Judgment;Summary — ECLI:EU:C:2025:127
Date: 2025-02-27
Language of the case: German
Court formation: Eighth Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Austria

Summary C-638/23 – 1 
Case C-638/23 
Summary of the request for a preliminary ruling under Article 98(1) of the 
Rules of Procedure of the Court of Justice 
Date lodged: 
24 October 2023 
Referring court: 
Verwaltungsgerichtshof (Austria) 
Date of the decision to refer: 
23 August 2023 
Appellant on a point of law: 
Amt der Tiroler Landesregierung 
  
Subject matter of the main proceedings 
Appeal on a point of law against a ruling by the Bundesverwaltungsgericht 
(Federal Administrative Court, Austria) concerning a data protection matter 
Subject matter and legal basis of the request 
Interpretation of Regulation (EU) 2016/679, Article 267 TFEU 
Question referred for a preliminary ruling 
Is Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of 
the Council of 27 April 2016 on the protection of natural persons with regard to 
the processing of personal data and on the free movement of such data, and 
repealing Directive 95/46/EC (General Data Protection Regulation; GDPR), to be 
interpreted as precluding application of a provision of national law (such as, in the 
present case, Paragraph 2(1) of the Tiroler Datenverarbeitungsgesetz (Tyrol Law 
on data processing)) in which a particular controller is provided for within the 
meaning of the second part of Article 4(7) of the GDPR but 
– this is merely a service (such as, in the present case, the Amt der Tiroler 
Landesregierung (Office of the Provincial Government of Tyrol)) which, although 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-638/23 
 
2  
established by law, is not a natural or legal person nor, in the present case, an 
authority, but functions merely as an auxiliary apparatus for such an authority and 
has no full or partial legal capacity of its own; 
– is nominated without reference to specific processing of personal data, with 
the result that the purposes and means of specific processing of personal data are 
not determined by Member State law either; 
– neither alone nor jointly with others determined the purposes and means of 
the processing of personal data at issue in the present case? 
Provisions of EU law cited 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation; GDPR) – Article 4(7), Article 5, 
Article 9, Article 26 
Provisions of national legislation cited 
Bundesverfassungsgesetz betreffend Grundsätze für die Einrichtung und 
Geschäftsführung der Ämter der Landesregierungen außer Wien (Federal 
Constitutional Law on the principles governing the establishment and 
management of the Offices of the Provincial Governments other than Vienna; ‘the 
BVG ÄmterLReg’) – Paragraphs 1 to 3 
Datenschutzgesetz (Law on data protection; ‘the DSG’) – Paragraph 1(1) 
Gesundheitstelematikgesetz 2012 (Law on health telematics 2012; ‘the GTelG 
2012’) – Paragraphs 18, 24d(2)(3) 
Tiroler Landesordnung 1989 (Tyrolean Provincial Code 1989), LGBl. 
No 61/1988, as amended in LGBl. No 71/2019 – Articles 56 and 58 
Geschäftsordnung des Amtes der Tiroler Landesregierung (Rules of procedure of 
the Office of the Provincial Government of Tyrol) – Paragraphs 4(1), 10, 18 
Tiroler Datenverarbeitungsgesetz (Tyrolean Law on data processing; ‘the 
TDVG’) – Paragraphs 1, 2(1)(a) and 2(3) 
Succinct presentation of the facts and procedure 
1 On 21 December 2021, the interested party lodged a data protection complaint 
with the Datenschutzbehörde (Data Protection Authority; ‘the DSB’) against the 
Office of the Provincial Government of Tyrol, the respondent, for breach of the 
AMT DER TIROLER LANDESREGIERUNG 
 
