The data subject was a policeman who was subject to disciplinary measures

Date of Decision July 13, 2026 Legal Provision B-VG Art. 130, para. 2a B-VG Art. 133, para. 4 BVwGG § 20 BVwGG § 24a GDPR Art. 4, para. 1 GDPR Art. 4(1)(15) GDPR Art. 4(2) GDPR Art. 4(7) GDPR Art. 5(1)(l) GDPR Art. 6(1)(c) GDPR Art. 6(1)(e) GDPR Art. 6(3) GOG § 85 GOG § 85(1) B-VG Art. 130 (current) B-VG Art. 130 effective as of February 1, 2019, last amended by BGBl. I No. 14/2019 B-VG Art. 130 effective from January 1,January 2019 through January 31, 2019, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 130 effective from January 1, 2019, through May 24,2018, last amended by Federal Law Gazette I No. 138/2017, B-VG Art. 130, effective from May 25, 2018, through December 31, 2018, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 130 effective from January 1, 2015, through May 24, 2018, last amended by Federal Law Gazette I No. 101/2014 B-VG Art. 130, effective from January 1, 2014, through December 31, 2014, last amended by Federal Law Gazette I No. 115/2013 B-VG Art. 130, effective from JanuaryJanuary 2014 through December 31, 2013; last amended by Federal Law Gazette I No. 51/2012; B-VG Art. 130; effective from January 1, 2004, through December 31,2013, last amended by Federal Law Gazette I No. 100/2003, B-VG Art. 130, effective from Jan. 1, 1998, through Dec. 31, 2003, last amended by Federal Law Gazette I No. 87/1997 B-VG Art. 130 effective from January 1, 1991, through December 31, 1997, last amended by Federal Law Gazette No. 685/1988 B-VG Art. 130, effective from July 1, 1976, to December 31, 1990, last amended by Federal Law Gazette No. 302/1975, B-VG Art. 130, effective from July 18, 1962, through June 30, 1976; last amended by Federal Law Gazette No. 215/1962, B-VG Art. 130, in effect from December 25, 1946, to July 17, 1962; last amended by Federal Law Gazette No. 211/1946; B-VG Art. 130, in effect from December 19,December 1945 through December 24, 1946; last amended by State Law Gazette No. 4/1945; B-VG Art. 130; in effect from January 3, 1930, through June 30, 1934 B-VG Art. 133 (now B-VG Art. 133), effective from Jan. 1, 2019, to May 24, 2018, last amended by BGBl. I No. 138/2017 Federal Constitutional Law (B-VG) Art. 133, effective as of January 1, 2019; last amended by Federal Law Gazette (BGBl.) I No. 22/2018 Federal Constitutional Law (B-VG) Art. 133, effective from May 25,May 2018 through December 31, 2018; last amended by Federal Law Gazette (BGBl.) I No. 22/2018; B-VG Art. 133; effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164/2013, B-VG Art. 133, effective from Jan. 1, 2014, through July 31, 2014, last amended by Federal Law Gazette I No. 51/2012 Federal Constitutional Law (B-VG) Art. 133, effective from January 1, 2004, through December 31, 2013, last amended by Federal Law Gazette I No. 100/2003 Federal Constitutional Law (B-VG) Art. 133, effective from January 1, 1975, through December 31, 2003, last amended by Federal Law Gazette No. 444/1974 Federal Constitutional Law (B-VG Art. 133 valid from Dec. 25, 1946, through Dec. 31, 1974, last amended by Federal Law Gazette No. 211/1946 B-VG Art. 133 valid from Dec. 19,December 1945 through December 24, 1946; last amended by State Law Gazette No. 4/1945; B-VG Art. 133; in effect from January 3, 1930, through June 30, 1934 BVwGG § 20 (currently BVwGG § 20), effective as of Oct. 1, 2025, last amended by Federal Law Gazette I No. 54/2025, BVwGG § 20, in effect from January 1, 2014, through September 30, 2025 BVwGG § 24a (now BVwGG § 24a), effective as of July 14, 2023, last amended by Federal Law Gazette I No. 77/2023 BVwGG § 24a effective from May 25, 2018, through July 13, 2023, last amended by Federal Law Gazette I No. 22/2018 GOG § 85 (current) GOG § 85 effective as of May 25, 2018, last amended by Federal Law Gazette I No. 32/2018 GOG § 85 effective from January 1, 2005, through May 24,2018, last amended by Federal Law Gazette I No. 128/2004 GOG § 85, effective from August 1, 1989, to December 31, 2004, repealed by Federal Law Gazette I No. 112/2003 GOG § 85, effective from May 1, 1983, through July 31, 1989; last amended by Federal Law Gazette No. 135/1983 GOG § 85 (current) GOG § 85 effective as of May 25, 2018, last amended by Federal Law Gazette I No. 32/2018 GOG § 85 effective from January 1, 2005, through May 24,2018, last amended by Federal Law Gazette I No. 128/2004; GOG § 85, effective from August 1, 1989, through December 31, 2004, repealed by Federal Law Gazette I No. 112/2003 GOG § 85 effective from May 1, 1983, through July 31, 1989, last amended by Federal Law Gazette No. 135/1983 Decision , W298 2314952-1/8E IN THE NAME OF THE REPUBLIC! The Federal Administrative Court, with Judge Mag. VEIGL presiding, Judge Dr. AMANN as an associate judge, and Judge Mag. LUGHOFER as an associate judge, has ruled on the complaint pursuant to Art. 130(2a) of the Federal Constitutional Law (B-VG) filed by XXXX, XXXX, represented by Attorney Mag. Franz SCHARF, Schulerstraße 20/7, 1010 Vienna, concerning data processing by a judicial body of the Federal Administrative Court, has rightly ruled as follows:The Federal Administrative Court, with Judge Mag. VEIGL presiding, Judge Dr. AMANN as an associate judge, and Judge Mag. LUGHOFER as an associate judge, having considered the complaint pursuant to article 130, paragraph 2a, B-VG, of Roman numeral 40, Roman numeral 40, with Attorney Mag. Franz SCHARF as representative, Schulerstraße 20/7, 1010 Vienna, concerning data processing by a judicial body of the Federal Administrative Court, has rightly ruled as follows: A) I. The complaint is partially upheld pursuant to § 85(1) of the Court Organization Act, and it is determined that XXXX’s fundamental right to data protection was violated by the publication on XXXX 2024 in the Federal Legal Information System of the decision dated XXXX 2024, Ref. No. XXXX, on XXXX 2024 in the Federal Legal Information System, the fundamental right to data protection was violated due to a lack of anonymization of the following references enclosed in quotation marks: Roman numeral I. The complaint is partially upheld pursuant to Section 85, paragraph 1, of the Court Organization Act, and it is determined that Roman numeral 40, through the publication on Roman numeral 40, 2024, in the Federal Legal Information System of the judgment dated Roman numeral 40, 2024, Case No. Roman numeral 40, the fundamental right to data protection has been violated due to the failure to anonymize the following references enclosed in quotation marks: - at the Education Center of the Security Academy (BZS) and in the Basic Police Training (PGA) program, through the place names “XXXX” and “XXXX ” (also abbreviated as “-XXXX”) and, at the State Police Directorate, by the place names “XXXX” and “XXXX,” as well as by the specific designations of the training courses “XXXX,” “XXXX” (p. 5, also in the illustrative description of this course: the “XXXX” in the year “XXXX”), “XXXX,” or “XXXX” ” and “XXXX” or “XXXX,” and—at the Security Academy’s Training Center (BZS) or in the Basic Police Training (PGA)—by the location designation “Roman 40” or “Roman 40” (also abbreviated as “- Roman 40”) and, at the State Police Directorate, by the location designation “Roman 40” or “Roman 40” as well as by the specific designation of the training courses “Roman 40,” “Roman 40” (p. 5, also in the illustrative explanation of this course: the “Roman 40” in the year “Roman 40”), “Roman 40” or “Roman 40” ” and “Roman 40” or “Roman 40” and - by the designation of the State Office for “XXXX.” - by the designation of the State Office for “Roman 40.” Consequently, the Federal Administrative Court is hereby ordered to retroactively anonymize the aforementioned ruling with respect to the cited references in the Federal Legal Information System within 6 weeks. II. In all other respects, the complaint is dismissed as unfounded pursuant to § 85(1) of the Court Organization Act. Roman numeral two. In all other respects, the complaint is dismissed as unfounded pursuant to § 85(1) of the Court Organization Act. III. The Federal Government shall reimburse the complainant for the costs of the complaint proceedings in the amount of EUR 50. Roman numeral three. The Federal Government shall reimburse the complainant for the costs of the complaint proceedings in the amount of EUR 50. B) The appeal is admissible pursuant to Article 133, paragraph 4, of the Federal Constitutional Law (B-VG). The appeal is admissible pursuant to Article 133, paragraph 4, of the Federal Constitutional Law (B-VG). Text Reasons for the Decision: I. Course of Proceedings: Roman numeral one. Course of Proceedings: 1. By a brief dated June 17, 2025, the complainant filed a complaint pursuant to Art. 130(2a) of the Federal Constitutional Act (hereinafter referred to as the “data protection complaint”) with the Federal Administrative Court, arguing in essence that the decision of the Federal Administrative Court dated April 24, 2025 (presumably referring to: XXXX 2024), which was published on XXXX 2024 in the