Full text
Text Ref. No.: 2026-0.690.562, dated September 16, 2026 (Case No.: DPA-D550.1354) [Processing Officer’s Note: Names and company names, legal forms and product names, addresses (including URLs, IP addresses, and email addresses), case numbers (and the like), statistical data, etc., as well as their initials and abbreviations, may have been abbreviated and/or altered for pseudonymization purposes. Obvious spelling, grammar, and punctuation errors have been corrected.] The services pseudonymized as P***media.com and G***list.com are each a Very Large Online Platform (VLOP) pursuant to Article 33 of Regulation (EU) 2022/2065 (Digital Services Act—DSA).The services pseudonymized as P***media.com and G***list.com are each a very large online platform (VLOP) pursuant to article 33 of Regulation (EU) 2022/2065, (Digital Services Act—DSA). Warning Accused: Dr. Erich Peter D***, born on **/**/197* As the controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data, on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “GDPR”), OJ No. L 119 of May 4, 2016, p. 1, as amended, committed the following acts and are thereby liable for the following violation: As the controller within the meaning of article 4, (7) of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “GDPR”), Official Journal No. L 119 of May 4, 2016, page 1, as amended, committed the following acts and are therefore liable for the following violation: On each of the following social media platforms, you shared a public post—or a post visible to anyone (even without a User account on the respective platforms)—titled “SLAPP**** Chronology, June 15” in connection with criminal proceedings before the Regional Court of N***stadt (hereinafter also “LG”) under case no.: *2 Hv *28/26z concerning a private prosecution and media law case brought by the private prosecutor and petitioner, Dr. Udo A***. With these posts, you intended to publicly highlight Dr. A***’s “next defeat at the Court.” As the author of the articles listed below, you therefore decided to publish the outcome of the proceedings by attaching excerpts from the LG’s ruling dated June 10, 2026, to the articles. In doing so, you attempted to obscure the identity of the defendant (Mr. Theodor B***) on the first page of the order; however, the defendant’s name was clearly recognizable in the remainder of the text, and thus his role as the defendant in a private prosecution criminal proceeding before the Regional Court was also evident. Specifically, you published the posts as follows, making the excerpts from the ruling accessible to an unspecified group of people: 1. On June 15, 2026, on the “P***media” platform using the profile “Erich D***.” The post was accessible until at least July 1, 2026, at: “https://www.p***media.com/erich.D***.7/**** /slapp****-chronology-156-lawyer-udo-a***-****next-defeat-in-court/*4*k*45*1j” and was “liked” by 322 other Users and shared 11 times; 2. On June 15, 2026, on the “G***list” platform under the profile “erichd***.” The post was available until at least July 1, 2026, at: “https://www.g***list.com/*re§*”*1/” and was “liked” by 1,302 other Users and shared a total of 36 times. On June 15, 2026, on the “Green***web” platform under the profile “d***erich.green***web.org.” The post was available at least until July 1, 2026, at: “https://green***web.org/profile/d***erich.green***web.org/*****/*5*7*pkw*n” and was “liked” by 111 other Users, saved 6 times, and shared 9 times. As a result, during the period from June 15, 2026, through at least July 1, 2026, you disclosed the name of Mr. Theodor B*** (hereinafter “the data subject”) and information regarding his status as a defendant in a privately prosecuted criminal case, and kept this personal data publicly accessible during the aforementioned period. The disclosure of this information was not necessary for the journalistic purpose pursued by the posts, which was to inform the public about the outcome and the reasoning behind the Court’s decision. This purpose could have been achieved in the same manner by publishing a version of the decision in which the data subject’s name had been completely redacted. The processing was therefore not limited to what was necessary for the journalistic purpose and violated the principle of data minimisation pursuant to Art. 5(1)(c) of the GDPR.The disclosure of this information was not necessary for the journalistic purpose pursued by the articles—namely, to inform the public about the outcome and reasoning of the Court's decision. This purpose could have been achieved in the same way by publishing a version of the order in which the data subject’s name had been completely redacted. The processing was therefore not limited to what was necessary for the journalistic purpose and violated the principle of data minimisation pursuant to article 5, paragraph 1, subparagraph c, of the GDPR. Administrative offenses under: Art. 5, para. 1, subparagraph c, in conjunction with Art. 83, para. 5, subparagraph a, of the GDPR, OJ L 2016/119, p. 1, as amended Article 5, paragraph 1, subparagraph (c), in conjunction with Article 83, paragraph 5, subparagraph (a), GDPR Official Journal L 2016/119, p. 1, as amended However, in the present case, the imposition of an administrative fine pursuant to para 83(5)(a) of the GDPR is waived, and a warning is issued instead.However, in the present case, the imposition of an administrative fine pursuant to article 83(5)(a) of the GDPR is waived, and a warning is issued instead. Legal basis: Article 58(2)(b) and Article 83(1) and (2) of the GDPR, Official Journal L 2016/119, p. 1, as amended; Article 58, paragraph 2, subparagraph b, and Article 83, paragraphs 1 and 2, of the GDPR, Official Journal L 2016/119, p. 1, as amended The following facts have been established 1.1. The accused serves as editor-in-chief of the media company “S***” (S*** Zeitschriften Gesellschaft m.b.H., with its registered office at **** N***stadt, M***-Platz *4/*2/*1a). As part of his journalistic work, he reports, among other things, on the private criminal and media law proceedings brought by attorney Dr. A*** against various individuals and critically examines these cases. 1.2. The defendant refers to the proceedings initiated by the aforementioned attorney as so-called “SLAPP lawsuits” (“Strategic Lawsuit Against Public Participation”). This term refers to legal proceedings which, according to the allegation, do not primarily serve to enforce legitimate claims, but rather aim to intimidate individuals through the time, financial, and other personal burdens associated with litigation and to deter them from public participation or the expression of critical opinions. In his reporting, the defendant specifically highlights what he alleges is the lawyer’s practice of repeatedly initiating private criminal charges and media law proceedings against individuals, thereby subjecting them to corresponding procedural and financial pressure. 1.3. The defendant maintains, on the platforms “P***media,” “G***list,” and “Green***web,” each under the names “Erich D***,” “erichd***,” and “d***erich.green***web.org.” Even individuals without a User account on the respective platforms can view the profile and the posts. 1.4. These public profiles are not profiles belonging to the media company “S***.” The defendant decides independently and solely which posts are created and published on these profiles, what content they contain, and when and in what form they are published. The media company S*** has no influence over these decisions. 