Austria
Other chapters
Foreword and issue-by-issue comparison
Austria
Get your copy
Request a hard copy of the GDPR Guide to National Implementation »
In this chapter:
Q1/ Applicable legislation
(a) Have the requirements of the GDPR been addressed by introducing a new law, or by updating existing legislation?
Old legislation has been updated.
———
(b) Relevant legislation includes:
- Data Protection Act, Federal Law Gazette I Nr. 165/1999
(the "Data Protection Act"); amended to reflect GDPR
requirements by two Data Protection Amendment Acts
in 2018- Date in force: 1 January 2000 (amended on 25 May 2018)
- Link: In German: see here
- Data Protection Act 1 & 2 on the Amendment of Material Laws (Federal Law Gazette I Nr. 32/2018 & Nr. 37/2018); amending a wide range of material laws to reflect GDPR changes
———
(c) What is the status of national pre-GDPR data protection law?
The relevant pre-GDPR legislation has been revised.
Q2/ Personal data of deceased persons
Does national law make specific rules regarding the processing of personal data of deceased persons?
There are no specific rules governing this issue.
Q3/ Legal bases for processing
(a) Does national law make specific rules regarding the processing of personal data in compliance with a legal obligation?
The Data Protection Act clarifies that the processing of criminal data is permitted, inter alia, where an explicit legal authorisation or obligation to process such data exists, and provided the general requirements of the GDPR are met.
———
(b) Does national law make specific rules regarding the processing of personal data for the performance of tasks carried out in the public interest?
The Data Protection Act contains specific provisions regarding the processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
———
(c) Does national law make specific rules regarding the processing of personal data in the exercise of official authority vested in the controller?
The Data Protection Act governs the processing of personal data for the purposes of policing and national security, including, inter alia, public security, the prosecution of criminal offences and the enforcement of sentences.
———
(d) Does national law contain criteria in addition to those listed in the GDPR, to determine whether processing for a new purpose is compatible with the purpose for which the personal data were initially collected?
The Data Protection Act clarifies that when carrying out processing activities for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, the controller may process such lawfully collected personal data for other research projects or new purposes only where those new purposes are not aimed at obtaining results relating to specific data subjects.
Q4/ Consent of children
At what age can a child give their consent to processing in relation to ISS?
14 years of age.
Q5/ Processing of sensitive personal data
(a) Are there any sensitive personal data which cannot be processed on the basis of a data subject’s consent?
All sensitive personal data can be processed if the data subject’s valid consent has been obtained.
———
b) Does national law contain any specific requirements regarding the processing of sensitive personal data in respect of the following:
(i) Employment, social security and/or social protection law
There are no specific rules on processing this category of data.
(ii) Substantial public interest
There are no specific rules on processing this category of data.
(iii) Preventative or occupational medicine; employee working capacity, medical diagnosis, provision of health or social care, or management of health or social care systems or services
There are no specific rules on processing this category of data.
(iv) Public interest in the area of public health
There are no specific rules on processing this category of data.
(v) Archiving purposes, scientific or historical research purposes or statistical purposes
The authorisation of the DPA may be required for processing personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. Where sensitive personal data are to be processed in this context, stricter requirements regarding the persons processing the data apply and the DPA must order preconditions to be fulfilled where these are necessary to safeguard the interests of the data subjects.
———
(c) Has national law introduced any further conditions and/ or limitations with regard to the processing of genetic data, biometric data, or health data?
There are no specific rules on processing this category of data.
Q6/ Data relating to criminal offences or convictions
Under what conditions does national law permit the processing of personal data relating to criminal convictions?
Provided the general requirements of the GDPR are met, processing personal data relating to criminal convictions and offences is permitted if:
- an explicit legal authorisation or obligation to process such data exists; or
- the legitimacy of the processing of such data is based on statutory duties of diligence, or the processing is necessary for the purpose of a legitimate interest, and the manner in which the data are processed safeguards the interests of the data subject.
Q7/ Exemptions
(a) Does national law specify exemptions to a data subject’s right to erasure?
The following specific exemptions apply to the right to erasure:
- where personal data processed by automated means cannot be erased (or rectified) immediately due to economic or technical constraints, data processing must be restricted until that time; and
- the data subject's rights under the GDPR (including the right to erasure) do not apply to data processing for journalistic purposes or, where the limitation of the exercise of those rights is necessary in order to reconcile data protection with the freedom of expression and information, to data processing for scientific, artistic or literary purposes.
———
(b) Does national law specify exemptions to a data subject’s right to be provided information under Art. 14 GDPR where the personal data has not been obtained from the data subject?
The data subject's rights under the GDPR (including transparency obligations) do not apply to data processing for journalistic purposes or, where the limitation of the exercise of those rights is necessary in order to reconcile data protection with the freedom of expression and information, to data processing for scientific, artistic or literary purposes.
———
(c) Does national law specify exemptions to a data subject’s right to not be subject to a decision based solely on automated processing, including profiling?
The data subject's rights under the GDPR (including the right to not be subject to a decision based solely on automated processing) do not apply to data processing for journalistic purposes or, where the limitation of the exercise of those rights is necessary in order to reconcile data protection with the freedom of expression and information, to data processing for scientific, artistic or literary purposes.