Federal Legal Information System (hereinafter “RIS”), had not been (sufficiently) anonymized in the most sensitive areas. The complainant works in the Ministry of the Interior and also performs a religious function within a religious community. His function within this religious community, precisely described by the term “XXXX,” was mentioned expressly in the decision. Since, apart from the complainant, no other active civil servant in the Ministry of the Interior performs such a clerical function as an XXXX, he is easily identifiable as the complainant in the XXXX proceedings before the Federal Administrative Court through the publication of the decision. The complainant had also worked as a teacher at the XXXX Education Center of the Security Academy. Although the Security Academy operates twelve training centers, the designation “XXXX Training Center 1” is used. In a brief dated June 17, 2025, the complainant filed a complaint pursuant to article 130, paragraph 2(a), B-VG (hereinafter referred to as the “data protection complaint”) to the Federal Administrative Court, arguing in essence that the decision of the Federal Administrative Court dated April 24, 2025 (presumably referring to Roman 40 2024), which had been published under the reference Roman 40 2024 in the Federal Legal Information System (hereinafter: RIS), had not been (sufficiently) anonymized in the most sensitive areas. The complainant works in the Ministry of the Interior and also performs a clerical function within a religious community. His function within this religious community, precisely described by the term “Roman 40,” was mentioned expressly in the decision. Since, apart from the complainant, no other active civil servant in the Ministry of the Interior performs such a religious function as a “Roman 40,” he could easily be identified as the complainant in the “Roman 40” proceedings before the Federal Administrative Court through the publication of the decision. The complainant had also worked as an instructor at the “Roman 40” training center of the Security Academy. Although the Security Academy operates twelve training centers, the designation “Roman 40” training center had not been anonymized. Information regarding the complainant’s health condition had also been published. Due to the failure to anonymize this information, the complainant’s identity had become known among his colleagues. Since the complainant’s identity was known, it was also known that he had suffered from the mental illness described in the decision. 2. In a statement issued by the President of the Federal Administrative Court on July 18, 2025, in response to the data protection complaint, it was noted that the head of the relevant court division had pointed out that the assertion—namely, that there were no other XXXX in the entire Ministry of the Interior—could not be verified by the court. This statement was also unlikely given the approximately 32,000 police officers, especially since a brief online search conducted by the court showed that there was (at least) one other police officer who was also a XXXX. Even if limited to the local operations of the security academy in question (or the XXXX Training Center), it cannot be ruled out that there is another XXXX. This point was also not raised during the proceedings, which is why, at the time the anonymization was carried out, this (unverifiable) fact could not be assumed. The alleged “identifiability” of the complainant is therefore not established. An additional online search—conducted by staff of the Legal Division using the search terms “XXXX” and “XXXX” as well as “training center”—yielded no results that would allow for the identification of the complainant. 2. In a statement by the President of the Federal Administrative Court dated July 18, 2025, in response to the data protection complaint, it was noted that the head of the relevant court division had pointed out that the assertion—that there was no other “Roman numeral 40” in the entire Ministry of the Interior—could not be verified by the court. This statement was also unlikely given the approximately 32,000 police officers, especially since a brief online search conducted by the court showed that there was (at least) one other police officer who was also Roman 40. Even if the scope were limited to the local operations of the security academy in question (or the “Roman 40” training center), it could not be ruled out that there was another “Roman 40.” This point was also not raised during the proceedings, which is why, at the time the anonymization was carried out, this (unverifiable) fact could not be assumed either. The alleged “identifiability” of the complainant is therefore unfounded. An additional online search—conducted by staff from the Legal Department—using the search parameters “Roman 40 ” and “Roman 40,” as well as “Education Center,” did not yield any results that would allow for a conclusion regarding the complainant’s identity. 3. The complainant responded in a statement dated August 21, 2025, arguing that the failure to anonymize his clerical role as “XXXX” within a religious community, and thus his religious beliefs—in conjunction with the failure to anonymize his work as a teacher at the XXXX Educational Center—the cited expert opinion, which was also not anonymized, was now known to broad circles within the executive branch who could trace this information back to him. The fact that there is another XXXX cannot be verified in the absence of further details. The fact that it cannot be ruled out that there is another XXXX does not constitute justification for the failure to anonymize his clerical position as required. The head of the responsible court division failed to provide an explanation as to why the first and last names were not abbreviated to initials and why addresses and location details were not removed. 3. The complainant responded with a statement dated August 21, 2025, arguing that the failure to anonymize his religious function as “Roman 40” within a religious community, and thus his religious beliefs—in conjunction with the failure to anonymize his work as a teacher at the “Roman 40” educational center—the cited expert opinion, which was also not anonymized, was now known to broad circles within the executive branch who could trace this finding back to him. The claim that there is another “Roman 40” cannot be verified in the absence of further details. The fact that it cannot be ruled out that there is another “Roman 40” does not constitute justification for the failure to anonymize his religious function as required. The head of the competent court division failed to provide an explanation as to why the first and last names were not abbreviated to initials and why addresses and location details were not removed. 4. On June 2, 2026, the complainant submitted a statement of costs. II. The Federal Administrative Court considered: Roman numeral two. The Federal Administrative Court considered: 1. Findings: 1.1. In a decision dated XXXX 2024, Case No. XXXX, the Federal Administrative Court, sitting in a panel designated for this purpose, ruled on a complaint filed by the complainant in a matter of civil service law. 1.1. The Federal Administrative Court ruled by decision dated Roman numeral 40 2024, Case No. Roman numeral 40, in a chamber designated for that purpose, on a complaint filed by the appellant in a civil service matter. The above-mentioned decision was published in anonymized form in the RIS on XXXX 2024 and has been available for retrieval or viewing there in this form ever since.The aforementioned decision was published in anonymized form in the RIS on Roman numeral 40 2024 and has been available for retrieval or viewing there in this form ever since. It is immediately apparent from the aforementioned decision published in the RIS that the complainant, a police officer with the rank of Chief Inspector, is assigned to the Federal Ministry of the Interior and, pursuant to the contested decision of the Federal Minister of the Interior, was removed from his permanent position as a teacher at an educational center of the Security Academy and transferred to the State Office for XXXX.It is immediately apparent from the aforementioned ruling published in the RIS that the complainant, as a police officer with the rank of Chief Inspector, is assigned to the Federal Ministry of the Interior and, by the contested decision of the Federal Minister of the Interior, was removed from his permanent position as a teacher at a training center of the Security Academy and transferred to the State Office for Roman 40. 1.2. In the present data protection complaint, the complainant considers the aforementioned decision—particularly with reference to passages on pages 5, 18, and 27—to be insufficiently anonymized because his personal data is being disclosed on the Internet. He bases his claim of a data protection violation on the failure to anonymize ● his position as a teacher at the XXXX Education Center, including his address (with reference to passages on p. 5), his position as a teacher at the “Roman 40” Education Center, including his address (with reference to passages on p. 5), ● his religious role as “XXXX” (with reference to a passage on p. 18) and  his religious role as “Roman 40” (with reference to a passage on p. 18) and ● his state of health as described in an expert opinion (cited on p. 27) were each interpreted in context. 