[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbK2B0fNxdBZFWeg1fwuQQPi6xTxnVfvN1fCs7dBfBFw":3},{"article":4,"iocs":54},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":28,"category":29,"article_tags":33},"648e2dd1-2d7f-410d-a8d1-3f999861ede3","BVwG - W137 2327171-1","bvwg-w137-2327171-1-0c5fc0","Created page with \"{{COURTdecisionBOX |Jurisdiction=Austria |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=BVwG |Court_Original_Name=Bundesverwaltungsgericht |Court_English_Name=Federal Administrative Court |Court_With_Country=BVwG (Austria) |Case_Number_Name=W137 2327171-1 |ECLI=ECLI:AT:BVWG:2026:W137.2327171.1.00 |Original_Source_Name_1=RIS |Original_Source_Link_1=https:\u002F\u002Fwww.ris.bka.gv.at\u002FDokument.wxe?ResultFunctionToken=ce7470f0-c384-4930-a6d3-cb73a966edef&Position...\" Show changes","An Austrian court has upheld a decision by the Data Protection Authority (DPA) against a controller who published an unredacted court judgment on social media. The judgment named a senior legal counsel in connection with an employment dispute. The DPA found that publishing the judgment without redacting the data subject's name violated her right to secrecy under the Austrian Data Protection Act, as anonymizing her name would have been an equally effective and less intrusive measure.","Austrian court upholds DPA decision against controller for publishing unredacted judgment.","Help BVwG - W137 2327171-1: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 15:29, 2 August 2026 view source Stella (talk | contribs)10 edits Tag: Decisions [1.0] (No difference) Latest revision as of 15:29, 2 August 2026 BVwG - W137 2327171-1 Court: BVwG (Austria) Jurisdiction: Austria Relevant Law: Article 4(1) GDPR Article 4(2) GDPR Article 4(7) GDPR Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 5(1)(f) GDPR Article 5(2) GDPR Article 6(1)(f) GDPR Article 9(1) GDPR Article 10 GDPR Article 85 GDPR Article 6(1) ECHRArticle 8(2) ECHRArticle 10 ECHRArticle 47 CFR§1(1) DSG§1(2) DSG§9 DSG[www.ris.bka.gv.at\u002FGeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597 §24(1) DSG][bka.gv.at\u002FGeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597 §24(5) DSG][bka.gv.at\u002FGeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597 §24(7) DSG]§27 DSG Decided: 08.07.2026 Published: 23.07.2026 Parties: X Austrian Data Protection Authority National Case Number\u002FName: W137 2327171-1 European Case Law Identifier: ECLI:AT:BVWG:2026:W137.2327171.1.00 Appeal from: DSBD124.0891\u002F25, 2025-0.833.293 Appeal to: Unknown Original Language(s): German Original Source: RIS (in German) Initial Contributor: stella A court upheld a DPA decision finding that a controller violated a data subject's right to secrecy by publishing an unredacted court judgment naming her on social media, since anonymising her name would have been an equally effective. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The controller, an assistant professor at a private university (the appellant), was engaged in an employment dispute with her university employer before a labour and social court. The data subject, a senior legal counsel employed by the university gave testimony as a witness in that employment proceeding. On 23 January 2025, the labour and social court ruled in the controller's favour, finding that her employment relationship continued beyond the university's purported termination date. The judgment referred to the data subject several times by her title and surname in connection with her witness testimony. In April 2025, the controller published the unredacted judgment in full including the data subject's title and surname on social media. She shared a downloadable link (first via Dropbox, later via Adobe) on her public Facebook profile and in a closed Facebook group of around 230 members connected to the university community. The files were later removed by Dropbox and Adobe after the data subject reported them. The data subject's full first name and additional details could also be found by combining her title and surname with the university's name in a Google search, which surfaced her LinkedIn profile. The data subject filed a complaint with the Austrian DPA, arguing that the controller had no justification for naming her and had drawn her into a public dispute with her employer. The controller argued that the judgment concerned matters of wider relevance to university staff, that the Facebook group was closed and that the data subject's name and role were already public via the university directory and LinkedIn. On 15 October 2025, the DPA upheld the complaint, finding that the controller had violated the data subject's right to secrecy under §1(1) of the Austrian Data Protection Act (DSG) by publishing the judgment without legal basis. The DPA found that a legitimate interest existed in principle, but that both