# BVwG - W298 2298066-1 - Type: Case Law - Source: Federal Administrative Court - Date: 2026-10-07 - Original: https://gdprhub.eu/index.php?title=BVwG_-_W298_2298066-1 - Canonical: https://overview.legal/posts/607173 - Topics: Personal Data, IP Address, Retention Period, Legitimate Interest, Integrity and Confidentiality Principle, Types of Special Categories of Personal Data, Professional Secrecy, Right to be Forgotten, Accountability, Security ## Summary Facts — According to national law (§ 6(2) and (3) PartG 2012), donations to political parties are being published on a government website, including the name of individuals who donate more than €150 and, in addition to that, the postal code of individuals who donate more than €500. A data subject donated €2,600 to a political party. Their name and postal code were published on the government website. The data subject filed a complaint with the DPA. The DPA held that the national law provided for a legal basis for the publishing of their name and postal code. The data subject appealed the decision to the Federal Administrative Court (Bundesverwaltungsgericht, the court). Holding — The court had doubts as to the compatibility of the national provision with the GDPR and European and national constitutional law. The court held that the processing of personal data in relation to a donation to a political party are special categories of personal data pursuant to Article 9(1) GDPR. While this information does not directly reveal the political opinion of an individual, the data allows the inference of a supposed political affiliation, depending on the amount of money donated. Article 6(3) GDPR provides that where the processing is based on national law, the national provision shall meet an objective of public interest and be proportionate to the legitimate aim pursued. The court held that the aim of transparency and control by the public in the light of donations to political parties is a legitimate aim in that regard. However, the court had doubts whether the processing is necessary to pursue that aim. According to the court, the legal materials documenting the legislative process of the national provision do not indicate that the legislator adequately considered whether it is necessary to publish the name and postal code of donors to a wide public, or whether it is a less intrusive but equally suitable means to restrict access to the information to a limited number of persons, or to omit the postal code of the donor. The principle of data minimisation pursuant to Article 5(1)(c) GDPR requires the legislator to make such considerations during the legislative process. Furthermore, the legislator should have considered the specific nature of the personal data according to Article 9(1) GDPR. For those reasons, the court has doubts as to the compatibility of the national provision with Article 8(1) CFR and Article 8 ECHR, and applied to the Constitutional Court (Verfassungsgerichtshof) to decide on the matter of compatibility. ## Sections (126) ### ¶1 Date of Decision October 7, 2026 Legal Provisions B-VG Art. 135, para. 4 B-VG Art. 140, para. 1, subpara. 1, lita B-VG Art. 89, para. 2 DSG § 1 DSG § 24, para. 1 DSG §27 DSG §35a(1) DSG §35h DSG §69(10) GDPR Art. 4(1) GDPR Art. 4(2) GDPR Art. 4(7) GDPR Art. 5 GDPR Art. 51(1) GDPR Art. 55, para. 1 GDPR Art. 58, para. 2 GDPR Art. 6 GDPR Art. 77, para. 1 GDPR Art. 9 ECHR Art. 8 CFR Art. 8 PartG §3 PartG §6 PartG §6, para. 2 PartG §6, para. 3 Federal Constitutional Law (B-VG) Art. 135 (current version); B-VG Art. 135 effective as of January 1, 2014, last amended by Federal Law Gazette I No. 51/2012; B-VG Art. 135 effective from July 1,July 2008 through December 31, 2013, last amended by Federal Law Gazette I No. 2/2008 B-VG Art. 135 effective from January 1, 2004, through June 30,June 2008, last amended by Federal Law Gazette I No. 100/2003, B-VG Art. 135, effective from July 1, 1976, through December 31, 2003, last amended by Federal Law Gazette No. 302/1975 Federal Constitutional Law (B-VG) Art. 135, effective from January 1, 1965, through June 30, 1976; last amended by Federal Law Gazette No. 212/1964 B-VG Art. 135, effective from Dec. 25, 1946, through Dec. 31, 1964; last amended by Federal Law Gazette No. 211/1946 B-VG Art. 135, effective from Dec. 19,December 1945 through December 24, 1946; last amended by State Law Gazette No. 4/1945; B-VG Art. 135; in effect from January 3, 1930, through June 30, 1934 B-VG Art. 140 (now B-VG Art. 140), effective as of Jan. 1, 2015, last amended by BGBl. > Applies: gdpr-art-4-par-1-en, gdpr-art-4-par-2-en, gdpr-art-4-par-7-en, gdpr-art-51-par-1-en, gdpr-art-5-en, gdpr-art-6-en, gdpr-art-8-en, gdpr-art-55-en, gdpr-art-58-en, gdpr-art-77-en, gdpr-art-89-en ### ¶2 I No. 114/2013 B-VG Art. 140 in effect from Jan. 1, 2014, through Dec. 31, 2014, last amended by BGBl. I No. 51/2012 B-VG Art. 140 effective from July 1, 2008, through December 31, 2013, last amended by Federal Law Gazette I No. 2/2008 B-VG Art. 140, effective from January 1, 2004, through June 30, 2008; last amended by Federal Law Gazette I No. 100/2003; B-VG Art. 140, effective from JuneJune 1992 through December 31, 2003; last amended by Federal Law Gazette No. 276/1992; B-VG Art. 140; effective from January 1, 1991, through MayJune 1992, last amended by Federal Law Gazette No. 685/1988; B-VG Art. 140, effective from July 1, 1988, through December 31, 1990, last amended by Federal Law Gazette No. 341/1988, Article 140 of the Federal Constitutional Law (B-VG), effective from July 1, 1976, through June 30, 1988, last amended by Federal Law Gazette No. 302/1975, Article 140 of the Federal Constitutional Law (B-VG), effective from December 19,December 1945 through June 30, 1976; last amended by State Law Gazette No. 4/1945; Federal Constitutional Law (B-VG) Art. 140, effective from January 3, 1930, through June 30, 1934 B-VG Art. 89 (now B-VG Art. 89), effective as of Jan. 1, 2015, last amended by Federal Law Gazette I No. 114/2013, B-VG Art. 89, effective from January 1, 2014, through December 31, 2014, last amended by Federal Law Gazette I No. 51/2012; Federal Constitutional Law (B-VG) Art. 89, effective from January 1, 2004, through December 31,December 2013, last amended by Federal Law Gazette I No. 100/2003, B-VG Art. 89, effective from July 1, 1976, through December 31, 2003, last amended by Federal Law Gazette No. 302/1975 Federal Constitutional Law (B-VG) Art. 89, effective from April 7, 1964, through June 30, 1976, last amended by Federal Law Gazette No. 59/1964 Federal Constitutional Law (B-VG) Art. 89, effective from December 19,December 1945 through April 6, 1964; last amended by State Law Gazette No. 4/1945; Federal Constitutional Law (B-VG) Art. 89; in effect from January 3, 1930, through June 30, 1934 DSG Art. 1 § 1 (now DSG Art. 1 § 1), effective as of Jan. 1, 2014, last amended by Federal Law Gazette I No. 51/2012 DSG Art. 1 § 1 valid from Jan. 1, 2000, through Dec. 31, 2013 DSG Art. 2 § 24 (now DSG Art. 2 § 24), effective as of July 15, 2024, last amended by Federal Law Gazette I No. 70/2024; DSG Art. 2 § 24, effective from May 25,May 2018 through July 14, 2024; last amended by Federal Law Gazette I No. 120/2017 DSG Art. 2 § 24 valid from January 1, 2010, through May 24,2018, last amended by Federal Law Gazette I No. 133/2009, DSG Art. 2 § 24, effective from Jan. 1, 2000, through Dec. 31, 2009 DSG Art. 2 § 27 (currently DSG Art. 2 § 27), effective as of May 25, 2018, last amended by Federal Law Gazette I No. 120/2017; DSG Art. 2 § 27, effective from Jan.January 2014 through May 24, 2018; last amended by Federal Law Gazette I No. 83/2013 DSG Art. 2 § 27 valid from January 1, 2000, through December 31, 2013 DSG Art. 2 § 35a (currently DSG Art. 2 § 35a), effective as of July 15, 2024, last amended by Federal Law Gazette I No. 70/2024 DSG Art. 2 § 35h (currently DSG Art. 2 § 35h), effective as of July 15, 2024, last amended by Federal Law Gazette I No. 70/2024 DSG Art. 2 § 69 (currently DSG Art. 2 § 69), effective as of July 15, 2024, last amended by Federal Law Gazette I No. 70/2024 DSG Art. 2 § 69, effective from May 25, 2018, through July 14, 2024, last amended by Federal Law Gazette I No. 24/2018 DSG Art. 2 § 69 effective from May 25, 2018, through May 24, 2018, last amended by Federal Law Gazette I No. 120/2017 ECHR Art. 8 (currently ECHR Art. 8), effective as of May 1, 2004 PartG § 3 (currently PartG § 3), effective as of January 1, 2023; last amended by Federal Law Gazette I No. 125/2022; PartG § 3 was in effect from July 1, 2012, through December 31, 2022 PartG § 6 (currently PartG § 6), effective as of July 1, 2025, last amended by Federal Law Gazette I No. 25/2025 PartG § 6 valid from January 1, 2023, through June 30, 2025, last amended by Federal Law Gazette I No. 125/2022 PartG § 6 valid from SeptemberJuly 2019 through December 31, 2022, last amended by Federal Law Gazette I No. 55/2019 PartG § 6 effective from July 1, 2012, through July 8, 2019 PartG § 6 (current) PartG § 6 effective as of July 1, 2025, last amended by Federal Law Gazette I No. 25/2025, PartG § 6, effective from January 1, 2023, through June 30, 2025, last amended by Federal Law Gazette I No. 125/2022, PartG § 6, effective from July 9,July 2019 through December 31, 2022, last amended by Federal Law Gazette I No. 55/2019 PartG § 6 effective from July 1, 2012, through July 8, 2019 PartG § 6 (current) PartG § 6 effective as of July 1, 2025, last amended by Federal Law Gazette I No. 25/2025, PartG § 6, effective from January 1, 2023, through June 30, 2025, last amended by Federal Law Gazette I No. 125/2022, PartG § 6, effective from July 9,July 2019 through December 31, 2022, last amended by Federal Law Gazette I No. 55/2019 PartG § 6, effective from July 1, 2012, through July 8, 2019 Decision , W298 2298066-1/16Z M O T I O N pursuant to Article 140, paragraph one, item 1, subitem a, in conjunction with Article 135, paragraph 4, in conjunction with Article 89, paragraph 2, of the Federal Constitutional Law (B-VG) pursuant to Article 140, paragraph one, item 1, subparagraph a, in conjunction with Article 135, paragraph 4, in conjunction with Article 89, paragraph 2, of the Federal Constitutional Law (B-VG) The Federal Administrative Court, with Judge Mag. > Applies: gdpr-art-89-en ### ¶3 Mathias Veigl presiding, and expert lay judges Mag. Gerda Ferch-Fischer and Mag. Florian Schultes serving as associate judges, in the proceedings concerning the complaint filed by Dr. XXXX, represented by Haslinger/Nägele Rechtsanwälte GmbH, against the decision of the Data Protection Authority dated July 4, 2024, D124.2340/23, 2024-0.199.724, has decided as follows: The Federal Administrative Court, with Judge Mag. Mathias Veigl presiding and expert lay judge Mag. Gerda Ferch-Fischer and expert lay judge Mag. Florian Schultes serving as associate judges in the proceedings concerning the complaint filed by Dr. Roman 40, represented by Haslinger/Nägele Rechtsanwälte GmbH, against the decision of the Data Protection Authority dated July 4, 2024, D124.2340/23, 2024-0.199.724, has decided as follows: Pursuant to Art. 140(1)(1)(a) of the Federal Constitutional Law (B-VG), a PETITION is filed with the Constitutional Court requesting that it interpret para 6(2) and (3) of the Federal Act on the Financing of Political Parties (Political Parties Act 2012 – PartG), Federal Law Gazette I No. 56/2012, as amended. the phrase “Pursuant to Article 140, paragraph one, item one, subparagraph a, of the Federal Constitutional Law (B-VG), a MOTION is filed with the Constitutional Court requesting that it remove from Section 6, paragraphs 2 and 3, of the Federal Act on the Financing of Political Parties (Political Parties Act 2012 – PartG), Federal Law Gazette Part I, No. 56 of 2012, as amended, the following wording: (2) The political party shall report to the Court of Auditors, for the purpose of providing public information on the financing of political parties through private funds, in an open and machine-readable standardized format, no later than four weeks after the end of a calendar year, the individual donations received in excess of €150, specifying the name of the donor, the date the donation was received, the amount, and the specific recipient of the donation (party branch, affiliated organization, citizens’ committee, member of parliament, or candidate) in an open and machine-readable standardized format. > Topics: Recipient, Supervisory Authorities ### ¶4 For individual donations exceeding €500, the ZIP code of the donor’s residential or business address must also be collected and reported to the Court of Auditors. The Court of Auditors must immediately publish individual donations exceeding €500, specifying the donor’s name and postal code, the date the donation was received, the amount, and the specific recipient of the donation. The Court of Auditors and the political party must delete the names of the donors after the expiration of the period specified in para 5(8). (2) For the purpose of providing public information on the financing of political parties through private funds, the political party must report to the Court of Auditors, in an open and machine-readable standardized format, no later than four weeks after the end of a calendar year, the individual donations received in excess of €150, specifying the donor’s name, the date the donation was received, the amount, and the specific recipient of the donation (branch, affiliated organization, citizens’ committee, member of parliament, or candidate) to the Court of Auditors. > Topics: Recipient ### ¶5 For individual donations exceeding €500, the ZIP code of the donor’s residential or business address must also be collected and reported to the Court of Auditors. The Court of Auditors must immediately publish information on individual donations exceeding €500, specifying the donor’s name and postal code, the date the donation was received, the amount, and a breakdown by the specific recipient of the donation. The Court of Auditors and the political party must delete the names of the donors after the expiration of the period specified in Section 5, paragraph 8. (3) Between the reference date for the election to the National Council or the European Parliament and Election Day, individual monetary donations exceeding €2,500 must be reported to the Court of Auditors, specifying the donor’s name and address, the date the donation was received, the amount, and the specific recipient of the donation (branch, affiliated organization, citizens’ committee, member of the National Council, or candidate) without delay. > Topics: Recipient ### ¶6 The Court of Auditors must immediately publish these donations on its website, specifying the donor’s name, the date the donation was received, the amount, and the specific recipient of the donation (affiliate, affiliated organization, personal committee, member of the National Council, or candidate). declare it unconstitutional. In the alternative Both in para 2 and para 3 of Section 6 of the Federal Act on the Financing of Political Parties (Political Parties Act 2012 – PartG), Federal Law Gazette Part I No. 56/2012, as amended.Both in paragraph 2 and paragraph 3 of Section 6 of the Federal Act on the Financing of Political Parties (Political Parties Act 2012—PartG), Federal Law Gazette Part I, No. 56 of 2012, as amended. the phrase “the donor’s name and address.” In the alternative, he seeks to derive from Para 6(2) of the Federal Act on the Financing of Political Parties (Political Parties Act 2012 – PartG), Federal Law Gazette I No. 56/2012, as amended, the phrase “the name and address of the donor.” > Topics: Recipient ### ¶7 No. 56 of 2012, as amended, the phrase “The political party shall report to the Court of Auditors, for the purpose of providing public information on the financing of political parties through private funds, in an open and machine-readable standardized format, no later than four weeks after the end of a calendar year, the individual donations received in excess of €150, specifying the name of the donor, the date the donation was received, the amount, and the specific recipient of the donation (branch, affiliated organization, citizens’ committee, member of parliament, or candidate) in an open and machine-readable standardized format no later than four weeks after the end of a calendar year. For individual donations exceeding €500, the ZIP code of the donor’s residential or business address must also be collected and reported to the Court of Auditors. The Court of Auditors must immediately publish individual donations exceeding €500, specifying the donor’s name and postal code, the date the donation was received, the amount, and the specific recipient of the donation. > Topics: Recipient ### ¶8 The Court of Auditors and the political party must delete the names of the donors after the expiration of the period specified in para 5(8).