Austrian VwGH: hotel listings and user reviews on travel platform serve legitimate

Court Administrative Court (VwGH) Type of Decision Ruling Document Type Text of the Decision Case Number Ro 2022/04/0026 Date of Decision May 17, 2024 Index E000 EU Law in General E1P E3L E13309900 E3L E16200000 E3L E19400000 E3R E15202000 E3R E19400000 E6J 19/05 Human Rights Legal Provision EURallg MRK Art. 10 12010P/TXT Charter of Fundamental Rights, Art. 11 31995L0046 Data Protection Directive, Art. 7(f) 32016R0679 GDPR, Art. 6(1)(b) 32016R0679 GDPR, Art. 6(1)(c) 32016R0679 GDPR Art. 6(1)(d) 32016R0679 GDPR Art. 6(1)(e) 32016R0679 GDPR Art. M. PRELIMINARY 62021CJ0252 Meta Platforms PRELIMINARY Note Joint handling (handled jointly or linked for a joint decision): Ro 2022/04/0027 Discussed in: Discussed in: MuR 4/2024, pp. 163–168; Subject The Administrative Court, through Presiding Judge Dr. Kleiser, Court Councilor Dr. Mayr, Court Councilor Mag. Hainz-Sator, and Court Councilors Dr. Pürgy and Mag.

Brandl as judges, with the assistance of the court clerk Mag. Kovacs, ruled on the appeal filed by 1. S S and 2. 01, against the decision of the Federal Administrative Court dated May 13, 2022, Ref. No. W258 2236970-1/18E, concerning a data protection matter (authority sued before the Administrative Court: Data Protection Authority; other party: Federal Minister of Justice; intervening party: T LLC in M, represented by Schindler Rechtsanwälte GmbH, located at Kohlmarkt 8-10, 1010 Vienna), the Court has correctly determined: Decision The appeal is dismissed as unfounded. 20 within two weeks, subject to enforcement otherwise. Reasons I. 1 1. The parties seeking appeal operate (according to the findings of the contested decision) a hotel and restaurant in G (Business S). at and on which—in addition to providing general information—registered users can submit reviews and testimonials. Business S was “listed” on this platform.

In a letter dated June 27, 2019, the appellants requested that the co-party carry out an erasure of all of their personal data. This request for erasure was not granted. 2 In a submission dated August 28, August 2019, the parties seeking review filed a data protection complaint with the Data Protection Authority (DPA, the respondent authority) against the co-party for unlawful data processing and a violation of the right to erasure pursuant to Art. 17(1)(d) GDPR . 3 2. By decision dated September 18, 2020, the respondent authority dismissed this data protection complaint as unfounded, relying (in particular) on Article 6(1)(f) GDPR . 4 3. In the contested decision of May 13, 2022, the Federal Administrative Court (BVwG) dismissed the complaint filed by the parties seeking review following an oral hearing. The appeal was declared admissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG).

5 The BVwG found that the co-party had “listed” the businesses of the parties seeking review on its platform without their consent. In addition, the BVwG reproduced excerpts from some of the entries (both negative and positive) in which the parties seeking review were named. The businesses of the parties seeking review are reviewed on the co-party’s platform several times a month. 6 In its legal assessment, the BVwG first explained that the media privilege pursuant to § 9 of the Data Protection Act does not apply to the present case and that the DPA is therefore competent to handle the complaint; furthermore, it stated that the general information and evaluations processed on the platform are to be regarded as personal data within the meaning of Art. 4(1) GDPR . Subsequently, the BVwG referred to the justification provision of Article 6(1)(f) GDPR , according to which data processing is permissible if it is necessary to safeguard the legitimate interests of the controller or a third party, provided that the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data do not override those interests.

