W214 2235505-1

XXXX, both represented by XXXX, against the decision of the Federal Ministry of Finance dated August 26, 2020, Ref. No. 2020-0-491.066, concerning the disclosure of information under the Freedom of Information Act, and has rightly ruled as follows after conducting an oral hearing: A) I. The appeal is dismissed with respect to the request that “the Federal Administrative Court (BVwG) grant the appeal on the grounds that the respondent authority wrongfully refused to provide the requested information, specifically regarding a list of the names of all companies to which, in the course of the COVID-19pandemic were granted tax deferrals and/or subsidies for fixed costs and/or loan guarantees, and the respective amounts of aid approved to date for each company, provided that the sum of the approved aid in each category (tax deferrals, fixed-cost subsidies, and loan guarantees) exceeds an amount that is higher than the lowest 10% of all aid approved in the respective category,” or, as stated in the further amended petition, “that the Administrative Court (BVwG) grant the complaint on the grounds that the respondent authority wrongfully refused to provide the requested information, namely a list of the names of all companies to which, in the course of the COVID-19pandemic, and the respective amounts of aid approved to date for each company.” “The 10% of companies in each category (tax deferrals, fixed-cost subsidies, and loan guarantees) that received the least amount of aid are not to be disclosed,” the court rejected this request. II. The complaint is dismissed with regard to the request that “the Administrative Court (BVwG) grant the complaint on the grounds that the respondent authority wrongfully refused to provide the requested information, namely a list of the names of all companies to which, in the course of the COVID-19pandemic, and the respective amounts of aid approved to date for each company,” granted the complaint on the condition that the respondent authority provide the requested information regarding the complainant’s request for information filed on June 2, 2020: “I hereby request, pursuant to §§ 2, 3 of the Freedom of Information Act, the names of all companies that applied for tax deferrals and/or subsidies for fixed costs and/or loan guarantees in the course of the COVID-19 pandemic, and the respective amounts of aid approved for each company.” was wrongfully denied insofar as it ● did not disclose the names of the companies that were approved for subsidies for fixed costs and/or loan guarantees in the course of the COVID-19 pandemic, nor the respective amounts of aid approved to date in this regard for those companies subject to the disclosure requirement in the “Transparency Award Module” pursuant to Regulation (EU) No. 651/2014 of the European Commission declaring certain categories of aid compatible with the internal market in application of Articles 107 and 108 of the Treaty on the Functioning of the European Union, as amended, and ● not the remaining names of corporations subject to a disclosure requirement under Sections 277 through 280a of the Austrian Commercial Code (UGB), which received, in the course of the COVID-19 pandemic, grants toward fixed costs and/or loan guarantees from the Federal COVID-19 Financing Agency GmbH (COFAG) in the course of the COVID-19 pandemic, and ● not the remaining names of corporations that were subject to a disclosure requirement pursuant to Sections 277 through 280a of the Austrian Commercial Code (UGB), to which the COVID-19 Federal Financing Agency GmbH (COFAG) approved or granted subsidies for fixed costs and/or loan guarantees, or to which the Austria Wirtschaftsservice Gesellschaft mbH (aws), the Austrian Hotel and Tourism Bank Gesellschaft m.b.H. (ÖHT), and/or the Austrian Control Bank (OeKB), and the respective amounts of aid approved to date for each company in this regard, in response to the aforementioned request for information. B) The appeal is not admissible pursuant to Art. 133(4) of the Federal Constitutional Law (B-VG). Text Reasons for the Decision: I. Course of Proceedings: 1 It should be noted at the outset that, by decision of the Federal Administrative Court dated July 28, 2021, Ref. No. W214 2235505-1/27E, the complaint regarding the failure to provide the requested information concerning the applied-for/granted tax deferrals was dismissed (Decision Point A2). This point of the decision remained unchallenged and was therefore not affected by the Administrative Court’s (VwGH) annulment of the decision (which covered only point A1) in its decision dated February 2, 2023, Ro 2023/13/0001-5 (see also para. 18 of the cited VwGH ruling). The course of the proceedings (to the extent still relevant to the case) was as follows up to the Administrative Court’s decision of February 2, 2023, Ro 2023/13/0001-5:

In a letter dated July 21, 2020, the respondent authority informed the complainant that the requested information could not be provided. The authority explained that the disclosure of the names of all companies, including the specific amounts of the respective COVID-19 support payments, did not constitute general information but rather specific details regarding the business conduct of the respective companies, which fall under the scope of protection of § 1 of the Data Protection Act (DSG) or, insofar as a connection to a natural person could be established, falls under the scope of the GDPR. Furthermore, the legitimate interest of the respective companies in maintaining confidentiality regarding the disclosure of the specific support payments outweighs the legitimate interest of the requester in the disclosure of this data (in this context, reference was made to the case law of the Supreme Administrative Court). The publication of the names, particularly in conjunction with the respective amounts, could allow inferences to be drawn regarding the companies’ earnings situation, profitability, and thus their competitiveness in the market compared to other market participants, along with the related effects on competition. Furthermore, there is no explicit statutory authorization or obligation—other than that described above—to transmit or disclose data regarding COVID-19 support payments. However, in order to also accommodate the legitimate interests in transparency, relevant obligations are provided for by law as a less restrictive measure: For example, under EU state aid law, the granting of individual aid exceeding 500,000 EUR must be published for a period of ten years. The submission of the relevant data to the so-called Transparency Award Module (TAM) is expected to begin in September 2020. In addition, pursuant to Section 3b(4) of the ABBAG Act, the Federal Minister of Finance is required to submit a detailed quarterly report to the Budget Committee setting forth all measures in favor of enterprises pursuant to Section 3b(1) of the ABBAG Act, in particular their financial implications.

The complainant filed an appeal against this decision in a written submission dated September 23, 2020, within the prescribed time limit pursuant to Art. 130(1)(1) of the Federal Constitutional Law (B-VG) and, after presenting the facts of the case and summarizing the contested decision, set forth the following grounds for the appeal: To ascertain whether the measures requested in the request for information dated June 2, 2020, fell within the scope of authority of the respondent agency, it suffices to examine the enforcement provisions of the respective substantive laws: - Section 19 of the Federal Act on the Review of Federal Subsidies in Connection with the COVID-19 Pandemic—COVID-19 Subsidy Review Act (Federal Law Gazette I No. 44/2020) - Section 6 of the Federal Act on the Establishment of a Federal Mining Participation Corporation—ABBAG Act (Federal Law Gazette I No. 51/2014) - Section 10 of the Federal Act on Special Subsidies for Small and Medium-Sized Enterprises—SME Subsidy Act (Federal Law Gazette No. 432/1996) - Section 15 of the Federal Act of May 12, 1977, Concerning the Facilitation of Enterprise Financing Through Guarantees Provided by Austria Wirtschaftsservice Gesellschaft mit beschränkter Haftung with Federal Liabilities – Guarantee Act of 1977 (Federal Law Gazette No. 296/1977) Furthermore, the substantive laws provide for relevant regulatory powers in favor of the respondent authority. Through this, the respondent authority determines the administrative actions (in this specific case: the administration of grants and subsidies) of enterprises established or controlled by the Federal Government. In this context, particular note should be made of the regulation issued by the Federal Minister of Finance (BMF) pursuant to Section 3b(3) of the ABBAG Act concerning guidelines on the adoption of financial measures which are necessary to maintain the solvency of enterprises and to bridge their liquidity difficulties in connection with the spread of the SARS-CoV-2 pathogen and the resulting economic impacts (Federal Law Gazette II No. 143/2020). The fact that the administration of subsidies and grants by the respondent authority has been partially outsourced to legal entities organized under private law (COFAG, aws, ÖHT) does not alter the fact that the matters in question remain within the scope of the respondent authority’s jurisdiction. In its decision of February 27, 2013, 2009/17/0232, the Administrative Court (VwGH) determined that the respondent authority, as the (at that time) competent insurance supervisory authority, was the correct recipient for information regarding the content of a pension fund contract. Nothing to the contrary could apply in this specific case, in which the respondent authority is (at least also) the supervisory authority or, in substantive terms, the relevant higher authority of the spun-off legal entities. The outsourcing of administrative actions in the legal form of private law cannot result in the individual’s subjective right to information being rendered meaningless or significantly impeded. Otherwise, federal agencies could evade this legal obligation through outsourcing. Such (unconstitutional) provisions cannot be attributed to the Law on the Duty to Provide Information. Subsequently, several examples were cited that would demonstrate that the Federal Ministry of Finance (BMF) possesses comprehensive powers of direction and intervention with respect to the spun-off companies. Pursuant to Section 3b of the ABBAG Act, the Federal Ministry of Finance (BMF) is required to submit to the Budget Committee, on a quarterly basis, a detailed report outlining all measures taken to maintain the solvency of enterprises and to bridge liquidity difficulties arising in connection with COVID-19. This special reporting obligation and the requirement for a “detailed account” could not be fulfilled by the respondent authority at all if the data available or reported in connection with business support were not properly processed by the respondent authority. It is therefore unclear why transmitting the data to the complainant would constitute a disproportionate burden. The fact that the data would first have to be obtained from third parties is also incomprehensible in light of the Federal Minister of Finance’s personal reporting obligation. Furthermore, COFAG is required to report to the Federal Ministry of Finance (BMF) on an ongoing basis regarding the financial measures taken (supervisory and inspection rights, reporting obligation; see Point 9 of the comprehensive guidelines contained in the annex to the BMF Regulation of September 11, 2020, Federal Law Gazette II No. 143/2020). In the specific case of assuming guarantees for loans under the Guarantee Act of 1977, it has already been explained above that this always requires case-by-case approval by the respondent authority or its representatives. It follows from this that all guarantee cases are on record with the tax administration. It also seems implausible that the respondent authority would have no comprehensive right to information or right to be consulted in cases of liability assumptions on such a large scale, which could lead to significant financial burdens on the federal government. Regarding the balancing of interests (interest in information versus confidentiality obligations), the complainant summarized the following: Section 1 of the Data Protection Act (DSG) does not establish an absolute duty of confidentiality for the body obligated to provide information; rather, within the scope of the Act on the Obligation to Provide Information, a balancing of interests must take place—namely, between the interest in obtaining information and the party’s (or parties’) interest in confidentiality. If the two interests are of equal weight, no duty of confidentiality on the part of the authority would preclude the disclosure of information; the authority would be barred from disclosing information (only) if the party’s interest in confidentiality prevails. In the context of this balancing of interests, it must also be taken into account that the right of access to information (“passive freedom of information”) is also covered by the scope of protection of the freedom of expression under Article 10 of the European Convention on Human Rights (ECHR). Subsequently, the criteria cited by the ECtHR—which are relevant for determining the scope of a right of access to information under Article 10 of the ECHR—were elaborated upon in greater detail, with particular reference to the ruling of the Administrative Court (VwGH) dated May 29, 2018, Ref. No. 2017/03/0083. The provisions that allow the party obligated to provide information, under federal and state laws governing the obligation to provide information, to refuse a requested disclosure must therefore be interpreted narrowly, particularly when a request for information is to be regarded as a relevant preparatory step for journalistic or other activities intended to create a forum for public debate, the requested information is in the public interest, and the requester plays a role as a “watchdog” within the meaning of the case law of the European Court of Human Rights. Gathering the requested information constitutes a relevant preparatory step for the complainant’s journalistic work. In his capacity as a journalist, XXXX undoubtedly also fulfills the role of a “public [watchdog]” or “social watchdog.” The specific request for information from the Federal Ministry of Finance (BMF) is also necessary for the exercise of freedom of expression and freedom of the press, as the requested information cannot be obtained by any other means or has not been published in this form. Furthermore, the requested information is of general or public interest. Whether the respective applicant companies receive government subsidies is not a “private matter” worthy of protection. Knowledge of the requested data could contribute to numerous media and civil society debates, all of which are in the public interest. If the general public has no knowledge of the underlying data, an informed public discussion is made impossible from the outset. Given the large number of companies that have applied for assistance, it cannot be said that the publication of the company names could trigger “unfair competition” with other market participants. It is also questionable to what extent information about the financial performance of individual companies—which could potentially be indirectly inferred from the provision of aid—is worthy of protection, given that the relevant industry associations representing the companies, or the companies themselves, have been vocally demanding government support—even on a large scale—including through the media. Furthermore, the financial performance and creditworthiness of Austrian companies are generally well documented anyway and can be obtained in detail, for example, from creditor protection associations. The (EU) legislature has made it unmistakably clear that, in comparable situations involving public subsidies or aid, the public interest in information prevails: for example, all payments made under the EU’s Common Agricultural Policy must be published. As for the respondent authority’s statements regarding publication under the Transparency Award Module (TAM), it itself acknowledges that there will be no complete publication of the state aid granted in the form requested. Overall, the respondent authority’s argument—that the legitimate interests in transparency are also being met in other ways (at least in part)—tends to support the complainant’s position: For as long as the data in question is generally available, the data subjects’ legitimate interest in confidentiality ceases to apply (Section 1(1), second sentence, of the Data Protection Act [DSG]), and the information must be disclosed. With regard to the fundamental right to data protection, the reasoning used by the respondent authority—that the disclosure of data is permissible only if the relevant law contains a corresponding authorization—suggests that a “separate statutory provision” of any kind must exist for the data transfer to be permissible. This would render the Act on the Obligation to Provide Information inapplicable. A closer examination of the GDPR reveals that its provisions do not preclude the requested information. Rather, Article 85 of the GDPR, in conjunction with Section 9 of the DSG (the “media privilege” under data protection law), requires a balancing of data protection on the one hand and freedom of information on the other, which, in this specific case, tips the scales in favor of freedom of information. According to Article 6(1)(e) of the GDPR, the processing of personal data is lawful if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. XXXX The obligations that were entrusted to XXXX are undoubtedly to be regarded as being in the public interest; therefore, the complainant, as a journalist, must be provided with the requested information pursuant to Article 6 of the GDPR in conjunction with Section 1 of the Duty to Provide Information Act (AuskunftspflichtG). Finally, a request was made that the Administrative Court (BVwG) set aside the contested decision without replacement and order the respondent authority to bring the matter into compliance with the law (by providing the requested information).

In a brief dated December 1, 2020, received by the BVwG on December 4, 2020, the complainant submitted a supplementary statement. In it, the complainant amended his motion to initiate proceedings pursuant to § 17 VwGVG in conjunction with § 13(8) AVG so that it now read as follows: “I hereby request, pursuant to the Act on the Duty to Provide Information, Federal Law Gazette No. 287/1987, as amended, the names of all companies that were granted tax deferrals and/or subsidies for fixed costs and/or loan guarantees in the course of the COVID-19 pandemic, and the respective amounts of aid approved to date for each company, provided that the total amount of approved aid in each category (tax deferrals, fixed-cost subsidies, and loan guarantees) exceeds an amount that is higher than the lowest 10% of all aid approved in the respective sector.” The complaint request filed under point 4 of the appeal against the decision was modified as follows in accordance with § 9(1)(4) VwGVG (verbatim reproduction including punctuation): “The complainant requests that the Federal Administrative Court (BVwG) grant the complaint on the grounds that the respondent authority wrongfully refused to provide the requested information, specifically regarding a list of the names of all companies to which, in the course of the COVID-19pandemic, and the respective amounts of aid approved to date for each company, provided that the total amount of approved aid in each category (tax deferrals, fixed-cost advances, and loan guarantees) exceeds an amount that is higher than the bottom 10% of all aid approved in the respective sector.” Subsequently, the discussion turned to the publication of payments under the EU’s Common Agricultural Policy, including the judgment of the European Court of Justice (ECJ) dated November 9, 2010, Case C-92/09, Schecke and Eifert) and EU Regulation No. 1306/2013 concerning the publication of agricultural subsidies. The data was published for Austria on the publicly accessible website https://www.transparenzdatenbank.at/. No competitive disadvantages for individual farmers were observed here. It therefore seemed incomprehensible why the publication of other subsidies should result in a competitive disadvantage. Regarding the scope of the request, it was summarized that a press release issued by the respondent authority on August 10, 2020, noted, among other things, that an aid package totaling 51 billion EUR had since been put together. Given such a large sum and such a large number of beneficiaries, it was not possible to define a specific journalistic outcome of the inquiry. The journalistic outcome was—in the “Rumsfeldian sense”—a “known unknown.” Only the data would provide the basis for initiating an investigation; only the disclosure of the data would make it possible to verify how the funds were used. Investigative journalism does not mean knowing the answer before asking the question. Journalists establish a basis for their investigative interest by posing questions they wish to “pursue.” This could include, for example: “Did donors to political parties receive significantly higher amounts in the form of tax deferrals, fixed-cost subsidies, or loan guarantees, while political opponents and their companies were granted less assistance? To what extent do corporations benefit that evade taxes through their international corporate structures or act against the Paris Climate Agreement goals through climate-damaging activities? Are there significant differences in the profile of aid recipients (location, company size, industry)? What proportion of a company’s total revenue do tax deferrals, fixed-cost subsidies, or loan guarantees account for? Which industries benefit the most from the aid, and which legal forms benefit more or less? To what extent have companies that made large profits during the pandemic (e.g., supermarkets, furniture stores) taken advantage of the aid?” The focus of the investigation is not on the “small fish”; but rather on structural patterns emerging from the aid disbursed. However, it is not possible to identify such patterns or even gain an overview if the authorities maintain a monopoly on information in this regard or if the right to access information is granted only on a piecemeal basis. Given the large number of companies that have applied for aid, it cannot be said that the publication of company names would put them at a competitive disadvantage relative to other market participants. Furthermore, the specific request does not concern trade and business secrets in the strict sense—that is, data that has commercial value or whose disclosure would, in and of itself, constitute a competitive disadvantage (through the transfer of “know-how”). Furthermore, the financial performance and creditworthiness of Austrian companies are generally well documented anyway and can be queried in detail, for example, from XXXX or other creditor protection associations. It should also be noted that XXXX, in the context of structuring XXXX, is itself bound by numerous legal provisions designed to protect those affected by media coverage. In this context, mention should be made of, for example, the Media Act (in particular §§ 6 ff.), the Austrian Civil Code (ABGB) (in particular § 1330), the Copyright Act (UrhG) (in particular § 78), and XXXX: These provisions protect affected companies from defamation, damage to creditworthiness, or biased reporting. For the reasons stated, it is therefore not apparent that the affected companies have a legitimate interest in confidentiality that would even remotely equal the interest in information expressed in the request for information.