““For the purpose of providing public information on the financing of political parties through private funds, the political party must report to the Court of Auditors, in an open and machine-readable standardized format, no later than four weeks after the end of a calendar year, the individual donations received in excess of €150, specifying the donor’s name, the date the donation was received, the amount, and the specific recipient of the donation (affiliate, affiliated organization, citizens’ committee, member of parliament, or candidate). For individual donations exceeding €500, the ZIP code of the donor’s residential or business address must also be collected and reported to the Court of Auditors. The Court of Auditors must immediately publish individual donations exceeding €500, specifying the donor’s name and postal code, the date the donation was received, the amount, and the specific recipient of the donation. > Topics: Recipient ### ¶9 The Court of Auditors and the political party must delete the names of the donors after the expiration of the period specified in Section 5, paragraph 8.” Declare this provision unconstitutional. Text Statement of Reasons: I. Facts: Roman numeral I. Facts: In his complaint dated October 23, 2023, addressed to the Data Protection Authority (DPA), the complainant alleged a violation of the right to confidentiality pursuant to § 1 DSG. In summary, it was argued that the complainant had made a donation of EUR 2,600 to a political party. Subsequently, pursuant to § 6(2) of the Political Parties Act (PartG) 2012, the Austrian People’s Party reported the amount of the donation, the date, and the complainant’s name along with his ZIP code to the Austrian Court of Auditors (a party to the proceedings), which in turn, pursuant to § 6(2) of the Political Parties Act (PartG) 2012, published the aforementioned data at www.rechnungshof.gv.at/rh/home/was-wir-tun/was-wir-tun_5/ was-wir-tun_5/ was-wir-tun_9/Parteispenden_2023_an_die_OEVP.html. > Topics: Supervisory Authorities ### ¶10 This allegedly violated the complainant’s right to confidentiality under § 1(1) of the Data Protection Act (DSG) by publishing data belonging to special categories regarding the complainant’s political opinion, as defined in Art. 9(1) of the GDPR, without a (sufficient) legal basis for the disclosure. In his complaint dated October 23, 2023, addressed to the Data Protection Authority (DPA), the complainant asserted a violation of his right to confidentiality under Section 1 of the DSG. In summary, it was alleged that the complainant had made a donation to a political party in the amount of EUR 2,600. Subsequently, the Austrian People’s Party, pursuant to Section 6, paragraph 2, of the Political Parties Act (PartG) 2012, reported the amount of the donation, the date, and the complainant’s name along with his ZIP code to the Austrian Court of Auditors (a party to the proceedings), which in turn, pursuant to Section 6, paragraph 2, of the Political Parties Act (PartG) 2012, published the aforementioned data at www.rechnungshof.gv.at/rh/home/was-wir-tun/was-wir-tun_5/ was-wir-tun_5/ was-wir-tun_9/Parteispenden_2023_an_die_OEVP.html. > Topics: Types of Special Categories of Personal Data, Political Opinions, Supervisory Authorities · Applies: gdpr-art-9-par-1-en ### ¶11 This allegedly violated the complainant’s right to confidentiality under Section 1, paragraph 1, of the Data Protection Act (DSG) by publishing data relating to the complainant’s political opinion that falls into special categories as defined in article 9, paragraph 1, of the GDPR—without a (sufficient) legal basis for the intervention. Consequently, the DPA suspended the proceedings pending the CJEU’s decision in Case C-33/22, in which the CJEU had to determine whether the exercise of the right to oversee the executive by a parliament is not subject to data protection oversight by a supervisory authority pursuant to Article 51(1) of the GDPR, and resumed the proceedings after the judgement was issued. Consequently, the DPA suspended the proceedings pending the CJEU’s decision in Case C-33/22, in which the CJEU had to determine whether the exercise by a parliament of its right to oversee the executive is not subject to data protection oversight by a supervisory authority pursuant to article 51, paragraph 1, GDPR, and resumed the proceedings after the judgement was rendered. > Topics: Supervision, Supervisory Authorities, Types of Special Categories of Personal Data, Political Opinions · Applies: gdpr-art-51-par-1-en, gdpr-art-9-en, gdpr-art-51-en ### ¶12 After being requested to submit comments, the co-party filed a statement on February 13, 2024, in which it argued, in summary, that the publication of the data reported by the political party to the co-party pursuant to para 6( 2 of the Political Parties Act (PartG) of 2012 to the co-party had been made on a legal basis and therefore did not constitute a breach of the duty of confidentiality.After being requested to submit a statement, the co-party submitted a statement on February 13, 2024, in which it argued, in summary, that the publication of the data reported by the political party to the co-party pursuant to Section 6, paragraph 2, PartG 2012 to the co-party was based on a legal basis and therefore did not constitute a breach of the duty of confidentiality. During the hearing granted to the parties in the proceedings before the Federal Administrative Court, the complainant argued that the published data constituted special categories of data within the meaning of Article 9(1) of the GDPR and that, therefore, special requirements applied to the legal basis, which para 6( 2 of the PartG 2012, which is why the interference with the fundamental right to data protection is inadmissible. > Topics: Professional Secrecy · Applies: gdpr-art-9-par-1-en ### ¶13 During the hearing granted to the parties in the proceedings before the Federal Administrative Court, the complainant argued that the published data constituted special categories of data within the meaning of Article 9, paragraph 1, GDPR and that, therefore, special requirements apply to the legal basis, which paragraph 6(2) of the PartG 2012 does not satisfy; consequently, the interference with the fundamental right to data protection is deemed impermissible. In the contested decision dated July 4, 2024, the DPA dismissed the complaint. Legally, the respondent authority argued that the co-party is a body responsible for overseeing public administration and that, according to the judgement of the CJEU in Case C-33/22, it is clear that the DPA is authorized to exercise data protection oversight over the co-party. On the merits, the respondent authority referred to the committee report in the materials accompanying Motion 2487/A, which amended the Federal Act on the Financing of Political Parties (Political Parties Act 2012—PartG), the Media Act, and the Constitutional Court Act of 1953 (VfGG), as well as to the DPA’s statement during the committee proceedings. > Topics: Supervisory Authorities, Public Authority · Applies: gdpr-art-9-en ### ¶14 It stated in particular that the disclosure requirement involved a cascading increase in the obligation to disclose and that the threshold amounts cited in the law appeared to be sufficiently justified and, accordingly, were not objectionable. The Data Protection Authority also had no doubts that the data processing and the disclosure requirement were sufficiently justified in accordance with the case law of the CJEU. The complainant filed a complaint against this decision with the Federal Administrative Court within the prescribed time limit in a brief dated August 5, 2024, arguing that Section 6(3) of the Political Parties Act (PartG) violates the Constitution and EU law. The complainant filed a complaint against this decision with the Federal Administrative Court within the prescribed time limit by a written submission dated August 5, 2024, arguing that paragraph 6(3) of the PartG violates the Constitution and EU law. > Topics: Supervisory Authorities ### ¶15 On January 1, 2025, Section 6 of the Data Protection Act entered into force, replacing the Austrian Data Protection Authority with the Parliamentary Data Protection Committee. In a request for comments and information, the Data Protection Authority was informed that its status as a party to the proceedings had been precluded and that the Parliamentary Data Protection Committee was free to submit a statement in the proceedings. In a submission dated February 4, 2025, the Parliamentary Data Protection Committee declined to submit a statement. Subsequently, the Federal Administrative Court (BVwG) filed a motion with the Constitutional Court to strike down provisions of the Political Parties Act, which was rejected by a decision dated September 11, 2025. Following the dismissal of the present complaint, the Federal Administrative Court (still) has concerns regarding the constitutionality of several passages in the provision of § 6(2) and (3) of the Political Parties Act (PartG) governing the publication of personal data of donors to political parties.Following the dismissal of the complaint in question, the Federal Administrative Court (still) has reservations regarding the constitutionality of several passages in the provision of Section 6, paragraphs 2 and 3, of the Political Parties Act (PartG) governing the publication of personal data of donors to political parties. > Topics: Personal Data, Supervisory Authorities ### ¶16 II. Legal Situation and Precedential Value: Roman Law II. Legal Situation and Precedential Value: The Federal Act on the Protection of Natural Persons with Respect to the Processing of Personal Data (Data Protection Act—DSG), Federal Law Gazette I No. 165/1999, reads as follows in its currently applicable version—which is relevant to the appeal—(the contested portion is underlined):The Federal Act on the Protection of Natural Persons with Regard to the Processing of Personal Data (Data Protection Act—DSG), Federal Law Gazette Part I, No. 165 of 1999, reads as amended—which is relevant to the appeal—(the contested portion is underlined): Art. 1 § 1 DSG, last amended by Federal Law Gazette I No. 51/2012: Article 1, Section 1, DSG, last amended by Federal Law Gazette I No. 51/2012: “Article 1 (Constitutional Provision) Fundamental Right to Data Protection § 1. (1) Every person has the right, in particular with regard to respect for their private and family life, to the confidentiality of personal data concerning them, to the extent that there is a legitimate interest therein. > Topics: Personal Data, Processing, Legitimate Interest, Integrity and Confidentiality Principle · Applies: gdpr-art-1-en ### ¶17 The existence of such an interest is excluded if data are not subject to a right to confidentiality due to their general availability or because they cannot be traced back to the data subject. Paragraph 1, (1) Every person has the right, particularly with regard to respect for their private and family life, to the confidentiality of personal data concerning them, provided there is a legitimate interest in such confidentiality. The existence of such an interest is excluded if data are not subject to a right to confidentiality due to their general availability or because they cannot be traced back to the data subject. (2) To the extent that the use of personal data is not in the vital interest of the data subject or does not occur with the data subject’s consent, restrictions on the right to confidentiality are permissible only to safeguard the overriding legitimate interests of another, and, in the case of interventions by a government authority, only on the basis of laws that are necessary for the reasons set forth in Article 8(2) of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210/1958. > Topics: Legitimate Interest, Personal Data, Integrity and Confidentiality Principle, Consent ### ¶18 Such laws may provide for the use of data that, by its Art, is particularly worthy of protection only to safeguard important public interests and must, at the same time, establish appropriate safeguards for the protection of the data subjects’ interests in confidentiality. Even in the case of permissible restrictions, the interference with the fundamental right must in each instance be carried out only in the least intrusive Art necessary to achieve the objective.(2) To the extent that the use of personal data is not in the vital interest of the data subject or does not occur with the data subject’s consent, restrictions on the right to privacy are permissible only to safeguard the overriding legitimate interests of another; in the case of interventions by a government authority, such restrictions may be imposed only on the basis of laws that are necessary for the reasons set forth in article 8, paragraph 2, of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210 of 1958. > Topics: Legitimate Interest, Personal Data, Consent ### ¶19 Such laws may provide for the use of data that, by its Art, is particularly worthy of protection only to safeguard important public interests and must, at the same time, establish appropriate safeguards for the protection of the data subjects’ interests in confidentiality. Even in the case of permissible restrictions, any interference with the fundamental right must be carried out only in the least intrusive Art necessary to achieve the objective. (3) To the extent that personal data concerning an individual is intended for automated processing or for processing in manually maintained files—that is, without automated support—every individual has, in accordance with statutory provisions, 1. the right to information regarding who is processing which data about them, where the data comes from, and for what purpose it is used, including, in particular, to whom it is disclosed; 2. the right to have inaccurate data corrected and the right to erasure of data processed unlawfully. > Topics: Personal Data, Accuracy, Right to be Forgotten, Automated Decision-Making ### ¶20 (4) Restrictions on the rights under paragraph 3 are permissible only under the conditions specified in paragraph 2.”(4) Restrictions on the rights under paragraph 3 are permissible only under the conditions specified in paragraph 2.” Art. 2 § 24(1) DSG, last amended by Federal Law Gazette I No. 120/2017: Article 2, Section 24, Paragraph 1, DSG, last amended by Federal Law Gazette I No. 120/2017: “Section 3 Remedies, Liability, and Sanctions Complaints to the Data Protection Authority § 24. (1) Every data subject has the right to lodge a complaint with the Data Protection Authority if they believe that the processing of their personal data violates the GDPR or § 1 or Article 2, Section 1.” Paragraph 24, (1) Every data subject has the right to lodge a complaint with the Data Protection Authority if they believe that the processing of their personal data violates the GDPR or Section 1 or Article 2, Part 1.” > Topics: Personal Data, Supervisory Authorities · Applies: gdpr-art-2-en ### ¶21 Art. 2 § 27, para. 1–3 DSG, last amended by Federal Law Gazette I No. 120/2017; Article 2, Paragraph 27, paragraphs 1–3, DSG, last amended by Federal Law Gazette Part I, No. 120 of 2017, Complaint to the Federal Administrative Court § 27(1) The Federal Administrative Court shall rule, through a panel, on complaints against decisions regarding a violation of the duty to provide information pursuant to § 24, para 7, and the Data Protection Authority’s duty to make a decision. Paragraph 27, point (1) The Federal Administrative Court shall rule through a panel on complaints against decisions regarding a violation of the duty to provide information pursuant to Section 24, paragraph 7, and the Data Protection Authority’s duty to decide. (2) The panel consists of a chairperson and one expert lay judge each from the ranks of employers and employees. The expert lay judges are appointed upon the recommendation of the Austrian Chamber of Commerce and the Federal Chamber of Labor and Employees. > Topics: Supervisory Authorities · Applies: gdpr-art-2-en ### ¶22 Appropriate measures shall be taken to ensure that a sufficient number of expert lay judges is available in a timely manner. (3) The expert lay judges must have at least five years of relevant professional experience and special knowledge of data protection law. Art. 2 § 35a, para. 1 DSG, last amended by Federal Law Gazette I No. 70/2024, Article 2, Section 35a, para. one, DSG, last amended by Federal Law Gazette Part I, No. 70 of 2024, Section 6 Parliamentary Data Protection Committee, Section 6, Parliamentary Data Protection Committee Establishment § 35a (Constitutional Provision) (1) In the legislative sphere, the Parliamentary Data Protection Committee is established as the national supervisory authority pursuant to Art. 51 of the GDPR. It is responsible for supervising processing activities. Section 35a (Constitutional Provision) (1) For the legislative sphere, the Parliamentary Data Protection Committee is established as the national supervisory authority pursuant to article 51 of the GDPR. > Topics: Supervision, Supervisory Authorities, Processing · Applies: gdpr-art-2-en, gdpr-art-51-en ### ¶23 It is responsible for supervising the processing activities 1. of the National Council and the Federal Council, including their members in the exercise of their mandate, as well as the officials pursuant to § 56i(1)(1) through (3) of the Constitutional Court Act of 1953 – VfGG, Federal Law Gazette No. 85/1953, of the National Council and the Federal Council, including their members in the exercise of their mandate, as well as officials pursuant to Section 56i, paragraph 1, items 1 through 3 of the Constitutional Court Act of 1953 – VfGG, Federal Law Gazette No. 85 of 1953, 1. of the National Council and the Federal Council, including their members in the exercise of their mandate, as well as the officials pursuant to Section 56i, paragraph 1, items 1 through 3 of the Constitutional Court Act of 1953 – VfGG, Federal Law Gazette No. 85 of 1953, of the National Council and the Federal Council, including their members in the exercise of their mandates, as well as officials pursuant to Section 56i, paragraph 1, items 1 through 3 of the Constitutional Court Act of 1953 – VfGG, Federal Law Gazette No. 85 of 1953, 2. the Court of Auditors and the Ombudsman’s Office, […]” Art. 2 § 35h DSG, last amended by Federal Law Gazette I No. 70/2024, Article 2, Section 35h, DSG, last amended by Federal Law Gazette Part I, No. 70 of 2024, Complaint to the Federal Administrative Court § 35h § 27, paragraph 1, applies mutatis mutandis. § 27, paragraphs 2 through 4, do not apply. > Topics: Processing ### ¶24 Paragraph 35h, § 27, paragraph 1, applies mutatis mutandis. § 27, paragraphs 2 through 4, do not apply. Art. 2 § 69(10) DSG, last amended by Federal Law Gazette Part I No. 70/2024 Article 2, Section 69, paragraph 10, DSG, last amended by Federal Law Gazette Part I, No. 70 of 2024, § 69 (10) (Constitutional Provision) The Parliamentary Data Protection Committee shall exercise its powers under this Federal Act as of January 1, 2025. Proceedings pending before the Data Protection Authority as of that date concerning processing pursuant to § 35a(1) shall be continued by the Parliamentary Data Protection Committee, with the decision period recommencing from that date. In proceedings pending before the Federal Administrative Court, the Administrative Court, or the Constitutional Court as of December 31, 2024, concerning processing pursuant to § 35a(1), the Parliamentary Data Protection Committee shall replace the Data Protection Authority. > Topics: Supervisory Authorities ### ¶25 Para 69, (10) (Constitutional Provision) The Parliamentary Data Protection Committee shall exercise its powers under this Federal Act as of January 1, 2025. Proceedings pending before the Data Protection Authority as of that date concerning processing pursuant to Section 35a, paragraph (1), shall be continued by the Parliamentary Data Protection Committee, and the decision period shall recommence. In proceedings pending before the Federal Administrative Court, the Administrative Court, or the Constitutional Court as of December 31, 2024, concerning processing pursuant to Section 35a, paragraph 1, the Parliamentary Data Protection Committee shall replace the Data Protection Authority. Federal Law on the Financing of Political Parties (Political Parties Act 2012 – PartG) StF: Federal Law Gazette I No. 56/2012 Federal Law on the Financing of Political Parties (Political Parties Act 2012 – PartG) Original Version, Federal Law Gazette Part One, No. 56 of 2012, Section 2 Amount and Allocation of Funding Section 2, Amount and Allocation of Funding Party Funding § 3. > Topics: Supervisory Authorities ### ¶26 (Constitutional Provision) The federal government and the states must, and municipalities may, allocate appropriate annual funding to political parties for their activities in contributing to the formation of political will at the federal, state, and municipal levels. To this end, political parties represented in the National Council or in the state parliaments shall be granted a total of at least 3.10 euros and at most 11 euros per eligible voter for the respective general representative body. The states may set their funding levels within twice the framework amounts to ensure participation in the political decision-making process at the district and municipal levels as well. The number of eligible voters shall be determined based on the number of eligible voters in the most recent election for the general representative body. Any additional funding provided to these political parties and parties campaigning in elections to general representative bodies to cover election campaign expenses is prohibited. > Topics: Representatives, Public Authority ### ¶27 Federal funding for political parties shall be regulated by a special federal law. Section 3 (Constitutional Provision): The federal government and the states must, and municipalities may, provide political parties with appropriate annual funding for their activities in participating in the formation of political will at the federal, state, and municipal levels. To this end, political parties represented in the National Council or in the state parliaments shall be granted a total of at least 3.10 euros and at most 11 euros per eligible voter for the respective general body of representation. The states may regulate their funding within twice the framework amounts to ensure participation in the political decision-making process at the district and municipal levels as well. The number of eligible voters shall be determined based on those eligible to vote in the most recent election for the general representative body. > Topics: