F. J. AND E.B. v. AUSTRIA
Inadmissible
Elisabeth Steiner;Isabelle Berro-Lefèvre;Julia Laffranque;Khanlar Hajiyev;Linos-Alexandre Sicilianos;Mirjana Lazarova Trajkovska;Paulo Pinto De Albuquerque
1. The applicant in the first case, Mr F.J., is an Austrian national, born in 1955. The applicant in the second case, Mr E.B., is an Austrian national, born in 1947. The President granted the applicants’ requests for their identity not to be disclosed to the public (Rule 47 § 3). They are represented before the Court by Mr H. Graupner, a lawyer practising in Vienna. 2. The Austrian Government (“the Government”) were represented by their Agent, Ambassador H. Tichy, Head of the International Law Department at the Federal Ministry of Foreign Affairs. 3. The facts of the case, as submitted by the parties, may be summarised as follows. 4. In February 2001 the Vienna Federal Police Department conducted police investigations in respect of the first applicant on suspicion of his having committed homosexual acts with consenting male persons within the age bracket of fourteen to eighteen, an offence under the former Article 209 (Gleichgeschlechtliche Unzucht mit Personen unter 18 Jahren) of the Criminal Code. 5. On an unspecified date the Vienna Public Prosecutor’s Office charged the first applicant with these offences. 6. On 2 April 2001 the Vienna Regional Court acquitted him of the charge. 7. On 14 December 2001 the first applicant lodged a request with the Vienna Federal Police Department for the deletion of both the electronically processed data and of the data manually processed in paper files concerning the proceedings in his case. 8. On 1 August 2002 the Federal Police Department informed the first applicant that it had deleted the electronically processed data but rejected the request concerning the data processed in paper files. Thereupon the first applicant filed a complaint concerning this decision with the Data Protection Commission. 9. On 2 September 2003 the Data Protection Commission partly allowed the first applicant’s complaint, ordering the Federal Police Department to modify the filing cards (Steckzettelindices) and filing registers (Protokollbücher) by noting the acquittal while maintaining the reference to Article 209 of the Criminal Code. It dismissed the first applicant’s complaint as regards the data processed in ordinary paper files – known as “copy files” (Kopieakte) – which contained copies of all the reports and communications generated by the authority and sent to other authorities, such as the public prosecutor, because data processed in paper files did not fall under the definition of filing systems (Dateien) within the meaning of the Data Protection Act. The right of deletion set forth in that Act was therefore not applicable. 10. In the Data Protection Commission’s view, information held in such information research tools could not be completely deleted or scrambled. In accordance with the relevant provisions of the Security Police Act, all administrative actions by administrative authorities – including police authorities – had to be documented and archived. Only by doing so was it possible to review the lawfulness of the actions of the authorities, which was necessary in a State governed by the rule of law. This was required by the rules regulating the authority’s internal mode of operation (Kanzleiordnung). However, such data had to be complete and correct, which meant that subsequent developments – in particular if the person concerned by the investigations had been acquitted – also had to be recorded. The question of whether or not the authority could use such data in its work was distinct from the issue of the archiving and recording of data and required that separate rules on the use of such data be applied. 11. On 21 November 2003 the first applicant lodged a complaint with the Constitutional Court and with the Administrative Court. 12. On 26 January 2006 the Constitutional Court quashed the Data Protection Commission’s decision. In the Constitutional Court’s view the Data Protection Commission had misinterpreted the applicable law when it had held that only the provisions on the archiving and storage of data for the authority’s internal use were applicable because the filing cards at issue did not only contain information of a general character but details about an individual person, such as that person’s name and address. Therefore, they recorded not only internal matters of the authority but also sensitive personal data. The authority should therefore have applied the rules for the use and processing of individual data under the Security Police Act (Sicherheitspolizeigesetz) and should have weighed up the private and public interests accordingly. Since the Data Protection Commission had failed to do so, the Constitutional Court quashed its decision. 13. On 28 February 2006 the Administrative Court discontinued the proceedings because the Constitutional Court had already quashed the decision. 14. Meanwhile, the police authorities, taking into account the legal opinion in the Constitutional Court’s decision, blanked out entries in the filing register by superimposing black bars over the first applicant’s name, date of birth, address and the respective file number and reference to Article 209 of the Criminal Code on the filing cards. This having been done, the applicant maintained his complaint of 10 August 2002 in respect of the data processed in the copy files only. 15. On 9 August 2006 the Data Protection Commission again decided on the first applicant’s appeal and rejected his request to delete the data concerning him that had been manually processed in ordinary paper files, the “copy files”. Referring to the Constitutional Court’s case-law, it found that the right to deletion of data under the Data Protection Act and the Security Police Act was not applicable to data manually processed in paper files because such files were unstructured compilations of information and did not qualify as filing systems (Dateien) under the Data Protection Act. 16. On 26 September 2006 the first applicant again lodged complaints with the Administrative Court and the Constitutional Court. 