Full text
59 paragraphsDate of Decision September 14, 2026 Legal Provision B-VG Art. 133(4) GDPR Art. 11 GDPR Art. 12 GDPR Art. 15 GDPR Art. 15(1)(c) GDPR Art. 19 GDPR Art. 21 GDPR Art. 24 GDPR Art. 40 GDPR Art. 5 B-VG Art. 133 (current version); B-VG Art. 133 effective from Jan. 1, 2019, through May 24, 2018; last amended by BGBl. I No. 138/2017 B-VG Art. 133 effective as of January 1, 2019, last amended by BGBl. I No. 22/2018 B-VG Art. 133 effective from May 25,May 2018 through December 31, 2018; last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG), Art. 133; effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164/2013, B-VG Art. 133, effective from January 1, 2014, through July 31, 2014, last amended by Federal Law Gazette I No. 51/2012 Federal Constitutional Law (B-VG) Art. 133, effective from January 1, 2004, through December 31, 2013, last amended by Federal Law Gazette (BGBl.)
applies Art. 15(1)(c), Art. 5, Art. 11, Art. 12, Art. 15, Art. 19, Art. 21, Art. 24, Art. 40
I No. 100/2003 B-VG Art. 133 effective from January 1, 1975, through December 31, 2003, last amended by Federal Law Gazette No. 444/1974 B-VG Art. 133 valid from Dec. 25, 1946, through Dec. 31, 1974, last amended by Federal Law Gazette No. 211/1946 B-VG Art. 133 valid from Dec. 19,December 1945 through December 24, 1946; last amended by State Law Gazette No. 4/1945; B-VG Art. 133; in effect from January 3, 1930, through June 30, 1934 Decision , W274 2320278-1/4E IN THE NAME OF THE REPUBLIC! The Federal Administrative Court, with Judge Mag. LUGHOFER presiding, as well as expert lay judge Mag. (FH) LACHNIT-GRIUC and the expert lay judge Dr. GOGOLA as associate judges, rules on the complaint filed by XXXX against the decision of the Data Protection Authority dated June 26, 2025, Ref. No.: D124.0747/24 (2025-0.490.882), with XXXX as a party to the proceedings, and finds as follows: The Federal Administrative Court, presided over by Judge Mag.
LUGHOFER, with expert lay judge Mag. (FH) LACHNIT-GRIUC and the expert lay judge Dr. GOGOLA as associate judges, on the complaint filed by Roman 40 against the decision of the Data Protection Authority dated June 26, 2025, Ref. No.: D124.0747/24 (2025-0.490.882), with Roman 40 as an intervening party, rightly: The complaint is granted, and the contested decision is amended such that the ruling reads: “The complaint is dismissed as unfounded.” An appeal is admissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG). An appeal is admissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG). Text Reasons for the Decision: In a submission dated March 11, 2024, to the respondent authority, XXXX (hereinafter: “Co-party,” “MB”) alleged a violation of his right to information by XXXX (hereinafter: “Complainant,” “BF”). He stated that he had received numerous personally addressed requests for donations in recent months, with some charitable organizations indicating that his address information had come from the BF.
Upon inquiry, the BF provided him only with information regarding the categories of recipients. He then requested additional information regarding the specific data recipients, which the BF refused to provide. This information was insufficient for him to exercise his data protection rights (e.g., erasure, access requests) vis-à-vis the data recipients. There is no impossibility in disclosing the individual data recipients. The BF is gaining a competitive advantage over other address publishers that disclose the recipients of their data. The MB cited several decisions of the Federal Administrative Court (BVwG) and attached the correspondence with the BF to his complaint.In a submission dated March 11, 2024, to the respondent authority, Roman 40 (hereinafter: “Intervener,” MB) alleged a violation of his right to access information by Roman 40 (hereinafter: “Complainant,” BF). He stated that he had received numerous personally addressed requests for donations in recent months, with some charitable organizations indicating that his address data came from the BF.
Upon request, the BF had provided him only with information regarding the categories of recipients. He then requested additional information regarding the specific data recipients, which the BF refused to provide. This information was insufficient for him to exercise his data protection rights (e.g., erasure, access requests) vis-à-vis the data recipients. There was no impossibility in disclosing the individual data recipients. BF was gaining a competitive advantage over other address publishers who disclose the recipients of their data. MB cited several decisions by the Federal Administrative Court (BVwG) and attached the correspondence with BF to his complaint. In response to a request, BF stated in a letter dated March 27, 2024, that it is a mailing list publisher and holds a business license for this activity pursuant to § 151 of the German Trade Regulation Act (GewO). It operates in accordance with the code of conduct pursuant to Art. 40 of the GDPR for the conduct of business by address publishers and direct marketing companies.
applies Art. 40
Due to standard industry practices, it is not possible to identify individual recipients: Address publishers typically work with industry partners who retrieve data and forward it to end customers, who in turn reduce the volume of data by cross-referencing it with their own databases. Therefore, there is no knowledge of which end customers these are or whether a selected data set is used at all. Tracking and logging the entire path an address takes through the various partners would entail a disproportionately large effort. Providing this information is therefore impossible within the meaning of the CJEU judgement in Case C-154/21. After being transferred to the customer, selected data is stored by BF only temporarily as a delivery file until the contractual relationship ends. The immediate erasure of the data also complies with the principle of data minimisation. The data subject is aware of all recipients through the origin note on the respective letter.