1. for further details). The BVwG then conducted an assessment specific to the present case and, providing detailed reasoning in each instance, affirmed that the three aforementioned requirements were met. ). 9 Given the lawfulness of the data processing, the parties seeking review are also not entitled to a claim for erasure. 10 With regard to the admission of the appeal, the Federal Administrative Court (BVwG) held that, while the question of whether comments on a review platform for hotels constitute processing within the meaning of Art. 6 para. 1 lit. f GDPR , is a matter to be decided on a case-by-case basis; however, there is a lack of case law from the Administrative Court regarding the principles that a balancing of interests must satisfy in the context of review platforms. 11 4. The present ordinary appeal is directed against this ruling. 12 The DPA and the co-party each filed a response to the appeal, in which they request that the appeal be dismissed (and the DPA also requests that it be rejected).

The DPA further requests reimbursement of costs. II. The Administrative Court has considered the following: 13 1. The appeal is admissible with regard to the legal issue raised by the Administrative Court, which (among other issues) is also considered to be a matter of principle by the parties seeking the appeal, and in light of the fact that there is no case law from the Administrative Court regarding the lawfulness of data processing by review platforms under Article 6(1)(f) GDPR or regarding the principles governing the balancing of interests to be carried out in this regard, the appeal is admissible but, for the reasons set forth below, not well-founded. 14 2. The relevant recitals and provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation [ GDPR ]) read, in part: “[Recitals] (47) The lawfulness of processing may be based on the legitimate interests of a controller, including a controller to whom the personal data may be disclosed, or of a third party, provided that such interests do not override the interests or the fundamental rights and freedoms of the data subject; in this regard, the reasonable expectations of the data subject based on his or her relationship with the controller must be taken into account.

A legitimate interest could exist, for example, where there is a relevant and appropriate relationship between the data subject and the controller, such as when the data subject is a customer of the controller or is in the controller’s employ. In any case, the existence of a legitimate interest must be weighed with particular care, including an assessment of whether a data subject, at the time of collection of the personal data and in light of the circumstances under which it is collected, can reasonably foresee that processing for this purpose may take place. In particular, when personal data is processed in situations where a data subject would not reasonably expect further processing, the data subject’s interests and fundamental rights could outweigh the controller’s interest. ] The processing of personal data for the purpose of direct marketing may be considered processing based on a legitimate interest.

] (65) A data subject should have the right to rectification of personal data concerning him or her, as well as a “right to be forgotten,” if the storage of his or her data violates this Regulation or Union law or the law of the Member States to which the controller is subject. In particular, data subjects should have the right to have their personal data erased and no longer processed if the personal data is no longer necessary for the purposes for which it was collected or otherwise processed, are no longer necessary, if the data subjects have withdrawn their consent to the processing or have objected to the processing of their personal data, or if the processing of their personal data infringes this Regulation for other reasons. ] f) the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

] c) The data subject objects to the processing pursuant to article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to article 21(2). d) The personal data has been processed unlawfully. ] Article 21 Right to Object (1) The data subject has the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her that is carried out on the basis of article 6(1)(e) or (f); this also applies to profiling based on those provisions. The controller shall no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing is necessary for the establishment, exercise, or defense of legal claims. ]” 15 3. The Court of Justice of the European Union (CJEU) has held that it is for the national (referring) court to determine whether data processing is justified by one of the requirements set forth in Article 6(1)(b) through (f) GDPR .

Likewise, the balancing of the respective conflicting rights and interests—which takes place in connection with Article 6(1)(f) GDPR —which depends on the specific circumstances of the individual case—is also a matter for the national (referring) Court (see, on all these points, CJEU, July 4, 2023, C-252/21, Meta Platforms , paras. 96, 110). M , para. 106 — held that, pursuant to Art. 6(1)(f) GDPR , the processing of personal data is permissible under three cumulative conditions: first, the controller or a third party must have a legitimate interest; second, the processing of personal data must be necessary to pursue that legitimate interest; and third, the interests or fundamental rights and freedoms of the data subject must not override those interests (see VwGH, May 9, 2023, Ro 2020/04/0037 , para. 52). 17 In its assessment, the Federal Administrative Court (BVwG) affirmed all three conditions.