In response, the respondent authority, now represented by the Financial Procurator’s Office, submitted its position in a written statement dated February 2, 2021. The authority argued that the disclosure had been lawfully refused on the basis of the confidentiality obligations under § 1(1) of the Data Protection Act (DSG) in conjunction with the General Data Protection Regulation (GDPR). However, the information was also lawfully withheld pursuant to § 1(2) of the Duty to Provide Information Act (AuskunftspflichtG) due to the fact that providing the requested information would significantly impair the administration’s other tasks and would affect matters outside the scope of the authority’s jurisdiction. The respondent authority essentially reiterated the arguments already put forward regarding confidentiality under data protection and tax law and again pointed out the high administrative burden that would result from providing the requested information; furthermore, information regarding the subsidies, fixed costs, and guarantees of the respondent authority was not immediately available. The modification of the original request for information and the amendment to the complaint are deemed inadmissible. Regarding the publication of payments under the EU’s Common Agricultural Policy, it was stated that, in the present case, it must be examined whether the disclosure of the requested subsidy data would violate the fundamental right to data protection under § 1 of the Data Protection Act (DSG). The Administrative Court (BVwG) has ruled, in connection with the publication of agricultural subsidies, that such publications are based on obligations under EU law, which take precedence even over national constitutional law and thus over the fundamental right to data protection. A comparison with the situation regarding agricultural subsidies is irrelevant because these are essentially granted for cultivated land, and no conclusions regarding the specific economic situation of the subsidized farm can be drawn from them.

In a brief dated March 8, 2021, the respondent authority commented on the questions posed during the hearing and explained, with regard to the fixed-cost subsidies, that a distinction was made between Fixed-Cost Subsidy I (for fixed costs incurred during the period between March 16,2020 and September 15, 2020) and Fixed Cost Subsidy 800,000 (for fixed costs incurred between September 16, 2020, and June 30, 2021). The fixed-cost grants are awarded by COFAG. COFAG is required, pursuant to Section 9 of the Regulation on Granted Fixed-Cost Subsidies I, to report to the Federal Ministry of Finance (BMF) on an ongoing basis and, upon request, to provide the BMF with all documents and information necessary to verify compliance with the directive and to ensure fulfillment of the reporting obligation to the Budget Committee. Pursuant to Section 9.1 of the Regulation on Granted Fixed-Cost Subsidies 800,000, COFAG must report to the BMF on an ongoing basis as of specific reporting dates and, upon request, must also provide the BMF with all documents and information necessary to verify compliance with the directive and ensure fulfillment of the reporting obligation to the Budget Committee. The fixed-cost grants were awarded on the basis of an agreement under private law, and there was no legal entitlement to them. Aggregated data was transmitted daily by COFAG to the BMF. COFAG is also required to submit a monthly report to the authority in question, containing all data records for each instrument, including the names and amounts of the applicants. COFAG’s reporting obligation to the BMF is mandated under Section 3b(3)(5) of the ABBAG Act, specified in all BMF guidelines issued by regulation, and further detailed in agreements. Pursuant to Section 6a(1) of the ABBAG Act, the provisions of this Act apply mutatis mutandis to subsidiaries established by ABBAG. COFAG is a wholly-owned subsidiary of ABBAG and was established at the BMF’s request to ABBAG pursuant to § 2(2a) of the ABBAG Act. Neither the ABBAG Act nor COFAG’s articles of association contain any provisions granting the BMF the authority to issue instructions or exercise supervisory powers. Subsequently, the respondent authority again invoked the protection of confidentiality, in particular Article 6(1)(f) of the GDPR. However, given the large volume of information requested by the applicant, it was simply not possible to weigh the competing interests in this specific case, and doing so would entail an effort that would significantly impede the authority’s other duties. Nor could the recipients of fixed-cost subsidies reasonably have foreseen that their data might also be further processed for journalistic purposes in a manner that identifies them personally. It cannot be determined with certainty whether, following the disclosure of the requested information to the complainant and its subsequent disclosure to the investigative network XXXX, the necessary safeguards for the data subjects would be upheld. The consequence would be claims for official liability against the Republic of Austria for the violation of the data subjects’ legitimate interests. Personal data would be published in individual cases where the grant amount exceeds EUR 500,000, EUR 100,000, or EUR 10,000 (the latter in the agricultural sector). Disclosure of grant information that goes beyond this publication and is more personally identifiable would be disproportionate. The state grants should be classified as trade secrets, for which there is an economic interest in confidentiality. Furthermore, the respondent authority again argued that the requested data could not be obtained either from credit reporting agencies or through the disclosure requirements under the Austrian Commercial Code (UGB), and that the affected companies could suffer a competitive disadvantage. Moreover, it is not within COFAG’s discretion whether fixed-cost subsidies are granted; rather, they are awarded provided the statutory requirements are met. In contrast to the publication of subsidy data under the Common Agricultural Policy, the publication of such data is not foreseeable for the affected companies. Furthermore, larger companies naturally incur higher fixed costs than smaller ones; therefore, granting a higher fixed-cost subsidy to a larger company would not constitute preferential treatment of large or international companies. Regarding loan guarantees, it was explained that, as of March 25, 2020, the defendant authority assumed indemnification obligations in connection with COVID-19 on the basis of the directive issued pursuant to Section 3b( 3 of the ABBAG Act, in accordance with the guideline—issued as a regulation by the Federal Minister of Finance—on the adoption of financial measures to maintain the solvency of and bridge the liquidity difficulties of companies in connection with the spread of the SARS-CoV-1 and the resulting economic impacts, Federal Law Gazette II No. 143/2020, last amended by Federal Law Gazette II No. 618/2020. COFAG is required to report to the Federal Ministry of Finance (BMF) on an ongoing basis in accordance with Section 9.1 of the Regulation on Financial Measures Taken and, upon request, to provide the Ministry with all documents and information necessary to verify compliance with the Directive. Guarantees for loans are provided within the scope of private-sector administration. There is no entitlement to the granting of a guarantee. COFAG decides on guarantees based on the BMF’s guidelines for implementing financial measures to maintain solvency and bridge liquidity difficulties in accordance with the ABBAG Act. The aws grants guarantees based on the guidelines of the Federal Ministry of Economic Affairs and Labor (BMDW) regarding aws guarantee commitments under the SME Promotion Act and the guidelines of the Federal Ministry of Finance (BMF) regarding aws guarantee commitments under the Guarantee Act of 1977, in its own name and for its own account. ÖHT grants guarantees based on the guidelines of the Federal Ministry of Agriculture, Regions, and Tourism regarding the assumption of guarantees for the tourism and leisure industry pursuant to the SME Promotion Act, in its own name and on its own account. In both cases, the approval of the Federal Ministry of Finance’s (BMF) representative is required for the federal government’s indemnification obligation. For the COVID-19 liabilities, COFAG has been appointed as the designated agent pursuant to Section 1 of the COVID-19 Designated Agent Regulation (Covid-19-BeauftragtenV). The processing agencies have an automated system for this data. Both aws and ÖHT report to both COFAG and the Federal Ministry of Finance (BMF). Similar to the data on fixed-cost subsidies, the data is aggregated daily by COFAG and transmitted monthly on an individual or company-specific basis. The reports from aws and ÖHT would be transmitted in both aggregated and individual- or company-specific forms. The respondent authority further explained on which reporting dates the data would be transmitted and who owned aws and ÖHT. The original data is stored by the respective processing agencies. Furthermore, the respondent authority again referred to its previous statements regarding the protection of confidential information, the balancing of interests, and proportionality. Regarding the “Transparency Award Module” (TAM), the respondent authority stated that, pursuant to Article 9 of Regulation (EU) No. 651/2014 (“AGVO”), Member States must ensure that information on individual aid grants exceeding 500,000 EUR is published. The Commission continuously reviews whether adjustments to the Temporary Framework are necessary, which is why the 5th amendment to the Temporary Framework is already in effect (2021/C 34/06). This fifth amendment also includes adjustments to the publication requirement under Recital 88: The publication requirement in the Temporary Aid Framework is extended to individual aid grants exceeding EUR 100,000, or exceeding EUR 10,000 in the agricultural sector. Fixed-cost grants and loan guarantees provided as part of the COVID-19 aid measures are subject to the publication requirement. In principle, this data is available. Work is currently underway to structure the data sets at the interface with the TAM. Guarantees of 100,000 EUR or more are to be included in the TAM, as are fixed-cost subsidies of 500,000 EUR or more. In any case, access to information via the budget report or the TAM represents the least intrusive measure compared to the nearly unrestricted disclosure of personal data deserving of protection. Furthermore, the respondent authority stated that the reporting obligation to the Budget Committee pursuant to Section 3b(4) of the ABBAG Act covers only the fixed-cost subsidy and the loan guarantees. To date, just under 700 million in fixed-cost subsidies and loan guarantees totaling approximately 4.8 billion EUR have been granted.

In this regard, the complainant stated in his submission dated March 26, 2021, that the respondent authority, in its entire argument regarding the protection of confidentiality, disregarded Article 10 of the ECHR. In this context, the complainant referred to relevant case law, in particular the European Court of Human Rights (ECHR) decision in Magyar Helsinki Bizottság (Application No. 18.030/11, Human Rights Newsletter 2016, 536), in which it was held that a right of access to information exists when such access is essential for the exercise of freedom of expression, particularly the freedom to receive and impart information. In this context, particular reference was made to the complainant’s status as a “public watchdog.” Furthermore, the complainant objected to the respondent authority’s definition of journalistic purposes. The summary provided in the monthly budget reports made publicly available could hardly constitute sufficiently transparent information on the use of 2.3 billion EUR that is suitable for journalistic purposes. It is incomprehensible that, on the one hand, information should be kept confidential from journalists, while on the other hand, all grants exceeding 100,000 EUR must be published in the transparency database. Furthermore, the respondent authority’s argument that the complainant should wait until the data is published in the TAM is completely out of touch with reality. This is not provided for by the Law on the Obligation to Provide Information. With regard to loan guarantees, reference was made to the arguments presented thus far. As the respondent authority itself states, “similar to data on fixed-cost subsidies … COFAG aggregates the data daily and transmits person- or company-specific data monthly.” Here, too, the report published for the National Council’s Finance Committee is insufficient to provide the informed public with a clear picture of the specific use of the funds. In summary, the respondent authority does not at any point plausibly dispute that it possesses the requested data or that it could, in effect, make it available without significant effort. A (further) oral hearing is therefore not necessary.

The statement was brought to the attention of the complainant, who responded to it in a written submission dated May 10, 2021. The respondent authority was unable to credibly demonstrate that it was not possible to comply with the information seeker’s request. Although COFAG has since entered data records into the TAM, this has yielded no results, because even a possible publication in the TAM ultimately does not replace the right to information under the Freedom of Information Act. Irrespective of this, the scope of the data now reported through the TAM does not even begin to cover the applicant’s request. For example, data is available for only 0.68% of the recipients of fixed-cost subsidies. Furthermore, while data from COFAG is included, data from ÖHT and aws is not. The question posed by the BVwG—namely, how many companies that received fixed-cost subsidies or loan guarantees as part of the COVID-19 support program would fall under the publication requirements set forth in Art. 9 of Regulation (EU) No. 65/2014, as amended, was therefore not answered in full, but only to the extent of 0.22% (59 cases out of 25,902 guarantees). There are also legitimate doubts regarding the number of fixed-cost subsidies. COFAG itself cited a figure of 96,024 “approved applications,” whereas the respondent authority claimed to have approved only 74,715 applications as of March 31, 2021. In addition, the complainant expressed doubt that the data was unavailable and reiterated his arguments regarding the balancing of interests.

The respondent authority filed an ordinary appeal with the Administrative Court (VwGH) against point A1) of this ruling in a brief dated September 10, 2021. In that brief, it was argued that the Federal Administrative Court should have ruled on the complainant’s original request for information dated June 2, 2020, rather than on the request as modified during the administrative court proceedings, and that the decision should therefore be set aside as unlawful. Furthermore, the respondent authority does not agree with the BVwG’s conclusion regarding the assessment of the requirements under Article 10(1) of the ECHR, as well as the respondent authority’s data protection obligations in connection with the request for information submitted by the intervening party (the complainant). The requested information is not available to the respondent authority to the extent and level of detail sought by the complainant. The respondent authority has only selected data at its disposal and is unable to provide comprehensive information. The necessity of the request for information for the exercise of freedom of expression is called into question, since access to information regarding the use of tax revenues for COVID-19 measures for the interested public is ensured on multiple occasions through the budget report, the publication in the TAM, and the Court of Auditors’ report “COVID-19 – Structure and Scope of Financial Aid Measures.” Even a narrow interpretation of the data protection provisions in connection with the disclosure of information would have had to lead to the conclusion that the requested information should have been denied in its entirety, since none of the grounds for authorization under Article 6 of the GDPR were met. In particular, Article 6(1)(f) of the GDPR cannot be invoked, as it does not apply to public authorities in the performance of their duties. Nor can the disclosure of data be based on Article 6(4) of the GDPR, as this provision requires the existence of a legitimate purpose pursuant to Article 23(1) of the GDPR, which cannot be identified in the present case. The respondent authority also could not understand the reference to the disclosure obligations under § 277 et seq. of the Austrian Commercial Code (UGB). In this context, reference was again made to the administrative burden. Furthermore, registration in the TAM is carried out by the relevant processing agencies—COFAG, aws, and ÖHT—which is why this data is not available to the appellant and would first have to be obtained in order to provide the requested information. To infer local and subject-matter jurisdiction on the part of the respondent authority for the requested information based on the regular reporting obligations of COFAG, aws, and ÖHT to the respondent authority would stretch the concept of “scope of activity” within the meaning of Section 1(1) of the Duty to Provide Information Act. Furthermore, reference was again made to the effort involved in providing the information, which would significantly impede the respondent authority’s ability to fulfill its other administrative duties.

