Main

Data protection law - An Introduction

Handbook

Resources

About the author

Legal notice
Privacy statement
Copyright information

edit SideBar

Recent Changes
Printable View
Page History
Edit Page

Sections 1-26 of the Austrian data protection act

Objects of and constitutional grounds for data protection legislation
Key definitions
Scope
Territorial application of the legislation
Provisions on data quality
Legal grounds for data processing
Provisions concerning sensitive data
The data subject's right to be informed
The data subject's right of access to her/his data
The data subject's right to object
Automated individual decisions
Provisions on data security
Notification
Prior checking
Remedies, liability and sanctions
Transfer of personal data to third countries
Supervisory authority

Right to Rectification and Erasure

Sect. 27 (1) Every controller shall rectify or erase data that are incorrect or have been processed contrary to the provisions of this Federal Act [Bundesgesetz]

1. on his own, as soon the incorrectness of the data or the inadmissibility of the processing becomes know to him, or
2. on a well-founded application by the data subject [Betroffener].

The obligation to rectify data according to sub-para. 1 shall apply only to those data whose correctness is significant for the purpose of the data application [Datenanwendung]. The incompleteness of data shall only justify a claim to rectification if the incorrectness, with regard to the purpose of the data application, results in the entire information being incorrect. As soon as data are no longer needed for the purpose of the data application, they shall be regarded as illegally processed data and shall be erased unless their archiving is legally permitted and unless the access to these data is specially secured. Any further use for another purpose shall be legitimate only if a transmission [Übermittlung] of the data for this purpose is legitimate; the legitimacy of further uses for scientific or statistical purposes is laid down in sects. 46 and 47.

(2) It shall be the obligation of the controller to prove that the data are correct - unless specifically provided otherwise by law - insofar as the data have not been collected exclusively based on statements made by the data subject.

(3) No rectification or erasure of data is possible insofar as the documentation purpose of a data application does not permit later changes. In such case, the necessary rectifications shall be effected by means of additional comments.

(4) The application for rectification or erasure shall be complied with within eight weeks after receipt and the applicant shall be informed thereof, or a reason in writing shall be given why the requested erasure or rectification was not carried out.

(5) In the areas of the executive responsible for the fields described in sect. 26 para. 2 sub-paras. 1 to 5, the following procedure shall be applied to applications for rectification or erasure, insofar as this is required to safeguard those public interests that require secrecy: The rectification or erasure shall be carried out if the demands of the data subject are justified in the opinion of the controller. The required information pursuant to para. 4 shall in all cases be that a check of the data files [Datenbestand] of the controller with regard to the application for rectification or erasure has been performed. The legality of this course of action is subject to review by the Data Protection Commission [Datenschutzkommission] according to sect. 30 para. 3 and the special complaint proceeding before the Data Protection Commission pursuant to sect. 31 para. 4.

(6) If the erasure or rectification of data kept solely on media readable by means of automatic processing systems can be carried out only at specific times for economic reasons, the data to be erased shall be kept inaccessible and a correcting remark shall be attached the data that are to be corrected.

(7) If data are used whose correctness is disputed by the data subject, and if neither their correctness or incorrectness can be established, an entry about the dispute [Bestreitungsvermerk] shall be attached upon request by the data subject. The entry about the dispute shall be erased only with the consent of the data subject or on grounds of a decision of the competent court of law or of the Data Protection Commission.

(8) If data that were rectified or erased in terms of para. 1 were transmitted before having been rectified or erased, the controller shall inform the recipient of the data by appropriate means, insofar as this does not constitute an unreasonable effort, in particular with regard to a legitimate interest in the information, and that the recipient can still be determined.

(9) The provisions of para. 1 to 8 shall be applied to the criminal records [Strafregister], kept according to the Criminal Records Act 1968 [Strafregistergesetz 1968] as well as to public books and registers kept by public sector controllers only insofar as

1. the obligation to rectification and erasure ex officio or
2. the procedure to assert and the competence to decide applications to rectification and erasure of data subjects

is not regulated otherwise by federal law.

Right to Object

Sect. 28 (1) Insofar as a use of data [Datenverwendung] is not authorised by law, every data subject [Betroffener] shall have the right to raise an objection with the controller [Auftraggeber] of the data application [Datenanwendung] against the use of data because of an infringement of an overriding interest in secrecy deserving protection arising from his special situation. If the requirements are met, the controller shall erase the data relating to the data subject within eight weeks from his data application and shall refrain from transmitting the data.

(2) If the inclusion of data in a filing system [Datei] open to inspection by the public is not mandated by law, the he data subject can object at any time and without any need to give reasons for his application. The data shall be erased within eight weeks.

Rights of the Data Subject concerning the Use of only Indirectly Personal Data

Sect. 29 The rights granted in sects. 26 to 28 cannot be exercised insofar as only indirectly personal data are used.

Part 6 - Legal Remedies

Duties of Supervision of the Data Protection Commission

Sect. 30 (1) Anyone shall have the right to lodge an application with the Data Protection Commission [Datenschutzkommission] because of an alleged infringement of his rights or obligations concerning him pursuant to this Federal Act [Bundesgesetz] by a controller [Auftraggeber] or processor [Dienstleister].

(2) The Data Protection Commission shall have the right to examine data applications [Datenanwendungen] in case of reasonable suspicion of an infringement of the rights and obligations mentioned in para. 1. It can order the controller or processor of the examined data application to give all necessary clarifications and to grant access to data applications and relevant documents.

(3) Data applications subject to prior checking [Vorabkontrolle] pursuant to sect. 18 para. 2 may be examined without a suspicion of illegal data use. The same applies to those fields of the government where a public sector controller claims that sects. 26 para. 5 and 27 para. 5 are to be applied.