3 
right to confidentiality under Paragraph 1(1) of the DSG in connection with a 
letter addressed to him in which he was informed of appointments reserved for 
him at a specified location for a COVID vaccination and was invited to take 
advantage of the offer. In that context, the interested party suspects that this letter 
was based on an unauthorised disclosure and processing of data relating to his 
health. 
2 In its observations of 31 January 2022, the Office of the Provincial Government of 
Tyrol declared to the DSB, inter alia, that it, the Office of the Provincial 
Government, was the controller in terms of data protection law responsible for the 
sending of that letter and that there was no joint controller within the meaning of 
Article 26 of the GDPR. 
3 By decision of 22 August 2022, the DSB – in so far as is here relevant – upheld 
the data protection complaint and found that the Office of the Provincial 
Government of Tyrol had breached the interested party’s right to confidentiality. It 
found that the Office of the Provincial Government of Tyrol had no specific 
access authorisation for the central vaccination register under Paragraph 24f(4) of 
the GTelG 2012, for which reason the subsequent processing of data had been 
unlawful. 
4 The action brought against that decision by the Office of the Provincial 
Government of Tyrol was dismissed as unfounded by the Federal Administrative 
Court in the ruling under appeal. 
5 The Federal Administrative Court found, in essence, that a ‘proposal’ had been 
drawn up by the Office of the Provincial Government of Tyrol for determining the 
purpose and means of the data processing at issue and was subsequently ‘released’ 
by the Landeshauptmann (Head of Government), with summary instructions. The 
procedure for sending a letter to citizens of the Province of Tyrol, in particular the 
proposal to send a ‘vaccination reminder’ to all individuals in Tyrol aged 18 years 
or older (and not yet vaccinated against Covid–19), had been drawn up, and the 
letter drafted, by the Office of the Provincial Government of Tyrol. The linking of 
the interested party’s place of residence with the place of vaccination was based 
on a proposal from the Office of the Provincial Government of Tyrol, and the 
Office of the Provincial Government had undertaken its technical implementation. 
The Office of the Provincial Government of Tyrol had repeatedly declared itself to 
be the controller of the processing of personal data – for example, in its privacy 
statement. On 19 November 2021, the Province of Tyrol, represented by the 
Office of the Provincial Government of Tyrol, had commissioned E GmbH to 
identify the addressees of the ‘vaccination reminder’. E GmbH had passed on the 
commission to I GmbH. In performance of the commission, I GmbH had first 
identified all individuals from the patient index (list of patients maintained 
pursuant to Paragraph 18 of the GTelG 2012) who were over 18 years of age and 
had declared an address in Tyrol. Subsequently, I GmbH had filtered out those 
who had an entry in the central vaccination register recording that they had been 
vaccinated with a COVID-19 vaccine authorised in the European Union. I GmbH 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-638/23 
 
4  
had submitted the names and addresses of the remaining individuals to the Office 
of the Provincial Government of Tyrol on 25 November 2021. The interested 
party had neither participated in the processing of his personal data nor given his 
consent. 
6 The Federal Administrative Court further found that, from a legal point of view, it 
followed from Paragraph 2(1)(a) and (3) of the TDVG alone that the Office of the 
Provincial Government of Tyrol was to be classified as the controller in respect of 
the processing of personal data at issue in the present case. The consultation of 
data from the patient index and from the central vaccination register and the 
pooling of those data, both done on a commission from the Office of the 
Provincial Government of Tyrol, were attributable for the purposes of data 
protection law to the Office of the Provincial Government of Tyrol. Under 
Paragraph 18 of the GTelG 2012, the Office of the Provincial Government of 
Tyrol had no grounds by which to justify lawful access to the patient index within 
the meaning of Article 5(1)(a) of the GDPR. In connection with access to the 
central vaccination register, that court held that the interested party’s vaccination 
status was a special category of personal data within the meaning of Article 9(1) 
of the GDPR because information about the data subject’s state of health could be 
derived from his vaccination status. The processing of vaccination status data 
would be authorised only if one of the exceptions to the processing prohibition of 
Article 9(1) of the GDPR which are set out in Article 9(2) of the GDPR applied. 
In the view of the court, no such exception obtained. The Office of the Provincial 
Government of Tyrol had no access authorisation for the central vaccination 
register for the purpose of issuing ‘reminders of vaccinations’ under 
Paragraph 24d(2)(3) of the GTelG 2012. Since the identification of address data 
by accessing the patient index and the central vaccination register was shown to 
be unlawful, their further use to address and send the ‘vaccination reminders’ was 
also unlawful. 
7 The present extraordinary appeal on a point of law by the Office of the Provincial 
Government of Tyrol has been brought against that ruling. In the pre-litigation 
procedure initiated by the Verwaltungsgerichtshof (Supreme Administrative 
Court, Austria), the DSB submitted a response to the appeal on a point of law, 
claiming that the appeal should be dismissed on procedural grounds or, in the 
alternative, on the merits. 
Succinct presentation of the reasoning in the request for a preliminary ruling 
8 In connection with the data processing in question, it is necessary to determine 
whether the Office of the Provincial Government of Tyrol has the status of 
controller within the meaning of Article 4(7) of the GDPR. 
9 Under the definition set out in Article 4(7) of the GDPR, ‘controller’ means the 
natural or legal person, public authority, agency or other body which, alone or 
jointly with others, determines the purposes and means of the processing of 
AMT DER TIROLER LANDESREGIERUNG 
 
