be given to specific recipients or recipient categories. The wording of Art. 15 GDPR clearly speaks in favor of such an option. The data protection authority had also not taken into account the protection of trade and business secrets. 5. With a supplementary statement dated XXXX 2020, the data protection authority submitted that a more detailed information provided by the BF would prove that it was not impossible to provide information to specific recipients, as claimed. 6. By decision of the Supreme Court of February 18, 2021, 6 Ob 159 / 20f, the following question was referred to the Court of Justice of the European Union for a preliminary ruling in accordance with Art. 267 TFEU: "Is Art 15 Paragraph 1 lit c of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data, on the free movement of data and on the repeal of Directive 95/46 / EC (General Data Protection Regulation, OJ L 119/1 of May 4, 2016, S 1; hereinafter "GDPR") to the effect that the claim is limited to information about recipient categories if specific recipients have not yet been determined in the case of planned disclosures However, the right to information must also extend to the recipients of these disclosures if data has already been disclosed?

" 7. On XXXX 2021, the BF filed an application to stay the proceedings because of the pending request for a preliminary ruling by the Supreme Court of February 18, 2021. 8. On XXXX 2021, the BF replied to the supplementary statement of the data protection authority of XXXX 2020. 2. at) . These findings are not in dispute. 3. 1. According to § 38 AVG, which according to § 17 VwGVG is to be applied accordingly in administrative court proceedings, an authority can suspend proceedings until a final decision on a preliminary question, which would have to be decided by other administrative authorities or by the courts as the main question, if the preliminary question already has forms the subject of pending proceedings before the competent court, among others, or such proceedings are pending at the same time. 2. A main question in this sense can also be a question referred to a preliminary ruling procedure pending at the ECJ.

It entitles to suspension according to § 38 AVG if it is prejudicial for the administrative court proceedings (cf. 2011, 2011/22/0316). A legal question is also prejudicial to a “merely” similar legal question, even if the same legal regulation of the same legislature is not affected (cf. 2017, Ra 2017/12/0068). 3. In the case at hand, the mP complains that the BF lacks information about recipients or specific categories of recipients of personal data. 4. Opinions in the literature differ on the question of whether priority should be given to naming the recipients or just categories of recipients within the framework of Art. 15 Para. 1 lit c GDPR. 5. 1. For a right of choice for the person responsible: According to Haidinger in Knyrim, DatKomm Art 15 GDPR margin no. 39, the word "or" implies that the person responsible has the right to choose to disclose recipients or only categories of recipients.

Paal in Paal / Pauly, DS-GVO / BDSG2 Art 15 DSGVO margin no. 6 states that there is a right to choose between "recipients" and "categories of recipients" in favor of the person responsible; this could therefore always be limited to the specification of categories of recipients. 2. Against a right of choice of the person responsible: Dix in Simitis / Hornung / speaks against a right of choice on the part of the person responsible, insofar as future disclosures of the data subject's data to specific recipients have already been determined, and for a "mandatory" extension of the right to information to the names of the recipients if disclosure has already taken place. Spiecker gen. 20. Bäcker in Kühling / Buchner, DS-GVO / BDSG2 Art 15 DSGVO margin no. 16 f also takes the position that the person responsible basically has no right to choose: If he still or already knows the recipient of the data, he must name them on request.

In this case, the person concerned can also request information about the categories of recipients. Ehmann in Ehmann / Selmayr, DSGVO2 Art 15 Rz 20 argues initially that a comparison with Art 30 Para 1 lit d DSGVO shows that, within the scope of the right to information, the naming of the (specific) recipients of personal data not named there takes precedence over the ones exclusively named there Naming the categories of recipients, and then based on the purpose of the right to information: Only the naming of the specific recipient makes it possible to check the lawfulness of the processing. Schantz in Schantz / Wolff, Das neue Datenschutzrecht [2017] margin no. 1198 mwN assumes that the data subject can choose whether he or she would like to know the names of the recipients or just the categories of the various recipients from the person responsible. If the person responsible was left to decide on the content of the information, this would considerably impair the practical effectiveness of the right to information, because knowledge of the specific recipient is often of great importance for the person concerned.

Schmidt-Wudy in Wolff / Brink, BeckOK Datenschutzrecht32 (as of May 1, 2020) Art 15 GDPR margin no. 58 takes the view that it is questionable whether the “or” between “recipient” and “categories of recipients” implies an alternative factual situation or should be understood as "and". The interpretation of the wording leaves the person responsible to choose whether to provide information to the recipients or the categories of recipients; Recital 63 seems to support the view that the "recipients" must be informed in any case and the categories of recipients can be optionally informed. It seems appropriate to assume an obligation to provide information about recipients in any case, but only to accept such an obligation with regard to the categories of recipients if data has been or is to be provided repeatedly, since only then "categories of recipients" exist. 2. Supreme Court Considerations: The wording of Art 15 (1) (c) GDPR does not allow a conclusive assessment of the question.

By referring to the scope of the data subject's right to information and not, for example, the correlating obligation of the person responsible to provide information, the German version indicates that the person concerned has a right to choose. ] les informations suivantes: les destinataires ou catégories de destinataires auxquels les données à caractère personnel ont été ou seront communiquées [... ] "). In contrast to Art 15 GDPR, Art 13 Paragraph 1 lit e and Art 14 Paragraph 1 lit e GDPR does not state the data subject's right to information about “recipients or categories of recipients”, but rather an obligation of the person responsible to provide information. e. at a stage in which there is no actual disclosure of data Third party may have come. 15 GDPR, on the other hand, extends not only to the data subject's currently processed data, but also, according to its intended purpose, to the data stock processed in the past (fundamentally ECJ Rs C-553/07, Rijkeboer, ECLI: EU: C: 2009: 293, Rz 51 ff; the convincing considerations of this decision based on the telos of the right to information are also to be transferred to the right to information according to Art 15 GDPR, especially since it can be derived from recitals 9 and 10 of the GDPR that the European legislator is reducing the Level of protection in relation to Directive 95/46 / EC in general not intended).

Recital 63 of the GDPR states that "every data subject should therefore have a right to know and learn ... ". So here we are not just talking about “categories of recipients”, which also suggests that the person responsible must name the individual recipients. Against this background, the interpretation of Article 15 (1) (c) GDPR must primarily be based on the purpose of the norm: First of all, reference should be made to the telos of the right to information as an auxiliary claim for effective legal enforcement, in particular the rights of data subjects under Article 16 ff GDPR . This purpose of the regulation clearly speaks in favor of an understanding - which is well covered by the wording of the provision - to the effect that the person responsible does not have a discretionary vote with regard to the question of how specifically he wants to comply with the request for information about the recipients of personal data; Rather, the data subject should basically have the choice of whether he wants information only about abstract recipient categories or about the specific recipients of his data.

The opposite understanding of the norm, on the basis of which the person responsible could ultimately always withdraw from merely providing information about the recipient category, led to a considerable impairment of the effectiveness of the legal remedies available to the data subject for the protection of his data, which is aimed at by the European legislator: As the appellate court and the defendant believe - the free choice, a person responsible will hardly ever give detailed information about specific recipients, which is associated with considerable additional effort. In this case, the person concerned will usually only be informed via abstract recipient categories. 6. The question that was submitted to the Court of Justice of the European Union is similar to the legal question to be resolved in the present proceedings within the meaning of the above-mentioned case law; It is also prejudicial: the question of whether specific recipients are to be informed within the framework of Art.