1.5. The aforementioned media company also exerted no influence regarding the publication of the posts in question; these were published exclusively by the defendant through his own profile. 1.6. A criminal proceeding based on a private prosecution and media law motions filed by the attorney was conducted before the Regional Court of N***stadt under case no. *2 Hv *28/26z. In these proceedings, the data subject was the defendant, charged with defamation and insult pursuant to Sections 111(1) and (2) and 115 of the German Criminal Code (StGB). The defendant was also a respondent in these proceedings under §§ 33 para 1, 37 para 1, and 41 para 1 of the Media Act (MedienG).Before the Regional Court of N***stadt, criminal proceedings based on a private prosecution and media law motions filed by the attorney were conducted under case no. *2 Hv *28/26z. In these proceedings, the data subject was the defendant, charged with defamation and insult under Sections 111(1) and (2) and 115 of the German Criminal Code (StGB). The defendant was also a respondent in these proceedings under Sections 33(1), 37(1), and 41(1) of the Media Act (MedienG). 1.7. In its decision dated June 10, 2026, the Regional Court ruled on the private prosecution and the media law motions and dismissed them pursuant to §§ 485(1)(3) in conjunction with § 71(5), last sentence, of the Code of Criminal Procedure (StPO) and § 41(1) of the Media Act (MedienG) on the grounds of § 212(1) of the Code of Criminal Procedure (StPO) and discontinued the proceedings because the elements of the alleged offenses were not met.The Regional Court issued a decision on June 10, 2026, regarding the private prosecution and the media law motions and dismissed them pursuant to Section 485, paragraph 1, No. 3, in conjunction with Section 71(5), last sentence, of the Code of Criminal Procedure (StPO), in conjunction with Paragraph 41(1) of the Media Act (MedienG), on the grounds of Paragraph 212(1) of the Code of Criminal Procedure (StPO), and dismissed the case because the elements of the alleged offenses had not been met. August 1. After this decision was served, the defendant decided to share the outcome of the so-called “SLAPP lawsuits” with the public. For this purpose, on June 15, 2026, the defendant published a publicly accessible post titled “SLAPP**** Chronology, June 15” on his social media profiles on the platforms “P***media,” “G***list,” and “Green***web,” each a publicly accessible post titled “SLAPP**** Chronology, June 15.” 1.9. The posts dealt exclusively with the Regional Court’s decision. Through these posts, the defendant sought to portray the outcome of the proceedings as “Dr. A***’s next defeat in Court.” In the posts, he stated, among other things: “The Courts are showing him where freedom of speech stands. His lawsuit was meant to run up costs for me because I’m disrupting his warning-letter business.” The defendant attached excerpts from the Regional Court’s order to each of the posts. In the published version, the defendant had redacted the name of the data subject in the designation of the defendant at the top of the first page. However, in the body text of the published ruling, the name of the data subject in the role of defendant remained unredacted and clearly legible. Users on the “G***list” and “Green***web” platforms pointed this out to him several times in the comments on the posts. Consequently, both the name of the data subject and their status as a defendant in a private prosecution criminal proceeding before the Regional Court for Criminal Matters were evident from the published images. The posts were accessible to an unspecified group of people. The publication took the following specific form: ● On June 15, 2026, on the “P***media” platform under the profile “Erich D***.” The post was accessible until at least July 1, 2026, at: “https://www.p***media.com/erich.D***.7/**** /slapp****-chronology-156-lawyer-udo-a***-****next-defeat-in-court/*4*k*45*1j”. At the time of official documentation, the post had been “liked” by 322 other users and shared eleven times. On June 15, 2026, on the “G***list” platform under the profile “erichd***”. The post was accessible until at least July 1, 2026, at: “https://www.g***list.com/*re§*”*1/”. At the time of official documentation, the post had been “liked” by 1,302 other users and shared a total of 36 times. On June 15, 2026, on the “Green***web” platform under the profile “d***erich.green***web.org”. The post was accessible at least until July 1, 2026, at: “https://green***web.org/profile/d***erich.green***web.org/*****/*5*7*pkw*n”. At the time of official documentation, the post had been “liked” by 111 other users, saved 6 times, and shared 9 times. Prior to the publication of the posts at issue in this proceeding, there was no contact between the accused and the data subject regarding the intended publication of this decision. In particular, at that time, there was no statement from the data subject in which she would have consented to the publication of her name and her status in the criminal proceedings. 1.12. These facts were ultimately reported to the DPA. In response, the defendant was asked to provide a justification. After receiving this request, the defendant contacted the DPA and stated that he had since deleted the posts, but that, regardless of this, it must not be overlooked that everything had taken place within the scope of media privilege, since he had published the excerpts exclusively for journalistic purposes, which is why the processing in question was ultimately lawful. 1.13. Subsequently, the accused also contacted the data subject to retroactively obtain their consent regarding the publication. The data subject then stated, at an unspecified time but in any case after the proceedings had been initiated, that he or she consented to the publication of his or her name and status in the criminal proceedings. The statement signed by the data subject, which was submitted to the DPA by the accused on July 15, 2026, read as follows: “To the Data Protection Authority I, Theodor B***, born on **. ******* 195*, hereby confirm that I have authorized Erich D*** to publicly disclose my name in connection with the proceedings that attorney Udo A*** is conducting against me. Therefore, the mention of my name in connection with the private prosecution brought against me does not constitute a violation under the Data Protection Act. Sincerely, Theodor B***” 1.14. The defendant deleted the posts after being asked to provide an explanation. However, it could not be determined at what specific time the erasure took place. 1.15. No material harm to the data subject resulting from the publication (in particular, financial or professional disadvantages) could be established. 2. The findings are based on the following assessment of the evidence: 2.1. In summary, the findings are based on the uncontroversial content of the administrative penalty notice, in particular on the statement of facts submitted by Dr. A*** on June 17, 2026, together with the attached screenshots or “screenshots,” the results of the DPA’s ex officio investigation, the accused’s statement of defense dated July 15, 2026, including attachments, and the case notes contained in the file. 2.2. The screen captures attached to the complaint reveal the profiles used, the content and titles of the posts, the respective publication dates, the attached excerpts from the Court decision, and the reactions and reposts by other Users visible at the time the screen captures were taken. 