Although the arguments of the parties seeking review are primarily directed against the balancing of interests, they also, as a first step, dispute the existence of a legitimate interest in data processing or the necessity of data processing itself. 4. 1. The BVwG assumes that the data processing in question serves the legitimate interest in information—in the form of the exercising of freedom of expression and freedom of information by the reviewing guests—as well as the public’s legitimate interest in information about the services offered on the market. In the case of hotel businesses (and particularly family-run businesses), this interest in information also encompasses the conduct of the persons involved in representation or operation of the hotel. There is therefore a direct connection to the service provider (and, in this case, to the parties seeking review). The fact that the co-respondent pursues commercial interests through the platform (by attempting to induce hotel operators to book additional paid services) cannot impair the public’s (independently existing) interest in information, because the platform fulfills the aforementioned legitimate interests regardless of any economic background.

The data processing is thus covered by the freedom of expression of the reviewing Users and by the freedom of information of potential guests. 19 The parties seeking review, on the other hand, argue that their right to the protection of their personal data must be weighed (solely) against the financial interest of the other parties involved (in selling their “premium features” to hotel operators). While—according to the parties seeking review, citing case law regarding other review platforms—there is a substantial public interest in information about the quality of teaching by educators or of medical services, the public interest in information regarding the quality of the services they offer is not even remotely comparable; this is also because Business S (as a high-end establishment) is of interest to only a small portion of the public, whereas information about medical services affects the general public.

Furthermore, the parties seeking review (citing the remarks of the [German] Federal Court of Justice [BGH] in its judgement of February 20, 2018, VI ZR 30/17) that the co-respondent has abandoned its position as a “neutral” information provider because it attempts to direct potential guests toward its paying customers by systematically and selectively giving them preferential treatment. Moreover, enterprises “listed” involuntarily are, in effect, forced to use the co-respondent’s paid services due to the co-respondent’s dominant market position. The right of the parties seeking review to freely make a decision about their own online presence outweighs Users’ interest in information, especially since this information can also be obtained on other platforms (such as booking platforms). 20 In its response to the appeal, the DPA counters that the appellants’ argument—that their operations, and thus the reviews of them, are of interest only to a small portion of the population—demonstrates that their rights are being infringed upon only to a minor extent.

21 In its response to the appeal (as the BVwG had already done), the intervenor points to the legitimate interest in the form of the exercise of freedom of expression and freedom of information. It would constitute objectively unjustified unequal treatment if high-end businesses were able to avoid public scrutiny. Contrary to the view of the parties seeking appeal, a hotel appeals to a far larger public than, for example, a doctor or a teacher, who are primarily selected and visited based on local proximity. The co-party also disputes that it has abandoned its role as a neutral information provider and grants hidden benefits through its fee-based services; rather, the benefits associated with the fee-based services are presented transparently. In response to the appellants’ reference to information obtained through booking platforms, the co-party argues that it would not be objectively justified to exclude the provision of information via (pure) review platforms per se.

2. The Federal Administrative Court correctly held that the exercise of the right to freedom of expression and information constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR (see, in this regard—albeit in each case still regarding the earlier legal situation under Directive 95/46/EC—CJEU Nov. 6, 2003, C-101/01, Lindqvist , para. 86 [on freedom of expression]; CJEU, May 13, 2014, C-131/12, Google Spain , paras. 81, 97 [on the interest in access to information]; as well as Opinion 06/2014 of the Art 29 Working Party on the concept of the controller’s legitimate interest under Article 7 of Directive 95/46/EC, WP 217, pp. 31, 43; see also—regarding Art. 6(1)(f) GDPR —Supreme Court of Austria, Feb. 2, 2022, 6 Ob 129/21w, para. ], GDPR , Art. 6, para. ). Similarly, the provision of Art. 17(3)(a) GDPR provides for an exception to the right to erasure of data to the extent that the processing of the data is necessary for the exercise of the right to freedom of expression and information (see also, in this context, Recital 65 of the GDPR , according to which the continued storage of personal data should be lawful if it is necessary for the exercise of the right to freedom of expression and information).