In a letter dated March 27, 2024, BF submitted on behalf of the client that it is an address publisher and holds a business license for this activity in accordance with Section 151 of the German Trade Regulation Act (GewO). It operates in accordance with the code of conduct under article 40 of the GDPR for the conduct of business by address publishers and direct marketing companies. Due to standard industry practices, it is not possible to identify individual recipients: Address publishers typically work with industry partners who retrieve data and forward it to end customers, who in turn reduce the volume of data by cross-referencing it with their own databases. Therefore, there is no knowledge of which end customers these are or whether a selected data set is used at all. Tracking and logging the entire path of an address through the various partners would entail a disproportionately large effort.
applies Art. 40
Providing such information is therefore impossible under the CJEU judgement in Case C-154/21. After being transferred to the customer, selected data is stored by BF only temporarily as a delivery file until the contractual relationship ends. The immediate erasure of the data also complies with the principle of data minimisation. The data subject is aware of all recipients through the origin note on the respective letter. In response to the request, MB stated in a letter dated October 13, 2024, that BF had claimed to have deleted the delivery files, even though the controller is required under Article 12 of the GDPR to take appropriate measures to fulfill the obligation to provide information under Article 15. Furthermore, there were no documents available to substantiate that disclosing the data recipients would entail a disproportionate effort. It was incorrect to assume that the MB knew all recipients of his data that had been disclosed by the BF, because letters from data recipients rarely included a source reference.
In particular, it cannot be assumed that all data recipients have already sent letters to him. They are not obligated to immediately use the acquired data by sending direct letters to him. The MB requested the hearing of informed representatives from various organizations that he knew had received his data from the BF.In a letter dated October 13, 2024, the MB stated that the BF had claimed to have deleted the data transfer files, even though the controller is required under Article 12 of the GDPR to take appropriate measures to fulfill the obligation to provide information under Article 15. Furthermore, there were no documents available to substantiate that disclosing the data recipients would entail a disproportionate burden. It is incorrect to assume that the MB knows all recipients of his data that were disclosed by the BF, because letters from data recipients rarely include a reference to the source.
In particular, it cannot be assumed that all data recipients have already sent letters to him. They are not obligated to use the data they have obtained immediately by sending direct letters to him. The MB requested the hearing of informed representatives from various organizations that he knew had received his data from the BF. The respondent authority subsequently obtained an audit report on the BF pursuant to Article 41 of the GDPR from XXXX and conducted hearings with the witnesses XXXX on February 10 and February 28, 2025. The respondent authority subsequently obtained an audit report on BF pursuant to article 41 of the GDPR from Roman 40 and conducted interviews with the witnesses Roman 40 on February 10 and February 28, 2025. In a letter dated March 27, 2025, BF commented on the findings of the investigation, stating that the witness interviews had revealed that there was no direct contact between the end customers of the industry partners and BF.
applies Art. 41
The origin note serves exclusively to inform the data subject about the origin of the data record. It is a fallacy to assume that, within a processing chain, the original supplier also knows the destination of every address rental. The industry partner generally informs the original supplier only of the volume used, but not of the individual data records. The MB had received letters with a source indicator from both end customers who were interviewed and had thus been informed of the transfer by BF. On May 15, 2025, the responding authority conducted an interview with the managing director of BF XXXX and its data protection officer XXXX. On May 15, 2025, the responding authority conducted an interview with the managing director of BF Roman 40 and its data protection officer Roman 40. In a letter dated May 29, 2025, the MB stated that, according to the transcript of the hearing held on May 15, 2025, the BF occasionally used special test addresses to determine whether a data record was still being used.
With these test addresses, it is apparently possible to keep track of the recipient. Furthermore, it is irrelevant for the disclosure of the recipients whether they have since deleted the data they received. The contested decision upheld the complaint and found that the BF had thereby violated the MB’s right to access information pursuant to Article 15(1)(c) of the GDPR by failing to provide him with information regarding the recipients of his personal data.The contested decision upheld the complaint and found that the BF had thereby violated the MB’s right to access pursuant to article 15, paragraph 1, subparagraph c, of the GDPR by failing to provide him with information regarding the recipients of his personal data. The respondent authority essentially stated that the BF had disclosed the MB’s personal data to third parties in at least three instances, although the transfer had not been made directly to the final recipients but rather to so-called industry partners specializing in the production of direct mail.
applies Art. 15(1)(c), Art. 15
BF does not maintain any records of the recipients to whom it discloses personal data of natural persons. Furthermore, BF has not, to date, taken any steps toward identifying the recipients, meaning that neither a cost estimate nor a project plan for such implementation exists. From a legal standpoint, the respondent authority assumed that the right of access under Article 15(1)(c) of the GDPR, in accordance with the CJEU judgement of January 12,2023 in Case C-154/21, also encompasses the right to be informed of the specific recipients of the personal data. The argument of impossibility could not be raised if the controller had not, as a matter of principle, organized its operations in such a way as to be able to provide information about the recipients. BF had deliberately decided not to keep records of the recipients, and it was irrelevant whether a recipient might have already deleted the transferred personal data.
applies Art. 15(1)(c)
The BF’s assertion that storage of information on the recipients would entail too great a technical and financial burden has not been substantiated in any way. The principle of data minimisation can never result in a data subject being unduly restricted in the fundamental right of access. The industry’s code of conduct, to which the BF had committed itself, clearly stipulated the obligation to provide information in the present case. Legally, the defendant authority assumed that the right of access under Article 15, paragraph 1, subparagraph (c), GDPR, in accordance with the CJEU judgement of January 12, 2023, in Case C-154/21, also included the right to be informed of the specific recipients of the personal data. The argument of impossibility cannot be raised if the controller has not, as a matter of principle, organized its operations in such a way as to be able to provide information about the recipients.
applies Art. 15
The BF had deliberately decided not to keep records of the recipients, and it is irrelevant whether a recipient may have already deleted the transferred personal data. The BF’s assertion that storage of information about the recipients would entail too great a technical and financial burden has not been substantiated in any way. The principle of data minimisation can never lead to a data subject being unduly restricted in the fundamental right of access. The industry’s code of conduct, to which the BF had submitted, clearly stipulated an obligation to provide information in the present case. This is the subject of BF’s complaint, in which—following an oral hearing—it sought, primarily, the amendment of the contested decision and, in the alternative, its annulment. In it, the BF essentially argues that the responding authority fails to recognize the fundamental importance of the principle of data minimisation.