17. The Constitutional Court dismissed the complaint on 7 March 2007. It rejected the first applicant’s argument that Article 8 of the Convention and the case-law of the European Court of Human Rights established a right to deletion of personal data in an ordinary paper file. The cases relied on by the first applicant, namely Amann v. Switzerland (no. 27798/95, ECHR 2000II) and Rotaru v. Romania (no. 28341/95, ECHR 2000V), had to be distinguished from the present case as they concerned completely different sets of facts. In the Constitutional Court’s view, Article 8 of the Convention did not impose a wider right to deletion of data than already contained in section 1 of the Data Protection Act which transformed into domestic law EU Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Official Journal L 281, 23/11/1995). Also the Council of Europe Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data of 28 January 1981 only concerned automatically processed data and did not extend to personal data in a conventional copy file or paper file. 18. Moreover, it was apparent and not disputed by the first applicant that, following the blackening out of his name, date of birth and address in the file register and of the reference to the paper files in the index card, the paper files at issue were no longer traceable via these information tools. This reduced the accessibility of his personal data to such an extent that there was no longer any interference with his rights under Article 8 of the Convention. That being so, the Constitutional Court concluded that there had been no breach of the first applicant’s rights under Article 13 of the Convention either. 19. On 5 July 2007 the Administrative Court dismissed the first applicant’s complaint for the same reasons as those relied on by the Constitutional Court. 20. In March 1999 the Vienna Federal Police Department conducted investigations in respect of the second applicant on suspicion of his having committed homosexual acts with consenting male persons within the age bracket of fourteen to eighteen, an offence under former Article 209 of the Criminal Code, and on suspicion of having committed sexual acts with persons under the age of fourteen years, an offence under Article 207 (Sexueller Missbrauch von Unmündigen) of the Criminal Code. 21. On an unspecified date the Vienna Public Prosecutor’s Office charged the applicant with those offences. 22. On 1 June 1999 the Vienna Regional Court acquitted him of these charges. 23. In July 1999 the Vienna Federal Police Department conducted investigations in respect of the second applicant on suspicion of his having committed offences under Article 207 and 209 of the Criminal Code. 24. On an unspecified date the Vienna Public Prosecutor’s Office charged the second applicant with those offences. 25. On 18 November 1999 the Vienna Regional Court convicted him of having committed homosexual acts with consenting male persons within the age bracket of fourteen to eighteen under former Article 209 of the Criminal Code and sentenced him to one year’s imprisonment. He was acquitted of the other charges. 26. In January 2001 the Vienna Federal Police Department conducted investigations in respect of the second applicant on suspicion of his having produced pornographic pictures of persons under the age of fourteen, an offence under Article 207a of the Criminal Code (Pornographische Darstellungen Minderjähriger), and of having committed an offence under Article 209 of the Criminal Code. 27. On an unspecified date the Vienna Public Prosecutor’s Office charged the second applicant with an offence under Article 209 of the Criminal Code. 28. On 6 April 2001 the Vienna Regional Court convicted him as charged and sentenced him to one year’s imprisonment. 29. On 8 May 2006 the second applicant lodged a request with the Vienna Federal Police Department for the deletion of the electronically processed data and the data manually processed in files, and held by the police authorities, concerning these three sets of proceedings. 30. In a decision of 31 May 2006 the Vienna Federal Police Department informed him that no electronically processed data relating to the above proceedings existed any longer and rejected the request concerning the data processed in paper files. 31. On an unspecified date the second applicant lodged a complaint against that decision with the Data Protection Commission. 32. On 29 November 2006 the Data Protection Commission dismissed the complaint. It found that, as regards the non-electronically processed data stored in ordinary paper files, the Data Protection Act and the right to request a deletion was not applicable as such paper files constituted an unstructured compilation of information but not a filing system (Datei) within the meaning of the Data Protection Act. As regards the filing cards and filing registers the Commission noted that on 12 July 2006 the police authorities, after having been invited to comment on the applicant’s complaint, had informed the Commission that all references in these research tools to the issues under Article 209 of the Criminal Code had been rendered illegible (unkenntlich gemacht). In the filing registers, the name and address of the applicant had also been deleted. Under the storage and deletion rules for the Vienna Federal Police Department (Skartierungsvorschrift) copy files were deleted five years following the end of the year of recording, while index cards and filing registers were destroyed after twenty years. In such circumstances the ordinary paper files (“copy files”) relating to investigations in respect of the applicant essentially served the purpose of documenting the activities of the authority and no longer allowed the tracking of sensitive information on the applicant in relation to Article 209 of the Criminal Code. The applicant’s complaint was therefore ill-founded. 