On October 28, 2021, the complainant (represented by counsel) filed a response to the appeal, in which he argued that no legal issue of fundamental importance was at stake. He argued that the Right to Information Act, in conjunction with Article 6(1)(c) of the GDPR, provided an appropriate data protection justification for the data processing involved in providing the information, which is why additional reliance on Article 6(1)(f) of the GDPR is not only unnecessary but even impermissible. As an example of a legal obligation within the meaning of Article 6(1)(c) of the GDPR, legal literature cites, among other things, the obligation to provide information under the (German) Freedom of Information Act (IFG). Nor is it true that the Federal Administrative Court (BVwG) incorrectly resolved the balancing of interests. Insofar as the appeal refers to the fact that publication takes place in the TAM anyway, it suffices to point out that the legislature—although it was certainly aware of the numerous existing publication obligations—did not impose a corresponding restriction in the Freedom of Information Act limiting the scope of information to data that would not have to be published at some point anyway. Accordingly, the existence of an alternative source is not in and of itself a reason to deny the request for information. Furthermore, the data from the TAM is not equivalent either quantitatively or qualitatively, particularly because the requester has no influence over when the data is entered into the database. The same applies to the appeal’s reference to the duties of the Court of Auditors. After all, it is precisely the role of the media to carry out their mission—which the European Court of Human Rights (ECHR) and the Constitutional Court (VfGH) consider essential for a functioning democracy—based on their own research and sources. It would therefore be clearly incompatible to limit the obligation to provide information to those areas in which a state supervisory body does not already exist. The argument that the publication of subsidy data would entail a competitive disadvantage is a sweeping and unproven assertion that, according to the Administrative Court’s case law cited above, would in any event not justify a refusal to provide information. Rather, concrete and transparent considerations would need to be made in this regard. It should also be taken into account that the recipients of the support measures in question are business operators and that the European Court of Justice has recognized that legitimate interests in confidentiality in a business context are certainly subject to a graduated assessment. Regarding the alleged disruption of duties and lack of data availability, it should be noted that a refusal to provide information cannot be justified by the argument that the information could also be obtained by other means. In the present case, the very fact of minimizing the burden argues in favor of directing the request directly to the respondent authority, since otherwise three agencies would have to carry out parallel work processes to provide the requested information. The Administrative Court (BVwG) therefore correctly concluded, based on the established facts, that the respondent authority should have complied with the request for information, at least to the extent specified in the BVwG’s ruling. The respondent authority never provided concrete details or specified, with regard to the burden it alleged throughout the proceedings, in what way an excessive burden was supposed to exist—which, however, would have been required under the case law of the Supreme Administrative Court (VwGH). Nor is it clear why, given an electronic database that is already aggregated and structured—and which was prepared by a third party and is available to the respondent authority— the separation of the data covered by the Federal Administrative Court’s ruling regarding the obligation to provide information from that which is not covered should entail any special effort.

With Federal Law Gazette I No. 155/2022, the Transparency Database Act of 2012 was amended and § 39g was inserted, authorizing the Federal Ministry of Finance (BMF) to publish certain COVID-19 aid payments, including fixed-cost subsidies exceeding 10,000 EUR in a single year. Excerpts from the explanatory notes to this legislative proposal read as follows: “Based on the publication of state aid on the Transparency Award Module (“TAM”) pursuant to Article 9 of COMMISSION REGULATION (EU) No. 651/2014 OF THE COMMISSION of June 17, 2014, declaring certain categories of aid compatible with the internal market in application of Articles 107 and 108 of the Treaty on the Functioning of the European Union (General Block Exemption Regulation—GBER) and subsidies in the area of the Common Agricultural Policy (CAP) pursuant to Articles 111 et seq. of REGULATION (EU) No. 1306/2013 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of December 17, 2013, on the financing, management, and control system of the Common Agricultural Policy and repealing Regulations (EEC) No. 352/78, (EC) No. 165/94, (EC) No. 2799/98, (EC) No. 814/2000, (EC) No. 1290/2005, and (EC) No. 485/2008 of the Council, certain economic aid provided by the federal government to companies in response to the COVID-19 crisis must also be published on a case-by-case basis on the transparency portal under certain conditions. In the case of certain data affected by the publication of COVID-19 (e.g., company name or other designation, ZIP code) are personal data subject to the fundamental right to data protection within the meaning of Section 1(1) of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999, as last amended by the Federal Act (Federal Law Gazette I No. 148/2021). Accordingly, every person has the right to the confidentiality of personal data concerning them, provided there is a legitimate interest in such confidentiality. Restrictions on this right to confidentiality of personal data are permissible only to safeguard the overriding legitimate interests of another; in the case of interventions by a government authority, such restrictions are permissible only on the basis of laws necessary for the reasons specified in Article 8(2) of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210/1958. Furthermore, any interference with this fundamental right must be carried out in the least intrusive manner necessary to achieve the objective and must be suitable for achieving the objective in the public interest. The COVID-19 crisis has entailed—and continues to entail—not only health and social policy implications but also massive budgetary and macroeconomic consequences. In this context, directly managing the pandemic requires, on the one hand, considerable expenditures in the health sector (e.g., procurement of COVID-19 vaccines, establishment of nationwide testing programs, etc.), and, on the other hand, comprehensive economic and social policy relief measures that support people in financial distress and maintain the production potential of the Austrian economy. Against the backdrop of the resulting drastic increase in government spending, which is offset by reduced government revenue, the increased transparency and public oversight of the public funds used to combat the COVID-19 pandemic—which this publication is intended to promote—must be regarded as taking precedence over the individual’s interest in the confidentiality of their data. The Court of Auditors, too, made the following concluding recommendation (19) in its report “Transparency Database—Costs and Benefits, Objectives and Achievement of Objectives,” Series BUND 2017/45: “In the interest of greater transparency for the public, the principle of strict non-disclosure of grant recipients underlying the design of the transparency database should be reconsidered for the area of (non-sensitive) grants.” Similarly, in its judgment of November 9, 2010, joined cases C 92/09 and C 93/09, Volker and Markus Schecke GbR (C 92/09), Hartmut Eifert (C 93/09) v. State of Hesse) recognized that increased oversight of the use of public funds constitutes a legitimate purpose in the public interest and thus confirmed, in principle, the permissibility of publishing personal data related to grants. Given that the funds expended by the government to address the COVID-19 crisis are public funds financed primarily by taxes paid by the general public, the citizen’s right to information regarding the specific use of these funds must be deemed to outweigh the recipient’s interest in keeping their data confidential and, in any case, justifies the publication of certain COVID-19 benefits. Furthermore, the publication of recipients’ personally identifiable information is an appropriate means of strengthening public oversight and transparency regarding the use of the government funds in question. A specific preventive effect against abuse can be expected through the strengthening of the beneficiary’s personal responsibility. In general, it is to be expected that publication will lead to better compliance with regulations, greater accountability, peer review, and ultimately more effective public spending. In this sense, the publication of recipients of certain forms of economic aid constitutes a sensible supplement to the existing administrative and control system, which is necessary to ensure adequate protection of the state’s financial interests and constitutes a measure necessary in a democratic society for the economic well-being of the country within the meaning of Article 8 of the ECHR. Since the only alternative for achieving the intended goal of providing transparent information to the public would be to provide information on a case-by-case basis—which, however, would sometimes lead to unequal treatment from an administrative standpoint and place a heavy burden on resources—publication also represents the least restrictive means of achieving this goal. Furthermore, publication also strengthens the legitimacy, efficiency, and accountability of the administration toward citizens. Under the GDPR, the publication of the data constitutes processing that is necessary for the performance of a task carried out in the public interest (enhanced oversight and increased transparency regarding the use of public funds) and is therefore lawful under Article 6(1)(e) of the GDPR.”

On May 15, 2023, the respondent authority submitted a statement in which it explained that the publication requirement in the TAM —with regard to COVID-19 aid—covers individual grants exceeding EUR 100,000.00 or, in the agricultural sector, exceeding EUR 10,000.00. As of May 9, 2023, the Austrian Transparency Portal listed by name 96,183 companies that had received the fixed-cost subsidy (among other things) in at least one year.

The Federal Administrative Court (BVwG) forwarded the respondent authority’s statement to the complainant and also gave the complainant the opportunity to submit a statement. The complainant submitted a statement in a written submission dated May 30, 2023, and explained that a search in the transparency database did not allow for a breakdown by individual support measures (COVID-19 fixed-cost subsidies and COVID-19 loan guarantees). However, obtaining the total amount of the individual approved and applied-for measures per funding recipient had been part of the request for information submitted to the respondent authority. Furthermore, loan guarantees are not included in the personally identifiable publications on the Transparency Portal. Additionally, funding data for past years (2020 and 2021) is no longer available. It is therefore not possible to obtain a comprehensive overview, although such an overview was requested in the request for information. The fact that the disclosures are accessible exclusively via a search form and that a uniform, exportable dataset is not available also hinders the ability to obtain a comprehensive overview. To access information on all grant recipients, thousands of pages would have to be manually clicked through. This makes systematic research considerably more difficult. Furthermore, the tables provided by the respondent authority regarding the total number of companies affected by the publications and the approved amounts merely constitute general information and do not allow for any conclusions to be drawn about individual recipients of fixed-cost subsidies and loan guarantees.

The respondent authority subsequently stated that the OeKB had provided—and continues to provide—it with time-limited download links regarding the bridge guarantees. These had not been entered into a data system but had served as the basis for the respondent authority’s plausibility check before the funds were released to OeKB. Furthermore, the respondent authority argued for the first time that the monthly reports submitted by COFAG had also been provided in the form of temporary links for downloading Excel spreadsheets. These had covered the guarantees issued by COFAG itself as well as the guarantees from aws and ÖHT. The information reportedly included, among other things, both the aid recipients and the guarantee amounts. These files, too, were not entered into or stored in a data system by the respondent authority. In addition to aggregated data, the defendant authority also received personal data in response to individual requests in specific cases. II. The Federal Administrative Court considered the following: 1 Findings: The course of proceedings described in Section I serves as the basis for the facts of the case. In particular, the following is established: 1 Regarding the economic impacts of the COVID-19 pandemic: The COVID-19 pandemic—and in particular the measures taken to contain it—caused the sharpest downturn in the global economy since the 1930s. Originating in China, the pandemic spread to Europe and, by the second quarter of 2020, had engulfed nearly the entire world. The spread of the coronavirus pandemic and the measures taken to combat it—in particular, the lockdown / shutdown of large parts of public life in March and April 2020, between November 2020 and May 2021, and in November and December 2021, also led to a severe economic crisis in Austria. As a result, gross domestic product (GDP) plummeted by 6.7 percent in 2020 and, although it rebounded by 4.5 percent in 2021, it had not yet returned to its pre-pandemic level on an inflation-adjusted basis. Overall, the COVID-19 crisis caused a loss of approximately 40 billion euros in economic output. Sectors particularly affected included the hospitality industry, the leisure sector, and parts of the retail sector. 2 At the time the decision was issued by the respondent authority, the complainant was—and continues to be—a journalist and XXXX at XXXX. 3 In an email dated June 2, 2020, sent to the Federal Ministry of Finance from his professional email address XXXX, the complainant submitted the following request for information: “Dear Mr. XXXX, I hereby request, pursuant to Sections 2 and 3 of the Freedom of Information Act (AuskunftspflichtG), the names of all companies that applied for tax deferrals and/or subsidies for fixed costs and/or loan guarantees in the course of the COVID-19 pandemic, as well as the respective amounts of aid approved for each company. In the event that the information is not provided in whole or in part (e.g., refusal), I request that your Ministry issue a formal notice addressed to me in accordance with § 4 of the Information Disclosure Act. Sincerely, XXXX 4 In the contested decision, the respondent authority rejected the request dated July 27, 2020, regarding the complainant’s request dated June 2,2020 for the disclosure of the names of all companies that applied for tax deferrals and/or subsidies for fixed costs and/or loan guarantees in the course of the COVID-19 pandemic, as well as the disclosure of the respective aid approved to date for each company (Decision Point 1). Furthermore, it was ruled that the complainant was not required to pay any administrative fees (Point 2 of the ruling). 5 The complainant filed an appeal against this decision within the prescribed time limit by a brief dated September 23, 2020, pursuant to Art. 130(1)(1) of the Federal Constitutional Law (B-VG). In it, he requested that “the Administrative Court (BVwG) set aside the contested decision of August 26, 2020, Ref. No. 2020-0.491.066, without replacement and order the Federal Ministry of Finance to immediately restore a situation in compliance with the law (by providing the requested information).” 6 In his statement dated December 1, 2020, received by the Federal Administrative Court on December 4, 2020, the complainant amended his motion to initiate proceedings pursuant to § 17 VwGVG in conjunction with § 13(8) AVG so that it read as follows: “I hereby request, pursuant to the Act on the Obligation to Provide Information, Federal Law Gazette No. 287/1987, as amended, the names of all companies that were granted tax deferrals and/or subsidies for fixed costs and/or loan guarantees in the course of the COVID-19 pandemic, and the respective amounts of aid approved to date for each company, provided that the total amount of approved aid in each category (tax deferrals, fixed-cost subsidies, and loan guarantees) exceeds an amount that is higher than the lowest 10% of all aid approved in the respective sector.” In the same letter, the complaint request made under point 4 of the appeal against the administrative decision was modified as follows in accordance with Section 9(1)(4) of the Administrative Court Act (VwGVG): “The complainant requests that the Federal Administrative Court (BVwG) grant the complaint on the grounds that the respondent authority wrongfully refused to provide the requested information, specifically a list of the names of all companies to which, in the course of the COVID-19pandemic, and the respective amounts of aid approved to date for each company, provided that the total amount of approved aid in each category (tax deferrals, fixed-cost advances, and loan guarantees) exceeds an amount that is higher than the lowest 10% of all aid approved in the respective category.” 7 In a statement dated June 8, 2021, the complainant again amended the complaint pursuant to § 9(1)(4) VwGVG as follows: “The Administrative Court (BVwG) is requested to grant the complaint on the grounds that the respondent authority wrongfully refused to provide the requested information, namely a list of the names of all companies to which, in the course of the COVID-19pandemic, and the respective amounts of aid approved to date for each company. The 10% of companies in each category (tax deferrals, fixed-cost subsidies, and loan guarantees) that received the least amount of aid are not to be disclosed.”, in the alternative, “the Administrative Court (BVwG) should grant the complaint on the grounds that the respondent authority wrongfully refused to provide the requested information, specifically regarding a list of the names of all companies that, in the course of the COVID-19pandemic, and the respective amounts of aid approved to date for each company.” 8 The Federal Divestiture Agency (ABBAG) is responsible for providing services and taking financial measures to benefit companies in accordance with § 3b(1) of the ABBAG Act, which are necessary to maintain the solvency of these companies and to bridge their liquidity difficulties in connection with the spread of the SARS-CoV-2 virus and the resulting economic impacts. The Federal Government owns 100% of the shares in ABBAG. The Federal Minister of Finance (BMF) is responsible for managing the Federal Government’s shares and must exercise the Federal Government’s ownership rights at the general meeting.

The fixed-cost subsidies were granted by COFAG on the basis of a private-law agreement, and there was no legal entitlement to them. COFAG was required to report to the Federal Ministry of Finance (BMF) on an ongoing basis regarding fixed-cost subsidies granted and, upon request, to provide the BMF with all documents and information necessary to verify compliance with the directive and to ensure fulfillment of the reporting obligation to the Budget Committee. COFAG transmitted aggregated data in this regard to the respondent authority on a daily basis. COFAG also submitted a monthly report to the respondent authority containing, for each instrument, all data records from which the names and amounts of the applicants were evident.

The aws issued guarantees based on the guidelines of the Federal Minister for Digitalization and Business Location (BMDW) for aws guarantees under the SME Promotion Act and the guidelines of the Federal Ministry of Finance (BMF) for aws guarantees under the Guarantee Act of 1977, acting in its own name and on its own account. The ÖHT provided guarantees based on the guidelines of the Federal Ministry of Agriculture, Regions, and Tourism (BMLRT) regarding the assumption of guarantees for the tourism and leisure industry under the SME Promotion Act, in its own name and on its own account. In both cases, the Federal Government’s indemnification obligation required the consent or approval of the Federal Ministry of Finance’s (BMF) designated representative. For the COVID-19 guarantees, COFAG was appointed as the designated representative pursuant to Section 1 of the COVID-19 Designated Representatives Regulation (Covid-19-BeauftragtenV). The processing agencies utilized a computer-assisted system to process the data. The authority in question was informed of the issued guarantee declarations through various reports from aws, ÖHT, and COFAG. Both aws and ÖHT reported to both COFAG and the respondent authority. The reports from aws and ÖHT were transmitted electronically to the respondent authority in aggregated form as well as in a form specific to individuals or companies.

COFAG’s reporting obligation to the Federal Ministry of Finance (BMF) remains mandatory pursuant to Section 3b(3)(5) of the ABBAG Act; it is stipulated in all BMF guidelines issued by regulation and further detailed in agreements. Pursuant to Section 6a(1) of the ABBAG Act, the provisions of this Act apply mutatis mutandis to subsidiaries established by ABBAG.