1.2.1. In the aforementioned ruling, the complainant’s teaching activities in the basic police training (PGA), as well as the names of the courses he taught at the training center at the Security Academy and the duty stations “XXXX” and “XXXX,” from which the complainant was transferred, were not anonymized. In addition, in this context, the place names “XXXX” and “XXXX” were not anonymized on p. 4 of the aforementioned decision at the State Police Directorate. As an example of this inadequate anonymization, the complainant referred in the data protection complaint to passages in the findings on page 5 of the aforementioned decision: 1.2.1. In the aforementioned decision, the complainant’s teaching activities in the Basic Police Training (PGA) program, as well as the names of the courses he taught at the Training Center of the Security Academy and the duty station “Roman 40” or “Roman 40,” from which the complainant was transferred. Additionally, in this context, the place name “Roman 40” or “Roman 40” was not anonymized by the State Police Directorate on page 4 of the aforementioned decision. As an example of this inadequate anonymization, the complainant referred in the data protection complaint to passages in the findings on page 5 of the aforementioned decision: “At the location ‘BZS XXXX’ ’ (Training Center of the XXXX Security Academy), police cadets are trained for entry into the profession (basic police training, referred to here as ‘PGA’ or ‘PGA-XXXX’ for XXXX) and experienced police officers are trained for middle management (basic training course for job category E2a). The PGA lasts two years, with July and August not being breaks from classes. A class system is in place, and the cadets hold the official title of “Aspirant” (Asp). Classes are designated according to the Austria-wide sequence; for example, Course XXXX is the XXXX course that began in the year XXXX. At the XXXX location, approximately 70 to 80 full-time instructors teach specific subjects. The complainant spent approximately 30 hours per week in the classrooms; the remaining time was devoted to lesson planning, follow-up work, and administrative tasks. The complainant primarily taught in the XXXX and XXXX courses, serving as deputy class commander in the PGA XXXX in May XXXX and as class commander in the PGA XXXX beginning in September XXXX. He taught the subjects XXXX. “At the ‘BZS Roman 40’ location (Training Center of the Security Academy Roman 40), police cadets are trained for entry into the profession (basic police training, referred to here as ‘PGA’ or ‘PGA-Roman 40’ for Roman 40) and experienced police officers for middle management (basic training course for employment group E2a). The PGA lasts 2 years, with July and August not being breaks from classes. There is a class system, and the cadets hold the official title of “Aspirant” (Asp). Classes are designated according to the Austria-wide sequence; for example, the “Roman 40” course is the Roman 40 course that began in the year Roman 40. At the “Roman 40” location, approximately 70 to 80 full-time teachers instruct students and are assigned specific subjects. The complainant spent approximately 30 hours per week in the classrooms; the remaining time was devoted to lesson planning, follow-up work, and administrative tasks. The complainant taught primarily in the Roman 40 and Roman 40 courses, serving as deputy class commander in PGA Roman 40 in May and, beginning in September, as class commander in PGA Roman 40. He taught the subjects in Roman 40. The Security Academy, as Department XXXX, is incorporated into Section I of the Federal Ministry of the Interior. Its director is XXXX, who was interviewed on December 5, 2023. One unit within this department oversees the 12 training centers, which are headed by XXXX (formerly XXXX). The 12 decentralized training centers (“BZS”) throughout Austria are part of the SIAK/Department; the XXXX Training Center in XXXX is the largest training center, with approximately XXXX PGA and XXXX courses for mid-level police management. (…) “The Security Academy, as Department Roman 40, is incorporated into Section Roman 1 of the Federal Ministry of the Interior. Its director is Roman 40, who was interviewed on December 5, 2023. A division within this department oversees the 12 training centers, headed by Roman 40 (formerly Roman 40). The 12 decentralized training centers (“BZS”) throughout Austria are part of the SIAK/Department; the Training Center Roman 40 in Roman 40 is the largest training center, with approximately Roman 40 PGA and Roman 40 courses for mid-level police management. (…)” The fact that the complainant was transferred from the Training Center of the Security Academy XXXX to the State Office for XXXX was also not anonymized or redacted in the above-mentioned decision. Similarly, the fact that the complainant was transferred from the Training Center of the Security Academy Roman 40 to the State Office for Roman 40 was not anonymized or redacted in the aforementioned decision. 1.2.2. On p. 18 of the above-mentioned decision, in the assessment of evidence—specifically in the evaluation of a witness’s testimony—the complainant is referred to once as “XXXX” in the following context: 1.2.2. On page 18 of the aforementioned decision, in the assessment of the evidence—specifically in the evaluation of a witness’s testimony—the complainant is referred to once as “Roman 40” in the following context: After the complainant asked the witness—a student in a course he taught—a question during the hearing and did not receive the answer he wanted in terms of accuracy, he continued to question her with increasing pressure. The pressure exerted by the complainant on the witness during the hearing was apparently so great that—as is evident from the discussion of the assessment of evidence—even “the presiding judge had to intervene.” This hot-tempered behavior was then held against the complainant during the hearing, and he justified himself by stating that, as a detective, he had been conducting interrogations for a long time and had generally never applied pressure during them. At this point, the complainant added, verbatim: “He found it (the criticism) simply unfair; he was also XXXX, and if that were the case, he would have failed at his job as well.”After the complainant asked the witness—a trainee in a course he was teaching—a question during the hearing and did not receive the answer he wanted in terms of accuracy, he continued to question her with increased pressure. The pressure exerted by the complainant on the witness during the hearing was apparently so great that—as is evident from the remarks on the assessment of evidence—even “the presiding judge had to intervene.” This hot-tempered behavior was then held against the complainant during the hearing, and he justified himself by stating that, as a detective, he had been conducting interrogations for a long time and had generally never applied pressure during them. At this point, the complainant added verbatim: “He found it (the accusation) simply unfair; he was also 40 years old and would have failed at his job as well.” It follows that if the word “XXXX” were completely anonymized at this point in the ruling, the complainant’s counterargument to the accusation made during the hearing—namely, that otherwise he would have failed at his job—would no longer be comprehensible.It follows that if the term “Roman 40” were completely anonymized at this point in the decision, the complainant’s counterargument to the accusation made during the hearing—namely, that otherwise he would have failed in his profession as well—would no longer be comprehensible. 1.2.3. The expert opinion cited on p. 27 of the aforementioned ruling—prepared by the expert consulted in the disciplinary proceedings—describes the complainant’s mental illness in terms of the duration and severity of the condition. 