This principle underlies the BF’s practice of immediately deleting the data records transferred to the respective customers after their transfers. The GDPR does not contain any obligation to store recipients for a specific period of time. This would contradict the obligation of data minimisation and lead to a massive increase in the volume of data stored by BF. The inability to provide the requested information in this case is not a self-inflicted organizational shortcoming, but rather a direct consequence of an industry-standard and data-protection-friendly business model. The codes of conduct cited by the authority in question merely establish a general responsibility but do not prescribe any specific technical or organizational implementation that would violate the principle of data minimisation. It is a matter of common sense that implementing a comprehensive, audit-proof logging system for millions of data records and thousands of transmission transactions would require a fundamental and cost-intensive overhaul of the entire IT infrastructure supporting BF’s business processes.
Under these circumstances, the demand for a detailed cost estimate is arbitrary. The respondent authority submitted the complaint, together with the administrative act, to the Federal Administrative Court—received on September 23, 2025—and moved to have it dismissed as unfounded. The complaint is well-founded: The following facts have been established: BF operates as an address publisher and direct marketing company pursuant to § 151 of the Trade Regulation Act (GewO) and, for this purpose, also processes the MB’s personal data (including, among other things, his residential address). As part of its commercial activities, BF directly provides address data to end customers for the purpose of postal contact (such as for fundraising campaigns) or to other industry partners for the purpose of compiling a data record for the end customer from various sources. Immediately after transmitting the relevant data record to the respective customer, BF deletes that data record.
When data is transferred to an industry partner, BF is informed by the industry partner only of the total volume ultimately used for the mailing, but not of the specific individual data records used. If BF receives a request for erasure or an objection from a data subject pursuant to Articles 17 and 21 of the GDPR, this request will be forwarded to all of BF’s license partners within one week.BF operates as an address publisher and direct marketing company in accordance with Section 151 of the German Trade Regulation Act (GewO) and, for this purpose, also processes the MB’s personal data (including, among other things, their residential address). As part of its commercial activities, BF directly discloses address data to end customers for the purpose of postal contact (such as for fundraising campaigns) or to other industry partners for the purpose of compiling a data record for the end customer from various sources.
Immediately after transmitting the relevant data record to the respective customer, BF deletes that data record. When data is transferred to an industry partner, BF is informed by the industry partner only of the total volume ultimately used for the mailing, but not of the specific data records used. If BF receives a request for erasure or an objection from a data subject pursuant to Articles 17 and 21 of the GDPR, this request will be forwarded to all of BF’s licensing partners within one week. BF has submitted to the industry-specific code of conduct for the operation of address publishers and direct marketing companies pursuant to Article 40 of the GDPR, which provides in para 1 of section 12 (“Data Subject Rights”) stipulate that address publishers and direct marketing companies must provide information “to the full extent of Article 15 of the GDPR” regarding the data stored in their own marketing files.
Section 10(2) of the Code of Conduct provides: “If address publishers and direct marketing companies only make data available for a marketing campaign without being involved in the design of mailings, they shall inform their clients of the requirement to include a label on the advertising material that identifies the controller(s) of the source file(s). Address publishers and direct marketing companies shall obtain confirmation from the advertising client that they have taken note of this notice.” The BF has adopted the industry-specific Code of Conduct for the operation of address publishers and direct marketing companies in accordance with article 40, GDPR, which stipulate in Section 12, paragraph 1 (“Data Subject Rights”) that address publishers and direct marketing companies must provide information “to the full extent of article 15 of the GDPR” regarding the data stored in their own marketing files.
Paragraph 10, paragraph 2, of the Code of Conduct provides: “If address publishers and direct marketing companies only provide data for a marketing campaign without being involved in the design of the mailings, they shall inform their clients of the requirement to include a label on the advertising material that identifies the controller(s) of the source file(s). Address publishers and direct marketing companies shall obtain confirmation from the advertising client that they have taken note of this notice.” On January 7, 2024, the MB submitted a request for information pursuant to Art 15 of the GDPR to the BF, seeking, among other things, information regarding “data recipients or categories of recipients.” On January 7, 2024, MB submitted a request for information pursuant to article 15 of the GDPR to BF, seeking, among other things, information about “data recipients or categories of recipients.”
applies Art. 15
In a letter dated January 10, 2024, the BF informed the MB, among other things, that his personal data would be disclosed to “businesses in Austria—specifically in the retail and wholesale sectors—as well as banks, insurance companies, mail-order companies, and nongovernmental organizations (NGOs) or non-profit, charitable, or church-affiliated fundraising organizations that engage in written advertising or marketing, as well as to address publishers and direct marketing companies.” The data transfers are carried out “after we have informed our customers accordingly that, in the event of a request for information, the controllers must, to the extent possible, assist in identifying the clients who provided the original data. This is typically done by printing the source notation directly on the respective letter.” For the sake of completeness, it is noted that MB is not registered on the Robinson List maintained by the Austrian Chamber of Commerce.
Registration protects him from unsolicited advertising mail. As a mailing list publisher, BF is obligated to compare its data with the Robinson List on a monthly basis and to cease further use of the affected data records. In an email dated February 9, 2024, the MB requested additional information regarding which specific data recipients his address data had been transmitted to thus far. On February 23, 2024, BF replied to MB, stating that, due to standard industry practices in direct marketing, it was not possible to provide information about the individual recipients. Assessment of the Evidence: The findings regarding BF’s activities are based on its undisputed submissions as well as on the verifiable and undisputed statements made during the hearing of BF’s managing director and data protection officer by the responding authority. The findings regarding the industry-specific codes of conduct are based on BF’s undisputed submissions and the codes of conduct themselves, which are published on the WKO website: https://www.wko.at/oe/information-consulting/werbung-marktkommunikation/verhaltensregeln.pdf.