Pursuant to Article 9 of Regulation (EU) No. 651/2014 (“AGVO”), Member States must ensure that information on individual aid grants exceeding EUR 500,000 is published. Pursuant to Article 9(4) of the AGVO, the information must be structured and made available in a standardized format and must be accessible via efficient search and download functions. For measures granted on the basis of the Commission Communication “Temporary Framework for State Aid to Support the Economy in the Context of the Current COVID-19 Outbreak,” 2020/C 91 I/01, supplementary publication requirements apply in accordance with Recital 34: For each individual aid measure granted on the basis of this Communication, Member States must, within 12 months of the date of grant, publish all relevant information in accordance with Annex III of the AGVO on the website provided by the European Commission, the “Transparency Award Module” (“TAM”). The Commission continuously reviews whether adjustments to the Temporary Framework are necessary, which is why the 5th Amendment to the Temporary Framework is already in effect (2021/C 34/06). This fifth amendment also includes adjustments to the publication requirement under Recital 88: The publication requirement in the TAM has been extended to individual aid grants exceeding EUR 100,000 or, in the agricultural sector, exceeding EUR 10,000. This provision was already in effect at the time the decision was issued by the respondent authority. Since the first half of May 2021, personal data regarding the granting of fixed-cost subsidies and guarantees (broken down by company and the amount granted) has been published in Austria in the TAM, to the extent that such data falls under the publication requirement set forth in Article 9 of Regulation (EU) No. 651/2014 (“AGVO”) as amended, have been published in the TAM. Both fixed-cost subsidies and guarantees amounting to EUR 100,000 or more have been or are being reported. The reporting of fixed-cost subsidies and loan guarantees granted by COFAG to the TAM is carried out by COFAG itself, while the loan guarantees processed by aws and ÖHT are reported by those entities themselves.

The Transparency Database Act was amended by Federal Law No. 23/2020. This amendment, which entered into force on April 5, 2020, stipulated that COVID-19 aid must be included in the (Austrian) Transparency Database. Beginning on June 4, 2020, the Accounting Agency (BHAG), acting as a service provider for COFAG, began reporting personal information regarding COFAG grants to the Transparency Database after the technical requirements had been met. The Federal Minister of Finance was and remains responsible for the Transparency Database.

Certain COVID-19 aid grants awarded by COFAG have been published in the Transparency Database since fall 2023 for amounts of 10,000 EUR or more. These include fixed-cost subsidies and, under the benefit category “Liabilities, Sureties, and Guarantees – COVID-19,” the gross grant equivalent for six federal support measures. This publication is based on the amendment BGBl I No. 155/2022 to the Transparency Database Act of 2012, which inserted Section 39g into the Act.

At the time the decision was issued, the authority in question had access to—and currently has access to—the names and amounts regarding the fixed costs granted by COFAG, as transmitted by COFAG pursuant to its reporting obligation. Furthermore, it had, and continues to have, relevant information regarding the guarantees granted by aws, ÖHT, and OeKB.