2. Assessment of the Evidence: The findings were based in particular on the data protection complaint dated June 17, 2025, and the court record. Re 1.1.: The above findings—that the decision dated XXXX 2024 was published anonymously in the RIS on XXXX 2024 and has been available for retrieval or viewing there in this form ever since—are confirmed by a recent review of the RIS. Re 1.1.: The above findings—that the judgment dated Roman numeral 40 2024 was published anonymously in the RIS on Roman numeral 40 2024 and has been available for retrieval or viewing there in this form ever since—are based on a recent review of the RIS. Re 1.2.1.: The above findings regarding the complainant’s place of employment, including the addresses of the transferring and receiving agencies, are evident from a review of the aforementioned decision in the form currently available in the RIS. It should be noted that while references to the place of employment “XXXX ” (also - XXXX), the names of the training courses taken, and the receiving agency, the State Office for XXXX, appear in various places in the text of the decision, while the address of the place of employment “XXXX” appears only in the cited findings on p. 5 of the aforementioned decision. Furthermore, it should be noted that, with regard to the State Police Directorate, the location designation “XXXX” or “XXXX” appears only on p. 4 of the aforementioned ruling.It is noted that, in the aforementioned ruling, the references to the duty station “Roman 40” (also “-Roman 40”), the names of the courses offered, and the host agency “State Office for Roman 40” appear in various places in the text of the decision, while the address of the duty station “Roman 40” appears only in the cited findings on page 5 of the aforementioned decision. Furthermore, it is noted that, in the case of the State Police Directorate, the location designation “Roman 40” or “Roman 40” appears only on p. 4 of the aforementioned decision. Re 1.2.2.: The above findings regarding the designation of the complainant as “XXXX” are based on the Court’s assessment, on page 18 of the aforementioned ruling, of a witness’s testimony in conjunction with the complainant’s demeanor as observed by the Court during the hearing.Re 1.2.2.: The above findings regarding the designation of the complainant as “Roman 40” follow from the assessment, made on p. 18 of the aforementioned decision, of a witness’s testimony in conjunction with the complainant’s demeanor as observed by the Court during the hearing. 3. Legal Assessment: 3.1. Pursuant to Article 130(2a) of the Federal Constitutional Law (B-VG), the administrative courts rule on complaints filed by persons whose rights, as defined by Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) — GDPR, Official Journal No. L 119 of May 4, 2016, p. 1.3.1. Pursuant to Article 130, paragraph 2(a), of the Federal Constitutional Law (B-VG), the administrative courts adjudicate on complaints filed by individuals whose rights under Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) —GDPR, Official Journal No. L 119 of May 4, 2016, page 1. Pursuant to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court decides through a single judge, unless federal or state laws provide for a decision by a panel. Pursuant to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court decides through a single judge, unless federal or state laws provide for a decision by a panel. Pursuant to Section 24a of the Federal Administrative Court Act (BVwGG), Sections 84 and 85 of the General Court Act (GOG) apply mutatis mutandis, with the proviso that a panel of the Federal Administrative Court shall make a decision on a complaint within the meaning of Article 130(2a) of the Federal Constitutional Act (B-VG) regarding alleged violations of such rights. Pursuant to § 7(1) of the Federal Administrative Court Act (BVwGG), the panel consists of a presiding judge and two additional members serving as associate judges. Pursuant to Section 24a of the Federal Administrative Court Act (BVwGG), Sections 84 and 85 of the General Administrative Court Act (GOG) apply mutatis mutandis, provided that a panel of the Federal Administrative Court makes a decision on a complaint within the meaning of Article 130, paragraph 2a, of the Federal Constitutional Act (B-VG) regarding alleged violations of such rights. Pursuant to paragraph 7(1) of the Federal Administrative Court Act (BVwGG), the panel consists of a presiding judge and two additional members serving as associate judges. 3.2. Regarding A) 3.2.1. Pursuant to § 20 of the BVwGG, findings and decisions that are not merely procedural in nature must be published in anonymized form in the RIS. 3.2.1. Pursuant to Section 20 of the BVwGG, rulings and decisions that are not merely procedural in nature must be published in anonymized form in the RIS. The rulings and decisions of the Federal Administrative Court are to be made generally accessible in anonymized form; and the adjudicating body must specify which personal data may not be disclosed in the publicly accessible text of the decision (see Explanatory Memorandum 2008, BlgNR 24th Session, p. 5). The rulings and decisions of the Federal Administrative Court shall be made generally accessible in anonymized form; in doing so, the adjudicating body must specify which personal data may not be disclosed in the publicly accessible text of the decision (see Explanatory Memorandum to the 2008 Constitutional Amendment, BlgNR 24. GP, page 5). The decision regarding which personal data should be anonymized in court decisions without substantially altering the meaning of the decision’s text is made by the respective adjudicating body (see VwGH, Aug. 9, 2021, Ra 2019/04/0106, para. 33). The decision as to which personal data in court decisions should be anonymized without significantly altering the meaning of the decision’s text is made by the respective decision-making body; see VwGH, August 9, 2021, Ra 2019/04/0106, para. 33). The anonymization of a court decision in the RIS, as a form of disclosure on the Internet, constitutes processing within the meaning of Art. 4(2) of the GDPR. The respective decision-making body is the presiding judge or, in the case of a panel (as is the case here), the presiding judge, who is the “controller” within the meaning of Article 4(7) of the GDPR when anonymizing the text of the decision. The anonymization of a court decision in the RIS, as a form of disclosure on the Internet, constitutes processing within the meaning of article 4(2) of the GDPR. The relevant decision-making body is the presiding judge or, in the case of a panel (as in the present case), the presiding judge, who, when anonymizing the text of the decision, is the “controller” within the meaning of article 4(7) of the GDPR. 3.2.2. Regarding Point I of the Judgment (partial finding of a data protection violation, including an order to provide services):3.2.2. Regarding Point I of the Judgment (partial finding of a data protection violation, including an order to provide services): 3.2.2.1. Pursuant to Article 4(1) of the GDPR, “personal data” means any information relating to an identified or identifiable natural person. The term “information” encompasses, without limitation, “all information” relating to a person, thereby demonstrating that the term is to be interpreted broadly. Thus, personal information such as identifying characteristics (name, address, and date of birth), physical characteristics (gender, eye color, height, weight), or internal states (opinions, motives, desires, beliefs, value judgments) is included just as much as factual information, such as financial and property circumstances, communication and contractual relationships, as well as other relationships of the data subject with third parties and their environment (Hödl in Knyrim, DatKomm Art. 4 GDPR [as of Dec. 1, 2018, rdb.at] para. 9). 3.2.2.1. According to Article 4(1) of the GDPR, “personal data” means any information relating to an identified or identifiable natural person. The term “information” encompasses, without limitation, “all information” relating to a person, which demonstrates that the term is to be understood broadly. Thus, personal information such as identifying characteristics (name, address, and date of birth), physical characteristics (gender, eye color, height, weight), or internal states (opinions, motives, desires, beliefs, value judgments) is included just as much as factual information, such as financial and property circumstances, communication and contractual relationships, as well as other relationships between the data subject and third parties and their environment (Hödl in Knyrim, DatKomm article 4, GDPR [as of Dec. 1, 2018, rdb.at] Margin Note 9). According to Article 4(15) of the GDPR, “data concerning health” means personal data related to the physical or mental health of a natural person, including the provision of health care services, and from which information regarding the data subject’s health status can be derived.According to article 4(15) of the GDPR, “data concerning health” refers to personal data relating to the physical or mental health of a natural person, including the provision of health services, and from which information about that person’s health status can be derived. In its recent ruling on Case OC 479/22 dated March 7, 2024, the CJEU clarified that, for information to be classified as personal data, it is not necessary for the information itself to enable the identification of the data subject (see CJEU, Oct. 24, 2024, OC 479/22p, in particular para. 44 et seq., and judgement of Oct. 19, 2016, Breyer, C-582/14, EU:C:2016:779, para. 41). In its more recent case law regarding OC 479/22 dated March 7,2024, the CJEU has clarified that, for information to be classified as personal data, it is not necessary for the information, in and of