DSB (Austria) - 2021-0.698.184
Facts — The data subject was a shareholder and managing director of two companies. The controller operated a free online search platform that allowed users to look up companies registered in the Austrian companies register and see, for a given company, which natural persons held positions such as shareholder or managing director, as well as an overlay showing what other companies those persons were connected to. The controller obtained the underlying data from a commercial information provider, which in turn sourced it from the Federal Ministry of Justice under a data-reuse agreement covering companies register documents. The controller funded the free service through advertising displayed on the platform. The data subject had no contractual relationship with the controller. A direct name search for the data subject on the controller's platform returned no results, however, searching for a company in which he held a position returned his name together with his role (managing director, sole shareholder with a 100% stake) and through an „i“ icon, an overlay listing his positions in other companies. The data subject complained to the Austrian DPA, arguing that the controller published his name without any contract between them and without any identifiable legitimate interest justifying the publication. The controller argued that its processing pursued a legitimate commercial interest, enabling business participants to research potential contractual partners and pointed out that companies register data was already public and accessible to anyone under national law, including via other commercial and official information services. Holding — First, the DPA rejected the controller's argument that the data was already available and therefore outside the scope of a secrecy interest altogether. It held, citing CJEU case-law C-73/07, that a blanket assumption that lawfully published data cannot be subject to a legitimate secrecy interest is incompatible with EU law requirements. Second, the DPA held that the controller's processing constituted a new form of data use requiring independent justification, because the controller did not merely reproduce publicly accessible companies register data, but recombined and cross-linked it, thereby creating additional informational value beyond what a simple companies register search would reveal. Third, applying the balancing test under Article 6(1)(f) GDPR and Section 1(2) DSG, the DPA found that the controller had a legitimate interest in operating its platform, both a commercial interest of its own (generating advertising revenue) and a legitimate interest of platform users and market participants generally in being able to assess a business partner's other company affiliations. The DPA weighed this against the data subject's interest in secrecy and concluded that the balance favoured the controller, for three reasons: 1. the underlying data's general availability in the companies register reduced (though did not eliminate) its protection-worthiness 2. the data related exclusively to the data subject's professional sphere as someone who had voluntarily chosen to participate in commercial life as a shareholder and managing director 3. the resulting interference with his data protection rights was accordingly of low intensity. The DPA therefore rejected the complaint as unfounded.
How it connects
Related across sources
Full text
Ref. No.: 2021-0.698.184 dated October 8, 2021 (Case No. DPA-D123.774) [Editor’s note: Names and company names, legal forms and product names, addresses (including URLs, IP addresses, and email addresses), case numbers (and similar), statistical data, etc., as well as their initials and abbreviations, may have been abbreviated and/or altered for pseudonymization purposes. Obvious spelling, grammar, and punctuation errors have been corrected.] DECISION RULING The Data Protection Authority rules on the data protection complaint filed by Franz A*** (complainant) on November 13, 2018, against N*** Marketing GmbH (respondent), represented by B*** & C*** Attorneys at Law, regarding a violation of the right to confidentiality, as follows: - The complaint is dismissed as unfounded . Legal Basis Art. 6, Art. 51(1), Art. 57(1)(f), and Art. 77(1) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR ), OJ No. L 119 of May 4, 2016, p. 1; Sections 1, 18(1), and 24(1) and (5) of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999 , as amended; Sections 9, 10 of the Federal Act on Special Civil Law Provisions for Enterprises (Commercial Code—UGB), dRGBl. p. 219/1897 as amended. STATEMENT OF REASONS A. Arguments of the Parties and Course of Proceedings 1. In a petition initiating proceedings dated November 13, 2018, the complainant alleged a violation of the right to privacy and argued as follows: It appears that the website www.n***.at processes personal data on a large scale. At the very least, the complainant’s name was used on the aforementioned website without there being a contract in place with the respondent. Furthermore, no legitimate interest on the part of the respondent could be identified that would entitle it to publish the complainant’s name on the Internet in a manner accessible to the general public. Screenshots of the website at issue were attached to the complaint. 2. In a statement dated December 3, 2018 (supplemented on January 10, 2019, upon request), the respondent , represented by the law firm B*** & C***, submitted the following arguments relevant to the proceedings: The respondent offers its services on the platform www.n***.at . As part of this free service—which ultimately constitutes a marketing activity for its own services—the respondent enables internet searches for existing enterprises and legal entities registered in the commercial register. As part of this search, Internet users have the option, through a simple search for a legal entity registered in the commercial register, to discover, on the one hand, any ownership interests and, on the other hand, to determine at which other legal entities a natural person holds a representative function. However, a direct query regarding the person is not possible. Since the exercise of this commercial activity would be inconceivable without the collection, storage, and disclosure of such information, it must also be assumed that the legislature has a legitimate interest in certain categories of cases that outweighs the interests of the data subjects. It is in the respondent’s legitimate interest, within the scope of its commercial