(4) For purposes of the inspection, the Data Protection Commission shall have the right, after having informed the owner of said rooms and the controller (processor), to enter rooms where data applications are carried out, operate data processing equipment, run the processing to be examined and to make copies of the storage media to the extent absolutely required for the exercise of the right to examination. The controller (processor) shall render the assistance necessary for the examination. The supervisory rights are to be exercised in a way that least interferes with the rights of the controller (processor) and third parties.

(5) Information acquired by the Data Protection Commission and its representatives during the examinations shall be used only for supervisory purposes in the context of the execution of data protection regulations. The obligation to confidentiality extends even to courts and administrative authorities, in particular fiscal authorities, with the reservation that, if the examination brings up probable cause to believe that a crime according to sects. 51 and 52 of this Federal Act [Bundesgesetz] or a crime according to sect. 278a StGB (criminal organisation) or any crime punishable with more than five years of imprisonment has been committed, a report shall be made and requests for assistance by criminal courts according to sect. 26 StPO regarding such crimes shall be complied with.

(6) To establish the rightful state, the Data Protection Commission can issue recommendations; an appropriate period for compliance shall be set if required. If a recommendation is not obeyed within the set period, the Data Protection Commission shall, depending on the kind of transgression and ex officio,

1. initiate an administrative inquiry to check the registration pursuant to sect. 22 para. 4, or
2. bring a criminal charge pursuant to sects. 51 or 52, or
3. in case of severe transgressions by a private sector controller file a lawsuit before the competent court of law pursuant to sect. 32 para. 5, or
4. in case of a transgression by an organ of a territorial corporate body [Gebietskörperschaft], involve the competent highest authority. This authority shall within an appropriate period, not exceeding twelve weeks, take measures to ensure that the recommendation of the Data Protection Commission is complied with or inform the Data Protection Commission why the recommendation is not complied with. The reason may be publicised by the Data Protection Commission in an appropriate manner as far as not contrary to official secrecy.

(7) The intervening party shall be informed as to how his intervention was dealt with.

Complaint before the Data Protection Commission

Sect. 31 (1) The Data Protection Commission [Datenschutzkommission] shall decide on request of the data subject [Betroffener] on alleged infringements by the controller [Auftraggeber] of a data application [Datenanwendung] of the right to information pursuant to sect. 26, insofar as this request for information does not concern a use of data [Datenverwendung] for acts of legislation or jurisdiction.

(2) The Data Protection Commission shall be competent to decide on an alleged infringement of the right to secrecy, rectification and erasure of the data subject pursuant to this Federal Act [Bundesgesetz] if the data subject has filed a complaint against a public sector controller that is not an organ of legislation or jurisdiction.

(3) In the case of imminent danger [Gefahr im Verzug], the Data Protection Commission can, when dealing with a complaint pursuant to para. 2, prohibit all further uses of data entirely or in part or - in the case of a dispute concerning the correctness of data - order the controller to make an entry about the dispute [Bestreitungsvermerk].

(4) If a public sector controller invokes sects. 26 para. 5 or 27 para. 5 vis-á-vis the Data Protection Commission concerning a complaint because of an infringement of the rights to information, rectification and erasure, the Data Protection Commission shall, after having examined the necessity of confidentiality, safeguard the protected public interests during the proceedings. If the Data Protection Commission comes to the conclusion that it was not justified to keep the processed data secret from the data subject, the disclosure of the data shall be ordered by a ruling [Bescheid]. The authority against whom action was taken may lodge an appeal against this decision with the administrative court [Verwaltungsgerichtshof]. If no such appeal is made and the ruling [Bescheid] of the Data Protection Commission is not complied within eight weeks, the Data Protection Commission itself shall carry out the disclosure to the data subject and shall communicate to him the desired information or inform him which data have been rectified or erased.

Court Action

Sect. 32 (1) Claims against private sector controllers [Auftraggeber] for infringements of the right to secrecy, to rectification or erasure shall be brought before the civil courts by the data subject [Betroffener].

(2) If data have been used contrary to the provisions of this Federal Act [Bundesgesetz], the data subject shall have the right to sue for an end to such unlawful state.

(3) In order to safeguard the legal right to put an end to an unlawful state an injunction may be issued even if the requirements mentioned in sect. 381 EO are not fulfilled. This also applies to orders to make an entry about the dispute [Bestreitungsvermerk].

(4) Complaints and applications for injunctions pursuant to this Federal Act shall in the first instance be lodged with the regional civil court [Landesgericht] in whose district the data subject has his domicile or seat. The data subject may bring an action before the regional civil court in whose district the controller or processor [Dienstleister] has his domicile or seat.

(5) The Data Protection Commission [Datenschutzkommission] shall, in a case where there is probable cause to believe that a serious data protection infringement has been committed by a private sector controller, file an action for a declaratory judgement (sect. 228 ZPO [footnote 24]) [Feststellungsklage] in the court that is competent pursuant to para. 4 second sentence.

(6) On request of a data subject the Data Protection Commission shall, if such action appears necessary to safeguard the protected interests of a large number of data subjects pursuant to this Federal Act, intervene in the proceedings in support of the data subject as an intervening third party [Nebenintervenient] (sects. 17 et seq. of the Code of Civil Procedure).

Damages

Sect. 33 (1) A controller [Auftraggeber] or processor [Dienstleister] who has culpably used data contrary to the provisions of this Federal Act [Bundesgesetz], shall indemnify the data subject [Betroffener] pursuant to the general provisions of civil law. If data falling under the categories listed in sect. 18 para. 2 no. 1 to 3 are publicly used in a manner that violates a data subjects' interests in secrecy deserving protection that is suitable to expose that person in a like manner to sect. 7 para. 1 of the Media Act, Federal Law Gazette No. 314/1981, that provision shall be applied even if the public use of data [Datenverwendung] is not committed by publication in the media. The claim for appropriate compensation for the defamation suffered shall be brought against the controller of the data used.

