Federal Administrative Court: retention of job applicant data for potential legal claims

Date of Decision July 8, 2026 Legal Provisions B-VG Art. 133(4) DSG §1 DSG §24 DSG §24(1) DSG §24(5) GDPR Art. 13 GDPR Art. 17 GDPR Art. 4 GDPR Art. 5 GDPR Art. 6 GDPR Art. 6(1)(f) VwGVG § 28(1) VwGVG § 28(2) VwGVG § 31(1) B-VG Art. 133 (current version); B-VG Art. 133 effective from January 1, 2019, through May 24, 2018, last amended by BGBl. I No. 138/2017 B-VG Art. 133 effective as of January 1, 2019, last amended by BGBl. I No. 22/2018 B-VG Art. 133 effective from May 25,May 2018 through December 31, 2018; last amended by Federal Law Gazette I No. 22/2018; B-VG Art. 133, effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164/2013, B-VG Art. 133, effective from Jan. 1, 2014, through July 31, 2014, last amended by Federal Law Gazette I No. 51/2012 Federal Constitutional Law (B-VG) Art. 133, effective from January 1, 2004, through December 31, 2013, last amended by Federal Law Gazette (BGBl.)

I No. 138/2017 VwGVG § 28 valid from January 1, 2014, through December 31, 2018 VwGVG § 28 today VwGVG § 28 effective as of January 1, 2019, last amended by BGBl. I No. 138/2017 VwGVG § 28 valid from January 1, 2014, through December 31, 2018 VwGVG § 31 (current) VwGVG § 31 effective as of September 1, 2018, last amended by Federal Law Gazette (BGBl.) I No. 57/2018 VwGVG § 31 effective from January 1,2017 through August 31, 2018; last amended by Federal Law Gazette I No. 24/2017 VwGVG § 31 valid from January 1, 2014, through December 31, 2016 Decision , W137 2333649-1/11E IN THE NAME OF THE REPUBLIC! The Federal Administrative Court, with Judge Mag. Peter HAMMER presiding and lay judges Mag. Ursula ILLIBAUER and Mag. Martina CHLESTIL as associate judges, has ruled on the complaint filed by XXXX against the decision of the Data Protection Authority dated November 24, 2025, Ref. No. D124.0658/24, 2024-0.835.856, has rightly ruled as follows: The Federal Administrative Court, presided over by Judge Mag.

Peter HAMMER and with expert lay judges Mag. Ursula ILLIBAUER and Mag. Martina CHLESTIL as associate judges, heard the complaint filed by Roman 40 against the decision of the Data Protection Authority dated November 24, 2025, Ref. No. D124.0658/24, 2024-0.835.856, has ruled as follows: A) I. The complaint is dismissed as unfounded pursuant to § 28(2) VwGVG in conjunction with § 24(1) and (5) DSG, as amended. Roman numeral one. The complaint is dismissed as unfounded pursuant to Section 28(2) of the VwGVG in conjunction with Paragraph 24(1) and (5) of the DSG, as amended. II. The remaining motions are dismissed as inadmissible. Roman numeral two. The remaining motions are dismissed as inadmissible. B) The appeal is inadmissible pursuant to Article 133, paragraph 4, of the Federal Constitutional Law (B-VG). The appeal is inadmissible pursuant to Article 133, paragraph 4, of the Federal Constitutional Law (B-VG).

Text Reasons for the Decision: I. Course of Proceedings: Roman numeral one. Course of Proceedings: 1. By a procedural motion dated February 29, 2024, amended by a brief dated June 6, 2024, XXXX (= complainant before the Federal Administrative Court and petitioner before the Data Protection Authority) filed a data protection complaint against XXXX (= first co-party before the Federal Administrative Court and first respondent before the Data Protection Authority) as well as against XXXX (= second co-party before the Federal Administrative Court and second respondent before the Data Protection Authority) regarding an alleged violation of the right to erasure. In support of the complaint, it was essentially argued that the complainant had sent his application documents, including personal data, to the first co-party via email on January 13, 2024. In doing so, he had expressly stated to the first co-party that the use of his application documents (personal data) was permitted solely for the purpose of the application, that they were not to be processed for the purpose of defending legal claims, and that they were to be deleted immediately upon completion of the application process.

However, the first co-respondent informed him in the rejection letter that his personal data would be stored and, accordingly, processed for an additional seven months pursuant to Article 6(1)(f) of the GDPR. 1. In a procedural motion dated February 29, 2024, amended by a brief dated June 6, 2024, Roman 40 (= complainant before the Federal Administrative Court and petitioner before the Data Protection Authority) filed a data protection complaint against Roman 40 (= first co-party before the Federal Administrative Court and first respondent before the Data Protection Authority) as well as Roman 40 (= second co-party before the Federal Administrative Court and second respondent before the Data Protection Authority) regarding an alleged violation of the right to erasure. In support of his claim, he essentially argued that on January 13, 2024, he had sent his application documents, including personal data, to the first intervening party via email.

In doing so, he had expressly stated to the first co-party that the use of his application documents (personal data) was permitted solely for the purpose of the job application, that they were not to be processed for the purpose of defending legal claims, and that they were to be deleted immediately upon completion of the application process. However, the first co-respondent informed him in the rejection letter that his personal data would be stored and processed for an additional seven months pursuant to article 6(1)(f) of the GDPR. Furthermore, he received a letter from the second party involved on behalf of the first party involved, which indicated that the first party involved had, against his express wishes, disclosed his personal data (at least his email address and name) to a third party against his express wishes, and that the second party subsequently stored his data unlawfully.

Although the complainant had expressly provided his personal data solely for the purpose of the job application, it was processed for purposes other than those intended—both by the firstand second parties in violation of the principle set forth in Article 5(1)(b) of the GDPR and, despite his request, had not been deleted. Although the complainant had expressly provided his personal data solely for the purpose of applying for the position, it was processed by both the first and second parties involved in violation of the principle set forth in article 5, paragraph 1, (b) of the GDPR, and were not deleted despite his request. For these reasons, his right to erasure under Article 17(1)(d) of the GDPR has been violated. For these reasons, his right to erasure under Article 17(1)(d) of the GDPR has been violated. 2. In its statement dated September 13, 2024, the second party to the proceedings essentially asserted, insofar as relevant to the proceedings, that the complainant’s personal data was being processed in a lawful manner by the parties to the proceedings.

These data were initially processed by the first party to the proceedings on the basis of Article 6(1)(b) of the GDPR for the purpose of reviewing the application on a pre-contractual basis. The application documents (resume) were then processed for a period of seven months from the date the application was rejected for the purpose of defending against legal claims under the Equal Treatment Act (Article 6(1)(f) of the GDPR in conjunction with Section 17(1)(1) in conjunction with Section 26(1) and Section 29(1) of the Equal Treatment Act). The resume has since been deleted. 2. In its statement dated September 13, 2024, the second party to the proceedings essentially stated, insofar as relevant to the proceedings, that the complainant’s personal data was being processed in a lawful manner by the parties to the proceedings. This data was initially processed by the first party involved on the basis of Article 6(1)(b) of the GDPR for the purpose of processing the application on a pre-contractual basis.

The application documents (resume) were then processed for a period of seven months from the date the application was rejected for the purpose of defending against legal claims under the Equal Treatment Act (Article 6(1)(f) of the GDPR in conjunction with Paragraph 17(1), subparagraph 1, in conjunction with Section 26, paragraph 1, and Section 29, paragraph 1, of the Equal Treatment Act (GlBG)). The resume has since been deleted. The remaining correspondence related to the application, in particular the complainant’s attachment titled “IMPORTANT—please read!,” is being processed to safeguard the legitimate interest of the first party involved in defending against legal claims and in defending itself in the present proceedings concerning alleged data protection violations (Art. 6(1)(f) GDPR). The processing will be necessary at least for the duration of the present proceedings, with the final expiration of the retention period depending on the outcome of the present proceedings.