Representatives, Public Authority ### ¶28 Any additional funding provided to these political parties and parties campaigning in elections to general representative bodies to cover election campaign expenses is prohibited. Federal funding for political parties shall be regulated by a special federal law. Section 3 Accountability Section 3, accountability Annual Financial Report § 6 Paragraph 6 Note regarding the following provision Applies only to those political parties that have filed their bylaws since January 1, 2000, or that have contested elections to a general representative body or to the European Parliament since January 1, 2000 (see § 16(4)).Applies only to those political parties that have filed their bylaws since January 1, 2000, or that have contested elections to a general representative body or to the European Parliament since January 1, 2000; see Section 16, paragraph 4). Donations § 6 (1) To the extent that maximum amounts are specified below for donations to a political party, these apply to the total of donations to the political party, donations to its affiliated organizations and to the committees of individuals attributable to it, as well as donations granted to members of the National Council and candidates to support their activities on behalf of the political party. > Topics: Accountability, Representatives ### ¶29 Bodies of a political party, branches of a political party with separate legal personality, affiliated organizations, committees of individuals, members of the legislature, and candidates must provide the party with all necessary information in a timely, accurate, and complete manner so that the party can comply with the deadlines specified in para 2.To the extent that maximum amounts are specified below for donations to a political party, these apply to the total of donations to the political party, donations to its affiliated organizations and to the committees of individuals attributable to it, as well as donations granted to members of the legislature and candidates to support their activities on behalf of the political party. Bodies of a political party, branches of a political party with separate legal personality, affiliated organizations, committees of individuals, members of the legislature, and candidates must provide the party with all necessary information in a timely, accurate, and complete manner so that the party can comply with the deadlines specified in paragraph 2.Section 6(1) To the extent that maximum amounts are specified below for donations to a political party, these apply to the total of donations made to the political party, donations made to its affiliated organizations and to the committees of individuals attributable to it, as well as donations granted to members of the legislature and candidates to support their activities on behalf of the political party. ### ¶30 Bodies of a political party, branches of a political party with separate legal personality, affiliated organizations, committees of individuals, members of the legislature, and candidates must provide the party with all necessary information in a timely, accurate, and complete manner so that the party can comply with the deadlines specified in paragraph 2.To the extent that maximum amounts are specified below for donations to a political party, these apply to the total of donations made to the political party, donations made to its affiliated organizations and to the committees of individuals attributable to it, as well as donations granted to members of the legislature and candidates to support their activities on behalf of the political party. Bodies of a political party, branches of a political party with separate legal personality, affiliated organizations, committees of individuals, members of parliament, and candidates must provide the party with all necessary information in a timely, accurate, and complete manner so that the party can comply with the deadlines specified in paragraph 2. ### ¶31 (1a) Each political party as defined in § 2(1) may accept donations totaling no more than €750,000 per calendar year. This provision also applies to new political parties standing for election that were not previously subject to the material scope of this Act, provided they have filed their bylaws prior to their first participation in an election for a general representative body or the European Parliament, provided, however, that for their first participation in an election in the relevant calendar year, twice this amount shall apply as the maximum limit. For existing political parties within the meaning of this federal law, or their territorial and non-territorial sub-organizations, that are running in elections to a state legislature in which they do not yet have representation, the amount specified in the first sentence is increased by an additional €200,000 per state legislative election in that calendar year, provided that the donations are earmarked by the donor for the purpose of election campaigning within the framework of the respective state legislative election campaign and are used accordingly. > Topics: Material scope (GDPR), Representatives ### ¶32 Each political party as defined in Section 2, paragraph 1, may accept donations totaling no more than €750,000 per calendar year. This provision also applies to new political parties engaged in election campaigning that were not previously covered by the material scope of this Act, provided they have filed their bylaws prior to their first participation in an election for a general representative body or the European Parliament, provided, however, that for their first participation in an election in the relevant calendar year, twice this amount shall apply as the maximum limit. For existing political parties as defined by this federal law, or their territorial and non-territorial sub-organizations, that are standing for election to a state legislature in which they do not yet have representation, the amount specified in the first sentence shall be increased by an additional €200,000 per state legislative election in that calendar year, provided that the donations are earmarked by the donor for election campaigning purposes within the framework of the respective state legislative election campaign and are used accordingly.(1a) Each political party as defined in Section 2, paragraph 1, may accept donations totaling no more than €750,000 per calendar year. > Topics: Material scope (GDPR), Representatives ### ¶33 This provision also applies to new political parties campaigning in elections that were not previously covered by the material scope of this Act, provided they have filed their bylaws prior to their first participation in an election for a general representative body or the European Parliament, provided, however, that for their first participation in an election in the relevant calendar year, twice this amount shall apply as the maximum limit. For existing political parties within the meaning of this federal law, or their territorial and non-territorial sub-organizations, that are running in elections to a state legislature in which they do not yet have representation, the amount specified in the first sentence shall be increased by an additional €200,000 per state legislative election in that calendar year, provided that the donations are earmarked by the donor for election campaigning purposes within the framework of the respective state legislative election campaign and are used accordingly. > Topics: Material scope (GDPR), Representatives ### ¶34 Each political party as defined in Section 2, paragraph 1, may accept donations totaling no more than €750,000 per calendar year. This provision also applies to new political parties engaged in election campaigning that were not previously covered by the material scope of this Act, provided they have filed their bylaws prior to their first participation in an election for a general representative body or the European Parliament, provided, however, that for their first participation in an election in the relevant calendar year, twice this amount shall apply as the maximum limit. For existing political parties as defined by this federal law, or their territorial and non-territorial sub-organizations, that are standing for election to a state legislature in which they do not yet have representation, the amount specified in the first sentence shall be increased by an additional €200,000 per state parliament election in that calendar year, provided that the donations are earmarked by the donor for election campaign purposes within the scope of the respective state parliament election campaign and are used accordingly. > Topics: Material scope (GDPR), Representatives ### ¶35 (2) For the purpose of providing the public with information on the financing of political parties through private funds, the political party must report to the Court of Auditors, in an open and machine-readable standardized format, no later than four weeks after the end of each calendar quarter, the individual donations received in excess of €150, specifying the name of the donor, the date the donation was received, the amount, and the specific recipient of the donation (branch, affiliated organization, citizens’ committee, member of parliament, or candidate). For individual donations exceeding €500, the ZIP code of the donor’s residential or business address must also be collected and reported to the Court of Auditors. The Court of Auditors must immediately publish information on individual donations exceeding €500, specifying the donor’s name and postal code, the date the donation was received, the amount, and a breakdown by the specific recipient of the donation. > Topics: Recipient ### ¶36 The Court of Auditors and the political party must delete the names of the donors after the expiration of the period specified in para 5(8).For the purpose of providing public information on the financing of political parties through private funds, the political party must report to the Court of Auditors, in an open and machine-readable standardized format, no later than four weeks after the end of each calendar quarter, the individual donations received in excess of €150, specifying the donor’s name, the date the donation was received, the amount, and the specific recipient of the donation (branch, affiliated organization, citizens’ committee, member of parliament, or candidate). For individual donations exceeding €500, the ZIP code of the donor’s residential or business address must also be collected and reported to the Court of Auditors. The Court of Auditors must immediately publish individual donations exceeding €500, specifying the donor’s name and postal code, the date the donation was received, the amount, and the specific recipient of the donation. > Topics: Recipient ### ¶37 The Court of Auditors and the political party must delete the names of the donors after the expiration of the period specified in Section 5, paragraph 8. (2) For the purpose of providing public information on the financing of political parties through private funds, the political party must report to the Court of Auditors, in an open and machine-readable standardized format, no later than four weeks after the end of each calendar quarter, the individual donations received in excess of €150, specifying the donor’s name, the date the donation was received, the amount, and the specific recipient of the donation (branch, affiliated organization, citizens’ committee, member of parliament, or candidate). For individual donations exceeding €500, the ZIP code of the donor’s residential or business address must also be collected and reported to the Court of Auditors. The Court of Auditors must immediately publish information on individual donations exceeding €500, specifying the donor’s name and postal code, the date the donation was received, the amount, and a breakdown by the specific recipient of the donation. > Topics: Recipient ### ¶38 The Court of Auditors and the political party must delete the names of the donors after the expiration of the period specified in Section 5, paragraph 8.For the purpose of providing public information on the financing of political parties through private funds, the political party must report to the Court of Auditors, in an open and machine-readable standardized format, no later than four weeks after the end of each calendar quarter, the individual donations received in excess of €150, specifying the donor’s name, the date the donation was received, the amount, and the specific recipient of the donation (branch, affiliated organization, citizens’ committee, member of parliament, or candidate). For individual donations exceeding €500, the postal code of the donor’s residential or business address must also be collected and reported to the Court of Auditors. The Court of Auditors must immediately publish information on individual donations exceeding €500, specifying the donor’s name and postal code, the date the donation was received, the amount, and a breakdown by the specific recipient of the donation. > Topics: Recipient ### ¶39 The Court of Auditors and the political party must delete the names of the donors after the expiration of the period specified in Section 5, paragraph 8. (3) Between the reference date for the election to the National Council or the European Parliament and Election Day, individual monetary donations exceeding €2,500 must be reported to the Court of Auditors, specifying the donor’s name and address, the date the donation was received, the amount, and the specific recipient of the donation (branch, affiliated organization, citizens’ committee, member of the National Council, or candidate) without delay. The Court of Auditors must immediately publish these donations on its website, specifying the donor’s name, the date the donation was received, the amount, and the specific recipient of the donation (affiliate, affiliated organization, personal committee, member of parliament, or candidate). 2. > Topics: Recipient ### ¶40 Regulation (EU) 2016/679 (General Data Protection Regulation), as amended, is applicable in the event of a complaint: Art. 4(1), (2), (7), and (11), Art. 5, Art. 6, and Art. 9 of the GDPR: Article 4, paragraphs 1, 2, 7, and 11; Article 5; Article 6; and Article 9 of the GDPR: Definitions Art. 4. For the purposes of this Regulation, the following terms shall have the following meanings: Article 4. For the purposes of this Regulation, the following terms shall have the following meanings: 1. “personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person; 2. > Topics: IP Address, Personal Data, Identification · Applies: gdpr-art-4-par-1-en, gdpr-art-4-par-2-en, gdpr-art-4-par-7-en, gdpr-art-4-par-11-en, gdpr-art-4-en, gdpr-art-5-en, gdpr-art-6-en, gdpr-art-9-en ### ¶41 “Processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transfer, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction; 7. “Controller” means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, makes the decision on the purposes and means of the processing of personal data; if the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for by Union law or the law of the Member States; Principles Governing the Processing of Personal Data Art. 5. (1) Personal data must be processed in accordance with Article 5, (1) Personal data must be a) processed lawfully, fairly, and in a manner that ensures transparency with regard to the data subject (“lawfulness, fairness, and transparency”); b) be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes is not considered incompatible with the original purposes pursuant to paragraph 89(1) (“purpose limitation”); c) be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”); d) be factually accurate and, where necessary, kept up to date; all reasonable measures must be taken to ensure that personal data that is inaccurate in light of the purposes of its processing is erased or rectified without delay (“accuracy”); e) be stored in a form that permits identification of data subjects only for as long as is necessary for the purposes for which they are processed; Personal data may be stored for a longer period provided that, subject to the implementation of appropriate technical and organizational measures required by this Regulation to protect the rights and freedoms of the data subject, processed exclusively for archiving purposes in the public interest, or for scientific or historical research purposes, or for statistical purposes in accordance with paragraph 89(1) (“storage limitation”); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, through appropriate technical and organizational measures (“Integrity and Confidentiality”); (2) The controller is responsible for compliance with paragraph 1 and must be able to demonstrate such compliance (“accountability”). > Topics: Personal Data, Retention Period, Storage Limitation, Controllers · Applies: gdpr-art-5-en ### ¶42 Lawfulness of Processing Art. 6 (1) Processing is lawful only if at least one of the following conditions is met: Article 6, (1) Processing is lawful only if at least one of the following conditions is met: a) The data subject has given consent to the processing of personal data concerning him or her for one or more specified purposes; b) processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of precontractual measures taken at the data subject’s request; c) processing is necessary for compliance with a legal obligation to which the controller is subject; d) The processing is necessary to protect the vital interests of the data subject or of another natural person; e) The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f) the processing is necessary to protect the legitimate interests of the controller or of a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail, in particular where the data subject is a child. > Topics: Legitimate Interest, Personal Data, Controllers, Consent · Applies: gdpr-art-6-par-1-en, gdpr-art-6-en ### ¶43 Subparagraph 1(f) does not apply to processing carried out by public authorities in the performance of their duties. (2) Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with respect to processing carried out for the purposes set forth in paragraph 1(c) and (e) by defining more precisely specific requirements for such processing and other measures to ensure lawfulness and fairness in processing, including for other specific processing situations under Chapter IX.