2.3. In response to the complaint, the DPA conducted an ex officio investigation on the aforementioned platforms on July 1, 2026. During this investigation, the posts in question were accessible in the described form on the respective profiles. In particular, it was found that the posts included images of portions of the Regional Court’s decision and that the name of the data subject remained clearly legible in the body text despite the redactions made elsewhere. Likewise, the comments posted beneath the posts were visible, in which users pointed out that the name of the data subject remained recognizable. During the proceedings, the defendant did not dispute the publication of the posts, their content, the attached images, their public accessibility, or the fact that the name of the data subject remained legible in the published text. He contested the charge solely on legal grounds. There is therefore no doubt regarding the documented publications. 2.5. Since it is evident from the posts themselves that they were published on June 15, 2026, and they were still publicly accessible as of July 1, 2026, during the course of the official investigation, public accessibility could be established at least for the period from June 15, 2026, through July 1, 2026, inclusive. 2.6. The findings regarding the defendant’s role as editor-in-chief of the media company S***, to the operation of his own social media profiles, and to his sole decision regarding the creation, content, and publication of the posts at issue in this proceeding for journalistic purposes are based on his own statements in the statement of defense dated July 15, 2026. These findings could also be supported by this information because it is consistent with the appearance of the profiles and the posts published there, and no evidence to the contrary has emerged during the proceedings. 2.7. There is no doubt that the defendant intended to inform the public, through the published posts, about the unsuccessful private prosecution and the Regional Court’s reasoning. There is likewise no doubt as to the authenticity of the published excerpts. 2.8. The finding that there was no contact with the data subject prior to the publication of the posts and that the declaration of consent was obtained only after the initiation of the present proceedings is based, among other things, on the case file note regarding the telephone conversation with the defendant on July 14, 2026. During this telephone conversation, the defendant stated that, following the conversation, he intended to contact the data subject to obtain their consent to the publication. This statement would be inconsistent with the assumption that consent had already been obtained prior to publication. 2.9. Furthermore, this chronological context is supported by the redactions made by the defendant himself, which were visible in the published excerpts. The defendant had obscured the name of the data subject in the space designated for the defendant’s name on the first page of the order, but failed to notice that the name appeared again in the body of the text. Had consent to the disclosure of the name already been in place prior to publication, or had the name been published at the request of the data subject, there would be no apparent reason for this attempt to redact the name. There is therefore no doubt that the statement submitted by the affected person was obtained after the posts were published. 2.10. The finding that the posts were subsequently deleted is based on a recent ex officio review of the aforementioned profiles, during which the posts could no longer be accessed. In the absence of further details, the exact time of erasure could not be determined. However, this does not preclude the determination of the period during which the offense occurred, because the posts were still publicly accessible as of July 1, 2026, during the ex officio investigation. 2.11. Finally, there was no evidence that the data subject had suffered any specific material damage as a result of the publication. No such damage was claimed, nor did it emerge during the investigation. Therefore, no material damage could be established. 3. The legal conclusion is as follows: 3.1. Pursuant to Article 4(1) of the GDPR, personal data means any information relating to an identified or identifiable natural person. According to Article 4(2) of the GDPR, the term “processing” means any operation or set of operations performed on personal data, whether or not by automated means, including, in particular, disclosure by transfers, dissemination, or otherwise making available.According to article 4(1) of the GDPR, personal data means any information relating to an identified or identifiable natural person. According to article 4(2) of the GDPR, the term “processing” means any operation or set of operations performed on personal data, whether or not by automated means, in particular the disclosure of such data by transfers, dissemination, or otherwise making it available. 3.2. The name contained in the published excerpts of the court decision directly referred to the data subject. In conjunction with the further content of the decision, it also became apparent that the data subject was the defendant in a private prosecution proceeding before the Regional Court for Criminal Matters. This information therefore constituted personal data pursuant to Article 4(1) of the GDPR. The name contained in the published excerpts of the court decision directly referred to the data subject. In conjunction with the rest of the ruling, it also became clear that the data subject was the defendant in a private prosecution proceeding before the Regional Court for Criminal Matters. This information therefore constituted personal data pursuant to article 4(1) of the GDPR. 3.3. Furthermore, the information regarding the role as a defendant in a private prosecution proceeding before a criminal court constitutes personal data relating to criminal offenses within the meaning of Article 10 of the GDPR. The scope of this provision encompasses not only information regarding final criminal convictions but also information indicating that a specific person is accused of committing a criminal offense or is the subject of criminal proceedings for that reason. The CJEU has expressly clarified in this regard that classification under Article 10 of the GDPR does not require that the commission of the criminal offense in question was actually established in the proceedings (see CJEU, June 4, 2026, C-312/24, para. 106). The same must apply in the present case. The fact that the Regional Court ultimately did not uphold the criminal charge brought against the data subject—because it found that the relevant elements of the offense had not been established—therefore does not alter this classification.Furthermore, the information regarding the individual’s status as a defendant in a privately prosecuted criminal proceeding constitutes personal data relating to criminal offenses within the meaning of article 10 of the GDPR. The scope of this provision encompasses not only information regarding final criminal convictions but also information indicating that a specific person is accused of committing a criminal offense or is the subject of criminal proceedings for that reason. The CJEU has expressly clarified in this regard that a classification within the meaning of article 10 of the GDPR does not require that the commission of the criminal offense in question was actually established in the proceedings (see CJEU, June 4, 2026, C-312/24, para. 106). The same must apply to the present case. The fact that the Regional Court ultimately did not uphold the criminal charge brought against the data subject—because it found that the relevant elements of the offense had not been met—therefore does not alter this classification. 