The data was, and is, processed using automated systems and was, and is, therefore accessible for automated searching. 2 Assessment of Evidence: The course of the proceedings and the facts of the case are set forth in the administrative file submitted by the respondent authority and in the court record, in particular in the written statements and the transcript of the oral hearing. The findings regarding the economic consequences of the COVID-19 pandemic are derived from the statistics on the effects of the coronavirus (COVID-19) on the Austrian economy, https://de.statista.com/themen/6436/auswirkungen-des-coronavirus-covid-19-auf-die-wirtschaft-in-oesterreich/#editorsPicks (accessed on February 27, 2024). The following should be noted regarding the availability of the data: As regards the availability of data on fixed-cost subsidies and guarantees granted in connection with COVID-19, the respondent authority initially denied that such data was available and argued that it would first have to be obtained. However, in the course of the proceedings, the respondent authority acknowledged that the data in question had been provided to it—both by COFAG and by aws and ÖHT (the latter two on an aggregated basis)—for the purpose of preparing the report to the Budget Committee, which the respondent authority is required to submit monthly pursuant to Section 3b(4) of the ABBAG Act, and as part of the federal government’s indemnification obligation, is transmitted to it by both COFAG and aws and ÖHT (the latter two on an aggregated basis). Furthermore, in its statement dated March 8, 2021, the respondent authority explained that COFAG is required to submit a monthly report to the respondent authority containing, for each instrument, all data records from which the applicant’s name is evident, and these data records also include the amounts per applicant. The reports from aws and ÖHT are submitted in aggregated form and in a form that identifies individuals or companies. Although the respondent authority noted in its brief of April 19, 2021—again putting this into perspective— that, with regard to the fixed-cost subsidy and guarantees granted, complying with the request for information would entail the collection of data by the respondent authority, it must nevertheless be assumed that the data in question was and is available to the respondent authority and was not immediately destroyed. Even within the administration, the traceability of official actions must be ensured for at least a certain period of time. The respondent authority did not even claim that the data transmitted to it was no longer in its possession. As for the data transmitted by COFAG, the respondent authority did not contest the availability of the data at its office in the appeal either, but (merely) argued that disclosing the data obtained in connection with the reporting obligation would exceed the scope of its authority (see the remarks in the legal assessment). When the respondent authority states in its response of June 18, 2021, that “the respondent authority has no data regarding the loan guarantees granted by aws,” it should be noted that in its statement of March 8, 2021, it explicitly stated that aws and ÖHT also transmit personal and company-related data to it. When confronted with these contradictions, the respondent authority stated in its response of July 27, 2021, that aws and ÖHT would provide only aggregated data for the report to the Budget Committee. However, in connection with the federal government’s indemnification obligation, “selected data on guarantees issued” were indeed available. The respondent authority did not explain why this did not pertain to the data requested by the complainant, nor did it (once again) specify which “selected data” was available to it. Finally, in response to an inquiry from the BVwG, the respondent authority clarified in its statement of March 7, 2024, that the monthly reports submitted by COFAG also included the guarantees provided by aws and ÖHT, and that the respective aid recipient and the guarantee amount were evident from those reports. Why (in contrast to the COFAG aid measures, the existence of which was not disputed in the appeal) only “selected data” should be available specifically regarding the guarantees granted by aws and ÖHT, was once again not explained and is also incomprehensible, since the data on the guarantees approved by aws and ÖHT were also submitted by COFAG in its monthly report. If the respondent authority now (also in its response dated March 7, 2024) argues—for the first time—that the monthly reports were transmitted to it “with temporary download links,” the following should be noted: Even if the links were time-limited, it is already clear from the term “download links” that the lists had to be downloaded by the respondent authority in order to conduct its plausibility check. Thus, the respondent authority processed the data at issue in any case for the purpose of conducting a plausibility check prior to the approval of the aforementioned COVID-19 aid. When the defendant authority states that the data was not entered into any “data systems,” this term (which is foreign to both the GDPR and the DSG) is unclear and does not mean that the downloaded files were not stored further. Nor does the respondent authority claim that the downloaded documents were deleted; rather, it merely states that the links were temporary. Based solely on the duty of care that undoubtedly rests with the respondent authority, it must be assumed that the deletion of this data could not have taken place, at least not by the time the decision was issued (approximately half a year after the first lockdown in Austria). Otherwise, the respondent authority would have made any review of its plausibility checks—including by the Court of Auditors—impossible. However, such conduct cannot be attributed to the respondent authority, which is specifically responsible for financial matters. The same applies to the personal data that the respondent authority received in response to an individual inquiry or complaint. Furthermore, given the relatively short period of time that has elapsed since the grants were awarded, it is assumed that the data has not yet been deleted. Taken together with the respondent authority’s statements of March 8, 2021, it therefore follows that the respondent authority also possessed personal and corporate data regarding aid recipients and guarantee amounts pertaining to the liabilities/guarantees for loans from aws, ÖHT, and OeKB. Furthermore, as the respondent authority itself stated in its response dated March 7, 2024, it also had access to the relevant data regarding the guarantees granted by OeKB. The above applies to the arguments regarding the “download links” and the data processed for the plausibility check and its availability. Regarding the role of OeKB, the following is noted: The COFAG website indicates that support for large enterprises in the form of guarantees is (also) provided by the OeKB (https://www.cofag.at/garantien.html, accessed on March 11, 2024). The fact that this was also the case in the past was confirmed by the respondent authority in its statement dated March 7, 2024. Although the OeKB was not explicitly mentioned by either the complainant or the respondent authority until the Administrative Court (BVwG) made an explicit inquiry, the complainant’s request for information certainly also (and likely specifically) covered the guarantees granted by the OeKB. However, the lack of explicit mention can likely also be explained by the fact that guarantees for large enterprises generally involve amounts that fall within the scope of the data required to be published in the TAM. Finally, it should be noted that the fact that the aid was granted by other agencies in no way precludes the respondent authority’s obligation to provide information, as the authority received the data in connection with its reporting obligations and used (or has used) it for its own purposes. Furthermore, in its statement dated March 8, 2021, the respondent authority indicated that the data to be reported to the TAM is available. In its statements dated June 18, 2021, and July 27, 2021, it explained that aws and ÖHT reported the data to the TAM themselves and that the corresponding data records were not available. As clarified in the respondent authority’s appeal, COFAG also submits the data itself. However, the fact that the approving or guarantee-granting entities submit the data to the TAM themselves does not mean that this data was not or is not available to the respondent authority. Rather, based solely on the aforementioned transmission of COFAG’s monthly reports to the respondent authority, it must be assumed that the data to be entered into the TAM was also received by the respondent authority as part of COFAG’s reporting obligation. Therefore, it was and is to be assumed that the data requested by the complainant was available to the respondent authority in the form of a computer-processed database to the extent of the findings. The findings regarding the granting of and reporting obligations for the aforementioned subsidies relate, on the one hand, to the past (for example, it was undisputed that the aforementioned subsidy measures and reporting obligations already existed at the time of the respondent authority’s decision); on the other hand, the reporting obligations to the Federal Ministry of Finance (BMF) remain in effect (see the Regulation of the Federal Minister of Finance pursuant to § 3b(3) of the ABBAG Act concerning guidelines on the granting of subsidies to cover fixed costs by the COVID-19 Federal Financing Agency GmbH (COFAG), Federal Law Gazette II No. 225/2020, as amended, and the Regulation of the Federal Minister of Finance pursuant to Section 3b(3) of the ABBAG Act concerning guidelines on the adoption of financial measures necessary to maintain solvency and to bridge liquiditydifficulties of companies in connection with the spread of the SARS-CoV-2 pathogen and the resulting economic impacts, Federal Law Gazette II No. 143/2020, as amended, both available on RIS). The fact that the application deadlines for COVID-19 support measures have since expired (see https://www.fixkostenzuschuss.at/, accessed on February 27, 2024), does not, however, mean that all related proceedings have already been concluded or that the data is no longer available at the authority in question (see the pop-up notice stating that applications submitted within the deadline [at least for compensation for losses, note] are still being processed, https://www.fixkostenzuschuss.at/verlustersatz/ (accessed on March 11, 2024). The fact that the application deadlines for bridging guarantees expired on June 15, 2022, is evident on the COFAG website (https://www.aws.at/aws-ueberbrueckungsgarantien/, accessed on March 11, 2024). It is widely known that COFAG is to be dissolved, as indicated by various media reports; see, for example, https://www.derstandard.at/story/3000000203650/cofag-liquidation-to-begin-on-June-30 (accessed on March 11, 2024). The fact that data on COVID-19 benefits totaling 10,000 EUR or more per year has also been publicly available on the Transparency Portal since October 2023 is evident from the Transparency Database Act (Section 39g, pursuant to which the Federal Ministry of Finance is authorized to publish COVID-19 benefits totaling 10,000 EUR or more per year in the Transparency Portal) and the press release issued at the time on the BMF’s website (https://www.bmf.gv.at/presse/pressemeldungen/2022/Oktober/corona-hilfen.html), press release dated October 27, 2022, accessed on March 11, 2024). Furthermore, the respondent authority itself referred to the entry of data into the Transparency Portal and the availability of data therein in its statements dated May 15, 2023, and March 7, 2024. In its statement dated March 7, 2024, the respondent authority also referred to the fundamental legal basis for reporting COVID-19 aid to the Transparency Database. As early as Federal Law Gazette I No. 23/2020, published on April 4, 2020, an amendment to the Transparency Database Act of 2012 provided that benefits related to COVID-19 aid must be included in the Transparency Database. This provision took effect on the day following its publication. Therefore, the obligation to register COVID-19 aid in the Transparency Database already existed at that time. The Federal Minister of Finance was and remains responsible for the Transparency Database. According to the respondent authority, registrations began on June 4, 2020; however, the respondent authority states that it did not have access to the data entered at that time. Ultimately, it need not be determined whether the respondent authority had access to the data, as it had already been transmitted to it as part of its reporting obligation. For the sake of completeness, it should be noted that the data was not subject to a general obligation to publish at that time, but was intended to promote transparency among the various government agencies that awarded grants. 3 Legal Assessment: 3.1 Pursuant to Art. 130(1)(1) of the Federal Constitutional Law (B-VG), the administrative courts rule on appeals against decisions of an administrative authority on the grounds of unlawfulness. Pursuant to § 6 of the Federal Administrative Court Act, Federal Law Gazette I No. 10/2013 (BVwGG), the Federal Administrative Court (BVwG) decides through a single judge, unless federal or state laws provide for a decision by a panel. In the absence of any special provisions in ordinary law specific to this matter, jurisdiction in this case lies with a single judge. Pursuant to § 17 VwGVG, unless otherwise provided for in this federal law, the provisions of the General Administrative Procedure Act (AVG), Federal Law Gazette No. 51/1991 (AVG)—with the exception of §§ 1 through 5 and Part IV—the provisions of the Federal Tax Code, Federal Law Gazette No. 194/1961, as amended (BAO), the Agricultural Proceedings Act, Federal Law Gazette No. 173/1950, as amended (AgrVG), and the 1984 Civil Service Procedural Act, Federal Law Gazette No. 29/1984, as amended (DVG), and, in all other respects, to apply mutatis mutandis those procedural provisions in federal or state laws that the authority applied or would have been required to apply in the proceedings preceding the proceedings before the Administrative Court. Pursuant to § 28(2) of the Administrative Court Act (VwGVG), the Administrative Court must rule on appeals filed under Art. 130(1)(1) of the Federal Constitutional Act (B-VG) if the relevant facts of the case are established or if the Administrative Court’s own determination of the relevant facts is in the interest of expediency or results in significant cost savings. Pursuant to § 31(1) VwGVG, decisions and orders are issued by resolution, unless a judgment must be rendered. 3.2 Regarding A): 3.2.1 Legal Situation Art. 20(3) and (4) of the Federal Constitutional Law (B-VG) read as follows: “(3) All bodies entrusted with the tasks of federal, state, and municipal administration, as well as the bodies of other public-law entities, are—unless otherwise provided by law—obligated to maintain confidentiality regarding all facts that have come to their knowledge exclusively through their official duties, the confidentiality of which is required in the interest of maintaining public peace, order, and security; comprehensive national defense; foreign relations; the economic interests of a public-law entity; the preparation of a decision; or the overriding interests of the parties (official confidentiality). Official confidentiality does not apply to officials appointed by a general representative body with respect to that representative body if it expressly requests such information. (4) All bodies entrusted with federal, state, and municipal administrative tasks, as well as the bodies of other public-law corporations, are required to provide information regarding matters within their sphere of activity, provided that no statutory duty of confidentiality precludes this; professional associations are obligated to provide information only to their respective members, and only to the extent that this does not prevent the proper fulfillment of their statutory duties. The specific regulations regarding federal bodies and self-government governed by federal legislation are a federal matter in terms of legislation and enforcement; with regard to the organs of the states and municipalities, as well as self-government to be regulated by state legislation, a federal matter in terms of framework legislation, and a state matter in terms of implementing legislation and enforcement." The relevant provisions of the Federal Act of May 15, 1987, on the Obligation of the Federal Administration to Provide Information and an Amendment to the Federal Ministries Act of 1986 (Law on the Duty to Provide Information), Federal Law Gazette No. 287/1987, as amended, read as follows: “§ 1 (1) Federal agencies, as well as the agencies of local self-government governed by federal legislation, shall provide information regarding matters within their sphere of activity, provided that no statutory duty of confidentiality precludes this. (2) Information shall be provided only to the extent that it does not significantly impair the performance of the administration’s other tasks; professional associations are obligated to provide information only to their respective members and only to the extent that this does not prevent the proper fulfillment of their statutory duties. Information shall not be provided if the request is clearly made in bad faith. § 2 Any person may submit a request for information in writing, orally, or by telephone. The person requesting information may be asked to submit a written version of a request made orally or by telephone if the content or scope of the desired information is not sufficiently clear from the request. § 3 Information shall be provided without undue delay, but no later than eight weeks after receipt of the request for information. If, for special reasons, this deadline cannot be met, the requester must be notified in any case. § 4 If information is not provided, a written decision to that effect must be issued at the request of the person requesting the information. The Administrative Procedure Act (AVG) shall apply as the procedural law governing the issuance of such a decision, unless another procedural law is applicable to the matter in which the information is provided." Information within the meaning of the Act on the Duty to Provide Information consists of statements of fact, the content of which comprises exclusively information already known to the administration at the time of the request and which does not first have to be obtained by the requested administrative unit for the purpose of fulfilling the duty to provide information. The provision of information refers to the disclosure of details regarding the contents of a file, which, as a general rule, will not be as detailed as the information that could be obtained by inspecting the files. The use of the term “information” implies that the administration is not required to prepare extensive reports, draft expert opinions, or obtain information that is otherwise accessible. In this respect, it can be inferred from the law that the provision of information is subordinate to the administration’s other duties; consequently, requests for information must contain specific questions that can be answered within the prescribed short time frame without disrupting other administrative processes. According to the established case law of the Administrative Court (VwGH), only established knowledge—whether factual or legal—may be the subject of a request for information. The obligation to provide information within the meaning of Article 20(4) of the Federal Constitutional Law (B-VG) establishes an obligation to provide information about the activities of the authorities, but not an obligation to justify official actions or omissions. In the case of a request for information, it is often necessary to assess whether and to what extent the request conflicts with an obligation to observe a statutory duty of confidentiality (such as official confidentiality). When assessing, in this context, whether official confidentiality precludes the disclosure of information, the applicant’s interest in obtaining the requested information must be weighed against the party’s interest in confidentiality. If the two interests are of equal weight, official confidentiality does not preclude the authority from disclosing the information. Only if the party’s interest in confidentiality outweighs the other interest is the authority prohibited from disclosing the information due to official confidentiality. Furthermore, the independent obligation to maintain the confidentiality of personal data, as defined in § 1(1) and (2) of the Data Protection Act (DSG), is also a statutory duty of confidentiality. The duty to provide information is further restricted by the provision in Section 1(2) of the Duty to Provide Information Act, according to which information must be provided only to the extent that doing so does not significantly impair the performance of the administration’s other tasks. This is intended to ensure that requests for information, which are justified in and of themselves, do not place an excessive burden on the administration and thereby prevent it from performing its other tasks (see, regarding the preceding paragraphs and with numerous additional references, VwGH 13.09.2016, Ra 2015/03/0038). In light of § 4(3) of the Federal Constitutional Act of 1986 (BMG), the term “scope of authority” may be understood to mean that the organs of a local government must provide information within the limits of their territorial and functional jurisdiction. The obligation to provide information applies both to matters of public administration and to those of private-sector administration (see VwGH, February 2, 2023, Ro 2023/13/0001-5, para. 19). Article 8 of the European Convention on Human Rights (ECHR), which has constitutional status pursuant to Federal Law Gazette No. 59/194, reads as follows: “Article 8 – Right to Respect for Private and Family Life (1) Everyone has the right to respect for his private and family life, his home, and his correspondence. (2) There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety, the economic well-being of the country, the defense of the order, and the prevention of criminal offenses, the protection of health and morals, or the protection of the rights and freedoms of others.” Article 10 of the ECHR reads: “Article 10 – Freedom of Expression (1) Everyone has the right to freedom of expression. This right includes freedom of opinion and freedom to receive and impart information and ideas without interference by public authorities and regardless of national borders. This article does not preclude States from subjecting radio, cinema, or television enterprises to a licensing procedure. (2) Since the exercise of these freedoms carries with it duties and responsibilities, it may be subject to certain formalities, conditions, restrictions, or penalties prescribed by law, such as those necessary in a democratic society in the interests of national security, territorial integrity, or public safety, the maintenance of order and the prevention of crime, the protection of health and morals, the protection of the reputation or the rights of others, to prevent the disclosure of confidential information, or to ensure the prestige and impartiality of the judiciary.” Articles 8 and 11 of the Charter of Fundamental Rights of the European Union, OJ C 303, Dec. 14, 2007, read as follows: “Article 8—Protection of Personal Data (1) Everyone has the right to the protection of personal data concerning them. (2) Such data may be processed only in good faith for specified purposes and with the consent of the data subject or on another legitimate basis provided for by law. Everyone has the right to obtain information about the data collected concerning them and to have such data corrected. (3) Compliance with these provisions is monitored by an independent body. Article 11—Freedom of Expression and Freedom of Information (1) Everyone has the right to freedom of expression. This right includes freedom of opinion and the freedom to receive and impart information and ideas without government interference and regardless of national borders. (2) Freedom of the media and media pluralism shall be respected.” Articles 5 and 6 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119 of May 4, 2016, hereinafter referred to as the GDPR, read as follows: “Article 5 Principles Governing the Processing of Personal Data (1) Personal data must be a) processed lawfully, fairly, and in a transparent manner in relation to the data subject (“lawfulness, fairness, and transparency”); b) be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes is not considered incompatible with the original purposes pursuant to Article 89(1) (“Purpose Limitation”); c) be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (“data minimization”); d) be factually accurate and, where necessary, kept up to date; all reasonable measures must be taken to ensure that personal data that are inaccurate in light of the purposes for which they are processed are erased or rectified without delay (“accuracy”); e) stored in a form that permits identification of data subjects only for as long as is necessary for the purposes for which the personal data are processed; personal data may be stored for a longer period provided that, subject to the implementation of appropriate technical and organizational measures required by this Regulation to protect the rights and freedoms of the data subject, processed exclusively for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1) (“storage limitation”); f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, through appropriate technical and organizational measures (“Integrity and Confidentiality”); (2) The controller is responsible for compliance with paragraph 1 and must be able to demonstrate such compliance (“Accountability”). Article 6 Lawfulness of Processing (1) Processing is lawful only if at least one of the following conditions is met: a) The data subject has given consent to the processing of personal data concerning him or her for one or more specified purposes; b) the processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of precontractual measures taken at the data subject’s request; c) the processing is necessary for compliance with a legal obligation to which the controller is subject; d) the processing is necessary to protect the vital interests of the data subject or of another natural person; e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f) the processing is necessary to protect the legitimate interests of the controller or of a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail, in particular where the data subject is a child. Subparagraph 1(f) does not apply to processing carried out by public authorities in the performance of their duties. (2) Member States may retain or introduce more specific provisions to adapt the application of the provisions of this Regulation with regard to processing carried out for the purposes set forth in paragraph 1(c) and (e) by specifying specific requirements for such processing as well as other measures to ensure lawful and fair processing, including for other specific processing situations under Chapter IX. (3) The legal basis for processing pursuant to paragraph 1(c) and (e) shall be determined by a) Union law or b) the law of the Member States to which the controller is subject. The purpose of the processing must be set forth in this legal basis or, with respect to processing under paragraph 1(e), be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This legal basis may contain specific provisions adapting the application of the provisions of this Regulation, including provisions regarding which general conditions apply to governing the lawfulness of processing by the controller, which types of data are processed, which individuals are affected, to which entities and for what purposes personal data may be disclosed, to what purpose limitation they are subject, how long they may be stored, and which processing operations and procedures may be applied, including measures to ensure lawful and fair processing, such as those for other specific processing situations set forth in Chapter IX. Union law or the law of the Member States must pursue an objective in the public interest and be proportionate to the legitimate purpose pursued. (4) If processing for a purpose other than that for which the personal data were collected is not based on the data subject’s consent or on a provision of Union or Member State law, which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall—in order to determine whether the processing for another purpose is compatible with the purpose for which the personal data were originally collected—take into account, among other things, a) any connection between the purposes for which the personal data were collected and the purposes of the intended further processing, b) the context in which the personal data were collected, in particular with regard to the relationship between the data subjects and the controller, c) the nature of the personal data, in particular whether special categories of personal data pursuant to Article 9 are being processed or whether personal data relating to criminal convictions and offenses pursuant to Article 10 are being processed, d) the potential consequences of the intended further processing for the data subjects, e) the existence of appropriate safeguards, which may include encryption or pseudonymization.” Section 1(1) and (2) of the DSG read as follows: “(Constitutional Provision) Fundamental Right to Data Protection § 1 (1) Every person has the right, in particular with regard to respect for his or her private and family life, to the confidentiality of personal data concerning him or her, provided there is a legitimate interest in such confidentiality. The existence of such an interest is excluded if data are not subject to a right to confidentiality due to their general availability or because they cannot be traced back to the data subject. (2) To the extent that the use of personal data does not serve the vital interests of the data subject or is not based on the data subject’s consent, restrictions on the right to confidentiality are permissible only to safeguard the overriding legitimate interests of another person, and, in the case of interventions by a government authority, only on the basis of laws that are necessary for the reasons specified in Article 8(2) of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210/1958. Such laws may provide for the use of data that, by its nature, is particularly worthy of protection only to safeguard important public interests and must, at the same time, establish appropriate safeguards for the protection of the privacy interests of the data subjects. Even in the case of permissible restrictions, any interference with the fundamental right must be limited to the least intrusive means necessary to achieve the objective.” 