The remaining correspondence related to the application, in particular the complainant’s attachment titled “IMPORTANT – Please Read!”, is processed to safeguard the legitimate interest of the first party involved in defending against legal claims and in the present proceedings concerning alleged data protection violations (article 6(1)(f) of the GDPR). The processing will be necessary at least for the duration of the present proceedings, with the final expiration of the retention period depending on the outcome of the present proceedings. The second party involved received the complainant’s personal data (but not his resume) for the purpose of responding to and assisting with the response to the request for erasure. The first party involved was therefore able to transfer this data to the second party involved on the basis of its legitimate interest. The second party now processes the data to safeguard the legitimate interests of both parties in defending against unfounded claims in the context of the present proceedings before the Data Protection Authority.

Furthermore, data processing by the second party involved was already permissible simply because it acted in its role as an external data protection officer. 3. In a decision dated November 24, 2025, Ref. No. D124.0658/24, 2024-0.835.856, the Data Protection Authority dismissed the data protection complaint filed on February 29, 2024. In this decision, the Data Protection Authority essentially made the following findings of fact: On January 13, 2024, the complainant applied to the first party as an IT systems administrator via the website www.karriere.at. In addition to his resume, the complainant’s application included other documents, in particular statements regarding the use of his personal data. On January 24, 2024, the first party notified the complainant that the position had already been filled by another candidate and informed him of the purpose and duration of the data processing.

Following a letter from the complainant dated January 24, 2024, the first party involved instructed the second party involved to respond to the complainant’s letter. Until the letter dated January 24, 2024, the first party involved had used the complainant’s application documents to review the complainant’s application. The complainant’s resume was stored by the first co-party for a period of seven months from the date the application was rejected on January 24, 2024, and was subsequently deleted. The first co-respondent retained the complainant’s resume, while the other co-respondent retained the complainant’s other documents, in order to defend against any legal claims the complainant might assert. Based on these findings of fact, the respondent authority essentially concluded the following from a legal perspective: Regarding the first co-respondent: The assertion, exercise, or defense of legal claims constitutes a legitimate interest, particularly in the present case, as the complainant has announced potential legal action.

The processing is also necessary to defend against the claims asserted by the complainant. No particularly serious infringement of the complainant’s rights is apparent. This is counterbalanced by the first third party’s interest in defending against the claims asserted by the complainant, which the complainant had already announced in his application. Thus, in this case, the interests of the co-involved party would outweigh those of the complainant. Since the data processing was lawful within the meaning of Art. 6(1) GDPR in conjunction with Art. 5(1)(a) of the GDPR, there is no obligation to erase the data under Article 17(1)(d) of the GDPR, which requires the erasure of personal data in the event of unlawful processing. Since the data processing was lawful within the meaning of Article 6, paragraph 1, GDPR in conjunction with Article 5(1)(a) GDPR, there is no obligation to erase data under Article 17(1)(d) GDPR, which requires that personal data be erased in the event of unlawful processing.

Furthermore, the erasure obligations under Article 17(1)(a), (b), (c), (e), and (f) of the GDPR are not applicable. Consequently, the first party involved is not required to erase the complainant’s personal data, as there is no obligation to erase data under Article 17(1)(a) through (f) of the GDPR, and, moreover, Article 17(1) of the GDPR does not apply insofar as the processing is necessary for the establishment, exercise, or defense of legal claims. Furthermore, the erasure obligations under article 17(1)(a), (b), (c), (e), and (f) of the GDPR are not applicable. Consequently, the first party involved is not required to erase the complainant’s personal data, as there are no obligations to erase data under Article 17(1)(a) through (f) of the GDPR, and, moreover, Article 17(1) GDPR does not apply insofar as the processing is necessary for the establishment, exercise, or defense of legal claims.

Regarding the second party involved: The second party involved lawfully received the complainant’s personal data from the first party involved in accordance with the explanations regarding the first party involved and processes this data just as lawfully in the interest of the first party involved pursuant to Article 6(1)(f) of the GDPR. In addition, the second party involved has an interest in fulfilling its contract with the first party involved. The second party involved lawfully received the complainant’s personal data from the first party involved in accordance with the explanations regarding the first party involved and processes this data just as lawfully in the interest of the first party involved pursuant to article 6(1)(f) of the GDPR. In addition, the second party involved has an interest in fulfilling its contract with the first party involved. In summary, the complainant’s personal data should not be deleted by the second party involved either, since there is no obligation to delete it under Article 17(1)(a) through (f) of the GDPR, and, moreover, Article 17(1) of the GDPR does not apply to the extent that the processing is necessary for the establishment, exercise, or defense of legal claims.In summary, the complainant’s personal data should not be deleted by the second party involved either, since there is no obligation to delete data under Article 17, paragraph 1, subparagraphs (a) through (f) of the GDPR, and, moreover, Article 17, paragraph 1, GDPR does not apply insofar as the processing is necessary for the establishment, exercise, or defense of legal claims. 4.

In the complaint filed against this decision within the prescribed time limit, comprising over 300 pages (including an appendix: Copyright © 2025 XXXX All Rights Reserved Worldwide), the complainant essentially argued: 4. In the complaint filed within the prescribed time limit against this decision, which ran to over 300 pages (including the addendum “Copyright © 2025 Roman numeral 40 All Rights Reserved Worldwide”), the complainant essentially argued: First, he requested that the Federal Administrative Court determine whether the case officer responsible at the Data Protection Authority might be working for the second party involved and whether a conflict of interest existed in this context. With regard to the obligation to delete the data, it was argued that the lawfulness of the processing of his personal data had never existed beyond the application process. Thus, not only must the second party involved delete the data, but the first party involved never had the right to disclose the data in general—and certainly not after the conclusion of the application process—because he had precisely specified the applicable data protection provisions in his written submission titled “IMPORTANT—Please read!,” and the first co-party had implicitly consented to this through the processing.

Not only did the co-parties have no right to store his resume for seven months beyond the application process, but to date there is also no evidence for the erasure after seven months. Likewise, there is no evidence that the data was ever processed correctly in accordance with the complainant’s specifications and consent, even during the processing phase of the application process. Since there had already been other breaches of duty in the past—such as the first party’s violation of the duty to inform when collecting the data (in the job offer)—and since simply performing an erasure of the resume after seven months, even from the complainant’s emails, might not be possible at all, without deleting all emails and all data, there may still be further violations in this case. However, this is not clear to the complainant, as he has no insight into the processing procedure or the storage practices of the other parties involved.

It is evident that data protection violations are still occurring. The complainant had clearly prohibited any form of further processing and storage of the data after the conclusion of the application process, and the first party involved had never objected to his conditions and the resulting “legally binding contract” for the processing of his data from January 13, 2024, and before January 24, 2024. With the agreement dated January 13, 2024, and the processing for the purpose of the application—which began, was carried out, and was completed without objection—the complainant has the right, pursuant to Article 5(1)(a) of the GDPR, to assume that the complainant’s data would be processed exactly in accordance with the specifications he provided on January 13, 2024 (in his letter accompanying the application) and would therefore be processed without exception and in full immediately upon completion of the application process, at the latest upon rejection of the application and the position.The complainant had explicitly prohibited any form of further processing and storage of the data after the conclusion of the application process, and the first-party data controller had never objected to his conditions or to the resulting “legally binding contract” for the processing of his data from January 13, 2024, and before January 24, 2024.

