The data subject was a customer of a bank (controller)

Date of Decision June 10, 2026 Legal Provision B-VG Art. 133(4) DSG §1(1) DSG §1(2) DSG §24 GDPR Art. 4(1) GDPR Art. 4(10) GDPR Art. 4(2) GDPR Art. 4(7) GDPR Art. 4(9) GDPR Art. 5 GDPR Art. 6 FM-GwG § 21 FM-GwG § 5 FM-GwG § 6 VwGVG § 28(1) VwGVG §31(1) B-VG Art. 133 (currently in effect from January 1, 2019, to May 24, 2018), last amended by BGBl. I No. 138/2017 B-VG Art. 133 effective as of January 1, 2019, last amended by BGBl. I No. 22/2018 B-VG Art. 133 effective from May 25,May 2018 through December 31, 2018; last amended by Federal Law Gazette I No. 22/2018; B-VG Art. 133, effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164/2013, B-VG Art. 133, effective from Jan. 1, 2014, to July 31, 2014, last amended by Federal Law Gazette I No. 51/2012 Federal Constitutional Law (B-VG) Art. 133, effective from January 1, 2004, through December 31, 2013, last amended by Federal Law Gazette (BGBl.)

The Federal Administrative Court, with Judge Mag. Herwig ZACZEK presiding and the expert lay judges Mag. René BOGENDORFER and Mag. Matthias SCHACHNER serving as associate judges, having considered the complaint filed by XXXX against the decision of the Data Protection Authority dated XXXX, XXXX (intervening party: XXXX), in a closed session, has lawfully ruled as follows: The Federal Administrative Court, with Judge Mag. Herwig ZACZEK presiding and the expert lay judges Mag. René BOGENDORFER and Mag. Matthias SCHACHNER as associate judges, has ruled in a closed session on the complaint filed by Roman numeral 40 against the decision of the Data Protection Authority dated Roman numeral 40, Roman numeral 40 (co-party: Roman numeral 40): A) The complaint against points 1 and 2 of the ruling is granted, and I. Points 1a and 1b of the ruling are amended to read as follows: Roman numeral one. Points 1a and 1b are amended to read as follows: “1.a.

The complaint regarding the alleged violation of the right to confidentiality under § 1 DSG, in that the controller processed the data subject’s telephone number during and after the contractual relationship through four attempted calls as well as through continued storage after the termination of the contract, and b) processed the data subject’s email address both during and after the contractual relationship was in effect, is dismissed as unfounded.“1.a. The complaint regarding the alleged violation of the right to privacy pursuant to Paragraph 1 of the DSG, in that the controller processed the data subject’s telephone number during and after the term of the contractual relationship through four attempted calls as well as through continued storage after the termination of the contract, and b) processed the data subject’s email address both during and after the contractual relationship was in effect, is dismissed as unfounded. 1.b.

The complaint regarding the alleged violation of the right to privacy pursuant to § 1(1) of the DSG is upheld, and it is determined that the controller violated the data subject’s right to privacy by processing the data subject’s name and address information for the purpose of mailing a letter on April 27,2022 and a debit card on May 11, 2022,”1.b. The complaint regarding the alleged violation of the right to confidentiality pursuant to Section 1, paragraph 1, of the DSG is upheld, and it is determined that the controller violated the data subject’s right to confidentiality by processing their name and address data for the purpose of sending a letter by mail on April 27, 2022, and an ATM card (debit card) on May 11, 2022, processing took place.” II. Ruling 2. is omitted without replacement. Roman numeral two. Ruling 2. is omitted without replacement. III. The appellant’s request for reimbursement of her litigation costs is dismissed as inadmissible.

Roman numeral three. The appellant’s request for reimbursement of her litigation costs is dismissed as inadmissible. B) The appeal is inadmissible pursuant to Article 133, paragraph 4, B-VG. The appeal is inadmissible pursuant to Article 133, paragraph 4, B-VG. Text Reasons for the Decision: I. Course of Proceedings: Roman numeral one. Course of Proceedings: 1. In a (initiating) petition (data protection complaint) dated May 23, 2022, the intervening party alleged a violation of the right to confidentiality by the complainant and, in summary, argued as follows: The controller is a bank with which the data subject had been in a contractual relationship as a bank customer until April 15, 2022. After the customer relationship ended, the data subject repeatedly requested the controller to cease data processing. Nevertheless, on April 27, 2022, the controller sent the data subject a letter titled “Planned Changes for 2022: Debit Card Terms and Conditions,” and on May 11, 2022, mailed her an ATM card.

In response, the data subject submitted a request for information to the controller on April 29, 2022, and, in a letter dated May 13, 2022, prohibited the use of her personal data. To make matters worse, the complainant had already revoked her consent to the storage of her email address and phone number and requested the erasure while the contractual relationship was still in effect. However, the respondent violated this by, for example, sending an email on February 3, 2022, and making various phone calls. The phone number was last unlawfully used on May 16, 2022. It is noted that the data protection violations were the decisive factor for the complainant in terminating the contractual relationship. The account was closed on April 15, 2022. She requests that the Data Protection Authority act immediately and “appropriately” penalize the violations. A bundle of documents was attached to the submission. 2.

At the request of the authorities, the controller made the following submissions in the proceedings before the respondent authority, insofar as they are relevant to the administrative court proceedings: 2.1. A valid customer relationship with the data subject existed until April 2022; as a customer, she was served by the “Advisory Center,” which is a location-independent support team for the bank’s private and business customers. 2.2. On February 1, 2022, the data subject personally submitted a document at a branch of the controller in which she stated that she was revoking her “consent to the storage” of her email address and phone number, that their data should be deleted, and that all further notifications must be sent by mail. 2.3. The data subject’s customer advisor at the time subsequently noted in the system that the data protection consent for certain purposes not required for business purposes had been set to “No.”

Consent to receive marketing communications had also been set to “No.” On February 3, 2022, the data subject’s account manager attempted to contact her by phone to inform her that there could be urgent, business-related matters in which the bank, as the controller, would need to reach its customers quickly—for example, by phone. This would be the case, for example, if fraud were suspected. However, he was unable to reach the data subject. On the same day, he also sent an email to the data subject, but for a (different) business-related reason; specifically, the data subject had used an account designated as private for business purposes, in violation of the contract. Since the data subject did not respond to this either, the same letter was sent by mail on February 15, 2022, again without a response from the data subject. On March 14, 2022, the data subject appeared in person at a branch because she wished to terminate her business relationship with the controller.

Although the data subject was not served at the aforementioned branch, the staff present there processed the transfer of her securities to another bank. However, the account could not be closed due to an outstanding fee of EUR 48.95. The data subject refused to pay this amount and requested that her account manager contact her; in accordance with this request, she was contacted by phone on March 15, 2022. Since she could not be reached by phone, the relevant documents were sent to her by mail; however, she did not respond. In early April 2022, a letter dated March 31, 2022, was received by mail, in which the data subject complained, among other things, about the aforementioned fees. To resolve the matter quickly, the account manager attempted to reach her by phone, again without success. To “put an end to the matter,” the controller decided to waive the outstanding amount “as a gesture of goodwill.”

On April 15, 2022, the data subject’s account was closed. Unfortunately, the account closure coincided with the “COVID-related” extended lead time for mailing the new terms and conditions for debit cards as well as for producing the new debit cards, which is why the letter and a new card were sent to the data subject. Finally, a request for information from the data subject was received on May 6, 2022, followed by a request for erasure on May 13, 2022. Out of a desire to provide good service, the account manager attempted to inform the data subject by phone on May 16, 2022, that the letters had been received. 2.4. From a legal standpoint, it is noted that the allegations made by the data subject are unfounded. All of the phone calls or emails she complained about were made for business reasons and were, in part, a result of her own conduct, which was in breach of contract. However, the company offers its apologies for the delay in sending the debit card and the letter.

This was merely an “unfortunate” overlap in timing (due to the coronavirus pandemic). That said, the use of the email address and phone number for business-related correspondence does not require the data subject’s consent. To the extent that the withdrawal of consent pertained to contact for marketing purposes, it has been honored. Neither the GDPR nor the Telecommunications Act grants a data subject the right to dictate a specific form of communication to an enterprise. It is necessary for the performance of a contract and also to safeguard the legitimate interests of a credit institution to contact its customers by phone or email in certain circumstances. 3. In the decision at issue in these proceedings, the respondent authority—insofar as still relevant to the complaint proceedings—ruled as follows: “The Data Protection Authority makes a decision on the data protection complaint filed by XXXX (complainant) on XXXX, supplemented on XXXX, against Erste Bank of XXXX (respondent) regarding an alleged violation of the right to confidentiality as follows:“The Data Protection Authority makes a decision on the data protection complaint filed by Roman numeral 40 (complainant) on Roman numeral 40, supplemented on Roman numeral 40, against Erste Bank of Roman numeral 40 (respondent) regarding an alleged violation of the right to confidentiality as follows: 1.

