Category: Austria

As in all EU member states, the EU General Data Protection Regulation (GDPR) came into effect in Austria on 25 May 2018. The centrepiece of Austria’s GDPR implementing legislation was the Data Protection Amendment Act 2018 (for further details please see “Draft Data Protection Amendment Act 2018 in appraisal” and “Proposals to alter national Data Protection Act”).

In addition to the Data Protection Amendment Act 2018, the Austrian federal legislature developed a broad approach to reconcile Austrian legislation with the GDPR and adjusted more than 230 ordinary laws. Further, the Data Protection Authority (DPA) issued two ordinances. Pursuant to Articles 35(4) and 35(5) of the GDPR, the DPA published a whitelist (BGBl II 2018/108) and a blacklist (BGBl II 2018/278) of processing operations which are subject to data protection impact assessments. Notably, processing activities not covered by these lists remain subject to the controller’s independent assessment.

Further, legislators from the nine Austrian provinces adopted data protection amendment acts to achieve GDPR compliance. These legislative acts will not be addressed here.

Federal data protection legislation

General

In two major pieces of legislation, 227 administrative legal acts were amended. The first Administrative Acts Data Protection Amendment Act 2018 (BGBl I 2018/32) was limited to the public sector. The second Administrative Acts Data Protection Amendment Act 2018 (BGBl I 2018/37) mostly addressed private sector governance. The second act is directed at:

• the finance sector;
• the health and social sectors; and
• the transport, innovation and technology sectors.

Restrictions

Particularly in the health sector, data subjects’ rights were restricted based on Article 23(1)(e) of the GDPR. For instance, most healthcare professions were excluded from the rights and duties under Articles 13, 14, 18 and 21 of the GDPR. Moreover, data subjects’ rights with regard to personal data that is collected by certain healthcare professionals and further processed for scientific or historical research purposes can be restricted. Data controllers may exclude data subjects’ rights pursuant to Articles 15, 16, 18 and 21 of the GDPR if the specific purpose for which the data is being processed may be impaired otherwise.

Science and research

Legislation was also passed to amend 17 administrative acts in the science and research sector (BGBl I 2018/31). Pursuant to Article 35(10) of the GDPR, 28 data protection impact assessments were carried out to accompany the new legislation. The results of these assessments were published in the Austrian Official Journal. Future data protection impact assessments in Austria can be used for guidance when drafting assessments, even though they deviate to some extent from the needs of private companies. Notably, the DPA was not consulted.

Constitutional Act and others

The Constitutional Act was amended alongside a few ordinary legislative acts. The Supreme Administrative Court, as well as the federal and provincial administrative courts, must rule on their own alleged GDPR infringements if accused of having infringed the GDPR while acting in their respective judicial capacities (BGBl I 2018/22).

Legislation interfering with personal data protection

The federal legislature also passed legislation governing data protection issues independently from the GDPR. This will have a significant impact on the protection of personal data in Austria.

Criminal Procedure Code and others

The Criminal Procedure Code, the Telecommunications Act and the Prosecutor’s Office Act were amended to:

• transpose Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA; and
• implement the Austrian government’s programme (BGBl I 2018/27).

Under these amended acts, law enforcement has been authorised to:

• use new investigative tools, such as international mobile subscriber identity catchers to localise technical installations and collect location data; and
• order telecoms providers to ‘quick freeze’ already collected personal data where a criminal offence is suspected.

Further, law enforcement has been authorised to seize letters linked to criminal offences which are punishable by imprisonment for over one year. The most controversial amendment in this regard was authorising law enforcement to install software (federal spyware known as Bundestrojaner) on computer systems – without the holder’s knowledge – to bypass encryption and monitor encrypted messages. This amendment will enter into force only on 1 April 2020 and will expire after five years. The introduction of the federal spyware was postponed so that the minister of the interior may acquire the needed software.

Security Police Act and others

• The Security Police Act, the Telecommunications Act and the Road Traffic Act were also amended (BGBl I 2018/29). The amendments concern matters such as:
• covertly using image processing equipment to identify vehicles;
• matching data collected through image processing equipment with wanted lists;
• data transferring to prevent attacks in connection with football games organised by the Austrian Football Association;
• data processing regarding emergency calls;
• the competency of the DPA to decide over complaints regarding data processing by law enforcement; and
• CCTV at public places for law enforcement purposes.

Further, the identification of users of prepaid SIM cards was introduced.

PNR Directive

The Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime was transposed into Austrian law (BGBl I 2018/64). Air carriers must transfer PNR data to the Passenger Information Unit located at the Ministry of the Interior. While the PNR Act obliges only air carriers regarding extra-EU flights, the minister of the interior is authorised to extend that obligation to flights from other EU member states to Austria and vice versa. The minister of the interior made use of this authorisation and issued the PNR Ordinance simultaneously with the PNR Act on 16 August 2018 (BGBl II 2018/208). The PNR Ordinance will abrogate after six months. Until then, for the second half of 2018, air carriers must transfer PNR data to the Passenger Information Unit regarding each cross-border inter or extra-EU flight.