23 Freedom of expression encompasses both the right of recipients of services to express their opinions on the quality of services—and, in connection therewith, on the conduct of the natural persons who are controllers of the services—and the right of potential future recipients of such services to to take note of these expressions of opinion (see, in this regard—in connection with a doctor-review platform and, again, regarding the earlier legal situation—Constitutional Court 8 Oct. 2015, G 264/2015, para. 36; see also—regarding a business review portal—Supreme Court (OGH) April 18, 2023, 6 Ob 46/23t, para. 2022, VI ZR 692/20, para. 20). Since the platform operated by the co-party enables the posting of such expressions of opinion as well as a structured search for them, it serves the exercise of freedom of expression. Consequently, however, the associated processing of personal data is, in principle, necessary to safeguard a legitimate interest (within the meaning of Art.

6(1)(f) GDPR ). ” The pursuit of commercial interests by the controller does not impair the (previously mentioned) right of service recipients to express opinions or of potential service recipients to receive opinions. Finally, the parties seeking review have also failed to substantiate that the co-respondent did not act as a neutral provider of information. Nor can anything of the sort be inferred from the data processing at issue here, especially since the reviews concerning Company S and the parties seeking review—which were identified (by way of example) by the Federal Administrative Court (BVwG) and were not contested in the appeal— (who, for their part, do not claim to have used the co-party’s fee-based services) were predominantly positive (see also, in this regard, Jahnel , GDPR [2021] Art. 6, para. 74, according to which, in the balancing of interests under Art. 6(1)(f) GDPR , it must be taken into account that processing may also be to the benefit of the data subject).

25 Nor do the parties seeking review provide a plausible explanation as to why they are effectively compelled to use the co-respondents’ fee-based services due to an alleged dominant market position, especially since they themselves argue elsewhere that the public’s interest in information can also be accommodated through other platforms (booking platforms). Contrary to the view of the parties seeking review, the Administrative Court sees no objective justification for limiting the right to exercise freedom of expression to those platforms through which the services being reviewed were booked (and thus not to recognize the expression of an opinion on pure review platforms as a legitimate interest). 26 Finally, even the circumstance asserted by the parties seeking review (and contested by the co-party)—that the data in question is of interest to (only) a small portion of the public—does not preclude the assumption that a legitimate interest exists.

While such circumstances may be taken into account in the balancing of interests and thus in determining whether one interest outweighs the other, they do not mean that an interest in information cannot be regarded as a legitimate interest on its merits simply because it concerns only a (select) portion of the public. 5. 1. In its balancing of interests, the Federal Administrative Court (BVwG) held (among other aspects) that, with regard to the interest in confidentiality, a distinction must be made as to which sphere of personality is being infringed upon. In this regard, the social sphere (as it is termed), in which the affected party interacts with outsiders, does not enjoy as extensive protection as privacy. In the social sphere, the individual concerned must be prepared for their behavior to be observed and evaluated. The parties seeking review were evaluated solely within the scope of their professional activities as employees or operators of the hotel.

The evaluations in question thus fall within the social sphere. ” The review platform remains unchanged even in the event of a business takeover; consequently, the hotel business should not be classified as part of the social sphere. 29 In its response to the appeal, the DPA argues that the reviews in question clearly fall within the social sphere in the sense of the professional sphere. This is not altered by the fact that, in the event of a transfer of the business to a third party, the parties seeking review might be entitled to have those entries deleted in which they are named. 30 The intervenor counters the appellants’ argument in this regard by stating that the factual circumstances cited by the appellants to support their case (the takeover of Company S by a third party) do not currently exist, and that in the event of a change of ownership, it would be possible to remove old reviews.

