W137 2327171-1

Date of Decision July 8, 2026 Legal Basis B-VG Art. 133, para. 4 DSG § 1 DSG § 24 DSG §24(1) DSG §24(5) DSG §9(1) GDPR Art. 4 GDPR Art. 5 GDPR Art. 6 GDPR Art. 6(1)(f) VwGVG §28(2) B-VG Art. 133 (current version); B-VG Art. 133 effective from January 1, 2019, through May 24, 2018; last amended by BGBl. I No. 138/2017 B-VG Art. 133 effective as of January 1, 2019, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 effective from May 25,May 2018 through December 31, 2018; last amended by Federal Law Gazette I No. 22/2018; B-VG Art. 133, effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164/2013, B-VG Art. 133, effective from Jan. 1, 2014, through July 31, 2014, last amended by Federal Law Gazette I No. 51/2012 Federal Constitutional Law (B-VG) Art. 133, effective from January 1, 2004, through December 31, 2013, last amended by Federal Law Gazette I No.

100/2003 B-VG Art. 133 effective from January 1, 1975, through December 31, 2003, last amended by Federal Law Gazette No. 444/1974 B-VG Art. 133 valid from Dec. 25, 1946, through Dec. 31, 1974, last amended by Federal Law Gazette No. 211/1946 B-VG Art. 133 valid from Dec. 19,December 1945 through December 24, 1946; last amended by State Law Gazette No. 4/1945; B-VG Art. 133; in effect from January 3, 1930, through June 30, 1934 DSG Art. 1 § 1 (now DSG Art. 1 § 1), effective as of Jan. 1, 2014, last amended by Federal Law Gazette I No. 51/2012 DSG Art. 1 § 1 valid from Jan. 1, 2000, through Dec. 31, 2013 DSG Art. 2 § 24 (now DSG Art. 2 § 24), effective as of July 15, 2024, last amended by Federal Law Gazette I No. 70/2024; DSG Art. 2 § 24, effective from May 25,May 2018 through July 14, 2024; last amended by Federal Law Gazette I No. 120/2017 DSG Art. 2 § 24 valid from January 1, 2010, through May 24,2018, last amended by Federal Law Gazette I No.

133/2009, DSG Art. 2 § 24, effective from Jan. 1, 2000, through Dec. 31, 2009 DSG Art. 2 § 24 (current) DSG Art. 2 § 24 effective as of July 15, 2024, last amended by Federal Law Gazette I No. 70/2024 DSG Art. 2 § 24 effective from May 25,May 2018 through July 14, 2024; last amended by Federal Law Gazette I No. 120/2017 DSG Art. 2 § 24 valid from January 1, 2010, through May 24,2018, last amended by Federal Law Gazette I No. 133/2009, DSG Art. 2 § 24, effective from Jan. 1, 2000, through Dec. 31, 2009 DSG Art. 2 § 24 (current) DSG Art. 2 § 24 effective as of July 15, 2024, last amended by Federal Law Gazette I No. 70/2024 DSG Art. 2 § 24 effective from May 25,May 2018 through July 14, 2024; last amended by Federal Law Gazette I No. 120/2017 DSG Art. 2 § 24 valid from January 1, 2010, through May 24,2018, last amended by Federal Law Gazette I No. 133/2009, DSG Art. 2 § 24, effective from Jan.

1, 2000, through Dec. 31, 2009 DSG Art. 2 § 9 (currently in effect) DSG Art. 2 § 9 effective from July 1, 2024, through June 30, 2024, last amended by Federal Law Gazette I No. 2/2023 DSG Art. 2 § 9 effective as of July 1, 2024, last amended by Federal Law Gazette I No. 62/2024 DSG Art. 2 § 9 effective from May 25,May 25, 2018, through June 30, 2024; last amended by Federal Law Gazette I No. 24/2018 DSG Art. 2 § 9 valid from May 25, 2018, through May 24,2018, last amended by Federal Law Gazette I No. 120/2017, DSG Art. 2 § 9, effective from April 1, 2005, through May 24, 2018, last amended by Federal Law Gazette I No. 13/2005 DSG Art. 2 § 9 effective from January 1, 2000, through March 31, 2005 VwGVG § 28 (currently VwGVG § 28), effective as of January 1, 2019, last amended by Federal Law Gazette I No. 138/2017; VwGVG § 28 valid from January 1, 2014, through December 31, 2018 Decision , W137 2327171-1/3E IN THE NAME OF THE REPUBLIC!

The Federal Administrative Court, with Judge Mag. Peter HAMMER presiding and expert lay judges Mag. Ursula ILLIBAUER and Mag. Martina CHLESTIL as associate judges, has ruled on the complaint filed by XXXX against the decision of the Data Protection Authority dated October 15, 2025, Ref. No. 293: The Federal Administrative Court, presided over by Judge Mag. Peter HAMMER and with expert lay judges Mag. Ursula ILLIBAUER and Mag. Martina CHLESTIL as associate judges, has ruled on the complaint filed by Roman 40 against the decision of the Data Protection Authority dated October 15, 2025, Ref. No. The complaint is dismissed as unfounded pursuant to Section 28(2) of the VwGVG in conjunction with Section 24(1) and (5) of the DSG, as amended. The appeal is not admissible pursuant to Article 133(4) of the Federal Constitutional Act (B-VG). The appeal is not admissible pursuant to Article 133(4) of the Federal Constitutional Act (B-VG).

Text Reasons for the Decision: I. Course of Proceedings: Roman numeral I. Course of Proceedings: 1. In a procedural motion dated April 8, 2025, XXXX (= co-party before the Federal Administrative Court and petitioner before the Data Protection Authority) filed a data protection complaint against XXXX (= complainant before the Federal Administrative Court and respondent before the Data Protection Authority) regarding an alleged violation of the right to confidentiality. The main grounds cited were that the complainant, without justifiable cause within the meaning of the GDPR, had made a court judgment—in which the intervening party’s last name appeared due to her testimony—publicly available for download via Dropbox. The complainant had also shared this link in a Facebook group with several hundred members, including current and former colleagues of the co-party. 1. In a procedural filing dated April 8, 2025, Roman 40 (= co-party before the Federal Administrative Court and petitioner before the Data Protection Authority) filed a data protection complaint against Roman 40 (= complainant before the Federal Administrative Court and respondent before the Data Protection Authority) regarding an alleged violation of the right to confidentiality.