33. On 2 January 2007 the applicant applied for legal aid in order to lodge a complaint with the Administrative Court. In addition, he proposed that the case be referred to the Court of Justice of the European Communities for a preliminary ruling. 34. On 8 January 2007 the Administrative Court, referring to its case-law in similar cases, dismissed the request for legal aid for lack of prospects of success. 35. On 13 March 2007 the applicant lodged a complaint with the Constitutional Court. 36. On 24 September 2007 the Constitutional Court, referring to its previous case-law (in particular its decision of 7 March 2007 in the first applicant’s case – see paragraphs 21-22 above), declined to deal with the case because it lacked any prospect of success. 37. Article 209 of the Criminal Code, in force until 14 August 2002, concerned consensual homosexual acts and read: “A male person who after attaining the age of nineteen fornicates with a person of the same sex who has attained the age of fourteen years but not the age of eighteen years shall be sentenced to a period of imprisonment of between six months and five years.” 38. On 21 June 2002, responding to a request for review made by the Innsbruck Regional Court, the Constitutional Court found that Article 209 of the Criminal Code was unconstitutional. 39. On 10 July 2002, following the Constitutional Court’s judgment, Parliament repealed Article 209. It also introduced Article 207b, which penalises sexual relations with persons under sixteen years of age under specific conditions and which is formulated in a gender-neutral way. That amendment, published in the Official Gazette (Bundesgesetzblatt) no. 134/2002, came into force on 14 August 2002. 40. A more detailed description of the law, the Constitutional Court’s judgments concerning Article 209 of the Criminal Code and its replacement by Article 207b of the Criminal Code can be found in E.B. and Others v. Austria, (nos. 31913/07, 38357/07/ 48098/07, 48777/07 and 48779/07, §§ 48-52, 7 November 2013). 41. Article 207, paragraph 1 of the Criminal Code reads; “Anyone who performs a sexual act on a person under the age of fourteen or has a sexual act performed on himself or herself by such a person, with the exception of the offence under Article 206, shall be sentenced to a period of imprisonment of between six months and five years.” 42. Article 207a, paragraph 1 of the Criminal Code reads: “Whoever 1. produces or 2. offers to someone else, procures, leaves to someone else, shows or makes otherwise accessible a pornographic image of a person under the age of eighteen shall be sentenced to imprisonment for up to three years.” 43. The Data Protection Act of 2000 contains the basic provisions governing the protection of personal data including a right of information and a duty to delete (section 27). The Data Protection Act distinguishes between manually recorded data and electronically processed data. Manually recorded data are subject to deletion in so far as they constitute a “filing system”. A “filing system” (Datei) is defined as a structured collection of data (section 4, point 6). A certain degree of organisation is necessary for an amount of manually processed data to qualify as a “filing system”. According to the case-law of the Supreme Court (judgment of 28 June 2000, 6 Ob 148) and the Administrative Court (decision of 21 October 2004, 2004/06/0086), card indexes and lists constitute filing systems, but mere files (Akten) do not. A “paper file” or “copy file” is therefore not deemed to be a filing system within the meaning of the Data Protection Act and is not subject to the right of deletion under this act (decision of the Administrative Court of 21 October 2004 Collection of Decisions A no. 16477/2004). 44. Section 1 of the Data Protection Act reads: “(1) Everybody shall have the right to secrecy regarding the personal data concerning him, especially concerning his private and family life, in so far as he has an interest deserving such protection. Such an interest is precluded when data cannot be covered by the right to secrecy because of their general availability or because they cannot be traced back to the data subject (Betroffener). (2) In so far as personal data are not used in the vital interests of the data subject or with his consent, restrictions of the right to secrecy are permitted only to safeguard the overriding legitimate interests of another; specifically, in the event of an intervention by a public authority, the restriction shall only be permitted on the basis of laws necessary for the reasons stated in Article 8 § 2 of the Convention. Such laws may provide for the use of data (Verwendung von Daten) deserving special protection only in order to safeguard substantial public interests and shall provide suitable safeguards for the protection of the data subjects’ interest in secrecy. Even in the case of permitted restrictions, the intervention with the fundamental right shall be carried out using only the least intrusive of all effective methods. (3) In so far as personal data concerning an individual are destined for automated processing or for manual processing (that is, in filing systems with no automated processing), everybody shall have, as provided for by law: 1. the right to obtain information revealing who processes what data concerning him, where the data originated, the purpose for which they are used, and to whom the data are transmitted; 2. the right to rectification of incorrect data and the right to deletion of illegally processed data. (4) Restrictions of the rights set out in subsection (3) shall be permitted only under the conditions laid out in subsection (2).” 