3.4. The CJEU also pointed out that personal data within the meaning of Article 10 of the GDPR is subject to enhanced protection due to its particular sensitivity. Making such data publicly available may lead to the stigmatization of the data subject and thus to a particularly serious interference with their private life and right to the protection of personal data (see CJEU, June 22, 2021, C-439/19, para. 74 et seq., with further references). The CJEU also noted that personal data within the meaning of Article 10 of the GDPR is subject to enhanced protection due to its particular sensitivity. Making such data publicly available may lead to the stigmatization of the data subject and thus to a particularly serious interference with their private life and right to the protection of personal data (see CJEU, June 22, 2021, C-439/19, para. 74 et seq., with further references). 3.5. By publishing the identified excerpts on his publicly accessible profiles and keeping them accessible at least from June 15, 2026, through July 1, 2026, the defendant disseminated this personal data and made it available to an indefinite group of people. There was therefore, beyond any doubt, also processing within the meaning of Article 4(2) of the GDPR.By publishing the identified excerpts on his publicly accessible profiles and keeping them accessible at least from June 15, 2026, through July 1, 2026, inclusive, the defendant disseminated this personal data and made it available to an unspecified group of people. Therefore, there was also, without a doubt, processing within the meaning of article 4(2) of the GDPR. 3.6. Regarding the accused’s liability: Pursuant to Article 4(7) of the GDPR, the controller is the natural or legal person, public authority, agency, or other body that, alone or jointly with others, makes the decision regarding the purposes and means of the processing of personal data.Pursuant to Article 4(7) of the GDPR, the controller is the natural or legal person, public authority, agency, or other body that, alone or jointly with others, makes the decisions regarding the purposes and means of the processing of personal data. According to the findings, the defendant personally operated the social media profiles at issue in this proceeding in order to share journalistic posts. He alone decided which posts were published, what content they contained, which parts of the Court’s decision were included, and when and on which platforms the posts were published. The media company S*** had no influence on these decisions. The defendant thus determined the purposes and means of the processing in question on his own and was therefore to be classified as a controller within the meaning of Article 4(7) of the GDPR. The defendant did not contest this conclusion in his defense either. Among other things, he argued that the processing took place within the scope of media privilege because he had critically examined Dr. A***’s “SLAPP lawsuits” and, for this purpose, wanted to bring the unsuccessful private prosecution before the Regional Court to the public’s attention.The defendant thus had sole control over the purposes and means of the processing in question and was therefore to be classified as a controller within the meaning of article 4(7) of the GDPR. The defendant did not contest this conclusion in his defense. Among other things, he argued that the processing took place within the scope of media privilege because he had critically examined Dr. A***’s “SLAPP lawsuits” and, for this purpose, intended to present the unsuccessful private prosecution before the Regional Court to the public. 3.7. The provision under Article 85 of the GDPR requires Member States, among other things, to reconcile the right to the protection of personal data with the right to freedom of expression and freedom of information, including processing for journalistic purposes. For processing for journalistic purposes, Member States must provide for derogations from Chapters Two through Seven and Nine of the GDPR if this is necessary to reconcile the right to the protection of personal data with freedom of expression and freedom of information. The national legislature implemented this in Section 9 of the DSG (Freedom of Expression and Freedom of Information).The provision under article 85 of the GDPR requires Member States, among other things, to reconcile the right to the protection of personal data with the right to freedom of expression and freedom of information, including processing for journalistic purposes. For processing for journalistic purposes, Member States must provide for derogations from Chapters 2 through 7 and 9 of the GDPR if this is necessary to reconcile the right to the protection of personal data with freedom of expression and freedom of information. The national legislature implemented this in Section 9 of the DSG (Freedom of Expression and Freedom of Information). 3.8. According to the case law of the CJEU, the concept of journalistic purposes must generally be interpreted broadly to take into account the importance of the right to freedom of expression and freedom of information in a democratic society. 3.9. A journalistic activity is therefore deemed to exist if it is aimed at disseminating information, opinions, or ideas to the public—regardless of the medium used. However, this requires editorial revision or selection of the disseminated information, or at least its presentation in accordance with an editorial decision. The underlying factual claims must be sufficiently verified, and the activity must be subject to the professional and ethical standards of journalism (see CJEU, July 9, 2026, C-199/24, paras. 61–73).Accordingly, an activity constitutes journalistic work if it is aimed at disseminating information, opinions, or ideas to the public, regardless of the medium used. However, this requires editorial revision or selection of the information disseminated, or at least its presentation in accordance with an editorial decision. The underlying factual claims must be sufficiently verified, and the activity must be subject to the professional and ethical rules governing journalistic practice (see CJEU, July 9, 2026, C-199/24, paras. 61–73). October 3. The defendant works as the editor-in-chief of the media company S***. The articles at issue in this proceeding were part of his journalistic coverage of the private prosecution and media proceedings initiated by attorney Dr. A***, which the defendant refers to as so-called “SLAPP lawsuits.” Through these articles, he sought to inform the public about the outcome of such a proceeding and to place the court decision adverse to Dr. A*** in the context of his previous critical reporting. To this end, he used his personal social media profiles. 3.11. The defendant did not limit himself to merely publishing a Court decision in its unaltered form. He provided the publication with his own title and his own contextual analysis, selected specific parts of the decision for publication, and partially redacted portions of it. The publication was thus based on editorial selection and served to disseminate information and opinions to the public. 