2. The CJEU has held (albeit still with regard to the predecessor provision of Art. 7(a) f of Directive 95/46/EC) that the criterion of the severity of the interference with the rights and freedoms of the data subject constitutes an essential factor in the balancing test in individual cases. In this regard, the Art of the personal data in question and its potentially sensitive nature must be taken into account (see CJEU, Dec. 11, 2019, C-708/18, TK , para. ). Furthermore, the CJEU (again regarding the previous legal situation) has stated that the balance (to be struck between the competing interests) may depend on the nature of the information and its sensitivity with respect to the data subject’s private life (see CJEU, May 13, 2014, C-131/12, Google Spain , para. ], GDPR/BDSG [2022], Art. 6 GDPR, para. ], GDPR , Art. 6, para. 105, which states that data processing is particularly serious if the data concerns an area associated with particularly high expectations of confidentiality).

The Supreme Court (OGH) has also recognized that, in the context of balancing interests, consideration must be given to which sphere of personality is being infringed upon, and in doing so, does not accord the social sphere—in which the data subject, as a member of society, communicates with outsiders—the same level of protection as the most private sphere of life (OGH Feb. 2, 2022, 6 Ob 129/21w, para. 70). 32 The Administrative Court first concurs with the view of the Supreme Court, according to which, in the course of the balancing of interests under Art. 6(1)(f) GDPR , a distinction must be made between whether the processed data concerns the (so-called) core area of protected privacy—as is the case, for example, with data regarding the data subject’s sex life—or the (so-called) social sphere, which is characterized by the data subject’s interaction with outsiders or public appearances, as is the case, for example, when providing services to third parties (see again OGH 6 Ob 129/21w, para.

70). 33 The Administrative Court’s (BVwG) ruling cannot be challenged when it classifies the assessments at issue (concerning the conduct of the parties seeking review in the course of their activities as hotel operators) to the social sphere (specifically in the form of the professional sphere) rather than to the private or domestic sphere of the parties seeking review. ], DatKomm [2019], Art. 4, para. 21, according to which confidential data—linked to domestic and private activities—can increase the potential risks to the rights and freedoms of individuals). Contrary to the view of the parties seeking review, the interference associated with the data processing at issue cannot be classified as an infringement of privacy merely because there is a possibility that the parties seeking review might sell their business. Although the fact of a transfer of business could, in turn, be taken into account in a balancing of interests, the parties seeking review do not allege that this event has occurred.

35 The parties seeking review counter that, in order to be notified of new reviews, they would be forced to provide the co-party with an email address and thereby consent to the processing of this data. This would conflict with the GDPR . Furthermore, they could only respond to critical comments if they themselves registered on the platform and thereby accepted the terms of use. Furthermore, the appellants argue that they are listed on “countless review platforms” and that the effort required to search all of these platforms would be unreasonable. They are therefore entitled to a right to have their information deleted from a single review platform, even if the effort required to search that platform alone would be reasonable. 36 In its response to the appeal, the DPA notes in this regard that the parties filing the appeal had, in this case, asserted a right to erasure only against the co-respondent, and therefore there is no need to address any potential unlawful data processing by other review platforms.

37 The co-respondent—like the BVwG before it—points out the option for hotels to be notified of new reviews via email. In addition, there are third-party providers that offer Surveillance of review platforms for a fee. There are thus sufficient (various) monitoring options available. The associated effort for the parties seeking review is not excessive. There is also the possibility of countering any potentially unjustified criticism. The second appellant has also made use of this option. The co-respondent is not a controller for data processing by other platforms. Finally, the co-respondent also points out that the parties seeking review, as hotel operators, are in the public eye and must therefore accept being monitored. 2. It should first be noted that the subject matter of the underlying proceedings is solely a claim for deletion asserted by the parties seeking review against the co-party, and not any potentially unlawful data processing by other review platforms.