The complaint is partially upheld, and it is determined that the respondent violated the complainant’s right to privacy by a. unlawfully processed the complainant’s telephone number during and after the contractual relationship by making four call attempts not necessary for the fulfillment of the contract, as well as by unlawfully conducting prolonged storage of the data beyond the termination of the contract; b. unlawfully used and stored the complainant’s email address both during and after the contractual relationship; c. unlawfully processed the complainant’s name and address data for the purpose of mailing a letter on April 27, 2022, and a debit card on May 11, 2022. 2. The respondent is ordered to completely delete the complainant’s telephone number and email address stored by the respondent within a period of 4 weeks, subject to enforcement if this order is not complied with. 3. In all other respects, the complaint is dismissed as unfounded. 4. – 6. [ … ]” 3.1.

In support of its decision, the respondent authority states, in summary, that a valid contractual relationship (checking account and securities account) existed between the data subject as a customer and the controller as a (banking) service provider until April 15, 2022. The collection and storage of the telephone number and email address were therefore to be assessed in light of the necessity in connection with the provision of contractual services (Art. 6(1)(b) GDPR).3.1. In support of its decision, the respondent authority summarizes that a valid contractual relationship (checking account and securities account) existed between the data subject as a customer and the controller as a (banking) service provider until April 15, 2022. The collection and storage of the telephone number and email address—were therefore to be assessed in light of the necessity in connection with the provision of contractual services (article 6(1)(b) of the GDPR). 3.2.

However, in the opinion of the respondent authority, the attempted calls complained of by the data subject in this proceeding—all constituted uses of data that were not strictly necessary for the controller to fulfill its contractual obligations; namely, the “service philosophy” cited by the controller as justification for the use of the telephone number was to be considered insufficient in light of the narrow interpretation of Article 6(1)(b) of the GDPR (as required from the perspective of the Data Protection Authority). Nor does a balancing of interests pursuant to Article 6(1)(f) of the GDPR favor the controller, since the bank had not provided a detailed justification for the existence of a legitimate interest in providing verbal explanations in connection with the termination of the contract, nor could the data subject have reasonably expected, following their explicit request for the erasure of their phone number, to be contacted again by the bank by phone immediately thereafter. 3.2.

However, in the opinion of the authority in question, the attempted calls complained of by the data subject in this proceeding—all constitute uses of data that were not strictly necessary for the performance of the controller’s contract; namely, the “service-oriented approach” invoked by the controller as a justification for using the telephone number was not to be considered sufficient in light of the narrow interpretation (required from the perspective of the Data Protection Authority) of article 6(1)(b) of the GDPR. Nor did a balancing of interests pursuant to Article 6(1)(f) of the GDPR favor the controller, since the bank had not provided a more detailed justification for the existence of a legitimate interest in verbal explanations regarding the termination of the contract, nor could the data subject have expected, following their explicit request for the erasure of their phone number, to be contacted again by phone by the bank immediately thereafter. 3.3.

When the controller invokes the statutory provisions of Section 21(1) of the FM-GwG, according to which copies of documents and information received from customers that are necessary for fulfilling the due diligence obligations under the FM-GwG toward customers must be retained for a period of ten years following the termination of the business relationship with the customer, the controller overlooks the fact that this provision applies to (specific) due diligence obligations under the FM-GwG — the prevention of money laundering and terrorist financing. The controller did not provide a detailed justification for the (ongoing) storage of the telephone number for these purposes, nor was such a justification apparent to the Data Protection Authority. 3.3. If the controller invokes the statutory provisions in Section 21, paragraph 1, of the FM-GwG, according to which copies of documents and information received from customers that are necessary for fulfilling the due diligence obligations under the FM-GwG with respect to customers must be retained for a period of ten years after the termination of the business relationship with the customer, the controller overlooks the fact that this provision is aimed at (specific) due diligence obligations under the FM-GwG—the prevention of money laundering and terrorist financing.

The controller did not provide a detailed justification for the (long-term) storage of the telephone number for these purposes, nor was such a justification apparent to the Data Protection Authority. 3. 4. In the opinion of the authority in question, the situation is similar with regard to the (more general) retention obligation under § 212 UGB, according to which enterprises must retain their books, business correspondence received, copies of business correspondence sent, and supporting documents for accounting entries (accounting documents) for seven years; however, the controller has at no time demonstrated in this regard (nor is it apparent to the Data Protection Authority) to what extent the obligation under § 212 UGB could also encompass a telephone number.3. 4. In the opinion of the respondent authority, the situation is similar with regard to the (more general) retention obligation under Section 212 of the UGB, according to which enterprises must retain their books, business correspondence received, copies of business correspondence sent, and supporting documents for accounting entries (accounting documents) for seven years; however, the controller has at no time demonstrated (nor is it apparent to the Data Protection Authority) to what extent the obligation under § 212 of the Austrian Commercial Code (UGB) could also encompass a telephone number. 3.5.

The (four) attempted calls at issue in this proceeding, which took place during an active contractual relationship, thus constituted unlawful processing of the data subject’s telephone number. Furthermore, the continued storage of the telephone number after the termination of the contract was not covered by Section 21 of the Financial Market Act (FM-GwG), Section 212 of the Austrian Commercial Code (UGB), or any other legal basis, and was therefore also unlawful. 3.5. The (four) attempted calls at issue during the term of the contractual relationship thus constituted processing of the data subject’s telephone number without a legal basis. Furthermore, the continued storage of the telephone number after the termination of the contract is not covered by Section 21 of the FM-GwG, nor by Section 212 of the UGB, nor by any other legal basis, and is therefore also unlawful. 3.6. With regard to the processing of the email address, the respondent authority takes the view—unlike with the phone number—that this is not a piece of data that was absolutely necessary at any point in time for the respondent to fulfill its contractual obligations.

Although the use of an email address may ensure that customers can be reached somewhat more quickly than by mail, this circumstance does not reach the level of necessity that would indicate a requirement within the meaning of Art. 6(1)(b) of the GDPR.Although the use of an email address may ensure that customers can be reached somewhat more quickly than by mail, this circumstance does not reach the level of necessity that would indicate a requirement within the meaning of article 6(1)(b) of the GDPR. In the absence of necessity (and proportionality), no different conclusion can be drawn from Article 6(1)(f) of the GDPR. With regard to “preventing fraud” as a legitimate interest, reference should be made to Recital 47, sentence 6 of the GDPR, according to which data processing for the purpose of combating fraud may only take place to the “extent strictly necessary.” The processing of the email address is therefore unlawful—in the absence of a legal basis under Article 6(1) of the GDPR.In the absence of necessity (and proportionality), no other conclusion can be drawn from article 6(1)(f) of the GDPR either.

With regard to “prevention of fraud” as a legitimate interest, reference should be made to Recital 47, sentence 6 of the GDPR, according to which data processing for the purpose of combating fraud may only take place to the “extent strictly necessary.” The processing of the email address is therefore unlawful—in the absence of a legal basis under article 6(1) of the GDPR. Since the storage of the phone number was no longer necessary after the termination of the contract (Art. 17(1)(a) GDPR) —and since the processing of the email address was already unlawful on its merits (Article 17(1)(d) of the GDPR)—the controller should have been ordered to carry out the erasure of the data in question.Since the storage of the phone number was no longer necessary after the termination of the contract (Article 17, paragraph 1, subparagraph a, GDPR)—and the processing of the email address was already unlawful on its merits (Article 17(1)(d) of the GDPR)—the controller should have been ordered to carry out the erasure of the relevant data. 4.

In the complaint filed against this decision on XXXX, the appellant (and data controller) first challenges the legal findings in the contested decision regarding the processing of the co-party’s email address. According to the complainant, the respondent authority never raised the issue during the proceedings that, in its view, the processing of the email address had been unlawful “from the outset.” The co-party itself, in its data protection complaint to the respondent authority, relied exclusively on the period following its “revocation,” but never on the processing of the email address that had taken place prior to that time. 4. In the complaint filed against this decision on Roman numeral 40, the appellant (and data controller) first challenges the legal findings in the contested decision regarding the processing of the co-party’s email address. Accordingly, the respondent authority never raised the issue during the proceedings that, in its view, the processing of the email address would have been unlawful “from the outset.”

The co-party itself, in its data protection complaint to the respondent authority, relied exclusively on the period following its “revocation,” but never on the processing of the email address that took place prior to that. The subject matter of the proceedings [before the respondent authority] was therefore the specific email messages sent starting in February 2022, but not the prior processing operations, such as the initial collection of the email address. The Data Protection Authority’s assertions—that there was never a legal basis within the meaning of Article 6(1) of the GDPR for the processing of the email address—are surprising in this regard; the co-respondent itself had in fact confirmed in January 2021 that certain contractual provisions might be sent to it via email in connection with the opening of an account, and the complainant refers in this regard to Exhibit ./2 attached to the complaint.

