Deletion of personal data used in a public data application
According to § 28.2 of the Data Protection Act (Datenschutzgesetz), if personal data are used in a public data application, the data subject has the right to object to this use at any time without the need to give reasons. If such an objection is raised, the controller of the application has to erase the data within eight weeks.
The applicant before the Constitutional Court runs an internet portal listing practising doctors in Austria. For each doctor there is an own site covering the name, practice address and telephone number, contractual relationship with health insurance funds, office hours, and certificates of the Austrian General Medical Council (Ärztekammer). Users can search for these data and, if they are logged in, they can publish evaluations and reports of their experiences regarding the individual doctor.
In a proceeding before the civil courts, a medical doctor had brought an action against the applicant, seeking the omission of the publication on the applicant’s website or any other processing of further specified data as well as the erasure of these data from the applicant’s website.
The applicant (as defendant in this proceeding) filed a complaint with the Constitutional Court. He claimed that § 28.2 of the Data Protection Act was in contradiction with Article 10 ECHR.
The Constitutional Court held that § 28.2 of the Data Protection Act interfered with the right to freedom of expression and information as laid down in Article 10 ECHR.
The obligation to erase personal data upon objection aimed at protecting the rights of the person concerned; thus, it served a legitimate aim under Article 10 ECHR. However, § 28.2 of the Data Protection Act granted the person concerned the absolute right to object to a data application without allowing the courts to strike a fair balance between the rights of the person and the interests of the controller of the application or those of the recipients. In particular, the provision at issue did not permit to consider the individual circumstances of the case; e.g., whether the information to be erased concerned the role of the data subject in public life. However, a weighing of conflicting interests is constitutionally required by Article 10.2 ECHR.
As a result, the Constitutional Court repealed § 28.2 of the Data Protection Act as contrary to Article 10 ECHR.