Based on this, the Administrative Court holds that, when determining the reasonableness of searching for critical reviews, one must not consider all review platforms, but only that of the co-party. 39 The parties seeking review do, in fact, correctly point out that the registration required to use an automatic notification service would entail providing an email address to the co-party. However, the resulting infringement of data protection rights would not, in itself, be considered excessively severe (especially since an email address is also listed on Company S’s website). In this context, the Administrative Court (BVwG) also correctly noted that offering a service to the public entails exposing oneself to scrutiny and, if necessary, criticism (see, for example, CJEU, July 4, 2023, C-252/21, Meta Platforms , para. 116, according to which, when weighing interests under Article 6(1)(f) GDPR , the reasonable expectations of the data subject must also be taken into account, and it therefore matters whether or not a data subject could reasonably have expected processing; see also VwGH, May 9, 2023, Ro 2020/04/0037 , para.

], GDPR , Art. 6, para. 132, according to which there is a high interest in information regarding business matters and the data subject’s interest is diminished due to their participation in the market). However, this also entails the requirement to review rating platforms with regard to such criticism. 7. 1. The Federal Administrative Court (BVwG) based its balancing of interests in this regard on the following: A user who wishes to submit a review must first register on the platform, accept the terms of use, and confirm that they have been a guest at the establishment. However, the co-party does not verify the identity of the reviewers. ” Registered users (hotel operators) could report (problematic) reviews to the third party; the third party would review the reported content and remove it if it did not comply with the Directives. Users who posted abusive content could be blocked by the third party.

Although the co-party attempts to identify inaccurate reviews using various methods, it ultimately cannot protect against reviews posted by fictitious Users regarding fictitious circumstances. In its legal assessment, the Federal Administrative Court (BVwG) first noted, regarding the arguments of the parties seeking review concerning abusive reviews and the co-party’s insufficient protection against abuse, there is no legitimate interest in knowingly submitting false (or criminally relevant) reviews or in being informed of such reviews. 2022, 6 Ob 129/21w, para. 80). This concerns, for example, measures that enable data subjects to report abusive entries to the operator of the review platform and have them removed. In the present case, the co-party took measures to curb abusive use and to enable representatives of listed businesses to defend themselves against comments. For example, users submitting reviews must register and confirm that the reviews are based on their own experiences.

” Although a business representative (unlike a user) must verify their identity before registering, this additional step is justified because business representatives also have the ability to have the business’s general information modified. Furthermore, in the BVwG’s view, it must be taken into account that the potential for abuse could also lead to positive reviews and that it is generally known that content available on the internet, such as reviews, may be inaccurate. In addition, the reviews could only be viewed by individuals who visited the platform and searched for business S. Finally, the parties seeking review were only named in individual comments. The BVwG further noted that protection against abuse would indeed be greater if the users submitting reviews were required to prove their identity or that they had actually used the hotel’s services. However, this obligation to provide proof would unduly restrict freedom of expression, as the associated effort would reduce the willingness to submit reviews.

However, this would amount to an impermissible coercion to enter into a contract. In any case, the co-respondent’s system for monitoring abuse is insufficient. 42 In its response to the appeal, the co-party assumes that its measures to prevent abusive reviews (described in more detail in a statement dated February 23, 2022) are effective. Regarding the incident at the hotel bar cited by the parties seeking review as grounds for their appeal, the co-respondent notes that this incident indisputably took place on the hotel’s premises and that the review is therefore not fictitious. 2. Even if the interest in protecting personal data relating to market presence—in light of the required consideration of the data subject’s reasonable expectations (see para. ], GDPR , Art. 6, para. 132). 2022, 6 Ob 129/21w, para. ], GDPR , Art. 6, para. 107). , protection against reviews that are not based on actual use of the service) must be recognized.