The relevant legal finding by the responding authority is therefore incorrect. The Data Protection Authority’s statements, according to which there was at no time a basis for processing the email address within the meaning of Article 6(1) of the GDPR, are surprising in this regard; the co-respondent itself had in fact confirmed in January 2021 that certain contractual provisions could be sent to it via email in connection with the opening of an account, and the complainant refers in this regard to Exhibit ./2 attached to the complaint. The respondent authority’s legal finding in this regard is therefore incorrect. With regard to the respondent authority’s legal finding that the (ongoing) storage of the telephone number and email address was unlawful, the complainant states, with reference to the provision of § 21 FM-GwG, as summarized below: With regard to the respondent authority’s legal finding that the (ongoing) storage of the telephone number and email address was unlawful, the complainant, referring to the provision of Section 21 of the FM-GwG, states as summarized below: In the complainant’s view, the retention requirement under para 21(1)(1) of the FM-GwG applies, among other things, to “copies of the documents and information received that are necessary for fulfilling customer due diligence obligations.”

While accuracy requires acknowledging that the FMA distinguishes between “necessary” and “additional information,” with email addresses and telephone numbers falling into the latter category (FMA, Circular on Due Diligence Obligations, paras. 51–53); it is incorrect, however—as the responding authority has concluded—to infer from this that email addresses and telephone numbers are not covered by the cited retention obligation in the present case. The FMA does not distinguish between “necessary” and “not necessary”; thus, its classification does not imply any hierarchical ranking of the information: According to the FMA circular, “occupation, employer, or type of self-employment, citizenship, country of birth, and signature” are also considered additional information, just like the email address and phone number. In any case, there is no doubt that citizenship, signature, etc., are personal data that fall under the provisions of Section 21 of the FM-GwG and must therefore be retained accordingly, meaning that all other “additional information” is also subject to the relevant retention period.

In any case, there is no doubt that citizenship, signature, etc., are personal data that fall under the provisions of Section 21, FM-GwG and must therefore be retained accordingly, meaning that all other “additional information” is also subject to the relevant retention period. If the data in question was collected during the course of the business relationship and is still available at the end of the business relationship, it is also subject to the retention obligations under the FM-GwG. Furthermore, it should be noted that the need to file a report of suspected money laundering may still arise even after the business relationship has ended. For this purpose, the Republic of Austria provides a dedicated portal, the so-called “goAML” platform of the BMI/Federal Criminal Police Office. The telephone number and email address of the affected customers must be entered as required (Appendix ./4) and submitted to the authority.

On February 1, 2022, the co-party personally submitted a handwritten letter at a branch of the complainant with the following content [reproduced to the extent relevant to the proceedings]: “[...] Dear Sir or Madam, I hereby revoke my consent to the storage of the following personal data: - Email address - Phone number and request that you delete this information immediately and send all further notifications exclusively by mail to the postal address listed above, which is known to you [...]” The letter was forwarded by the branch employees to the complainant’s “Advisory Center” (internal), which was responsible at that time for serving the co-party as a bank customer. The employee responsible for customer service regarding the party involved selected “No” in the bank’s internal data management system under “Processing of data for specific, non-business-related purposes” as well as under “Consent to receive marketing messages.” 1.4.

On May 11, 2022, the co-party received a debit card from the bank issued in their name. The mailing of the aforementioned informational letter and the debit card to the co-party was prepared or arranged by the bank even before the termination of the contractual relationship between the bank and the co-party, in anticipation of delivery delays expected at that time due to measures related to the COVID-19pandemic, so that the co-party mistakenly received a letter and the card from the bank. 1.13. In a letter dated April 29, 2022, received by the bank on May 6, 2022, the co-party requested information under data protection law (Art. 15 GDPR). 1.13. In a letter dated April 29, 2022, received by the bank on May 6, 2022, the co-party requested information under data protection law (article 15, GDPR). 1.14. In a letter dated May 13, 2022, the co-party sent a letter by mail to the bank with the following content [excerpt relevant to the proceedings]: “[...]

Dear Sir or Madam! I hereby demand that you immediately disclose the legal basis—including, among other things, the data protection basis—on which you are processing my personal data for the repeated mailings to me, including the bank cards! [A] after the termination of any contractual relationship and the closure of the account on April 15, 2022 [...] and set a deadline for [...1 verifiable erasure of my personal data from all of your databases by Friday, May 20, 2022, upon receipt [...]” Subsequently, a bank employee attempted to contact the co-party by phone, again without success. 1.15. In response to written information provided by the bank on January 12, 2021, pursuant to the Payment Services Act, the co-party made the following statements [in part] to the bank: “[…] Provision of information and contractual terms pursuant to Sections 40 et seq. of the Payment Services Act (ZaDiG)”[…] Provision of information and contractual terms pursuant to Sections 40 et seq. of the Payment Services Act (ZaDiG) I hereby agree that the credit institution may provide me with the information and contractual terms pursuant to § 40 et seq. of the Payment Services Act (ZaDiG) electronically (via PDF file) to the email address I have provided.

Vienna, January 12, 2021 “Signature of Account Holder” The letter bears a handwritten signature of the party involved at the “Signature of Account Holder” section. 2. Assessment of the Evidence: The findings regarding the characteristics of the parties and their contractual relationship with one another are based on the clear and uncontroversial content of the case file, to which the parties to the proceedings raised no objections. In the course of being notified of the complaint, the co-party was also given the opportunity to comment on the complainant’s factual allegations or, if necessary, to file (counter) motions for evidence; and since no such motions were filed, it was to be assumed that the relevant facts regarding the business relationship (and the associated communication) between the complainant and the co-party were to be regarded as undisputed. 3. Legal Assessment: Since the subject matter of the complaint is a decision by the Data Protection Authority, the Senate has jurisdiction pursuant to § 27 DSG.

Since the subject matter of the complaint is a decision by the Data Protection Authority, the Senate has jurisdiction pursuant to § 27 DSG. Regarding Point A): 3.1. Applicable Law: The relevant provisions of the Federal Act on the Protection of Natural Persons with Regard to the Processing of Personal Data (Data Protection Act—DSG), as amended by Federal Law Gazette I No. 24/2018, read in part as follows:The relevant provisions of the Federal Act on the Protection of Natural Persons with Regard to the Processing of Personal Data (Data Protection Act—DSG), as amended by Federal Law Gazette Part I No. 24 of 2018, read in part as follows: “Article 1 (Constitutional Provision) Fundamental Right to Data Protection § 1 (1) Everyone has the right, particularly with regard to respect for their private and family life, to the confidentiality of personal data concerning them, provided there is a legitimate interest in such confidentiality.

The existence of such an interest is excluded if data are not subject to a right to confidentiality due to their general availability or because they cannot be traced back to the data subject. Paragraph one, (1) Everyone has the right, particularly with regard to respect for their private and family life, to the confidentiality of personal data concerning them, provided there is a legitimate interest therein. The existence of such an interest is excluded if data are not subject to a right to confidentiality due to their general availability or because they cannot be traced back to the data subject. (2) To the extent that the use of personal data is not in the vital interest of the data subject or does not occur with the data subject’s consent, restrictions on the right to confidentiality are permissible only to safeguard the overriding legitimate interests of another, and, in the case of interventions by a government authority, only on the basis of laws that are necessary for the reasons set forth in Article 8(2) of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210/1958.

Such laws may provide for the use of data that, by its Art, is particularly worthy of protection only to safeguard important public interests and must, at the same time, establish appropriate safeguards for the protection of the privacy interests of the data subjects. Even in the case of permissible restrictions, the interference with the fundamental right must, in each instance, be carried out in the least intrusive Art necessary to achieve the objective.(2) To the extent that the use of personal data is not in the vital interest of the data subject or does not occur with the data subject’s consent, restrictions on the right to privacy are permissible only to safeguard the overriding legitimate interests of another; in the case of interventions by a government authority, such restrictions may be imposed only on the basis of laws that are necessary for the reasons set forth in article 8, paragraph 2, of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210 of 1958.

Such laws may provide for the use of data that, by its Art, is particularly worthy of protection only to safeguard important public interests and must, at the same time, establish appropriate safeguards for the protection of the data subjects’ privacy interests. Even in the case of permissible restrictions, the interference with the fundamental right must, in each instance, be carried out in the least intrusive Art necessary to achieve the objective. […] Complaint to the Data Protection Authority § 24 (1) Every data subject has the right to lodge a complaint with the Data Protection Authority if they believe that the processing of their personal data violates the GDPR or § 1 or Article 2, Section 1. Paragraph 24, (1) Every data subject has the right to lodge a complaint with the Data Protection Authority if they believe that the processing of their personal data violates the GDPR or Section 1 or Article 2, Part 1.

(2) The complaint must include: 1. the designation of the right deemed to have been violated, 2. to the extent reasonably possible, the designation of the legal entity or body to which the alleged violation is attributed (the respondent), 3. the facts from which the violation is derived, 4. the grounds on which the allegation of unlawfulness is based, 5. a request to determine the alleged violation, and 6. the information necessary to assess whether the complaint was filed in a timely manner. (3) Where applicable, a complaint must be accompanied by the underlying request and any response from the respondent. In the event of a complaint, the Data Protection Authority must provide further assistance at the request of the data subject. […] (5) If a complaint is found to be justified, it must be addressed. If a violation is attributable to a private-sector controller, that controller must be instructed to comply with the complainant’s requests for access, rectification, erasure, restriction, or data portability to the extent necessary to remedy the identified violation.