3.12. Taking these circumstances into account, the processing in question falls within the scope of § 9(1) DSG in conjunction with Art. 85 GDPR. The defendant therefore correctly cites § 9(1)(2) of the DSG as the legal basis. The DPA does not overlook the defendant’s journalistic activities; however, this cannot ultimately lead to the requested dismissal of the proceedings.Taking these circumstances into account, the processing in question falls within the scope of paragraph 9(1) of the DSG in conjunction with article 85 of the GDPR. The defendant therefore correctly cites Section 9(1)(2) of the DSG as the legal basis. The DPA does not overlook the defendant’s journalistic activities; however, this cannot ultimately lead to the requested dismissal of the proceedings. 3.13. In its decision of December 14, 2022, G 287/2022 et al., the Constitutional Court struck down Para 9(1) of the DSG, as amended by Federal Law Gazette I No. 24/2018, as unconstitutional. The repealed provision had provided for a broad exemption from the DSG and significant parts of the GDPR in the context of data processing for journalistic purposes. In the opinion of the Constitutional Court, this undifferentiated sectoral exemption did not sufficiently take into account the required balance between the fundamental right to data protection, on the one hand, and freedom of expression and freedom of information, on the other.In its decision of December 14, 2022, G 287 of 2022, among others, the Constitutional Court struck down Section 9, paragraph 1, of the DSG, as published in the Federal Law Gazette, Part I, No. 24 of 2018, as unconstitutional. The repealed provision had provided for a broad exemption from the DSG and substantial parts of the GDPR in the context of data processing for journalistic purposes. In the opinion of the Constitutional Court, this undifferentiated sectoral exemption did not sufficiently take into account the necessary balance between the fundamental right to data protection, on the one hand, and freedom of expression and freedom of information, on the other. In response, the media privilege was restructured effective July 1, 2024. The provision under § 9(1)(2) of the DSG authorizes the controller to process personal data, including special categories of personal data pursuant to Art. 9(1) of the GDPR, as well as personal data relating to criminal convictions and offenses pursuant to Article 10 of the GDPR, provided that such processing is carried out for journalistic purposes. In response, the media privilege was restructured effective July 1, 2024. The provision under Section 9, paragraph 1, item 2, of the DSG authorizes the controller to process personal data, including special categories of personal data pursuant to Article 9, paragraph 1, of the GDPR, as well as personal data relating to criminal convictions and offenses pursuant to Article 10, GDPR, provided that this processing is done for journalistic purposes. 3.15. The provision thus constitutes an independent legal basis for journalistic activities covered by Section 9(1) of the DSG. An additional legal basis under Article 6(1) of the GDPR was therefore not required, nor was the consent of the data subject. The processing of information regarding the data subject’s status as a defendant was also, in principle, covered by § 9(1)(2) of the DSG. The absence of consent granted prior to publication therefore did not, in and of itself, constitute a violation of Article 5(1)(a) or Article 6 of the GDPR. The provision thus constitutes an independent legal basis for journalistic activities covered by Section 9, paragraph 1, of the DSG. An additional legal basis under Article 6, paragraph 1, of the GDPR was therefore not required, and consequently, the data subject’s consent was not required either. The processing of information regarding the data subject’s status as a defendant was also, in principle, covered by paragraph 9(1)(2) of the DSG. The absence of consent granted prior to publication therefore did not, in and of itself, constitute a violation of article 5(1)(a) or article 6 of the GDPR. 3.16. Conversely, however, the declaration of consent provided only retrospectively could not retroactively ensure compliance with the principle of data minimisation during the period in question. Pursuant to Article 5(1)(c) of the GDPR, personal data must be adequate, relevant, and limited to what is necessary for the purposes of the processing.Conversely, however, the declaration of consent provided only retrospectively could not retroactively ensure compliance with the principle of data minimisation during the established period of the offense. Pursuant to Article 5(1)(c) of the GDPR, personal data must be adequate, relevant, and limited to what is necessary for the purposes of the processing. 3.17. Section 9(1) of the DSG contains no exception to this principle. Only the principle of transparency under Article 5(1)(a) of the GDPR is further modified by Section 9(1)(3) of the DSG. The remaining principles of Article 5 of the GDPR remain applicable. Pursuant to Article 5(2) of the GDPR, the controller is responsible for compliance with all data protection principles and must be able to demonstrate such compliance (“accountability”). This accountability to the DPA is also not affected by Section 9(1) of the DSG.Section 9(1) of the DSG contains no exception to this principle. Only the principle of transparency under article 5(1)(a) of the GDPR is further modified by Section 9(1)(3) of the DSG. The remaining principles of Article 5 of the GDPR remain applicable. Pursuant to Article 5(2) of the GDPR, the controller is responsible for compliance with all data protection principles and must be able to demonstrate such compliance (“accountability”). This accountability to the DPA is also unaffected by paragraph 9(1) of the DSG. 3.18. The explanatory notes on the new provisions governing media privilege also point out that the principles of Article 5 of the GDPR remain unaffected within the scope of media privilege (see SA 2566 BlgNR 27th Session, p. 6.). The explanatory notes on the new regulation of the media privilege also point out that the principles of article 5, GDPR remain unaffected within the scope of the media privilege—see Committee Report 2566, BlgNR 27th Session, p. 6.). 3.19. In other words: Although the legislature has, through Section 9(1)(2) of the Data Protection Act (DSG), conducted a balancing of constitutional interests and established a legal basis for processing for journalistic purposes, this does not mean that any processing of personal data is permissible solely because it takes place in connection with a journalistic report. Processing under the media privilege must be appropriate and relevant to the specific journalistic purpose and limited to the extent necessary for that purpose. In this context, it must be examined whether the journalistic purpose can be achieved through an anonymized or less intrusive presentation with comparable informational value.In other words: Although the legislature has, through Section 9, paragraph 1, item 2, of the DSG, weighed the interests under fundamental rights and established a legal basis for processing for journalistic purposes, However, this does not mean that any processing of personal data is permissible simply because it takes place in connection with a journalistic report. Processing within the scope of the media privilege must be appropriate and relevant to the specific journalistic purpose and limited to the extent necessary for that purpose. In this context, it must be examined whether the journalistic purpose can be achieved through an anonymized or less intrusive presentation with comparable informational value. 