5 
personal data; where the purposes and means of such processing are determined 
by EU or Member State law, the controller or the specific criteria for its 
nomination may be provided for by EU or Member State law. 
10 In accordance with the settled case-law of the CJEU, the term ‘controller’ is 
broadly defined in order to guarantee the effective and comprehensive protection 
of data subjects. The term can also refer to two or more parties involved in data 
processing. Any person who or which exerts influence over the processing of 
personal data, for his or its own purposes, and who participates, as a result, in the 
determination of the purposes and means of data processing, may be regarded as a 
controller. By contrast, persons cannot be considered to be controllers in the 
context of operations that precede or are subsequent in the overall chain of 
processing for which those persons do not determine either the purposes or the 
means. Liability is limited to operations involving the processing of personal data 
in respect of which the person in question actually determines the purposes and 
means. The determination of the purpose and means of processing in accordance 
with the underlying provisions need not (necessarily) be carried out by the use of 
written instructions. Any person who contributes to determining the purposes and 
means of data processing can be considered to be a controller (cf. on all of the 
above points the ruling of the Supreme Administrative Court of 27 June 2023, 
Ro 2023/04/0013, paragraphs 21 to 23, with reference to the judgments of the 
CJEU of 29 July 2019, C-40/17, Fashion ID, ECLI:EU:C:2019:629, 
paragraphs 66 to 70, 74 and 85; of 5 June 2018, C-210/16, Wirtschaftsakademie 
Schleswig-Holstein, ECLI:EU:C:2018:388, paragraph 31; and of 10 July 2018, 
C-25/17, Jehovan Todistajat, ECLI:EU:C:2018:551, paragraph 67). 
11 According to the findings of the Federal Administrative Court, the Office of the 
Provincial Government of Tyrol merely drew up a ‘proposal’ for the purpose of 
the data processing (increasing the vaccination rate) and the means (targeted 
invitation of persons aged 18 years or older residing in Tyrol who had not yet 
been vaccinated against COVID-19, using data from the central vaccination 
register and the patient index – by way of the Province of Tyrol, represented by 
the Office of the Provincial Government of Tyrol, commissioning E GmbH – and 
linking each data subject’s place of residence with the proposed place of 
vaccination), which was subsequently ‘released’ and thereby approved by the 
Landeshauptmann, who, under Article 58 of the Tyrolean Provincial Code 1989, 
is head of the Office of the Provincial Government of Tyrol and, under 
Article 56(1) of the same code, represents the Province of Tyrol. 
12 It follows that the Landeshauptmann alone, in his capacity as representative of the 
Province of Tyrol, and not, alone or jointly with him, the Office of the Provincial 
Government of Tyrol, determined both the purpose and the means of the 
processing of personal data. There is nothing in the facts established to indicate 
that, in the present case, the Office of the Provincial Government of Tyrol 
determined, alone or jointly with the Landeshauptmann, the purposes and means 
of data processing – not even in respect of individual stages of the data 
processing – or that it at least contributed to that determination for its own 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-638/23 
 