(2) The controller or processor shall also be liable for damage caused by their staff, insofar as their actions was casual for the damage.

(3) The controller shall be free from liability if he can prove that the circumstances which caused the damage cannot be attributed to him or his staff (para. 2). This also applies to the exclusion of the processors' liability. In the case of contributory negligence on the part of the injured party or a person for whose conduct the injured party is responsible, sect. 1304 ABGB shall apply.

(4) Lawsuits according to para. 1 shall be brought before the court that is competent according to Sect. 32 para. 4.

Common Provisions

Sect. 34 (1) The right to lodge an application according to sect. 30, a complaint according to sect. 31 or legal action according to sect. 32 and claims for damages according to sect. 33 shall apply only if the charge is filed by the intervening party within a year after having gained knowledge of the incident that gave rise to the complaint and no later than three years after the alleged incident. This is to be communicated to the intervening party in the case of a late application according to sect. 30; late complaints according to sect. 31 or legal actions according to sect. 32 shall be dismissed.

(2) Applications according to sect. 30, complaints according to sect. 31 or legal action according to sect. 32 and claims for damages according to sect. 33 can be filed not only because of an alleged infringement of this Federal Act [Bundesgesetz], but also based on an infringement of data protection provisions of another member state of the European Union, insofar as these provisions are applicable in Austria according to sect. 3.

(3) If the alleged infringement of a data subjects interest in secrecy deserving protection is to be adjudicated in Austria by applying the national provisions of another member state of the European Union pursuant to sect. 3, the Data Protection Commission [Datenschutzkommission] shall ask the competent foreign supervisory authority for assistance.

(4) The Data Protection Commission shall render inter-authority assistance [Amtshilfe] to the independent supervisory authorities of the member states of the European Union upon request.

Part 7 - Control Bodies

Data Protection Commission and Data Protection Council

Sect. 35 (1) The Data Protection Commission [Datenschutzkommission] and the Data Protection Council [Datenschutzrat] shall safeguard data protection in accordance with the regulations of this Federal Act [Bundesgesetz] without prejudice to the competence of the Federal Chancellor [Bundeskanzler] and the courts of law.

(2) (Constitutional provision) The Data Protection Commission shall exercise its functions vis-á-vis the highest executive authorities enumerated in art. 19 B-VG

Composition of the Data Protection Commission

Sect. 36 (1) The Data Protection Commission [Datenschutzkommission] shall consist of six members appointed by the Federal President [Bundespräsident] on a proposal of the Federal Government [Bundesregierung] for a term of five years. Reappointments shall be permitted. All members shall have legal expertise. One member shall be a judge.

(2) The proposal of the Federal Government for the nomination of the members of the Data Protection Commission shall be prepared by the Federal Chancellor. The Federal Chancellor shall choose from

1. a proposal of three candidates by the President of the Supreme Court [Oberster Gerichtshof] for the judge,
2. a proposal of the states [Bundesländer] for two members,
3. a proposal of three candidates by the Federal Chamber of Labour [Bundeskammer für Arbeiter und Angestellte] for one member,
4. a proposal of three candidates by the Austrian Federal Economic Chamber [Wirtschaftskammer Österreich] for one member.

All proposed persons should have experience in the field of data protection.

(3) One member shall be proposed from the circle of federal officials with legal expertise.

(4) For every regular member an alternate member shall be appointed. The alternate member shall act in case the member is unable to fulfil his duties. The term of the alternate member shall expire with the end of the members term of office; if the term of the member ends prematurely para. 8 shall be applied.

(5) The following persons cannot be members of the Data Protection Commission:

1. members of the Federal Government [Bundesregierung] or of a State Government [Landesregierung] or Secretaries of State [Staatssekretäre];
2. persons who may not be elected for the National Council [Nationalrat].

(6) Where a member of the Data Protection Commission fails, without adequate excuse, to take part in three consecutive meetings or if one of the causes for exclusion specified in para. 5 arises after the appointment, the Data Protection Commission shall, after hearing the member concerned, decide on the matter. Such decision shall result in the loss of membership. In all other cases a member of the Data Protection Commission may only be deprived of his office on serious grounds and by a decision of the Data Protection Commission approved by at least three members. The term of office shall end when the member resigns from his function in a written statement to the Federal Chancellor.

(7) Para. 2, 3, 5 and 6 shall be applied to the alternate members the same way as to members.

(8) If membership ends because of death, voluntary resignation or in accordance with para. 6, the respective alternate member (para. 4) shall become a full member of the Data Protection Commission until the expiry of the term of the member he replaced. A new alternate member shall be appointed for that time according to para. 2 and 3. If an alternate member leaves prematurely, a new alternate member shall be appointed without delay.

(9) The members and alternate members of the Data Protection Commission shall be entitled to receive compensation for travel expenses (category 3) according to the regulations for federal officials. They shall furthermore be entitled to a compensation according to the amount of time and effort involved, the amount of which shall be determined in an ordinance of the Federal Government upon request of the Federal Chancellor.

Independence of the Data Protection Commission
(Constitutional Provision)

Sect. 37 (1) The members of the Data Protection Commission [Datenschutzkommission] shall be independent and not bound by instructions [Weisungen] in the exercise of their duties.

(2) The officials working in the office of the Data Protection Commission shall be bound only by instructions [Weisungen] of the chairman and the executive member [geschäftsführendes Mitglied] of the Data Protection Commission with regard to their professional work.

Organisation and Operation of the Data Protection Commission

Sect. 38 (1) (Constitutional Provision) The Data Protection Commission [Datenschutzkommission] shall adopt its own rules of procedure, in which one of its members shall be charged with directing the current business (executive member) [geschäftsführendes Mitglied]. This shall include rulings [Bescheide] on procedure and provisional rulings [Mandatsbescheide] in the course of the registration proceedings according to sect. 20 para. 2 and sect. 22 para. 3. Whether competent members of the office of the Data Protection Commission shall be authorised to act on behalf of the Data Protection Commission or the executive member [geschäftsführendes Mitglied], shall be laid down in the rules of procedure.