If the complaint proves to be unfounded, it shall be dismissed. […]” The recitals and provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data, on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation — GDPR), OJ L 119, May 4, 2016, p. 1, read as follows:The relevant Recitals and provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation — GDPR), Official Journal L 119 of May 4, 2016, p. 1, read as follows: “(10) In order to ensure a high and uniform level of data protection for natural persons and to eliminate obstacles to the flow of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States.

The rules on the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data should be applied uniformly and consistently throughout the Union. With regard to the processing of personal data to fulfill a legal obligation or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller, Member States should have the option to retain or introduce national provisions that further specify the application of the provisions of this Regulation. In conjunction with the general and horizontal data protection legislation implementing Directive 95/46/EC, there are several sector-specific laws in the Member States in areas that require more specific provisions. This Regulation also provides Member States with flexibility to specify their rules, including for the processing of special categories of personal data (hereinafter “sensitive data”).

In this regard, this Regulation does not preclude Member States from adopting legislation that defines the circumstances of specific processing situations, including a more precise definition of the conditions under which the processing of personal data is lawful. (40) For processing to be lawful, personal data must be processed with the consent of the data subject or on another permissible legal basis arising from this Regulation or, whenever this Regulation refers to it, from other Union law or the law of the Member States, including, among other things, on the grounds that it is necessary for compliance with a legal obligation to which the controller is subject, or for the performance of a contract to which the data subject is a party, or for the implementation of precontractual measures taken at the data subject’s request. (41) Where this Regulation refers to a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament; this is without prejudice to requirements under the constitutional order of the Member State concerned.

However, the relevant legal basis or legislative measure should be clear and precise, and its application should be foreseeable for data subjects in accordance with the case law of the Court of Justice of the European Union (hereinafter “the Court”) and the European Court of Human Rights. (...) (45) Where the controller processes personal data on the basis of a legal obligation to which the controller is subject, or where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, there must be a basis for this in Union law or in the law of a Member State. This Regulation does not require a specific law for every individual processing operation. A single law serving as the basis for multiple processing operations may be sufficient if the processing is carried out pursuant to a legal obligation to which the controller is subject or if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

Similarly, Union law or the law of the Member States should specify the purposes for which the data may be processed. Furthermore, such law could clarify the general conditions set forth in this Regulation governing the lawfulness of the processing of personal data and could specify how the controller is to determine what types of personal data are processed, which data subjects are affected, to which entities the personal data may be disclosed, for what purposes and for how long they may be stored, and what other measures are taken to ensure that the processing is lawful and carried out with fairness. Likewise, Union law or the law of the Member States should specify whether the controller performing a task carried out in the public interest or in the exercise of official authority is a public authority or another natural or legal person governed by public law, or, provided that this is justified by the public interest, including health-related purposes such as public health, social security, or the administration of health care services, a natural or legal person governed by private law, such as a professional association.

(47) The lawfulness of the processing may be based on the legitimate interests of a controller, including a controller to whom the personal data may be disclosed, or of a third party, provided that such interests do not override the interests or the fundamental rights and freedoms of the data subject; in this regard, the reasonable expectations of the data subject, based on their relationship with the controller, must be taken into account. A legitimate interest could exist, for example, where there is a relevant and appropriate relationship between the data subject and the controller, such as when the data subject is a customer of the controller or is in the controller’s employ. In any case, the existence of a legitimate interest must be weighed with particular care, including an assessment of whether a data subject, at the time the personal data is collected and in light of the circumstances under which the collection takes place, can reasonably foresee that processing for this purpose may occur.

In particular, when personal data is processed in situations where a data subject would not reasonably expect further processing, the data subject’s interests and fundamental rights may outweigh the controller’s interest. … The processing of personal data to the extent strictly necessary for the prevention of fraud also constitutes a legitimate interest of the respective controller. The processing of personal data for the purpose of direct marketing may be considered processing that serves a legitimate interest. [...] “Article 4 Definitions For the purposes of this Regulation, the following terms shall have the following meanings: 1. “personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person; 2.

“Processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transfers, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction; […] 7. “Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, makes the decision on the purposes and means of the processing of personal data; if the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for under Union law or the law of the Member States; […] 9. “Recipient” means a natural or legal person, public authority, agency, or other body to whom personal data are disclosed, regardless of whether such entity is a third party or not.

However, public authorities that may receive personal data in the course of a specific investigative mandate under Union law or the law of the Member States are not considered recipients; the processing of such data by those authorities is carried out in accordance with applicable data protection regulations and in line with the purposes of the processing; 10. “Third party” means a natural or legal person, public authority, agency, or other body, other than the data subject, the controller, the processor, and the persons authorized under the direct responsibility of the controller or the processor to process the personal data; [ … ] [ … ] Article 5 Principles Governing the Processing of Personal Data (1) Personal data must be a) processed lawfully, with fairness, and in a transparent manner in relation to the data subject (“lawfulness, fairness, and transparency”); b) be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes; Further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes is not considered incompatible with the original purposes pursuant to Article 89(1) (“purpose limitation”); c) be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”); d) be factually accurate and, where necessary, kept up to date; all reasonable measures must be taken to ensure that personal data that is inaccurate in relation to the purposes of its processing is erased or rectified without delay (“accuracy”); e) be stored in a form that permits identification of data subjects only for as long as is necessary for the purposes for which they are processed; Personal data may be stored for a longer period provided that, subject to the implementation of appropriate technical and organizational measures required by this Regulation to protect the rights and freedoms of the data subject, processed exclusively for archiving purposes in the public interest, or for scientific or historical research purposes, or for statistical purposes in accordance with article 89(1) (“storage limitation”); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, accidental destruction, or accidental damage, using appropriate technical and organizational measures (“Integrity and Confidentiality”); (2) The controller is responsible for compliance with paragraph 1 and must be able to demonstrate such compliance (“accountability”).

Article 6 Lawfulness of Processing (1) Processing is lawful only if at least one of the following conditions is met: a) The data subject has given consent to the processing of personal data concerning him or her for one or more specific purposes; b) processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of precontractual measures taken at the data subject’s request; c) processing is necessary for compliance with a legal obligation to which the controller is subject; d) The processing is necessary to protect the vital interests of the data subject or of another natural person; e) The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f) the processing is necessary to protect the legitimate interests of the controller or of a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail, in particular where the data subject is a child;f) the processing is necessary to safeguard the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail, in particular where the data subject is a child.

Subparagraph 1(f) does not apply to processing carried out by public authorities in the performance of their official duties. (2) Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing carried out to fulfill paragraph 1(c) and (e) by defining more precisely specific requirements for processing and other measures to ensure lawfulness and fairness in processing, including for other specific processing situations under Chapter IX.(2) Member States may maintain or introduce more specific provisions to adapt the application of the provisions of this Regulation with respect to processing carried out to fulfill the purposes set forth in paragraph 1(c) and (e) by defining specific requirements for such processing and other measures more precisely, to ensure lawfulness and fairness in processing, including for other specific processing situations under Chapter IX.

(3) The legal basis for the processing referred to in paragraph 1(c) and (e) shall be determined by (a) Union law; or (b) the law of the Member States to which the controller is subject. The purpose of the processing must be specified in that legal basis or, with respect to processing pursuant to paragraph 1(e), be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This legal basis may contain specific provisions governing the application of the provisions of this Regulation, including provisions regarding the general conditions governing the lawfulness of processing by the controller, the types of data processed, which data subjects are affected, to which entities and for what purposes personal data may be disclosed, to what purpose limitation they are subject, how long they may be stored, and which processing operations and procedures may be applied, including measures to ensure lawful and fair processing, such as those for other specific processing situations under Chapter IX.

Union law or the law of the Member States must pursue an objective in the public interest and be proportionate to the legitimate purpose pursued.The purpose of the processing must be specified in that legal basis or, with respect to processing pursuant to paragraph 1(e), be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This legal basis may contain specific provisions to adapt the application of the provisions of this Regulation, including provisions regarding the general conditions governing the lawfulness of processing by the controller, the types of data processed, the individuals concerned, the entities to which and the purposes for which personal data may be disclosed, the purpose limitation applied to them, how long it may be stored, and which processing operations and procedures may be applied, including measures to ensure lawfulness and fairness in processing, such as those for other specific processing situations under Chapter IX.