6  
purposes and bears responsibility for at least part of the data processing as an 
additional party alongside the Landeshauptmann. In the opinion of the Supreme 
Administrative Court, this alone would suffice to make the Office of the 
Provincial Government of Tyrol not a controller within the meaning of the first 
part of Article 4(7) of the GDPR. 
13 However, the Federal Administrative Court also derives its classification of the 
Office of the Provincial Government of Tyrol as a controller from the Office’s 
designation as a controller in Paragraph 2(1)(a) and (3) of the TDVG. 
14 It is therefore necessary to determine whether it was possible validly to designate 
the Office of the Provincial Government of Tyrol as a controller within the 
meaning of the first part of Article 4(7) of the GDPR on the basis of that legal 
provision, irrespective of the fact that, not having determined the purposes and 
means of the processing of personal data, it does not have the status of a controller 
in accordance with the second part of Article 4(7) of the GDPR. 
15 In principle, the Office of the Provincial Government of Tyrol has no executive 
function and no legal personality of its own. Although the provincial legislation 
can entrust the Office of the Provincial Government of Tyrol with official tasks on 
a case-by-case basis and thereby provide for it as a public authority, that did not 
happen in connection with the production and sending of the letter to the 
interested party in the present case. 
16 That letter did not impose a legally binding obligation on the interested party to 
receive a COVID vaccination; on the contrary, it invited the interested party to 
receive a COVID vaccination at one of several simultaneously announced 
appointments at a specified location. The letter neither constitutes an act of public 
authority, nor is it connected with an act of public authority by way of preparing, 
accompanying or implementing such an act. 
17 The Office of the Provincial Government of Tyrol is therefore neither a natural or 
legal person, nor is it a public authority in connection with the processing of the 
interested party’s personal data in the present case. On the contrary, it acted in the 
present case purely as an auxiliary apparatus within the framework of 
administration delegated to the private sector, without full or partial legal 
personality. 
18 In that context, the question arises whether a mere service, as an auxiliary 
apparatus of a public authority without full or partial legal capacity of its own – 
such as the Office of the Provincial Government of Tyrol in the present case – is 
to be understood as an ‘agency or other body’ within the meaning of the first part 
of Article 4(7) of the GDPR and can therefore, in accordance with the second part 
of Article 4(7) of the GDPR, be provided for as a controller by Member State law. 
19 The GDPR does not refer to Member State law for the meaning and scope of the 
terms contained in its Article 4(7), in particular with regard to the terms ‘agency’ 
AMT DER TIROLER LANDESREGIERUNG 
 