The findings regarding the correspondence between MB and BF are based on the documents submitted by MB with the data protection complaint. Legally, it follows that: The relevant legal provisions here are those of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “GDPR”), which has been directly applicable since May 25, 2018, are as follows: “Article 5 Principles Governing the Processing of Personal Data (1) Personal data must be a) processed lawfully, fairly, and in a manner that ensures transparency with regard to the data subject (“lawfulness, fairness, and transparency”); b) be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes is not considered incompatible with the original purposes pursuant to paragraph 89(1) (“purpose limitation”); c) be adequate, relevant, and limited to what is necessary for the purposes of processing (“data minimisation”); (…) e) be stored in a form that permits identification of data subjects only for as long as is necessary for the purposes for which the personal data are processed; personal data may be stored for a longer period provided that, subject to the implementation of appropriate technical and organizational measures required by this Regulation to protect the rights and freedoms of the data subject, exclusively for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1) (“storage limitation”); (…) Article 11 Processing for Which Identification of the Data Subject Is Not Required (1) If, for the purposes for which a controller processes personal data, the identification of the data subject by the controller is not or is no longer necessary, the controller is not obligated to retain, obtain, or process additional information for the sole purpose of complying with this Regulation in order to identify the data subject.
applies Art. 89(1), Art. 5, Art. 11
(2) Where, in cases referred to in paragraph 1 of this article, the controller can demonstrate that it is unable to identify the data subject, it shall inform the data subject thereof, where possible. In such cases, Articles 15 through 20 shall not apply, unless the data subject provides additional information enabling his or her identification in order to exercise the rights set forth in those articles. Article 12 Transparent Information, Communication, and Procedures for Exercising the Data Subject’s Rights (1) The controller shall take appropriate measures to provide the data subject with all information pursuant to Articles 13 and 14 and all communications pursuant to Articles 15 through 22 and Article 34 relating to the processing in a precise, transparent, understandable, and easily accessible form, using clear and plain language; this applies in particular to information specifically addressed to children.
The information shall be provided in writing or in another form, including electronically where appropriate. If requested by the data subject, the information may be provided orally, provided that the identity of the data subject has been verified by other means. (2) The controller shall facilitate the exercise by the data subject of his or her rights under Articles 15 through 22. In the cases referred to in Article 11(2), the controller may refuse to act on the data subject’s request to exercise their rights under Articles 15 through 22 only if the controller demonstrates that it is unable to identify the data subject. (3) The controller shall provide the data subject with information regarding the actions taken in response to a request under articles 15 through 22 without undue delay, and in any event within one month of receiving the request. This time limit may be extended by an additional two months if necessary, taking into account the complexity and the number of requests.
applies Art. 11(2), Art. 15
The controller shall notify the data subject of any extension within one month of receiving the request, along with the reasons for the delay. If the data subject submits the request electronically, the information shall be provided electronically, if possible, unless the data subject specifies otherwise. (…) Article 15 Right of Access by the Data Subject (1) The data subject has the right to obtain from the controller confirmation as to whether personal data concerning him or her are being processed; if so, he or she has the right to access such personal data and to receive the following information: a) the processing purposes; b) the categories of personal data being processed; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; d) if possible, the planned duration for which the personal data will be stored, or, if this is not possible, the criteria for determining that duration; e) the existence of a right to rectification or erasure of personal data concerning them, or a right to restriction of processing by the controller, or a right to object to such processing; f) the existence of a right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to the source of the data; h) the existence of automated decision-making, including profiling, pursuant to article 22 paragraphs 1 and 4, and—at least in such cases—meaningful information about the logic involved, as well as the scope and intended consequences of such processing for the data subject.
(…) Article 19 Obligation to Notify in Connection with the Rectification or Erasure of Personal Data or the Restriction of Processing The controller shall notify all recipients to whom personal data have been disclosed of any rectification or erasure of the personal data or any restriction of processing pursuant to Article 16, Article 17(1), and Article 18, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject of these recipients if the data subject so requests. (…) Article 21 Right to Object (…) (2) Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him or her for such marketing purposes; this also applies to profiling insofar as it is related to such direct marketing. (3) If the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for those purposes.
applies Art. 17(1), Art. 16, Art. 18, Art. 19, Art. 21
(…) Article 24 Responsibilities of the Controller (1) The controller shall implement appropriate technical and organizational measures, taking into account the nature, scope, circumstances, and purposes of the processing, as well as the varying likelihood and severity of the risks to the rights and freedoms of natural persons, implement appropriate technical and organizational measures to ensure, and to be able to demonstrate, that the processing is carried out in accordance with this Regulation. These measures shall be reviewed and updated as necessary. (…) Article 40 Codes of Conduct (1) Member States, supervisory authorities, the Board, and the Commission shall promote the development of codes of conduct designed to contribute to the proper application of this Regulation, taking into account the specific characteristics of individual processing areas and the particular needs of micro, small, and medium-sized enterprises.
(…) In this case, MB requested that BF disclose the specific recipients to whom BF had transferred its personal (address) data. According to the findings, the recipient is, depending on the circumstances of the case, either directly the end customer, who purchases the data for the purpose of contacting the customer by mail, or an industry partner who, in turn, compiles data records for the end customer from various sources. BF (undisputedly) does not have the requested information because it deletes the relevant data records immediately after processing the order with the recipient. The sole issue at hand, therefore, is whether BF is obligated to perform storage or logging of the specific recipients of the data transfers and, as a result of this failure, has violated MB’s right to access information under Article 15(1)(c) of the GDPR. The MB affirms the existence of such an obligation, citing the Court’s decision in W214 2233132-1, while the BF denies it, pointing to the principle of data minimisation and the expected effort involved.In the present case, the MB requested that the BF disclose the specific recipients to whom the BF had transferred his personal (address) data.
applies Art. 15(1)(c)
According to the findings, depending on the circumstances of the case, the recipient is either directly the end customer, who purchases the data for postal contact, or an industry partner who, in turn, compiles data records for the end customer from various sources. The BF (undisputedly) does not have the requested information because it deletes the relevant data records immediately after order processing with the recipient. The sole issue at hand, therefore, is whether BF is obligated to perform storage or logging of the specific recipients of the data transfers and, as a result of this omission, has violated MB’s right to access information under article 15(1)(c) of the GDPR. The MB affirms the existence of such an obligation, citing the Court’s decision in W214 2233132-1, while the BF denies it, pointing to the principle of data minimisation and the expected administrative burden. Regarding the issue at hand, it should first be noted that the GDPR does not, in fact, impose an explicit obligation for the storage of data regarding the specific recipients of transferred personal data.
