In 2016, the DPO had dismissed the complaint of an employee of the City of Vienna for violation of the right to confidentiality. As a staff representative, the latter had claimed that a supervisor had unlawfully forwarded an e-mail to staff representatives who belonged to a different union faction. The request was for a declaration of infringement. In its decision of October 1, 2018, W253 2140428-1/9E (not yet published), the Federal Administrative Court (BVwG) upheld the appeal against this decision and found that the complainant’s right to confidentiality had been violated by the processing operation complained of in December 2014. In assessing the lawfulness of the processing, the BVwG used the (stricter) GDPR, in particular Art. 6 para. 1 last sentence, referred to. The DSB has now challenged this finding in an ordinary appeal to the Administrative Court. In December 2014, the GDPR did not yet exist; it is mandatory pursuant to Art. 99 para. 1 GDPR only formally entered into force on 24.5.2016. As a result of an interpretation of Section 69 (1) which, in the opinion of the DSB, is contrary to Union law, the BVwG has ruled that Section 69 (1) is not applicable. 4 and 5 DSG applied the GDPR retroactively. According to the DPO, the situation is different in cases where a claim for performance (e.g. deletion) is to be assessed. Here, the legal situation at the time of the decision is decisive.