license, to make the published (Commercial Register) data—including links to first and last names as well as positions as managing directors and shareholders of legal entities registered in the Commercial Register—to Users of the website as information that is of interest and useful to them. Since various enterprises also place advertisements on the platform, it is also in the respondent’s interest to attract as many website users as possible through the interesting information made available there, in order to have the highest possible number of visitors to the website and thereby generate advertising revenue. This advertising revenue constitutes a portion of the respondent’s revenue. Data on the complainant is accessible only by entering the name of a legal entity registered in the Commercial Register. Pursuant to para 9(1) of the Austrian Commercial Code (UGB), anyone is authorized to inspect the Commercial Register; there are no restrictions on such inspection. The Commercial Register also enjoys publicity within the meaning of § 15 of the Austrian Commercial Code (UGB) and is accessible to the public as a “list of persons with links” within the Commercial Register. It is generally known that such company data—i.e., facts subject to registration and publication that are accessible in the Commercial Register— and—in accordance with § 10(1) of the Austrian Commercial Code (UGB)—are also published in the Ediktsdaten and the Wiener Zeitung, is generally known; for example, the Bar Association also offers its members access to -Info as a service. This service even offers expanded functionality compared to the respondent’s service. 4. In a submission dated January 20, 2019, the complainant objected that the respondent’s economic interests could not justify the publication of the complainant’s data on the Internet for anyone to view. An economic advantage cannot outweigh the interest in confidentiality. Compared to the respondent, the Commercial Register has a statutory mandate and, moreover, cannot be accessed by anyone free of charge on the Internet. Furthermore, the Commercial Register does not provide links to other companies. 4. In a submission dated December 15, 2020, the respondent , represented by the law firm B & C, argued, in summary, as follows: D* Wirtschaftsauskunftsdienst Ges.m.b.H. (“D***”) has a valid contract with the Federal Ministry of Justice (“BMJ”) based on para 5(3)(3) in conjunction with § 8 of the Information Reuse Act (IWG). Documents and records from the Commercial Register pursuant to para 1 of Section 1 of the Commercial Register Act are made available to D*** by the BMJ. The difference between providers that grant access to the (official) Commercial Register and the respondent is that the respondent offers basic information regarding enterprises free of charge and displays it via links in an “overlay” for the respective enterprise. The “official” databases require registration and/or a small fee (e.g., auszug.at: EUR 1.32) for direct individual searches, which are offered as a search option. However, the fee for the individual search is so low that it cannot be considered a barrier. The processing concerns exclusively the complainant’s professional sphere, as he himself made the decision to participate in economic life as a shareholder or managing director. The complainant must therefore be prepared from the outset for his conduct to be observed by a broad public and for his business relationships to be disclosed. Attached to the statement were, among other things, screenshots of the respondent’s website and the commercial register. 6. The complainant did not submit any further comments within the prescribed deadline, despite having been given the opportunity to do so during the hearing of the parties. B. Subject Matter of the Complaint The subject matter of the complaint is whether the respondent violated the complainant’s right to confidentiality. C. Findings of Fact 1. The respondent holds, among others, the business licenses for “advertising agency” and “direct marketing and address provider.” The respondent operates a search platform on the website www.n***.at . Advertisements are also placed on this website. The website appears as follows: [Editor’s note: The screenshot of the respondent’s website reproduced here as a facsimile (graphic file) cannot be pseudonymized with reasonable effort and has therefore been removed.] 2. The complainant is a shareholder and managing director of two enterprises (at the time of the decision, these are F*** GmbH and G*** GmbH). 3. There is no contractual relationship between the complainant and the respondent. 4. A direct search by name (“Mag. Franz A***” or “Franz A***”) for the complainant on the respondent’s platform yields no results. When searching for part of the enterprise name of an enterprise in which the complainant is also a shareholder or managing director, the search results—once opened—include, among other things, information about the enterprise’s authorized representatives. The results appear as follows, for example: [Editor’s note: The screenshot from the respondent’s website reproduced here as a facsimile (graphic file) cannot be pseudonymized with reasonable effort and has therefore been removed. The search result contains the complainant’s name, the titles “managing director,” “private individual,” and “authorized to act alone,” as well as the statement that the complainant is the sole shareholder of G*** GmbH (“100.00% stake”).] 5. Next to the complainant’s name is an “i.” This “i” indicates that additional information about the complainant is available. Selecting the “i” causes an “overlay” to appear. It appears as follows: [Editor’s note: The screenshot from the respondent’s website reproduced here as a facsimile (graphic file) cannot be pseudonymized with reasonable effort and has therefore been removed.] This “overlay” displays the complainant’s other “roles” at other enterprises. 