3.20. The principle of data minimisation is one of the central provisions of the GDPR and, according to the case law of the CJEU, embodies the principle of proportionality. Processing is not necessary if the intended purpose can be achieved just as effectively, in a reasonable manner, by other means that interfere less with the rights of the data subject (see CJEU June 22, 2021, C-439/19, para. 98 and 110; July 14, 2026, C-474/24, para. 77, 84, and 89).The principle of data minimisation is one of the central provisions of the GDPR and, according to the case law of the CJEU, embodies the principle of proportionality. Processing is not necessary if the intended purpose can be achieved just as effectively, under reasonable circumstances, by other means that interfere less with the rights of the data subject (see CJEU June 22, 2021, C-439/19, paras. 98 and 110; July 14, 2026, C-474/24, paras. 77, 84, and 89). 3.21. Applied to the present case, this leads to the following conclusion: The specific journalistic purpose of the articles in question was to inform the public about the outcome and content of the Court’s decision, to describe the dismissal of the private criminal lawsuit filed by Dr. A*** and the motions under media law, and to contextualize this decision within the defendant’s critical reporting on what he referred to as “SLAPP lawsuits.” From any perspective, it cannot be considered necessary here to disclose the identity of the person concerned and his status as a defendant. The subject of the critical reporting was Dr. A***’s conduct of the litigation and the Court decision that was unfavorable to him, not the identity of the defendant. Identifying the data subject by name contributed neither to an understanding of the decision nor to an assessment of the attorney’s conduct, which the defendant had brought to light. It would have been possible and reasonable for the defendant to present the outcome of the proceedings, the Regional Court’s relevant considerations, and the connection it established to the lawsuits referred to as “SLAPP lawsuits” in the same manner, while redacting the name of the data subject throughout the published excerpt. The name of the Court, case number, date of the decision, type of proceeding, and the grounds for the decision relevant to the reporting would have been sufficient to present the content and authenticity of the decision in a comprehensible manner. Completely redacting the name would therefore have been an equally effective, yet significantly less intrusive measure. The data subject would not thereby have been associated, in the eyes of an indefinite group of people, with the status of defendant in a privately prosecuted criminal proceeding. The attempt by the accused himself to redact the name also confirms this conclusion. He had originally obscured the name of the data subject in the space designated for the defendant’s name on the first page, but failed to notice that it appeared again in the body of the text. This shows that, according to the accused’s own original editorial decision, naming the data subject was not intended to be part of the informational content of the posts. Regardless of this, however, the decisive factor remains that the identity of the data subject objectively had no additional informational value for the established journalistic purpose. This conclusion is also consistent with the recent case law of the Federal Administrative Court (BVwG). In connection with the publication of a Court decision on social media, the BVwG held that naming a person violates the principle of data minimisation if it neither makes the relevant informational content of the decision more understandable nor more conclusive, and the informational purpose can be achieved equally well through an anonymized publication. Although § 9(1) of the Data Protection Act (DSG) was not applicable in that proceeding due to the absence of journalistic activity; the reasoning provided there regarding the objective necessity of naming the individual is nevertheless applicable to the present case, because the principle of data minimisation remains fully applicable in this case as well (see BVwG, July 8, 2026, W137 2327171-1). This conclusion is also consistent with the recent case law of the Federal Administrative Court (BVwG). In connection with the publication of a Court decision on social media, the BVwG held that naming a person violates the principle of data minimisation if it neither makes the relevant information in the decision more understandable nor more coherent, and if the informational purpose can be achieved equally well through an anonymized publication. Although Section 9, paragraph 1, of the Data Protection Act (DSG) was not applicable in that case due to the absence of journalistic activity, the reasoning provided there regarding the objective necessity of naming individuals is nevertheless applicable to the present case, because the principle of data minimisation remains fully applicable in this case as well (see BVwG, July 8, 2026, W137 2327171-1). The fact that no material damage could be established does not eliminate the objective violation of the principle of data minimisation. The disclosure of the data subject’s name and his status as a defendant was therefore not necessary for the established journalistic purpose. The processing was not limited to the extent necessary for this purpose. The defendant therefore violated Art. 5(1)(c) of the GDPR during the period from June 15, 2026, through at least July 1, 2026.The disclosure of the data subject’s name and his status as a defendant was therefore not necessary for the established journalistic purpose. The processing was not limited to what was necessary for this purpose. The defendant therefore violated article 5(1)(c) of the GDPR during the period from June 15, 2026, through July 1, 2026, inclusive. 3.22. In addition to the finding of an objective violation, no further examination is required in the present case regarding the subjective element of the offense or the accused’s fault, because the DPA has refrained from imposing an administrative fine pursuant to Article 83(5)(a) of the GDPR.In addition to finding an objective violation, there is no need in this case to examine the subjective element of the offense or the accused’s culpability in greater detail, because the DPA has refrained from imposing an administrative fine pursuant to article 83(5)(a) of the GDPR. 3.23. Pursuant to Article 58(2)(b) of the GDPR, the DPA also has the authority to issue a warning to a controller if its processing activities have violated the GDPR. The wording of this provision is based on the objective existence of a violation. Intent or negligence, however, are not listed as prerequisites for issuing a warning.Pursuant to article 58(paragraph 2)(b) of the GDPR, the DPA also has the authority to issue a warning to a controller if its processing activities have violated the GDPR. The provision, as worded, is based on the objective existence of an infringement. Intent or negligence, however, are not mentioned as prerequisites for issuing a warning. 