(2) Member States may maintain or introduce more specific provisions to adapt the application of the provisions of this Regulation with regard to processing carried out to fulfill paragraph 1(c) and (e) by defining specific requirements for processing and other measures more precisely, to ensure lawfulness and fairness in processing, including for other specific processing situations set forth in Chapter IX. > Topics: Public Authority ### ¶44 (3) The legal basis for the processing operations referred to in paragraph 1(c) and (e) shall be determined by (a) Union law; or (b) the law of the Member States to which the controller is subject. The purpose of the processing must be set out in that legal basis or, with respect to processing pursuant to paragraph 1(e), be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This legal basis may contain specific provisions adapting the application of the provisions of this Regulation, including provisions regarding which general conditions apply to the lawfulness of processing by the controller, which types of data are processed, which data subjects are affected, to which entities and for what purposes personal data may be disclosed, to what purpose limitation they are subject, how long they may be stored, and which processing operations and procedures may be applied, including measures to ensure lawful and fair processing, such as those applicable to other specific processing situations under Chapter IX. > Topics: Fairness & Transparency, Personal Data, Controllers ### ¶45 Union law or the law of the Member States must pursue an objective in the public interest and be proportionate to the legitimate purpose pursued.The purpose of the processing must be specified in that legal basis or, with respect to processing pursuant to paragraph 1(e), be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This legal basis may contain specific provisions to adapt the application of the provisions of this Regulation, including provisions regarding the general conditions governing the lawfulness of processing by the controller, the types of data processed, the individuals concerned, the entities to which and the purposes for which personal data may be disclosed, the purpose limitation to which they are subject, how long they may be stored, and which processing operations and procedures may be applied, including measures to ensure lawfulness and fairness in processing, such as those for other specific processing situations set forth in Chapter IX. > Topics: Personal Data, Controllers ### ¶46 Union law or the law of the Member States must pursue an objective in the public interest and be proportionate to the legitimate purpose pursued. […] Processing of Special Categories of Personal Data Article 9 (1) The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation, is prohibited. Article 9, (1) The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, (2) Paragraph 1 does not apply in the following cases: a) data concerning health, or data concerning a natural person’s sex life or sexual orientation, is prohibited. > Topics: Personal Data, Processing · Applies: gdpr-art-9-par-1-en, gdpr-art-9-en ### ¶47 The data subject has explicitly consented to the processing of the aforementioned personal data for one or more specified purposes, unless, under Union law or the law of the Member States, the prohibition set forth in paragraph (1) cannot be lifted by the data subject’s consent, b) the processing is necessary for the controller or the data subject to exercise their rights or fulfill their obligations arising from labor law and social security and social protection law, to the extent that this is permitted under Union law or the law of the Member States, or under a collective agreement governed by the law of a Member State that provides appropriate safeguards for the fundamental rights and interests of the data subject, c) the processing is necessary to protect the vital interests of the data subject or another natural person, and the data subject is physically or legally incapable of giving consent, d) the processing is carried out on the basis of appropriate safeguards by a non-profit foundation, NGO, or other organization with political, ideological, religious, or trade union aims, within the scope of its lawful activities and provided that that the processing relates exclusively to members or former members of the organization or to persons who maintain regular contact with it in connection with its purposes, and that the personal data is not disclosed to the public without the consent of the data subjects, the processing relates to personal data that the data subject has manifestly made public, f) the processing is necessary for the establishment, exercise, or defense of legal claims or in the context of judicial proceedings by Courts in the exercise of their judicial functions, g) the processing is based on Union law or the law of a Member State that is proportionate to the objective pursued, respects the essence of the right to data protection, and provides for appropriate and specific measures to safeguard the fundamental rights and interests of the data subject, is necessary for reasons of substantial public interest, h) the processing is necessary for the purposes of preventive healthcare or occupational medicine, for the assessment of an employee’s fitness for work, for medical diagnosis, care or treatment in the health or social care sector, or for the administration of health or social care systems and services, based on Union law or the law of a Member State, or pursuant to a contract with a health professional, and subject to the conditions and safeguards referred to in paragraph 3; i) the processing is necessary for reasons of public interest in the area of public health, such as protection against serious cross-border threats to health or to ensure high standards of quality and safety in healthcare and with regard to medicinal products and medical devices, is necessary on the basis of Union law or the law of a Member State that provides for appropriate and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy; or j) the processing is necessary on the basis of Union law or the law of a Member State that is proportionate to the objective pursued, respects the essence of the right to data protection, and provides for appropriate and specific measures to safeguard the fundamental rights and interests of the data subject, is necessary for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to paragraph 89. > Topics: Statistics, Personal Data, Consent, Professional Secrecy ### ¶48 The personal data referred to in paragraph 1 may be processed for the purposes set forth in paragraph 2(h) if such data is processed by or under the responsibility of qualified personnel who are subject to a duty of professional secrecy under Union law, the law of a Member State, or the regulations of competent national authorities, or if the processing is carried out by another person who is also subject to a duty of confidentiality under Union law, the law of a Member State, or the rules of national competent authorities. Art. 51(1) GDPR: Article 51, paragraph 1, GDPR: “Art. 51 GDPR” “Art.” 51 GDPR Supervisory Authority (1) Each Member State shall provide for one or more independent authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons with regard to the processing of personal data and to facilitate the free flow of personal data within the Union (hereinafter referred to as “supervisory authority”).” > Topics: Supervision, Personal Data, Supervisory Authorities, Public Authority · Applies: gdpr-art-51-par-1-en, gdpr-art-51-en ### ¶49 Art. Article 55(1) of the GDPR: Article 55, paragraph 1, of the GDPR: “Art. 55 of the GDPR” “Art.” 55 of the GDPR Competence (1) Each supervisory authority shall be competent to carry out the tasks and exercise the powers conferred upon it by this Regulation within the territory of its own Member State.” Art. 58(2) GDPR: Article 58, paragraph 2, GDPR: “Art. 58 GDPR” “Art.” 58 GDPR Powers (2) Each supervisory authority shall have all of the following remedial powers, which enable it to (a) issue a warning to a controller or a processor that intended processing operations are likely to infringe this Regulation; (b) issue a reprimand to a controller or a processor where they have infringed this Regulation through processing operations; c) instruct the controller or processor to comply with requests from the data subject to exercise the rights to which the data subject is entitled under this Regulation, d) to instruct the controller or processor to bring processing operations into compliance with this Regulation, where necessary, in a specific manner and within a specified time frame, e) to order the controller to notify the data subject affected by a personal data breach accordingly, f) to impose a temporary or permanent restriction on processing, including a prohibition, g) order the rectification or erasure of personal data or the restriction of processing in accordance with Articles 16, 17, and 18, and order that recipients to whom such personal data has been disclosed in accordance with Article 17(2) and Article 19 be informed of such measures, h) revoke a certification or instruct the certification body to revoke a certification granted pursuant to Articles 42 and 43, or instruct the certification body not to grant a certification if the conditions for certification are not or are no longer met, i) to impose an administrative fine pursuant to article 83, in addition to or in lieu of the measures referred to in this paragraph, depending on the circumstances of the individual case, j) to order the suspension of the transfer of data to a recipient in a third country or to an international organisation. > Topics: Supervision, Right to Restriction, Right to be Forgotten, Controllers · Applies: gdpr-art-17-par-2-en, gdpr-art-55-par-1-en, gdpr-art-58-par-2-en, gdpr-art-16-en, gdpr-art-17-en, gdpr-art-18-en, gdpr-art-19-en, gdpr-art-42-en, gdpr-art-43-en, gdpr-art-55-en, gdpr-art-58-en, gdpr-art-83-en ### ¶50 Art. 77(1) GDPR: Article 77, paragraph 1, GDPR: “Art. 77 GDPR” “Art.” 77 GDPR Right to lodge a complaint with a supervisory authority (1) Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or the place where the alleged infringement occurred, if the data subject considers that the processing of personal data concerning them infringes this Regulation.” The Federal Administrative Court—in accordance with the legal reasoning of the Data Protection Authority – that § 6(2) and (3) of the Political Parties Act (PartG) of 2012 is, in principle, applicable to the case at hand, as it concerns the processing of personal data relating to a political party donation for the purpose of publication by the Court of Auditors. Given the specific amount of the donation, it must be assumed, based on the facts of the case, that the aforementioned provision requires the publication of the complainant’s name and ZIP code on the Court of Auditors’ website for a period of 7 years.The Federal Administrative Court—in accordance with the legal considerations of the Data Protection Authority—assumes that Section 6, paragraphs 2 and 3 of the Political Parties Act (PartG) 2012 are, in principle, applicable to the case at hand because it concerns the processing of personal data relating to a political party donation for the purpose of publication by the Court of Auditors. > Topics: Personal Data, Supervision, Supervisory Authorities, Processing · Applies: gdpr-art-77-par-1-en, gdpr-art-77-en ### ¶51 Given the specific amount of the donation, it must be assumed, based on the facts of the case, that the aforementioned provision requires the publication of the complainant’s name and ZIP code before the Federal Administrative Court on the Court of Auditors’ website for a period of 7 years. The cited provisions are therefore binding within the meaning of Art. 89(2) in conjunction with Art. 135(4) in conjunction with Art. 140(1)(1)(a) of the Federal Constitutional Law (B-VG). The cited provisions are therefore prejudicial within the meaning of Article 89, paragraph 2, in conjunction with Article 135, paragraph 4, in conjunction with Article 140, paragraph 1, item 1, subparagraph a, of the Federal Constitutional Law (B-VG). Decision of the Senate: Pursuant to Article 130(1)(1) of the Federal Constitutional Law (B-VG), the administrative courts rule on complaints against decisions of an administrative authority on the grounds of unlawfulness. > Applies: gdpr-art-89-par-2-en, gdpr-art-89-en ### ¶52 Pursuant to article 130, paragraph 1, subparagraph 1, of the Federal Constitutional Law (B-VG), the administrative courts rule on complaints against decisions of an administrative authority on the grounds of illegality. Pursuant to § 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court makes its decisions through a single judge, unless federal or state laws provide for a decision by a panel. Pursuant to § 27 of the Data Protection Act (DSG), as amended (which essentially corresponds to § 39 of the DSG 2000, which was in effect until May 24, 2018), the Federal Administrative Court makes a decision in proceedings concerning complaints against decisions alleging a violation of the duty to provide information under para 24(7) and the duty of the Data Protection Authority to render a decision, by a panel. The panel consists of a chairperson and one expert lay judge each from the ranks of employers and employees. > Topics: Supervisory Authorities ### ¶53 Pursuant to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court makes its decisions through a single judge, unless federal or state laws provide for a decision by a panel. Pursuant to Section 27 of the Data Protection Act (DSG), as amended (which essentially corresponds to Section 39 of the DSG 2000), the Federal Administrative Court decides by a panel in proceedings concerning complaints against decisions based on a violation of the duty to inform pursuant to Section 24, paragraph 7, and the Data Protection Authority’s duty to decide. The Senate consists of a chairperson and one expert lay judge each from the ranks of employers and employees. Pursuant to § 35a(1)(2) of the DSG, the Parliamentary Data Protection Committee is established as the national supervisory authority under Article 51 of the GDPR and is responsible for supervising the processing activities of the Court of Auditors. > Topics: Supervision, Supervisory Authorities, Processing · Applies: gdpr-art-51-en ### ¶54 Pursuant to § 35g(2) of the Data Protection Act (DSG), complaints may be filed with the Federal Administrative Court, and appeals may be brought before the Administrative Court of Appeal. Pursuant to § 35h of the DSG, § 27(1) applies mutatis mutandis. § 27(2) through (4) do not apply.Pursuant to Section 35a, paragraph 1, item 2 of the DSG, the Parliamentary Data Protection Committee is established as the national supervisory authority pursuant to article 51 of the GDPR and is responsible for supervising the processing activities of the Court of Auditors. Pursuant to Section 35g, paragraph 2, of the DSG, complaints may be filed with the Federal Administrative Court, and appeals may be filed with the Administrative Court of Appeal. Pursuant to Section 35h of the DSG, Section 27, paragraph 1, applies mutatis mutandis. Paragraph 27, paragraphs 2 through 4, do not apply. The proceedings of the administrative courts, with the exception of the Federal Finance Court, are governed by the Administrative Court Procedure Act (VwGVG) (Section 1 of the aforementioned Act). > Topics: Supervision, Supervisory Authorities, Processing · Applies: gdpr-art-51-en ### ¶55 Pursuant to § 58(2) VwGVG, conflicting provisions that had already been promulgated at the time this federal law entered into force remain in force.The proceedings of the administrative courts, with the exception of the Federal Finance Court, are governed by the Administrative Court Procedure Act (VwGVG) (Section 1, leg. cit.). Pursuant to paragraph 58(2) of the VwGVG, conflicting provisions that had already been promulgated at the time this federal law entered into force remain in force. Pursuant to § 17 VwGVG, unless otherwise provided in this federal law, the provisions of the AVG—with the exception of §§ 1 through 5 and Part IV , as well as other specifically named laws (not relevant in the present case), and, in all other respects, those procedural provisions in federal or state laws shall apply mutatis mutandis that the authority applied or would have been required to apply in the proceedings preceding the proceedings before the Administrative Court. ### ¶56 Pursuant to Section 17 of the VwGVG, unless otherwise provided in this federal law, the provisions of the AVG—with the exception of Sections 1 through 5 and Part IV— , as well as other specifically named laws (not relevant in the present case) and, in all other respects, those procedural provisions in federal or state laws that the authority applied or would have been required to apply in the proceedings preceding the proceedings before the Administrative Court. Pursuant to § 28(1) VwGVG, the Administrative Court must resolve the case by rendering a decision, unless the complaint is to be dismissed or the proceedings are to be discontinued. Pursuant to § 31(1) VwGVG, decisions and orders are issued by resolution, unless a judgment is to be rendered.Pursuant to Section 28(1) of the VwGVG, the administrative court must resolve the case by a judgment, unless the complaint is to be dismissed or the proceedings are to be discontinued. ### ¶57 Pursuant to Section 31(1) of the VwGVG, decisions and orders are issued by resolution unless a judgment must be rendered. Pursuant to Section 28(2) of the VwGVG, the Administrative Court must decide on complaints pursuant to Art. 130(1)(1) of the Federal Constitutional Act (B-VG), the Administrative Court must make a decision on the merits of the case itself if the relevant facts are established or if the determination of the relevant facts by the Administrative Court itself is in the interest of expediency or results in significant cost savings. Pursuant to Section 28(2) of the VwGVG, the Administrative Court must rule on its own on complaints pursuant to Article 130, paragraph one, subparagraph 1 of the Federal Constitutional Law (B-VG), the Administrative Court must make the decision itself if the relevant facts are established or if the Administrative Court’s own determination of the relevant facts is in the interest of expediency or results in significant cost savings. ### ¶58 In the present case, the Federal Administrative Court must rule on a complaint against a decision by the Data Protection Authority—which was originally the competent supervisory authority—regarding data processing by the Court of Auditors. Pursuant to § 69(10) of the Data Protection Act (DSG), the Parliamentary Data Protection Committee shall replace the Data Protection Authority in proceedings pending before the Federal Administrative Court, the Administrative Court, or the Constitutional Court concerning processing activities under para 35a(1) of the Data Protection Act (DSG) as of December 31, 2024.In the present case, the Federal Administrative Court must rule on a complaint against a decision by the Data Protection Authority—as the originally competent supervisory authority—regarding data processing by the Court of Auditors. Pursuant to Section 69, paragraph 10, of the DSG, the Parliamentary Data Protection Committee shall replace the Data Protection Authority in proceedings pending before the Federal Administrative Court, the Administrative Court, or the Constitutional Court as of December 31, 2024, concerning processing activities pursuant to paragraph 35a(1) of the DSG. > Topics: Supervisory Authorities, Supervision, Processing ### ¶59 It follows, therefore, that the Federal Administrative Court must rule on complaints against decisions of the Data Protection Authority—regardless of the status of the Parliamentary Data Protection Committee as a party to the proceedings—as a panel composed in accordance with Section 27( 2 of the DSG, with two lay judges with expertise drawn from the ranks of employers and employees, making a decision. It follows, therefore, that the Federal Administrative Court must rule on complaints against decisions of the Data Protection Authority—regardless of the status of the Parliamentary Data Protection Committee as a party—as a senate composed in accordance with Section 27, paragraph 2, of the DSG, with two expert lay judges drawn from the ranks of employers and employees in making the decision. III. Constitutional Concerns: Roman numeral three. Constitutional Concerns: 1. In the present case, the Data Protection Authority, in the contested decision, dismissed the complainant’s data protection complaint regarding an alleged violation under § 1 DSG because, on the basis of § 6 para. 3 of the Political Parties Act (PartG) of 2012, it recognized a qualified legal basis for the publication of the data in question. 1. > Topics: Supervisory Authorities ### ¶60 In the present case, the Data Protection Authority, in the contested decision, dismissed the complainant’s data protection complaint regarding an alleged violation under Paragraph 1, DSG because it recognized a valid legal basis for the publication of the data in question pursuant to paragraph 6(3) of the PartG 2012. 