The grounds for the complaint essentially stated that the complainant, without justifiable cause within the meaning of the GDPR, had made a court judgment—in which the last name of the co-party appeared due to her testimony—publicly available for download via Dropbox. The complainant had also shared this link in a Facebook group with several hundred members, including current and former colleagues of the co-party. 2. In her statement dated April 26, 2025, the complainant essentially stated—insofar as relevant to the proceedings—that the shared judgement was a decision of the Labor and Social Court (hereinafter: ASG) in an employment law proceeding in which she, as the plaintiff, had filed a lawsuit against her employer, a private university. The co-party had appeared in the proceedings as the employer’s representative and as a witness. The significance of this judgement extends far beyond her individual case because it raises fundamental questions regarding the legal treatment of numerous employment contracts at the university.

The Facebook group in which she shared the judgement was a closed group for her employer’s staff with approximately 230 members. The name of the co-party was included only in abbreviated form, and her full name, as well as significantly more detailed personal information, were already publicly accessible via the university’s official employee directory and her professional LinkedIn profile. 3. In a statement dated April 29, 2025, the co-party essentially argued—insofar as relevant to the proceedings—that the complainant had at no time explained why the mention of her name was necessary for the publication. Rather, the complainant was dragging the co-party, as a private individual, into a public defamation campaign directed against her employer. Contrary to the complainant’s assertions, the Facebook group in question is accessible to a wider audience. Furthermore, the complainant also published the judgement on her Facebook and LinkedIn profiles, which are publicly accessible worldwide.

To disseminate the judgement, she initially used the Dropbox service and subsequently Adobe. These providers deleted the file upon request (from the co-party), about which the complainant publicly complained. 4. In its decision dated October 15, 2025, Ref. No. 293, the Data Protection Authority upheld the data protection complaint of April 8, 2025, and determined that the complainant had thereby violated the co-party’s right to confidentiality by publishing, without legal justification, a court judgment in which the co-party was named on her personal Facebook profile and in a Facebook group by providing a publicly accessible link. In this decision, the Data Protection Authority essentially made the following findings of fact: During the period relevant to the proceedings, the complainant was (had been) employed as an assistant professor at XXXX. During the period relevant to the proceedings, the complainant was (had been) employed as an assistant professor at Roman 40.

In that proceeding, the complainant sought a declaration that the employment relationship was valid, or, alternatively, a challenge to the termination. Proceedings were pending between the complainant (plaintiff) and Roman 40 (defendant) before the ASG under case no. 25 Cga 126/24 t-28. In that case, the complainant sought a declaration that the employment relationship was valid or, alternatively, a challenge to the termination. In its judgement of January 23, 2025, the ASG granted the complainant’s lawsuit and determined that the complainant’s employment relationship with Roman 40 continued beyond July 31, 2024. The co-party is employed as Senior Legal Counsel at the Austrian XXXX and at XXXX, respectively. The co-party is employed as Senior Legal Counsel at the Austrian Roman 40 or at Roman 40. She testified as a witness in the aforementioned labor law proceedings. In a Google search in which the title along with the last name and the search term “XXXX” are entered, the LinkedIn profile of the co-party appears on the first page of the search results, from which the co-party’s first name (as well as other information) can be deduced(en).

When performing a Google search in which the title, last name, and the search term “Roman 40 ” is entered, the LinkedIn profile of the co-party appears on the first page of the search results, from which the co-party’s first name (as well as other information) can be derived. In April 2025, the complainant published the aforementioned ASG judgement—in the form in which she received it as a party to the proceedings, unaltered and in its entirety—via a (publicly accessible) Dropbox link and later via a (publicly accessible) Adobe link on Facebook. Specifically, this occurred on her public Facebook profile as well as in a closed Facebook group consisting of approximately 230 members of the XXXX community who had moved to Austria as part of an institutional relocation. In April 2025, the complainant published the aforementioned ASG judgement—in the form in which she had received it as a party to the proceedings, unchanged and in its entirety—on Facebook via a (publicly accessible) Dropbox link and later via a (publicly accessible) Adobe link.

Specifically, this occurred on her public Facebook profile as well as in a closed Facebook group consisting of approximately 230 members of the “Römisch 40” community, who had moved to Austria as part of the institutional relocation. The respective file was deleted from Dropbox and Adobe after notification by the co-party. The co-party, or rather her title and last name, is mentioned several times (as a witness) in the judgement published by the complainant. Based on these findings of fact, the respondent authority essentially concluded the following from a legal perspective: The complainant argued that only the title and last name of the co-party had been published in the judgement, meaning she could not be uniquely identified. However, according to the case law of the CJEU, the existence of means that could reasonably and likely be used to identify the person in question is essential for identifiability.

As can be seen from the findings, it is readily possible to determine the full name of the co-party (including their professional title) using a simple Google search, which is why it must undoubtedly be assumed that the person is identifiable within the meaning of Art. 4(1) of the GDPR. As can be seen from the findings, it is readily possible to determine the full name of the party involved (including their professional title) using a simple Google search; therefore, it must undoubtedly be assumed that the data subject is identifiable within the meaning of Article 4(1) of the GDPR. The only possible justification is the legal basis of “legitimate interests” pursuant to Article 6(1)(f) of the GDPR. Although the existence of legitimate interests must generally be affirmed, both publications would prove to be excessive, because, on the one hand, the ASG judgement was made accessible to a larger group of uninvolved individuals and, on the other hand, the disclosure of the name of the co-party was not necessary to achieve the purpose pursued by the complainant—namely, to inform colleagues in similar labor law situations.

The only justifiable ground for processing is “legitimate interests” pursuant to article 6(1)(f) of the GDPR. Although the existence of legitimate interests can generally be affirmed, both publications would prove to be excessive, because, on the one hand, the ASG’s judgement had been made accessible to a larger group of uninvolved persons and, on the other hand, the disclosure of the co-party’s name was not necessary to achieve the complainant’s intended purpose—informing colleagues in similar labor law situations. A less intrusive but equally effective measure would have been to publish the judgment while simultaneously redacting the name of the co-party. 5. In the complaint filed against this decision within the prescribed time limit, the appellant essentially argued: The respondent authority had misapplied § 1(1) of the Data Protection Act (DSG) because there was no legitimate interest in confidentiality in this case, as not every processing of personal data constitutes an infringement of privacy.