Union law or the law of the Member States must pursue an objective in the public interest and be proportionate to the legitimate purpose pursued. The relevant provisions of the Federal Act on the Prevention of Money Laundering and Terrorist Financing in the Financial Market (Financial Market Money Laundering Act—FM-GwG), as last amended by Federal Law Gazette I No. 151/2024, read as follows, including the heading: The relevant provisions of the Federal Act on the Prevention of Money Laundering and Terrorist Financing in the Financial Market (Financial Market Money Laundering Act—FM-GwG), as last amended by Federal Law Gazette, Part One, No. 151 of 2024, read as follows, including the heading: “Customer Due Diligence Obligations Application of Customer Due Diligence Obligations § 5. Obligated entities must apply customer due diligence obligations pursuant to § 6 in the following cases: Paragraph 5, Obligated entities must apply customer due diligence obligations pursuant to Paragraph 6 in the following cases: 1. upon establishing a business relationship; Savings deposit transactions pursuant to Section 31(1) of the Austrian Banking Act (BWG) and transactions pursuant to Section 12 of the Austrian Securities Account Act (Depotgesetz) are always considered business relationships; Savings deposit transactions pursuant to Section 31, paragraph one, of the Austrian Banking Act (BWG) and transactions pursuant to Section 12 of the Austrian Securities Account Act (Depotgesetz) are always considered business relationships; 2. when conducting any transactions that do not fall within the scope of a business relationship (occasional transactions), a) whose amount is at least 15,000 euros or the equivalent in euros, regardless of whether the transaction is carried out in a single transaction or in multiple transactions that are clearly linked, or b) which are money transfers within the meaning of Article 3(9) of Regulation (EU) 2023/1113 exceeding 1,000 euros; b) which are money transfers within the meaning of Article 3, point 9, of Regulation (EU) 2023/1113 in excess of 1,000 euros; if, in the cases referred to in subparagraph (a), the amount is not known before the transaction begins, the due diligence requirements must be applied as soon as the amount is known and it is determined that it amounts to at least 15,000 euros or the equivalent in euros;if, in the cases referred to in subparagraph (a), the amount is not known before the transaction begins, the due diligence requirements shall apply as soon as the amount is known and it is determined that it amounts to at least 15,000 euros or the equivalent in euros; 3. for every deposit into savings accounts and every withdrawal from savings accounts, if the amount to be deposited or withdrawn is at least 15,000 euros or the equivalent in euros; 4. if there is a suspicion or reasonable grounds to believe that the customer belongs to a terrorist organization (Section 278b of the German Criminal Code (StGB)) or that the customer is objectively involved in transactions that serve the purposes of money laundering (Section 165 of the German Criminal Code (StGB)—including assets derived from a criminal act committed by the perpetrator himself) or the financing of terrorism (Section 278d of the German Criminal Code (StGB)); 4. if there is suspicion or reasonable grounds to believe that the customer belongs to a terrorist organization (Section 278b, StGB) or that the customer is objectively involved in transactions that serve the purpose of money laundering (Section 165 of the German Criminal Code (StGB)—including assets derived from a criminal act committed by the perpetrator himself) or the financing of terrorism (Section 278d of the German Criminal Code (StGB)); 5. if there are doubts regarding the authenticity or adequacy of previously received customer identification data.

Scope of Due Diligence Obligations § 6. (1) Due diligence obligations toward customers include: Section 6, (1) Due diligence obligations toward customers include: 1. Verifying the customer’s identity and verifying that identity based on documents, data, or information obtained from a credible and independent source, including electronic means of identity verification and relevant trust services in accordance with Regulation (EU) No. 910/2014 and other secure methods for remote or electronic identification in accordance with para 4;1. Verification of the customer’s identity based on documents, data, or information from a credible and independent source, including electronic means of identity verification and relevant trust services in accordance with Regulation (EU) No. 910 of 2014, and other secure methods of remote or electronic identification as provided for in paragraph 4; 2. Verifying the identity of the beneficial owner and taking appropriate measures to verify that identity so that the obligated entities are satisfied that they know who the beneficial owner is; in the case of legal entities, trusts, companies, foundations, and similar legal arrangements, this includes taking appropriate measures to understand the customer’s ownership and control structure; in the case of private foundations that have established a supplementary foundation deed pursuant to § 10 PSG, this includes reviewing the supplementary foundation deed.

Continuous surveillance of the business relationship, including a review of the transactions carried out during the course of the business relationship, to ensure that they are consistent with the obligated party’s knowledge of the customer, the customer’s business activities, and the customer’s risk profile, including, where necessary, the source of funds; 7. Regularly verifying the availability of all information, data, and documents required under this federal law, as well as updating such information, data, and documents. The identity of any person who claims to be acting on behalf of the client (natural person authorized to act on the client’s behalf) must be established and verified in accordance with Section 1. The authority to act on behalf of the client must be verified in an appropriate manner. The customer must promptly disclose any changes to the authority to act on the customer’s behalf during the course of the business relationship.

The identity of any person who claims to act on behalf of the customer (an authorized natural person) must be established and verified in accordance with paragraph one. Authority to represent the customer must be verified in an appropriate manner. The customer must, on their own initiative and without delay, report any changes in authority to represent the customer during the course of the business relationship. (2) The verification of identity pursuant to paragraph 1, subparagraph 1, must be conducted as follows: (2) The verification of identity pursuant to paragraph 1, subparagraph 1, must be conducted as follows: 1. For a natural person, by the personal presentation of an official photo ID. For this purpose, official photo identification means documents issued by a government authority that bear a non-replaceable, recognizable photograph of the person in question and contain the person’s name, date of birth, and signature, as well as the issuing authority; in the case of travel documents for foreign nationals, the signature and full date of birth need not be included in the travel document if this is in accordance with the law of the issuing state.

Individual criteria for official photo identification may be omitted if, due to technological advances, other equivalent criteria are introduced—such as biometric data—that are at least equivalent in their authenticating effect to the omitted criteria. However, the criterion that the document must be issued by a government authority must always be met; 2. for a legal entity, verification must be based on conclusive documents available in accordance with the legal standards customary in the country where the legal entity is headquartered. In any case, the legal existence, name, legal form, authority to represent, and registered office of the legal entity must be verified. (3) The obligated parties must request that the customer disclose the following: 1. whether the customer intends to conduct the business relationship (Para 5(1)(1)) or the occasional transaction (Para 5(1)(2)) for his own account or for the account of a third party, or on behalf of a third party, and 1. whether they intend to conduct the business relationship (Section 5, paragraph 1, item 1) or the occasional transaction (Section 5, paragraph 1, item 2) for their own account or for the account of a third party, or on behalf of a third party, and 2. the identity of his or her beneficial owner(s).

The customer must comply with this request and, during the course of the ongoing business relationship, must promptly disclose any relevant changes on his or her own initiative. If the customer states that he intends to act for the account of another or on behalf of another (Subparagraph 1), he must also provide the obligated party with proof of the settlor’s identity, and the obligated parties must verify and confirm the settlor’s identity. The identity of the trustee must be verified in accordance with para 2, item 1, and exclusively in the physical presence of the trustee. Identification of the trustee by third parties is also excluded. The verification and confirmation of the settlor’s identity must be carried out, in the case of natural persons, by presenting the original or a copy of the settlor’s official photo ID (para. 2, subparagraph 1), and in the case of legal entities, by means of conclusive documents (Para 2, Item 2).

The trustee must further provide a written declaration to the obligor stating that he has verified the settlor’s identity personally or through reliable guarantors. Reliable sources of assurance in this context include Courts and other government authorities, notaries, attorneys, and third parties as defined in § 13. The customer must comply with this request and, during the course of the business relationship, promptly disclose any relevant changes on his own initiative. If the client declares that he intends to act on behalf of or at the request of a third party (paragraph one), he must also provide the obligor with proof of the settlor’s identity, and the obligors must verify and confirm the settlor’s identity. The identity of the trustee must be verified in accordance with paragraph 2, clause one, and exclusively in the physical presence of the trustee. Identification of the trustee by third parties is also excluded.

The verification and confirmation of the settlor’s identity must be carried out, in the case of natural persons, by presenting the original or a copy of the settlor’s official photo ID (paragraph 2, clause 1), and in the case of legal entities, by means of conclusive documents (paragraph 2, subparagraph 2). The trustee must also provide the obligor with a written declaration stating that he or she has verified the settlor’s identity personally or through reliable guarantors. Reliable sources for this purpose include Courts and other government authorities, notaries, attorneys, and third parties as defined in Section 13, (4) The personal presentation of an official photo ID as defined in para 2 may be replaced by security measures in the case of business relationships or transactions without personal contact. In any event, the obligated party must know the customer’s name, date of birth, and address; in the case of legal entities, the business name and registered office.

The following security measures are permissible:(4) The personal presentation of official photo identification as defined in paragraph 2 may be replaced by security measures in the case of business relationships or transactions without personal contact. In any case, the obligated party must know the customer’s name, date of birth, and address; in the case of legal entities, the business name and registered office. The following are permissible security measures: 1. the presentation of an official photo ID as part of a video-based electronic procedure (online identification), 2. a procedure provided for by law that securely provides the same information as the presentation of an official photo ID (electronic ID), 3. the submission of the customer’s legal declaration in the form of a qualified electronic signature pursuant to Art. 3(12) of Regulation (EU) No. 910/2014, or the delivery of the obligated party’s legal declaration by certified mail to the customer’s address specified as the customer’s place of residence or registered office, provided that, in addition, 3. the submission of the customer’s legal declaration in the form of a qualified electronic signature pursuant to article 3, paragraph 12, of Regulation (EU) No. 910 of 2014, or the delivery of the obligated party’s legal declaration by certified mail to the customer address specified as the customer’s place of residence or registered office, provided that, in addition, a) in the case of legal entities, the registered office is also the location of the central administration, regarding which the customer must submit a written declaration, b) a copy of the customer’s official photo ID, or that of their legal representative, or—in the case of legal entities—of the body authorized to represent them, is provided to the obligor prior to the conclusion of the contract, unless the legal transaction is concluded electronically using a qualified electronic signature, and c) in the case of customers with a registered office or residence in a third country, a written confirmation from another credit institution with which the customer has an ongoing business relationship is provided, stating that the customer’s identity has been established and verified in accordance with this Federal Act and that the ongoing business relationship remains in effect.