3.24. Although the CJEU has clarified that an administrative fine under Article 83 of the GDPR may only be imposed if it is established that the controller committed the objectively established violation intentionally or through negligence, However, the CJEU derived this requirement of fault from the provisions specifically applicable to administrative fines under Article 83(2)(b) and (3) of the GDPR (see CJEU, Dec. 5, 2023, C-807/21, paragraphs 67, 68, and 75). These considerations cannot be extended to the possibility of issuing a warning pursuant to Article 58(2)(b) of the GDPR.The CJEU has clarified that an administrative fine under article 83 of the GDPR may only be imposed if it is established that the controller committed the objectively established infringement intentionally or negligently. However, the CJEU derived this requirement of fault from the provisions specifically applicable to administrative fines under article 83(2)(b) and (3) of the GDPR; see CJEU, Dec. 5, 2023, C-807/21, paragraphs 67, 68, and 75). These considerations cannot be extended to the possibility of issuing a warning pursuant to article 58(2)(b) of the GDPR. 3.25. Consequently, it is not necessary to examine the subjective element of the offense in greater detail in the present case. 4. With regard to the warning, the following should also be noted: 4.1. In addition to the possibility of issuing a warning to controllers pursuant to Article 58(2)(b) of the GDPR in the event of a confirmed violation of the GDPR, the supervisory authorities may, pursuant to Article 83(2) of the GDPR, impose administrative fines depending on the circumstances of the individual case, in addition to or in lieu of the measures specified in Article 58(2)(a) through (h) and (j) of the GDPR. When making the decision whether to impose an administrative fine and, if applicable, when determining its amount, due consideration must be given to the criteria set forth in Article 83(2)(a) through (k) of the GDPR. Furthermore, in accordance with Article 83(1) of the GDPR, an administrative fine must be effective, proportionate, and dissuasive in each individual case.In addition to the option of issuing a warning to controllers in the event of a confirmed violation of the GDPR pursuant to article 58(2)(b) of the GDPR, the supervisory authorities may, pursuant to article 83(2), GDPR, impose administrative fines, depending on the circumstances of the individual case, in addition to or in lieu of the measures specified in Article 58(2)(a) through (h) and (j) of the GDPR. When making the decision whether to impose an administrative fine and, if so, when determining its amount, due consideration must be given to the criteria set forth in article 83(2)(a) through (k) of the GDPR. Furthermore, in accordance with article 83(1) of the GDPR, an administrative fine must be effective, proportionate, and deterrent in each individual case. 4.2. Recital 148 of the GDPR provides that, in the case of a minor infringement or where the administrative fine likely to be imposed would place a disproportionate burden on a natural person, a warning may be issued instead of an administrative fine. It follows that not every identified violation must necessarily be punished with an administrative fine. 4.3. Rather, the selection of the appropriate remedial measure in each individual case constitutes a discretionary decision by the supervisory authority. This discretion must be exercised taking into account all the circumstances of the individual case as well as the criteria specified by the legislature in Article 83(1) and (2) of the GDPR. In this context, the CJEU clearly states that once the supervisory authority identifies a violation of the GDPR, it must respond in an appropriate manner; however, it has discretion in selecting the appropriate and necessary measures for this purpose (see CJEU, July 14,July 2026, C-474/24, para. 128, citing CJEU 7 Dec. 2023, C-26/22 and C-64/22, paras. 57 and 68).Rather, the selection of the appropriate remedial measure in a specific case constitutes a discretionary decision by the supervisory authority. This discretion must be exercised taking into account all the circumstances of the individual case as well as the criteria set forth by the legislature in article 83(1) and (2) of the GDPR. In this context, the CJEU clearly states that, as soon as the supervisory authority identifies a violation of the GDPR, it must respond in an appropriate manner; however, it has discretion to choose the appropriate and necessary means to do so—see, CJEU July 14, 2026, C-474/24, para. 128, with reference to CJEU Dec. 7, 2023, C-26/22 and C-64/22, paras. 57 and 68). 4.4. According to the CJEU, the EU legislature has thus established a system of sanctions that enables supervisory authorities to impose the sanctions that are most appropriate and justified in light of the circumstances of the specific case, while taking into account the requirement to to ensure comprehensive compliance with the GDPR and to guarantee a uniform and high level of protection for personal data through a clearly enforceable legal framework (see CJEU, Sept. 26, 2024, C-768/21, paras. 37–47).According to the CJEU, the EU legislature has thus established a system of sanctions that enables supervisory authorities to impose the sanctions that are most appropriate and justified in light of the circumstances of the specific case, while taking into account the requirement to to ensure comprehensive compliance with the GDPR and to guarantee a uniform and high level of protection for personal data through a clearly enforceable legal framework (see CJEU, Sept. 26, 2024, C-768/21, paras. 37–47). 4.5. In the present case, it must first be noted that the disclosure found to have occurred through the publication of the excerpts could not be regarded as a minor interference. The name of the data subject and, in particular, his status as a defendant in a privately prosecuted criminal proceeding were accessible on three public social media platforms—and thus accessible to anyone—from June 15, 2026, until at least July 1, 2026. The posts reached a significant number of users and were shared multiple times. Furthermore, the disclosure involved personal data relating to criminal offenses within the meaning of Article 10 of the GDPR. Such data is particularly sensitive due to the risk of social disapproval and the associated stigmatization (see CJEU, June 22, 2021, C-439/19, para. 74 et seq.).In the present case, it must first be noted that the disclosure established by the publication of the excerpts could not be regarded as a minor interference. The data subject’s name and, in particular, his status as a defendant in a privately prosecuted criminal proceeding were accessible on three public social media platforms—and thus accessible to anyone—from June 15, 2026, until at least July 1, 2026. The posts reached a significant number of users and were shared multiple times. Furthermore, the disclosure involved personal data relating to criminal offenses within the meaning of article 10 of the GDPR. Such data is particularly sensitive due to the risk of social disapproval and the associated stigmatization (see CJEU, June 22, 2021, C-439/19, para. 74 et seq.). 