publications were excessive the judgment was made accessible to an uninvolved and disproportionately wide audience and disclosing the data subject's name was not necessary to achieve the controller's stated purpose of informing colleagues in similar situations. The DPA noted that publishing the judgment with the data subject's name redacted would have been an equally effective, less intrusive alternative. The controller appealed, arguing that the data subject had no protectable secrecy interest because she had participated in the proceeding in a public professional capacity and had made comparable information about herself public on LinkedIn and that the DPA had failed to weigh her freedom of expression rights under Article 10 ECHR against the data subject's secrecy interest. Holding The court dismissed the appeal in full and confirmed the DPA's decision. First, the court rejected the controller's argument that no protectable secrecy interest existed because the data subject had acted in a professional capacity. It held that, under settled national case-law, appearing in a professional role does not by itself remove a person's right to secrecy under §1(1) DSG. Second, applying the three-part test for legitimate interest under Article 6(1)(f) GDPR, the court accepted that the controller had, in principle, a legitimate interest in informing colleagues in comparable employment situations about the judgment. However, it held that publishing the data subject's name failed the necessity requirement under this test and therefore also breached the data minimisation principle under Article 5(1)(c) GDPR. The court noted that the data subject was a witness testifying about legal matters, not the person responsible for the controller's employment contract and that naming her added nothing to the comprehensibility or persuasive value of the information the controller sought to share. Because necessity was lacking, the court found it unnecessary to conduct any further balancing of the parties' respective rights. Third, the court rejected the controller's argument, based on the CJEU's Buivids judgment (C-345\u002F17), that her freedom of expression justified full disclosure. It held that Buivids concerned processing carried out solely for journalistic purposes, which was not the situation here. It further held that §9 DSG, which implements Article 85 GDPR for journalistic activity, did not apply for the same reason, and did not eliminate the requirement of proportionality in any case. Finally, the court agreed with the DPA that redacting the data subject's name and title would have been an equally effective and only minimally burdensome alternative that would not have undermined the controller's informational purpose and held that the controller had not plausibly explained why such redaction would have been insufficient. The court accordingly found no unlawfulness in the DPA's decision and dismissed the appeal. It declared that an appeal on points of law (Revision) was not admissible, since the case did not raise a legal question of fundamental importance and was consistent with existing case-law. Comment This decision illustrates that data minimisation can resolve a legitimate-interest assessment under Article 6(1)(f) GDPR at the necessity stage, without requiring a full balancing of competing rights, where a less intrusive alternative (redaction) would serve the controller's purpose equally well. Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Date of Decision July 8, 2026 Legal Basis B-VG Art. 133, para. 4 DSG § 1 DSG § 24 DSG §24(1) DSG §24(5) DSG §9(1) GDPR Art. 4 GDPR Art. 5 GDPR Art. 6 GDPR Art. 6(1)(f) VwGVG §28(2) B-VG Art. 133 (current version); B-VG Art. 133 effective from January 1, 2019, through May 24, 2018; last amended by BGBl. I No. 138\u002F2017 B-VG Art. 133 effective as of January 1, 2019, last amended by Federal Law Gazette I No. 22\u002F2018 B-VG Art. 133 effective from May 25,May 2018 through December 31, 2018; last amended by Federal Law Gazette I No. 22\u002F2018; B-VG Art. 133, effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164\u002F2013, B-VG Art. 133, effective from Jan. 1, 2014, through July 31, 2014, ","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=BVwG_-_W137_2327171-1&diff=52568&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-08-02T15:29:04+00:00","2026-08-02T16:00:12.774331+00:00",7,[18,21,23,25],{"name":19,"type":20},"Facebook","product",{"name":22,"type":20},"Dropbox",{"name":24,"type":20},"Adobe",{"name":26,"type":27},"Austrian Data Protection Authority","vendor","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":28,"icon":30,"name":31,"slug":32},null,"Privacy Fines","privacy-fines",[34,39,44,49],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":50},{"id":51,"icon":30,"name":52,"slug":53},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[]]