If the confirming credit institution is headquartered in a third country, that third country must meet the requirements set forth in § 13(4). In lieu of identification and confirmation by a credit institution, identification and written confirmation by the Austrian representative authority in the relevant third country or by a recognized certification authority is also permissible,(c) for customers domiciled or resident in a third country, there is a written confirmation from another credit institution with which the customer has an ongoing business relationship, stating that the customer’s identity has been established and verified in accordance with this Federal Act and that the ongoing business relationship remains in effect. If the confirming credit institution is headquartered in a third country, that third country must meet the requirements set forth in Section 13, paragraph 4. In lieu of identification and confirmation by a credit institution, identification and written confirmation by the Austrian diplomatic or consular mission in the relevant third country or by a recognized certification authority is also permissible, or 4. the first payment in connection with the transactions is processed through an account opened in the customer’s name at a credit institution as defined in § 13, and they have copies of the customer’s documents on file that allow the customer’s information—or that of the natural person authorized to represent the customer—to be reliably verified.

The FMA, with the approval of the Federal Minister of Finance, shall issue a Regulation specifying the measures required for online identification to mitigate the increased risk, and in particular shall establish requirements regarding data security, protection against forgery, and the persons who conduct the online identification. (5) Obligated entities may determine the scope of the due diligence obligations set forth in para 1 through 3 on a risk-based basis. When assessing the risks of money laundering and terrorist financing, at least the variables listed in Annex I must be taken into account. As a result of this assessment, each customer must be classified into a risk category. Obligated entities must be able to demonstrate to the FMA that the measures they have taken are appropriate in light of the identified risks of money laundering and terrorist financing.(5) Obligated entities may determine the scope of the due diligence obligations referred to in paragraphs 1 through 3 on a risk-based basis.

When assessing the risks of money laundering and terrorist financing, at least the variables listed in Appendix I must be taken into account. As a result of this assessment, each customer must be classified into a risk category. Obligated entities must be able to demonstrate to the FMA that the measures they have implemented are appropriate in light of the identified risks of money laundering and terrorist financing. Record Keeping, Data Protection, Information Exchange, and Internal Organizational Requirements Record Keeping Obligations and Data Protection § 21. (1) Obligated entities shall retain: Paragraph 21, (1) Obligated entities shall retain: 1. Copies of the documents and information received that are necessary for fulfilling customer due diligence obligations, including electronic means of identity verification and relevant trust services pursuant to Regulation (EU) No. 910/2014, as well as other secure methods for remote or electronic identification in accordance with § 6(4), for a period of ten years following the termination of the business relationship with the customer or following the date of an occasional transaction;1.

Copies of the documents and information received that are necessary to fulfill customer due diligence obligations, including electronic means of identity verification and relevant trust services pursuant to Regulation (EU) No. 910 of 2014, as well as other secure methods of remote or electronic identification in accordance with paragraph 6, for a period of ten years after the termination of the business relationship with the customer or after the date of an occasional transaction; 2. the transaction documents and records necessary for identifying transactions, for a period of ten years following the termination of the business relationship with the customer or following an occasional transaction. (2) Obligated parties must delete all personal data that they have processed exclusively for the purposes of this Federal Act upon expiration of the retention periods specified in para (1), unless provisions of other Federal Acts require or authorize a longer retention period.

No erasure may occur until the final resolution of any pending preliminary investigation, trial, or appeal proceedings under § 165, § 278a, § 278b, § 278c, § 278d, or § 278e of the Criminal Code (StGB), if the obligated party has demonstrably become aware of such proceedings.(2) Obligated parties shall delete all personal data that they have processed exclusively for the purposes of this federal law upon the expiration of the retention periods specified in paragraph (1), unless provisions of other federal laws require or authorize a longer retention period. No erasure of data may occur until the final conclusion of any pending preliminary investigation, trial, or appeal proceedings under § 165, § 278a, § 278b, § 278c, Section 278d, or Section 278e of the German Criminal Code (StGB), if the obligated party has demonstrably become aware of such proceedings. 3.2. Regarding the granting of the complaint against points 1.a., 1.b., and 2. of the decision: 3.2.1.

The scope of the challenge (Para 9(1)(3) and (4) in conjunction with Para 27 of the Administrative Court Act (VwGVG)) clearly extends to points 1.a., 1.b., and 2.—that is, against the legal findings regarding the complainant’s use of the telephone number and email address, as well as the related administrative order for erasure; the remaining parts of the contested decision have thus become final.3.2.1. The scope of the challenge (Section 9, paragraph 1, subparagraphs 3 and 4, in conjunction with Section 27 of the VwGVG) clearly extends to the parts of the decision 1.a., 1.b., and 2.—that is, against the legal findings regarding the complainant’s use of the telephone number and email address, as well as the related administrative order for erasure; the remaining parts of the contested decision have thus become final. 3.2.2. It should be noted at the outset that the complainant, as the operator of a credit institution pursuant to § 1 BWG, in connection with the data processing operations at issue in this proceeding (collection, storage, and use of the telephone number and email address to contact the co-party) as the controller within the meaning of Art. 4(7) of the GDPR.

The telephone number and email address of the co-party—who, in this context, is a data subject within the meaning of Art. 4(1) of the GDPR—undoubtedly constitute personal data. As established, a contractual relationship existed between the parties in the form of a standard banking service relationship (provision of a checking account and a securities account); Therefore, in principle, the grounds for lawfulness under Article 6(1)(a), (b), (c), and (f) of the GDPR may apply to the processing operations in question. 3.2.2. First, it should be noted that the complainant, as the operator of a credit institution pursuant to Section 1, BWG, in connection with the data processing operations at issue (collection, storage, and use of telephone numbers and email addresses to contact the other party to the proceedings), qualifies as a controller within the meaning of article 4(7) of the GDPR. The telephone number and email address of the other party—who, in this context, is a data subject within the meaning of Article 4(1) of the GDPR—undoubtedly constitute personal data.

As established, a legal relationship existed between the parties in the form of a standard banking service relationship (provision of a checking account and a securities account); Therefore, in principle, the grounds for lawfulness under article 6(1)(a), (b), (c), and (f) of the GDPR are applicable to the processing operations in question. Regarding the lawfulness of the complainant’s processing of the telephone number and email address: 3.2.3. In finding 1.a., the respondent authority stated that the complainant had violated the co-party’s right to confidentiality (Para 1 of the Data Protection Act in conjunction with Art. 6(1) of the GDPR) by unlawfully processing the co-party’s telephone number during and after the contractual relationship through four call attempts not necessary for the performance of the contract, as well as through the unnecessary continued storage after the termination of the contract. 3.2.3.

In ruling 1.a., the respondent authority found that the complainant had violated the co-party’s right to confidentiality (Section 1(1) of the DSG IVm Article 6(1) of the GDPR) by unlawfully processing the co-party’s telephone number during and after the contractual relationship through four attempted calls not necessary for the performance of the contract, as well as through the unnecessary continued storage of the data after the termination of the contract. 3.2.4. In the opinion of the respondent authority, the attempted calls complained of by the data subject in this proceeding—all of which constitute uses of data that were not strictly necessary for the performance of a contract; therefore, the “service-oriented approach” cited by the controller as justification for the use of the telephone number was to be considered insufficient in light of the narrow interpretation of Article 6(1)(b) of the GDPR (as required from the perspective of the Data Protection Authority).

Nor does a balancing of interests pursuant to Article 6(1)(f) of the GDPR favor the controller, since the bank did not provide a more detailed justification for the existence of a legitimate interest in verbal explanations regarding the termination of the contract, nor could the data subject have expected to be contacted by the bank again by telephone following his or her explicit request for the erasure of his or her telephone number. 3.2.4. In the opinion of the authority in question, the attempted calls complained of by the data subject in this proceeding—all of which constitute uses of data that were not strictly necessary for the performance of a contract— therefore, the “service-oriented approach” cited by the controller as justification for using the telephone number was not to be considered sufficient in light of the narrow interpretation (required from the perspective of the Data Protection Authority) of article 6(1)(b) of the GDPR.

Nor did a balancing of interests pursuant to Article 6(1)(f) of the GDPR favor the controller, since neither had the bank provided a more detailed justification for the existence of a legitimate interest in verbal explanations regarding the termination of the contract, nor could the data subject, following his or her explicit request for the erasure of his or her telephone number, have expected to be contacted by the bank again by telephone. 3.2.5. The grounds for authorization under Article 6(1)(c) of the GDPR ( “processing based on legal obligations”) in connection with the specific retention obligations under § 21 Fm-GwG for the prevention of money laundering and terrorist financing is, in the opinion of the respondent authority, not relevant to this case.3.2.5. Likewise, the legal basis cited by the controller—which had already been invoked during the proceedings before the respondent authority—under Article 6(1)(c) of the GDPR (, “processing based on legal obligations”) in connection with the specific retention obligations under Section 21 of the Fm-GwG for the prevention of money laundering and terrorist financing is, in the opinion of the respondent authority, not relevant to this case. 3.2.6.