3.2.2.1. Regarding the subject matter of the appeal proceedings; amendment of the underlying request for information; amendment of the appeal’s relief sought; jurisdictional authority and scope of enforcement: Regarding the subject matter of the appeal proceedings: As explained above, in its decision of February 2, 2023, Ro 2023/13/0001-5, the Supreme Administrative Court (VwGH) overturned the decision of the Federal Administrative Court (BVwG) of July 28, 2021, W214 2235505-1/27E, in the contested portion (point A1) on the grounds of unlawfulness due to the Administrative Court’s lack of jurisdiction, and ruled that the Administrative Court should not have based its decision on the request for information, which had only been amended during the appeal proceedings. It follows that, in the present case, the original request for information—submitted by the complainant to the respondent authority via email on June 2, 2020—constitutes the subject matter of the appeal proceedings and the decision. Consequently, the request for information “modified” during the appeal proceedings is not to be taken into account. Regarding the appeal’s relief sought: The respondent authority considers the complainant’s amended request for relief, which states that the Administrative Court should grant the appeal on the condition that “that the respondent authority wrongfully refused the requested information, specifically regarding a list of the names of all companies to which, in the course of the COVID-19pandemic were granted tax deferrals and/or fixed-cost subsidies and/or loan guarantees, along with the respective amounts of aid approved to date for each company. The 10% of companies in each category (tax deferrals, fixed-cost subsidies, and loan guarantees) that received the least amount of assistance need not be disclosed,” in the alternative, “that the respondent authority wrongfully refused to provide the requested information, namely a list of the names of all companies to which, in the course of the COVID-19pandemic and the respective amounts of aid approved to date for each company.” as inadmissible. The respondent authority stated in this regard that the possibility of a subsequent amendment to this petition was doubtful. The request would also determine the scope to which the administrative decision is being challenged. Any subsequent amendment to the request could be precluded by the decision’s potential partial legal effect. In this regard, it should first be noted that—as already explained above—in light of the aforementioned decision of the Administrative Court (VwGH) dated February 2, 2023, Ro 2023/13/0001-5, the original constitutes the subject matter of the appeal proceedings and the decision; therefore, the restriction of the appeal’s request—stating that the names of the companies and the amounts granted “provided that the sum of the approved aid in each category (tax deferrals, fixed-cost subsidies, and loan guarantees) exceeds an amount higher than the lowest 10% of all aid approved in the respective category” or regarding “those 10% of companies in each category (tax deferrals, fixed-cost subsidies, and loan guarantees) are among those that received the least, […],” must be disregarded, especially since this request in the complaint does not correspond to the original request for information. Furthermore, however, the Supreme Administrative Court has, in its established case law, clearly opposed a restrictive interpretation of the scope of review by the Administrative Court: Accordingly, the request for review under § 9(1)(4) of the Administrative Court Act (VwGVG) does not entail a general restriction on the scope of review by the Administrative Court. With regard to the present proceedings, the respondent authority must be upheld in that the complainant’s original request in his complaint—which was aimed at having the Federal Administrative Court (BVwG) annul the contested decision and order the respondent authority to restore a legally compliant state of affairs (provision of information), was incorrectly formulated in light of the relevant case law in VwGH, May 24, 2018, Ro 2017/07/0026. Ultimately, the complainant amended his request for relief in accordance with the case law described above, now correctly seeking a declaratory ruling from the BVwG. In light of the principles outlined above, the request for relief in the form of the (alternative) motion relating to the original request for information is, on the whole, admissible. Jurisdiction and Scope of Authority of the Respondent Authority: In the present case, the Federal Administrative Court assumes that the respondent authority has substantive jurisdiction to issue a decision as the body consulted pursuant to § 4 of the Freedom of Information Act, as well as to provide the requested information. Pursuant to Section 2(1)(2) of the Federal Ministries Act (BMG), the scope of authority of the federal ministries includes, among other things, the subject areas assigned to the individual federal ministries for administration in accordance with Part 2 of the Annex. Accordingly, the Federal Ministry of Finance (BMF) is responsible, among other things, for matters of federal finances; matters of finance, including fiscal policy; matters of economic policy, insofar as they do not fall within the jurisdiction of another federal ministry, without prejudice to the Federal Chancellery’s authority for economic coordination; and matters relating to federal assets. Pursuant to § 3b of the ABBAG Act, the BMF is required to submit to the Budget Committee, on a quarterly basis, a detailed report outlining all measures taken to preserve the solvency of enterprises and to bridge liquidity difficulties arising in connection with COVID-19. In this regard, pursuant to Section 3b(3)(5) of the ABBAG Act, COFAG is or was required to submit a monthly report to the respondent authority, which—as the respondent authority itself states in its statement of March 8, 2021— —contains, for each instrument, all data records from which the names and amounts of the applicants are also apparent. This makes it clear that, for the purpose of fulfilling this task, the respondent authority receives data from COFAG regarding subsidies for fixed costs and guarantees, has access to this data, and uses it within the scope of its authority. The respondent authority also confirmed this in its statement of March 7, 2024, by stating that it had itself—based on the reports—conducted or was conducting plausibility checks in particular. Furthermore, with regard to the liabilities assumed by aws and ÖHT in their own names and for their own account, pursuant to § 1(1) in conjunction with § 1( 2a of the Guarantee Act of 1977 and § 7(1) in conjunction with § 7(2a) of the SME Promotion Act. The Federal Government’s liability is assumed by COFAG. COFAG receives information on the financing provided by aws and ÖHT and, in turn, reports to the authority in question. The respondent authority also receives, among other things, personal and company-related data from aws and ÖHT. In addition, with regard to COVID liabilities, the Federal Ministry of Finance (BMF) is informed of every application for the assumption of the indemnification obligation and every decision made by COFAG in its capacity as agent. Insofar as the respondent authority argued in its appeal dated September 10, 2021, that disclosing the data obtained under the reporting obligation would exceed the scope of its jurisdiction, the ruling cited by the respondent authority (VwGH September 13, 2016, Ra 2015/03/0038) is not suitable for supporting its position but rather appears to contradict it: The Administrative Court (VwGH) states that the activities of companies in which the City of Vienna holds a direct or indirect stake cannot be separated from the scope of authority of the municipal government. The complainant’s request was therefore directed at obtaining information regarding an activity of the respondent authority and thus concerns a “matter within its sphere of activity” within the meaning of § 1 of the Duty to Provide Information Act (see VwGH February 27, 2013, 2009/17/0232, para. 2.3 et seq., concerning the Federal Ministry of Finance in connection with the PKG). The fact that certain data is generally generated by another ministry (granting of guarantees by aws or ÖHT) does not alter the fact that the respondent authority has access to such data and uses it within the scope of its enforcement authority. It must therefore be assumed that the subsidies in question (to the extent of the findings) fall within the scope of authority of the respondent authority. For the sake of completeness, it should be noted that the present case differs from the one underlying the decision of the Administrative Court (VwGH) dated June 28, 2021, Ro 2021/11/0005, particularly since that proceeding involved information requested in the disclosure request that was not available to the respondent authority but would have had to be obtained from another agency based on supervisory powers. In the present case, however, according to the findings, the requested information (in its entirety) is available to the respondent authority to the extent determined, and the complainant—also in light of the procedural principles of expediency, expedition, and simplicity—therefore not be required to submit a request for information to each individual agency. 3.2.2.2. On the merits: 3.2.2.2.1. Regarding official confidentiality under Art. 20, para. 3, B-VG: Pursuant to Article 20(4) of the Federal Constitutional Law (B-VG), all bodies entrusted with the tasks of federal, state, and municipal administration, as well as the bodies of other public-law entities, must provide information regarding matters within their sphere of activity, provided that no statutory duty of confidentiality precludes this. Pursuant to Article 20(3) of the Federal Constitutional Law (B-VG), all bodies entrusted with the tasks of the federal, state, and municipal administration, as well as the bodies of other public-law entities—unless otherwise provided by law—are obligated to maintain confidentiality regarding all facts that have come to their knowledge exclusively through their official duties, the confidentiality of which is required in the interest of maintaining public order and order, and security; comprehensive national defense; foreign relations; the economic interests of a public-law entity; the preparation of a decision; or the overriding interests of the parties. For the purposes of Art. 20(3) of the Federal Constitutional Law (B-VG), “party” refers to any person who comes into contact with the authority for any reason (see VwGH 28 Jan. 2019, Ra 2017/01/0140). When assessing the party’s interest in confidentiality, a balancing of interests must be performed, namely between the interest in obtaining the information and the party’s interest in confidentiality. If the two interests are of equal weight, no obligation of confidentiality on the part of the authority precludes the disclosure of information; (only) if the party’s interest in confidentiality outweighs the other interest may the authority be prohibited from disclosing the information (see VwGH Jan. 28, 2019, Ra 2017/01/0140). Regarding official confidentiality concerning fixed-cost subsidies and the granting of guarantees: In contrast to tax deferrals, which are granted for various reasons and within the framework of a long-term “tax relationship” between the company and the tax administration based on mutual trust, COVID-19 fixed-cost subsidies and guarantees are exceptional forms of financial assistance granted in the context of a pandemic. These are awarded within the framework of private-sector administration, and there is no legal entitlement to their grant. In this respect, there is no reason to assume the existence of an overriding public interest (as is required for the maintenance of tax administration) that would preclude the disclosure of information. Furthermore, it should be noted that, with regard to the subsidies relevant here, the respondent authority, based on the EU-level standardized publications of Covid-19 subsidies—with regard to the subsidies relevant here—it has published only the fixed-cost subsidies and the guarantees granted, and has not classified tax deferrals as aid within the meaning of the aforementioned regulation. This, too, supports the justified distinction between tax deferrals and other COVID-19 subsidies. Furthermore, the respondent authority did not invoke grounds of official confidentiality with respect to fixed-cost subsidies and the granting of guarantees. To the extent that a balancing of the parties’ interests might be relevant, reference is made to the following remarks. 3.2.2.2.2. On the balancing of interests between the fundamental right to freedom of expression/access to information and the right to respect for family and private life: In its decision dated May 29, 2018 (VwGH 2017/03/0083), the Administrative Court (VwGH) states that, according to the case law of the European Court of Human Rights (ECHR), Article 10(1) of the European Convention on Human Rights (ECHR) is to be interpreted as including—subject to certain additional conditions—a right of access to information (see, in this regard and for what follows, ECHR [Grand Chamber] November 8, 2016, Magyar Helsinki Bizottsag, 18030/11, in particular paras. 131 and 156 et seq.). The ECtHR has recognized such a right of access to information protected by Article 10 of the ECHR, among other things, when the person concerned has a claim to receive information under national law (as is the case in Austria with the right to information enshrined in Article 20(4) of the Federal Constitutional Law [B-VG] and to be granted by ordinary law), particularly when this right has been confirmed by a court. A right of access to information also arises when access to the information is instrumental to the exercise of the right to freedom of expression—in particular, the freedom to receive and impart information or ideas—and the denial of access constitutes an interference with that right. In such cases, the ECtHR essentially identifies the following criteria as relevant for determining the scope of the right of access to information under Article 10 of the ECHR: - the purpose and objective of the request for information (is the collection of information a relevant preparatory step for journalistic or other activities intended to create a forum for public debate or constituting an essential element of such a forum?); - the actual necessity of the request for information for the exercise of freedom of expression, - the nature of the information sought (the information, data, or documents to which access is sought must generally pass the test of whether they are in the public interest; the need for disclosure may exist if, among other things, disclosure ensures transparency regarding the manner in which public affairs are conducted and regarding matters of interest to society as a whole), - the role of the requester (as a journalist, a “social watchdog,” or a nongovernmental organization whose activities relate to matters of public interest), - and, finally, the existence of information that is readily available. The scope of the subjective right to information granted by the laws on the duty to provide information based on Art. 20(4) of the Federal Constitutional Law (B-VG) is —as is the scope of the provisions that may restrict this right, concerning the permissible refusal to provide information on grounds of confidentiality, significant interference with the performance of other duties, and the frivolous nature of a request for information— – must be interpreted in accordance with the Constitution, based on the constitutionally equivalent provision of Article 10 of the ECHR and in light of the relevant case law of the European Court of Human Rights. In the context relevant here, therefore, with regard to the question of whether statutory confidentiality obligations preclude the disclosure of the requested information, a balancing test must be conducted taking Article 10 of the ECHR into account. As part of this balancing test, it must be examined, among other things, whether any statutory confidentiality obligations comply with the substantive legal requirement of Article 10(2) of the ECHR, that is, whether they pursue a legitimate purpose within the meaning of this provision, are necessary in a democratic society, and are ultimately proportionate. In assessing the extent and manner in which information is to be provided—as is evident from the more recent case law of the ECtHR cited above—one cannot disregard whether access to the requested information is instrumental to the exercise of the right to freedom of expression, in particular the freedom to receive and impart information or ideas, which must be assessed on the basis of the criteria set forth by the ECtHR. Those provisions that, under federal and state laws governing the obligation to provide information, allow the party obligated to provide information to refuse a requested disclosure must therefore be interpreted narrowly, particularly when a request for information is to be viewed as a relevant preparatory step for journalistic or other activities intended to create a forum for public debate, the requested information is in the public interest, and the requester plays a “watchdog” role within the meaning of the ECtHR’s case law (see VwGH May 29, 2018, Ra 2017/03/0083; see also VwGH 13.9.2016, Ra 2015/03/0038 and VwGH 26.03.2021, Ra 2019/03/0128). The Constitutional Court (VfGH) also states in its decision VfGH March 4, 2021, E 4037/2020, on the balancing of the right to freedom of expression and access to information against the right to respect for family and private life: “2. Under Article 10(1) of the ECHR, everyone has the right to freedom of expression. The scope of protection under this provision—which includes the right to freedom of opinion and the freedom to receive and impart information and ideas without interference by public authorities—covers not only the mere expression of opinions but also statements of fact, as well as advertising measures (Const. Ct. Decisions 14.218/1995, 17.568/2005, 20.014/2015, and 20.340/2019). 2.1 In its previous case law (see, e.g., VfSlg 11.297/1987, 12.104/1989, 12.838/1991, 19,571/2011), also citing the earlier case law of the European Court of Human Rights (see ECtHR, Feb. 19, 1998, Guerra case, Application No. 14,967/89, Human Rights Newsletter 1998, 59), that Article 10(1) of the ECHR does not, however, impose an obligation on the state to guarantee access to information or to provide information itself. The Constitutional Court most recently affirmed this in Constitutional Court Case No. 19.571/2011. In the case underlying this decision, however, the European Court of Human Rights recognized the existence of a right of access to information and, consequently, a violation of Article 10(1) of the ECHR (see ECtHR, November 28, 2013, Case of the Austrian Association for the Preservation, Strengthening, and Creation of Economically Sound Agricultural and Forestry Landholdings, Appl 39.534/07, Human Rights Newsletter 2013, 433). 2.2 In its decision of November 8, 2016 (GK), Case of Magyar Helsinki Bizottság, Application No. 18.030/11, Human Rights Newsletter 2016, 536, the European Court of Human Rights summarized its previous case law to the effect that Article 10(1) of the ECHR also guarantees a right of access to information under certain conditions (see most recently also ECtHR, October 8, 2019, Szurovecz case, Application No. 15.428/16, Human Rights Newsletter 2019, 423). On the one hand, this is the case when the disclosure of the information has been ordered by a court in a final and binding decision. On the other hand, such a right exists when access to information is essential for the exercise of freedom of expression, in particular the freedom to receive and impart information. Of particular importance to the existence and scope of this right is whether the collection of information is a relevant preparatory step for journalistic or other activities, whether the disclosure of the requested information may be necessary in the public interest—in particular because it promotes transparency regarding the manner in which public affairs are conducted and regarding matters that are of interest to society as a whole—whether the holder of the fundamental right is acting in the public interest as a journalist, a nongovernmental organization, or in another capacity as a “public watchdog,” and, finally, whether the requested information is readily available and thus no further data collection is necessary (see ECtHR, Magyar Helsinki Bizottság case, para. Z149 et seq.). 