45. Section 4 of the Data Protection Act, – which contains a number of definitions, reads, in so far as relevant: “For the subsequent provisions of this Federal Act the terms listed below shall mean: 1. ’data’ (‘personal data’): information relating to data subjects ... who are identified or identifiable; data are ‘only indirectly personal’ for a controller (Auftraggeber) ..., a processor (Dienstleister) ..., or a recipient of a transmission (Empfänger einer Übermittlung) ... if the data relate to them in such a manner that the controller, processor or recipient of a transmission cannot establish the identity of the data subject by legal means; 2. ’sensitive data’ (‘data deserving special protection’): data relating to natural persons concerning their racial or ethnic origin, political opinion, trade union membership, religious or philosophical beliefs, and data concerning health or sex life; ... 6. ’filing system” (Datei): structured collection of data accessible via at least one search criterion;” 46. Section 27 of the Data Protection Act, which concerns the deletion of data, reads, in so far as relevant: “(1) Every controller shall rectify or delete data that are incorrect or have been processed contrary to the provisions of this Federal Act 1. on his own initiative, as soon as the incorrectness of the data or the inadmissibility of the processing becomes known to him, or 2. on a well-founded application by the data subject (Betroffener) The obligation to rectify data under subsection 1 shall apply only to those data of which the correctness is significant for the purpose of the data application (Datenanwendung). The incompleteness of data shall justify a claim to rectification only if such incorrectness, with regard to the purpose of the data application, results in the information being incorrect in its entirety. As soon as data cease to be needed for the purpose of the data application, they shall be regarded as illegally processed data and shall be erased unless their archiving is legally permitted and the access to these data is specially secured. Any further use for another purpose shall be legitimate only if transmission (Übermittlung) of the data for this purpose is legitimate; the legitimacy of further uses for scientific or statistical purposes is laid down in sections 46 and 47. (4) The application for rectification or erasure shall be complied with within eight weeks of receipt and the applicant shall be informed thereof, or a reason in writing shall be given as to why the requested erasure or rectification was not carried out. (5) Within the sphere of the executive agencies responsible for the fields described in section 26 ..., the following procedure shall apply as regards applications for rectification or erasure, in so far as this is required to safeguard those public interests that require secrecy: the rectification or erasure shall be carried out if, in the opinion of the controller, the demands of the data subject are justified. The requisite information for the purposes of subsection 4 shall in all cases be that a check of the controller’s data files (Datenbestand) with regard to the application for rectification or erasure has been performed. The legality of this course of action is subject to review by the Data Protection Commission (Datenschutzkommission) ... and the special complaint procedure before the Data Protection Commission pursuant to section 31 (4).” 47. The Security Police Act regulates the powers and duties of the authorities dealing with matters of public security and their officers in exercising their functions. 48. Section 53 of the Security Police Act reads: “Admissibility of processing data (1) The police authorities may investigate and further process personal data 1. for the purpose of fulfilling the duty to provide initial general assistance (section 19); 2. for the purpose of averting criminal connections (section 16, subsection 1 (2), and section 21); 2a. for extended threat investigation (section 21, subsection 3) under the prerequisites of section 91c subsection 3; 3. for the purpose of averting dangerous assaults (section 16, subsections 2 and 3, and section 21, subsection 2), including the investigation necessary for averting a threat (section 16, subsection 4, and section 28a); 4. for preventing potential dangerous assaults endangering life, health, morals, freedom, property or the environment (section 22, subsections 2 and 3) or for preventing dangerous assaults by means of a crime analysis if – because of the type of the assault – repeated commission is likely; 5. for the purpose of a search (section 24); 6. in order to be able to maintain public order during a specific event. (2) The police authorities may investigate and further process data already processed by them in the implementation of federal or regional laws for the purpose of and subject to the prerequisites of subsection 1; they must not, however, compare electronic data within the meaning of Article 141 of the Code of Criminal Procedure. Existing transmission prohibitions remain unaffected.” 49. Section 57(1) of the Security Police Act reads: “The security police authorities may establish as data a person’s name, sex, former name, nationality, date of birth, place of birth, address, name of parents and other names and data used by that person and further process these data in a centralized information data base as well as the reason for gathering these data and, if necessary, the reason why the authority has intervened and inform other authorities thereof, if 6. criminal justice investigations have been instituted against the person concerned.” 