itself, to enable the identification of the person concerned; see, in this regard, CJEU, Oct. 24, 2024, OC 479/22p, in particular para. 44 et seq., and the judgement of October 19, 2016, Breyer, C-582/14, EU:C:2016:779, para. 41). Consequently, the processing of personal data within the meaning of the GDPR already occurs when identification is possible by reasonable means—even by drawing on additional information. Based on the aforementioned finding, which is accessible in the RIS, the complainant’s employment as a teacher at the “XXXX” or “XXXX” ” (at the State Police Directorate “XXXX” or “XXXX”) and his transfer to the State Office for “XXXX ” (see the findings above under 1.2.1.) and, on the other hand, his mental illness as described on p. 27 of the aforementioned decision (see the findings above under 1.2.3.) have been disclosed. The aforementioned decision, which is available in the RIS, discloses, on the one hand, the complainant’s employment as a teacher at the Education Center “Roman 40” or “Roman 40 ” (at the State Police Directorate “Roman 40” or “Roman 40”) and his transfer to the State Office for “Roman 40 ” (see the findings above under 1.2.1.) on the one hand, and his mental illness, as described on p. 27 of the aforementioned decision (see the findings above under 1.2.3.), on the other. Thus, in the present case, there has been processing within the meaning of Article 4(2) of the GDPR of both the complainant’s personal data and sensitive data concerning health. Thus, in the present case, there is processing within the meaning of Article 4(2) of the GDPR of both the complainant’s personal data and sensitive data concerning health. 3.2.2.2. Pursuant to the principle of lawfulness of processing under Article 6(1) of the GDPR, the purpose of the processing must either be necessary for compliance with a legal obligation to which the controller is subject (subparagraph (c)), or necessary for the purpose of processing a task carried out in the public interest, or carried out in the exercise of official authority vested in the controller (lit. e). 3.2.2.2. Pursuant to the principle of lawfulness of processing under Article 6, paragraph 1, GDPR: either necessary for compliance with a legal obligation to which the controller is subject (subparagraph (c)), or necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (subparagraph (e)). Anonymization is defined as the processing of personal data contained in a decision in such a way that attribution to specific individuals in the given context is ruled out as far as possible. In any case, it involves the abbreviation or complete removal of all personal information that would enable such identification (e.g., through research on the Internet or in publicly accessible databases)—such as names, addresses, locations, [email] addresses, websites, enterprises owned, job titles, personal identification numbers, specific individual circumstances, etc.) and their replacement, to the greatest extent possible, with abstract placeholders (“petitioner,” “complainant,” “in X”), to the extent that this is necessary for the comprehensibility of the text’s legal content. The publication of judicial decisions (the purpose justifying publication) aims to ensure transparency of the legal situation from the Court’s perspective. In this context, the details regarding the facts of the case (their individualization) serve only to ensure the comprehensibility of the legal reasoning (see Nogratnig in Fellner/Nogratnig RStDG, GOG, and StAG II5.04 § 20 BVwGG (as of September 1, 2025, rdb.at)). Anonymization is understood to mean the processing of personal data contained in a decision in such a way that identification of specific individuals in the given context is ruled out as far as possible. In any case, it includes the abbreviation or complete removal of all personal information that would enable such identification (e.g., through research on the Internet or in publicly accessible databases) (names, addresses, locations, [email] addresses, websites, enterprises owned, job titles, personal identification numbers, specific individual circumstances, etc.) and their replacement, to the greatest extent possible, with abstract placeholders (“petitioner,” “complainant,” “in X”), to the extent that the comprehensibility of the text’s legal content requires it at all. The publication of judicial decisions (the purpose justifying publication) aims to ensure transparency of the legal situation from the Court’s perspective. In this context, the details regarding the facts of the case (their individualization) serve only to ensure the comprehensibility of the legal reasoning; see Nogratnig in Fellner/Nogratnig RStDG, GOG, and StAG II5.04, Section 20, BVwGG (as of September 1, 2025, rdb.at)). The Administrative Court has also already stated the following in its case law: The anonymization of court decisions for the purpose of publication requires a balancing of the protection of the privacy of the persons involved in the proceedings against the public interest in access to case law (see VwGH, August 9, 2021, Ra 2019/04/0106, para. 33). The publication of court decisions (particularly in the RIS) serves, on the one hand, to promote legal certainty by providing those seeking legal guidance with a source of law—in addition to the statute—that addresses, in particular, the application and interpretation of applicable law; and, on the other hand, to promote transparency by enabling effective public scrutiny of court decisions. To safeguard the personal rights of those involved in the proceedings (parties, witnesses, and other participants), personal data must be anonymized (see VwGH, August 9, 2021, Ra 2019/04/0106, para. 30). The Administrative Court has also already stated in its case law: The anonymization of court decisions for the purpose of publication requires a balancing of the protection of the personal rights of those involved in the proceedings against the public’s interest in access to case law (see VwGH, Aug. 9, 2021, Ra 2019/04/0106, para. 33). The publication of court decisions (particularly in the RIS) serves, on the one hand, to promote legal certainty by providing those seeking legal guidance with a source of law—in addition to the statute—that addresses, in particular, the application and interpretation of applicable law; and, on the other hand, to promote transparency by enabling effective public scrutiny of court decisions. To safeguard the personal rights of those involved in the proceedings (parties, witnesses, and other participants), personal data must be anonymized; see VwGH, August 9, 2021, Ra 2019/04/0106, para. 30). In light of the above case law of the highest courts, it must therefore be examined in this case to what extent the processing of the complainant’s aforementioned personal (health) data, as carried out in the aforementioned ruling, is necessary for understanding the decision. 3.2.2.3. The data protection complaint regarding the insufficient anonymization of the complainant’s personal (health) data is justified based on the following considerations of the adjudicating panel: Due to the publication of the aforementioned ruling in the RIS, insufficient anonymization of his work as a teacher at the Education Center of the Security Academy “XXXX” or “XXXX” and the identification of the courses he taught make it possible to trace the information back to the complainant. Furthermore, the aforementioned decision addresses the complainant’s transfer, as a police officer, from his permanent position as a teacher at the training center of the Security Academy “XXXX” to the State Office for “XXXX.” In the Senate’s view, it is well known that there are not a large number of individuals within the police force who have been transferred from their permanent position as a teacher at the training center of the “XXXX” Security Academy to the State Office for “XXXX.” The information cited is in itself sufficient to allow a group of individuals—whose exact number cannot be determined—to draw conclusions about the complainant and, thereby, to gain knowledge of his mental illness cited on p. 27 of the aforementioned ruling, i.e., of his sensitive data concerning health. Due to the publication of the aforementioned decision in the RIS, it is possible to trace the information back to the complainant based on the insufficient anonymization of his position as a teacher at the Security Academy’s “Roman 40 ” or “Roman 40” and the names of the courses he taught, it is possible to trace the information back to the complainant. Furthermore, the aforementioned decision addresses the complainant’s transfer as a police officer from his permanent position as a teacher at the Training Center of the Security Academy “Roman 40” to the State Office for “Roman 40.” In the Senate’s view, it is well known that there are not a large number of individuals within the police force who have been transferred from their permanent position as a teacher at the Security Academy’s Training Center “Roman 40” to the State Office for “Roman 40.” The information