The co-party did not appear in the labor court proceedings as a private individual, but rather in her public professional capacity during a public hearing. The party in question promotes their professional role on LinkedIn themselves, providing their first name, last name, title, position, place of work, and place of residence. Consequently, this information is generally available, which is why Para 1 of Section 1 of the DSG expressly excludes any interest in confidentiality. The respondent authority misapplied Section 1(1) of the DSG because, in this case, there is no legitimate interest in confidentiality, as not every processing of personal data constitutes an infringement of privacy. The co-party did not appear in the labor court proceedings as a private individual, but rather in her public professional capacity as part of a public hearing. She herself promotes her professional role on LinkedIn, providing her first name, last name, title, position, place of work, and place of residence.

Consequently, this information is generally available, which is why Section 1(1) of the DSG expressly excludes the interest in confidentiality. In the ASG’s judgement, the co-party is referred to merely as Witness XXXX, and the mere mention of her title and last name in proceedings in which she voluntarily participated as an institutional representative of her employer does not affect any privacy interest worthy of protection. In the ASG’s judgement, the co-party is referred to merely as “Witness 40,” and the mere mention of her title and last name in proceedings in which she voluntarily participated as an institutional representative of her employer does not infringe upon any privacy interest worthy of protection. Furthermore, the respondent authority failed to weigh the interests of data protection against freedom of expression pursuant to Article 85 of the GDPR and Section 9 of the DSG.

In the present case, the complainant’s fundamental rights under Article 10 of the ECHR (1. the right to be informed about labor law precedents, 2. the right to report on her own legal dispute, 3. the right to defend her professional reputation against institutional representations) would outweigh the other party’s interest in confidentiality. Furthermore, the respondent authority failed to balance the interests of data protection and freedom of expression in accordance with article 85 of the GDPR and Section 9 of the DSG. In the present case, the complainant’s fundamental rights under article 10 of the ECHR (1. the right to information regarding labor law precedents, 2. the right to report on her own legal dispute, 3. the right to defend her professional reputation against institutional representations) outweigh the other party’s interest in confidentiality. Finally, the respondent authority’s view that redacting the personal data in the ASG’s judgement would have been a less restrictive measure is misguided, because this would not have been an equally effective means of presenting the institutional action in a comprehensible and transparent manner.

The complainant therefore moved that the Federal Administrative Court 1. set aside the contested decision; 2. in the alternative, to remand the matter to the respondent authority for a new decision; and 3. 3. to rule that the publication of a labor court judgement concerning one’s own legal dispute, in which individuals are named exclusively in their professional capacity as representatives of an institution, does not constitute a violation of the right to confidentiality pursuant to Section 1, paragraph 1, of the DSG, provided that the data subject acted in their publicly advertised professional capacity and the information is generally accessible. 7. In a letter from the Data Protection Authority dated November 14, 2025 (received on November 21, 2025), the complaint, together with the administrative decision, was forwarded to the Federal Administrative Court. The letter essentially referred to the decision and requested that the complaint be dismissed.

3. The co-party works as Senior Legal Counsel at the Austrian XXXX and was called as a witness in the above-mentioned labor law proceeding. Notwithstanding her professional connection to the then-respondent in the labor law proceedings, she is not a party to those proceedings and has no authority over the legal acts at issue therein. 3. The co-party works as Senior Legal Counsel at the Austrian company Roman 40 and was examined as a witness in the aforementioned labor law proceedings. Notwithstanding her professional connection to the then-respondent in the labor law proceedings, she is not a party to those proceedings and is not responsible for the legal acts at issue therein. A Google search using the title and last name of the co-party in combination with the search term “XXXX” displays her LinkedIn profile on the first page of the search results. This profile reveals, in particular, her first name as well as other information.

A Google search using the title and last name of the co-party in combination with the search term “Roman 40” displays her LinkedIn profile on the first page of search results. This profile reveals, in particular, her first name as well as other information. 4. In April 2025, the complainant published the ASG’s judgement on Facebook, unedited and in its entirety. 4. In April 2025, the complainant published the ASG’s judgement unaltered and in its entirety on Facebook. The publication took place both via her publicly accessible Facebook profile and in a closed Facebook group with approximately 230 members from the Roman 40 community who had relocated to the Vienna site as part of the institutional move to Austria. The judgement was initially made available via a publicly accessible Dropbox link and subsequently via an Adobe link that was also publicly accessible. Following a report by the co-party, the respective files were removed from Dropbox and Adobe, respectively.

This refers to the copy of the judgement that was sent to the complainant as a party to the proceedings. In the published judgement, the co-party is named multiple times as a witness, with her title and last name explicitly stated. The connection to the (then) shared employer in the context of a search is virtually obvious even to outsiders based on the information provided by the complainant on her profiles and regarding the labor law proceedings. 2. Assessment of Evidence: The findings regarding the relevant facts are derived from the administrative decision, the complaint, and the court record. The complainant did not contest these facts or the assessment of evidence—which also formed the basis of the first-instance decision—in her complaint. In particular, the facts established by the respondent authority—namely, that the complainant published the aforementioned ASG judgement, including the last name and academic title of the co-party, both on her publicly accessible Facebook profile and in a closed Facebook group with approximately 230 members from the XXXX community who had relocated to the Vienna office as part of the institutional move to Austria—are entirely undisputed.

Rather, the complainant argued on multiple occasions in her complaint why she was entitled to publish the information in the chosen form and to name the co-party. The complainant did not contest these facts or the assessment of the evidence—which also formed the basis of the first-instance decision—in her complaint. In particular, the facts established by the respondent authority—namely, that the complainant published the aforementioned ASG judgement, including the last name and academic title of the co-party, both on her publicly accessible Facebook profile and in a closed Facebookgroup with approximately 230 members from the Roman 40 community who had relocated to the Vienna site as part of the institutional move to Austria—is entirely undisputed. Rather, the complainant has repeatedly argued in her complaint why she was entitled to publish the information in the chosen form, specifically by naming the co-party.