With the contract dated January 13, 2024, and the unobjected-to, initiated, and completed processing for the purpose of the application, the complainant, pursuant to Article 5, paragraph 1, subparagraph a, GDPR, the right to assume that the complainant’s data would be processed exactly in accordance with the specifications defined by him on January 13, 2024 (in the letter he enclosed with his application) and that their processing would therefore result in their immediate deletion without exception and in full upon completion of the application process, at the latest upon rejection of the application and the position. For these reasons, the contested decision is unlawful, and the parties involved are obligated to delete the complainant’s personal data without delay. The complainant therefore submitted the following motions (accompanied by explanations and instructions), requesting that the Federal Administrative Court 1. ensure that the present proceedings are concluded as quickly as possible in accordance with the law and without causing any undue burden to the complainant; 2. examine the aforementioned issues and resolve them in accordance with the law; 3. thoroughly and comprehensively review and examine the data as well as the legal situation, in which connection the complainant referred in detail to experiences from other areas of law within the jurisdiction of the Federal Administrative Court; 4. examine the implications of the Court’s decision and its interpretation of the statutory provisions before rendering a final decision; 5. ensure that any erasure of the data is promptly ordered and carried out; 6. ensure that any unnecessary damages incurred by the complainant (specifically cited: the filing fee and three weeks of work required to draft the complaint in question) are promptly and fully remedied; 7.

Initiate an investigation into the procedural errors committed to date by the Data Protection Authority, covering the procedures, the content of the decisions, their lawfulness, and the case officers involved (particularly those active in the present proceedings); and 8. ensure that such errors do not occur again in the future. 5. By letter from the Data Protection Authority dated January 27, 2026 (received by the court on the same day), the complaint, together with the administrative decision, was forwarded to the Federal Administrative Court. The letter essentially referred to the decision and requested that the complaint be dismissed. 6. In a written submission dated February 25, 2026, the Federal Administrative Court admonished the complainant, due to his multiple and repeated offensive remarks directed at the Data Protection Authority and the respondents in the appeal against the decision, that, in the event of a recurrence of such offensive language, a disciplinary fine would have to be imposed pursuant to § 34 AVG. 6.

In a written submission dated February 25, 2026, the Federal Administrative Court cautioned the complainant regarding his multiple and repeated offensive remarks directed at the Data Protection Authority and the respondents in the appeal against the decision, that in the event of a recurrence of such offensive language, an administrative fine would have to be imposed pursuant to Section 34 of the AVG. 7. In a statement (filed after notice of the appeal) dated March 11, 2026, the second co-party (as representative of the first co-party) essentially argued that the continued processing of the complainant’s data was necessary even after the conclusion of the application process, since the complainant had already announced in his application letter that he might take various legal actions. The style of the letter, its length, and the complainant’s statements taken as a whole gave the impression that he would take legal action against the first party involved following the rejection of his application for the advertised position.

Therefore, as the Data Protection Authority has already stated, there is a legitimate interest on the part of the first co-respondent in this case pursuant to Article 6(1)(f) of the GDPR. Furthermore, the retention of data is not merely an exception to the obligation to erase data pursuant to Article 17(3)(b) or (e) of the GDPR, but rather a separate processing activity with its own distinct purpose based on Article 6(1)(f) of the GDPR. 7. In its statement (following notification of the complaint) dated March 11, 2026, the second party involved (as the representative of the first party involved) essentially argued that the continued processing of the complainant’s data was necessary even after the conclusion of the application process, since the complainant had already indicated in his cover letter that he might take various legal actions. The style of writing, the length, and the complainant’s statements taken as a whole gave the impression that he would take legal action against the first party involved following the rejection of his application for the advertised position.

Therefore, as the Data Protection Authority has already explained, the first co-respondent has a legitimate interest in this case pursuant to article 6(1)(f) of the GDPR. Furthermore, the retention of data is not merely an exception to the obligation to erase data pursuant to Article 17(3)(b) or (e) of the GDPR, but rather a separate processing activity with its own distinct purpose based on Article 6(1)(f) of the GDPR. Regarding data processing in connection with application documents, it should be noted that all processing steps necessary for conducting a hiring process would fall under Article 6(1)(b) of the GDPR as pre-contractual measures. With regard to data processing in connection with job application documents, it should be noted that all processing steps necessary for conducting a job application process would fall under article 6(1)(b) of the GDPR as pre-contractual measures. II.

The Federal Administrative Court considered: II. The Federal Administrative Court considered: 1. Findings: 1.1. The first co-party is a research organization that had posted a job advertisement on the website www.karriere.at. This site, which is designed as a job application portal, already contains a detailed privacy policy as well as a notice regarding the relevant further processing by potential employers in recruitment processes in accordance with the applicable legal provisions. 1.2. The second party to the proceedings is a law firm organized as a GmbH (limited liability company), which provided legal support to the first party to the proceedings in the job application process at issue and initially provided representation for the first party to the proceedings in the present case. In response to the complainant’s letter dated January 24, 2024, the first co-party instructed the second co-party on the very same day to respond to that letter. 1.3.

On January 13, 2024, the complainant applied for the position of IT system administrator with the first party involved, writing directly to the first party involved. In addition to his resume, he attached three documents titled “IMPORTANT – PLEASE READ!”, “Statement,” and “COVID Information.” In these documents, the complainant emphasized in particular that he was granting his consent to the processing of his personal data exclusively for the application process and objected to any processing of his personal data beyond that scope. He further stated that his information should be considered “intellectual property,” that the application was subject to copyright, and that any further processing or creation of copies would constitute an “intentional criminal offense.” With the information provided here—as the complainant stated in the document titled “IMPORTANT—PLEASE READ!”—there was “no legally valid reason for the extended storage of my data beyond the application process.”

In the event of noncompliance with his instructions in this regard, the complainant threatened (already in the aforementioned attachment to the application) to take legal action against the first-named party. The complainant was also always aware that this was incompatible with the legal obligations of a potential employer in the context of a job posting. 1.4. In an email dated January 24, 2024, the first co-respondent informed the complainant that the advertised position had already been filled by another candidate and once again explicitly disclosed to the complainant the relevant legal bases on which the (further) data processing at issue in this proceeding was based, even beyond the conclusion of the immediate application process. Furthermore, the first co-respondent expressly stated to the complainant that it had not yet received any substantial indication of identity thefts—as discussed by the complainant in his attachments—or of a risk thereof within its own area of responsibility. 1.5.

Up until the letter dated January 24, 2024, the first co-respondent had used and processed the complainant’s application documents and personal data solely within the context of the application process. This processing is also not the subject of the complaint at issue here. The complainant’s resume was stored by the first party involved for a period of seven months beginning on January 24, 2024, the date the application was rejected, in connection with any potential complaints regarding the hiring decision (such as those related to equal treatment issues), and was subsequently deleted. Currently, both parties involved process and retain only those personal data of the complainant that are necessary to defend against legal claims (now) asserted by the complainant. In addition, there is the data that the complainant himself submitted in his statements and complaints during the present data protection proceedings.

This data will be processed at least until the expiration of the deadline for filing an appeal or complaint against the administrative court decision in question. 2. Assessment of the Evidence: The findings regarding the relevant facts are derived from the administrative act, the complaint, and the court record. 2.1. The findings regarding the first co-party and the job posting are based on the administrative decision of the Data Protection Authority. The platform’s privacy policy was submitted by the complainant himself. 2.2. The findings regarding the second party also stem from the administrative decision and are undisputed. Furthermore, in its statement dated September 13,2024, the first party credibly asserted that, in response to the complainant’s letter dated January 24, 2024, the second party had been instructed by the first party on the very same day to respond to that letter. This was also confirmed by the complainant. 2.3.

The findings regarding the complainant’s application for the position of IT systems administrator with the first party to the proceedings are based on the complainant’s undisputed statements in his petition initiating the proceedings as well as on the documents he submitted. In particular, the complainant’s application dated January 13, 2024, as well as the attachments “IMPORTANT – PLEASE read!”, “Statement,” and “COVID Information,” were submitted directly during the first-instance proceedings. Their content—in particular, the complainant’s request for a significant restriction on the processing of personal data (limited solely to the application process)—is also clearly evident from the aforementioned attachments. This also leaves no doubt as to the complainant’s intention to prescribe precisely to the first-instance respondent—regardless of any applicable legal obligations—at the “contractual level” what the respondent may do with his data and how it may be processed.