2.3 It follows that Article 10(1) of the ECHR does not, in fact, establish a general obligation on the part of the State to provide information or grant access to information. However, a right of access to information may exist (in this respect deviating from Decision 19.571/2011) on a case-by-case basis in accordance with the criteria set forth above (see section 2.2.).” Based on the complainant’s statements regarding his function and role, it can be assumed that he meets the above-mentioned criteria. This was also not disputed by the respondent authority. There is undoubtedly a substantial public interest in the proper use of public funds that were allocated as “COVID-19 subsidies,” especially since taxpayer money was used on a large scale (cf. the repeated statements at the political level that “whatever the cost”) to support businesses, and the complainant’s request for information is also suitable for contributing to the formation of public opinion based on journalistic research and publications derived therefrom. Even if the data and information requested by the complainant are in any case subject to a (partial) obligation to publish under the TAM or are disclosed in the budget report or the Court of Auditors’ report, it should be noted that the Freedom of Information Act does not provide for a corresponding restriction of access to data that is required to be published. Moreover, at the time of the decision, the data had not yet been published by the respondent authority. Nor may the respondent authority refuse to provide the information (merely) because other sources of information are available to the complainant, especially since, in the present case, there are no specific disclosure obligations under other federal laws within the meaning of Section 6 of the Freedom of Information Act. Furthermore, the complainant’s request for information also includes information which are not subject to a publication requirement at the level of detail requested by the complainant and which, at most, amount to less than 100,000 EUR. Even the Court of Auditors’ report cited by the respondent authority contains (merely) an overview of the individual aid measures, their legal bases, the respective administering agencies, the total volume of allocations, the amount of disbursements, and general information about the category of recipients, but no names or company names of specific recipients. Furthermore, the aforementioned report was not published until June 25, 2021—that is, after the complainant had filed the request for information and after the respondent authority had issued its decision. On the other hand, the request for information at issue concerns—insofar as the data is not already required by law to be published (for example, in deviation from the Constitutional Court ruling of March 4, 2021, E-4037/2020 — does not concern former “public figures” such as members of parliament who were still receiving continued salary payments in connection with their former term of office, but rather private companies in need of support due to the pandemic. Based on the various interests at stake, the Federal Administrative Court (BVwG) must assess the extent to which data protection provisions conflict with the complainant’s interest in obtaining information and—insofar as different interests must be weighed against one another in this case—make that determination. On the Fundamental Right to Data Protection: The core of the fundamental right to data protection under Section 1(1) of the Data Protection Act (DSG) is respect for the data subject’s legitimate interests in confidentiality. Holders of this fundamental right may be either natural persons or legal entities. The purpose of data protection law is to ensure legal protection for the natural or legal person, or group of persons, whose data is being used. The DSG is focused solely on the protection of data subjects. The right to confidentiality of personal data is understood to mean the protection of data subjects against the disclosure of their data and against its transfer (see Thiele/Wagner, DSG, 2020, K9, K12 regarding Section 1). An infringement of the right to confidentiality may only occur to safeguard overriding legitimate interests of others (balancing of interests) and only on the basis of laws that are necessary for reasons set forth in Article 8(2) of the ECHR; it must be carried out only in the least intrusive manner necessary to achieve the objective, and must comply with the requirement of specificity (see Thiele/Wagner, DSG, 2020, K9, K51 on § 1). In the present context, the data in question is personal data processed by a government agency (the Federal Ministry of Finance). The Constitutional Court states the following regarding the question of whether the Duty to Provide Information Act (AuskunftspflichtG) constitutes a sufficiently precise legal basis for an interference with the fundamental right to data protection: “3.2. A statutory restriction on these fundamental rights must, in accordance with the respective legal reservation (see, regarding freedom of expression, e.g., VfSlg 12.886/1991, 17.960/2006 and 20.014/2015, and regarding data protection, see, e.g., Constitutional Court Decisions 17.940/2006, 19.892/2014, and 20.359/2019) is only permissible if it is necessary for one of the reasons specified in Article 10(2) of the ECHR or § 1(2) of the Data Protection Act (DSG) in conjunction with Article 8(2) of the ECHR. The aforementioned interference with the fundamental right to freedom of expression and with the right to data protection under Section 1(1) of the Right to Information Act serves, in each case, the “protection of the rights of others” within the meaning of Article 10(2) of the ECHR and § 1(2) of the DSG in conjunction with Article 8(2) of the ECHR, namely the respective opposing fundamental right. The interference thus pursues a legitimate aim in any case. 3.3 With regard to § 1(2) of the Data Protection Act (DSG), the legal basis must also be sufficiently precise (see, e.g., Constitutional Court Decisions 18.643/2008, 19.886/2014, 20.359/2019). This requirement is met by § 1(1) of the Right to Information Act—contrary to the view expressed in the counter-submission by the President of the National Council —is already fulfilled in the present case simply because this provision facilitates the required balancing of interests between the fundamental right to information within the meaning of Article 10(1) of the ECHR and the right to data protection, thereby ensuring an appropriate balance (see VfSlg 18.018/2006, 20.014/2015) between these two fundamental rights. For the latter reason, the provision also proves to be proportionate.” (Constitutional Court, March 4, 2021, E-4037/2020).” Regarding the GDPR: With regard to the question of whether this case law is transferable to the new or supplementary legal situation based on the (European, and thus taking precedence) GDPR, it must first be noted that the GDPR (merely) provides for the protection of natural persons’ personal data. Insofar as natural persons act as sole proprietors, their business data, for example, falls within the scope of the GDPR. Although the GDPR does not provide for corresponding protection of personal data of legal entities, information that is formally related to a legal entity may still be regarded as personal data of a natural person—for example, when the information indirectly relates to a person, as may be the case, for example, with corporations having only one shareholder (see Klabunde in Ehmann/Selmayr, General Data Protection Regulation 2, K14 on Art. 4; and regarding the latter statement with reference to Arts. 7 and 8 of the GRC: ECJ, Schecke and Eifert, para. 53 [cited above in the procedural history]). Data that allows inferences to be drawn about a person’s financial situation and assets—particularly when linked to other identifying characteristics, such as names—must (in this case as well) be regarded as personal data (see Art. 4(1) GDPR; Klabunde in Ehmann/Selmayr, General Data Protection Regulation 2, Note 14 on Art. 15; Karg in Simitis/Hornung/Spiecker (eds.), Data Protection Law, Art. 4(1), Notes 49 et seq.). Accordingly, the substantive applicability of the GDPR to parts of the present case—which concerns the names and grant amounts of companies—cannot be ruled out, especially since individuals and companies may also be affected in the present case. However, the GDPR itself notes in Recital 4 that the protection of personal data is not an absolute right, but must be balanced against other fundamental rights in light of its societal function and in accordance with the principle of proportionality. The Regulation is consistent with all fundamental rights and respects all freedoms and principles recognized by the Charter of Fundamental Rights of the European Union (Charter), in particular the freedom of expression and the freedom of information as set forth in Article 11 of the Charter. Article 52(3) of the GRC provides for the possibility of relying on case law relating to the ECHR to interpret the GRC. Accordingly, the aforementioned principles must, in principle, be regarded as applicable to the new legal situation in the context of a proportionality assessment. Consequently, a balancing test must be conducted between the right to data protection and the right to freedom of expression and access to information. Furthermore, it must be examined whether, in the given context, there are additional provisions authorizing interference that require the disclosure of the data in question. Regarding the complainant’s role and interest: The fact that the complainant, as a journalist, works at XXXX in the XXXX department and thus fulfills the social role of a “public watchdog” within the meaning of the case law of the European Court of Human Rights (ECHR) and the Austrian Administrative Court (VwGH) on issues of freedom of expression and information is not in dispute and forms the basis for the following balancing of interests. Nor is it disputed that the COVID-19 pandemic—or rather, the measures implemented to contain it—caused the sharpest downturn in the global economy since the 1930s. The domestic economy, too, contracted on a historic scale in the first half of 2020. Among the various economic support measures conceived and implemented in this situation—in addition to the tax deferrals mentioned above—are fixed-cost subsidies and guarantees for businesses affected by pandemic-related restrictions on economic activity. The complainant is correct in arguing that the pandemic-induced situation, with its effects on the economy and the labor market, was an extraordinary, “historic” one, to which the short-term, rapid disbursement of very large sums from public funds was linked as an economic policy measure. It must be acknowledged that there is (still) a significant public interest in a public debate regarding the nature and amount of the support provided, and consequently in societal oversight of the use of funds to protect against misuse in this extraordinary situation. The interest in information—cited here as a criterion—for sparking public discourse is not to be equated with an inherent, preemptive accusation of misuse of funds. On the contrary, it represents, first and foremost, a form of citizen participation in democratic decision-making processes. In this light, the requested information is in any case suitable for contributing to transparency regarding the manner in which public affairs are conducted (“the manner to conduct public affairs,” ECtHR [Grand Chamber] Nov. 8, 2016, Magyar Helsinki Bizottsag, 18030/11, para. 161 (see again VwGH May 29, 2018, Ra 2017/03/0083). With regard to the requested information, it should be noted that this information is, in principle, held by the respondent authority and was or is available to the extent determined. Thus, four of the above-mentioned criteria for determining the scope of the right of access must be considered fulfilled, namely: the purpose and objective of the request for information as a preparatory step for journalistic activities aimed at creating a forum for a necessary and significant public debate; the role of the applicant as a journalist and thus as a public watchdog; the nature of the requested information as being of significant public interest and intended to ensure transparency regarding the handling of substantial public funds through its disclosure, as well as the existence of the available information. Regarding the companies’ data protection interests: The public interest in a broad discourse on the awarding and administration of COVID-19 subsidies to companies, as well as the complainant’s essential role in this process and the undisputedly relevant and available information, is counterbalanced by the interests and rights of subsidy recipients to the confidentiality of their personal data: Regarding the parties’ arguments in detail: ECJ case law and the (agricultural) transparency database: In its argumentation, the defendant authority relies on the ECJ ruling in Schecke and Eifert—already cited above (in the procedural history)—regarding the publication of data on recipients and the exact amounts provided for in Article 44a of Regulation (EC) No. 1290/2005 [on the financing of the Common Agricultural Policy], which provides for the publication of data on recipients and the exact amounts each receives from the EAGF [European Agricultural Guarantee Fund] and the EAFRD [European Agricultural Fund for Rural Development], states that the EU legislature should originally have ensured that this obligation did not go beyond what is necessary to achieve the legitimate objectives pursued (see para. 79). However, the Council and the Commission did not conduct such a proportionality assessment or an assessment of necessity, and the legislature did not consider less intrusive forms of publication, namely limited publication by name. The ECJ further clarified that the objective of transparency cannot automatically be given priority over the right to the protection of personal data (see para. 85). The Commission subsequently organized a consultation in 2011 with representatives of agricultural and trade associations, the food industry, workers, civil society, and the EU institutions, during which options for the publication of data were examined (see Recitals 72 et seq. of Regulation (EU) No. 1306/2013 [on the financing, management, and control system of the Common Agricultural Policy]). The introduction of a lower threshold below which the name of a beneficiary is not disclosed is intended to balance the need for oversight regarding the amount of aid, on the one hand, with the need to limit interference with the rights of beneficiaries, on the other (see Recital 82 of the cited Regulation). To comply with data protection requirements, recipients of funding are to be informed of the publication of their data prior to its publication and of the purposes of the processing (see Recital 86 of the cited Regulation). The current publication rule is set forth in Art. 111 et seq. of the cited legislation and provides for the annual, retrospective publication of the fund’s beneficiaries, specifically the first and last names of natural persons or the registered name of the legal entity or association, the municipality of residence or registered office, and the amounts of payments made during the relevant fiscal year; this information is to remain accessible on a dedicated website for two years. Excluded are the names of beneficiaries who receive €1,250 or less (or the amount set by the Member State with regard to the small producers’ scheme) in aid in a given year. Pursuant to Art. 113 of the aforementioned regulation, Member States shall inform beneficiaries of the publication of their data and the purpose of its processing. In Austria, the database implementing these regulations can be found at www.transparenzdatenbank.at. From these remarks, it can be concluded that the publication of aid recipients (in principle) strengthens public oversight of how the disbursed funds are used and thus contributes to the appropriate use of public funds by the administration. Furthermore, the principle of transparency, enshrined in Articles 1 and 10 of the TEU and Article 15 of the TFEU, enables greater citizen participation in the decision-making process and ensures greater legitimacy, efficiency, and accountability of the administration within a democratic system (see Schecke and Eifert, para. 68 et seq.). The recitals of Regulation [EU] No. 1306/2013 also refer to the intended goal of strengthening public oversight of the use of funds (Recitals 73 et seq., arg. Recital 84: “Making this information available to the public, together with the general information provided for in this Regulation, increases transparency regarding the use of Union funds under the Common Agricultural Policy and thus improves the public perception and acceptance of this policy. This enables greater citizen participation in the decision-making process and ensures greater legitimacy, efficiency, and administrative accountability toward citizens.” On the other hand, the requirements for transparency and oversight of grant management contained in the underlying European legal texts do not take absolute precedence over data protection interests; but rather, the EU legislature was required to take into account the interests of funding recipients in the protection of their personal data when designing a disclosure obligation intended to promote transparency, and to consider the necessity of such a measure in the context of achieving the intended purpose. Thus, not every measure aimed at transparency is justified, but only those that are necessary to achieve the purpose (oversight, public participation, prevention of abuse). The current legal situation under Regulation (EU) No. 1306/2013 implements this balancing of interests by exempting small grant recipients up to a certain threshold, whose names must be anonymized for publication. The principles and findings from the European legal framework regarding the CAP discussed above are therefore not readily transferable to the facts of the case at hand: For the publications of recipients of agricultural subsidies just described, unlike the national legal situation prevailing at the time of the defendant authority’s decision regarding the COVID-19 subsidies at issue in this proceeding, there was a legal basis in the EU Regulation itself, and, furthermore, the recipients of agricultural subsidies were and are required to be informed of any publication (see Recital 86 and Art. 113 of Regulation (EU) No. 1306/2013). Furthermore, it should be noted that the issue at hand is not the publication of recipients of COVID-19 economic subsidies in a publicly accessible database. Competitive Disadvantage: The authority in question further argues that the publication of the subsidies could entail a competitive disadvantage for the affected parties in relation to their competitors: In any case, a competitive disadvantage for the affected parties would arise if competitors or business partners were to exploit knowledge of necessary payment relief to the detriment of the affected parties—for example, by imposing higher contractual insurance premiums on them or by refraining from entering into future contracts from the outset. It is also conceivable that the creditworthiness ratings of the affected parties could deteriorate, thereby making future financing more expensive. Furthermore, the respondent authority argues that, since the fundamental right to data protection must be safeguarded in every individual case, even if it had concluded—based on a general assessment—that the interest in disclosure generally prevails, it would still have had to examine each individual case because it cannot be ruled out a priori that, due to special circumstances in a specific case, there is no overriding interest in disclosure. Given the volume of data requested, this case-by-case review would have been simply impossible; in any event, it would have significantly impeded the performance of the administration’s other duties, so that, pursuant to Section 1(2) of the Duty to Provide Information Act, there was no obligation to provide information. Had the respondent authority disclosed the requested information regarding personal data without sufficiently weighing the interests involved on a case-by-case basis, it would have faced far-reaching consequences and, in particular, would have been obligated to compensate the affected companies for damages pursuant to § 29(1) of the Data Protection Act (DSG). The complainant counters these arguments by stating that, given the large number of companies that had applied for the subsidies in question, it cannot be said that the publication of the company names could cause a competitive disadvantage vis-à-vis other market participants. If most or all companies in an industry were to receive subsidies, no harm to an individual company could be inferred from this. Furthermore, the request does not concern trade or business secrets in the strict sense, and the financial performance and creditworthiness of Austrian companies are generally well documented, for example by creditor protection associations. There is no doubt that information regarding the receipt and amount of a COVID-19 subsidy is capable of indirectly revealing a company’s economic situation. However, this information does not constitute a trade or business secret in the strict sense. Regarding the arguments of the respondent authority, reference must first be made to the ruling of the Administrative Court (VwGH) dated May 29, 2018, Ra 2017/03/0083, according to which “the mere presumption that the information sought in the request for disclosure might also contain data that may not be disclosed due to statutory confidentiality obligations is not sufficient to justify a refusal to provide information,” “since what matters is the actual existence of such grounds, which the authority—or, in appeal proceedings, the Administrative Court—must determine.” However, no specific findings were made regarding the existence of competitive disadvantages. As for the merits of the case, the following should be considered: First, it should be noted that, depending on the type and size of the business, companies are already required to regularly publish their own financial data (total assets, revenue, number of employees), from which indications of the companies’ economic situation can generally be derived (e.g., corporations; see § 277 et seq. of the Austrian Commercial Code (UGB)). It is true that access to financial data can also be obtained through credit reports provided by credit bureaus; a sample request at XXXX lists the following categories of information accessible in this manner: a “Compliance Check” with XXXX rating, probability of default, maximum individual credit limit, payment method, payment history, risk assessment, Web Risk Indicator, a note on the financial situation, an industry-comparative assessment, a note on the industry, key personnel, division managers, collection cases, key figures, general company information, locations, ownership structure, balance sheet, income statement, balance sheet ratios, land registry, and historical development (see sample request for inquiry category XXXX, accessed on March 11, 2024). However, it should be noted here that this data is not “published,” but is only disclosed for a fee and upon demonstration of a legitimate interest by the requester (see also the remarks below regarding the outcome of the data protection considerations). In any case, it cannot be ruled out that the processing of the company name and the amount of aid—which is relevant under data protection law—for companies operating in industries not significantly affected by the economic situation, and for which information about their own economic situation is available only to a limited extent or not at all through other publications or services, may allow competitors to draw conclusions about the company’s economic situation. However, it must also be taken into account that the purpose of the request for information at hand is to provide a journalist with the names of companies and the amounts of aid, rather than a general publication of the information accessible to the general public. In his statement dated December 1, 2020, the complainant argues that, in the course of his work and that of his employer, he is bound by legal provisions designed to protect individuals affected by media coverage, namely §§ 6 et seq. of the Media Act (protection of personality rights and grounds for compensation), § 1330 of the Austrian Civil Code (ABGB) (defamation), and § 78 of the Austrian Copyright Act (UrhG) (protection of likeness) XXXX. Furthermore, the complainant is himself bound by data protection provisions when handling the requested data, which means that, should he publish company names and funding amounts, he is subject to corresponding duties of protection and requirements to weigh the interests involved (regarding media privilege, see section 3.2.2.2.3.). However, the complainant has not ruled out the possibility of also publishing the data of individual companies as a result of his research. In summary, when considering whether responding to the request for information would entail a competitive disadvantage for the affected companies, it must be taken into account that in industries that were severely impacted by the economic effects of the pandemic, negative effects among competitors were already limited in any case. Furthermore, companies of certain legal forms and sizes are legally required to publish data on their financial performance, and information regarding a company’s creditworthiness is available through service providers—albeit for a fee and upon demonstration of a legitimate interest. Moreover, the complainant, as the recipient of the requested data, is also bound by legal frameworks—not least those pertaining to data protection—and the disclosure of the data to the complainant does not constitute general publication, which reduces the possibility of competitive disadvantages among competing companies. However, these considerations do not necessarily lead to the conclusion that all types of companies must be subject to the same disclosure requirements, as different structures and disclosure obligations result in varying degrees of weight given to the legitimate interest in confidentiality (see below for the outcome of the data protection considerations). Regarding the scope of the request: In this context, questions arise as to whether the disclosure of company names in connection with the amounts of state aid is actually necessary, as well as regarding the breadth of the request, which is directed at “all” companies. It is understandable that the complainant considers it desirable and essential to have as broad and complete a set of data as possible in order to identify connections, gain an overview of the overall conduct, and formulate questions to be pursued further. The smaller and more selective a set of data records would be, the less effectively the complainant could fulfill its role as a “public watchdog.” On the other hand, consideration must also be given to the principle of necessity regarding interference with the rights of third parties in connection with violations of their data protection interests, as reflected in the ECJ judgment in Schecke and Eifert as well as in those of the Austrian supreme courts (see, among others, as above, Case No. 18975/2009): As the complainant has repeatedly stated, his concern—in his role as a journalist and in the context of the exceptional situation caused by the pandemic and the rapid disbursement of substantial subsidies—is the ability to scrutinize public financial management. Theoretically, one could specify investigative interests that relate, for example, to certain sectors or industries, or to specific criteria regarding companies receiving subsidies (legal form, revenue, number of employees), or even to a specific suspicion from which a question or request for information could be formulated. These more specific requests for information, journalistic questions, and investigative interests would still be linked to a monitoring function regarding the specific data requested and to a correspondingly defined public discourse on financial management—albeit not as comprehensive as in the context of the now-modified request for information. However, this approach would preclude the—understandably desirable—possibility of obtaining a comprehensive overview of the financial management and thus being able to identify structural patterns. Thus, the complainant’s now-defined—broad – research interest of the complainant is aimed at obtaining, through access to the data, as complete an overview as possible of financial management in connection with the COVID-19 subsidies and—based on this overview—formulating and pursuing more specific research questions grounded in an interest in oversight. In this context, the aforementioned interest in oversight is to be regarded as one that, alongside the oversight interests of administrative bodies such as the Court of Auditors, is of great significance in terms of the existence and functioning of democracy (see, for further details on the significance of the “public watchdog” and related references: ECtHR [Grand Chamber] Nov. 8, 2016, Magyar Helsinki Bizottsag, 18030/11, in particular para. 166 et seq.). In this light, it must therefore also be assumed that the requirement to disclose the names of the companies and the amounts of aid granted in each case is necessary for the pursuit of the investigative