3. 1. Pursuant to § 6 BVwGG, the Federal Administrative Court decides through a single judge, unless federal or state laws provide for a decision by a panel. 1. Pursuant to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court makes its decisions through a single judge, unless federal or state laws provide for a decision by a panel. Pursuant to § 27(1) of the Data Protection Act (DSG), the Federal Administrative Court decides by a panel on complaints against decisions based on a violation of the duty to provide information pursuant to para 24(7) of the aforementioned Act and the Data Protection Authority’s duty to decide. Pursuant to § 27(2), first sentence, of the DSG, the panel consists of a chairperson and one expert lay judge each from the ranks of employers and employees. In the present case, the Senate therefore has jurisdiction. Pursuant to Section 27(1) of the DSG, the Federal Administrative Court, sitting as a Senate, rules on complaints against decisions regarding violations of the duty to provide information under paragraph 24(7) of the DSG and the Data Protection Authority’s duty to decide.

2. 2. Pursuant to § 31(1) VwGVG, decisions and orders are issued by resolution, unless a judgment must be rendered. Pursuant to § 28(1) VwGVG, the administrative court must resolve the case by a final judgment, unless the complaint is to be dismissed or the proceedings are to be discontinued. Pursuant to Section 28, paragraph 1, of the VwGVG, the administrative court must resolve the case by judgment, unless the complaint is to be dismissed or the proceedings are to be discontinued. 3. The Relevant Provisions of the GDPR: Article 4 Definitions For the purposes of this Regulation, the following terms shall have the following meanings: 1. “personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person; 2.

–6. (…) 7. “Controller” means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, makes the decision on the purposes and means of the processing of personal data; if the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for by Union law or the law of the Member States; 8–26. (…) Article 5 Principles Governing the Processing of Personal Data (1) Personal data must a) be processed lawfully, fairly, and in a transparent manner in relation to the data subject (“lawfulness, fairness, and transparency”); b) be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes is not considered incompatible with the original purposes pursuant to paragraph 89(1) (“purpose limitation”); c) be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”); d) be factually accurate and, where necessary, kept up to date; all reasonable measures must be taken to ensure that personal data that is inaccurate in light of the purposes for which it is processed is erased or rectified without delay (“accuracy”); e) be stored in a form that permits identification of data subjects only for as long as is necessary for the purposes for which they are processed; Personal data may be stored for a longer period provided that, subject to the implementation of appropriate technical and organizational measures required by this Regulation to protect the rights and freedoms of the data subject, exclusively for archiving purposes in the public interest, or for scientific or historical research purposes, or for statistical purposes in accordance with article 89 paragraph 1 (“storage limitation”); f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, accidental destruction, or accidental damage, through appropriate technical and organizational measures (“Integrity and Confidentiality”); (2) The controller is responsible for compliance with paragraph 1 and must be able to demonstrate such compliance (“accountability”).

Article 6 Lawfulness of Processing (1) Processing is lawful only if at least one of the following conditions is met: a) the data subject has given consent to the processing of personal data concerning him or her for one or more specific purposes; b) processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of precontractual measures taken at the data subject’s request; c) processing is necessary for compliance with a legal obligation to which the controller is subject; d) processing is necessary to protect the vital interests of the data subject or of another natural person; e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f) the processing is necessary to safeguard the legitimate interests of the controller or of a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail, in particular where the data subject is a child.

Subparagraph 1(f) does not apply to processing carried out by public authorities in the performance of their duties. 4 The relevant provisions of the DSG: Article 1 (Constitutional Provision) Fundamental Right to Data Protection § 1. (1) Everyone has the right, in particular with regard to respect for their private and family life, to the confidentiality of personal data concerning them, provided there is a legitimate interest in such confidentiality. The existence of such an interest is excluded if data are not subject to a right to confidentiality due to their general availability or because they cannot be traced back to the data subject. Paragraph one, (1) Everyone has the right, particularly with regard to respect for their private and family life, to the confidentiality of personal data concerning them, provided there is a legitimate interest in such confidentiality. The existence of such an interest is excluded if data are not subject to a right to confidentiality due to their general availability or because they cannot be traced back to the data subject.

(2) To the extent that the use of personal data is not in the vital interest of the data subject or does not occur with the data subject’s consent, restrictions on the right to confidentiality are permissible only to safeguard the overriding legitimate interests of another person, and, in the case of interventions by a government authority, only on the basis of laws that are necessary for the reasons set forth in Article 8(2) of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210/1958. Such laws may provide for the use of data that, by its Art, is particularly worthy of protection only to safeguard important public interests and must, at the same time, establish appropriate safeguards for the protection of the privacy interests of the individuals concerned. Even in the case of permissible restrictions, the interference with the fundamental right must, in each instance, be carried out only in the least intrusive Art necessary to achieve the objective.

(2) To the extent that the use of personal data is not in the vital interest of the data subject or does not occur with the data subject’s consent, restrictions on the right to privacy are permissible only to safeguard the overriding legitimate interests of another; in the case of interventions by a state authority, such restrictions may be imposed only on the basis of laws that are necessary for the reasons set forth in article 8, paragraph 2, of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210 of 1958. Such laws may provide for the use of data that, by its Art, is particularly worthy of protection only to safeguard important public interests and must, at the same time, establish appropriate safeguards for the protection of the privacy interests of the individuals concerned. Even in the case of permissible restrictions, any interference with the fundamental right must be carried out only in the least intrusive manner necessary to achieve the objective.

(…) Freedom of Expression and Freedom of Information § 9. (1) With regard to the processing of personal data by media owners, publishers, media staff, and employees of a media company or media service within the meaning of the Media Act—MedienG, Federal Law Gazette No. 314/1981—as well as by other persons, who, on the basis of a contract, contribute journalistically to the content of a medium or to the content of communications by a media service within a media company or media service, for the journalistic purposes of the media company or media service, the provisions of the GDPR and this Federal Act shall apply subject to the following conditions:Section 9, (1) With regard to the processing of personal data by media owners, publishers, media staff, and employees of a media company or media service as defined by the Media Act (MedienG), Federal Law Gazette No. 314 of 1981, as well as by other persons who, on the basis of a contract, contribute journalistically to the content of a medium or to the content of communications by a media service within a media company or media service, for the journalistic purposes of the media company or media service, the provisions of the GDPR and this Federal Act apply subject to the following conditions: 1.