Since the complainant explicitly intended in his letter to exclude retention obligations required by law (such as the right to file a complaint regarding equal treatment) in the context of a job posting for his person, and since he also explicitly mentioned these on his own initiative in his attachment, there can be no doubt that the complainant was aware of and understood these requirements for further data processing when he submitted his application. There is therefore no doubt as to the authenticity and accuracy (in terms of the intended data protection implications) of these documents. 2.4. The fact that the first co-respondent informed the complainant that the advertised position had already been filled by another candidate is evident from the first co-respondent’s email dated January 24, 2024. This email also shows that, in this context and with explicit reference to the letter enclosed with his application, the first co-party (once again) informed the complainant of the relevant legal bases on which the processing of his personal data had been based to date and on which it would be based in the future —where necessary—be based in the future.

The remaining findings are taken from this communication. 2.5. The findings regarding the use of the application documents are based on the submissions of the co-parties and the available case records. The fact that the application documents were processed exclusively within the context of the application process until the application was rejected is consistent with the purpose for which they were submitted, and no evidence of any other use in the complaint proceedings has come to light. The finding that the complainant’s documents will be retained for seven months starting on January 24, 2024, for the purpose of defending against any potential legal claims arising from the application process is based on the undisputed statements of the parties involved in this matter. According to the information provided by the first co-party, the complainant’s resume was deleted seven months after his application was rejected.

The complainant did not credibly contest this assertion during the proceedings, and there are no other indications that would cast doubt on its accuracy. The fact that the co-parties will process the complainant’s personal data beyond August 2024 necessarily follows from the complainant’s data protection complaint, which was filed in the meantime (in February 2024). The finding that the parties to the proceedings and the Administrative Court processed data that the complainant submitted to the authority and/or the Court in the context of the present data protection proceedings stems from the undisputed fact of the present complaint proceedings. The fact that this data will now necessarily continue to be processed until the expiration of the deadline for filing extraordinary appeals follows from the legal situation, whereby the filing of such appeals extends the processing of the data accordingly. 3.

Legal Assessment: 3.1. Pursuant to § 6 BVwGG, the Federal Administrative Court decides through a single judge, unless federal or state laws provide for a decision by a panel. 3.1. Pursuant to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court makes its decisions through a single judge, unless federal or state laws provide for a decision by a panel. Pursuant to § 27(1) of the Data Protection Act (DSG), the Federal Administrative Court decides by a panel on complaints against decisions based on a violation of the duty to inform pursuant to para 24(7) of the aforementioned Act and the Data Protection Authority’s duty to decide. Pursuant to § 27(2), first sentence, of the Data Protection Act (DSG), the panel consists of a chairperson and one expert lay judge each from the ranks of employers and employees. In the present case, the Senate therefore has jurisdiction.

Pursuant to Section 27(1) of the DSG, the Federal Administrative Court, sitting as a Senate, rules on complaints against decisions regarding violations of the duty to provide information under paragraph 24(7) of the DSG and the Data Protection Authority’s duty to make a decision. Pursuant to Section 27, paragraph 2, first sentence, of the DSG, the Senate consists of a presiding judge and one expert lay judge each from the employer and employee groups. The Senate therefore has jurisdiction in this matter. The proceedings of the administrative courts, with the exception of the Federal Finance Court, are governed by the VwGVG, Federal Law Gazette I 2013/33, as amended by Federal Law Gazette I 2013/122 (§ 1 of the aforementioned Act). Pursuant to § 59(2) VwGVG, conflicting provisions that had already been promulgated at the time this federal law entered into force remain in effect.The proceedings of the administrative courts, with the exception of the Federal Finance Court, are governed by the VwGVG, Federal Law Gazette I 2013/33, as amended by Federal Law Gazette I 2013/122 (Section 1, leg. cit.).

Pursuant to paragraph 59(2) of the VwGVG, conflicting provisions that had already been promulgated at the time this federal law entered into force shall remain in force. Pursuant to § 17 VwGVG, unless otherwise provided in this federal law, the provisions of the AVG—with the exception of §§ 1 through 5 and Part IV—apply to proceedings concerning complaints under Art. 130(1) B-VG. Part, the provisions of the Federal Tax Code (BAO), Federal Law Gazette No. 194/1961, the Agricultural Proceedings Act (AgrVG), Federal Law Gazette No. 173/1950, and the Civil Service Proceedings Act of 1984 — DVG, Federal Law Gazette No. 29/1984—and, in all other respects, those procedural provisions in federal or state laws are to be applied mutatis mutandis that the authority applied or should have applied in the proceedings preceding the proceedings before the Administrative Court.Pursuant to Section 17 of the Administrative Court Act (VwGVG), unless otherwise provided in this federal law, the provisions of the Administrative Procedure Act (AVG)—with the exception of Sections 1 through 5 and Section IV—shall apply to proceedings concerning complaints under Article 130, paragraph 1, of the Federal Constitutional Law (B-VG).

Part IV, the provisions of the Federal Tax Code (BAO), Federal Law Gazette No. 194 of 1961, the Agricultural Proceedings Act (AgrVG), Federal Law Gazette No. 173 of 1950, and the Civil Service Proceedings Act of 1984 (DVG), Federal Law Gazette No. 29 of 1984, and, in all other respects, those procedural provisions in federal or state laws are to be applied mutatis mutandis that the authority applied or would have been required to apply in the proceedings preceding the proceedings before the Administrative Court. 3.2. Pursuant to § 31(1) VwGVG, decisions and orders shall be issued by resolution, unless a final judgment is to be rendered.3.2. Pursuant to § 31(1) VwGVG, decisions and orders shall be issued by resolution, unless a final judgment is to be rendered. Pursuant to § 28(1) VwGVG, the administrative court must resolve the case by a judgment, unless the complaint is to be dismissed or the proceedings are to be discontinued.

Pursuant to Section 28, paragraph 1, of the VwGVG, the administrative court must resolve the case by a judgment, unless the complaint is to be dismissed or the proceedings are to be discontinued. Re A) 3.3. The Relevant Provisions of the GDPR: Article 4 Definitions For the purposes of this Regulation, the following terms shall have the following meanings: 1. “personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person; 2. “Processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transfers, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction; 3–6.

(…) 7. “Controller” means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, makes the decision on the purposes and means of the processing of personal data; if the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for by Union law or the law of the Member States; 8–26. (…) Article 5 Principles Governing the Processing of Personal Data (1) Personal data must be a) processed lawfully, fairly, and in a transparent manner in relation to the data subject (“lawfulness, fairness, and transparency”); b) be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes; Further processing for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes is not considered incompatible with the original purposes pursuant to paragraph 89(1) (“purpose limitation”); c) be adequate, relevant, and limited to what is necessary for the purposes of the processing (“data minimisation”); d) be factually accurate and, where necessary, kept up to date; all reasonable measures must be taken to ensure that personal data that is inaccurate in light of the purposes of its processing is erased or rectified without delay (“Accuracy”); e) be stored in a form that permits identification of data subjects only for as long as is necessary for the purposes for which they are processed; Personal data may be stored for a longer period provided that, subject to the implementation of appropriate technical and organizational measures required by this Regulation to protect the rights and freedoms of the data subject, processed exclusively for archiving purposes in the public interest, or for scientific or historical research purposes, or for statistical purposes in accordance with article 89 paragraph 1 (“storage limitation”); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, through appropriate technical and organizational measures (“Integrity and Confidentiality”); (2) The controller is responsible for compliance with paragraph 1 and must be able to demonstrate such compliance (“accountability”).

Article 6 Lawfulness of Processing (1) Processing is lawful only if at least one of the following conditions is met: a) the data subject has given consent to the processing of personal data concerning him or her for one or more specified purposes; b) processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of precontractual measures taken at the data subject’s request; c) processing is necessary to comply with a legal obligation to which the controller is subject; d) the processing is necessary to protect the vital interests of the data subject or of another natural person; e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f) the processing is necessary to protect the legitimate interests of the controller or of a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail, in particular where the data subject is a child.