2. The Federal Administrative Court has serious concerns regarding the constitutionality of Section 6(3) of the PartG 2012. 2. The Federal Administrative Court has serious concerns regarding the constitutionality of Section 6(3) of the PartG 2012. In detail: 2.1. The Federal Administrative Court’s primary concern is that, within the scope of application of Section 6, para 2 and para 3, of the PartG 2012, there is an unconstitutional interference with the fundamental right to data protection under Section 1 of the DSG, by establishing an obligation to publish special categories of personal data that is not proportionate to the purpose of the law. 2.1. > Topics: Personal Data, Supervisory Authorities ### ¶61 The Federal Administrative Court has primary concerns that, within the scope of application of Section 6, paragraphs 2 and 3, of the PartG 2012, there is an unconstitutional infringement of the fundamental right to data protection under Section 1, DSG by codifying an obligation to publish special categories of personal data that is not proportionate to the purpose of the law. 2.2. Furthermore, in this context, the Federal Administrative Court assumes that Art. 8 of the CFR and, in connection therewith, Article 8 of the European Convention on Human Rights (ECHR) have been violated; these provisions—as will be discussed in more detail—inherently provide a level of fundamental rights protection similar to that of § 1 of the DSG. 2.2. Furthermore, the Federal Administrative Court assumes in this context that article 8 of the GRC—which is also enshrined in fundamental and constitutional law—and, in connection with this, article 8 of the ECHR have been violated; these articles—as will be discussed in more detail later—inherently provide a level of fundamental rights protection similar to that of Section 1 of the DSG. > Topics: Personal Data, Authority Powers for Fundamental Rights Protection · Applies: gdpr-art-8-en ### ¶62 CFR—which are also enshrined in fundamental and constitutional law—and, in connection therewith, article 8 of the ECHR have been violated; these provisions—as will be discussed in more detail below—inherently provide a level of fundamental rights protection similar to that of Section 1 of the DSG. 2.3. Ultimately, the Federal Administrative Court assumes that, should the Constitutional Court not share the aforementioned concerns, there is also a violation of the constitutional principle of equal treatment. Re 2.1. and 2.2.: The following is stated in the scholarly literature regarding Section 6 of the PartG 2012: The following is stated in the scholarly literature regarding Section 6 of the PartG 2012: Since the original version took effect, the provisions of Section 6 of the PartG 2012 have received the most public attention (apart from the accountability requirements under Section 5), and the differences between the PartG 2012 and the PartG 1975—which was in effect until June 30, 2012—are best illustrated by the rules governing donations: Although the PartG 1975 stipulated that political parties had to append donations exceeding 7,260 euros to their financial reports in a separate list, it also provided that the President of the Court of Auditors was required to keep the donation notifications submitted to him by political parties confidential. > Topics: Accountability, Authority Powers for Fundamental Rights Protection ### ¶63 Neither oversight nor public disclosure was provided for, with one exception: if a political party, on its own initiative, requested the President of the Court of Auditors to disclose the donor of a reported donation. However, this scenario has never occurred. These provisions of the 1975 Political Parties Act (PartG), which in no way correspond to the goal of transparency in “private party financing (donation transparency),” have repeatedly been the focus of public attention, and the GRECO evaluation report has also heavily criticized these provisions (see Chapter VII). Eisner/Kogler/Ulrich, Law of Political Parties³ § 6 PartG Marginal Note 1 (as of Jan. 17, 2023, rdb.at)Since the original version of the PartG 2012 came into force, the provisions of Section 6 have received the most public attention (apart from the accountability requirements under Section 5), and the differences between the PartG 2012 and the PartG 1975—which was in effect until June 30, 2012—are best illustrated by the regulations governing donations: Although the PartG 1975 stipulated that political parties had to append donations exceeding 7,260 euros to their financial reports in a separate list, it also provided that the President of the Court of Auditors was required to keep the donation notifications submitted to him by political parties confidential. > Topics: Transparency, Accountability ### ¶64 Neither oversight nor public disclosure was provided for, with one exception: if a political party, on its own initiative, requested the President of the Court of Auditors to disclose the donor of a reported donation. However, this scenario has never occurred. These provisions of the 1975 PartG, which in no way corresponded to the principle of transparency in “private party financing (donation transparency)” in no way, were repeatedly the focus of public attention, and the GRECO evaluation report also heavily criticized these provisions (see Roman Chapter seven)., Eisner/Kogler/Ulrich, Law of Political Parties, Vol. 3, Section 6, PartG Marginal Note 1 (as of Jan. 17, 2023, rdb.at) Both the 2012 revision of the PartG and the current system of criminal law on corruption were negotiated jointly as part of the “Transparency Package” and adopted by the National Council. Although the old version of the PartG, which was repealed by Federal Law Gazette I 2012/56, implicitly assumed that political party donations were permissible by establishing rules for their disclosure, there was no explicit permission to accept such contributions comparable to the current § 6(1) of the PartG. > Topics: Transparency ### ¶65 Conversely, the criminal law on corruption, as it stood prior to the 2012 Anti-Corruption Amendment Act (KorrStrÄG), did not contain any provision corresponding to the currently applicable § 305(4)(1), case 1, of the Criminal Code (StGB). Given that these two legislative amendments were adopted simultaneously and that there was no other necessity for including an explicit authorization to accept party donations, there are good reasons to view § 6(1) of the Political Parties Act (PartG) as a provision granting permission within the meaning of § 305(4)(1), case 1, of the Criminal Code (StGB). Further evidence supporting this conclusion can be found in the legislative materials accompanying the revision of the PartG, as one of the legislature’s objectives in amending the law was to create legal certainty regarding the permissibility of donations to political parties. Considering the direct temporal connection to the tightening of criminal law on corruption, the goal of increasing legal certainty could, at least in part, also refer to the KorrStrÄG 2012 (Christopher Kahl/Alexander Stücklberger, “On the Permissibility of Political Party Donations from the Perspective of Criminal Corruption Law,” ZWF 2020, 58).Both the 2012 revision of the Political Parties Act (PartG) and the current system of criminal law on corruption were negotiated together as part of the “Transparency Package” and adopted by the National Council. > Topics: Transparency, Access Controls ### ¶66 Although the old version of the PartG, which was repealed by Federal Law Gazette (BGBl) Roman I 2012/56, implicitly assumed that political party donations were permissible by establishing rules for their disclosure, there was no explicit permission to accept such contributions comparable to the current Section 6, paragraph 1, of the PartG. Conversely, the criminal law on corruption, in the version prior to the KorrStrÄG 2012, also contained no provision corresponding to the currently applicable Section 305, paragraph 4, subparagraph 1, case 1 of the StGB. Given that these two legislative amendments were adopted simultaneously and that there was no other need to include an explicit authorization to accept party donations, there are good reasons to view Section 6, paragraph 1, of the Political Parties Act (PartG) as a provision granting permission within the meaning of paragraph 305(4)(1)(i) of the German Criminal Code (StGB). > Topics: Access Controls ### ¶67 Further evidence supporting this conclusion can be found in the legislative materials accompanying the revision of the PartG, as one of the legislature’s objectives in amending the law was to create legal certainty regarding the permissibility of donations to political parties. Considering the direct temporal connection to the tightening of criminal law on corruption, the goal of increasing legal certainty could, at least in part, also refer to the KorrStrÄG 2012 (Christopher Kahl/Alexander Stücklberger, “On the Permissibility of Political Party Donations from the Perspective of Criminal Corruption Law,” ZWF 2020, 58). Overall, the legislature does not view political party donations as anything “improper” or even illegal, but rather as an important element of the dual financing system for political parties and expects them to be raised. It would be unrealistic to assume that, while the legislature explicitly permits political party donations in para 6(1) of the Political Parties Act (PartG) of 2012—and thereby declares them a component of political parties’ budgets—it nevertheless subjects the acceptance of such donations by a public official to criminal penalties on a large scale. ### ¶68 Christopher Kahl/Alexander Stücklberger, “On the Permissibility of Political Party Donations from the Perspective of Corruption Law,” ZWF 2020, 58. Overall, the legislature does not view political party donations as anything “improper” or even prohibited, but rather as an important element of the dual financing system for political parties and anticipates that they will be raised. It would be unrealistic to assume that, while the legislature explicitly permits political party donations in Section 6, paragraph 1, of the Political Parties Act (PartG) of 2012—and thereby declares them a component of political parties’ budgets—it nevertheless subjects the acceptance of such donations by a public official on a large scale to criminal penalties. , Christopher Kahl/Alexander Stücklberger, “On the Permissibility of Political Party Donations from the Perspective of Corruption Criminal Law,” ZWF 2020, 58 From the legislative materials: From the explanatory memorandum of Committee Report 1637 BlgNR, 27th Parliamentary Session on Motions 2487/A, 34/A and Am. 34/A, 35/A and Am. 35/A, and 454/A regarding Federal Law Gazette I No. 125/2022, in which the original version of Federal Law Gazette I No. 56/2012 was last amended. ### ¶69 From the explanatory memorandum to Committee Report 1637 BlgNR, 27th legislative period, regarding motions 2487/A, 34/A and To 34/A, 35/A and To 35/A, and 454/A pertaining to the Federal Law Gazette, Part One, No. 125 of 2022, in which the original version of the Federal Law Gazette, Part One, No. 56 of 2012, was last amended Regarding Items 14 through 20 (Section 6): Regarding Items 14 through 20 (Section 6): “Section 6(2): A uniform system of year-round revenue transparency that is easily accessible to everyone shall be established. In the future, all donations received by a political party—including those from its affiliates as defined in para 1—will be reported to the Court of Auditors on a quarterly basis. The Court of Auditors must then separately publish all donations reported to it that exceed €500, including the name of the respective donor, the date, and the recipient of the donation. > Topics: Transparency, Recipient ### ¶70 To this end, the Court of Auditors must maintain a donation list for each party on its website and update it quarterly with the donations reported by the parties. This will allow the public to review all donation activities centrally on the Court of Auditors’ website. Within the donation lists for each party, the Court of Auditors must, in turn, categorize the donations by recipient so that the interested public can obtain an overview of the donation activities—for example, of an affiliated organization—even during the course of the year.“Section 6, paragraph 2: A uniform system of year-round revenue transparency that is easily accessible to everyone shall be established. Thus, in the future, all donations received by a political party—including those from its affiliated organizations as described in paragraph 1—shall be reported to the Court of Auditors on a quarterly basis. The Court of Auditors must then separately publish all donations reported to it that exceed €500, including the name of the respective donor, the date, and the recipient of the donation. > Topics: Recipient, Transparency ### ¶71 To this end, the Court of Auditors must maintain a donation list for each party on its website and update it quarterly with the donations reported by the parties. This will allow the public to review all donation activities centrally on the Court of Auditors’ website. Within the donation lists for each party, the Court of Auditors must, in turn, categorize the donations by recipient so that the interested public can obtain an overview of the donation activities—for example, of an affiliated organization—even during the course of the year. Parties are granted a four-week deadline to report donations received during a quarter. This should give parties sufficient time to gather the relevant information within their organizations, which can be somewhat time-consuming, particularly for parties with a highly decentralized structure or a widely ramified network. The names of all donors must be disclosed to the Court of Auditors. > Topics: Recipient ### ¶72 This system of comprehensive, year-round central recording of donation receipts by the Court of Auditors eliminates the previously existing reporting requirements for donations, such as, in particular, the ad hoc reporting of donations exceeding €2,500 previously provided for in para 5 (old version).“ Parties are granted a four-week deadline to report donations received during a quarter. This should give parties sufficient time to gather the relevant information within their organizations, which entails a certain amount of effort, particularly for parties with a highly decentralized structure or a widely dispersed network. The names of all donors must be disclosed to the Court of Auditors. This system of comprehensive, year-round central recording of donation receipts by the Court of Auditors eliminates the previously existing reporting obligations for donations, such as, in particular, the ad hoc reporting of donations exceeding €2,500 previously required under paragraph 5 of the previous version.” > Topics: Notified Body Reporting and Notification Obligations ### ¶73 As is already evident from the cited statutory provisions, § 6 of the PartG 2012 is located in Section 3, “accountability,” leg. cit. As is already evident from the cited statutory provisions, Section 6 of the PartG 2012 is located in Section 3, “accountability,” of the cited law. Regarding the Relationship to Section 1 of the DSG Regarding the relationship to Section 1 of the DSG A limitation on the right to confidentiality under Section 1 of the DSG generally arises from the second paragraph of the cited provision. cit.; however, the GDPR and, in particular, the principles enshrined therein (in Art. 5 GDPR) must in any case be taken into account when interpreting the right to confidentiality (see Thiele/Wagner, Practical Commentary on the Data Protection Act [DSG]² § 1, margin note 39 [as of Feb. 1, 2022, rdb.at]; see also § 4(1) DSG). A limitation on the right to confidentiality under Paragraph 1 of the DSG generally arises from the second paragraph of the cited provision. > Topics: Accountability · Applies: gdpr-art-5-en ### ¶74 However, the GDPR—and in particular the principles enshrined therein (in article 5 of the GDPR)—must in any case be taken into account when interpreting the right to confidentiality; see Thiele/Wagner, Practical Commentary on the Data Protection Act [DSG]² Section 1, margin note 39 [as of Feb. 1, 2022, rdb.at]; see also paragraph 4 of the DSG). The requirements for the lawfulness of data processing are specified in Article 6 of the GDPR. Accordingly, the lawfulness of any processing requires that the processing—in addition to the other principles set forth in Article 5(1)—must satisfy at least one of the legal grounds exhaustively listed in Article 6(1) of the GDPR (see Selmayr in Ehmann/Selmayr, General Data Protection Regulation, Commentary², Art. 5, margin note 8f). The requirements for the lawfulness of data processing are specified in article 6 of the GDPR. Accordingly, the lawfulness of any processing requires that the processing—in addition to the other principles set forth in Article 5(1)—must satisfy at least one of the legal grounds exhaustively listed in Article 6(1) exhaustively listed in Article 6(1) of the GDPR (see Selmayr in Ehmann/Selmayr, General Data Protection Regulation, Commentary², Article 5, margin note 8f). > Applies: gdpr-art-5-par-1-en, gdpr-art-6-par-1-en, gdpr-art-5-en, gdpr-art-6-en ### ¶75 Pursuant to Art. 6(1)(c) of the GDPR, the processing of data is lawful, among other things, if the processing is necessary for compliance with a legal obligation to which the controller is subject. Pursuant to Article 6(1)(e) of the GDPR, this is also the case if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Thus, it (continues to) apply that the use of data in accordance with procedural laws is also permissible from a data protection perspective (see OHG, Nov. 27, 2019, 6Nc30/19t; see also Jahnel, Commentary on the General Data Protection Regulation, margin note 61 on Art. 6 GDPR [as of Dec. 1, 2020, rdb.at]).According to article 6(1)(c) of the GDPR, the processing of data is lawful, among other things, if the processing is necessary for compliance with a legal obligation to which the controller is subject. > Topics: Controllers · Applies: gdpr-art-6-par-1-pnt-c-en, gdpr-art-6-par-1-pnt-e-en, gdpr-art-6-en ### ¶76 According to article 6(1)(e) of the GDPR, this is also the case if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Thus, it (continues to) apply that the use of data in accordance with procedural laws is also permissible from a data protection perspective; see OHG, Nov. 27, 2019, 6Nc30/19t; see also Jahnel, Commentary on the General Data Protection Regulation, margin note 61 on article 6, GDPR [as of Dec. 1, 2020, rdb.at]). An official interference with the fundamental right to data protection under § 1 DSG—as must be assessed in the present case—on the grounds of overriding legitimate public interests is permitted only if it is sufficiently defined by statutory provisions. Furthermore, any interference that is permissible in and of itself must also be proportionate, and thus comply with the principle of the least intrusive means under para 1, last sentence, of the Data Protection Act (DSG). > Topics: Controllers · Applies: gdpr-art-6-par-1-pnt-e-en, gdpr-art-6-en ### ¶77 Restrictions on the fundamental right to data protection, pursuant to the statutory reservation in § 1(2) of the Data Protection Act (DSG), are permissible in the case of interventions by a state authority only on the basis of laws that are necessary for the reasons specified in Art. 8(2) of the European Convention on Human Rights (ECHR) and that are sufficiently precise, that is, provide rules that are foreseeable to everyone regarding the conditions under