applies Art. 15(1)(c)
The legal situation under the DSG 2000 prior to the GDPR’s entry into force in May 2018 was different: At that time, there was a statutory obligation—albeit a very limited one—under § 14(2)(7) of the DSG 2000, according to which a logging obligation for transfers existed only in accordance with the state of the art, costs, and risks associated with processing. For applications not registered in the data processing register at that time, there was an explicit logging requirement in relation to the right of access, whereas data applications that complied with a standard regulation (§ 17(2)(6)) or a model regulation (§ 19(2)) were, in turn, exempt (§ 14(3)). In Decision 2005/06/0194, the Administrative Court held that the legislature had considered the disclosure of only the recipient groups in response to requests for information to be sufficient in principle, provided that “the provision of information regarding specific recipients is impossible due to a lack of logging or would require a disproportionately high effort.”Regarding the issue outlined above, it should first be noted that the GDPR does indeed not impose an explicit obligation for the storage of data on the specific recipients of transferred personal data.
The legal situation under the DSG 2000 prior to the GDPR’s entry into force in May 2018 was different: At that time, there was a statutory obligation—albeit a very limited one—under Section 14, paragraph 2, item 7 of the DSG 2000, according to which a logging requirement for transfers existed only in accordance with the state of the art, costs, and risks of processing. For applications not registered in the data processing register at that time, a logging requirement existed explicitly in relation to the right of access; however, data applications that complied with a standard regulation (Section 17, paragraph 2, Item 6) or a model regulation (Section 19, Paragraph 2) were again exempt (Section 14, Paragraph 3). In Decision 2005/06/0194, the Administrative Court (VwGH) held that the legislature had considered the disclosure of only the recipient groups in response to requests for information to be sufficient in principle, provided that “the provision of information regarding specific recipients is impossible due to a lack of record-keeping or would require a disproportionately high effort.”
Regarding the current legal situation, the CJEU, in its judgement of January 12, 2023, in Case C-154/21, affirmed the controller’s obligation to disclose the identity of the specific recipients of the disclosed data in response to a corresponding request for information, “unless it is not possible to identify the recipients.” Regarding this impossibility, the Court held (para. 48) that such a situation “in particular” should be assumed when the specific recipients “are not yet known.” The CJEU thus established the impossibility of identification as a fundamental limitation on the right of access. However, the Court’s reasoning regarding the background of the right of access to information about the specific recipients—which it affirmed in principle (para. 37 et seq.)—must also be taken into account: This is intended to enable the data subject not only “to verify whether the data concerning him or her are accurate, but also whether they are being processed lawfully (…), in particular whether they have been disclosed to recipients authorized to process them.”
“This right of access is necessary, in particular, to enable the data subject, where appropriate, to exercise their right to rectification, their right to erasure (‘right to be forgotten’), their right to restriction of processing, which they are entitled to under Articles 16, 17, and 18 of the GDPR (…), as well as to exercise their right under Article 21 of the GDPR to object to the processing of their personal data, or, in the event of damage, to seek the judicial remedies provided for in Articles 79 and 82 of the GDPR.” This is intended to enable the data subject not only “to verify whether the data concerning them is accurate, but also whether it is being processed lawfully (…), in particular whether it has been disclosed to recipients authorized to process it.” “This right of access is necessary, in particular, to enable the data subject, where applicable, to exercise their right to rectification, their right to erasure (“right to be forgotten”), their right to restriction of processing, which they are entitled to under Articles 16, 17, and 18 of the GDPR (…), as well as to exercise the right to object to the processing of their personal data provided for in article 21, GDPR, or, in the event of damage, to seek the judicial remedy provided for in articles 79 and 82 of the GDPR.”
applies Art. 16, Art. 17, Art. 18, Art. 21, Art. 79, Art. 82
An unrestricted reliance on the “impossibility” of providing specific information due to a lack of logging cannot therefore be inferred from the cited CJEU case law, since the principle of data processing in good faith (Art. 5(1)(a) GDPR) must also be observed. As the respondent authority states in the contested decision, referring to its own decision, it is generally not permissible to delete existing data that is subject to disclosure after receiving a request for access and then to issue a negative response. Nevertheless, the Court does not share the respondent authority’s reasoning regarding the applicability of that decision to the present case for the following reasons:An unrestricted reliance on the “impossibility” of providing the specific information due to a lack of logging cannot therefore be derived from the cited CJEU case law, since the principle of data processing in good faith (Article 5, paragraph 1, subparagraph a, GDPR) must also be observed.
applies Art. 5(1)(a), Art. 5
As the respondent authority states in the contested decision, referring to its own ruling, it is generally not permissible to delete existing data subject to disclosure after receiving a request for information and then to issue a negative response. Nevertheless, the Court does not share the respondent authority’s reasoning regarding the applicability of that decision to the present case for the following reasons: In line with the Federal Constitutional Court (BF), it must first be noted that the GDPR (as already explained) does not impose an obligation for the storage of the recipient data specifically requested by MB, but does establish a general obligation to implement data minimisation (and, correspondingly, an obligation to implement storage limitation and purpose limitation) (Art. 5(1)(b), (c), and (e) of the GDPR). These three “fundamental obligations” of data processing generally preclude the processing of data beyond the specified purpose (Hötzendorfer/Tschohl/Kastelitz in Knyrim, DatKomm Art. 5 GDPR (as of May 7, 2020, rdb.at), para. 34).