The controller is not obligated to disclose to the data subject any information that is subject to the protection of editorial secrecy (Section 31 of the Media Act) (editorial secrecy under data protection law); para 31(2) of the Media Act applies. In proceedings before Courts and administrative authorities concerning data protection matters, § 31 of the Media Act (MedienG) applies, with the proviso that the controller may refuse to answer questions within the meaning of § 31(1) of the Media Act not only as a witness but also as any other party to the proceedings. Section 321(1) of the Code of Civil Procedure (ZPO), Federal Law Gazette No. 113/1895, applies mutatis mutandis. 1. The controller is not obligated to disclose to the data subject any information that is subject to the protection of editorial secrecy (Section 31, MedienG) (editorial secrecy under data protection law); Section 31(2) of the MedienG applies.

In proceedings before Courts and administrative authorities concerning data protection matters, Section 31 of the Media Act applies, provided that the controller may refuse to answer questions within the meaning of Section 31, paragraph 1, Media Act not only as a witness but also as a party to the proceedings. Section 321, paragraph 1, of the Code of Civil Procedure (ZPO), RGBl. No. 113 of 1895, applies mutatis mutandis. In exercising its powers, the Data Protection Authority must respect editorial confidentiality. 2. The controller is entitled to process personal data, including the special categories of personal data referred to in Article 9(1) of the GDPR, as well as personal data relating to criminal convictions and offenses or related preventive measures (Article 10 of the GDPR), provided that such processing is carried out for journalistic purposes. The last sentence of Article 10 of the GDPR remains unaffected.

Sections 12 and 13 of this Federal Act do not apply. 2. The controller is authorized to process personal data, including the special categories of personal data referred to in Article 9, paragraph 1, GDPR, as well as special categories of personal data relating to criminal convictions and offenses or related security measures (Article 10, GDPR), provided that such processing is carried out for journalistic purposes. The last sentence of article 10 of the GDPR remains unaffected. Sections 12 and 13 of this Federal Act do not apply. 3. 3. Article 5, paragraph 1, subparagraph (a) of the GDPR applies with respect to the principle of transparency, provided that the processing of personal data need only be comprehensible to the data subject to the extent that insofar as this does not disproportionately impair the freedom of expression and information, and only to the extent that the provisions of this paragraph do not provide otherwise.

(…) Complaint to the Data Protection Authority § 24. (1) Every data subject has the right to lodge a complaint with the Data Protection Authority if they believe that the processing of their personal data violates the GDPR or § 1 or Article 2, Section 1. Paragraph 24, (1) Every data subject has the right to lodge a complaint with the Data Protection Authority if they believe that the processing of their personal data violates the GDPR or Paragraph 1, or Article 2, Section 1. (2) The complaint must include: 1. the designation of the right deemed to have been infringed, 2. to the extent reasonably possible, the designation of the legal entity or body to which the alleged infringement is attributed (respondent), 3. the facts from which the violation is derived, 4. the grounds on which the allegation of unlawfulness is based, 5. a request to determine the alleged violation, and 6. the information necessary to assess whether the complaint was filed in a timely manner.

(3) Where applicable, a complaint must be accompanied by the underlying request and any response from the respondent. In the event of a complaint, the Data Protection Authority must provide further assistance at the request of the data subject. (4) The right to have a complaint addressed expires if the complainant does not file it within one year after becoming aware of the event giving rise to the complaint, but no later than three years after the event allegedly occurred. Late complaints shall be dismissed. (5) If a complaint is found to be justified, it must be addressed. If a violation is attributable to a controller in the private sector, that controller must be instructed to comply with the complainant’s requests for access, rectification, erasure, restriction, or data portability to the extent necessary to remedy the established violation. If the complaint proves to be unfounded, it shall be dismissed.

(6) A respondent may, until the conclusion of the proceedings before the Data Protection Authority, subsequently remedy the alleged violation by complying with the complainant’s requests. If the Data Protection Authority considers the complaint to be without merit in this respect, it shall hear the complainant on this matter. At the same time, the respondent must be informed that the Data Protection Authority will informally discontinue the proceedings if the respondent does not, within a reasonable period of time, provide a reasoned explanation as to why the respondent still considers the originally alleged violation to be, at least in part, unresolved. If such a statement by the complainant substantially alters the nature of the matter (Section 13(8) AVG), it shall be presumed that the original complaint has been withdrawn and a new complaint has been filed simultaneously. In this case as well, the original complaint proceedings shall be informally discontinued, and the complainant shall be notified thereof.

(6) A respondent may, until the conclusion of the proceedings before the Data Protection Authority, subsequently remedy the alleged violation by complying with the complainant’s requests. If the Data Protection Authority considers the complaint to be without merit in this respect, it must hear the complainant on this matter. At the same time, the complainant must be informed that the Data Protection Authority will dismiss the proceedings without formal notice if the respondent does not, within a reasonable period of time, provide a reasoned explanation as to why he or she still considers the originally alleged violation to be, at least in part, unresolved. If such a statement by the complainant substantially alters the nature of the matter (Section 13, paragraph 8, AVG), it shall be presumed that the original complaint has been withdrawn and a new complaint has been filed simultaneously.

In this case as well, the original complaint proceedings shall be informally discontinued, and the complainant shall be notified accordingly. Late statements shall not be taken into account. (7) The Data Protection Authority shall inform the complainant of the status and outcome of the investigation within three months of the filing of the complaint. (8) Any data subject may bring the matter before the Federal Administrative Court if the Data Protection Authority fails to address the complaint or fails to inform the data subject of the status or outcome of the complaint within three months. (9) The Data Protection Authority may—to the extent necessary—call upon official experts in the proceedings. (10) The following periods are not included in the decision-making period pursuant to § 73 AVG:(10) The following periods are not included in the decision-making period pursuant to § 73 AVG: 1.

the time during which the proceedings are suspended pending a final decision on a preliminary issue; 2. 2. the time during proceedings under Articles 56, 60, and 63 of the GDPR. 5. Pursuant to the constitutional provision of § 1(1) of the Data Protection Act (DSG), everyone has the right—in particular with regard to respect for private and family life—to the confidentiality of personal data concerning them, provided there is a legitimate interest in confidentiality. , both data processed by automated means and manually processed data—must be kept confidential, or the processing of such data is prohibited, provided there is a legitimate interest in confidentiality. 5. According to the constitutional provision of Section 1, paragraph 1, of the DSG, every person, particularly with regard to respect for private and family life, has the right to confidentiality of personal data concerning them, provided there is a legitimate interest in confidentiality.