(2) The Federal Chancellor [Bundeskanzler] shall install an office and supply the necessary personnel and equipment to support the operation of the Data Protection Commission.

(3) The Data Protection Commission shall be heard before an ordinance based on this Federal Act [Bundesgesetz] is enacted or which otherwise directly concerns important issues of data protection.

(4) The Data Protection Commission shall compile a report about its activities at least every other year and publish it in an appropriate manner. The report shall be forwarded to the Federal Chancellor.

Decisions of the Data Protection Commission

Sect. 39 (1) The Data Protection Commission [Datenschutzkommission] shall be able to make decisions when all six members are present. Sect. 36 para. 4 shall apply when a member is unable to fulfil his duties.

(2) The judge shall preside.

(3) A valid decision of the Data Protection Commission shall require a majority of votes cast. In the case of a parity of votes the vote of the chairman shall decide the issue. An abstention from the vote is not permitted.

(4) Decisions of the Data Protection Commission that are of fundamental importance for the general public shall be published in an appropriate manner by the Data Protection Commission taking into account the requirements of official secrecy.

Effect of Rulings of the Data Protection Commission and the Executive Member

Sect. 40 (1) Rulings [Bescheide] of the executive member [geschäftsführendes Mitglied] of the Data Protection Commission [Datenschutzkommission] pursuant to sect. 20 para. 2 or sect. 22 para. 3 in conjunction with sect. 38 para. 1 are subject to appeal [Vorstellung] pursuant to sect. 57 para. 2 AVG. An appeal against a ruling [Bescheid] pursuant to sect. 22 para. 3. shall have suspensive effect.

(2) No regular remedy at law shall be permitted against rulings [Bescheide] of the Data Protection Commission. They are not subject to repeal or modification by administrative procedure. The parties shall have the right to bring the case before the Administrative Court [Verwaltungsgerichtshof] except in the case of para. 1. This also applies to public sector controllers that execute laws in those cases where they enjoy the rights of a party to the proceedings according to sect. 13 para. 3 or sect. 20 para. 6 or whenever the right to lodge a complaint with the Administrative Court has been granted by law.

(3) Rulings permitting the transborder transmission [Übermittlung] or committing of data [Überlassung] pursuant to sect. 13 shall be cancelled whenever the legal or factual prerequisites for granting a permit no longer apply, in particular as the result of a promulgation [Kundmachung] of the Federal Chancellor pursuant to sect. 55.

(4) If the Data Protection Commission has established that an infringement of provisions of this Federal Act [Bundesgesetz] by a public sector controller has taken place, said controller shall without delay and with all means at his disposal create the state expressed in the legal opinion of the Data Protection Commission.

Establishment and Duties of the Data Protection Council

Sect. 41 (1) A Data Protection Council [Datenschutzrat] is established at the Federal Chancellery [Bundeskanzleramt].

(2) The Data Protection Council shall advise the Federal Government [Bundesregierung] and the State Governments [Landesregierungen] on requests in political matters of data protection. For this purpose,

1. the Data Protection Council can deliberate on questions of fundamental importance for data protection;
2. the Data Protection Council shall be given opportunity to give its opinion on draft bills of Federal Ministries [Bundesministerien], insofar as these are significant for data protection;
3. public sector controllers shall present their projects to the Data Protection Council for evaluation, insofar as these are significant for data protection;
4. the Data Protection Council shall have the right to request information and documents from public sector controllers insofar as this is necessary to evaluate projects of significant impact on data protection in Austria;
5. the Data Protection Council may ask private sector controllers or their representations of interest established by law to give their opinion on developments of general importance that give cause for concern or at least call for attention from a data protection perspective;
6.the Data Protection Council may transmit its observations, concerns and suggestions for improvements of data protection in Austria to the Federal Government and the State Governments, as well as to the legislative bodies by way of these organs.

(3) Para. 2 sub-paras. 3 and 4 shall not apply insofar as the internal affairs of the churches and religious communities recognised by law are concerned.

Composition of the Data Protection Council

Sect. 42 (1) The Data Protection Council [Datenschutzrat] shall have the following members:

1. representatives of the political parties: The party that is most strongly represented in the Main Committee of the National Council [Hauptausschuß des Nationalrates] shall delegate four representatives, the second strongest shall delegate three members and all other parties represented in the Main Committee of the National Council shall delegate one member each. If the two parties that are most strongly represented in the National Council [Nationalrat] have an equal number of seats, each of said parties shall delegate three members;
2. one representative each from Federal Chamber of Labour [Bundeskammer für Arbeiter und Angestellte] and the Austrian Federal Economic Chamber [Wirtschaftskammer Österreich];
3. two representatives of the States [Länder];
4. one representative each of the Association of Austrian Municipalities [Gemeindebund] and the Austrian Association of Towns [Städtebund];
5. a member of the Federation [Bund] appointed by the Federal Chancellor [Bundeskanzler].

(2) The representatives mentioned in para. 1 sub-para. 3, 4 and 5 should have professional experience in the field of computer science and data protection.

(3) An alternate representative shall be nominated for every representative.

(4) Members of the Federal Government [Bundesregierung] or of a State Government [Landesregierung] or Secretaries of State [Staatssekretäre] as well as persons who may not be elected for the National Council [Nationalrat] shall not be members of the Data Protection Council [Datenschutzrat].

(5) The representatives shall be members of the Data Protection Council until they announce their resignation in writing to the Federal Chancellor [Bundeskanzler], or, if no resignation is announced, until the nominating body (para. 1) has named another representative to the Federal Chancellor.

(6) The members of the Data Protection Council shall serve in an honorary capacity. Members of the Data Protection Council living outside of Vienna shall be entitled to receive compensation for travel expenses (category 3) according to the regulations for federal officials, if they attend meetings of the Data Protection Council.