Q8/ Restrictions on data subjects’ rights
Aside from the exemptions noted in Q7, does national law contain any other restrictions on the rights of data subjects under Chapter III GDPR?
The data subject's rights under Chapter III of the GDPR do not apply to data processing for journalistic purposes or, GDPR Guide to National Implementation 21 where this is necessary in order to reconcile data protection with the freedom of expression and information, to data processing for scientific, artistic or literary purposes.
The right of access does not apply in the following situations:
- where a controller is acting in the exercise of official power insofar as the granting of a right of access would jeopardise the fulfilment of the controller’s duties; and
- where the granting of a right of access would jeopardise a trade secret of the controller or a third party.
Q9/ Joint controllership
Does national law provide rules or guidance on the apportionment of responsibility between joint controllers?
There are no additional rules on apportionment of liability between joint controllers.
Q10/ Processor
In addition to the contract between controller and processor, are there any pieces of legislation which govern processing by a processor?
Unless employees are already subject to such an obligation by law, processors (as well as controllers) must contractually bind their employees to maintain confidentiality of the relevant personal data, including after the end of their employment with the processor or controller.
Q11/ Impact Assessments
Are there any circumstances in which national law requires an Impact Assessment to be carried out, where the GDPR would not otherwise require such an assessment?
The DPA has issued a "Black List" setting out the processing activities for which an Impact Assessment is mandatory, as well as a "White List" setting out processing activities for which no Impact Assessment is required.
Q12/ Prior authorisation and public interest
Are there any circumstances in which national law requires controllers to consult with, or obtain prior authorisation from, the DPA in relation to processing for the performance of a task carried out by the controller in the public interest (including processing in relation to social protection and public health)?
In addition to the provisions of the GDPR, prior authorisation from the DPA is required in the following circumstances:
- where obtaining consent of the data subject would require disproportionate effort, other statutory exemptions do not apply, and the controller wishes to process addresses to inform and interview data subjects for purposes in the public interest; or
- where the processing for such purposes is not covered by specific legal provisions nor by the consent of data subjects and, in addition, the used personal data are not:
- publicly accessible;
- lawfully collected by the controller for another research project; or
- pseudonymised in a way which prevents the controller from identifying the data subjects by legal means.
Q13/ DPOs
(a) Does national law require controllers to appoint a DPO in circumstances other than those in Art. 37(1) GDPR?
DPOs are only mandatory in the circumstances set out in Art. 37(1) GDPR.
———
(b) Does national law impose secrecy and confidentiality obligations on DPOs and if so, in what circumstances do they apply?
Austrian law imposes a general secrecy obligation on all DPOs and on people acting on their behalf. In particular, this obligation applies with regard to the identity of data subjects who have contacted the DPO. The DPO and individuals acting on its behalf may use information made available to them exclusively for the fulfilment of their duties and are bound by confidentiality including after the end of their engagement.
Q14/ International data transfers
(a) Does national law make specific rules about transfers of personal data from public registers?
Data transfers from public registers are not subject to specific rules.
———
(b) Does national law restrict the transfer of specific categories of personal data to third countries?
Data transfers from public registers are not subject to specific rules.
Q15/ DPAs
(a) Details of the DPA(s).
- Name of DPA: Datenschutzbehörde
- Address: Barichgasse 40-42, 1030 Vienna, Austria
- Website: dsb.gv.at
———
(b) If more than one national DPA has been established, what is the rationale behind multiple DPAs?
Not applicable as there is only one DPA.
———
(c) How does national law ensure consistent application of the GDPR by the various DPAs in accordance with Art. 63 GDPR?
Not applicable.
———
(d) Does national law grant the relevant DPA additional powers beyond those set out in Art. 58 GDPR?
The law in Austria does not grant the relevant DPA any additional powers beyond those set out in Art. 58 GDPR.
———
(e) What national appeals process exists to enable parties to challenge the decisions of the DPA?
Decisions of the DPA may be appealed to the Federal Administrative Court (Bundesverwaltungsgericht) within a period of four weeks.
Where the case involves legal questions of fundamental importance (e.g., where prior case law is missing or inconsistent), a subsequent appeal may be brought to the Higher Administrative Court (Verwaltungsgerichtshof).
———
(f) Have specific national rules been adopted regarding the DPA’s power to obtain information from controllers or processors that are subject to obligations of professional secrecy (or equivalent)?
There are no specific rules on this issue.
Q16/ Claims by not-for-profit bodies
Does national law specify any not-for-profit bodies that are entitled to bring claims on behalf of individuals without the specific mandate of those individuals?
There are no not-for-profit bodies that are specifically mandated to bring such claims.
Q17/ Administrative fines, penalties and sanctions
(a) Does national law lay down rules on whether and to what extent administrative fines may be imposed on public authorities for breaches of the GDPR?
Administrative fines cannot be imposed on public authorities and public bodies, including bodies established under public or private law acting within their legal mandate.
———
(b) Does national law impose penalties/sanctions in addition to those set out in the GDPR, for breaches of the GDPR not subject to administrative fines (e.g., criminal penalties)?
