In its decision of May 30, 2022, the data protection authority addressed the question of whether members of a service committee may use data from the staff directory to send postal promotional letters for joining a trade union.
The data protection authority has initiated an official investigation procedure against two members of a departmental committee (as persons responsible). Pursuant to § 9 para. 3 lit. i PVG to access the staff directory and the staff data contained therein in order to perform its duties. In this case, the data was used by the data controller to promote membership in a trade union.
It was determined that such data processing was not covered by the PVG and was therefore unlawful. This results from a comparison with legal bases that apply to other – statutory – interest representation bodies: Section 17a AKG, for example, provides for the express permission to use personal data of Chamber of Labor members for (election) advertising. A corresponding provision for the Chamber of Commerce is found in Section 86 para. 3 WKG. The creation of a legal basis for data processing – such as that carried out here – for the purpose of recruitment as a trade union member is the responsibility of the legislator.
Against this background, those responsible were, in accordance with Art. 58 par. 1 lit. d GDPR to draw attention to this violation so that the conduct is not repeated and to notify those responsible in accordance with Art. 57 par. 1 lit. d GDPR to raise awareness of their obligations under data protection law.
Source: DSB Austria