which the collection or use of personal data is permitted for the performance of specific administrative tasks. The legislature must therefore, in accordance with the provisions of § 1 para 2 of the Data Protection Act (DSG), establish a subject-specific regulation that specifies and limits the cases in which interference with the fundamental right to data protection is permissible (Constitutional Court, June 23, 2014, G 90/2013 [Identification Procedures]). > Topics: Personal Data, Identification ### ¶78 The principle of limited interference under Section 1(2) of the Data Protection Act (DSG) is therefore based on the requirement that the legislature, in the relevant substantive legislation, must define and specify the conditions and limits of permissible interferences with the right to data protection by controllers, and —while at the same time providing for appropriate safeguards to protect the data subjects’ interests in confidentiality— (Administrative Court, Dec. 10, 2018, Ra 2018/12/0060 [Unredacted Medical Certificates]; see also VwGH Nov. 14, 2013, 2012/17/0048 [Disclosure of Customer Data to the FMA]; Constitutional Court (VfGH) Dec. 9, 2008, B 1944/07 [Section Control II]; see Thiele/Wagner, Practical Commentary on the Data Protection Act [DSG] § 1, Marg. No. 55; 77).An official interference with the fundamental right to data protection under Section 1 of the DSG—as must be assessed in the present case—on the grounds of overriding legitimate public interests is permitted only if it is sufficiently defined by statutory provisions. > Topics: Personal Data, Controllers ### ¶79 Furthermore, any interference that is permissible in and of itself must also be proportionate, and thus comply with the principle of the least intrusive means under Section 1, paragraph 2, last sentence, of the DSG. Restrictions on the fundamental right to data protection are, pursuant to the statutory reservation in Section 1, paragraph 2, of the DSG, permissible in the case of interventions by a state authority only on the basis of laws that are necessary for the reasons set forth in Article 8, paragraph 2, ECHR and which regulate with sufficient precision—that is, in a manner foreseeable to everyone—the conditions under which the collection or use of personal data is permitted for the performance of specific administrative tasks. The legislature must therefore, in accordance with the provisions of Section 1(2) of the DSG, provide for a subject-matter-specific regulation in the sense that the cases of permissible interference with the fundamental right to data protection are specified and limited (Constitutional Court, June 23, 2014, G 90 of 2013, [Identification Procedures]). > Topics: Personal Data, Identification ### ¶80 The principle of limited interference under Section 1, paragraph 2, of the Data Protection Act (DSG) therefore requires that the legislature, in the relevant substantive legislation, define and specify the conditions and limits of permissible interference with the right to data protection by controllers, and —while at the same time providing for appropriate safeguards to protect the data subjects’ interests in confidentiality— (VwGH Dec. 10, 2018, Ra 2018/12/0060 [Unredacted Medical Certificates]; see also VwGH Nov. 14, 2013, 2012/17/0048 [Disclosure of Customer Data to the FMA]; Constitutional Court (VfGH) Dec. 9, 2008, B 1944/07 [Section Control II]; see also Thiele/Wagner, Practical Commentary on the Data Protection Act [DSG], Section 1, Marginal No. 55; 77). It also follows from the second sentence of Recital 41 of the GDPR that a corresponding legal basis must be clear and precise, and its application should be foreseeable for the data subject in accordance with the case law of the European Court of Human Rights (see Jahnel, Commentary on the General Data Protection Regulation, Art. 6 GDPR).It also follows from the second sentence of Recital 41 of the GDPR that a corresponding legal basis must be clear and precise, and its application should be foreseeable for the data subject in accordance with the case law of the ECtHR; see Jahnel, Commentary on the General Data Protection Regulation, article 6, GDPR). > Topics: Personal Data, Controllers · Applies: gdpr-art-6-en ### ¶81 Regarding Article 8 of the EU CFR: Regarding Article 8 of the EU CFR: In Case 1 BvR 16/13 of November 6, 2019, the German Federal Constitutional Court ruled that the CFR does not establish comprehensive protection of fundamental rights for the European Union, but rather follows the principle of limited application in the sense of federal diversity. Accordingly, national protection of fundamental rights remains in place even where Union fundamental rights exist and national fundamental rights—while they must be invoked to implement Union (primary) law—are subject to a substantive framework that limits their scope. In this case, the European fundamental rights provisions supplement the national ones. The Constitutional Court also argued along these lines in its decision of March 14, 2012, U466/11 VfSlg. 19632, stating that, under the principle of equivalence, provisions of ordinary law must be reviewed against the standard of directly applicable primary law, such as the CFR. > Applies: gdpr-art-8-en ### ¶82 At the same time, therefore (which is also relevant here), there is no obligation to refer the matter to the Court of Justice if the protection of fundamental rights is equivalent to that provided by the CFR. It remains to be noted that, in any event, it cannot be inferred from the cited case law for the present case that, based on considerations of primary law—particularly with regard to the primacy of the diversity of fundamental rights—which may only be restricted if there are concrete indications to that effect, § 1(1) of the DSG, as a separate national fundamental right with constitutional status, must be interpreted to mean that its scope of application cannot extend beyond that of Article 16(1) of the TFEU and Article 8(1) of the EU CFR. The GDPR made use of the authority to enact data protection regulations at the level of secondary law, as provided for in Article 16(2) TFEU, and the GDPR also explicitly takes into account the protection of other (various) fundamental rights and freedoms (and reference is also made to this, for example (see Recital 4 of the GDPR; see also Lachmayer in Knyrim, DatKomm Art. 1 GDPR, para. 38, and Ernst in Paal/Pauly, General Data Protection Regulation, on Art. 1, para. 1)). > Applies: gdpr-art-1-en ### ¶83 Accordingly, a higher level of protection for fundamental rights, such as that provided under § 1(1) of the DSG, as compared to Art. 8(1) of the CFR, as a result of a stricter statutory reservation in terms of content, even if it does not conflict with the principles of fundamental freedoms or the concept of a uniform level of protection (see also Recital 19 of the GDPR).In Case 1 BvR 16/13 of November 6, 2019, the German Federal Constitutional Court held that the CFR does not establish comprehensive protection of fundamental rights for the European Union, but rather follows the principle of limited application in the sense of federal diversity. Accordingly, national protection of fundamental rights remains in place even where Union fundamental rights exist and national fundamental rights—while to be invoked for the implementation of (primary) Union law—are subject to a substantive framework that sets limits on their scope. ### ¶84 In this case, the European provisions on fundamental rights supplement the national ones. The Constitutional Court also argued along these lines in its decision of March 14, 2012, U466/11 VfSlg. 19632, stating that, under the principle of equivalence, provisions of ordinary law must be reviewed against the standard of directly applicable primary law, such as the CFR. At the same time, therefore (which is also relevant here), there is no obligation to refer the matter to the Court of Justice if the protection of fundamental rights is equivalent to that provided by the CFR. It remains to be noted that, in any event, it cannot be inferred from the cited case law for the present case that, based on considerations of primary law—particularly with regard to the primacy of the diversity of fundamental rights, which may be restricted only if there are concrete indications to that effect— Section 1, Paragraph 1, of the DSG, as a separate national fundamental right of constitutional rank, must be interpreted to mean that its scope of application cannot extend beyond Article 16, Paragraph 1, of the TFEU and Article 8, Paragraph 1, of the EU CFR. ### ¶85 The GDPR made use of the authority to enact data protection regulations at the level of secondary law, as established under article 16, paragraph 2, TFEU, and the GDPR also explicitly takes into account the protection of other (various) fundamental rights and freedoms (and reference is also made to this, for example; see Recital 4 of the GDPR; see also Lachmayer in Knyrim, DatKomm, article 1, GDPR, para. 38, as well as Ernst in Paal/Pauly, General Data Protection Regulation, on article 1, margin note 1)). Accordingly, a higher level of protection for fundamental rights, such as that provided under Section 1, Paragraph 1, of the DSG compared to Article 8, paragraph 1, of the EU CFR, as a result of a stricter statutory reservation in terms of content, is permissible even if it does not conflict with the principles of fundamental freedoms or the concept of a uniform level of protection—see also Recital 19 of the GDPR). > Applies: gdpr-art-1-en ### ¶86 In the decision of the Constitutional Court (VfSlg 19.632/2012), it was already established that, based on the principle of equivalence, the rights guaranteed by the CFR may also be asserted before the Constitutional Court as constitutionally guaranteed rights pursuant to Art. 144 of the Federal Constitutional Law (B-VG), and that, within the scope of application of the CFR, they constitute a standard of review in proceedings for the general review of norms, particularly pursuant to Art. 139 and Art. 140 of the Federal Constitutional Law (B-VG). This applies when the relevant guarantee in the CFR, in its wording and specificity, is equivalent to rights guaranteed by the Constitution. The objectives of intervention under Article 52(1) of the CFR—specifically, “objectives recognized by the Union as serving the common good”—permit more far-reaching interventions under Article 8 of the CFR than those exhaustively listed in Article 8(2) of the ECHR (to which para 1(2) of the DSG explicitly refers with regard to state interference), although this divergence will, in practice, lead to virtually no significant differences in the admissibility of interference, given the same standard of review (proportionality). > Applies: gdpr-art-52-par-1-en, gdpr-art-8-en ### ¶87 In light of these considerations, it is assumed that Article 8 of the CFR “does not provide a level of protection that goes beyond the constitutional provision of Section 1 of the Data Protection Act (DSG),” although the scopes of application of the two fundamental rights provisions are nevertheless not (entirely) identical. Given the comparability between § 1 DSG and Art. 8 CFR—which exists despite the differences when viewed in their overall context—this provision can in any case be invoked as a fundamental right before the Constitutional Court (Riesz in Holoubek/Lienbacher, CFR Commentary 2, Art. 8 (as of April 1, 2019, rdb.at)). In the Constitutional Court’s decision VfSlg 19.632 from 2012, it was already established that, based on the principle of equivalence, the rights guaranteed by the CFR may also be invoked before the Constitutional Court as constitutionally guaranteed rights pursuant to article 144, B-VG, and that, within the scope of application of the CFR, they constitute a standard of review in proceedings for the general review of norms, particularly pursuant to articles 139 and 140 of the B-VG. > Applies: gdpr-art-8-en ### ¶88 This applies when the relevant guarantee in the CFR is equivalent in its wording and specificity to rights guaranteed by the Constitution. The objectives of the restrictions under article 52, paragraph 1, CFR—specifically, “objectives recognized by the Union as serving the common good”—allow for more extensive interventions under Article 8 of the CFR than those exhaustively listed in Article 8, paragraph 2, of the ECHR (to which Paragraph 1, subparagraph 2, DSG explicitly refers to with regard to state interference), although this divergence will, in light of the same limit test (proportionality), lead to virtually no significant differences in the admissibility of interference in practice. In light of these considerations, it is assumed that article 8 of the CFR “does not provide a level of protection that goes beyond the constitutional provision of Section 1 of the DSG,” although the scopes of application of the two fundamental rights provisions are nevertheless not (entirely) identical. > Applies: gdpr-art-8-en, gdpr-art-52-en ### ¶89 In light of the fact that, despite existing differences, Paragraph 1 of the DSG and Article 8 of the CFR are nevertheless comparable in the overall context, this provision can in any case be invoked as a fundamental right before the Constitutional Court (Riesz in Holoubek/Lienbacher, CFR Commentary 2, Article 8, (as of April 1, 2019, rdb.at)). Similarly, the ECtHR has recognized the need to protect personal data by consistently ruling that the processing, transmission, and storage of such data as an interference with the right to privacy protected by Article 8(1) of the ECHR (in particular, the general right to personal integrity). Article 8 of the CFR builds upon the existing comprehensive safeguards of Article 8(1) of the ECHR and enshrines the protection of personal data as a distinct fundamental right. Indirectly, however, incorporation in the area of data protection takes place through the explicit reference to Article 8 of the ECHR in the explanatory notes to Article 8 of the CFR, which, pursuant to Article 52(7) of the CFR in conjunction with Article 6(1), third subparagraph, of the TEU must be taken into account in its interpretation, which demonstrates the close link—also underscored by primary law—between the two systems. > Topics: Personal Data · Applies: gdpr-art-8-en, gdpr-art-52-en ### ¶90 This is also confirmed by the alignment of the case law of the CJEU with that of the ECtHR (see again Riesz in Holoubek/Lienbacher, CFR Commentary 2, Art. 8 (as of April 1, 2019, rdb.at)). Similarly, the ECtHR has recognized the need for protection of personal data by consistently characterizing the processing, transfers, and storage of such data as an interference with the right to privacy protected by article 8, paragraph 1, ECHR (in particular the general right of privacy). Article 8 of the CFR builds upon the existing comprehensive safeguards of Article 8, paragraph 1, of the ECHR and enshrines the protection of personal data as a distinct fundamental right. Indirectly, however, incorporation in the area of data protection takes place through the explicit reference to Article 8 of the ECHR in the explanatory notes to Article 8 of the CFR, which, pursuant to Article 52(7) of the CFR in conjunction with Article 6(1), third subparagraph, of the TEU, must be taken into account in the interpretation of the CFR; this demonstrates the close link—also underscored by primary law—between the two systems. > Topics: Personal Data · Applies: gdpr-art-8-en, gdpr-art-52-en ### ¶91 This is also confirmed by the alignment of the case law of the CJEU with that of the ECtHR (see again Riesz in Holoubek/Lienbacher, CFR Commentary 2, article 8, (as of April 1, 2019, rdb.at). It further follows from the case law of the CJEU that, under the law of the Member States to which the controller is subject, the relevant legal basis for processing must pursue an objective in the public interest and be proportionate to the legitimate purpose pursued. Since these requirements stem from the provisions set forth in Article 52(1) of the Charter, they must be interpreted in light of that provision. (CJEU, August 1, 2022, Case OT, C-184/20, para. 69 et seq.)It further follows from the case law of the CJEU that, where processing is based on the law of the Member States to which the controller is subject, the relevant legal basis must pursue an objective in the public interest and be proportionate to the legitimate purpose pursued. > Topics: Controllers · Applies: gdpr-art-8-en ### ¶92 Since these requirements stem from the provisions set forth in article 52, paragraph 1, of the Charter, they must be interpreted in light of that provision. (CJEU, August 1, 2022, Case C-184/20, para. 69 et seq.) It follows from the legislative history and relevant scholarship that the purpose of the provision in § 6(3) of the Political Parties Act (PartG) 2012 concerning the publication of the names and addresses of party donors:on the one hand, to achieve accountability for political parties subject to the PartG 2012, and on the other hand, to promote transparency by informing the broadest possible public about party financing.It follows from the legislative materials and relevant literature that the purpose of the provision in paragraph 6(3) of the PartG 2012 concerning the publication of the names and addresses of party donors:serves, on the one hand, the purpose of ensuring accountability for political parties subject to the PartG 2012 and, on the other hand, the purpose of transparency to inform the broadest possible public about the financing of political parties. > Topics: Transparency, Accountability ### ¶93 Regarding the question of whether special categories of data are processed: Personal data that, by its nature, is particularly sensitive with regard to fundamental rights and freedoms deserves special protection because its processing may pose significant risks to fundamental rights and freedoms (see also Article 29 Working Party, Advice Paper on Special Categories of Data [2011] 4). Thus, legal scholarship—in addition to the highly personal or identity-defining nature of the range of information covered by Article 9(1) of the GDPR— —that the categories of data protected under para 1 pose a high potential for harm and discrimination, which is repeatedly realized (see Frenzel in Paal/Pauly, GDPR-BDSG3 Art. 9 GDPR, para. 6 with further references; furthermore, Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm, Art. 9 GDPR, margin note 3; Albers/Veit, BeckOK DatenschutzR, Art. 9 GDPR, margin note 17 et seq.).Personal data that, by its very nature, is particularly sensitive with regard to fundamental rights and freedoms deserves special protection because their processing can give rise to significant risks to fundamental rights and freedoms (in this sense, see also the Article 29 Working Party, “Advice paper on special categories of data” [2011] 4). > Topics: Personal Data · Applies: gdpr-art-9-par-1-en, gdpr-art-9-en ### ¶94 Thus, legal scholarship—in addition to emphasizing the highly personal or identity-defining nature of the spectrum of information covered by Article 9(1) GDPR—it is emphasized that the categories of data protected under paragraph 1 pose a high potential for harm and discrimination, which is repeatedly realized; see Frenzel in Paal/Pauly, GDPR-BDSG3 article 9, GDPR, Marg. Note 6 with further references; see also Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm, article 9, GDPR, Marg. Note 3; Albers/Veit, BeckOK DatenschutzR, article 9, GDPR, Marg. Note 17 et seq.). However, if Art 9 of the GDPR is intended, in particular, to protect data subjects from being exposed to the risk of particularly serious discrimination as a result of data processing, then it seems necessary to include within the scope of protection of Article 9(1) of the GDPR not only data revealing the