applies Art. 5(1)(b), Art. 5(1)(c), Art. 5(1)(e), Art. 5
The retention period for data must therefore be limited to the absolute minimum necessary (para. 49). If it were assumed that the BF had an obligation to perform storage of information about specific recipients of transferred personal data, such an obligation would result in the Federal Police retaining and accumulating substantial data sets solely for the “purpose” of being able to provide information to data subjects in the theoretical event that they submit a request for access and wish to be informed of the specific recipients. However, this would reduce the principle of data minimisation to absurdity, given that controllers would then always be free to counter alleged violations of data minimisation or storage limitations—resulting from the continued storage of data after the original purpose has been fulfilled—by arguing that the data subject in question might submit a request for access in the future and, in doing so, also wish to know which data was transferred to which recipients (regarding the obligation to disclose the content of the transferred data in the event of a request for access, see VwGH Ro 2020/04/0015).In accordance with the Federal Constitutional Court (BF), it should first be noted that the GDPR (as already explained) does not impose an obligation to store the recipient data specifically requested by the MB, but rather establishes a general obligation to implement data minimisation (and, correspondingly, an obligation to implement storage limitation and purpose limitation) (Article 5, paragraph 1, subparagraphs b, c, and e of the GDPR).
applies Art. 5
These three “fundamental obligations” of data processing generally preclude the processing of data beyond the specified purpose (Hötzendorfer/Tschohl/Kastelitz in Knyrim, DatKomm article 5, GDPR (as of May 7, 2020, rdb.at), Marginal Note 34). The retention period for data must therefore be limited to the absolute minimum necessary (Marginal Note 49). If it were assumed that the Federal Office (BF) had a duty to perform storage of information about specific recipients of transferred personal data, such an obligation would result in the BF retaining and accumulating substantial data sets solely for the “purpose” of being able to provide information to data subjects in the theoretical event that they submit a request for access and wish to be informed of the specific recipients. However, this would reduce the principle of data minimisation to absurdity, given that controllers would then always be able to counter alleged violations of data minimisation or storage limitations—resulting from the continued storage of data after the original purpose has been fulfilled—with the argument that the data subject in question might submit a request for access in the future and, in doing so, also wish to know which data were transferred to which recipients (regarding the obligation to disclose the content of the transferred data in the event of a request for access, see VwGH Ro 2020/04/0015).
applies Art. 5
The priority of data minimisation over a retention obligation solely for the purpose of providing information to the data subject can also be derived from the provision of Art 11 of the GDPR, which, although specific, is nevertheless generalizable in its underlying principle: this provision relieves the controller of the obligation to retain information necessary to identify the data subject if such identification is no longer necessary for the (original) processing purpose, even if this makes it impossible to exercise the rights under Articles 15 through 20. This provision thus indicates that, when balancing the data subject rights, the legislature gives priority to data minimisation (see also Hötzendorfer in Knyrim, DatKomm Art. 11 GDPR (as of May 7, 2020, rdb.at), paras. 1, 2). In this context, Recital 64 of the GDPR should also be noted, which states that a controller should not store personal data solely for the purpose of being able to respond to potential access requests.The priority of data minimisation over a storage obligation solely for the purpose of providing information to the data subject can also be derived from the provision of article 11 of the GDPR, which, although specific, is nevertheless generalizable in its underlying principle: this provision relieves the controller of the obligation to retain information necessary to identify the data subject if such identification is no longer necessary for the (original) processing purpose, even if this makes it impossible to exercise the rights under articles 15 through 20.
This provision thus indicates that, when balancing the data subject rights, the legislature gives priority to data minimisation (see also Hötzendorfer in Knyrim, DatKomm article 11, GDPR (as of May 7, 2020, rdb.at), paras. 1, 2). In this context, Recital 64 of the GDPR should also be noted, which states that a controller should not store personal data solely for the purpose of responding to potential access requests. In the Rijkeboer case (judgement of May 7, 2009, C-553/07), the CJEU had to rule on the following facts: The data subject in that case requested that his municipality’s administration inform him of all instances in which data concerning him had been transferred from the municipal administration to third parties during the preceding two years (para. 23). The municipality subsequently provided the information only for the one-year period preceding the submission of the request for information, because the relevant national law provided for the storage of such data for only one year (para. 21).
applies Art. 11
The Court distinguished between the “basic data” that the municipality held about a specific person and the “information about the recipients or categories of recipients to whom this basic data is transmitted, as well as about the content of this data” (para. 42 et seq.), with the time limitation at issue applying only to the second category of data. The CJEU referred to the necessity of the right of access in order to exercise the other rights provided for in the (then-current) Directive (para. 51 et seq.) and held that this right must therefore also apply retroactively (para. 54). The duration of retention should be assessed, among other things, in light of the potential burden on the controller if there are numerous recipients of the data or if the frequency of transfers to a smaller number of recipients is high (para. 59). It must also be taken into account “that personal data must not be kept in a form that allows for the identification of the data subject for longer than is necessary to achieve the purposes for which they were collected or further processed” (para. 65).
Ultimately, it is up to the Member States to establish an appropriate time limit “while ensuring a fair balance between the data subject’s interest in the protection of his or her privacy—in particular through the right to rectification, erasure, or blocking of the data if its processing does not comply with the Directive, as well as the right to object and the right to judicial remedy, on the one hand, and the burden that the obligation to retain the information in question places on the controller, on the other hand” (para. 64). The particularly sensitive nature of the data must also be taken into account where appropriate (para. 63). In the present case, it is problematic that the information regarding the recipients is limited to a period of one year, while the underlying data is retained for much longer, unless it is demonstrated that retaining the information in question for a longer period would impose an undue burden on the controller (para. 66).
In summary, the CJEU thus requires a balancing of interests here between the data subject’s interest in receiving information—in order to be able to assert further data protection rights—and the controller’s interest in erasure, because retention would impose an undue burden on the controller. Under the current legal framework, such an obligation for data storage—arising from a balancing of interests on a case-by-case basis—may result from Article 24 of the GDPR, which obligates the controller in para 1 to “implement appropriate technical and organizational measures, taking into account the nature, scope, circumstances, and purposes of the processing, as well as the varying likelihood and severity of the risks to the rights and freedoms of natural persons, to implement appropriate technical and organizational measures to ensure and be able to demonstrate that the processing is carried out in accordance with this Regulation.”
applies Art. 24
Under certain circumstances, therefore, the obligation to log the individual recipients of data transfers may arise if this is necessary in a specific case to ensure GDPR-compliant processing (see also Haidinger in Knyrim, DatKomm Art. 15 GDPR (as of July 1, 2024, rdb.at), footnote 246), which could be assumed, for example, in the case of data requiring special protection.Such an obligation to perform storage—arising after a case-by-case assessment—may, under the current legal framework, stem from Article 24 of the GDPR, which obligates the controller in paragraph 1 to “implement appropriate technical and organizational measures, taking into account the nature, scope, the circumstances, and the purposes of the processing, as well as the varying likelihood and severity of the risks to the rights and freedoms of natural persons, to implement appropriate technical and organizational measures to ensure and be able to demonstrate that the processing is carried out in accordance with this Regulation.”