Chairmanship and Operation of the Data Protection Council

Sect. 43 (1) The Data Protection Council shall decide on its rules of procedure.

(2) The Data Protection Council [Datenschutzrat] shall elect a chairman and two vice chairmen. The term of office of the chairman and the vice chairmen shall be five years, without prejudice to sect. 42 para. 5. Reappointments shall be permitted.

(3) The Federal Chancellery [Bundeskanzleramt] shall be responsible for the operation of the Data Protection Council. The Federal Chancellor [Bundeskanzler] shall supply the necessary personnel. While working for the Data Protection Council, the officials of the Federal Chancellery shall be bound only by instructions [Weisungen] of the chairman of the Data Protection Council with regard to their professional work.

Meetings and Decisions of the Data Protection Council

Sect. 44 (1) The meeting of the Data Protection Council [Datenschutzrat] shall be convened by the chairman whenever the need arises. If a member requests that a meeting be convened, the chairman shall convene the meeting so that it can take place within four weeks.

(2) The chairman can bring experts into the meeting whenever the need arises.

(3) Deliberations and decisions of the Data Protection Council shall require the presence of at least half of its members. Decisions shall be passed by a simple majority of votes cast. In the case of a parity of votes, the vote of the chairman shall decide the issue. An abstention from the vote is not permitted. A dissenting opinion may be given.

(4) The Data Protection Council may create permanent or ad hoc working groups which it may entrust with the preparation, appraisal and handling of specific issues. An individual member (rapporteur) may be entrusted with executive work, the first appraisal and handling of specific issues.

(5) Every member of the Data Protection Council must - except in case of justifiably being prevented - attend the meetings of the Council. A member who is unable to attend shall inform his alternate member without delay.

(6) Members of the Data Protection Commission [Datenschutzkommission] who are not members of the Data Protection Council shall have the right to attend meetings of the Council or its working groups. They shall have no right to vote.

(7) The deliberations of the Data Protection Council shall be confidential as long as the Council itself does not decide otherwise.

(8) The members of the Data Protection Council, the members of the Data Protection Commission and experts brought into the meeting according to para. 2 shall be obliged to keep all information confidential of which they have learned solely due to their activities for the Data Protection Council, insofar as secrecy is required in the public interest or in the interest of a party.

Part 8 - Special Purposes of Data

Private Purposes

Sect. 45 (1) Natural persons shall be permitted to process data for purely personal or family matters that have been disclosed to them by the data subject [Betroffener] himself or that they have received in a lawful manner, in particular in accordance with sect. 7 para. 2.

(2) Data that are processed by a natural person for purely personal or family matters shall be transmitted for another purpose only with the consent of the data subject, unless expressly provided for otherwise by law.

Scientific Research and Statistics

Sect. 46 (1) For the purpose of scientific or statistical research projects whose goal is not to obtain results in a form relating to specific data subjects [Betroffene], the controller [Auftraggeber] shall have the right to use all data that

1. are publicly accessible or
2. the controller has lawfully collected for other research projects or other purposes or
3. are only indirectly personal for the controller.

Other data shall only be used under the conditions specified in para. 2 sub-paras. 1 to 3.

(2) In case of the use of data [Datenverwendung] for purposes of scientific research or statistics that do not fall under para. 1, data which are not publicly accessible shall be used only

1. pursuant to specific legal provisions or
2. with the consent of the data subject [Betroffener] or
3. with a permit of the Data Protection Commission [Datenschutzkommission] pursuant to para. 3.

(3) A permit of the Data Protection Commission for the use of data for purposes of scientific research or statistics shall be granted if

1. the consent of the data subjects is impossible to obtain because they cannot be reached or the effort would otherwise be unreasonable and
2. there is a public interest in the use of data for which a permit is sought and
3. the professional aptitude of the applicant has satisfactorily been demonstrated.

In case sensitive data are to be transmitted, an important public interest in the research must exist; furthermore, it must be ensured that at the recipient the data shall only be used by persons who are subject to a statutory duty to confidentiality or whose reliability in this respect is otherwise credible. The Data Protection Commission may issue its permit subject to terms and conditions insofar as this is necessary to safeguard the data subjects' interests deserving protection, in particular, with regard to the use of sensitive data.

(4) Legal restrictions on the right to make use of data [Datenverwendung] for other reasons, in particular copyright, shall not be affected.

(5) Even in those cases where the use of data in a form which permits identification of data subjects is legal for purposes of scientific research or statistics, the data shall be coded without delay so that the data subjects are no longer identifiable if specific phases of scientific or statistic work can be performed with indirectly personal data only. Unless expressly laid down otherwise, data in a form which permits identification of data subjects shall be rendered unidentifiable as soon as it is no longer necessary for scientific or statistic work to keep them identifiable.

Transmission of Addresses to Inform or Interview Data Subjects

Sect. 47 (1) Unless provided for otherwise by law, the transmission [Übermittlung] of address data of a certain group of data subjects [Betroffene] in order to inform or interview them shall require the consent of the data subjects.

(2) If an infringement of the data subject's interests in secrecy is unlikely, considering the selection criteria for the category of data subjects [Betroffenenkreis] and the subject of the information or interviews, no consent shall be required if

1. data from the same controller are used or
2. in case of an intended transmission of address data to third parties
a. there is an additional public interest in the information or interviewing or
b. the data subject, having received an adequate information about the cause for and content of the transmission, has not objected to the transmission within a reasonable period of time.

(3) If the prerequisites of para. 2 are not met and if obtaining the consent of the data subjects' pursuant to para. 1 would require an unreasonable effort, the transmission of the address data shall be permissible with a permit of the Data Protection Commission [Datenschutzkommission] pursuant to para. 4, in case the transmission to third parties shall be performed for

1. the purpose of information or an interview due to an important interest of the data subject himself
2. an important public interest in the information or interviews or
3. an interview of the data subjects for reasons of scientific research and statistics.