In point 1 of the ruling,b., the respondent authority further ruled that the complainant had violated the co-party’s right to confidentiality under Section 1(1) of the Data Protection Act (DSG) by unlawfully using and storing the co-party’s email address both during and after the contractual relationship. 3.2.6. In finding 1.b., the respondent authority further ruled that the complainant had violated the co-party’s right to confidentiality under Section 1, paragraph 1, of the DSG by unlawfully using and storing the co-party’s email address both during and after the contractual relationship was in effect. In contrast, in the opinion of the adjudicating panel, the complainant’s counterargument (in this regard) is justified for the following reasons: 3.2.7. Pursuant to Article 5(1)(a) of the GDPR, personal data must be processed lawfully, fairly, and in a manner that is transparent to the data subject.3.2.7.

Pursuant to Article 5(1)(a) of the GDPR, personal data must be processed lawfully, with fairness, and in a manner that is transparent to the data subject. 3.2.8. Under Article 5(1)(c) of the GDPR, which enshrines the principle of data minimisation, such data must also be adequate, relevant, and limited to what is necessary for the purposes of the processing. This principle embodies the principle of proportionality (see, in this regard, the judgement of the CJEU of October 4, 2024, Schrems [Disclosure of Data to the General Public], C‑446/21, paragraphs 49 and 50, as well as the case law cited therein). 3.2.8. According to Article 5(1)(c) of the GDPR, which enshrines the principle of data minimisation, such data must also be adequate, relevant, and limited to what is necessary for the purposes of processing. This principle embodies the principle of proportionality; see, in this regard, the judgement of the CJEU of October 4, 2024, Schrems [Disclosure of Data to the General Public], C‑446/21, paragraphs 49 and 50, as well as the case law cited therein). 3.2.9.

With regard to the conditions for the lawfulness of processing, Article 6(1) of the GDPR contains an exhaustive list of cases in which the processing of personal data may be considered lawful. Accordingly, processing must fall within one of the categories set forth in that provision in order to be considered lawful (see CJEU, Judgement of Oct. 4, 2024, C‑621/22, para. 29 and the case law cited therein). 3.2.9. With regard to the conditions for the lawfulness of processing, article 6(1) of the GDPR contains an exhaustive list of the cases in which the processing of personal data may be considered lawful. Accordingly, processing must fall under one of the cases provided for in this provision in order to be considered lawful (see CJEU, Judgement of Oct. 4, 2024, C‑621/22, para. 29 and the case law cited therein). 3.2.10. Under Article 6(1)(a) of the GDPR, the processing of personal data is lawful if and to the extent that the data subject has given consent to such processing for one or more specific purposes.

If no such consent exists or if the consent was not freely given, specifically for the particular case, in an informed manner, and unambiguously within the meaning of Article 4(11) of the GDPR, such processing may nevertheless be justified if it meets one of the conditions set forth in Article 6(1)(b) through (f) regarding necessity (see, in this regard, the judgement of the CJEU of July 4, 2023, C‑252/21, paragraphs 91 and 92). 3.2.10. Under Article 6(1)(a) of the GDPR, the processing of personal data is lawful if and to the extent that the data subject has given consent to such processing for one or more specific purposes. If no such consent has been given, or if the consent was not freely given, specifically for the particular case, in an informed manner, and unambiguously within the meaning of article 4(11) of GDPR, such processing may nevertheless be justified if it meets one of the conditions regarding necessity set forth in article 6(1)(b) through (f); see, in this regard, the judgement of the CJEU of July 4, 2023, C‑252/21, paras. 91 and 92). 3.2.11.

It should be noted at this point that, for the present case, it is legally irrelevant whether and when the co-party granted or revoked any consent to the processing of the complainant’s telephone number and email address. In the present context—against the backdrop of the contractual relationship in the form of a typical banking transaction—the grounds for lawfulness set forth in para 6(1)(b), (c), and (f) of the GDPR are, rather, relevant. 3.2.11. It should be noted at this point that, for the present case, it is legally irrelevant whether and when the involved party granted or revoked any consent given to the complainant regarding the processing of their telephone number and email address. In the given context—against the backdrop of the legal relationship in the form of a typical banking transaction—the grounds for lawfulness set forth in article 6(1)(b), (c), and (f) of the GDPR are rather relevant.

Regarding Article 6(1)(b) of the GDPR (“Processing for the performance of a contract”): 3.2.12. According to Article 6(1)(b) of the GDPR, the processing of personal data is lawful if it is “necessary for the performance of a contract to which the data subject is a party or for the implementation of precontractual measures taken at the data subject’s request.” 3.2.12. According to Article 6(1)(b) of the GDPR, the processing of personal data is lawful if it is “necessary for the performance of a contract to which the data subject is a party or for the implementation of precontractual measures taken at the data subject’s request.” 3.2.13. For the processing of personal data to be considered necessary for the performance of a contract within the meaning of this provision, it must—in accordance with the relevant case law of the CJEU—be objectively indispensable to achieve a purpose that is an essential component of the contractual performance intended for the data subject.

The controller of this processing must therefore be able to demonstrate to what extent the main subject matter of this contract could not be fulfilled without this processing. According to the established case law of the CJEU, business communication [in any event] constitutes a purpose that is an essential part of a specific contractual performance (see CJEU, C‑394/23, para. 35 et seq.). In the cited decision, the CJEU addressed the fact that the provision of rail transport services generally requires communication with the customer. For the application of the justification set forth in Art. 6(para 6) 1(b) of the GDPR, it is therefore decisive that the processing of personal data by the controller is essential for the proper performance of the contract concluded between the controller and the data subject, and that there are no practicable and less intrusive alternatives. The CJEU merely points out—although this circumstance is irrelevant to the case at hand—that such communication does not necessarily have to be personalized based on the gender identity of the customer in question, since, in the CJEU’s view, the personalization of content does not appear necessary to offer services to a customer if those services can, where appropriate, be provided to the customer in the form of an equivalent alternative that is not linked to [gender-specific] personalization, such that it is not objectively indispensable to achieve a purpose that is an integral part of those services.

(see CJEU, Judgement of January 9, 2025, C‑394/23, para. 32 et seq., and the case law cited therein).3.2.13. For the processing of personal data to be considered necessary for the performance of a contract within the meaning of this provision, it must—in accordance with the relevant case law of the CJEU—be objectively indispensable to achieve a purpose that is an integral part of the contractual service intended for the data subject. The controller of this processing must therefore be able to demonstrate to what extent the main subject matter of this contract could not be fulfilled without such processing. According to the established case law of the CJEU, business communication [in any event] constitutes a purpose that is an essential component of a specific contractual performance (see CJEU, C-394/23, para. 35 et seq.). In the cited decision, the CJEU addressed the fact that the provision of rail transport services generally requires communication with the customer.

For the application of the justification set forth in article 6(1), (b) of the GDPR, it is therefore decisive that the processing of personal data by the controller is essential for the proper performance of the contract concluded between the controller and the data subject, and that there are no practical and less intrusive alternatives. The CJEU merely points out—although this circumstance is irrelevant to the case at hand—that such communication does not necessarily have to be personalized based on the gender identity of the customer in question, since, in the CJEU’s view, the personalization of content does not appear necessary to offer services to a customer if those services can, where appropriate, be provided to the customer in the form of an equivalent alternative that is not linked to [gender-specific] personalization, so that it is not objectively indispensable to achieve a purpose that is an essential component of those services.

See CJEU, Judgement of Jan. 9, 2025, C‑394/23, para. 32 et seq. and the case law cited therein). In the opinion of this panel, nothing else can be considered the performance of a contractual obligation in connection with the account management agreement at issue here. In the view of the adjudicating panel, the collection and ongoing storage of the telephone number and email address for the purpose of business correspondence between the complainant, as the bank, and the co-party, as its customer, was, in any event, covered in principle by Article 6(1)(b) of the GDPR:In the opinion of the adjudicating panel, nothing else can apply to the provision of a contractual service in connection with the account management agreement at issue here. In the view of the adjudicating panel, the collection and ongoing storage of the telephone number and email address for the purpose of business correspondence between the complainant, as the bank, and the co-party, as its customer, was, in any event, covered in substance by Article 6(1)(b) of the GDPR: 3.2.14.

This undoubtedly gives rise to a regular need to contact the customer (in this case: the co-party), for example, in the event of suspected misuse of the checking account by unauthorized third parties, such as in cases of phishing attacks or other forms of fraudulent attempts to carry out transactions or cash withdrawals. Examples include cases in which unauthorized third parties attempt to make cash withdrawals or initiate transfers by presenting forged or altered identification documents. In such cases, the complainant may, in any event, be obligated to (promptly) consult by telephone with the involved party—as a customer—in cases of suspicion, in order to prevent harmful conduct and halt any potential transactions. The (specific) scope of duties of care and due diligence—such as the question of banks’ duties to provide advice and information—is, in principle, a matter to be determined on a case-by-case basis (see OGH, Aug. 28, 2024, 7Ob95/24g, para. 12).