Under certain circumstances, therefore, the obligation to log the individual recipients of data transfers may arise if this is necessary in a specific case to ensure GDPR-compliant processing (see also Haidinger in Knyrim, DatKomm article 15, GDPR (as of July 1, 2024, rdb.at), footnote 246), which could be assumed, for example, in the case of data requiring special protection. However, no obligation to store data in this specific case can be inferred from the code of conduct applicable to the BF for the operation of address publishing and direct marketing businesses pursuant to Art 40 of the GDPR: Although these rules of conduct stipulate in § 12(1) under “data subject rights” that BF is obligated to provide information “to the full extent of Article 15 of the GDPR,” this applies only “with respect to data stored in its own marketing files.” Actual “storage” is thus specified as a prerequisite for the obligation to provide information, meaning that no obligation to store data can be inferred from this provision.
applies Art. 15
Conversely, no obligation to store data in this specific case can be inferred from the code of conduct applicable to BF for the operation of address publishing and direct marketing businesses pursuant to article 40 of the GDPR: Although these rules of conduct stipulate in Section 12, paragraph 1, under “data subject rights,” that the BF is obligated to provide information “to the full extent of article 15 of the GDPR,” this applies only “with respect to data stored in its own marketing files.” Actual “storage” is thus specified as a prerequisite for the obligation to provide information, meaning that no obligation to store data can be inferred from this provision. Based on the above considerations, the Court—contrary to the decision in Case W214 2233132-1—does not find that the controller is generally required to retain records in order to be able to provide information about the specific recipients when disclosing data.
Furthermore, unlike in the facts underlying that case, the BF argues in the present case that such a storage obligation would place an undue burden on it. Nor can it be assumed that the data subject’s data protection rights vis-à-vis the controller and the recipients—which are linked to the disclosure—would be “largely rendered meaningless” if the controller were not generally obligated to perform storage of such information. In this specific case, the failure to provide information about the specific data recipients does not appear to result in any detriment to the MB’s data protection rights: In this context, the MB asserts in its statement of October 13, 2024, it is incorrect to assume that, based on the source notation affixed to promotional letters, he knows all recipients of his data that were disclosed by BF, because such a source notation is rarely found on letters from data recipients.
In particular, it cannot be assumed that all data recipients have already sent letters to him. They are not obligated to immediately use the acquired data by sending direct correspondence to him. In this regard, it should be noted that, pursuant to § 151(7), first sentence, of the German Trade Regulation Act (GewO), address publishers and direct marketing companies must structure mailings carried out as part of marketing campaigns—which they conduct using personal data provided by them or obtained through their intermediary services— must be designed in such a way that, through appropriate labeling of the advertising material sent out, the identity of the controllers of those data systems whose data was used to address the advertising mailing (source data systems) is traceable; to the extent that such business operators are involved in advertising mailings solely by providing or brokering data, they must ensure, by providing an appropriate notice to the controllers responsible for the advertising mailing, that the identity of the controllers of the source data systems used is traceable.In this regard, it should be noted that, pursuant to Section 151, paragraph 7, Sentence 1 of the German Trade Regulation Act (GewO), address publishers and direct marketing companies must structure mailings carried out as part of marketing campaigns—using personal data provided or brokered by them— must be designed such that, through appropriate labeling of the sent advertising material, the identity of the controllers of those data systems whose data were used to address the advertising mailing (source data systems) is traceable; to the extent that such business operators participate in advertising mailings solely by providing or brokering data, they must ensure, by providing an appropriate notice to the controllers responsible for the advertising mailing, that the identity of the controllers of the source data systems used can be traced.
The law thus requires that advertising mailings from address publishers/direct marketing companies be labeled with a note indicating the origin of the personal data used. To the extent that the aforementioned businesses—which include BF— do not carry out the marketing campaign themselves but are merely involved in the advertising mailing—for example, by brokering data (through an “industry partner”)—they must at least work to ensure that such a source notation is included by notifying the controller responsible for the mailing. According to Section 10(2) of the industry-specific code of conduct applicable to BF, the advertising client must even confirm in writing that they have taken note of this notice. It follows from these requirements, which are binding on BF, that it can generally be assumed that, in the case of an advertising letter addressed to the MB using data originating from BF, the MB learns of the data’s origin from BF via the source notation.
The MB presented examples in the proceedings (statement of October 13, 2024) presented examples (XXXX) where a corresponding origin note referring to the BF was printed on the promotional letter; however, he left his assertion that “an origin note is found only rarely on the letters sent to data recipients” entirely unsubstantiated.The law thus requires that promotional mailings from address publishers/direct marketing companies be labeled with a note indicating the source of the personal data used. To the extent that the aforementioned businesses—which include BF— do not carry out the marketing campaign themselves but merely participate in the advertising mailing—for example, by providing data (through an “industry partner”)—they must at least ensure that such a source notice is included by notifying the controller responsible for the mailing. According to Section 10, paragraph 2, of the industry-specific code of conduct applicable to BF, the advertising client must even confirm in writing that they have taken note of this notice.