, both data processed by automated means and data processed manually—must be kept confidential, or the processing of such data is prohibited, provided there is a legitimate interest in confidentiality. The key factor in determining whether a fundamental right under Section 1(1) of the DSG exists at all is the existence of interests worthy of protection. When assessing these interests, a balancing of interests must be conducted. The key factor in determining whether a fundamental right under Section 1(1) of the DSG exists at all is the presence of interests worthy of protection. When assessing these interests, a balancing of interests must be conducted. In this context, particular consideration must be given to the principle of lawfulness under data protection law. The fundamental right to data protection is not absolute but may be restricted by certain permissible interventions. Pursuant to Section 1(2) of the DSG, restrictions on the right to confidentiality—insofar as the use of personal data is not in the vital interest of the data subject or does not occur with the data subject’s consent— permitted only to safeguard the overriding legitimate interests of another party; in the case of interventions by a government authority, these may occur only on the basis of laws that are necessary for the reasons set forth in Article 8(2) of the ECHR.

In this context, restrictions on this right may arise from para 2 of the aforementioned provision, but not (directly) from Article 6(1) of the GDPR. However, the GDPR—and in particular the principles enshrined therein—must in any case be taken into account when interpreting the right to confidentiality. at]). The fundamental right to data protection is not absolute but may be restricted by certain permissible interventions. Pursuant to Section 1(2) of the DSG, restrictions on the right to confidentiality—insofar as the use of personal data is not in the vital interest of the data subject or does not occur with the data subject’s consent— permitted only to safeguard the overriding legitimate interests of another person; in the case of interventions by a government authority, these may occur only on the basis of laws that are necessary for the reasons set forth in article 8, paragraph 2, of the ECHR.

In this context, restrictions on this right may arise from paragraph 2, leg. , but not (directly) from article 6, paragraph 1, of the GDPR. However, the GDPR—and in particular the principles enshrined therein—must in any case be taken into account when interpreting the right to confidentiality. at]). It should be noted at the outset that the last name and academic title of the co-party constitute personal data within the meaning of Article 4(1) of the GDPR. It is also undisputed that the complainant processed the personal data of the co-party within the meaning of article 4(2) GDPR by processing the ASG’s judgement—including the last name and academic title of the co-party—on or via her social media profiles and making the full, non-anonymized text available for download, and that she is therefore to be classified as a controller within the meaning of Article 4(7), GDPR, is equally undisputed.

The only point of contention is the lawfulness of this data processing—namely, whether the complainant, by publishing the ASG judgement in the chosen form (including the last name and academic title of the co-party), violated the co-party’s right to confidentiality pursuant to Paragraph 1 of the DSG. The complainant argues that there is no legitimate interest in confidentiality in this case, as the personal data of the co-party is publicly available because she herself published it on LinkedIn. Furthermore, the ASG’s judgement reveals only the co-party’s last name and academic title, and the co-party voluntarily participated in the court proceedings as an institutional representative of her employer. Furthermore, in a balancing of interests in this case, the complainant’s fundamental rights under Article 10 of the ECHR (1. to be informed about labor law precedents, 2. the right to report on her own legal dispute, 3.

the right to defend her professional reputation against institutional representations) would outweigh the co-party’s interest in confidentiality. The complainant argues that there is no legitimate interest in confidentiality in this case, as the personal data of the other party is publicly available because the other party herself published it on LinkedIn. Furthermore, the ASG’s judgement reveals only the co-party’s last name and academic title, and she voluntarily participated in the court proceedings as an institutional representative of her employer. Furthermore, in a balancing of interests in this case, the complainant’s fundamental rights under article 10 of the ECHR (1. to be informed about labor law precedents, 2. the right to report on her own legal dispute, 3. the right to defend her professional reputation against institutional representations) would outweigh the co-party’s interest in confidentiality.

However, this legal view proves to be mistaken: Insofar as the complainant asserts that the co-party has no right to confidentiality in the context of any connection to professional activity, this contradicts established (supreme court) case law. According to this case law, even acting in a professional capacity does not negate the right to confidentiality. , para. 65; Dec. 16, 2008, C-524/06, Huber, para. 48). , para. 65; Dec. 16, 2008, C-524/06, Huber, para. 48). With regard to the lawfulness of the processing of personal data, Article 6(1) of the GDPR contains an exhaustive and definitive list of six cases (regarding the predecessor provision, Article 7 of the Data Protection Directive: CJEU Nov. 24, 2011, Joined Cases C-468/10 and C-469/10, ASNEF, para. ; Oct. 19, 2016, C-582/14, Breyer, para. 57). Article 6(1) of the GDPR contains an exhaustive and definitive list of six cases regarding the lawfulness of the processing of personal data (regarding the predecessor provision, Article 7 of the Data Protection Directive: CJEU, Nov.

24, 2011, Joined Cases C-468/10 and C-469/10, ASNEF, para. ; Oct. 19, 2016, C-582/14, Breyer, para. 57). Pursuant to Article 5(1)(c) of the GDPR, personal data must be adequate, relevant, and limited to what is necessary for the purposes of the processing (principle of data minimisation). at). The processing of personal data should be reduced to what is unavoidable. This ensures that the processing is actually limited by the specified purpose (see OGH Dec. 22, 2021, 6 Ob214/21w, with reference to Hötzendorfer/Tschohl/Kastelitz in Knyrim, DatKomm Art. 5 GDPR, paras. 21 and 34). Data is relevant if it is conducive to achieving the purpose—that is, if it is suitable within the meaning of the constitutional doctrine of proportionality. If, on the other hand, the processing of certain data can be dispensed with without hindering the achievement of the purpose, then such data is not relevant (Hötzendorfer/Tschohl/Kastelitz in Knyrim, DatKomm Art.