Even against this background, the adjudicating panel must determine that the processing of the telephone number and email address for the purpose of establishing contact in connection with the contractual relationship between the parties, which existed at least until April 15, 2022, is in any case to be regarded as standard business practice, and therefore, in substance, unquestionably falls under the grounds for lawfulness set forth in Article 6(1)(b) of the GDPR. 3.2.16. In this context, it must be emphasized that, in fulfilling the contractual obligations at issue in connection with the provision of a checking account, the complainant has comprehensive duties of protection and care toward the other party as its customer. This can undoubtedly give rise to a regular need to contact the customer (in this case: the co-party), for example, in the event of suspected misuse of the checking account by unauthorized third parties, such as in cases of phishing attacks or other forms of fraudulent attempts to carry out transactions or cash withdrawals.

Examples include cases in which unauthorized third parties attempt to make cash withdrawals or initiate transfers by presenting forged or altered identification documents. In such cases, the complainant may, in any event, be required to (promptly) consult by telephone with the involved party—as a customer—in cases of suspicion, in order to prevent harmful conduct and halt any potential transactions. The (specific) scope of duties of care and due diligence—such as the question of banks’ duties to provide advice and information—is, in principle, a matter to be determined on a case-by-case basis; see Supreme Court, Aug. 28, 2024, 7Ob95/24g, para. 12). Even against this background, the adjudicating panel must determine that the processing of the telephone number and email address for the purpose of establishing contact in connection with the contractual relationship between the parties—which existed until at least April 15, 2022—is, in any event, to be regarded as standard business practice, and therefore, in substance, falls without doubt under the grounds for authorization set forth in Article 6(1)(b) of the GDPR. 3.2.17.

This is done to clarify or prevent any misunderstandings, or simply with the aim of discussing, through mutual communication, the terms for continuing or terminating the business relationship. Against this background, the adjudicating panel cannot concur with the legal opinion of the respondent authority in this regard. Rather, it is unrealistic to prohibit a controller who, as in the present case, provides highly regulated banking services (see, for example, § 2(10) in conjunction with §§ 5 and 6 of the Financial Market Act (FM-GwG)), from attempting to establish personal contact with a customer via modern means of communication such as telephone and email in connection with contractual disputes. In this regard, the European Data Protection Board (EDPB) also emphasizes that the processing of contact information to communicate with the contracting party regarding the status of the service, billing, or schedule changes is generally to be regarded as necessary for the performance of a contract (see, mutatis mutandis, EDPB Guidelines 2/2019, Version 2.0, in particular paragraphs 38 and 42). 3.2.17.

This is done to clarify or prevent any misunderstandings, or simply with the aim of discussing the terms for continuing or terminating the business relationship through amicable communication. Against this background, the adjudicating panel cannot concur with the legal opinion of the respondent authority in this regard. Rather, it would be unrealistic to prohibit a controller—who, as in the present case, provides highly regulated banking services (see, for example, Section 2, No. 10, in conjunction with Sections 5 and 6 of the FM-GwG), from attempting to establish personal contact with a customer via modern means of communication such as telephone and email in connection with contractual disputes. In this regard, the European Data Protection Board (EDPB) also emphasizes that the processing of contact information to communicate with the contracting party regarding the status of the service, billing, or schedule changes is generally to be regarded as necessary for the performance of a contract (see, mutatis mutandis, EDPB Guidelines 2 from 2019, Version 2.0, in particular paragraphs 38 and 42).

Consequently, the communications in question were covered by the grounds for lawfulness set forth in Article 6(1)(b) of the GDPR.Consequently, the communications in question were covered by the legal basis set forth in article 6, paragraph 1, subparagraph b, of the GDPR. Regarding the legal basis under Article 6(1)(c) of the GDPR—processing necessary for compliance with a legal obligation to which the controller is subject: Regarding the legal basis under Article 6(1)(c) of the GDPR—processing necessary for compliance with a legal obligation to which the controller is subject: 3.2.18. The provision of banking services is generally subject to a high degree of regulatory oversight. Of central importance here are the regulations aimed at preventing money laundering and terrorist financing in the financial market (Financial Market Money Laundering Act—FM-GwG). 3.2.19. In this context, the determination and verification of the customer’s identity pursuant to para 6(1)(1) FM-GwG and of the persons authorized to represent the customer pursuant to para 6(1) FM-GwG constitutes a key due diligence obligation in connection with the prevention of money laundering and terrorist financing.

The information collected and verified during the identification process must be documented. In addition, copies of the documents and information received that are necessary for fulfilling customer due diligence obligations must be retained in accordance with Section 21(1)(1) of the FM-GwG for a period of ten years following the termination of the business relationship […].3.2.19. In this context, the determination and verification of the customer’s identity pursuant to Section 6, paragraph 1, item 1, FM-GwG and that of the persons authorized to represent the customer pursuant to Section 6, paragraph 1, FM-GwG by the credit institution constitutes a central due diligence obligation in connection with the prevention of money laundering and terrorist financing. The information collected and verified as part of the identification process must be documented. In addition, copies of the documents and information received that are necessary to fulfill customer due diligence obligations must be retained, in accordance with Section 21, paragraph 1, item 1 of the FM-GwG, for a period of ten years after the termination of the business relationship […].

Against this background, the retention of the email address and phone number of the co-party for a period of ten years following the termination of the contractual relationship is deemed lawful within the meaning of Art. 6(1)(c) GDPR and § 21( 1 of the Anti-Money Laundering Act (Fm-GwG). Against this background, the retention of the email address and phone number of the party involved for a period of ten years following the termination of the contractual relationship is deemed lawful within the meaning of Article 6, paragraph 1, subparagraph c, of the GDPR and Section 21, paragraph 1, Fm-GwG. The complaint was therefore also upheld on this point. Regarding the basis for lawfulness under Article 6(1)(f) of the GDPR—processing for the purposes of the legitimate interests pursued by the controller or by a third party:Regarding the legal basis under Article 6(1)(f) of the GDPR—processing for the purposes of the legitimate interests pursued by the controller or by a third party: 3.2.20.

Furthermore, in the given context, the legal basis under Article 6(1)(f) of the GDPR applies to the processing of the email address and phone number of the involved party (with respect to periods following the termination of the contractual relationship). 3.2.20. Furthermore, in the given context, the legal basis under article 6(1)(f) of the GDPR applies to the processing of the email address and phone number of the party involved (with respect to periods following the termination of the contractual relationship). 3.2.21. The Supreme Court (OGH) has recognized that, in the context of balancing interests, it must be taken into account which sphere of personality is being infringed upon; in this regard, the social sphere—in which the data subject, as a member of society, communicates with outsiders— is not afforded the same level of protection as the most private sphere of life (OGH 2.2.2022, 6 Ob 129/21w, para. 70). 3.2.22.

The Federal Administrative Court first concurs with the Supreme Court’s view that, in the course of the balancing of interests under Art. 6(1)(f) of the GDPR, a distinction must be made as to whether the processed data concern the (so-called) core area of protected privacy—as is the case, for example, with data concerning the data subject’s sex life—or the (so-called) social sphere, which is characterized by the data subject’s interaction with outsiders or public appearances, as is the case, for example, when providing services to third parties (see again OGH 6 Ob 129/21w, para. 70). 3.2.22. The Federal Administrative Court first concurs with the view of the Supreme Court, according to which, in the course of the balancing of interests under article 6, paragraph 1, subparagraph (f) of the GDPR, a distinction must be made between whether the processed data concerns the (so-called) core area of protected privacy—as is the case, for example, with data regarding the data subject’s sex life—or the (so-called) social sphere, which is characterized by the data subject’s interaction with outsiders or public appearances—as is the case, for example, when providing services to third parties (see again OGH 6 Ob 129/21w, para. 70). 3.2.23.

The information in question pertaining to the co-party (phone number and email address) must, in any case, be classified as falling within the co-party’s social sphere. This circumstance must be given due consideration in the balancing of interests. The telephone number and email address—as established, the co-party was in a contractual relationship with the complainant as a bank customer and, in this context, provided her contact information to the bank for the purpose of potential communication with the bank— typically serve the purpose of communicating with third parties and do not fall within the domestic sphere or constitute particularly sensitive information (Art. 9 GDPR). Therefore, it could not have come as a surprise to the co-party that the complainant would use the phone number and email address to contact her in cases such as the present one, in which a contractual relationship had been terminated but operational measures (final settlement, etc.) were still required to process the termination, there was a certain need for communication between the parties. 3.2.23.

The information in question pertaining to the co-party (phone number and email address) must therefore be classified as falling within the co-party’s social sphere. This circumstance must be given due consideration in the balancing of interests. The telephone number and email address—as established, the co-party was in a contractual relationship with the complainant as a bank customer and, in this context, provided her contact information to the bank for the purpose of potential communication with the bank— typically serve the purpose of communicating with third parties and do not fall within the domestic sphere or constitute particularly sensitive information (article 9, GDPR). Therefore, it could not have come as a surprise to the co-party that the complainant would use the phone number and email address to contact her in cases such as the present one, in which a contractual relationship had been terminated but operational implementation measures (final settlement, etc.) were still required to finalize the termination there was a certain need for communication between the parties 3.3.