4.6. In light of the established facts and taking into account the aforementioned legal criteria, however, it was decided not to impose an administrative fine. Particular weight was given to the statement from the data subject submitted by the accused, according to which the data subject had consented to the publication. Although this statement was obtained only after the publication and after the initiation of the present proceedings, it cannot retroactively remedy the violation of the principle of data minimisation that existed at the time of publication, nor can it retrospectively legitimize the processing for the aforementioned period. However, the statement must be taken into account as an additional circumstance of the individual case within the meaning of Article 83(2)(k) of the GDPR when selecting an appropriate remedial measure. In particular, it indicates that the data subject herself subsequently accepted the publication that had already taken place, thereby significantly reducing the weight of the adverse effects of the processing that actually occurred. This circumstance was ultimately decisive in refraining from imposing an administrative fine.However, in light of the established facts and taking into account the aforementioned legal criteria, an administrative fine was not imposed. Particular weight was given to the statement submitted by the accused on behalf of the data subject, according to which the data subject had consented to the publication. Although this statement was obtained only after the publication and after the initiation of the proceedings in question, it cannot retroactively remedy the violation of the principle of data minimisation that existed at the time of publication, nor can it retrospectively legitimize the processing for the period in question. However, the statement must be taken into account as an additional circumstance of the individual case within the meaning of article 83(2)(k) of the GDPR when selecting the appropriate remedial measure. In particular, it indicates that the data subject himself subsequently accepted the publication that had already taken place, thereby significantly reducing the weight of the adverse effects of the processing that actually occurred. This circumstance was ultimately decisive in the decision to refrain from imposing an administrative fine. 4.7. Furthermore, there were no relevant prior violations of data protection regulations by the accused. This circumstance should not be considered an independent mitigating factor, as compliance with the GDPR is the norm. However, it means that there is no aggravating circumstance within the meaning of Art. 83(2)(e) of the GDPR (see VwGH June 24, 2026, Ro 2025/04/0007, para. 163 et seq.). Furthermore, there were no relevant prior violations of data protection regulations by the defendant. This circumstance should not be considered an independent mitigating factor, as compliance with the GDPR is the norm. However, it does mean that there are no aggravating circumstances within the meaning of paragraph 83(2)(e) of the GDPR (see VwGH, June 24, 2026, Ro 2025/04/0007, para. 163 et seq.). 4.8. However, completely refraining from imposing a remedial measure was not an option. It is evident from the accused’s arguments that he accords absolute priority to the right to freedom of expression and freedom of information within the scope of the media privilege. In doing so, he overlooks the fact that the Constitutional Court (VfGH) has specifically struck down as unconstitutional the blanket exclusion of data protection requirements resulting from the earlier version of § 9( 1 DSG, because it failed to ensure an appropriate and nuanced balance between the fundamental right to data protection, on the one hand, and freedom of expression and freedom of information, on the other.However, it was out of the question to refrain entirely from taking remedial action. It is clear from the defendant’s arguments that he accords absolute priority to the right to freedom of expression and freedom of information within the scope of the media privilege. In doing so, he overlooks the fact that the Constitutional Court has just struck down as unconstitutional the blanket exclusion of data protection requirements effected by the previous version of Section 9, paragraph one, of the Data Protection Act (DSG), was unconstitutional, because it failed to ensure an appropriate and nuanced balance between the fundamental right to data protection, on the one hand, and freedom of expression and freedom of information, on the other. The defendant was therefore to be informed in the warning in question that even in the case of processing for journalistic purposes based on § 9(1)(2) of the DSG, the principle of data minimisation pursuant to Art. 5(1)(c) of the GDPR must be observed without restriction. Before publishing personal data in the future, he must assess whether its disclosure is appropriate and relevant for the specific journalistic purpose and limited to the extent necessary for that purpose. This applies in particular when the publication makes personal data, as defined in Article 9(1) and Article 10 of the GDPR, accessible to a potentially unlimited group of people.The accused was therefore informed in the present warning that even in the case of processing for journalistic purposes based on Section 9, paragraph 1, No. 2, of the DSG, the principle of data minimisation pursuant to article 5(1)(c) of the GDPR must be fully observed for the purpose of journalism. Before publishing personal data in the future, he must assess whether its disclosure is appropriate and relevant for the specific journalistic purpose and limited to the extent necessary for that purpose. This applies in particular when the publication makes personal data, as defined in Article 9, paragraph 1, and Article 10 of the GDPR, accessible to a potentially unlimited group of people. The principle of data minimisation must also be observed in every individual processing operation and thus also in the context of journalistic research activities. However, its application must always be based on the respective processing purpose. For internal journalistic research, therefore, the processing of a larger volume of information may be necessary than for the subsequent publication. The requirements applicable to publication must not be mechanically applied to earlier stages of research without taking into account journalistic practices. In the present case, however, the identified violation concerned exclusively the public disclosure of the data subject’s name and role in a private prosecution proceeding. The legal assessment in this case was unambiguous and leaves no room for a different conclusion, as the disclosed information was clearly not necessary for reporting on the outcome of the private prosecution proceedings. 4.11. The warning pursuant to Article 58(2)(b) of the GDPR therefore proves, in the final analysis, to be an appropriate, necessary, and proportionate remedial measure. It thus also takes into account the need to clarify the legal situation without imposing an administrative fine under Article 83 of the GDPR, given the mitigating circumstances. The present decision thus also pursues the general preventive goal of raising awareness among other controllers who process personal data for journalistic purposes regarding the legal situation concerning media privilege and, in particular, the continued applicability of the principle of data minimisation. However, the specific circumstances of the present case remain decisive for the selection of the corrective measure. The warning pursuant to article 58(2)(b) of the GDPR therefore proves, in conclusion, to be an appropriate, necessary, and proportionate corrective measure. It thus also takes into account the need to clarify the legal situation without imposing an administrative fine under article 83 of the GDPR, given the mitigating circumstances. This decision thus also pursues the general preventive goal of raising awareness among other controllers who process personal data for journalistic purposes regarding the legal situation concerning media privilege and, in particular, the continued applicability of the principle of data minimisation. However, the specific circumstances of the present case remain decisive for the selection of the remedial measure.