5 GDPR para. 34 et seq. at). Pursuant to Article 5, paragraph 1, subparagraph (c) of the GDPR, personal data must be adequate and relevant to the purpose and limited to what is necessary for the purposes of the processing (principle of data minimisation). at). The processing of personal data should be reduced to what is unavoidable. This ensures that processing is actually limited by the specified purpose; see OGH Dec. 22, 2021, 6 Ob214/21w, with reference to Hötzendorfer/Tschohl/Kastelitz in Knyrim, DatKomm article 5, GDPR Marginal Notes 21 and 34). Data is relevant if it is conducive to achieving the purpose—that is, if it is suitable within the meaning of the constitutional doctrine of proportionality. If, on the other hand, the processing of certain data can be dispensed with without hindering the achievement of the purpose, then such data is not relevant (Hötzendorfer/Tschohl/Kastelitz in Knyrim, DatKomm article 5, GDPR Marginal Note 34 et seq.

at). The requirements for lawful data processing are specified in Article 6 of the GDPR. According to this provision, the lawfulness of any processing requires that the processing—in addition to the other principles set forth in Article 5(1)— —must satisfy at least one of the legal grounds exhaustively listed in Article 6(1) of the GDPR (see Selmayr in Ehmann/Selmayr, General Data Protection Regulation, Commentary 3, 2024, Art. 5, para. The requirements for lawful data processing are specified in Article 6 of the GDPR. According to this paragraph, the lawfulness of any processing requires that the processing—in addition to the other principles set forth in Article 5(1)—must satisfy at least one of the legal grounds exhaustively listed in Article 6(1) exhaustively listed in article 6(1) of the GDPR (see Selmayr in Ehmann/Selmayr, General Data Protection Regulation, Commentary 3, 2024, article 5, para.

11). In the present case, only the legal basis set forth in Article 6(1)(f) of the GDPR is applicable. Pursuant to Article 6(1)(f) of the GDPR, the processing of personal data is lawful if the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, do not override those interests. In the present case, only the legal basis set forth in Article 6, paragraph 1, subparagraph f, of the GDPR is applicable. Pursuant to Article 6, paragraph 1, (f) of the GDPR, the processing of personal data is lawful if the processing is necessary to protect the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail.

The EDPB provides for a test framework under which the processing of personal data is permissible if three cumulative conditions are met, thereby following the CJEU, which had already established this for the largely identical predecessor provision (Art. 7(f) of the Data Protection Directive) and which is also relied upon by DPA and the Austrian Supreme Court (OGH) in their case law:The EDPB provides for a test framework under which the processing of personal data is permissible if three cumulative conditions are met, thereby following the CJEU, which had already established this with regard to the largely consistent predecessor provision (article 7(f), Data Protection Directive) and which is also relied upon by DPA and the Supreme Court in their case law: 1. The existence of a legitimate interest pursued by the controller or by the third party or parties, 2. The processing of personal data is necessary to fulfill the legitimate interest, and 3.

The data subject’s fundamental rights and freedoms do not override this interest. ” The weighing must be done from an objective perspective and not from the subjective perspective of individual data subjects; thus, individual sensitivities are not to be taken into account. It has not been conclusively clarified whether a balancing of interests must always be conducted on a case-by-case basis or summarily for each instance of processing. While the Administrative Court (VwGH) assumes a fundamental case-by-case assessment, some scholars—citing the (lack of) practicality of a case-by-case review, some scholars in the literature also consider a summary balancing of interests—based on typical circumstances—to be sufficient, a view that could also be supported by the existence of a right to object. If this balancing of interests favors the controller or a third party, the processing is generally permissible (subject to compliance with the other requirements mentioned above, and in particular Article 5).

The controller is responsible for conducting the balancing of interests and bears the burden of proof (see Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Art. 6 GDPR, para. 51 [as of Oct. at]). If this balancing of interests favors the controller or a third party, the processing is generally permissible (subject to compliance with the other conditions mentioned above, and in particular article 5). The controller is responsible for conducting the balancing of interests and bears the burden of proof; see Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm article 6, GDPR, Marg. No. 51 [as of Oct. at]). According to the case law of the CJEU, the concept of “legitimate interest” within the meaning of Article 6(1)(f) of the GDPR must be interpreted broadly. In principle, all lawful interests of the controller or a third party may be considered legitimate interests; these need not be specified by law.

The Court thus recognizes a broad spectrum of economic, legal, non-material, and factual interests as generally eligible for consideration (see CJEU, Oct. 4, 2024, Case C-621/22 Koninklijke Nederlandse Lawn Tennisbond). The concept of “legitimate interest” within the meaning of Article 6(1)(f) of the GDPR must be interpreted broadly in accordance with the case law of the CJEU. In principle, all legitimate interests of the controller or a third party may be considered legitimate interests; these need not be specified by law. The Court thus recognizes a broad spectrum of economic, legal, non-material, and factual interests as generally eligible for consideration (see CJEU, Oct. 4, 2024, Case C-621/22, Koninklijke Nederlandse Lawn Tennisbond). As a basis for the potential lawfulness of the processing by the complainant, namely the publication of the ASG’s judgement, Article 6(1)(f) of the GDPR must therefore be examined—specifically, whether this processing was necessary to safeguard the complainant’s legitimate interests, provided that the interests and rights of the other party do not override them.

Moreover, the complainant did not assert any other grounds. Accordingly, to determine the possible lawfulness of the complainant’s processing—that is, the publication of the ASG’s judgement—Article 6(1) (f) of the GDPR must therefore be examined, namely whether this processing was necessary to safeguard the complainant’s legitimate interests, provided that the interests and rights of the other party involved do not outweigh them. Furthermore, the complainant did not assert any other grounds. In the opinion of the adjudicating panel, the complainant generally has a legitimate interest in informing her colleagues who are in similar employment law situations about the ASG’s judgement concerning her employment relationship. It should be noted that the publication of the judgement both on the complainant’s Facebook profile and within the closed Facebook group of the Roman 40 community was, in principle, appropriate for informing the complainant’s affected colleagues about her employment-law situation.