Subparagraph 1(f) does not apply to processing carried out by public authorities in the performance of their duties. (2) – (4) (…) Article 13 Obligation to Provide Information When Collecting Personal Data from the Data Subject (1) Where personal data are collected from the data subject, the controller shall provide the data subject with the following information at the time of collection: a) the name and contact details of the controller and, where applicable, of the controller’s representative; b) where applicable, the contact details of the data protection officer; c) the purposes for which the personal data will be processed and the legal basis for the processing; d) if the processing is based on Article 6(1)(f), the legitimate interests pursued by the controller or by a third party; e) where applicable, the recipients or categories of recipients of the personal data; and f) where applicable, the controller’s intention to transfer the personal data to a third country or an international organisation, as well as the existence or absence of an adequacy decision by the Commission or, in the case of transfers pursuant to article 46, article 47, or the second subparagraph of paragraph 49(1), a reference to the appropriate or suitable safeguards and the possibility of how to obtain a copy of them or where they are available.

(2) In addition to the information referred to in paragraph 1, the controller shall provide the data subject, at the time of collection of such data, with the following further information necessary to ensure fair and transparent processing: (a) the period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period; b) the existence of a right to obtain from the controller information regarding the personal data in question, as well as the right to rectification, erasure, restriction of processing, or the right to object to the processing, and the right to data portability; c) where the processing is based on Article 6(1)(a) or Article 9(2)(a), the existence of a right to withdraw consent at any time, without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal; d) the existence of a right to lodge a complaint with a supervisory authority; e) whether the provision of personal data is required by law or contract or is necessary for the conclusion of a contract, whether the data subject is obligated to provide the personal data, and what possible consequences failure to provide such data would entail; and f) the existence of automated decision-making, including profiling, pursuant to article 22 paragraphs 1 and 4, and—at least in such cases—meaningful information regarding the logic involved, as well as the scope and intended consequences of such processing for the data subject.

(3) If the controller intends to further process the personal data for a purpose other than that for which the personal data was collected, the controller shall provide the data subject, prior to such further processing, with information regarding that other purpose and all other relevant information in accordance with paragraph 2. (4) Paragraphs 1, 2, and 3 do not apply if and to the extent that the data subject already has the information. Article 17 Right to Erasure (“Right to Be Forgotten”) (1) The data subject has the right to request that the controller erase personal data concerning him or her without delay, and the controller is obligated to erase personal data without delay if any of the following grounds apply: a) The personal data is no longer necessary for the purposes for which it was collected or otherwise processed. b) The data subject withdraws consent on which the processing was based pursuant to article 6(1)(a) or article 9(2)(a), and there is no other legal basis for the processing. c) The data subject objects to the processing pursuant to Article 21(1), and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2). d) The personal data has been processed unlawfully. e) The erasure of the personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which the controller is subject. f) The personal data was collected in relation to information society services offered pursuant to article 8(1).

(2) If the controller has made the personal data public and is obliged to perform the erasure pursuant to paragraph 1, the controller shall, taking into account available technology and the cost of implementation, take reasonable measures, including technical measures, to ensure that other controllers engaged in the processing of the personal data that a data subject has requested the erasure of all links to such personal data or of copies or replicas of such personal data. (3) Paragraphs 1 and 2 do not apply to the extent that the processing is necessary a) for the exercise of the right to freedom of expression and information; (b) for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (c) for reasons of public interest in the area of public health in accordance with article 9 paragraph 2 items h and i and article 9 paragraph 3; d) for archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes as set forth in article 89(1), insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of such processing; or e) for the establishment, exercise, or defense of legal claims. 3.4 The Relevant Provisions of the DSG: Article 1 (Constitutional Provision) Fundamental Right to Data Protection § 1.

(1) Every person has the right to the confidentiality of personal data concerning them, particularly with regard to respect for their private and family life, to the extent that there is a legitimate interest in such confidentiality. The existence of such an interest is excluded if data are not subject to a right to confidentiality due to their general availability or because they cannot be traced back to the data subject. Paragraph one, (1) Everyone has the right, particularly with regard to respect for their private and family life, to the confidentiality of personal data concerning them, provided there is a legitimate interest therein. The existence of such an interest is excluded if data are not subject to a right to confidentiality due to their general availability or because they cannot be traced back to the data subject. (2) To the extent that the use of personal data is not in the vital interest of the data subject or does not occur with his or her consent, restrictions on the right to confidentiality are permissible only to safeguard the overriding legitimate interests of another, and, in the case of interventions by a government authority, only on the basis of laws that are necessary for the reasons specified in Article 8(2) of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210/1958.

Such laws may provide for the use of data that, by its Art, is particularly worthy of protection only to safeguard important public interests and must, at the same time, establish adequate safeguards for the protection of the privacy interests of the individuals concerned. Even in the case of permissible restrictions, the interference with the fundamental right must in each instance be carried out only in the least intrusive manner necessary to achieve the objective. (2) To the extent that the use of personal data is not in the vital interest of the data subject or is not carried out with the data subject’s consent, restrictions on the right to privacy are permissible only to safeguard the overriding legitimate interests of another person; in the case of interventions by a government authority, such restrictions are permissible only on the basis of laws that are necessary for the reasons set forth in article 8, paragraph 2, of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210 of 1958.

Such laws may provide for the use of data that, by its Art, is particularly worthy of protection only to safeguard important public interests and must, at the same time, establish appropriate safeguards for the protection of the data subjects’ privacy interests. Even in the case of permissible restrictions, any interference with the fundamental right must be carried out only in the least intrusive Art necessary to achieve the objective. (…) Complaint to the Data Protection Authority § 24. (1) Every data subject has the right to lodge a complaint with the Data Protection Authority if they believe that the processing of their personal data violates the GDPR or § 1 or Article 2, Section 1. Paragraph 24, (1) Every data subject has the right to lodge a complaint with the Data Protection Authority if they believe that the processing of personal data concerning them violates the GDPR or Paragraph 1, or Article 2, Section 1.

(2) The complaint must include: 1. the designation of the right deemed to have been infringed, 2. to the extent reasonably possible, the designation of the legal entity or body to which the alleged infringement is attributed (the respondent), 3. the facts from which the violation is derived, 4. the grounds on which the allegation of unlawfulness is based, 5. a request to determine the alleged violation, and 6. the information necessary to assess whether the complaint was filed in a timely manner. (3) Where applicable, a complaint must be accompanied by the underlying request and any response from the respondent. In the event of a complaint, the Data Protection Authority must provide further assistance at the request of the data subject. (4) The right to have a complaint addressed expires if the complainant does not file it within one year after becoming aware of the event giving rise to the complaint, but no later than three years after the event allegedly took place.

Late complaints shall be dismissed. (5) If a complaint is found to be justified, it must be addressed. If a violation is attributable to a controller in the private sector, that controller must be instructed to comply with the complainant’s requests for access, rectification, erasure, restriction, or data portability to the extent necessary to remedy the established violation. If the complaint proves to be unfounded, it shall be dismissed. (6) A respondent may subsequently remedy the alleged violation before the conclusion of the proceedings before the Data Protection Authority by complying with the complainant’s requests. If the Data Protection Authority deems the complaint to be without merit in this respect, it must hear the complainant on this matter. At the same time, the respondent must be advised that the Data Protection Authority will informally discontinue the proceedings if the respondent does not, within a reasonable period, provide reasons why he or she still considers the originally alleged violation to be, at least in part, unresolved.

If such a statement by the complainant alters the nature of the matter (Section 13(8) AVG), it shall be presumed that the original complaint has been withdrawn and a new complaint has been filed simultaneously. In this case as well, the original complaint proceedings must be informally discontinued, and the complainant must be notified accordingly. Late submissions shall not be taken into account.(6) A respondent may, until the conclusion of the proceedings before the Data Protection Authority, subsequently remedy the alleged violation by complying with the complainant’s requests. If the Data Protection Authority deems the complaint to be without merit in this respect, it shall hear the complainant on this matter. At the same time, the complainant must be advised that the Data Protection Authority will dismiss the proceeding without formal notice if the complainant does not, within a reasonable period, provide reasons why he or she still considers the originally alleged violation to be, at least in part, unresolved.