provided is in itself sufficient for an indeterminate group of individuals to draw conclusions about the complainant and thereby also gain knowledge of his mental illness, as cited on page 27 of the aforementioned decision—that is, of his sensitive data concerning health. Due to the demonstrated inadequate anonymization of his personal (health) data, it was therefore possible to draw conclusions about the complainant, such that he is, in any case, identifiable as a natural person within the meaning of Art. 4(1) of the GDPR to a larger group of unauthorized individuals.Due to the demonstrated inadequate anonymization of his personal (health) data, it was therefore possible to draw conclusions about the complainant, meaning that he is, in any case, identifiable as a natural person within the meaning of Article 4(1) of the GDPR to a larger group of unauthorized individuals. In a further step, against the backdrop of the aforementioned case law of the highest courts, it is now necessary to examine, within the framework of a balancing of interests, whether the complainant’s legal interest in data protection for his personal (health)data or the public’s interest in learning about the case law. With regard to the disclosure on the Internet of his employment as a teacher at the Education Center and his transfer to the State Office for “XXXX,” the balancing of interests favors the complainant for the following reasons: With regard to the disclosure on the Internet of his employment as a teacher at the Education Center and his transfer to the State Office for “Roman 40,” the balancing of interests favors the complainant for the following reasons: The purpose of publishing court decisions—namely, legal certainty and transparency—would nevertheless have been served by anonymizing the place of employment “XXXX ” or “XXXX” and the courses taught in connection with his teaching activities at the Security Academy’s Education Center, as well as his transfer to the State Office for “XXXX,” would still have been ensured. The substance of the decision text in the aforementioned ruling would also not change significantly if the place of employment “XXXX ” or “XXXX” and the names of the courses he taught in connection with his teaching activities at the Security Academy’s Training Center, as well as the name of the receiving agency, the State Office for “XXXX,” were anonymized.The purpose of publishing court decisions—namely, legal certainty and transparency—would not be compromised by anonymizing the place of employment “Roman 40 ” or “Roman numeral 40,” the courses taught in connection with his teaching activities at the Security Academy’s Training Center, and the transfer to the State Office for “Roman numeral 40” would still have been ensured. The substance of the text of the aforementioned ruling would also not change significantly if the place of employment “Roman 40 ” or “Roman 40,” the names of the courses he taught in connection with his teaching activities at the Security Academy’s Training Center, and the name of the receiving agency, the State Office for “Roman 40,” were anonymized. With regard to the disclosure of his sensitive data concerning health on the Internet, however, the balancing of interests works against the complainant for the following reasons: There is, in fact, an overriding public interest in access to case law, particularly in decisions concerning civil service, disciplinary, and social law, in which the existence and/or severity of an illness may need to be disclosed for substantive legal reasons. Consequently, the processing of the complainant’s sensitive data concerning health was necessary pursuant to Art. 5(1)(a) and Art. 6(1)( (e) in conjunction with para 3 of the GDPR, for the performance of a task carried out in the public interest, so that this processing must be considered lawful under one of the principles of the GDPR.Consequently, the processing of the complainant’s sensitive data concerning health is necessary, pursuant to article 5, paragraph 1, subparagraph (a), and article 6, paragraph 1, subparagraph (e), in conjunction with paragraph 3, GDPR, is necessary for the performance of a task carried out in the public interest, so that this processing must be considered lawful under one of the principles of the GDPR. The data protection complaint at issue is partially dismissed in Point I for the reasons set forth above pursuant to § 85(1) of the Court Organization Act, and it is determined that XXXX, through the publication on XXXX 2024 in the Federal Legal Information System of the ruling dated XXXX 2024, Case No. XXXX, published on XXXX 2024 in the Federal Legal Information System, infringed upon the fundamental right to data protection due to a failure to anonymize the following references enclosed in quotation marks: The data protection complaint at issue is partially upheld in Point I. For the reasons set forth above, pursuant to paragraph 85(1) of the Court Organization Act, the complaint is partially upheld, and it is determined that Roman numeral 40, through the publication on Roman numeral 40, 2024, in the Federal Legal Information System of the ruling dated Roman numeral 40, 2024, Ref. No. Roman 40, constitutes a violation of the fundamental right to data protection due to a failure to anonymize the following references enclosed in quotation marks: - at the Education Center of the Security Academy (BZS) and in the Basic Police Training (PGA) program, by the place names “XXXX” and “XXXX ” (also abbreviated as “-XXXX”) and, at the State Police Directorate, by the place names “XXXX” and “XXXX,” as well as by the specific designations of the training courses “XXXX,” “XXXX” (p. 5, also in the example explanation of this course: the “XXXX” in the year “XXXX”), “XXXX,” or “XXXX ” and “XXXX” or “XXXX,” and—at the Security Academy’s Training Center (BZS) or during Basic Police Training (PGA)—by the location designation “Roman 40” or “Roman 40 ” (also abbreviated as “- Roman 40 ”) and, at the State Police Directorate, by the location designation “ Roman 40 ” or “ Roman 40 ” as well as by the specific designation of the training courses “ Roman 40 ,” “Roman 40” (p. 5, also in the illustrative explanation of this course: the “Roman 40” in the year “Roman 40”), “Roman 40,” or “Roman 40 ,” and “Roman 40” or “Roman 40,” and - through the designation of the State Office for “XXXX.” - through the designation of the State Office for “Roman 40.” Accordingly, the Federal Administrative Court must also be issued a directive in Point I of the ruling to (re)anonymize these references. Accordingly, the Federal Administrative Court must also be issued a directive in Point Roman one of the ruling to (re)anonymize these references. 3.2.3. Regarding Point II (Dismissal of the Remaining Claims): 3.2.3. Regarding Point Roman Numeral Two (Dismissal of the Remaining Claims): With regard to his data protection complaint, the complainant also relies on the fact that he holds a clerical position as “XXXX” and that the mention of his clerical position on p. 18 of the aforementioned decision violates his fundamental right to data protection. The complainant also bases his data protection complaint on the fact that he holds a clerical position as “Roman 40” and that the mention of his clerical position on p. 18 of the aforementioned decision violated his fundamental right to data protection. However, the data protection complaint is not justified in this regard based on the following considerations of the adjudicating panel: It follows from the case law of the Supreme Court regarding a comparable legal situation involving the anonymization of court decisions in the ordinary courts that the primary focus should be on the comprehensibility of the decision (Supreme Court decision of Oct. 11, 2018, 12 Ns 29/18p). Where identifying factual details necessary for understanding the decision become apparent in the reasoning (Danzl/Hopf, OGH [2017] 124), the decision must be published even if the anonymity of the parties is not guaranteed (4 Ob 101/09w = EvBl 2010/18 [Konecny concurring]). In the Senate’s view, given that the word “XXXX” is processed only once in the aforementioned ruling—disregarding the portions that were wrongly left unanonymized (see above)—it is virtually impossible to identify the complainant. Furthermore, it was determined that if the word “XXXX” were fully anonymized at this point in the decision, the complainant’s rebuttal to the allegation made during the hearing—namely, that otherwise the complainant would have failed his profession—would no longer be comprehensible. In this respect, in accordance with the case law cited, identifying factual details are required in the reasoning that are necessary for understanding the decision, so that to this extent, the lack of anonymization is not objectionable. In the Senate’s view, given that the term “Roman 40” is processed only once in the aforementioned ruling—disregarding the parts that were wrongly not anonymized (see above)—it is virtually impossible to draw conclusions about the appellant. Furthermore, it