interest and thus also fulfills the fifth criterion set forth by the ECtHR regarding the necessity of the request for information. Conclusion regarding data protection considerations: Regarding the data to be reported to the TAM: As the respondent authority explained, only fixed-cost grants and guarantees granted are subject to reporting to the TAM. Regarding the “Transparency Award Module,” the respondent authority stated that, pursuant to Art. 9 of Regulation (EU) No. 651/2014 (“AGVO”), Member States must ensure that information on individual aid grants exceeding 500,000 EUR is published. Pursuant to Article 9(4) of the AGVO, the information must be structured and made available in a standardized format and be accessible via efficient search and download functions. For measures granted on the basis of the Commission Communication “Temporary Framework for State Aid to Support the Economy in Light of the Current COVID-19 Outbreak,” 2020/C 91 I/01, there are supplementary publication requirements pursuant to Recital 34: Member States must publish all relevant information in accordance with Annex III of the AGVO for each individual aid measure granted on the basis of this Communication within 12 months of the date of its grant on the website provided by the European Commission, the Transparency Award Module (“TAM”). The Commission continuously assesses whether adjustments to the Temporary Framework are necessary, which is why the 5th amendment to the Temporary Framework is currently in effect (2021/C 34/06). This fifth amendment also includes adjustments to the publication requirement under Recital 88: The publication requirement in TAM has been extended to individual aid grants exceeding EUR 100,000 or, in the agricultural sector, exceeding EUR 10,000. Even though the defendant authority now argues that it does not report the data to the TAM itself, it should be noted that—as already explained in the assessment of the evidence—this does not mean that the data to be reported is (entirely) unavailable to it. Thus, there is a duty to publish based on Union law, which constitutes a permissible statutory restriction on the right to confidentiality as set forth in § 1 DSG, but also in accordance with Art. 6 GDPR. Since the data to be published was, in any event, already available to the respondent authority to the extent determined at the time the request for information was filed (at least to the extent that had accrued up to that point) and, due to the already established obligation to publish, did not warrant protection, it was to be assumed here that the complainant’s interest in disclosure clearly outweighed other interests, and the data in question should have been made available to the complainant. The fact that the publication of the data (which had been announced for fall 2020) did not actually take place until May 2021 does not alter the fact that this data—which was required to be published pursuant to a legitimate regulatory provision, namely an obligation under Union law—had to be disclosed to the complainant and remains subject to disclosure. Therefore, the complainant’s complaint on this point had to be upheld. Regarding the fixed-cost subsidies and guarantees not published in the TAM: Regarding the data protection interests of individuals: Although the complainant asserted during the oral hearing that he was not interested in “small fry” or sole proprietorships, he did not explicitly exclude them from his request for information. In this regard, it should first be noted that the BVwG, in its decision Ref. No. W214 2235505-1/27E, granted the complaint within the scope of the ruling cited in section 2.21, and the dismissal of the complaint (which also concerned the disclosure of personal data of natural persons/sole proprietorships) remained uncontested. However, the fundamental legal situation regarding the transmission of the data at issue in the proceedings is set forth again below, in particular to underscore the difference from (reporting-obligated) corporations or legal entities: With regard to the publication of data concerning sole proprietorships and natural persons, since these are natural persons, the GDPR applies in addition to § 1 DSG. In this context, the respondent authority initially invoked Article 6(1)(c) and (e) of the GDPR and argued that the Act on the Duty to Provide Information does not constitute a law that complies with the requirements of this provision. In its statement dated March 8, 2021, however, the respondent authority referred to Article 6(1)(f) of the GDPR, which provides for a balancing of interests between the interests of third parties and those of the data subjects. In its appeal, the respondent authority again contested the applicability of Article 6(1)(f) of the GDPR (which, however, was not even raised in the Federal Administrative Court’s ruling at the time). In this regard, the following should be noted: Since the disclosure of information constitutes further processing of data that the respondent authority has collected in a different context and for a different purpose (namely, to grant aid in connection with the COVID-19 pandemic), Article 6(4) of the GDPR applies to transfers made under the Duty to Provide Information Act. In this context, the question arises as to whether the Obligation to Provide Information Act constitutes a “legal provision of the Union or of the Member States that, in a democratic society, constitutes a necessary and proportionate measure to protect the objectives referred to in Article 23(1).” If this were to be denied, the balancing of interests prescribed in Article 6(4)—based on the criteria listed therein—would apply, which would in any case favor the (natural) person, since the disclosure of information would not serve a “compatible” purpose related to the original purpose of the processing, and the balancing of interests based on the other criteria would also favor the data subject (since, in the present case, there would be no suitable safeguards such as encryption, nor would there be any interaction between the data subjects and the complainant). This, however, would render the disclosure of information regarding natural persons under the Duty to Provide Information Act entirely impossible. The Law on the Obligation to Provide Information is therefore (even though it does not meet the requirements of Art. 23(2) of the GDPR—which, however, does not automatically render this law void merely due to the vague wording of Art. 23(2) [“in particular”]), must be regarded as an intervention law within the meaning of Article 23(1)(i) of the GDPR (to ensure the protection of the rights and freedoms of others). In this case, a balancing test pursuant to § 1 of the Right to Information Act would again have to be conducted. However, for the reasons stated above regarding the balancing test under § 1(2) of the Data Protection Act, this also leads to the conclusion that, in any event, the data subjects’ interest in confidentiality outweighs the complainant’s interest in obtaining information. The argument that a law intended to safeguard the “rights and freedoms of other persons”—which includes the right to freedom of expression and information—does not pursue a legitimate aim (as asserted by the respondent authority) cannot be accepted by the Federal Administrative Court. However, the Law on the Duty to Provide Information would also be a lawful regulatory measure on the basis of Art. 6(1)(c) and (e) of the GDPR, especially since the requirements for a corresponding domestic law must not be unduly stringent (see, in this regard, Constitutional Court decision of March 4, 2021, E4037/2020 and VwGH, Dec. 21, 2023, Ro 2021/04/0010, para. 55 et seq.). Pursuant to Art. 6(1)(c) of the GDPR, processing is permitted if it serves to fulfill a legal obligation. One example of such an obligation is the duty to provide information under the (German, note) Freedom of Information Act (IFG) (Paal/Pauly, GDPR BDSG3 GDPR Art. 6 para. 1, para. 18). This law—similar in its fundamental intent to the Freedom of Information Act—establishes a right of access to official information held by public authorities that is, in and of itself, unconditional but is also delimited against other fundamental rights and thus may be limited in substance. The Duty to Provide Information Act also corresponds to Art. 85 of the GDPR (Processing and Freedom of Expression and Freedom of Information) and, through the balancing test it provides for, reconciles the two fundamental rights (the fundamental right to data protection and the right to freedom of information, which is encompassed by the fundamental right to freedom of expression). Thus, there is in any case an appropriate legal basis for the general (further) processing of personal data. With regard to the publication of data pertaining to sole proprietorships or individuals, it must be taken into account, in particular, that the publication of funding data concerning them may also provide insight into the financial assets of these (natural) persons, and that this constitutes a more significant infringement of the fundamental right to data protection than allowing inferences to be drawn about the financial assets of a legal entity. Consequently, in this case, a balancing of interests pursuant to § 1(2) of the Data Protection Act (DSG) favors the sole proprietors. However, as mentioned, the Law on the Duty to Provide Information is based on a balancing of the fundamental rights to data protection and to information. As described, this balancing favors the data protection of natural persons, provided that there is no statutory obligation to publish such information. This is not altered by the fact that the legislature has since decided that certain COVID-19 aid data may also be published for sole proprietorships if the annual amount exceeds 10,000 EUR. The statutory provision in question was not yet in force at the time the defendant authority rendered its decision and was not even available as a draft (rather, it is Initiative Motion No. 2734/A, XXVII. GP, introduced on July 8, 2022), so that sole proprietorships—which were not subject to any obligation to disclose their financial situation—could in no way have foreseen that data concerning them regarding COVID-19 subsidies would be disclosed to third parties and, in some cases, even published. Apart from that, at the time the defendant authority made its decision, sole proprietorships were more likely to face a competitive disadvantage than would be the case with a subsequent publication made after a corresponding period of time had elapsed. Therefore, the authority in question was not obligated to disclose information regarding sole proprietorships or natural persons and the amounts of COVID-19 subsidies they received (unless the sole proprietorships in question are those whose data is published in the TAM). Regarding the data protection interests of legal entities and partnerships: As explained above, the fundamental right to data protection enshrined in § 1 of the Data Protection Act (DSG)—in contrast to regulations in other European countries—also applies to legal entities and partnerships. If the authority in question addresses any competitive disadvantages faced by companies, the following should be noted: It is understandable that the complainant—and, to the extent that the complainant subsequently publishes the companies’ data, the public as well—would become aware of the amount of subsidies received by certain companies and, as a result, gain insight into the company’s assets and creditworthiness. However, it can be ruled out that this would entail a significant competitive disadvantage for those companies that are already subject to extensive disclosure requirements regarding their financial situation. This is the case for corporations that are subject to the disclosure requirements under the provisions of Sections 277 et seq. of the Austrian Commercial Code (UGB). Even if the disclosure requirement primarily serves the interests of creditors and the specific subsidy amounts are not to be disclosed individually in these publications, the general financial situation of the aforementioned companies is and is therefore suitable for distinguishing this matter from the balancing of interests under data protection law. Against this background, companies subject to these disclosure obligations cannot have a legitimate expectation that their receipt of subsidies will be kept confidential, especially since, according to the case law of the ECJ, a violation of the right to protection of personal data carries a different weight for legal entities than for natural persons, and legal entities are already subject to an expanded obligation to disclose their data in this regard (ECJ Nov. 9, 2010, C-92/09; C-93/09). Insofar as the respondent authority argues in its appeal that the Administrative Court (BVwG) should have distinguished between small and micro-enterprises and other enterprises among those subject to disclosure requirements, the following should be noted: Although small and micro-enterprises within the meaning of §§ 278 et seq. are subject to exemptions regarding disclosure obligations, these (solely) to reduce the administrative burden on these companies and are not intended to reduce the transparency of the companies’ financial situation or to compensate for any competitive disadvantage; thus, in the present case, exempting the respondent authority from its obligation to provide information regarding these companies does not appear appropriate (see also Directive 2012/6/EU amending Council Directive 78/660/EEC on the annual financial statements of companies of certain legal forms with regard to micro-enterprises). As regards the balancing of interests between natural persons and legal entities, the ECJ in Case C-92/09 — Schecke and Eifert—that the disclosure requirements at issue in that case would constitute a disproportionate interference with regard to natural persons; however, it held the following with respect to legal entities: “Finally, as regards legal entities that are recipients of EAGF and EAFRD funds, insofar as they may rely on the rights recognized by Articles 7 and 8 of the Charter (see paragraph 53 of this judgment), it must be assumed that the publication obligation arising from the provisions of Union law, the validity of which is being questioned, does not exceed the limits set by the principle of proportionality. Indeed, the infringement of the right to the protection of personal data carries a different weight in the case of legal entities than in the case of natural persons. Legal entities are already subject to an extended obligation to publish their data in this regard. Furthermore, the obligation on the competent national authorities to verify, prior to the publication of the data in question, whether the name of each legal entity that is a recipient of EAGF and EAFRD funds identifies natural persons would impose a disproportionate administrative burden on those authorities.” (Case C-92/09, para. 87). Consequently, the data at issue in this case—relating to legal entities (corporations) whose names may allow the identification of a natural person—may also be disclosed to the complainant, particularly since, on the one hand, they are subject to an obligation to disclose information regarding their financial situation, and, second, because—in accordance with the case law of the European Court of Justice—further differentiation among the companies subject to the publication requirement would impose a disproportionate administrative burden on the authority in question. In this context, however, it should be noted once again that the case at hand does not concern the publication of the requested data in a comprehensive database, but rather the provision of data for journalistic purposes, whereby the names and subsidy amounts of companies of particular public interest may also be published. With regard to companies subject to disclosure requirements under §§ 277 et seq. of the Austrian Commercial Code (UGB), for the reasons stated above, the complainant’s right to receive information is at least equivalent to the companies’ right to confidentiality; therefore, the information must be provided (see VwGH, January 28, 2019, Ra 2017/01/0140). For the sake of completeness, it should be noted that the complainant’s argument that information on the creditworthiness of companies can be obtained through credit reporting agencies is true insofar as certain creditworthiness information can be obtained from them; however, the disclosure of this data is subject to a legitimate interest. Nevertheless, access to this data is relatively easy to obtain. In its decision 6Ob156/09y dated November 12, 2009, the Supreme Court, referring to its decision 6Ob195/08g dated October 1, 2008, stated: “In this decision, the Supreme Court upheld the appellate court’s legal opinion that the defendant’s database constitutes a publicly accessible database, because it was made available to a group of persons not predetermined from the outset and not limited to a specific external circle, and access to the file depended solely on the client’s determination of the inquirer’s sufficient ‘legitimate interest.’” However, this decision has been criticized in some legal literature (see, for example, Leissler, “Apropos: Current Developments in Data Protection for Credit Reports,” ecolex 2009, 181; Forgó/Kastelitz, “The Right to Object Pursuant to § 28(2) DSG 2000,” jusIT 2009, 18; Jahnel, “Right to Object to Inclusion in a Credit Database,” jusIT 2008, 184 [regarding the second-instance decision upheld by the Supreme Court in 6 Ob 195/08g]), partially expressly endorsed (see Dörfler, “Data Protection: Is the Supreme Court on the Wrong Track?” ecolex 2009, 636). After weighing the various arguments, while the threshold for obtaining this data is set low, this does not mean that all data processed by credit reporting agencies regarding companies (such as sole proprietorships or companies not subject to disclosure requirements) no longer merits any protection. The complaint was therefore upheld to the extent of point A) II, as the complainant was wrongfully denied access to the names of the companies and the amounts of subsidies granted with respect to corporations subject to disclosure requirements under §§ 277 et seq. of the Austrian Commercial Code (UGB). Regarding the scope of the information provided and the “significant impairment of other tasks”: Insofar as the respondent authority argues that it does not have access to all data pertaining to aws and ÖHT that is the subject of the proceedings, it must first be noted that, based on the findings, it can be assumed that the respondent authority did in fact have access to this data as well. In this context, it should be noted that the “granted” —the release of which may have required the consent of COFAG or the respondent authority (prior to the release of the funds or guarantees) and thus ultimately also an “approval”—fall within the scope of the complainant’s request for information. Apart from that, reference should be made to the case law of the Administrative Court (VwGH), according to which a request for information must be granted, at least in part, if the requested information can be provided to that extent (see VwGH, Nov. 27, 2012, 2011/03/0093). In the present case as well, the Administrative Court held in its aforementioned decision of February 2, 2023 (para. 20), that it is incumbent upon the party obligated to provide information—in the event that a request for information is, in its view, overly broad—to comply with it only to the extent that there are no grounds justifying a refusal to provide the information. Furthermore, it follows from the case law of the European Court of Human Rights (ECHR) that (even) in cases involving data that must first be collected and processed, a blanket refusal to provide information may be disproportionate in individual cases: For example, the ECtHR’s decision of November 28, 2013, Case No. 39534/07, was based on the fact that complying with the request for information would have required significant resources, which would have jeopardized the ability of the authority obligated to provide information to fulfill its duties. The Constitutional Court noted in particular that the applicants’ request in that case had nothing to do with receiving information on one or more specific questions, but would have required the authority obligated to provide information to compile, on its own initiative, all decisions spanning several years, anonymize them, and send paper copies of these to the complainants. The ECtHR explained in this regard that, in determining that the denial of access violated Article 10 of the ECHR, it had taken into account the fact that the requested information was “available” and did not require the authority obligated to provide information to collect data. However, in assessing whether the challenged interference was “necessary” within the meaning of Article 10(2) of the ECHR, the Court must take into account all the circumstances of the case. Overall, the ECtHR found that the reasons relied upon by the authority required to provide information and the Constitutional Court to deny the applicants’ request for access to the authority’s decisions were indeed “relevant” but not sufficient. It is not the task of the European Court of Human Rights to determine exactly how the authority subject to the disclosure obligation could and should have granted the applicants access to its decisions; however, it found that a complete denial of access had been disproportionate. Nor did it emerge that providing the requested information would have substantially impaired the performance of the administration’s other duties. The Administrative Court (VwGH) also pointed out, with regard to the ground for refusing access based on a significant impairment of the administration’s other tasks, that invoking this ground generally cannot justify a blanket refusal of access —with respect to all information requested in a request for information—cannot generally be justified (see again VwGH, May 29, 2018, Ra 2017/03/0083). In this case as well, as the VwGH explained in its most recently cited decision, the requested information must be provided “to the extent that” to the extent that it does not significantly impair the performance of the remaining tasks, which may, for example, result in the provision of general information if only the disclosure of additional detailed information sought beyond that would lead to a significant impairment of the performance of the remaining tasks. Even in the event of a refusal to provide information on the grounds of a significant impairment to the performance of other tasks, comprehensible findings of fact are required, particularly regarding the specific circumstances of the administrative organization, which determine the effort involved in locating the data necessary for the correct and complete provision of the requested information (see VwGH May 29, 2018, Ra 2017/03/0083, with reference to VwGH 23.10.1995, 93/10/0009). However, in this case, the respondent authority failed to provide a specific argument as to how an excessive burden existed. The respondent authority has neither factually set forth nor quantified in a comprehensible manner either the extent of the existing (available) data or the effort associated with providing complete information or partial/summary information (see also VwGH Ra 2017/03/0083; Ra 2021/16/0014, according to which the duty to investigate ex officio the facts essential to the decision reaches its limit where, depending on the circumstances of the case, only the party can provide information on the facts). It should be noted that the data available to the respondent authority consists of a computer-processed and structured database, such that a selection of the data covered by the obligation to provide information pursuant to the ruling is, in any event, reasonable. 3.2.2.2.3. Regarding the media privilege: The complainant bases his original complaint on the so-called “media privilege” under § 9(1) of the Data Protection Act (DSG), according to which the processing of personal data by media owners, media employees, and employees of a media company or media service as defined by the Media Act for journalistic purposes of the media company or media service, the provisions of the DSG as well as Chapters II, III, IV, V, VI, VII, and IX of the GDPR do not apply. In general, it should be noted that the blanket exemption from the substantive requirements of the GDPR provided for in this provision is in clear conflict with Art. 85(2) of the GDPR and is, moreover, unconstitutional; for this reason, the Constitutional Court has struck down the provision, and it will cease to be in force on June 30, 2024. Furthermore, the fundamental right to data protection (§ 1 DSG) applies in any case (see Bresich/Dopplinger/Dörnhöfer/Kunnert/Riedl, DSG, § 9, K 8 and 11). Furthermore, the authority in question, which is required to carry out the interference with data protection, is not the intended recipient of the provision; therefore, a more detailed examination of it is not necessary in the present case. With regard to the complainant’s position, upon receipt of the requested information, as already outlined above, he must be referred to the constitutional provision of § 1 DSG. It was therefore necessary to rule accordingly. 3.3 Regarding B) Inadmissibility of the appeal: Pursuant to § 25a(1) VwGG, the Administrative Court must state in the operative part of its judgment or order whether the appeal is admissible under Art. 133(4) B-VG. The ruling must be briefly justified. The present decision does not depend on the resolution of a legal issue of fundamental significance. There is no lack of case law from the Administrative Court, nor does the present decision deviate from the case law of the Administrative Court; furthermore, the relevant case law of the Administrative Court is not to be regarded as inconsistent. Nor are there any other indications that the legal issues to be resolved are of fundamental significance. Rather, in its decision of May 29, 2018, Ra 2017/03/0083, established criteria for the proportionality test, which were also to be taken into account in the present case. With regard to the effort involved and the scope of the data disclosure, the Administrative Court case law cited in section 3.2 applies. The fact that a balancing of interests under the GDPR concerning natural persons—and only their data is protected under the GDPR—favors them in this specific case is a decision based on the particular circumstances and does not constitute a legal issue of fundamental importance (incidentally, this outcome of the balancing test remained uncontested by both parties in the first instance). The other balancing considerations are based on the case law of the CJEU (notably Schecke and Eifert, C-92/09) and the ECtHR (notably Magyar Helsinki Bizottság, Appl 18.030/11), as well as the case law of the Administrative Court (VwGH) and the Constitutional Court (VfGH) cited in Section 3.2 It must therefore be held that the appeal is not admissible pursuant to Art. 133(4) of the Federal Constitutional Law (B-VG).