(Dieser Artikel ist auch in deutscher Sprache verfügbar)

The lack of adequate independence of the Austrian Data Protection Authority (Datenschutzkommission) is an issue the European Commission deals with since a complaint was filed by the data protection association Arge Daten back in October 2003.

In July 2005 the Commission started infringement procedures against Austria for a faulty implementation of Article 28 (1) second sentence of the data protection directive (95/46/EG) which requires that data protection authorities shall exercise their functions with complete independence.

The Austrian Data Protection Commission is, in terms of organisation and staff, integrated in the Federal Chancellery.

According to a draft law, aiming to change various regulations of the Austrian Constitution that was open for public consultation until mid September, the DPA will be closed down. Some of the duties of the DPA are planned to be assigned to nine administration courts (one in each of the nine Austrian provinces) that will be established with this new law. By which organisation(s) the remaining duties will be fulfilled remains unclear.

In its bi-annual activity report for the years 2005 - 2007 the DPA strongly opposes these plans, arguing that the possibilities to assign the duties of the DPA to administration courts are limited, since these courts can only deal with complaints about unlawful behaviour of administrative bodies. Complaints about unlawful behaviour of private sector entities will then be dealt with by civil courts.

This will not only make it difficult for citizens to find the responsible court but also increases the barrier and costs to execute ones' rights, since (administration) court procedures are by far more formal than the very informal procedures of the existing Data Protection Authority.

While it remains unclear which organisation(s) will fulfil the remaining duties of the DPA the draft law includes provisions to create "independent" institutions that are not bound to directives of their superior institutions. But superior institutions will be granted the right to examine all procedures of the "independent" institution and to withdraw the "independent" institutions for "important reasons".

If this draft law comes into force without substantial corrections this will lead to an even lower level of enforcement of data protection rights than Austria enjoys today. This level is rather low in Austria since the DPA suffers of a lack of staff while its workload constantly increases.

In a comparison of the number of staff of European DPAs in relation to inhabitants of their countries, the Austrian DPA is on rank 27 (24 in the year 2004) out of 31 countries. On the average, similar sized countries have DPAs with 40 staff members, the Austrian DPA only has 20.

While in most other countries the number of staff increased between 2004 and 2006 it remained the same in Austria, but even worse, the important position of the contact person to international organisations like the Article 29 working party had to be given up due to new duties that were assigned to the DPA.

Concluding, it has to be said that the draft law, that will result in shutting down the Austrian DPA, seems to be a consistent step further in a history of non-ambitious data protection policy. While Austria's officials are proud to be rated again number one in E-Government they should rather be ashamed of being tail-light in data protection.

Austrian Data Protection Authority
http://www.dsk.gv.at

Arge Daten
http://www.argedaten.at

EDRI-gram: EC: data protection inadequate in Austria and Germany (24.08.2005)
http://www.edri.org/edrigram/number3.17/DPA

Draft law - on the Austrian Parliament webpage
http://www.parlinkom.gv.at/portal/page?_pageid=908,6614640&SUCHE=J...

Bi-annual report of the Austrian DPA for the years 2005 - 2007
http://www.dsk.gv.at/Datenschutzbericht2007.pdf

(contribution from Andreas Krish - EDRI-member VIBE! - Austria)