In the decision of February 16, 2018 on GZ: DSBD122.757/0002-DSB/2018, the data protection authority had to deal with the question of whether the driver’s license authority had to delete data on a pending investigation regarding the complainant.
Specifically, a provincial police directorate transmitted data on a pending investigation against the complainant to the respondent in its capacity as a security and driving license authority. The respondent subsequently based its assessment of the complainant’s traffic unreliability on this information about a pending investigation. The complainant requested the deletion of these data concerning the preliminary investigation pending against him, as there would be no legal basis for this transfer of his data.
However, the respondent rejected the request for cancellation on the grounds that, as a driver’s license authority, it was entitled to assume an unreliability to drive in the case of proven, specific facts. However, what is to be understood by “proven” would be up to the respondent to judge. The respondent further argued that it had to assess the commission of a criminal act as a preliminary question for the revocation of the driving license pursuant to Section 38 AVG according to its own view.
As a result, the complainant was found to be in the right: Data concerning a pending preliminary investigation are “criminal data” within the meaning of Section 8 (1). 4 DSG 2000, for which special protection under data protection law is provided. Accordingly, for “criminal data” there must be an explicit legal authorization or obligation to use it.
According to the clear wording of the Driver’s License Act, traffic unreliability is only considered to exist in the case of (certain)
proven criminal acts assumed. Mere suspicion is not sufficient for this. The data protection authority thus follows the case law of the Administrative Court (see the findings of the Administrative Court of May 23, 2005, Zl. 2000/11/0065, and of October 16, 2012, Zl. 2012/11/0171, both with regard to Section 7 (3) (1) of the Austrian Driver’s License Act).
Since in the present case, at the time of receipt of the criminal law-relevant data in question, there was only the suspicion that the complainant might have committed the relevant criminal acts, the respondent wrongly rejected the complainant’s request for deletion. Furthermore, in the course of the proceedings before the data protection authority, the complainant was also informed by the authorities acting against
acquitted him of the charges brought against him.
Consequently, a violation of the right to deletion had to be established.
This decision is not legally binding.