Administrative Penal Act

Pursuant to the Administrative Penal Act, the presumption of innocence does not apply. Whenever an administrative provision is infringed, there is a presumption of fault and the accused must thus prove their innocence. However, this provision may be superseded by Article 83(2) of the GDPR which, according to legal literature, stipulates a presumption of innocence. That said, there is no legal certainty as to whether the authorities will apply the presumption of fault. Therefore, it comes as welcome news that after 1 January 2019, the presumption of fault will apply only to administrative fines up to €50,000. Another notable amendment of the Administrative Penal Act is the introduction of an approach which obliges authorities to advise the accused before imposing a fine in case of small infringements. Both mentioned amendments are already published in the Official Journal but will enter into force on 1 January 2019 (BGBl I 2018/57).

Comment

The GDPR has created a new understanding and awareness of data protection. Despite its nature, a directly applicable legal act, the GDPR has created significantly more work for the legislature than simply transposing a directive. The Austrian federal legislature has chosen to impose the GDPR by implementing the narrow but general Data Protection Act and introducing amendments to ordinary legal acts individually. However, these amendments are essentially limited to wording adjustments and restrictions on data subjects’ rights.

That said, a legal framework for data processing for research and scientific purposes has been created. In addition, the federal legislature has broadened the powers of law enforcement to process data and transposed, among other things, the PNR Directive. Although not directly linked to the GDPR, the amendments to the Administrative Penal Act also offer some relief concerning the GDPR’s fine regime.

By Janos Boszormenyi, Associate Schoenherr

On July 9, 2018, the German and Austrian competition authorities published joint guidelines regarding the transaction value thresholds of their respective merger regimes.

In Austria, the new threshold (Section 9 paragraph 4 of the Austrian Cartel Act) has applied since November 1, 2017. Accordingly, a merger has to be reported to the competition authority, even if the “traditional” turnover thresholds are not met, if: (a) the value of consideration exceeds EUR 200 million, (b) the combined worldwide turnover of the concerned undertakings exceeds EUR 300 million, (c) the combined domestic turnover of the concerned undertakings exceeds EUR 15 million, and (d) the target has significant activities in Austria.

Background

The rationale of the new threshold is to capture transactions where the target’s turnover does not adequately reflect its market position. A disproportionately high purchase price compared to the size of the target and its actual revenues may indicate that this is the case. The 2014 Facebook/WhatsApp merger is a commonly-cited example. The new threshold, however, does not only apply to digital markets (where products or services are monetized differently than in conventional markets), but also to “new” markets or markets characterized by innovation. Indeed, in practice, so far (as reported by the competition authorities), the rule’s application has not been limited to the digital sector, and often concerns other sectors (e.g., the pharmaceutical industry).

The New Guidelines

The new thresholds raise a number of questions, including, among others: “How is the consideration calculated?”; “What is the relevant date to determine transaction value?”; “What constitutes significant domestic activities?” The new guidelines address these questions and provide guidance based on the experience of the authorities. 

Significant Activities in Austria: Any (Turnover) Safe Harbor?

The local nexus requirement in Austria can be a particularly critical issue when assessing a potential filing obligation.

It should be noted that the guidelines state that the local nexus criterion included in the transaction value threshold has to be clearly distinguished from the local nexus criterion which applies (according to established case law) with regard to the traditional turnover thresholds under the effects doctrine. Having thus two different sets of local nexus criteria within the same jurisdiction already creates real confusion. 

The guidelines stress that the domestic turnover is of limited relevance when assessing local nexus in the context of the transaction value threshold. This approach makes perfect sense considering the rationale of this threshold, which is to cover cases where the target’s turnover is not an adequate parameter. It follows that the turnover is only relevant where it “adequately reflects the undertaking’s market position and its competitive potential.” In this case, the guidelines specify that the Austrian competition authority will generally not assume that an undertaking has significant activities in Austria where domestic turnover does not exceed EUR 500,000. This threshold does thus not create an absolute “safe harbor,” but rather one in relative terms, as it still requires diligent analysis of the market, the activities, and the potential of the target. It will mostly be relevant in mature “conventional markets” and markets where competition is not mainly driven by innovation. 

Other Reference Points for Local Nexus

If turnover is not an adequate measure, what is? The guidelines emphasize that this will largely depend on the industry at issue. Frequently cited examples for the digital sector are the number of “clicks” (access frequency), downloads, or registered users.

The guidelines state that there is will also be a presumption of significant domestic activity if the target has a location in Austria.

According to the guidelines, research and development may also qualify as a relevant activity. Whether such R&D activity is significant in Austria depends on a number of circumstances (e.g., location, activities relating to entry into the domestic market). The guidelines provide specific guidance for some industries (e.g., the pharma sector).

Conclusion

The competition authorities’ paper offers valuable guidance on the most relevant aspects of the new thresholds and illustrates them with a number of practical examples. By their very nature and due to the fact that the relevant regulation has been in place for less than a year, the guidelines do not claim to provide an exhaustive set of answers. However, the very detailed guidelines are certainly helpful in order to assess a potential filing obligation under the new transaction value test. In addition, parties may approach the Austrian authority to seek individual guidance in order to clarify open issues.  

By Andreas Traugott, Partner, and Anita Lukaschek, Associate, Baker McKenzie Vienna

This Article was originally published in Issue 5.9 of the CEE Legal Matters Magazine. If you would like to receive a hard copy of the magazine, you can subscribe here.