7 
and ‘other body’, with the result that those terms must be given an autonomous 
and uniform interpretation. 
20 The terms ‘agency’ and ‘other body’, used not only in the first part of Article 4(7) 
of the GDPR but also in relation to the definitions of ‘processor’ (point (8)), 
‘recipient’ (point (9)) and ‘third party’ (point (10)) in Article 4 of the GDPR, are 
not defined in greater detail in the GDPR. 
21 Under Article 24(1) of the GDPR, responsibility for data protection lies with the 
controller. He or it is therefore obliged in principle to put in place suitable 
technical and organisational measures to ensure that processing is compliant with 
the regulation and to review and to update those measures as required. 
22 The existence of legal personality or full or partial legal capacity as a prerequisite 
for an ‘agency or other body’ would primarily correspond to the intention of 
Article 4(7) of the GDPR to guarantee the effective and comprehensive protection 
of the data subject. In the view of the European Data Protection Board, the 
controller must not only have at least a say in the purposes and means of the 
processing of personal data but is also supposed to have a genuine ability to 
exercise control (cf. its Guidelines 07/2020 on the concepts of ‘controller’ and 
‘processor’ in the GDPR, version 2.0, of 7 July 2021, paragraph 23). 
Comprehensive protection of the data subject will be effective only if the 
controller is de facto able to take the necessary action, refrain from prohibited 
activities and uphold the obligations and fundamental principles of data 
processing laid down in the GDPR. That would require the controller to have at 
least partial legal capacity. 
23 On the other hand, such a definition which relies on the existence of legal 
personality might be contested on the grounds that an ‘agency or other body’ 
would already be covered by the term ‘legal person’ in the first part of Article 4(7) 
of the GDPR. 
24 In summary, it is unclear to the Supreme Administrative Court whether an 
‘agency or other body’ within the meaning of Article 4(7) of the GDPR 
presupposes legal personality and whether the Office of the Provincial 
Government of Tyrol, which is neither a natural or legal person nor, in the present 
case, a public authority, can validly be provided for as a controller by Member 
State law under the second part of Article 4(7) of the GDPR. 
25 In the view of the European Data Protection Board, the controller’s specific 
identification by law is determinative for establishing who is acting as controller 
(cf. its Guidelines 07/2020 on the concepts of ‘controller’ and ‘processor’ in the 
GDPR, version 2.0, of 7 July 2021, paragraph 23). 
26 The Office of the Government of the Province of Tyrol is designated as a 
controller in Paragraph 2 of the TDVG without reference to any specific 
processing of the personal data of the Province of Tyrol, in particular to the 
processing of personal data for the purpose of producing and sending letters such 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-638/23 
 
8  
as that which was addressed to the interested party. On the contrary, the 
nomination of the Office of the Government of the Province of Tyrol as controller 
in Paragraph 2 of the TDVG refers to data processing in general, without further 
specifying that data processing. In the absence of any reference to specific data 
processing, the TDVG also does not set out the purpose or means of the individual 
processing of personal data that the Province of Tyrol conducts or commissions 
alone or for a controller other than the Office of the Provincial Government of 
Tyrol or for specified controllers. 
27 It is unclear to what extent the purposes and means of data processing must be 
determined by Member State law within the meaning of the second part of 
Article 4(7) of the GDPR so that the controller may be provided for as a controller 
by Member State law and whether, in that respect, the nomination of the Office of 
the Provincial Government of Tyrol as a controller in Paragraph 2 of the TDVG, 
without reference to any specific processing of personal data and without 
stipulation of the purpose and means of such specific processing of data, is in 
alignment with Article 4(7) of the GDPR and is binding on the supervisory 
authority and the courts in proceedings concerning a complaint within the 
meaning of Article 77 of the GDPR. 
28 Reference to specific data processing when nominating the controller in law under 
the second part of Article 4(7) of the GDPR is primarily decisive in relation to the 
permissibility conditions set out in Article 6(1)(c) and (e) of that regulation. Under 
those provisions, processing is lawful if the processing is necessary for 
compliance with a legal obligation to which the controller is subject (point (c)) or 
the processing is necessary for the performance of a task carried out in the public 
interest or in the exercise of official authority vested in the controller (point (e)). 
29 It must also be concluded from the permissibility conditions decisive in the 
present case, which are set out in Article 6(1)(c) and (e) of the GDPR, and from 
the intention of Article 4(7) of the GDPR to guarantee the effective and 
comprehensive protection of the data subject, that a person can be designated as a 
controller under Member State law only if he or it is entitled by law and de facto 
able to determine, alone or jointly with others, the purposes and means of the 
specific processing of personal data, exercise genuine control and take the 
necessary action, refrain from prohibited activities and uphold the obligations and 
fundamental principles of data processing laid down in the GDPR. 
30 As stated in paragraphs 9 to 12 above, the Office of the Provincial Government of 
Tyrol – even only in respect of individual stages of the processing of personal data 
on which the letter to the interested party was based – neither determined the 
purposes and means of the data processing nor at least contributed to that 
determination for its own purposes. In such a case, the Supreme Administrative 
Court has doubts as to whether the Office of the Provincial Government of Tyrol 
can be provided for as a controller by Member State law under the second part of 
Article 4(7) of the GDPR.