The Federal Court of Justice (BGH) has (in connection with the requested injunction against the dissemination of reviews by certain, specifically identified Users of a hotel review portal) held, for example, that the protected interests of the data subject affected by a review outweigh the interests of the portal operator if the review was not based on guest contact; the complaint raised by the data subject regarding the lack of guest contact was deemed, in principle, sufficient to trigger the operator’s duty to verify (BGH Aug. 9, 2022, VI ZR 1244/20, para. ). 44 Conversely, in the aforementioned decision G 264/2015, para. , the Constitutional Court held that a provision granting data subjects affected by inclusion in a publicly accessible data application a right to object at any time and without cause, which —without allowing for a balancing of the opposing interests—results in an unconditional obligation on the part of the controller to perform the erasure of the data, which was ultimately deemed a disproportionate interference with the freedom of expression and information under Article 10 of the ECHR.

45 In its judgement of December 7, 2021, Standard Verlagsgesellschaft mbH v. Austria , No. 39378/15, para. , that while the ECHR does not provide for an absolute right to anonymity on the internet, it has, conversely, expressed understanding for internet users’ interest in keeping their identity undisclosed. In addition to the significant value of anonymity on the internet, other legitimate interests (such as the protection of the rights and freedoms of third parties) must also be taken into account. Therefore, a balancing of the conflicting interests must be carried out. In its judgement of October 10, 2013, Delfi AS v. Estonia , No. 64569/09, para. , the ECtHR took into account the system implemented by an operator (in this case, an online news portal) for reporting and removing (inappropriate) comments. In this context, the ECtHR also considered it noteworthy that the (in that case) operator had permitted comments from unregistered Users (making it very difficult for the data subject affected by the comments to determine the Users’ identities) and had thus assumed a certain degree of responsibility for the comments.

2023, 6 Ob 46/23t, para. 10). The risk of a negative review must also be accepted in principle (Supreme Court, February 2, 2022, 6 Ob 129/21w, para. 89). 2022, 6 Ob 129/21w, para. , regarding a teacher review platform). In this context, the Supreme Court also stated that—especially since the possibility of anonymous expression of opinion on the Internet cannot be prohibited outright—data subjects must tolerate abusive reviews to a certain extent (see again Supreme Court 6 Ob 129/21w, para. 84). However, it can also be inferred from the cited judgement that the exclusion of “free-text reviews” (and thus also of insults) must be taken into account in the balancing test (para. 89). Finally, the Supreme Court (in connection with the teacher-review platform) considered it decisive that reviews could only be viewed by individuals who had downloaded the App and selected the specific school (Supreme Court, Feb.

Nor does the circumstance raised in the appeal—namely, that there is no relationship of dependency between the hotel operator and the guests (which, in the event of a requirement to disclose one’s identity, could impair the willingness to submit reviews)—alter this conclusion on its own (even the scenarios assessed by the ECtHR in the decisions cited above [para. 45] were not based on a relationship of dependency in the sense assumed by the parties seeking review, for example, regarding the relationship between a teacher and a student). Based on this, however, the absence of a review of the review prior to its publication—specifically, to verify whether the user actually used the service being reviewed—and thus the fact that a data subject may have to tolerate the presence of abusive reviews for a certain period of time (see, for example, in this context, BGH, Feb. 15, 2022, VI ZR 692/20, para.

41, which refers to an acceptable circumstance inherent in the system)—cannot, in and of itself, result in the unlawfulness of the data processing. 49 Nor is it objectionable if, when balancing interests in a situation such as the present one, the circumstances that, in this specific case, only data attributable to the social sphere of the parties seeking review was processed, that access to the data requires a specific search for the business of the parties seeking review, and that, in the general perception, online reviews do not convey unrestricted credibility, are taken into account. On the other hand, with regard to the interests of the parties seeking review, it should be taken into account that the present case also involves (as the Supreme Court has held in its case law) “free-text reviews,” in which the potential infringement of the protection of personal data is greater than in the mere assignment of points.