data subject’s actual political views, but also, and in particular, data regarding the individual’s presumed political preferences, since the processing of such data likewise entails the risk of particularly negative consequences for the data subject. > Topics: Personal Data, Political Opinions · Applies: gdpr-art-9-par-1-en, gdpr-art-9-en ### ¶95 (Administrative Court, December 14, 2021, Case No. Ro 2021/04/0007) However, if Article 9 of the GDPR is intended, in particular, to protect data subjects from being exposed to the risk of particularly serious discrimination as a result of data processing, then it seems necessary to include within the scope of protection of Article 9(1) of the GDPR that reveal the data subject’s actual political views, but also data regarding the individual’s presumed political preferences, since the processing of such data likewise entails the risk of particularly adverse consequences for the data subject. (Administrative Court, December 14, 2021, Case No. Ro 2021/04/0007) For data to constitute a special category pursuant to Article 9(1) of the GDPR, it is sufficient if, with respect to the categories of data of racial or ethnic origin, political opinions, religious or philosophical beliefs, and trade union membership, the sensitive information is only indirectly inferred. > Topics: Personal Data, Political Opinions · Applies: gdpr-art-9-par-1-en, gdpr-art-9-en ### ¶96 Thus, even indirect references to these characteristics are subject to special protection, provided that they are recognizable to an average, objective third party (see Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Art. 9 GDPR, para. 19 et seq.)It is sufficient for data to constitute a special category pursuant to Article 9(1) of the GDPR if, with respect to the categories of data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, and trade union membership, the sensitive information is only indirectly inferred. Thus, even indirect references to these characteristics are subject to special protection, provided that they are recognizable to an average, objective third party (see Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm article 9, GDPR, para. 19 et seq.). Depending on the amount, a donation to a political party may also indicate an affinity for that party or the likelihood that the person will vote for that party —it can therefore be assumed that the political opinion of the person who made the donation can also be inferred from the donation to a political party. > Topics: Types of Special Categories of Personal Data, Political Opinions · Applies: gdpr-art-9-par-1-en, gdpr-art-9-en ### ¶97 This was also affirmed in recent case law of the CJEU in a similar case, where the existence of Article 9 GDPR data was already affirmed in the case of the purchase of medications that allow inferences to be drawn about the health status of an identified or identifiable person, (CJEU, Oct. 4, 2024, C-21/23, Lindenapotheke) —which is comparable to the present case in that conclusions regarding the complainant’s political views can be drawn from knowledge of the fact of the donation, the amount of the donation, and the beneficiary party. Depending on the amount, a donation to a political party may also indicate an affinity for that party or the likelihood that the person will vote for that party – it must therefore be assumed that the political opinion of the person who made the donation can also be inferred from the donation to a political party. This was also affirmed in recent case law of the CJEU in a similar case, where the applicability of article 9, GDPR data was already affirmed in the case of the purchase of medications that allow inferences to be drawn about the health status of an identified or identifiable person (CJEU, Oct. 4, 2024, C-21/23, Lindenapotheke) —which is comparable to the present case in that conclusions regarding the complainant’s political opinion can be drawn from knowledge of the fact of the donation, the amount of the donation, and the beneficiary party. > Topics: Types of Special Categories of Personal Data, Political Opinions, Identification · Applies: gdpr-art-9-en ### ¶98 Consequently, it must be assumed that the processed data also constitutes special categories of data pursuant to Article 9(1) of the GDPR. Consequently, it must be assumed that the processed data also constitutes special categories of data pursuant to Article 9, paragraph 1, of the GDPR. Regarding the requirements for the legal basis: Regarding the legitimate purpose: Article 6(3) of the GDPR clarifies, with respect to the lawfulness of data processing, that the processing must be based on Union law or the law of the Member States to which the controller is subject, and that the legal basis in question must pursue an objective in the public interest and be proportionate to the legitimate purpose pursued. Since these requirements stem from the provisions set forth in Article 52(1) of the Charter, they must be interpreted in light of the latter provision and transposed accordingly.Article 6(3) of the GDPR clarifies, with regard to the lawfulness of data processing, that the processing must be based on Union law or the law of the Member States to which the controller is subject, and that the legal basis in question must pursue an objective in the public interest and be proportionate to the legitimate purpose pursued. > Topics: Controllers · Applies: gdpr-art-6-par-3-en, gdpr-art-9-par-1-en, gdpr-art-9-en ### ¶99 Since these requirements stem from the provisions set forth in Article 52(1) of the Charter, they must be interpreted in light of that paragraph and transposed accordingly. In this regard, it should be noted that the fundamental rights to respect for private life and to the protection of personal data, guaranteed in Articles 7 and 8 of the Charter, do not claim unrestricted applicability, but must be viewed in light of their social function and weighed against other fundamental rights. Consequently, restrictions may be imposed provided that they are provided for by law in accordance with Article 52(1) of the Charter and respect the essence of the fundamental rights as well as the principle of proportionality. According to this principle, restrictions may be imposed only if they are necessary and genuinely meet objectives of general interest recognized by the Union or the requirements of the protection of the rights and freedoms of others. > Topics: Personal Data ### ¶100 They must be limited to what is strictly necessary, and the legislation containing the restriction must provide clear and precise rules regarding the scope and application of the measure in question (Judgement of June 22, 2021, Latvijas Republikas Saeima [Traffic Points], C-439/19, EU:C:2021:504, para. 105, and the case law cited therein).In this regard, it should be noted that the fundamental rights to respect for private life and to the protection of personal data, guaranteed by articles 7 and 8 of the Charter, do not claim unrestricted applicability, but must be viewed in light of their social function and weighed against other fundamental rights. Consequently, restrictions may be imposed provided that they are provided for by law in accordance with article 52(1) of the Charter and respect the essence of the fundamental rights as well as the principle of proportionality. According to this principle, restrictions may be imposed only if they are necessary and genuinely meet objectives of general interest recognized by the Union or the requirements of the protection of the rights and freedoms of others. > Topics: Personal Data ### ¶101 They must be limited to what is strictly necessary, and the legislation containing the restriction must provide clear and precise rules regarding the scope and application of the measure in question (Judgement of June 22, 2021, Latvijas Republikas Saeima [Traffic Points], C-439/19, EU:C:2021:504, para. 105 and the case law cited therein). The purpose pursued is accountability, transparency, and ease of verification by the general public. These objectives objectively serve a goal that is in the public interest. They are indisputably in the public interest and are therefore legitimate. (see CJEU, August 1, 2022, Case OT, C-184/20)The purpose pursued is accountability, transparency, and ease of verification by the general public. These objectives objectively serve a goal in the public interest. They are indisputably in the public interest and are therefore legitimate. (See CJEU, August 1, 2022, Case C-184/20) On the necessity of publishing the data: As regards the requirement of necessity, Recital 39 Recital of the GDPR that this requirement is met if the objective pursued—which is in the public interest—cannot reasonably be achieved just as effectively by other means that interfere less with the fundamental rights of the data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed in Articles 7 and 8 of the Charter—namely, the rights to respect for private life and to the protection of personal data—and where the exceptions and limitations to the principle of protection of such data must be limited to what is strictly necessary (see, to that effect, the judgement of June 22, 2021, Latvijas Republikas Saeima [Traffic Points], C-439/19, EU:C:2021:504, para. 110, and the case law cited therein). > Topics: Personal Data, Accountability, Transparency ### ¶102 As regards the requirement of necessity, it follows from Recital 39 of the GDPR that this requirement is met if the pursued, public interest objective cannot reasonably be achieved just as effectively by other means that interfere less with the fundamental rights of the data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed by articles 7 and 8 of the Charter, , and the exceptions and limitations to the principle of protection of such data must be limited to what is strictly necessary (see, to that effect, the judgement of June 22, 2021, Latvijas Republikas Saeima [Traffic Points], C-439/19, EU:C:2021:504, para. 110, and the case law cited therein). Consequently, in the present case, it must be examined whether the objective of informing the general public about the financing of political parties could be achieved just as effectively, in a reasonable manner, by other means that would interfere less significantly with the applicant’s (or those of other donors) to respect for private life and to the protection of personal data. > Topics: Personal Data ### ¶103 The Federal Administrative Court assumes that the publication of the names of individuals who make donations was mandated (in part) because it allows the public to form an impression of individual parties’ “dependence” on donations: political parties make a significant contribution to the overall process of public decision-making and opinion-forming. (see § 1(2) PartG 2012) Nevertheless, the Court doubts that the regulation is constitutionally sound, particularly with regard to the legislative reservation limited by § 1(2) DSG and Art. 23(1) GDPR.The Federal Administrative Court assumes that the publication of the names of individuals who make donations was mandated (in part) because it allows the public to form an opinion regarding individual parties’ “dependence” on donations: political parties make a significant contribution to the overall process of public decision-making and opinion-forming. > Applies: gdpr-art-23-par-1-en ### ¶104 (see Section 1, paragraph 2, PartG 2012) Nevertheless, the Court doubts that the provision is constitutionally compliant, particularly with regard to the legislative reservation limited by Section 1, paragraph 2, of the Data Protection Act (DSG) and article 23, paragraph 1, of the GDPR. The materials before the Federal Administrative Court do not indicate that, when enacting the aforementioned provision, the legislature examined whether it is absolutely necessary to publish the data specified in Section 6(3) of the PartG 2012 on the Internet without any restrictions on access, or whether the objectives pursued by the law could be achieved just as effectively if the number of persons able to view this data were limited or, for example, the address were not published—which the legislature would have been required to do under the case law of the CJEU (CJEU, Aug. 1, 2022, Case OT, C-184/20). > Applies: gdpr-art-23-en ### ¶105 It would also be necessary to examine whether the requirement of necessity for data processing is met in conjunction with the principle of “data minimisation” enshrined in para 5(1)(c) of the GDPR, is met, according to which personal data must be adequate, relevant, and limited to what is necessary for the purposes of the processing (see, to that effect, the judgement of December 11, 2019, Asociația de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, para. 48). Indeed, the materials before the Federal Administrative Court do not indicate that, when enacting the aforementioned provision, the legislature examined whether it is absolutely necessary to publish the data specified in Section 6, paragraph 3, PartG 2012 be published on the Internet without any restrictions on access, or whether the objectives pursued by the law could be achieved just as effectively if the number of persons able to view this data were limited or, for example, the address were not published—which the legislature would have been required to do under the case law of the CJEU (CJEU, Aug. 1, 2022, Case OT, C-184/20). > Topics: Retention Period, Personal Data ### ¶106 It would also be necessary to examine whether the requirement of necessity for data processing, together with the principle of “data minimization” enshrined in article 5, paragraph 1, letter c of the GDPR, according to which personal data must be adequate, relevant, and limited to what is necessary for the purposes of the processing—see, in this regard, the judgement of December 11, 2019, Asociația de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, para. 48). Finally, it should be noted that an objective serving the public interest cannot be pursued without taking into account the fact that it must be reconciled with the fundamental rights affected by the measure, by striking a fair balance between the objective serving the public interest and the rights in question (Judgement of April 5, 2022, Commissioner of An Garda Síochána et al., C-140/20, EU:C:2022:258, para. 52). Consequently, in order to assess the proportionality of the data processing at issue, it is necessary to determine the severity of the interference caused by that processing with the fundamental rights to respect for private life and to the protection of personal data, and to examine whether the importance of the public interest objective pursued by that processing is proportionate to that severity. > Topics: Retention Period, Personal Data · Applies: gdpr-art-5-en ### ¶107 In assessing the severity of the interference, particular account must be taken of the nature of the personal data at issue, especially the sensitive nature of such data, as well as the Art and specific circumstances of its processing, in particular the number of persons who have access to that data and the conditions under which such access is granted (Judgement of December 11, 2019, Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064, para. 57). In the present case, it must be noted that the online publication of personally identifiable data regarding political opinions is likely to reveal information about sensitive aspects of the data subjects’ private lives. Consequently, the Federal Administrative Court has doubts as to whether the unlimited publication of data pursuant to § 6(2) and (3) of the Political Parties Act (PartG) of 2012 constitutes accountability (the donor’s name and ZIP code) is necessary for the accountability and oversight of political parties, and that less intrusive measures would not suffice to achieve the purpose. > Topics: Political Opinions, Personal Data, Accountability, Types of Special Categories of Personal Data ### ¶108 Furthermore, the Federal Administrative Court cannot discern to what extent the legislature has engaged with the criteria developed by the CJEU and must therefore assume that the provision is not consistent with the protection of fundamental rights under EU law, particularly with regard to Art. 8(1) of the EU CFR and Article 8 of the ECHR. Consequently, the Federal Administrative Court has doubts that the unlimited publication of data pursuant to Section 6, paragraphs 2 and 3 of the Political Parties Act (PartG) of 2012 constitutes accountability (the donor’s name and ZIP code) is necessary for the accountability and oversight of political parties, and that less intrusive measures would suffice to achieve the purpose. Furthermore, the Federal Administrative Court cannot discern to what extent the legislature has addressed the criteria developed by the CJEU and must therefore assume that the provision is not consistent with the protection of fundamental rights under EU law, particularly with regard to article 8, paragraph 1, EU CFR and Article 8 of the ECHR. > Topics: Accountability ### ¶109 Re 2.3.: Even setting aside the EU legal constraints that bind the legislature to Article 23 of the GDPR when drafting national regulations, the case law of the Constitutional Court establishes the principle of objectivity. While this principle generally leaves it up to the legislature to determine both the objective of the regulation and the means used to achieve that objective, it does not relieve the legislature of the obligation to sufficiently define, in the case of regulations relevant to fundamental rights, the constitutionally required limits of the chosen means. The Constitutional Court has emphasized this in particular in connection with a statutory publication requirement (Const. Ct. Dec. 12.289/1990, G 245/89, among others). The Federal Administrative Court does not question the legislature’s fundamental freedom of choice regarding the regulatory objective and the means employed. > Applies: gdpr-art-23-en ### ¶110 Rather, the question is whether the specific formulation of the publication requirement under § 6(2) and (3) of the Political Parties Act (PartG), in light of the associated restriction on the right to protection of personal data pursuant to § 1(1) of the Data Protection Act (DSG) as well as Art. 8 of the CFR and Art. 8 of the ECHR, is consistent with the requirement of objectivity derived from the principle of equality.Even setting aside those EU-law restrictions that bind the legislature to Article 23 of the GDPR when drafting national regulations, the requirement of objectivity is found in the case law of the Constitutional Court. Although this principle generally leaves it up to the legislature to determine both the regulatory objective and the choice of means used to achieve that objective, it does not relieve the legislature of the obligation to sufficiently define, in the case of regulations relevant to fundamental rights, the constitutionally required limits of the chosen means. > Topics: Personal Data · Applies: gdpr-art-23-en ### ¶111 The Constitutional Court has emphasized this in particular in connection with a statutory publication requirement (Constitutional Court Decision 12.289 of 1990, G 245/89, among others). The Federal Administrative Court does not question the legislature’s fundamental freedom of choice regarding the regulatory objective and the means employed. Rather, the question is whether the specific formulation of the publication requirement under Section 6, paragraphs 2 and 3, of the Political Parties Act (PartG), in light of the associated restriction on the right to protection of personal data pursuant to Section 1, paragraph 1, of the Data Protection Act (DSG) as well as article 8, CFR and Article 8 of the ECHR, is consistent with the requirement of objectivity derived from the principle of equality. The principle of equality is enshrined in Austrian constitutional law in several places, namely in Art. 2 of the StGG and, above all, Art. 7 of the B-VG. > Topics: Personal Data · Applies: gdpr-art-2-en, gdpr-art-7-en ### ¶112 The principle of equality is also binding on the legislature. It imposes substantive limits on the legislature insofar as it prohibits the enactment of regulations that cannot be objectively justified (e.g., VfSlg 14.039/1995; 16.407/2001). The Constitutional Court has emphasized that the principle of equality constitutes an essential component of the democratic principle and is therefore not at the discretion of the constitutional legislature (Constitutional Court Decision 15.373). According to the test developed by the Constitutional Court, the principle of equality permits only differentiation that is objectively justified; such differentiation presupposes relevant differences in the factual realm (objective distinguishing characteristics). According to established case law, the legislature must attach the same legal consequences to identical sets of facts; substantially different sets of facts must lead to correspondingly different regulations (e.g., Constitutional Court Reports 2956, 11.190, 11.641, 13.477, 14.521, 19.590; VwGH 2. 