50. Section 58 (1) of the Security Police Act reads: “Access by the security police authorities as controller to personal data which are stored and kept accessible in accordance with Section 57 (1) must be blocked 6. as regards no. 6 if there is no longer a suspicion of having committed an offence against the person concerned, at latest five years after entering of the data into the centralized information data base, in case of more than one entry pursuant to no. 6 five years after the latest;” 51. Section 61 of the Security Police Act reads: “Admissibility of updating data The police authorities are entitled to update the personal data used by them if they have lawfully verified more recent data.” 52. Section 63 of the Security Police Act reads: “Duty of correction or deletion (1) If it is found that data which are incorrect or have been investigated contrary to the provisions of this federal Act are being stored, these data shall be corrected or deleted immediately. In the same way, personal data shall be deleted if they are no longer needed for the fulfilment of the task for which they have been used, unless there is a special regulation concerning their deletion. (2) The police authorities shall examine electronically processed personal data which have remained unchanged for six years to find out whether they need to be corrected or deleted pursuant to subsection 1. For data processed in the Central Information Register, sections 58 and 59 shall apply.” 53. In a judgment of 16 March 2001 the Constitutional Court found that under Section 63 of the Security Police Act the police authorities had the obligation to supplement and correct data they had collected pursuant to Section 57 (1) 6. of that act and in particular to add the information whether the public prosecutor had discontinued the criminal investigations or the person concerned had been acquitted of the charges as otherwise the data stored must be considered incorrect. In addition, Section 63 and Section 57 (1) 6. of the Security Police Act must be interpreted in conformity with the Federal Constitution, in particular the right to data protection under Section 1 of the Data Protection Act, which means that there exists also the obligation to delete such data once they are no longer necessary for the purpose of criminal justice even before the time-limit set un section 58 (1) 6. of the Security Police Act has expired. 54. The Storage and Deletion Rules for the Vienna Federal Police Department (Skartierungsvorschrift), an instruction (Erlass) by the Federal Minister for the Interior of 18 September 1992, regulate the elimination and destruction of all documents which were no longer of any use for operational purposes of the Vienna Federal Police Authority. This is done by fixing time limits for storing different categories of documents and the modalities for disposing of these documents after expiry of the time limit. According to Section 5 of the Rules copy files were deleted five years following the end of the year of recording, while index cards and filing registers were destroyed after twenty years. 55. At the supranational level there are two basic instruments which regulate the protection of personal data in Europe. The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 28 January 1981 (European Treaty Series no. 108) and the European Union Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Official Journal L 281, 23/11/1995). 56. The Council of Europe Convention of 28 January 1981 secures in Article 1 “for every individual, whatever his nationality or residence, respect for his rights and fundamental freedoms, and in particular his right to privacy, with regard to automatic processing of personal data relating to him ("data protection")”. Under Article 3 the scope of this Convention is restricted to “automated personal data files and automatic processing of personal data in the public and private sectors”. However according to Article 3 (2) of the Convention “any State may ... give notice by a declaration addressed to the Secretary General of the Council of Europe: (c) that it will also apply this convention to personal data files which are not processed automatically”. Article 6 of the Convention provides that “personal data revealing racial origin, political opinions or religious or other beliefs, as well as personal data concerning health or sexual life, may not be processed automatically unless domestic law provides appropriate safeguards.” Article 6 also provides that “the same shall apply to personal data relating to criminal convictions”. 57. Following the Council of Europe Convention of 28 January 1981 there has also been adopted Recommendation No. R(87)15 of the Committee of Ministers to Member States Regulating the Use of Personal Data in the Police Sector (17 September 1987), which deals with the collection and processing of particular sensitive personal data including necessary safeguard measures. As the Convention the Regulation only applies to “the collection, storage, use and communication of personal data for police purposes which are the subject of automatic processing”, but it also provides that “manual processing of data should not take place if the aim is to avoid the provisions of this recommendation”. 58. Within the European Union Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, as in force at the relevant time, regulates the protection of personal data. According to Article 1 “Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy, with respect to the processing of personal data”. Personal data within the meaning of the directive are any information relating to an identified or identifiable natural person (Article 2 (a)) and "processing of personal data" is “any operation or set of operations which is performed upon personal data, whether or not by automatic means” (Article 2 (b)). Article 3 delimits the scope of the Directive, this provision reads as follows: “1. This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system. 2. This Directive shall not apply to the processing of personal data: in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law; by a natural person in the course of a purely personal or household activity.”