If such a statement by the complainant substantially alters the nature of the matter (Paragraph 13(8) of the Administrative Procedure Act [AVG]), it shall be presumed that the original complaint has been withdrawn and a new complaint has been filed. In this case as well, the original complaint proceedings shall be informally discontinued, and the complainant shall be notified accordingly. Late statements shall not be taken into account. (7) The Data Protection Authority shall inform the complainant of the status and outcome of the investigation within three months of the filing of the complaint. (8) Any data subject may bring the matter before the Federal Administrative Court if the Data Protection Authority fails to address the complaint or fails to inform the data subject of the status or outcome of the complaint within three months. (9) The Data Protection Authority may—to the extent necessary—call upon official experts to assist in the proceedings.

(10) The following periods are not included in the decision-making period pursuant to § 73 AVG:(10) The following periods are not included in the decision-making period pursuant to § 73 AVG: 1. the time during which the proceedings are suspended pending a final decision on a preliminary issue; 2. the time during proceedings under Articles 56, 60, and 63 of the GDPR.2. the time during proceedings under Articles 56, 60, and 63 of the GDPR. 3.5. Article 17 of the GDPR grants data subjects the right to erasure, or the “right to be forgotten,” under certain conditions. These conditions include, among others, the lack of necessity for further data processing, the withdrawal of consent, an objection to the processing, or the fact that the processing is unlawful in itself. 3.5. Article 17 of the GDPR grants data subjects the right to erasure, or the “right to be forgotten,” under certain conditions.

These include, among other things, the lack of necessity for further data processing, the withdrawal of consent, an objection to data processing, or the fact that the processing is unlawful in and of itself. A data subject is generally entitled to erasure if the controller violates the principles of Article 5 when processing the data subject’s personal data or cannot rely on any legal basis within the meaning of Article 6—or, at most, in conjunction with Article 9 — (or more). If the controller is not performing any data processing, the right to erasure does not apply. The decisive point in time for assessing the requirements is the date the request is submitted (see Haidinger in Knyrim, DatKomm Art. 17 GDPR, para. 47 [as of July 1, 2024, rdb.at]).The data subject is generally entitled to a right to erasure if the controller, in processing the data subject’s personal data, violates the principles of Article 5 or cannot rely on any legal basis within the meaning of Article 6—possibly in conjunction with Article 9— – (or more).

If the controller is not performing any data processing, the right to erasure does not apply. The decisive point in time for assessing the requirements is the date the request is filed; see Haidinger in Knyrim, DatKomm article 17, GDPR, para. 47 [as of July 1, 2024, rdb.at]). If, among other reasons, the personal data is no longer necessary for the purposes for which it was collected or otherwise processed (Art. 17(1)(a) GDPR) or if the personal data was processed unlawfully (Art. 17(1)(d) of the GDPR), the data subject has the right to request that the controller erase personal data concerning him or her without delay, and the controller is obligated to erase such personal data without delay (Article 17(1) of the GDPR).If, among other things, the personal data is no longer necessary for the purposes for which it was collected or otherwise processed (Article 17, paragraph 1, subparagraph a, GDPR) or if the personal data was processed unlawfully (Article 17, paragraph 1, (d) of the GDPR), the data subject has the right to request that the controller erase personal data concerning him or her without delay, and the controller is obligated to erase such personal data without delay (Article 17(1) of the GDPR).

If the processing is necessary for the controller to comply with a legal obligation under the law of the Member State or the Union, the data subject has no right to erasure; this applies, for example, to an employee’s sick leave days. For example, an order record transmitted to a collection agency is also subject to the retention obligation under Para 132 of the Federal Tax Code (BAO) or Para 212 of the Austrian Commercial Code (UGB) as a business letter. This is therefore a catch-all provision that specifically targets retention obligations under commercial and tax law. However, it may also encompass retention obligations under health law, budgetary law, or archival law. The Data Act does not impose any specific obligations regarding the storage or erasure of data (see Haidinger in Knyrim, DatKomm Art. 17 GDPR, Marg. No. 70 [as of July 1, 2024, rdb.at]).If the processing is necessary for the controller to comply with a legal obligation under the law of the Member State or of the Union, the data subject has no right to erasure; this applies, for example, to an employee’s sick leave days.

For example, the order record transmitted to a collection agency is also subject to the retention requirement under paragraph 132(1) of the Federal Tax Code (BAO) or paragraph 212 of the Austrian Commercial Code (UGB) as a business letter. This is therefore a catch-all provision that specifically targets retention obligations under commercial and tax law. However, it may also encompass retention obligations under health, budgetary, or archival law. The Data Act does not impose any specific obligations regarding the storage or erasure of data (see Haidinger in Knyrim, DatKomm article 17, GDPR, Marg. No. 70 [as of July 1, 2024, rdb.at]). Furthermore, Article 17(3)(e) of the GDPR clarifies for all types of data that, where the conditions for asserting, exercising, or defending legal claims are met, the controller is under no obligation to carry out erasure of the data.Furthermore, article 17(3)(e) of the GDPR clarifies, with respect to all types of data, that the controller is under no obligation to carry out erasure if the conditions for asserting, exercising, or defending legal claims are met.

In accordance with the case law of the CJEU, any processing of personal data must, as a general rule, comply with the principles set forth in Article 5 of the GDPR regarding the processing of personal data and with one of the principles listed in Article 6 of the GDPR regarding the lawfulness of data processing (regarding the predecessor provision, Art. 6 of the Data Protection Directive: CJEU, May 20, 2003, joined cases C-465/00, C-138/01, and C-139/01, Österreichischer Rundfunk et al., para. 65; Dec. 16, 2008, C-524/06, Huber, para. 48). In accordance with the case law of the CJEU, any processing of personal data must, as a general rule, comply with the principles set forth in Article 5, GDPR regarding the processing of personal data and one of the principles set forth in Article 6 of the GDPR regarding the lawfulness of data processing (regarding the predecessor provision, Article 6 of the Data Protection Directive: CJEU May 20, 2003, Joined Cases C-465/00, C-138/01, and C-139/01, Österreichischer Rundfunk et al., para. 65; Dec. 16, 2008, C-524/06, Huber, para. 48).

With regard to the lawfulness of the processing of personal data, Article 6(1) of the GDPR contains an exhaustive and definitive list of six cases (regarding the predecessor provision, Article 7 of the Data Protection Directive: CJEU Nov. 24, 2011, Joined Cases C-468/10 and C-469/10, ASNEF, para. 30 et seq.; Oct. 19, 2016, C-582/14, Breyer, para. 57). Article 6(1) of the GDPR contains an exhaustive and definitive list of six cases governing the lawfulness of the processing of personal data (regarding the predecessor provision, Article 7 of the Data Protection Directive: CJEU Nov. 24, 2011, joined cases C-468/10 and C-469/10, ASNEF, para. 30 et seq.; Oct. 19, 2016, C-582/14, Breyer, para. 57). For the present case, this means: First, it must be noted that the parties involved process the complainant’s personal data within the meaning of Art. 4(1) of the GDPR. It is undisputed that the parties involved are to be classified as controllers within the meaning of Article 4(7) of the GDPR.