Outside the scope of the penalties set out in the GDPR, an administrative offense is punishable by a fine of up to €50,000 to anyone who inter alia intentionally and illegally gains access to data processing, transmits data intentionally in violation of the rules on confidentiality or violates the Data Protection Act's provisions on image processing.
In addition, data processing with the intention to unlawfully enrich himself or a third person, or to harm the data subject's fundamental right to data protection, constitutes a criminal offense punishable by a court with imprisonment of up to one year or with a fine of up to 720 day-fines. The actual daily rate depends on the economic circumstances of the convicted person; however, one daily rate must be between €4 and €5,000.
Q18/ Freedom of expression and information
(a) What (if anything) does national law do to balance the provisions of the GDPR against the right to freedom of expression and information?
The following rules govern the balance between the GDPR and the right to freedom of expression and information:
- extensive parts of the GDPR (Chapters II-VII & IX) do not apply to data processing for journalistic purposes; and
- where necessary in order to reconcile the protection of personal data with freedom of expression and information, GDPR Chapters II-VII & IX (except for Arts. 5, 28, 29 & 32 GDPR) do also not apply to processing for scientific, artistic or literary purposes.
———
(b) What derogations have been introduced by national law concerning the processing of personal data for the purpose of academic, artistic or literary expression?
Where it is necessary in order to reconcile the protection of personal data with freedom of expression and information, GDPR Chapters II-VII & IX (except for Arts. 5, 28, 29 & 32 GDPR) do not apply to processing for scientific, artistic or literary purposes.
Q19/ National identification numbers
Does national law stipulate specific conditions for the processing of a national identification number, and if so, what are the conditions?
There are no specific provisions governing this issue.
Q20/ Processing in the context of employment
(a) For what purposes can employees’ personal data in the employment context be processed under national law?
The use of CCTV to monitor employees is not permitted.
———
(b) Does national law provide safeguards for employees’ dignity, legitimate interests, and fundamental rights?
There are no specific safeguards of this nature.
Q21/ Other material derogations
Are there any other material derogations from, or additions to, the GDPR under national law?
The Data Protection Act contains detailed requirements and safeguards with regard to the lawfulness of the recording and processing of image data, which apply to photographs as well as video recordings.
Q22/ Current legal challenges
Are there any current legal challenges (e.g., court cases or regulatory appeals) regarding the validity or operation of the national GDPR implementation law (e.g., claims that the law incorrectly applies the GDPR; claims that the law is incompatible with constitutional principles; etc.)?
There are no current legal challenges ongoing.
Q23/ Enforcement
Has the local DPA issued any material fines or taken any material enforcement action to date for breaches of the GDPR?
To date, the largest financial fine amounts to €4,700 for a violation of the provisions relating to image recordings (illegal CCTV cameras). In the majority of cases where controllers or processors have been found to be in violation of the law, the DPA has issued orders to improve their practices rather than imposing fines.
Q24/ Regulatory Guidance
Has the DPA issued any significant guidance on the application of the GDPR or national implementation law?
The DPA has issued the following guidance on the application of the GDPR and/or GDPR implementation law:
- general guidance from the DPA (see here dsb.gv.at/documents/22758/116802/DSGVO_2016_679_Leitfaden.pdf/5d8caa5e-ab18-490d-a3a2-f5ba994e70f7 (in German))
- the DPA's "Black List" establishing the categories of processing operations that require an Impact Assessment (see here (in German)); and
- the DPA's "White List" determining the exemptions from the duty to carry out an Impact Assessment (see here (in German)).
Wolf Theiss contributors
|
Roland Marko |
|
Roland Marko is a member of the IP & IT team. Roland specialises in information technology law (IT-outsourcing, cloud computing, e-commerce, licenses, etc.), data protection and data security law, intellectual property law (including litigation) and unfair competition law. He is the author of numerous articles on IP/IT law and a frequent lecturer at Austrian universities. After completing his legal studies, Roland obtained an LL.M. degree from the University of Vienna and also has an Academic Media Expert certificate from the University of Graz. |
|
|
Paulina Pomorski |
|
Paulina Pomorski is a member of the IP & IT team. Prior to joining Wolf Theiss, she gained professional experience as an associate in the IP & IT practice at another renowned international law firm in Vienna and as a research and teaching assistant at the Vienna University's Department for Tax Law. Paulina specialises in intellectual property law, unfair competition law, information technology and data protection. Paulina is admitted to the New York bar and holds an LL.M. from the New York University School of Law in Global Business Law (2012) as well as an LL.M. from the National University of Singapore in Asian Legal Studies (2012). As a lecturer at the University of Applied Sciences, St. Pölten, she teaches courses on "Media and Communications Law". She speaks German and Polish (both mother tongue), English and French (both fluent). |
|
Other chapters
- Foreword and issue-by-issue comparison
- Country-by-country guides:
———
See also:
Our Global Data, Privacy & Cybersecurity Practice »
GDPR Handbook: Unlocking the EU General Data Protection Regulation »
———
This publication is provided for your convenience and does not constitute legal advice. This publication is protected by copyright.
© 2019 White & Case LLP