50 The Federal Administrative Court (BVwG) also correctly held, on the merits, that in the balancing of interests to be conducted pursuant to Art. 6(1)(f) GDPR , it is necessary to take into account the measures that the controller itself implements or makes available to the data subject to prevent potential abuse, as well as the extent to which such measures, in turn, interfere with the interests or fundamental rights to be considered. 51 The findings of the BVwG underlying the balancing of interests in connection with the prevention of misuse remained, however, rather cursory. For example, the BVwG states that the co-respondent would remove reported content if it did not comply with the Directives, without elaborating on the content of these Directives. ” However, it does not specify in what cases—and thus under what conditions—a post would be deleted. 52 However, it must be pointed out to the parties seeking review that they have failed to demonstrate the relevance of the associated procedural defects.

Although the appeal argues that the negative post (described in more detail in the contested decision and concerning an incident at the hotel bar of Company S) could not have been “posted” in relation to the hotel (because the reviewer had not booked an overnight stay at the hotel), if the co-respondent had established an effective control system. However, this does not imply that the facts underlying this negative review would not have occurred at all (and not merely that they would have been assessed or classified differently). Consequently, the parties seeking review do not demonstrate which of the personal data at issue here were not deleted solely due to the alleged inadequacy of the co-respondent’s safeguards against misuse. Consequently, even the argument regarding the lack of an effective control system does not, in this specific case, demonstrate the unlawfulness of the data processing in question.

53 8. In response to the argument raised by the second appellant—namely, that as a formerly politically exposed person, he is at particular risk of being subjected to abusive comments—the Federal Administrative Court (BVwG) countered that a data subject may assert his or her special situation by objecting to the data processing pursuant to Art. 21 GDPR by referring to this particular circumstance. No such objection was raised in the present case. 54 The parties seeking review argue that the second appellant’s political activity was raised repeatedly during the proceedings and, in particular, during the oral hearing. Furthermore, the parties seeking review did not base their request for erasure on any specific provision. The BVwG’s statement that no objection had been raised pursuant to Art. 21 GDPR is therefore inconsistent with the record. 55 It must be countered that neither the reference (made during the proceedings) to the second appellant’s former political activity nor the alleged fact that the request for erasure was not based on any specific provision allows one to conclude that an objection under Art.

21 GDPR had been raised. Furthermore, the request for erasure dated June 27, June 2019 (as well as in the data protection complaint of August 28, 2019) points out that the grounds for erasure under Article 17(1)(d) GDPR (unlawful data processing) has been met (whereas no reference is made to Article 17(1)(c) GDPR , which is based on the filing of an objection under Article 21 GDPR ). 56 9. Finally, the Administrative Court does not see any reason to comply with the request of the parties seeking review to obtain a preliminary ruling from the CJEU. Regarding the question of the lawfulness of processing without consent, it should be noted that, under the framework of Article 6(1) of the GDPR , consent constitutes only one of several (alternative) grounds for justification. With regard to the balancing of interests, reference must again be made to the case law of the CJEU, according to which the balancing of the respective conflicting rights and interests—which depends on the specific circumstances of the individual case—is a matter for the national (referring) Court (see again CJEU C-252/21, para.

110). 57 10. The appeal was therefore dismissed as unfounded pursuant to para 42(1) VwGG. 58 The requested oral hearing was waived pursuant to para 39(2)(6) VwGG, because the Administrative Court—a tribunal within the meaning of Art. 6 MRK and a Court within the meaning of Art. 47 CFR—had already held an oral hearing; consequently, neither Art. 6 of the ECHR nor Art. , VwGH June 23, 2022, Ro 2019/04/0221 to 0222, para. 36). , in particular § 53(1) of the Administrative Court Act (VwGG), in conjunction with the 2014 Administrative Court Reimbursement of Expenses Ordinance. M. J00 In RIS since June 26, 2024 Last updated on March 25, 2026 Document number JWT_2022040026_20240517J00