6. The data listed as a result of the query originates from D*** Wirtschaftsauskunftsdienst Ges.m.b.H. (which, in turn, obtains the data from the Commercial Register based on a contractual relationship with the Federal Ministry of Justice) and is made available to the respondent by the former. Assessment of the Evidence The findings are based on the parties’ consistent statements in this regard, as well as the documents submitted by them and an ex officio search conducted by the Data Protection Authority on the website www.n***.at (accessed on October 8, 2021). D. From a legal perspective, this implies the following: The fundamental right to data protection enshrined in § 1 of the DSG, according to the first paragraph of which every person, in particular with regard to respect for their private and family life, has a right to the confidentiality of personal data concerning them, provided there is a legitimate interest in such protection, includes the protection of the data subject against the collection of their data and the disclosure of data collected about them. However, the fundamental right to data protection is not absolute; rather, it may be restricted by certain permissible interventions. Pursuant to § 1(2) of the Data Protection Act (DSG), restrictions on the right to confidentiality—insofar as the use of personal data is not in the vital interest of the data subject or does not occur with the data subject’s consent—are permissible only to safeguard the overriding legitimate interests of another party. The complainant’s data used by the respondent is derived from the Commercial Register. As the respondent correctly argued, the Commercial Register is public pursuant to § 10 of the Austrian Commercial Code (UGB), and anyone is authorized to access the Commercial Register pursuant to § 9 UGB. However, insofar as the respondent argued in this context that the data in question was already “generally available” and thereby implied that it would not be subject to a claim to confidentiality, it must be countered that the general presumption that there is no violation of legitimate confidentiality interests with respect to lawfully published data is not compatible with the requirements of European law (see the judgement of the CJEU of December 16, 2008, C-73/07 Satakunnan Markkinapörssi and Satamedia; see also the decisions of the Federal Administrative Court (BVwG) dated July 29, 2020, Ref. No. W211 2221963-1, and February 25, February 2021, Ref. No. W274 2236016-1, as well as the decision of the Data Protection Authority dated April 23, 2019, Ref. No. D123.626/0006-DPA/2018). Furthermore, if the respondent argues that these connections could also be identified through a targeted search for individuals in the commercial register and thus believes that this may constitute a mere reproduction of “publicly available data,” the respondent is mistaken, since the respondent recombines and links the commercial register data and thereby generates informational added value; consequently, this constitutes a new use of data in this context, the permissibility of which must be assessed in accordance with the provisions of the DSG and the GDPR (see, regarding the legal situation under the DSG 2000, Kotschy in Jahnel (ed.), Data Protection Law and E-Government Yearbook 2012, 27 [47]; the decision of the Federal Administrative Court dated February 25, February 2021, Ref. No. W274 2238717-1, as well as the decision of the Data Protection Authority dated January 15, 2019, Ref. No. D123.527/0004-DPA/2018). In the present case—as the respondent correctly argued—data processing based on overriding legitimate interests within the meaning of § 1(2) of the Data Protection Act (DSG) or Art. 6(1)(f) of the GDPR may serve as a justification. To this end, the complainant’s legitimate interests must be assessed and weighed against the respondent’s legitimate interests (as well as those of any third parties, if applicable). In the context of this balancing of interests, it must be taken into account that two cumulative conditions must be met for the respondent to rely on this legal basis: on the one hand, the processing must be necessary to safeguard the legitimate interests of the controller or a third party; on the other hand, the fundamental rights and freedoms of the data subject (in this case: the complainant’s), which require the protection of personal data, must not override them (see the judgement of the CJEU of November 24, 2011, C-468/10 and C-469/10 [ASNEF and FECEMD], para. 38; see also the judgement of the CJEU of May 4, 2017, C‑13/16 [Rīgas satiksme], para. 28). In weighing the interests involved, it must be considered whether a data subject, at the time the personal data is collected and in light of the circumstances under which it is collected, can reasonably foresee that processing for this purpose may take place. This balancing must be carried out from an objective perspective and not from the subjective perspective of individual data subjects; thus, individual sensitivities are not to be taken into account (see Kastelitz/Hötzendorfer/Tschohl , loc. cit., para. 51). [Editor’s note: this refers to Kastelitz/Hötzendorfer/Tschohl in Knyrim , DatKomm Art. 6 GDPR , para. 51] In this context, the respondent argued that the complainant’s data primarily served its economic interests as well as the interests of participants in economic life in learning which individuals hold stakes in enterprises and what positions they also hold in other enterprises. This would enable a participant in economic life to better assess a potential contractual partner, among other things, and, for example, to determine whether the person(s) behind the contractual partner as shareholders are still active in other enterprises or not. Since various enterprises also place advertisements on the platform, it is also in the respondent’s interest to attract as many users as possible to the website by providing interesting information there, in order to have the highest possible number of visitors to the website and thereby generate advertising revenue. Taking into account that, due to their general availability, the complainant’s data is presumed to be of lesser significance in terms of protection, and since this data ultimately pertains only to the complainant’s professional sphere—where he himself makes the decision to participate in economic life as a shareholder or managing director—and therefore the overall intensity of the intrusion must be considered low, the Data Protection Authority concludes that the respondent’s legitimate interests in processing the complainant’s data as part of its web service outweigh the complainant’s interests. The complaint has been found to be unfounded and was therefore dismissed pursuant to para 24(5) DSG. Keywords Confidentiality, lawfulness of processing, publication, legitimate interests, balancing of interests, commercial register, commercial register data, public domain, managing director, roles at other enterprises, linking, informational added value European Case Law Identifier (ECLI) ECLI:AT:DPA:2021:2021.0.698.184 Last updated on July 24, 2024 Document number DSBT_20211008_2021_0_698_184_00