However, the necessity of the means employed must be examined in the context of these proceedings, as well as whether the data processing principle set forth in article 5(1)(c) of the GDPR—data minimisation—was complied with in this regard. The CJEU has repeatedly held that processing may only involve data that is necessary [to achieve the purpose] and must, in principle, be limited to what is absolutely necessary (see CJEU, Nov. 9, 2010, C-92/09 and C-93/09 [Schecke], para. 86; CJEU, Nov. 7, 2013, C-473/12 [IPI], para. 39; CJEU, Dec. 11, 2014, C-212/13 [Ryneš], para. 28). The CJEU has repeatedly stated that processing may only involve data that is necessary [to achieve the purpose] and must, in principle, be limited to what is absolutely necessary; see CJEU Nov. 9, 2010, C-92/09 and C-93/09 [Schecke], para. 86; CJEU, Nov. 7, 2013, C-473/12 [IPI], para. 39; CJEU, Dec. 11, 2014, C-212/13 [Ryneš], para.

28). In this context, alternatives must also be considered, and if other analogous measures achieve the same effect as data processing, such a measure must be chosen. However, in the present case, despite recognizing the complainant’s legitimate interest in informing her colleagues in comparable employment law situations, based on the aforementioned case law of the Court of Justice, there is already a lack of necessity for the publication of the AS judgementG in the chosen form is lacking. Against this background, a further balancing of individual rights is no longer necessary. As explained, the principle of data minimisation already applies at the level of the necessity of data processing. The case at hand concerns the public disclosure of a witness’s name (in his professional capacity for the respondent in the labor law proceedings). He was named to present a legal position but—as the ASG’s decision also expressly states—was not the complainant’s point of contact under civil service or labor law.

The respondent authority found that, in principle, the complainant had a legitimate interest, but that the publication of the personal data of the co-party did not comply with the principle of data minimisation. In this case, the balancing of interests ends at the level of necessity. ” As already explained, there can be no question of a “solely journalistic purpose” in the present case. Rather, there is no indication of any journalistic activity on the part of the complainant. Furthermore, the judgement in Case C-345/17 does not contain a factual determination applicable to the present case. Rather, it leaves the assessment of the individual case to the competent Court as the trial Court. Moreover, the CJEU’s decision relates to the personal data of persons acting directly (against the complainant), which in the present case would, at most, concern that body of XXXX that signed the complainant’s employment contract.

However, this does not apply to the co-party (a witness in court proceedings). Contrary to the claims made in the complaint, this party was not a “party” to the legal dispute with the employer. As already explained, there can be no question of a “solely journalistic purpose” in the present case. Rather, there is no indication of any journalistic activity on the part of the complainant. Furthermore, the judgement in Case C-345/17 does not contain a factual ruling that is applicable to the present case. Rather, it leaves the assessment of the individual case to the competent Court as the trial Court. Furthermore, the CJEU’s decision relates to the personal data of individuals acting directly (against the complainant), which in the present case would, at most, concern the body within the Roman 40 that signed the complainant’s employment contract. However, this does not apply to the co-party (a witness in court proceedings).

Contrary to the claims made in the complaint, this party was not a “party” to the legal dispute with the employer. Furthermore, § 9 DSG (which implements Art. 85 of the GDPR)—which, incidentally, refers to journalistic activity (which is not present here) as a prerequisite for its applicability and is therefore inapplicable— does not entirely override the principle of proportionality, but rather establishes a different standard of balancing. Section 9 of the DSG (as a specification of Article 85, GDPR)—which, incidentally, refers to journalistic activity (which is not present here) as a prerequisite for its applicability and is therefore not applicable—does not entirely override the principle of proportionality, but rather establishes a different standard for balancing interests. In the present case, the Data Protection Authority did not substantially interfere with the right to freedom of expression, but rather set forth a less restrictive measure regarding the processing of the personal data of the party involved —redaction/anonymization of the name and academic degree—which in no way impairs the stated informational purpose regarding the content of the proceedings and the employment contract in question.

This would also involve only minimal technical effort and is therefore reasonable. Nor does the complainant come close in her complaint of November 11, 2025, to demonstrating that the anonymization or redaction of the personal data of a witness (who, incidentally, is not typically participating “voluntarily” in court proceedings as part of his official duties) would in any way impair her interest in obtaining information. She merely makes a bare assertion here without attempting to present a coherent line of reasoning. Likewise, the “disproportionality” of the first-instance decision is merely raised without any coherent argumentation. On the one hand, direct harm resulting from a violation of the right to confidentiality is not required to establish such a violation. On the other hand, such harm would have to be asserted individually under civil law and would therefore not be the subject or content of administrative proceedings in the first place.

Consequently, the complainant’s disclosure of the co-party’s last name and academic title through the publication of the full, non-anonymized judgement on social media and download platforms was to be classified as unnecessary, thereby violating the principle of data minimisation and infringing upon the co-party’s right to confidentiality in the present case, as provided for in para 1 of the Data Protection Act (DSG). Consequently, the complainant’s disclosure of the co-party’s last name and academic title through the publication of the full, non-anonymized judgement on social media and download platforms was deemed unnecessary, thereby violating the principle of data minimisation and infringing upon the co-party’s right to confidentiality in the present case, as guaranteed by Paragraph 1(1) of the Data Protection Act (DSG). Since the contested decision is unlawful for these reasons within the meaning of Art.

Since, for these reasons, the contested decision is not unlawful within the meaning of article 130, paragraph 1, item 1, of the B-VG, the complaint filed against it had to be dismissed pursuant to Section 28(2) of the VwGVG in conjunction with paragraph 24(1) and (5) of the DSG. 7. Pursuant to paragraph 24(1) of the VwGVG, the Administrative Court must conduct a public oral hearing upon request or, if it deems it necessary, on its own initiative. Pursuant to § 24(4) VwGVG, the Administrative Court may refrain from holding a hearing, regardless of a party’s request, if the case file indicates that an oral hearing is unlikely to provide further clarification of the matter and if the omission of the hearing does not conflict with either Art. Pursuant to Section 24(4) of the VwGVG, the Administrative Court may dispense with a hearing regardless of a party’s motion if the case file indicates that an oral hearing is unlikely to provide further clarification of the matter, and neither Article 6, paragraph 1, of the Convention for the Protection of Human Rights and Fundamental Freedoms nor Article 47 of the Charter of Fundamental Rights precludes the omission of a hearing.