- The Federal Administrative Court states that a specifically named, attributable natural person (de facto offender) is required to punish a legal entity.
- The direct applicability of ECJ competition law principles to Art. 83 GDPR is rejected; official procedures must ensure sufficient concretization and rights of defense.
The Austrian data protection authority had imposed a fine of EUR 4 800 for failure to delete video recordings. The fined responsible party had challenged the fine decision before the Federal Administrative Court (FAC).
The BVG held in its Decision from August 19, 2019 first notes the following in this regard:
The Punishment of the legal person under the provision in question presupposes that a person who has given it attributable natural person (leader) committed a criminal offense has. […]
The main question was whether the data protection supervisory authority (DPA) had a was allowed to impose a fine without specifically naming the employee who was responsible for the initiating act. The DSB wanted to dispense with this, partly on the basis of principles of competition law:
The DPA dealt with this issue in an opinion […], in which she first referred to a brief […] in another proceeding […]. It summarizes that, on the basis of the GDPR, any act of persons acting within the framework of a legal person is imputable to the legal person. It is irrelevant which employee was involved in this case.. […] In its opinion […], the DPA further states that Art. 83 GDPR substantively competition law regulations modeled on which is why the relevant case law of the ECJ on Article 15 of Regulation No. 17/1962 and Article 23 of Regulation No. 1/2003 must be applied. It follows from this – in summary in this case – that a Concrete naming of a natural person who is alleged to have acted culpably within the company or is to be held responsible for a possibly faulty organization not necessary (cf. ECJ, judgment of 18.09.2003, C‑338/00 P, and further ECJ, judgment of 23.01.2014, T‑391/09, as well as the Opinions on Cases C‑204/00 P and C‑280/06).
The BVG rejects this view – rather, the concrete designation of the de facto responsible offender is required:
The proceedings cited in the Opinion refer to competition law proceedings conducted by the Commission, i.e. at the level of European law using its own – also procedural – Specifications of the regulations cited above. In contrast, Art. 83(8) GDPR states that the exercise of the supervisory authority’s powers shall be subject to appropriate procedural safeguards in accordance with the Union law and the Member State law including effective judicial remedies and due process must be subject to. In the opinion of the Federal Administrative Court, this precludes the direct applicability of the principles of jurisdiction of the European courts with regard to competition law. […] from. […] Therefore, it must be stated in the result that not a sufficiently concrete accusation of an offense in the official proceedings. can be assumed.
Rather, it would be necessary to specifically name the de facto responsible person(s):
In addition, it should not be overlooked in this context that the complaint of the LPD of XXXX 2018 already states that the waitress working there at that time had stated to the police officers that the boss of the company was Mr. XXXX [and thus the shareholder or the managing director under commercial law]. In the administrative court proceedings conducted so far, it finally also turned out that the Actual influence and control of the persons involved with regard to the complainant with the information from the company register not sufficiently concrete and not presented according to reality has been made. As a result, it must be assumed that the following no sufficient concretization of the accusation of the crime in the official proceedings, since it is not clear from the latter which person’s conduct should have been attributed to the complainant. Thus, however, the exercise of essential rights of defense of the accused in the proceedings no longer seems to be sufficiently guaranteed.
For this purpose you will find here a contribution by Michael Suda, who works at the DSB.