(4) The Data Protection Commission shall grant the permit for the transmission if the controller has satisfactorily demonstrated that one of the requirements in para. 3 applies and no overriding interests in secrecy deserving protection on the part of the data subject are an obstacle to the transmission. The Data Protection Commission may issue the permit subject to terms and conditions, insofar s this is necessary to safeguard the data subjects' interests deserving protection, in particular, with regard to the use of sensitive data as selection criterion.

(5) The transmitted address data shall only be used for the permitted purpose and shall be erased as soon as they are no longer needed for information or interviews.

(6) In those cases where it is lawful to transmit the names and addresses of persons belonging to a certain category of data subjects pursuant to the aforementioned provisions, the processing required for selecting the address data to be transmitted shall also be permitted.

Journalistic Purposes

Sect. 48 (1) Insofar as media companies, media services and their operatives use data directly for journalistic purposes according to the Media Act [Mediengesetz], only sects. 4 to 6, 10, 11, 14 and 15 of the non-constitutional provisions of this Federal Act [Bundesgesetz] shall apply.

(2) The use of data [Datenverwendung] for activities pursuant to para. 1 shall be legal insofar as this is required to fulfil the information requirements of the media companies, media services and their operatives in exercise of the right to free speech pursuant to art. 10 para. 1 of the European Convention on Human Rights.

(3) In all other respects the Media Act [Mediengesetz] shall apply, especially the third part about the protection of personality rights.

Data Processing in the Event of a Catastrophe

Sect. 48a (1) Public sector controllers are authorized to use personal data in the event of a catastrophe, so far it is necessary for rendering assistance for the persons directly affected by the catastrophe, for the location and identification of missing and deceased persons and for informing the relatives. Relief organizations (para. 6) are also authorized to use personal data for this purpose in accordance with their respective tasks and legal powers. If this is necessary for dealing with the catastrophe rapidly, a use of data may take place in form of participation in a joint information system. Whoever rightfully possesses data, may transfer those data to public sector controllers or relief organizations, as far as it is necessary for coping with the catastrophe or for the other purposes mentioned. The data are to be deleted immediately, if they are no longer needed for the fulfillment of the concrete purposes.

(2) Transmission or comitting data abroad is permitted as far as this is necessary for the fulfillment of a purpose set out in para. 1. If this is necessary dealing with the catastrophe rapidly, a use of data by the public sector controller or the relief organization may take place in form of participation in a joint information system, in which foreign controllers participate. Transmission of criminal identification [erkennungsdienstlicher] and sensitive data for identification purposes to a such system shall take place only if investigations show concrete indications that the missing person might have deceased. Data that in itself can lead to establishing the criminal liability of the data subject shall not be transferred, unless it is absolutely necessary for the identification in the individual case. Transfer of data of relatives shall take place only in pseudonymized form. Transmission or committing data to states without an adequate level of protection may take place if the controller can assume (based on a written promise of the recipient or a written agreement concluded with the recipient, or - if under the given circumstances no such promise or agreement can be made - by giving instructions for the recipient), that the interests of secrecy deserving protection of the data subjects affected by the planned data traffic are adequately protected in abroad as well. A transmission or committing has to be stopped, if there are reasons to suppose that the recipient will not take care about the necessary protection of the secrety interests of the data subjects, or will disregard the explicit data protection legal instructions of the controller. During the catastrophe, a licence is not required pursuant to sect. 12 para. 3 sub-para. 3. However, the Data Protection Commission is to be informed without delay about the initiated transmissions and committings, and the specific circumstances of the situation that made them necessary. The Data Protection Commission may prohibit data transmissions or commissions in order to protect the rights of the data subjects, if the invasion to the right to data protection caused by the transfer is not justified by the specific circumstances of the catastrophe.

(3) On the basis of a concrete inquiry from a close relative of a person presumably or actually directly affected by the catastrophe, data controllers are authorized to trasmit data about journeys to and from the territory affected by the catastrophe, about staying in the territory affected by the catastrophe and about the state of the investigation on the persons affected by the catastrophe, if the relative discloses the following data:

1. first name and surname, date of birth and living address of the person presumably or actually affected by the catastrophe;
2. his own first name and surname, date of birth, and living address and other contact information, and his relationship to the person affected by the catastrophe.

In case of a doubt concerning the relationship, if cannot be resolved through verification, a proof of identity and the relationship is required.

(4) Apart from sect. 3, public sector controllers or relief organizations shall transmit data of persons presumably or actually directly affected by the catastrophe (including personal data) to close relatives only if they can prove their identity and the relationship, and the information is necessary for the protection of their rights or those of a person affected. Social security providers [Sozialversicherungsträger] are obliged to help public sector controllers and relief organizations in verifying the data pursuant to para. 3 and the relationship. Authorities are authorized to obtain the data necessary for the verification of this information by means of inter-authority assistance and to use them for this purpose.

(5) For the purposes of this provision, close relatives are the parents, the children, spouse and cohabitant of the person affected. Other relatives may receive the mentioned information under the same conditions as close relatives if they are able to satisfactory show a special close relationship [besondere Nahebeziehung] with the person presumably or actually directly affected by the catastrophe.

(6) For the purposes of this provision, a relief organization is a generally accepted nonprofit organization with the goal of providing help for people set out in a statute or in a bye-law, that can be assumed to be able to furnish significant assistance in the event of a catastrophe.

(7) All uses of data shall be logged pursuant to sect. 18 para. 2 sub-para 7.

(8) The permissibility of data uses based on other facts mentioned in sect. 8 and 9 remains unaffected.