was determined that if the phrase “Roman 40” were fully anonymized at this point in the ruling, the appellant’s counterargument to the objection raised during the hearing—namely, that otherwise the appellant would have failed his profession—would no longer be comprehensible. In this respect, in accordance with the case law cited, identifying factual details are required in the reasoning to the extent necessary for understanding the decision; thus, to this extent, the lack of anonymization is not objectionable. For legal reasons alone, it is therefore irrelevant that, with regard to the local operations of the security academy in question, it cannot be ruled out that there is (at least) one other police officer who is also XXXX. Nor is it relevant that an Internet search—conducted by staff of the Legal Department using the search parameters “XXXX ” and “XXXX” or “training center” did not yield any results that would allow an identification of the complainant.For legal reasons alone, it is therefore irrelevant that, with regard to the local operations of the security academy in question, it cannot be ruled out that there is (at least) one other police officer who is also Roman 40. Nor is it relevant that an Internet search—conducted by staff of the Legal Department—using the search terms “Roman 40 ” and “Roman 40,” or even “training center,” did not yield any results that would allow for an identification of the complainant. Consequently, the processing of the word “XXXX ” in the context of the decision’s assessment of the evidence is necessary pursuant to Art. 5(1)(a) and Art. 6(1)(c) in conjunction with (3) of the GDPR to fulfill a legal obligation to which the controller—the presiding judge—is subject; so that this processing must also be considered lawful under one of the principles of the GDPR.Consequently, the processing of the word “Roman 40” in the context of the assessment of evidence in the decision is necessary pursuant to article 5(1)(a) and article 6(1)(c), in conjunction with paragraph 3, GDPR to fulfill a legal obligation to which the controller—the presiding judge—is subject; thus, this processing must also be deemed lawful under one of the principles of the GDPR. It was therefore necessary to make a decision in accordance with the judgment in Point II. Accordingly, with regard to Point II, the decision was to be rendered as stated in the ruling. 3.2.4. Regarding reimbursement of costs (Point III): 3.2.4. Regarding reimbursement of costs (Point III): In his data protection complaint filed on June 17, 2025, to initiate proceedings, the complainant requested reimbursement of the costs of the complaint. Pursuant to § 85(5), last sentence, of the GOG, in a decision granting the complaint, the Federal Government must be ordered to reimburse the complainant for the costs of the complaint. Pursuant to Section 85, paragraph 5, last sentence, of the GOG, in a decision granting the appeal, the Federal Government must be ordered to reimburse the complainant for the costs of the appeal. Section 24a of the Administrative Court Act (BVwGG) expressly declares Sections 84, 85, and 85b of the GOG to be applicable. According to the legislative materials for Federal Law Gazette I No. 22/2018 (including amendment to the B-VG and BVwGG), specific legal protection under data protection law is to be introduced in accordance with the model provisions in the area of ordinary jurisdiction (see §§ 83 et seq. GOG) (see SA 100 BlgNR 26. GP 2). The legislature thereby makes it clear that in such proceedings concerning complaints based on judicial activity, the regime of the GOG is to apply in the first instance. Section 24a, BVwGG expressly declares Sections 84, 85, and 85b of the GOG to be applicable to complaint proceedings concerning an alleged violation of the right to data protection by an administrative court in the exercise of its judicial jurisdiction pursuant to article 130, paragraph 2a, of the B-VG. According to the explanatory materials accompanying the Federal Law Gazette, Part One, No. 22 of 2018, (including amendments to the B-VG and BVwGG), specific legal protection under data protection law is to be introduced based on the model provisions in the area of ordinary jurisdiction (see Sections 83 et seq. of the GOG); see Committee Report 100 BlgNR 26. Legislative Period 2). The legislature thereby makes it clear that, in such proceedings concerning complaints arising from judicial activity, the provisions of the GOG are to apply in the first instance. Pursuant to § 85(5), last sentence, of the GOG, in a decision granting the appeal, the Federal Government is to be ordered to reimburse the appellant for the costs of the appeal. Pursuant to § 85(2), last sentence, of the GOG, the competent Court decides in non-contentious proceedings (unless otherwise provided). In the absence of a contrary provision by the legislature, the provision of the AußStrG regarding reimbursement of costs—specifically para 78 leg. cit., shall apply (VwGH Aug. 20, 2025, Ra 2024/04/0321-9).Pursuant to Section 85(5), last sentence, of the GOG, in a decision granting the appeal, the Federal Government must be ordered to reimburse the appellant for the costs of the appeal. Pursuant to Section 85(2), last sentence, of the GOG, the competent Court decides in non-contentious proceedings (unless otherwise specified). In the absence of a contrary provision by the legislature, the provision of the AußStrG regarding reimbursement of costs—specifically, paragraph 78, leg. cit., must be applied (VwGH Aug. 20, 2025, Ra 2024/04/0321-9). Due to the legislature’s explicit reference in § 24a BVwGG to the provisions of the GOG, the BVwG must, in the event of a decision granting the appeal in appeal proceedings pursuant to Art. 130(2a) of the Federal Constitutional Act (B-VG), the Federal Administrative Court must apply the provision of the AußStrG cited here when determining the costs of the appeal and setting the extent of reimbursement thereof. This is not altered by the fact that the legislative materials indicate that “[a]s in other proceedings before the Federal Administrative Court […], the provisions of the Administrative Court Procedure Act — VwGVG, Federal Law Gazette I No. 33/2013, [are to] apply” (see SA 100 BlgNR 26. GP 2), because the VwGVG—except in exceptional cases not applicable here, such as costs in proceedings concerning complaints against the exercise of direct administrative authority to issue orders and enforce measures pursuant to § 35 VwGVG —does not provide for a claim for reimbursement of costs, but rather the principle of self-bearing of costs applies within its scope of application. The application of the aforementioned principle to proceedings concerning a data protection violation by an administrative court in the exercise of its judicial powers is precluded by para 85(5), last sentence, GOG as lex specialis (VwGH Aug. 20, 2025, Ra 2024/04/0321-9).Due to the legislature’s explicit reference in Section 24a of the BVwGG to the provisions of the GOG, the Federal Administrative Court (BVwG) must, in the event of a decision granting the appeal in appeal proceedings pursuant to article 130, paragraph 2a, B-VG, the provision of the AußStrG cited here must be applied when determining the costs of the appeal and setting the extent of reimbursement thereof. This is not altered by the fact that the legislative materials indicate that “[a]s in other proceedings before the Federal Administrative Court […] the provisions of the Administrative Court Procedure Act (VwGVG), Federal Law Gazette Part One, No. 33 of 2013” (see Committee Report 100, BlgNR 26. Legislative Period 2), because the VwGVG—except in exceptional cases not applicable here involving costs in proceedings concerning complaints regarding the exercise of direct administrative authority to issue orders and impose coercive measures pursuant to Section 35, VwGVG—does not provide for a claim for reimbursement of costs, but rather the principle of self-financing applies within its scope of application. The application of the aforementioned principle to proceedings concerning a data protection violation by an administrative court in the exercise of its judicial powers is precluded by paragraph 85(5) last sentence of the GOG as lex specialis (VwGH Aug. 20, 2025, Ra 2024/04/0321-9). Section 78(2) of the AußStrG provides that the costs necessary for a party to pursue or defend its legal claims in an appropriate manner are to be reimbursed to the extent that the party was successful in pursuing or defending its claims. Pursuant to § 78(1) of the AußStrG, the Court must determine, without further inquiry and after careful consideration of all circumstances, the extent to which reimbursement of costs is to be ordered. Pursuant to § 78(4) of the AußStrG, the provisions of the ZPO apply mutatis mutandis to the itemization of costs. Pursuant to § 54(1) of the Civil Procedure Code (ZPO), the party claiming reimbursement of costs must submit to the Court a statement of costs, together with any supporting documents necessary