In the present case, it must first be noted that the parties involved process the complainant’s personal data within the meaning of Article 4(1) of the GDPR. It is undisputed that the parties involved are to be classified as controllers within the meaning of article 4(7) of the GDPR. It must therefore be examined whether the parties involved can base their processing on the legal basis of legitimate interests under Article 6(1)(f) of the GDPR. It must therefore be examined whether the parties involved can base their processing on the legal basis of legitimate interests under article 6(1)(f) of the GDPR. The processing of personal data under Article 6(1)(f) of the GDPR is lawful if three cumulative conditions are met: First, the controller or a third party must have a legitimate interest; second, the processing of personal data must be necessary to fulfill that legitimate interest; and third, the interests or fundamental rights and freedoms of the data subject not outweigh the legitimate interest of the controller or a third party (see CJEU, Jan. 9, 2025, C-394/23, Mousse, para. 45 et seq.).The processing of personal data pursuant to Article 6(1)(f) of the GDPR is lawful if three cumulative conditions are met: First, the controller or a third party must have a legitimate interest; second, the processing of the personal data must be necessary to fulfill that legitimate interest; and third, the interests or fundamental rights and freedoms of the data subject not outweigh the legitimate interest of the controller or a third party—see CJEU, Jan. 9, 2025, C-394/23, Mousse, para. 45 et seq.).

Regarding legitimate interest: In the absence of a definition of the term “legitimate interest” in the GDPR, a broad spectrum of interests may, in principle, be considered legitimate. The EU legislature has not required, in this regard, that a controller’s interest must be regulated by law. However, the term “legitimate interest” within the meaning of Article 6(1)(f) of the GDPR—even if it is not limited to interests that are enshrined in law and specifically defined—requires that the legitimate interest invoked be lawful (see CJEU, Oct. 4, 2024, C-621/22, Koninklijke Nederlandse Lawn Tennisbond, para. 38 et seq.).In the absence of a definition of the term “legitimate interest” in the GDPR, a broad spectrum of interests may, in principle, be considered legitimate. The EU legislature has not required in this regard that a controller’s interest must be regulated by law. However, the term “legitimate interest” within the meaning of article 6(1), (f) of the GDPR—even though it is not limited to interests that are legally established and specific—that the legitimate interest invoked must be lawful (see CJEU, Oct. 4, 2024, C-621/22, Koninklijke Nederlandse Lawn Tennisbond, para. 38 et seq.).

According to the case law of the CJEU, the assertion, exercise, or defense of legal claims constitutes a legitimate interest (see CJEU, June 17, 2021, C-597/19, para. 108 et seq.). Thus, in the present case, the existence of a legitimate interest must in principle be affirmed for both the first and second parties involved, as they are involved in data protection proceedings. Furthermore, the complainant had already threatened legal consequences in his application to the first party involved should the first party fail to comply exactly with the “data protection provisions” specified by the complainant. According to the case law of the Court of Justice, the assertion, exercise, or defense of legal claims constitutes a legitimate interest (see CJEU, June 17, 2021, C-597/19, para. 108 et seq.). Thus, in the present case, the existence of a legitimate interest must generally be affirmed for both the first co-respondent and the second co-respondent, as they are involved in proceedings concerning data protection law.

Furthermore, the complainant had already threatened legal consequences in his application to the first party involved should the first party fail to comply exactly with the “data protection provisions” specified by the complainant. In addition, there are legal grounds for processing data in job application procedures, as applicants could, following an application process, assert claims under the Equal Treatment Act (Section 26, para 1 and 5, GlBG in conjunction with Section 29, para 1, GlBG), which is why the party initially involved has a legitimate interest in retaining application documents for a certain period of time.Furthermore, there are legal grounds for processing data in recruitment procedures, as applicants could, for example, assert claims under the Equal Treatment Act (Section 26, paragraphs 1 and 5, GlBG in conjunction with Section 29, paragraph 1, GlBG), which is why the first party involved has a legitimate interest in retaining application documents for a certain period of time.

Regarding Necessity: With regard to the necessity of processing personal data to realize the legitimate interest, it must be examined whether the legitimate interest in processing the data cannot be achieved just as effectively, in a reasonable manner, by other means that interfere less significantly with the fundamental rights and freedoms of the data subjects, whereby such processing must take place within the limits of what is strictly necessary to realize this legitimate interest. The requirement of necessity must be assessed in conjunction with the principle of data minimisation under Article 5(1)(c) of the GDPR and requires that personal data be adequate, relevant, and limited to what is necessary for the purposes of the processing (see CJEU Jan. 9, 2025, C-394/23, Mousse, para. 48 et seq.). With regard to the necessity of processing personal data to pursue the legitimate interest, it must be assessed whether the legitimate interest in processing the data cannot be achieved just as effectively, by reasonable means, through other measures that interfere less significantly with the fundamental rights and freedoms of the data subjects, provided that such processing takes place within the limits of what is strictly necessary to realize that legitimate interest.

The requirement of necessity must be examined in conjunction with the principle of data minimisation under article 5(1)(c) GDPR, and requires that personal data be appropriate and relevant to the purpose and limited to what is necessary for the purposes of the processing (see CJEU, Jan. 9, 2025, C-394/23, Mousse, para. 48 et seq.). It is not apparent here how the first party involved could defend itself in the event of a complaint against the job assignment without the complainant’s specific data (resume, correspondence with the complainant, application documents). For the second party involved, this information is indispensable given its functional relationship to the first party involved. The fact that the complainant has suggested he would refrain from filing such a complaint in the event of erasure does not alter this. Since the involved parties have also limited the processing of personal data to what is strictly necessary, the criterion of necessity is likewise met.

Regarding the balancing of interests: In a further step, as part of the balancing of interests, it must be examined how the interests of the respective parties relate to one another. As a general rule in this assessment, a minor and not particularly compelling interest of a controller is usually only to be given greater weight than the interests and rights of the data subject if the impact on those interests and rights is minimal. The more important and compelling the controller’s legitimate interests are, the more significant an infringement on the data subject’s interests and rights can be justified. Protective measures to mitigate disproportionate consequences for data subjects must also be taken into account here, as they play a special role in the balancing test. Furthermore, the balancing of interests must always be conducted from an objective perspective. The balancing of interests concludes with an assessment of the controller’s legitimate interests on the one hand and an impact assessment regarding the data subject’s interests and rights on the other.

An important and quite helpful interpretive guide for this balancing can be found in Recital 47, sentence 1: “In doing so, the reasonable expectations of the data subject, based on their relationship with the controller, must be taken into account.” Sentence 4 of the same Recital also points in the same direction: “In particular, when personal data are processed in situations in which a data subject would not reasonably expect further processing, the interests and fundamental rights of the data subject could outweigh the interests of the controller.” When considering what constitutes the data subject’s reasonable expectations in the respective processing context, the decisive factor is whether, at the time of data collection and taking the circumstances into account, the data subject could reasonably have expected that data processing would take place for a specific purpose. More specifically, Braun/Hasenauer (Yearbook of Data Protection Law 2018, 34) add as a further criterion that the factual connection between the essential core of the relationship between the data subject and the controller is decisive.

The closer and more typical this connection is given the circumstances, the more the data subject must reasonably expect the processing to take place (see Jahnel, Commentary on the General Data Protection Regulation, Art. 6 GDPR, paras. 77–79 [as of Dec. 1, 2020, rdb.at]). An important and quite helpful interpretive guide for this balancing test can be found in Recital 47, sentence 1: “In this context, the reasonable expectations of the data subject, based on their relationship with the controller, must be taken into account.” Sentence 4 of the same Recital also points in the same direction: “In particular, where personal data are processed in situations in which a data subject would not reasonably expect further processing, the interests and fundamental rights of the data subject could outweigh the interests of the controller.” When considering what constitutes the data subject’s reasonable expectations in the respective processing context, the decisive factor is whether, at the time of data collection and taking the circumstances into account, the data subject could reasonably have expected that data processing would take place for a specific purpose.

More specifically, Braun/Hasenauer (Yearbook of Data Protection Law 2018, 34) add as a further criterion that the factual connection between the essential core of the relationship between the data subject and the controller is decisive. The closer and more typical this connection is given the circumstances, the more likely the data subject is to reasonably expect the processing—see Jahnel, Commentary on the General Data Protection Regulation, article 6, GDPR, Marginal Notes 77–79 [as of Dec. 1, 2020, rdb.at]). In this context, it must be assumed that, as part of the balancing of interests to be conducted on a case-by-case basis, the complainant’s interest in the (premature) erasure of his personal data must be weighed against the interest of the other parties involved in defending themselves against the legal claims asserted by the complainant. In the present case, on the one hand, the complainant was aware that by transferring his application documents, his personal data would be processed by the first party involved.

