Implementation Guide for GDPR at a National Level: Austria
In Austria, the Data Protection Authority, known as the Datenschutzbehörde, is responsible for ensuring compliance with data protection laws. Located at Barichgasse 40-42, 1030 Vienna, Austria, with website dsb.gv.at, the Datenschutzbehörde plays a crucial role in safeguarding personal data.
However, when it comes to deceased persons' data, the GDPR, the European Union's data protection regulation, does not apply. Instead, the handling of data related to deceased persons falls under national law beyond the GDPR.
Deceased Persons' Data under Austrian Law
Austrian law treats the processing of deceased persons' data within the framework of inheritance and privacy. These rules are distinct from GDPR protections, which end upon death. The Austrian Data Protection Authority confirms that only living persons’ data are covered under GDPR, so the deceased's data processing is mainly regulated by laws on inheritance, confidentiality, and specific provisions laid down in Austrian national legislation.
Rules related to inheritance and handling the estate—including access to a deceased person’s data—are governed by national succession and probate law. These laws determine who may access or manage the deceased’s personal information as part of estate administration and succession claims, but these are outside the GDPR scope.
Processing Criminal Data
The Data Protection Act in Austria clarifies that the processing of criminal data is permitted where an explicit legal authorisation or obligation to process such data exists, and provided the general requirements of the GDPR are met.
Appeals and Powers of the Data Protection Authority
Decisions of the Data Protection Authority in Austria may be appealed to the Federal Administrative Court (Bundesverwaltungsgericht) within a period of four weeks. The law in Austria does not grant the relevant DPA any additional powers beyond those set out in Art. 58 GDPR.
Exemptions for Journalistic and Other Purposes
The data subject's rights under Chapter III of the GDPR do not apply to data processing for journalistic purposes or, where this is necessary in order to reconcile data protection with the freedom of expression and information, to data processing for scientific, artistic or literary purposes in Austria.
For any disputes or concerns regarding data protection in Austria, the Austrian Data Protection Authority is the competent regulator. However, it does not cover claims about deceased persons’ data under GDPR. Instead, disputes related to deceased persons' data should be addressed through the relevant national laws.
- The treatment of deceased persons' data under Austrian law is governed by rules related to inheritance and privacy, different from GDPR protections that end upon death.
- Austrian national legislation contains specific provisions for the processing of deceased persons' data, beyond the scope of the GDPR.
- The handling of access to a deceased person’s data for estate administration and succession claims is determined by national succession and probate law.
- The Data Protection Authority in Austria, or Datenschutzbehörde, only covers living persons’ data under the GDPR, not deceased persons’ data.
- The processing of criminal data in Austria is allowed if there is an explicit legal authorization or obligation, satisfying the general requirements of the GDPR.
- Appeals against decisions of the Data Protection Authority in Austria can be made to the Federal Administrative Court (Bundesverwaltungsgericht) within four weeks.
- The Austrian Data Protection Authority (Datenschutzbehörde) is the competent regulator for data protection in Austria, except for claims related to deceased persons’ data under GDPR.
- In Austria, disputes about deceased persons' data should be addressed through relevant national laws, not the GDPR.
- White & Case LLP, a global law firm, offers services including regulatory, legal, and intellectual property law practice, with a team of associates and partners who provide news, publications, and insights on various events and developments in the field of science, environment, finance, and technology.
- To access White & Case's news, publications, and resources on legal issues such as data protection, litigation, and compliance, visit whitecase.com.