Part 9 - Special Uses of Data

Automated Individual Decisions

Sect. 49 (1) Nobody shall be subjected to a decision that produces legal effects concerning him or adversely affects him in a significant manner which is based solely on automated processing of data intended to evaluate certain personal aspects relating to him, for example his performance at work, creditworthiness, reliability and conduct.

(2) Deviating from para. 1, a person may be subjected to a decision based solely on automated processing if

1. this is expressly authorised by law or
2. the decision is taken in the course of the entering into or performance of a contract, and the request of the data subject [Betroffener] for the entering into or the performance of the contract has been satisfied or
3. the legitimate interests of the data subject are safeguarded by appropriate means - such as arrangements allowing him to assert his point of view.

(3) Upon request, the data subject shall in case of automated decisions be informed of the logical procedure of the automated decision in an intelligible form.

Joint Information Systems

Sect. 50 (1) The controllers [Auftraggeber] of a joint information system [Informationsverbundsystem] shall, unless already regulated by law, appoint a suitable operator [Betreiber] for the system. The name (designation) and address of the operator shall be included in the notification for registration in the Data Processing Register [Datenverarbeitungsregister]. Without prejudice to the data subject's rights pursuant to sect. 26, the operator shall give to the data subject [Betroffener] upon request within twelve weeks all information necessary to identify the controller who is responsible for the data processed in the system concerning him; in cases where the controller would have to apply sect. 26 para. 5, the operator shall inform the data subject that no controller obligated to give the information can be named. The operator's obligation to assist shall also apply in case of requests by public authorities. The operator shall also be responsible for the necessary data security measures (sect. 14) in the joint information system. The operator can free himself of liability under the conditions laid down in sect. 33 para. 3. If a joint information system is operated and no appropriate notification with an appointed operator is filed with the Data Processing Register, each controller shall have to bear the obligations of the Operator.

(2) Further controller duties may be assigned to the operator by an appropriate legal instrument. Unless realised by statute, such assignment of obligations shall only be valid vis-à-vis the data subject and the public authorities that execute this Federal Act [Bundesgesetz] if the assignment is recorded in the Data Processing Register [Datenverarbeitungsregister] following an appropriate notification to the Data Protection Commission [Datenschutzkommission].

(3) The provisions of para. 1 and 2 shall not apply if provided for otherwise by law due to the special, in particular, international structure of a specific joint information system.

Part 10 - Penal Provisions

Use of Data with the Intention to make a Profit or to Cause Harm

Sect. 51 (1) Whoever uses personal data that have been entrusted to or made accessible to him solely because of professional reasons, or that he has acquired illegally, for himself or makes such data available to others or publishes such data with the intention to make a profit or to harm others, despite the data subject's interest in secrecy deserving protection, shall be punished by a court with imprisonment up to a year, unless the offence shall be subject to a more severe punishment pursuant to another provision.

(2) The offender shall be prosecuted only with the authorisation of the injured party.

Administrative Penalties

Sect. 52 (1) Insofar as the act does not realise the legal elements of a criminal offence subject to the jurisdiction of the courts of law and is not subject to more severe penalties according to another administrative provision, an administrative offence punishable by a fine of up to 18 890 Euro is committed by anyone who

1. intentionally and illegally gains access to a data application [Datenanwendung] or maintains an obviously illegal means of access or
2. transmits data intentionally in violation of the rules on confidentiality (sect. 15), and in particular anybody who uses data entrusted to him according to sect. 46 and 47 for other purposes or
3. uses or fails to grant information, to rectify or erase data in violation of a final judicial decision or ruling [Bescheid],
4. intentionally erases data in violation of sect. 26 para. 7,
5. intentionally obtains data pursuant to sect. 48a by using false information.

(2) Insofar as the act does not realise the legal elements of a criminal offence subject to the jurisdiction of the courts of law, an administrative offence punishable by a fine of up to 9 445 Euro is committed by anyone who

1. collects, processes and transmits data without having fulfilled his obligation to notify according to sect. 17 or
2. engages in transborder data transmissions [Übermittlungen] or committings [Überlassungen] without the necessary permit of the Data Protection Commission [Datenschutzkommission] according to sect. 13 or
3. violates his obligations of disclosure and information according to sects. 23, 14 and 25 or
4. grossly neglects the required data security measures according to sect. 14.

(3) Attempts shall be punished.

(4) Data media or programs can be confiscated (sects. 10, 17 and 18 VStG), if they are linked to an administrative offence according to para. 1 and 2.

(5) The District Administrative Authority [Bezirksverwaltungsbehörde] at the controllers [Auftraggeber] (processors [Dienstleister]) domicile or seat shall be the competent authority for decisions according to para. 1 to 4. If there is no domicile or seat in Austria, the District Administrative Authority at the seat of the Data Protection Commission [Datenschutzkommission] shall be competent.

Part 11 - Transitional and Final Provisions

Exemption from Fees

Sect. 53 (1) All applications submitted according to this Federal Act [Bundesgesetz] by data subjects [Betroffener] to safeguard their interests as well as all applications in the proceedings for notification and for register statements according to sect. 21 para. 3 shall be exempt from stamp duties and federal administrative fees.

(2) No fee shall be charged for copies of entries in the Data Processing Register [Datenverarbeitungsregister] needed by a data subject to assert his rights.

Communication to the European Commission and to the other Member States of the European Union

Sect. 54 (1) The Federal Chancellor [Bundeskanzler] shall communicate to the European Commission whenever a Federal Act [Bundesgesetz] concerning the right to process sensitive data has been adopted upon its promulgation in the Federal Law Gazette [Bundesgesetzblatt].

(2) The Data Protection Commission [Datenschutzkommission] shall communicate to the other member states of the European Union and the European Commission in which cases

1. no permit was issued for transborder data flows to a third country because the requirements of sect. 13 para. 2 sub-para 1 were considered not to have been met;
2. a permit was issued for transborder data flows to a third country without an adequate level of data protection because the requirements of sect. 13 para. 2 sub-para 2 are deemed to have been met.