On the other hand, it was already clear to him at the time he submitted his application that the first party involved would have to perform this processing beyond the application process, because he actively sought to prevent precisely the continued processing at issue here for seven months. If the complainant now argues that he would not have submitted his documents to the first co-respondent had he known that they would be stored for an extended period after the conclusion of the application process, it must be pointed out to him that he was aware of the relevant processing purpose and that he not only should have anticipated such storage but apparently even accepted it (since he sought to thwart it by including his supplement), especially since the retention of application documents is required by law. For these reasons, the legitimate interests of the other parties involved outweigh the complainant’s fundamental rights and freedoms, and in the present case, the processing of the complainant’s personal data may be based on the provision of Article 6(1)(f) of the GDPR.

For these reasons, the legitimate interests of the other parties involved outweigh the complainant’s fundamental rights and freedoms, and in the present case, the processing of the complainant’s personal data may be based on article 6(1)(f) of the GDPR. Since the complainant’s personal data is therefore not being processed unlawfully in the present case, the elements of Article 17(1)(d) of the GDPR are also not met. The adjudicating panel further concurs with the view expressed by the respondent authority in the contested decision, according to which the remaining elements of Article 17(1) of the GDPR are also not applicable in the present case.Since the complainant’s personal data is not being processed unlawfully in this case, the conditions of Article 17(1)(d) of the GDPR are also not met. The adjudicating panel further concurs with the view expressed by the respondent authority in the contested decision, according to which the remaining elements of article 17(1) of the GDPR are also not applicable in the present case. 3.6.

Insofar as the complainant alleges that he was not adequately informed about the continued processing (following the rejection of his application), it should first be noted that he initially provided this data voluntarily and in his own interest (job application). The purpose and scope of this processing were also known to him at the time of submission, as is clearly evident from the job application and its attachments. However, it was equally clear to him that further processing would/must take place to a limited extent. In addition, this information is also available on the homepage of the portal the complainant used to obtain information. This was communicated to him along with the rejection of his application and, in terms of content, meets the criteria of Article 13 of the GDPR. As the authority correctly stated, such information must be provided only when the further or modified processing begins.

However, it does not need to be provided prior to the original processing. Consequently, the further processing by the first party involved, effective January 24, 2024, is in compliance with the law, which extends to the processing by the second party involved (acting on the first party’s behalf).He was informed of this along with the rejection of his application, and the content of this notice meets the criteria of article 13 of the GDPR. As the authority correctly stated, such information must be provided only once the further or modified processing begins. However, it does not need to be provided prior to the original processing. Thus, the further processing by the first party involved as of January 24, 2024, is in compliance with the law, which extends to the processing carried out by the second party involved (acting on the first party’s behalf). Insofar as the complainant assumes tacit acceptance of his personal data protection rules (as set forth in the application supplement), this consideration need not be addressed in further detail.

In the present case, the (further) processing is carried out on the basis of statutory provisions and obligations that cannot be waived under civil law. Insofar as the complainant assumes that there was a duty to provide information regarding (any) further processing as early as January 13, 2024, this is again an error. Even if the position had been awarded to the complainant, a change in the processing would have occurred—albeit for different reasons (such as the preparation of an employment contract, a personnel file, etc.). However, the controller cannot be required to inform the complainant of all potentially relevant changes to the processing purpose at the time of the (incidentally, voluntary) transfer of the complainant’s data. Rather, in accordance with the case law cited by the Data Protection Authority, the specific further or modified processing of the data must be explained accordingly. 3.7.

Since the complainant’s personal data is therefore not being processed unlawfully in the present case, there is no obligation to erase the data under Article 17(1)(d) of the GDPR. The adjudicating panel further concurs—in accordance with the arguments of the respondent authority in the contested decision—that the remaining provisions of Article 17(1) of the GDPR are also not applicable in the present case.3.7. Since the complainant’s personal data is not being processed unlawfully in the present case, there is no obligation to erase the data under Article 17(1)(d) of the GDPR. The adjudicating panel further concurs—in accordance with the reasoning of the respondent authority in the contested decision—with the view that the remaining grounds set forth in article 17(1) of the GDPR are also not applicable in the present case. In addition, the processing by the parties involved is necessary, pursuant to Article 17(3)(e) of the GDPR, for the establishment, exercise, or defense of legal claims, as they are already (at least) involved in a data protection proceeding.

Furthermore, the processing by the co-respondents is necessary, pursuant to article 17(3)(e) of the GDPR, for the establishment, exercise, or defense of legal claims, as they are already (at least) involved in data protection proceedings. Since, for these reasons, the contested decision is not unlawful within the meaning of Art. 130(1)(1) B-VG, the complaint filed against it was dismissed pursuant to § 28(2) VwGVG in conjunction with § 24(1) and (5) DSG.Since, for these reasons, the contested decision is not unlawful within the meaning of article 130, paragraph 1, item 1, of the B-VG, the complaint filed against it had to be dismissed pursuant to Section 28(2) of the VwGVG in conjunction with Section 24(1) and (5) of the DSG. 3.8. Regarding the complainant’s other claims: The Administrative Court’s jurisdiction is generally limited to the legal review of the (administrative) decisions challenged in the complaint, the content or subject matter of which is in turn defined by the complaint initiating the proceedings.

A party has no subjective right to dictate to the Court the nature or course of the proceedings; therefore, such motions must be dismissed as inadmissible. The same applies to an investigation into case officers of the Data Protection Authority based on alleged bias or “Surveillance” or “Instruction” of such case officers. First, there is no corresponding legal basis for the requested compensation. Furthermore, the amount of work involved in a proceeding with minimal costs does not in and of itself constitute “damages” eligible for compensation—all the more so since, in this case, the complainant has not prevailed on the merits. For the sake of completeness, it should merely be noted that pleadings in court proceedings are not subject to “copyright” and do not constitute “intellectual property” in the sense that the Court would be prohibited from quoting from them or storing and processing them in accordance with (procedural) legal requirements. 3.9.

Conduct of an Oral Hearing Pursuant to § 24(1) VwGVG, the Administrative Court must conduct a public oral hearing upon request or, if it deems it necessary, on its own motion.Pursuant to paragraph 24(1) of the VwGVG, the administrative court must conduct a public oral hearing upon request or, if it deems it necessary, on its own initiative. Pursuant to § 24(4) VwGVG, the administrative court may refrain from holding a hearing, regardless of a party’s request, if the case file indicates that an oral hearing is unlikely to provide further clarification of the matter and if the omission of the hearing does not conflict with either Art. 6(1) of the Convention for the Protection of Human Rights and Fundamental Freedoms nor Art. 47 of the Charter of Fundamental Rights.Pursuant to Section 24(4) of the VwGVG, the Administrative Court may dispense with a hearing regardless of a party’s motion if the case file indicates that an oral hearing is unlikely to provide further clarification of the matter, and neither Article 6, paragraph 1, of the Convention for the Protection of Human Rights and Fundamental Freedoms nor Article 47 of the Charter of Fundamental Rights precludes the omission of a hearing.

Neither does the decision at issue deviate from the Administrative Court’s previous case law, nor is there a lack of case law; furthermore, the Administrative Court’s existing case law cannot be regarded as inconsistent. Nor are there any other indications that the legal issue at hand is of fundamental importance. Rather, the processing of personal data took place in connection with a labor law protection framework defined by the legislature, which provides for avenues of appeal in the context of job placements. The fact that these protections cannot be circumvented by civil law contracts (and certainly not by those that are said to have been concluded “implicitly”—for example, in the sense of “acceptance by silence”) already follows from the fundamental structure of the rule of law.