Blog

The Federal Administrative Court (BVwG) recently dealt with a request for deletion under data protection law by operators of a hotel who requested the deletion of all posts, photos and information, including reviews, about their hotel business on an online travel review platform. In its decision of 13 May 2022 (GZ 258 2236970-1; not published yet), the BVwG analysed whether the listing could be based on the permissible element of legitimate interest (Art 6 para 1 lit f DSGVO). The court paid particular attention to the balancing of interests and, in connection with this, to the abuse control of the platform operator. As a result, the court confirmed that the listing of businesses on a rating platform – even if a natural person is behind the business – is lawful and the operator has no right to deletion.

The decision was based on the following facts:

The two complainants are “hosts” of a hotel which is run as a “family business”. Based on the right to “digital silence” (digitale Ruhe), the complainants requested the deletion of all information about the hotel because the listing of the hotel and the related processing of personal data had taken place without justification within the meaning of Article 6 of the GDPR (especially without corresponding consent). It should be mentioned that in addition to general information about the hotel (name, address, contact details, description, etc.), the entry on the platform also contains ratings and reviews from users. In some reviews, the complainants are also mentioned by name in connection with their function as owners/hosts of the hotel. It is also interesting that the hotel is rated very good with 4.5 out of 5 possible points.

As the platform operator (respondent) refused to comply with the deletion request, the complainants filed a complaint with the Austrian Data Protection Authority, which, however, rejected the complaint with regard to the alleged violation of the right to confidentiality as well as the right to deletion (decision of 18 September 2020, no. DSB-D130.308/2020-0.308.526). The complainants appealed against this decision to the Federal Administrative Court.

The BVwG confirmed that there was processing of personal data by the respondent and that it could not rely on the media privilege of Section 9 of the Data Protection Act in conjunction with Article 85 of the GDPR. Since the listing on the platform was made without the consent of the complainants, the BVwG had to examine whether the data processing could be based on a legitimate interest of the platform operator or a third party.

Legitimate interest in data processing and necessity of data processing

In this regard, the BVwG held that the platform serves a legitimate information interest in the form of exercising the freedom of speech and information of the rating guests as well as of the persons viewing ratings. The purpose approved by the legal system is to provide the interested public with an overview of the services offered on a market (cf. OGH 02.02.2022, 6 Ob 129/21w, BGH VI ZR 488/19, Ärztebewertung IV, para 28). Since hotel and restaurant businesses, especially family businesses, regularly have persons who act externally and represent the business to guests, the public’s interest in information also includes the conduct of these persons in the business.

Data processing is also necessary to safeguard the previously mentioned interests. Evaluating users should be able to reflect their experiences as authentically as possible in the sense of freedom of speech and these reports of experiences should be received as authentically as possible by potential guests (freedom of information). This also includes perceptions about and naming of persons who significantly shape the operation, such as the complainants.

Weighing up interests

In the balancing of interests carried out by the BVwG, it was found that the evaluations fall within the social sphere of the complainants, as the comments only concern their professional activities. This is all the more true because the business is run as a family business and the complainants appear to the outside world to a particular extent.

An argument put forward by the complainants that the platform also allows the submission of abusive ratings, for example by persons who were never guests, and that the respondent does not have an effective and transparent procedure for dealing with unlawful content, did not change the BVwG’s assessment. It was true that there was no legitimate public information interest in false or criminally relevant ratings. However, whether this possibility of abuse makes the data processing of the platform operator unlawful depends on how intensively the conceivable measures to prevent abuse restrict all fundamental rights to be included in the weighing of interests (vgl OGH 02.02.2022, 6 Ob 129/21w Rz 80 – Teacher evaluation platform).

In its decision Lehrerbewertungsplattform (OGH 02.02.2022, 6 Ob 129/21w), the Austrian Supreme Court (OGH) already recognised the problem that the teacher rating app does not prevent certain possibilities of abuse. For example, people who do not even know a teacher can submit evaluations. Such abuse could only be avoided by registering users by name. However, this would restrict the students’ freedom of expression, because they could be prevented from submitting an evaluation at all. The Supreme Court weighed the restriction of the plaintiff’s rights through the possibility of abuse less heavily than the restriction of freedom of speech that would occur if users had to register by name or if such an app was not allowed to be operated at all

In the case decided, the platform operator had taken numerous measures to limit abusive uses or to enable business owners to defend themselves against certain comments. Especially for the following reasons, a possible remaining potential for abuse is not sufficient to assume that the data processing is unlawful:

• The reviews complained of by the complainants exclusively concern their professional practice, which can be attributed to the social sphere. In contrast to the circumstances in the private sphere, these have a lower level of protection.
• The ratings can only be viewed by those who actually visit the platform. Furthermore, the complainants are only mentioned by name in a few comments, so that in the case of abuse it is not to be expected that a pillorying effect for the complainants is created with the comments.
• It is not absolutely necessary and not required by law that reviewers have to prove their identity or provide proof that they have actually been a guest of the reviewing establishment. This would considerably restrict the freedom of speech.

The BVwG therefore considered the measures taken by the respondent to be sufficient. For the above reasons, the interference in the interests of the complainants by the data processing carried out by the platform operator is not to be rated higher than the interest of the public or the entirety of users to evaluate the complainants’ business and to view the information about the business including reviews/experience reports. The complaint was therefore correctly dismissed by the BVwG. The complainants have meanwhile appealed to the VwGH.

Involved in the procedure.

DISCLAIMER

This blog is for general information purposes only and does not constitute legal advice. Schindler Rechtsanwälte GmbH assumes no liability for the accuracy, completeness and timeliness of the blog. The blog cannot replace individual legal advice.