7. 1992, 90/16/0167 – verst Sen; VwGH March 23, 2000, 99/15/0202; see also VfSlg 8806, 11.190, 15.510—regarding statutory exceptions). ### ¶113 The review of the objectivity of laws aims to assess the relationship between the facts covered by a provision and the intended legal consequence. If there are differing provisions, a comparison of the legal norms must be conducted; the question is whether the facts covered in each case are so different that they can “justify” the different legal consequences (VfSlg 16.635, 17.309). Any review of the objectivity of laws must first conduct such an examination of the relationship between the facts and the legal consequence. This may lead to the conclusion that this relationship, in and of itself, is not based on any “reasonable” ground; in which case the law must be regarded as contrary to the principle of equality (e.g., VfSlg 13.975) [Muzak, B-VG6 Art. 2 StGG (as of Oct. 1, 2020, rdb.at)]. As the Federal Administrative Court has already stated, it has well-founded concerns regarding the fundamental constitutionality of the provision at issue—and concerns also exist with regard to the Constitutional Court’s case law on the test of objectivity: The principle of equality is enshrined in Austrian constitutional law in several places, namely in article 2 of the StGG and, above all, in article 7 of the B-VG. > Applies: gdpr-art-2-en, gdpr-art-7-en ### ¶114 The principle of equality is also binding on the legislature. It imposes substantive limits on the legislature insofar as it prohibits the enactment of regulations that cannot be objectively justified (e.g., Constitutional Court Decision 14.039 from 1995; 16.407 from 2001). The Constitutional Court has emphasized that the principle of equality is an essential component of the democratic principle and is therefore not at the discretion of the constitutional legislature (Constitutional Court Decision 15.373). According to the test developed by the Constitutional Court, the principle of equality permits only differentiation that is objectively justified; such differentiation requires relevant differences in the factual sphere (objective distinguishing characteristics). According to established case law, the legislature must attach the same legal consequences to identical sets of facts; substantially different sets of facts must lead to correspondingly different regulations (e.g., VfSlg 2956, 11.190, 11.641, 13.477, 14.521, 19.590; VwGH 2. 7. 1992, 90/16/0167 – verst Sen; VwGH March 23, 2000, 99/15/0202; see also VfSlg 8806, 11.190, 15.510—regarding statutory exceptions). ### ¶115 The review of the objectivity of laws aims to assess the relationship between the facts covered by a provision and the intended legal consequence. If there are differing provisions, a comparison of the legal norms must be conducted; the question is whether the facts covered in each case are so different that they can “justify” the different legal consequences (VfSlg 16.635, 17.309). Any review of the reasonableness of laws must first conduct such an examination of the relationship between the facts and the legal consequence. This may lead to the conclusion that this relationship, in and of itself, is not based on any “reasonable” grounds; in which case the law must be regarded as contrary to the principle of equality (e.g., VfSlg 13.975) [Muzak, B-VG6 article 2, StGG (as of Oct. 1, 2020, rdb.at)]. As the Federal Administrative Court has already stated, it has well-founded concerns regarding the fundamental constitutionality of the provision at issue—and concerns also exist with regard to the Constitutional Court’s case law on the test of objectivity: It should be noted at this point that the PartG 2012, by referring to Section 4, does not limit itself to a mere obligation on the part of political parties to disclose their own finances, but rather subjects the parties to a multi-tiered oversight regime in which independent auditors must first verify compliance with statutory requirements, and furthermore, the Court of Auditors is granted independent and far-reaching powers of oversight, information gathering, and investigation. > Applies: gdpr-art-2-en ### ¶116 The Court of Auditors may not only verify the mathematical accuracy and completeness of financial reports but, in the event of concrete indications of inaccuracies or legal violations, may also demand the submission of additional books, supporting documents, contracts, correspondence, and other records. Furthermore, the publication and sanction mechanisms provided for by law ensure that any irregularities identified do not go unpunished. Furthermore, the 2012 Political Parties Act establishes extensive disclosure requirements: The accountability obligations applicable to political parties are not limited to the disclosure of total revenues and total expenditures. Rather, the financial circumstances of the parties, in their various forms, must be disclosed and made available for public scrutiny. Furthermore, pursuant to Section 7a of the 2012 Political Parties Act (PartG), political parties must, among other things, make available on their websites the financial reports published by the Court of Auditors, the decisions issued by the independent Party Transparency Senate regarding these reports, and their election campaign reports.In addition, the Political Parties Act of 2012 provides for extensive disclosure requirements: The accountability obligations applicable to political parties are not limited to the disclosure of total revenues and total expenditures. > Topics: Accountability, Transparency ### ¶117 Rather, the financial circumstances of the parties, in their various forms, must be disclosed and made available for public scrutiny. Furthermore, pursuant to Section 7a of the 2012 Political Parties Act (PartG), political parties must, among other things, make available on their websites the financial reports published by the Court of Auditors, the decisions issued by the independent Party Transparency Senate regarding these reports, and their election campaign reports. The statutory oversight system thus proves to be comprehensive and multi-tiered, even beyond the publication of the names of donors who have contributed more than EUR 500: The oversight of party financing is first ensured through a professionally independent audit, then through institutional oversight by the Court of Auditors, and finally through related disclosure and sanction mechanisms. The legislature therefore already has a comprehensive set of tools at its disposal to effectively verify compliance with the regulations on party financing and to detect violations. > Topics: Transparency ### ¶118 The contested provisions require the publication of the name and ZIP code of a donor who contributes more than EUR 500 to a political party and thus significantly interfere with the fundamental rights of the data subjects concerned. According to § 5(8) of the Political Parties Act (PartG) of 2012, this data must be retained and made available for a period of 7 years.The contested provisions require the publication of the name and ZIP code of a donor who contributes more than EUR500 to a political party, thereby significantly infringing upon the fundamental rights of the data subjects concerned. According to paragraph 5(8) of the PartG 2012, this data must be retained or made available for a period of 7 years. In contrast, political parties are financed through subsidies (see paragraph 3 of the PartG 2012) and through donations. In contrast, political parties are financed through subsidies (see Section 3 of the PartG 2012) and through donations. > Topics: Personal Data ### ¶119 It should first be noted that the legislature has set a comparatively low threshold for the (phased) disclosure requirement. On the other hand, the donation amounts covered by the disclosure requirement—at least in relation to the total volume of political party financing, specifically that of the ÖVP—account for only a small proportion and thus, on their own, generally, and also in the case underlying the challenge, have only a limited influence on the financing and decision-making within the party. The suitability of a disclosure requirement linked indiscriminately to this threshold for achieving the intended purpose of transparency and oversight therefore requires a more detailed factual justification. In particular, it is not clear why a single donation at the lower end of the threshold should be treated the same as a very large donation in this regard. This raises the question of whether treating donations of different natures in the same manner (by disclosing the donor’s name, the donation amount, and the specific recipient) actually provides a comparably higher degree of transparency, which is highly doubtful. > Topics: Transparency, Recipient ### ¶120 Furthermore, the Political Parties Act provides for the publication of the relevant data for a very long period of 7 years, without providing for a balancing of interests or proportionality based on the circumstances of the individual case. Thus, the question is not whether the legislature was permitted to establish a disclosure requirement at all, but whether it was permitted to define its scope of application so rigidly that it also covers situations in which the infringements of fundamental rights associated with disclosure are disproportionate to the interest in transparency pursued thereby. The Federal Administrative Court does not fail to recognize that the disclosure obligations provided for in para 2 and 3 of § 6 of the Political Parties Act (PartG) do not constitute criminal provisions. Rather, the legislature’s decision is aimed at pursuing a legitimate goal of transparency and oversight in the area of political party financing by making certain information publicly available. > Topics: Transparency ### ¶121 However, this does not mean that no heightened legislative requirements should be imposed on the specific design of the disclosure requirement. Even a non-criminal provision can result in a significant infringement of fundamental rights. The decision is not merely the punitive nature of a provision, but in particular the intensity of the infringement of fundamental rights associated with the disclosure and the question of whether the legislature itself has sufficiently provided for the limitations on the chosen means necessary to safeguard fundamental rights.The Federal Administrative Court does not fail to recognize that the publication obligations provided for in Section 6, paragraphs 2 and 3, of the Political Parties Act (PartG) do not have the character of criminal provisions. Rather, the legislature’s decision is aimed at pursuing a legitimate goal of transparency and oversight in the area of political party financing by making certain information publicly available. > Topics: Transparency ### ¶122 However, this does not mean that no heightened legislative requirements should be imposed on the specific design of the disclosure obligation. Even a non-criminal provision can result in a significant infringement of fundamental rights. What is decisive is not merely the punitive nature of a provision, but in particular the intensity of the infringement of fundamental rights associated with the disclosure and the question of whether the legislature itself has sufficiently provided for the limitations on the chosen means necessary to safeguard fundamental rights. It is precisely in this respect that the present case differs from the mere question of the appropriateness of the legislative choice of means: The Federal Administrative Court does not doubt that transparency regarding the financing of political parties constitutes a legitimate regulatory objective and that the legislature may, in principle, also resort to the means of publication to achieve it. > Topics: Transparency ### ¶123 Rather, the question is whether the specific combination of a low disclosure threshold, the duration of the disclosure, and the lack of any provision for taking into account the particular circumstances of individual cases can still be regarded as an objectively justified and proportionate application of this measure. This assessment must also take into account that, as explained above, other comprehensive monitoring and disclosure requirements already exist. For the proportionality test, it is significant to determine what independent, additional value the publication of an individual donor’s name adds in terms of insight and oversight compared to the existing disclosure, audit, and sanction mechanisms. The lesser this additional benefit is for the effective oversight of political party financing, the more significant the intrusion into the donor’s right to confidentiality of their personal data associated with the publication of their name appears to be. > Topics: Personal Data, Monitoring ### ¶124 From the Federal Administrative Court’s perspective, the static threshold at which publication by the Court of Auditors becomes mandatory results in an imbalance between the extent of the intrusion on presumed donors and the contribution that actually benefits the finances of political parties. In particular, it becomes apparent that the significant infringement of fundamental rights associated with the publication is not proportionate to the gain in transparency. From the Court’s perspective, the contested regulation is therefore not in accordance with the constitutional requirement of proportionality and constitutes an disproportionate infringement of the complainant’s fundamental rights. The principle of equality appears to have been violated in the present case (see VfSlg 5737, among others). The principle of equality appears to have been violated in the present case (see VfSlg 5737, among others). 3. > Topics: Transparency ### ¶125 In any event, a constitutionally compliant interpretation of the contested provision was not possible in the present case with regard to the provisions of ordinary law in the PartG 2012, since these—like any other method of interpretation —is limited by the unambiguous wording of the law (VfSlg 12.228/1989, VwGH March 13, 2009, 2005/12/0240, with further references; June 29, 2011, December 1, 2009). 3. In any event, a constitutionally compliant interpretation of the contested provision was not an option in the present case with regard to the ordinary statutory provisions of the PartG 2012, since these—like any other method of interpretation —is limited by the unambiguous wording of the law (VfSlg 12.228 from 1989, VwGH March 13, 2009, 2005/12/0240, with further references; June 29, 2011, 2009/12/0141). An unlawful provision is not to be disregarded, but rather must be applied until it is reviewed and struck down by the Constitutional Court in the procedure provided for this purpose (see Constitutional Court, October 11, 1955, V15/55). ### ¶126 An unlawful provision is not to be disregarded, but rather must be applied until it is reviewed and repealed by the Constitutional Court in the procedure provided for this purpose (see Constitutional Court, Oct. 11, 1955, V15/55). IV. Conclusion (Roman numeral four). Conclusion Therefore, the Federal Administrative Court has decided to submit the motion cited in the ruling to the Constitutional Court. ## Cited law provisions (41) ### GDPR — gdpr-art-4-par-1-en ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; ### GDPR — gdpr-art-4-par-2-en ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; ### GDPR — gdpr-art-4-par-7-en ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; ### GDPR — gdpr-art-4-par-11-en ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; ### GDPR — gdpr-art-5-par-1-en Personal data shall be: ### GDPR — gdpr-art-5-par-1-pnt-c-en adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’); ### GDPR — gdpr-art-6-par-1-en Processing shall be lawful only if and to the extent that at least one of the following applies: ### GDPR — gdpr-art-6-par-1-pnt-c-en processing is necessary for compliance with a legal obligation to which the controller is subject; ### GDPR — gdpr-art-6-par-1-pnt-e-en processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; ### GDPR — gdpr-art-6-par-3-en The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by: ### GDPR — gdpr-art-9-par-1-en Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited. ### GDPR — gdpr-art-17-par-2-en Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. ### GDPR — gdpr-art-23-par-1-en Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard: ### GDPR — gdpr-art-51-par-1-en Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’). ### GDPR — gdpr-art-52-par-1-en Each supervisory authority shall act with complete independence in performing its tasks and exercising its powers in accordance with this Regulation. ### GDPR — gdpr-art-55-par-1-en Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State. ### GDPR — gdpr-art-58-par-2-en Each supervisory authority shall have all of the following corrective powers: ### GDPR — gdpr-art-77-par-1-en Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. ### GDPR — gdpr-art-89-par-2-en Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes. ### GDPR — gdpr-art-1-en Subject-matter and objectives ### GDPR — gdpr-art-2-en Material scope ### GDPR — gdpr-art-4-en For the purposes of this Regulation: ### GDPR — gdpr-art-5-en Principles relating to processing of personal data ### GDPR — gdpr-art-6-en Lawfulness of processing ### GDPR — gdpr-art-7-en Conditions for consent ### GDPR — gdpr-art-8-en Conditions applicable to child's consent in relation to information society services ### GDPR — gdpr-art-9-en Processing of special categories of personal data ### GDPR — gdpr-art-16-en The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. ### GDPR — gdpr-art-17-en Right to erasure (‘right to be forgotten’) ### GDPR — gdpr-art-18-en Right to restriction of processing ### GDPR — gdpr-art-19-en The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it. ### GDPR — gdpr-art-23-en Restrictions ### GDPR — gdpr-art-42-en Certification ### GDPR — gdpr-art-43-en Certification bodies ### GDPR — gdpr-art-51-en Supervisory authority ### GDPR — gdpr-art-52-en Independence ### GDPR — gdpr-art-55-en Competence ### GDPR — gdpr-art-58-en Powers ### GDPR — gdpr-art-77-en Right to lodge a complaint with a supervisory authority ### GDPR — gdpr-art-83-en General conditions for imposing administrative fines ### GDPR — gdpr-art-89-en Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes --- Generated by overview.legal · https://overview.legal/posts/607173 · 2026-11-14