Austria Jurisdiction: Prospective Filing System Inclusion

The factor of Prospective Filing System Inclusion is explicitly addressed in Austria's Federal Act concerning the Protection of Personal Data (DSG). The law applies to the processing of personal data, even when the processing is performed without automated means, if the data is intended to be part of a filing system.

Text of Relevant Provisions

Austria DSG. § 4(1):

"The provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ No L 119 of 4 May 2016, p. 1 (in the following: General Data Protection Regulation) and this federal law shall apply to the processing of personal data of natural persons wholly or partly by automated means and to the processing other than by automated means of personal data of natural persons which form part of a filing system or are intended to form part of a filing system, unless the more specific provisions of Chapter 3 of this federal law prevail."

Original (German):

"Die Bestimmungen der Verordnung (EU) 2016/679 zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten und zum freien Datenverkehr sowie zur Aufhebung der Richtlinie 95/46/EG (Datenschutz-Grundverordnung), ABl. Nr. L 119 vom 4. Mai 2016, S. 1 (im Folgenden: Datenschutz-Grundverordnung) und dieses Bundesgesetzes gelten für die Verarbeitung personenbezogener Daten natürlicher Personen, die ganz oder teilweise auf automatisierte Weise erfolgt und für die nicht automatisierte Verarbeitung personenbezogener Daten natürlicher Personen, die Teil eines Dateisystems sind oder werden sollen, es sei denn, die spezifischeren Bestimmungen von Kapitel 3 dieses Bundesgesetzes haben Vorrang."

Analysis of Provisions

• Austria DSG § 4(1) clearly states that the law applies not only to automated data processing but also to non-automated processing when the personal data "form part of a filing system or are intended to form part of a filing system." This means that the intention to include data in a filing system is sufficient to bring the processing activities under the scope of Austria’s data protection law, even if the data is not yet part of a structured filing system at the time of processing.
• The inclusion of the phrase "intended to form part of a filing system" ensures that data protection obligations are triggered as soon as there is a clear intent to organize or structure the data systematically. This prevents any potential loophole where data could be processed without protections simply because it has not yet been formally included in a filing system.
• The rationale for including this factor is to provide robust protection for personal data, ensuring that all processing activities are covered, whether automated or manual, as long as the data is expected to become part of a filing system. This is in line with the GDPR's approach, which the Austrian law complements and implements.

Implications

• For businesses operating in Austria, this means that they must be aware that their data processing activities may fall under the scope of the DSG even if they are not yet utilizing a formal filing system. As soon as personal data is intended to be organized or structured into a filing system, the full set of data protection obligations apply.
• This can particularly affect businesses that handle large volumes of unstructured data or those that are in the process of digitizing or organizing their data. They must ensure that even during preliminary stages of data processing, they are compliant with data protection laws, as the intention to structure the data triggers the applicability of the DSG.
• An example of this would be a company collecting customer information with the plan to later incorporate it into a CRM system. Even before the data is uploaded into the CRM, the company must comply with Austria’s data protection law, as the data is intended to become part of a structured filing system.