Measures of the European Commission

Sect. 55 The content of findings of the European Commission made according to Art. 31 para. 2 of the Directive 95/46/EC of the European Parliament and the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Official Journal L 281, 23 November 1995 p. 0031, on

1. whether a third country has an adequate level of data protection or
2. the suitability of certain standard contractual clauses or pledges to safeguard sufficient protection to the use of data [Datenverwendung] in a third country

shall be promulgated by the Federal Chancellor [Bundeskanzler] in the Federal Law Gazette according to sect. 2 para. 3 BGBlG, Federal Law Gazette No. 660/1996.

Administrative Matters pursuant to Art. 30 of the Federal Constitution

Sect. 56 The President of the National Council [Nationalrat] is the controller [Auftraggeber] of such data applications [Datenanwendungen] for purposes of such matters with which he has been entrusted pursuant to art. 30 B-VG. Transmissions of data [Übermittlungen] from such data applications shall only take place if ordered by the President of the National Council. The President shall make provisions that in case of a transmission order the requirements of sect. 7 para. 2 are met and, in particular, that the consent of the data subject [Betroffener] is obtained in such cases where it is necessary pursuant to sect. 7 para. 2 for lack of another legal basis for the transmission.

Gender-Neutral Use of Language

Sect. 57 Insofar as expressions relating to natural persons in this article are given only in the male form, they shall apply to males and females equally. When the expressions are applied to specific natural persons, the form specific to the gender shall be used.

Manual Filing Systems

Sect. 58 Insofar as manual filing systems, i.e., filing systems [Dateien] managed without automatic processing, exist for such purposes and fields where the Federation [Bund] has the power to pass laws, they are deemed to be data applications [Datenanwendungen] according to sect. 4 sub-para. 7. Sect. 17 shall apply insofar as the obligation to notification applies only to those filing systems whose content is subject to prior checking [Vorabkontrolle] according to sect. 18 para. 2.

Implementation Notice

Sect. 59 This Federal Act [Bundesgesetz] implements the Directive 95/46/EC of the European Parliament and the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Official Journal L 281, 23 November 1995 p. 31.

Entry into Force

Sect. 60 (1) (Constitutional Provision) The constitutional provisions of art. 1, sects. 35 para. 2, 37, 38 para. 1 as well as 61 para. 4 and 7 shall enter into force on 1 January 2000. With the entry into force of this Federal Act [Bundesgesetz] the Datenschutzgesetz, Federal Law Gazette No. 565/1978, shall become ineffective.

(2) The other provisions of this Federal Act shall enter into force on 1 January 2000 as well.

(3) Sects. 26 para. 6 and 52 para. 1 and 2 as formulated in the federal law published in Federal Law Gazette I No. 136/2001 shall enter into force on 1 January 2002.

Transitional Provisions

Sect. 61 (1) Notifications that were made to the Data Processing Register [Datenverarbeitungsregister] before this Federal Act [Bundesgesetz] entered into force shall count as notifications according to sect. 17, insofar as they have not become irrelevant because the obligation to notify is no longer applicable. Likewise, registrations made before this Federal Act entered into force shall count as registrations according to sect. 21.

(2) Insofar as the law as it now stands requires a permit for transborder data transmission [Übermittlung], an application for a new permit must be filed before 1 January 2003 for such transmissions for which a permit was granted prior to this Federal Acts entry into force. If the application is filed in time, such transmissions may be carried out until the final decision about the application for the permit.

(3) Data protection violations that have taken place before this Federal Act entered into force shall, insofar as the legality or illegality of a set of facts is concerned, be adjudicated according to the legal provisions in force at the time the act was committed; insofar as an obligation to act or a forbearance is concerned, the law as its stands at the time when the decision of first instance is rendered shall be applied. A criminal offence shall be adjudicated according to the law that is more favourable to the offender overall; this also extends to appeal proceedings.

(4) (Constitutional Provision) Data applications [Datenanwendungen] that are required for the purposes laid down in sect. 17 para. 3 may be continued even without a sufficient legal basis in terms of sect. 1 para. 2 until 31 December 2007, in the cases of sect. 17 para. 3 sub-para. 1 to 3 until federal regulations covering the functions and powers in these fields are enacted.

(5) Manual filing systems subject to notification according to sect. 58 shall be notified to the Data Processing Register no later than 1 January 2003, provided they already existed when this Federal Act entered into force. The same shall apply to automated data applications according to sect. 17 para. 3 that were made subject to notification by the new regulations.

(6) The Data Protection Commission [Datenschutzkommission] in office at the time this Federal Act enters into force shall carry out all functions of the Data Protection Commission according to sect. 35 for six months after this Federal Act has entered into force.

(7) (Constitutional Provision) Insofar as individual provisions contain references to the Data Protection Act [Datenschutzgesetz], Federal Law Gazette No. 565/1978, such provisions shall be valid by analogous application until adjusted to conform to this Federal Act. Enactment of Ordinances Sect. 62 Ordinances [Verordnungen] based on this Federal Act [Bundesgesetz] in the current version in force may already be enacted as of the day following the promulgation of the legal provision to be implemented; they shall, however, not enter into force before the statutory provisions which are to be implemented. References

Sect. 63 Insofar as provisions of this Federal Act [Bundesgesetz] refer to provisions of other Federal Acts, these shall be applied in the current version in force. Execution

Sect. 64 The Federal Chancellor [Bundeskanzler] and the other Federal Ministers [Bundesminister] within their purview shall execute this Federal Act [Bundesgesetz] insofar as the execution has not been entrusted to the Federal Government [Bundesregierung] or to the State Governments [Landesregierungen].

Page last modified on March 27, 2007, at 04:04 PM
Copyright © András Jóri 2006-2007 (unless otherwise stated). All rights reserved. Theme by Theron Parlin - wiki