It follows from these binding requirements for BF that, as a general rule, it can be assumed that, in the case of an advertising letter addressed to the MB using data originating from BF, the MB learns of the data’s origin from BF via the source notation. Incidentally, in the proceedings (statement of October 13, 2024), the MB did present examples (Roman numeral 40), in which a corresponding origin note referring to the BF was printed on the promotional letter, but left his assertion that “an origin note is found only rarely on the letters sent to data recipients” entirely unsubstantiated. The fact that—as the MB also argues in favor of the need to disclose the specific recipients—data is occasionally transferred without being used for an immediate mailing, and of which the MB therefore learns nothing, is likely to occur rarely, after all, end customers pay for the transferred data, and the storage of data by end customers for a possible later mailing also appears economically pointless due to the risk of the data becoming “obsolete.”
Mailings will therefore generally take place at the same time as the data transfer, as was also revealed by the two witness interviews conducted by the prosecuting authority regarding XXXX. Finally—particularly in cases where MB’s data is not passed on to an end customer but to another address publisher for the “enrichment” of its database—it is necessary to refer to the “Robinson List” pursuant to § 151(9) and (11) of the Trade Regulation Act (GewO), in which individuals who wish to opt out of receiving promotional materials may be listed free of charge. The list must be updated at least once a month and made available to address publishers and direct marketing companies. These businesses may not send or distribute addressed advertising materials to individuals listed on this list, nor may they disclose their data. Furthermore, registration on the “Robinson List” pursuant to para 11 constitutes the exercise of the right to object under Article 21(2) of the GDPR against these businesses.
applies Art. 21(2)
Pursuant to Article 21(3), these businesses may no longer process the personal data of the data subject for the purpose of direct marketing as a result of an objection. Specifically, as noted, the BF forwards such requests to object to all of its licensed partners within one week, thereby preventing further processing of the relevant personal data by these partners as well, and thus ensuring that the BF complies with the requirements of Article 19 of the GDPR.The fact that—as the MB also argues in favor of the need to disclose the specific recipients—data is sometimes transferred that is not immediately used for mailings and of which the MB therefore has no knowledge is likely to occur rarely, after all, end customers pay for the data that is shared, and the storage of data by end customers for a potential mailing at a later date appears economically pointless due to the risk of the data becoming “outdated.”
applies Art. 21(3), Art. 19
Mailings will therefore generally take place simultaneously with the data transfer, as was also confirmed by the two witness interviews conducted by the prosecuting authority regarding point 40. Finally—particularly in cases where MB’s data is not passed on to an end customer but to another address publisher for the “enrichment” of its database—reference must be made to the “Robinson List” pursuant to Section 151, paragraphs 9 and 11 of the Trade Regulation Act (GewO), in which individuals who wish to opt out of receiving advertising material may be registered free of charge. The list must be updated at least once a month and made available to address publishers and direct marketing companies. These businesses may not send or distribute addressed advertising materials to individuals listed on this list, nor may they disclose their data. Furthermore, registration on the “Robinson List” pursuant to paragraph 11 is deemed to constitute the exercise of the right to object under article 21, paragraph 2, of the GDPR with respect to these businesses.
applies Art. 21
Pursuant to Article 21, paragraph 3, these businesses may no longer process the personal data of the data subject for the purpose of direct marketing following an objection. Specifically, as noted, BF forwards such requests to object to all of its license partners within one week, thereby preventing any further processing of the relevant personal data by these parties as well, and thus ensuring that BF complies with the requirements of article 19 of the GDPR. It is therefore not clear to what extent the MB’s data protection interests could be compromised here by the failure to disclose the recipients of the data. In contrast, the BF rightly argues that a general obligation to ensure storage of information regarding the transfers of personal data to specific recipients would lead to a multiplication of the BF’s data holdings and would thus not only contradict the principle of data minimisation but would also result in a significantly greater administrative burden for the BF.
In accordance with the Rijkeboer case, such a burden on the controller must be given significant weight in the balancing of interests. Finally, as noted, the BF discloses only address data and thus no data that is, in principle, particularly sensitive. Since the balancing of interests in this case clearly favors the BF and finds against the MB’s right to storage and disclosure of the specific recipients, the specific extent of the burden expected to be incurred by the BF need not be determined. The MB’s right to information was therefore not infringed. The complaint against the contested decision was therefore to be upheld, and the ruling of the contested decision was to be amended to dismiss the data protection complaint. Pursuant to para 24(1) VwGVG, the Administrative Court must conduct a public oral hearing upon request or, if it deems it necessary, on its own motion.Pursuant to paragraph 24(1) of the VwGVG, the Administrative Court must conduct a public oral hearing upon request or, if it deems it necessary, on its own motion.
Pursuant to § 24(4) VwGVG, unless otherwise provided by federal or state law, the Administrative Court may, regardless of a party’s motion, refrain from holding a hearing if the case file indicates that an oral hearing is unlikely to provide further clarification of the matter, and neither Article 6(1) of the ECHR nor Article 47 of the CFR precludes the omission of the hearing. Pursuant to paragraph 24(4) of the VwGVG—unless otherwise provided by federal or state law— – the Administrative Court may, regardless of a party’s motion, dispense with an oral hearing if the case file indicates that an oral hearing is unlikely to provide further clarification of the matter, and neither article 6(1) of the ECHR nor article 47 of the CFR preclude the omission of the hearing. In the present case, the facts were clarified by the record. The admission of further evidence was not necessary to clarify the facts.
applies ECHR Art. 6(1), ECHR Art. 47
The Federal Administrative Court had to clarify, first and foremost, the legal issues discussed above, so that holding an oral hearing did not prove necessary. The appeal was admissible in this case because, with regard to the legal issue of fundamental importance (for potentially numerous cases)—namely, whether or under what conditions the GDPR obligates controllers to perform storage of information about the specific recipients of the personal data they transfer solely for the purpose of enable data subjects to obtain information pursuant to Article 15(1)(c) of the GDPR.The appeal was admissible in the present case because, regarding the legal question of fundamental importance (for potentially numerous cases)—namely, whether and under what conditions the GDPR obligates controllers to perform storage of information about the specific recipients of the personal data they transfer solely for the purpose of enabling data subjects to receive information pursuant to article 15, paragraph 1, subparagraph (c), of the GDPR.
applies Art. 15(1)(c), Art. 15