to certify the amounts and details in that statement, or else forfeit its right to reimbursement (VwGH Aug. 20, 2025, Ra 2024/04/0321-9). Section 78(2) of the AußStrG provides that the costs necessary for a party’s proper pursuit or defense of a legal claim are to be reimbursed to the extent that the party was successful in its pursuit or defense of the claim. Pursuant to Section 78, paragraph 1, of the AußStrG, the Court must determine, without further inquiry and after careful consideration of all circumstances, the extent to which reimbursement of costs is to be ordered. Pursuant to Section 78, paragraph 4, of the AußStrG, the provisions of the ZPO apply mutatis mutandis to the itemization of costs. Pursuant to Section 54, paragraph 1, ZPO, the party claiming reimbursement of costs must submit to the Court a statement of costs, together with any supporting documents necessary to verify the amounts and details in said statement, failing which the claim for reimbursement shall be forfeited (VwGH 08/20/2025, Ra 2024/04/0321-9). On June 2, 2026, the complainant submitted a statement of costs in which he claimed costs in the amount of EUR 4,025.54, pursuant to § 54(1) of the German Code of Civil Procedure (ZPO), for filing the complaint dated June 17,2025 and a statement dated August 21, 2025. On June 2, 2026, the complainant submitted a statement of costs in which he listed costs totaling EUR 4,025.54 pursuant to Section 54, paragraph 1, of the ZPO for filing the complaint on June 17, 2025, and a response dated August 21, 2025. Pursuant to § 52(5) of the ZPO, an award of costs requires that a statement of costs have been submitted. Following the submission of the statement of costs, the Court must subsequently make an ex officio decision on the obligation to reimburse costs. A separate motion is not required for the reimbursement of costs. Failure to submit a complete statement of costs in a timely manner results, pursuant to § 54(1) ZPO, in the loss of the claim for reimbursement of costs (7 Ob 77/57; RS0002204; LGZ XXXX 43 R 2038/90 EFSlg 64.003; OLG Vienna 16 R 17/02s WR 931; RW0000533; RS0036036 with reference to Schindler/Schmoliner in Kodek/Oberhammer, ZPO-ON1.00 § 54 ZPO (as of Oct. 9, 2023, rdb.at))Pursuant to paragraph 52 of the ZPO, an award of costs requires that a statement of costs have been submitted. After the statement of costs has been submitted, the Court must subsequently make a decision ex officio on the obligation to reimburse costs. A separate motion is not required for the reimbursement of costs. Failure to submit a complete statement of costs in a timely manner results in the loss of the claim for reimbursement of costs pursuant to Section 54, paragraph 1, of the ZPO (7 Ob 77/57; RS0002204; LGZ Roman 40 43 R 2038/90 EFSlg 64.003; OLG Vienna 16 R 17/02s WR 931; RW0000533; RS0036036 with reference to Schindler/Schmoliner in Kodek/Oberhammer, ZPO-ON1.00 Section 54, ZPO (as of October 9, 2023, rdb.at)) Pursuant to § 54(1), last sentence, of the ZPO, costs must be filed in conjunction with the procedural act to be performed. Pursuant to Section 54, paragraph 1, last sentence, of the ZPO, costs must be filed in conjunction with the procedural act to be performed. The appellant’s submission of costs on June 5, 2026, for the procedural acts on June 17, 2025, and August 21, 2025, is therefore deemed untimely. Since the appellant did not provide a (timely) itemized statement of specific costs within the meaning of Section 54(1) of the Code of Civil Procedure (ZPO), the costs of the appeal were to be awarded to him pursuant to Section 78(1) of the Act on Costs in Administrative Proceedings (AußStrG). Pursuant to § 1(1) of the Regulation of the Federal Minister of Finance concerning fees for submissions to the Federal Administrative Court and the Provincial Administrative Courts (BuLVwG-EGebV, BGBl. II No. 387/2014), filings with the Federal Administrative Court—including complaints—are subject to a fee, unless the law provides for exemption from such fees. Pursuant to § 2 BuLVwG-EGebV, this fee for complaints is 50 euros. Since the appellant did not (in a timely manner) itemize certain costs within the meaning of Section 54, paragraph 1, of the Code of Civil Procedure (ZPO), the costs of the appeal were to be awarded to him pursuant to Section 78, paragraph 1, of the Act on Costs in Extraordinary Proceedings (AußStrG). Pursuant to Section 1, Paragraph 1, of the Regulation of the Federal Minister of Finance concerning Fees for Petitions to the Federal Administrative Court and the State Administrative Courts (BuLVwG-EGebV, Federal Law Gazette Part 2, No. 387 of 2014), filings with the Federal Administrative Court—including complaints—are subject to a fee, unless the law provides for an exemption from fees. Pursuant to Section 2 of the BuLVwG-EGebV, this fee for complaints is 50 euros. The motion for reimbursement of costs was therefore granted with respect to the appeal costs. 3.3. Regarding the Waiver of an Oral Hearing: Pursuant to § 24(1) VwGVG, the Administrative Court must conduct a public oral hearing upon request or, if it deems it necessary, on its own initiative.Pursuant to paragraph 24(1) of the VwGVG, the Administrative Court must conduct a public oral hearing upon request or, if it deems it necessary, on its own initiative. Pursuant to § 24(4) VwGVG, unless otherwise provided by federal or state law, the Administrative Court may dispense with a hearing if the case file indicates that an oral hearing is unlikely to lead to further clarification of the matter, and neither Article 6(1) of the ECHR nor Article 47 of the CFR precludes waiving the hearing. Pursuant to Section 24, paragraph 4, of the VwGVG, the administrative court may—unless otherwise provided by federal or state law—waive a hearing if the case file indicates that an oral hearing would not lead to further clarification of the matter, and the omission of the hearing is not precluded by either article 6, paragraph 1, of the ECHR nor article 47 of the CFR. In the present case, the decision to forgo such a hearing can be based on the fact that the facts necessary for assessing the complaint have been clarified from the file in conjunction with the complainant’s submissions. Furthermore, the complainant did not request an oral hearing. 3.4. Regarding B) 3.4.1. Admissibility of the (ordinary) appeal: Pursuant to § 25a(1) VwGG, the Administrative Court must state in the operative part of its judgment or order whether the appeal is admissible under Art. 133(4) B-VG. The ruling must be briefly justified. Pursuant to Section 25a(1) of the VwGG, the Administrative Court must state in the operative part of its judgment or order whether the appeal is admissible pursuant to Article 133(4) of the B-VG. The ruling must be briefly justified. The appeal against points I and II of the judgment is admissible under Article 133(4) of the Federal Constitutional Law (B-VG) because the decision depends on the resolution of a legal question of fundamental importance, namely, the extent to which the obligation to anonymize and obscure personal data and information that makes a person identifiable applies in a decision of the Federal Administrative Court. There is a lack of case law from the Administrative Court on this legal issue. The appeal against points Roman numeral one and Roman numeral two is admissible pursuant to article 133, paragraph 4, B-VG, because the decision depends on the resolution of a legal issue of fundamental importance, namely the extent to which the obligation to anonymize and obscure personal data and information that makes a person identifiable applies in a court decision of the Federal Administrative Court. There is a lack of case law from the Administrative Court on this legal issue. The appeal against point III is admissible pursuant to Art. 133, para. 4, B-VG with regard to the decision on costs, because although the Administrative Court, in its cited case law of August 20,2025 that, in the absence of a list of certain costs within the meaning of § 54(1) of the Code of Civil Procedure (ZPO) by the data subject, the Federal Administrative Court may award appeal costs within the meaning of § 78(1) of the Act on Costs in Administrative Proceedings (AußStrG), there is, however, as far as can be seen, no case law from the Federal Administrative Court regarding the timeliness of the statement of costs in a decision by the Administrative Court. The appeal against point three of the ruling. is admissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG) with respect to the decision on costs, because although the Administrative Court, in its cited case law of August 20, 2025, held that in the absence of a statement of certain costs within the meaning of Paragraph 54(1), of the ZPO by the data subject, the Federal Administrative Court may award appeal costs within the meaning of paragraph 78(1) of the AußStrG; however, as far as can be ascertained, there is no case law from the VwGH regarding the timeliness of the statement of costs in a decision by the Administrative Court.