Source: https://english.bmf.gv.at/services/data-protection.html
Timestamp: 2019-04-25 08:03:11+00:00

Document:
What is regulated by the General Data Protection Regulation?
What does the Austrian Data Protection Act regulate?
What does the term “controller” mean?
What does the term “processor” mean?
Where can you find further information on data protection?
For what purposes and on what legal bases does processing of personal data take place?
Who is the Data Protection Officer in the finance department?
To whom are personal data disclosed?
How long are personal data going to be stored?
Is there any automated decision-making, e.g. profiling?
What happens when you visit our websites?
Which security standards is the data processing subject to?
How can you submit your application?
How will your application be answered?
Which redress do you have?
Protection and privacy of personal data is a matter of great importance for the Federal Ministry of Finance (BMF) and all competent bodies of the finance department responsible for data protection. We take care to process all personal data in accordance with all applicable European and Austrian statutory provisions, and we take our responsibility very seriously.
We want you to know for what purposes and on what legal bases we collect personal data, and how we process these data. We also want to inform you about your rights in data protection matters and the contact persons available for you in this respect.
As changes to the Data Protection Statement may become necessary over the course of time, we encourage you to revisit the same from time to time.
Data protection is a fundamental right enshrined in the Charter of Fundamental Rights of the European Union and in § 1 of the DSG (Austrian Data Protection Act). From 25 May 2018 on, the General Data Protection Regulation (GDPR) is in force in the European Union. At the same time, the new Austrian Data Protection Act (Datenschutzgesetz, DSG) enters into force in Austria.
The GDPR is a regulation of the European Union and is directly effective in every Member State, thus including Austria. The GDPR comprises rules on the processing of personal data, such as the principles of processing, the rights of the data subjects and the responsibilities of the controllers and processors.
The DSG is an Austrian law and comprises provisions supplementing the GDPR and stipulations for the implementation of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the processing of personal data by competent authorities for purposes of the prevention, detection, investigation or prosecution of criminal offenses or the execution of criminal penalties, including protection from and prevention of threats to public safety, as well as for purposes of national security, intelligence and military intrusion prevention.
Personal data are any information that relates to an identified or identifiable natural person (“data subject”). A natural person is deemed identifiable if he or she can be identified directly or indirectly, for example by means of a name or an identification number (e.g. tax identification number, social security number and account number).
For further information, please see Article 4 (1) of the GDPR.
The term “processing” means any process involving personal data that is carried out with or without the aid of automated procedures. These include, for example, collecting, recording, organising, sorting, storing, adapting or modifying, reading out, querying, using, divulging through transmission, dissemination or any other form of disclosure, matching or merging, restricting, deleting or destroying personal data.
For further information, please see Article 4 (2) of the GDPR.
The term “controller” means the person or entity, public authority, agency or other body that, alone or in cooperation with others, decides on the purposes and means of processing personal data.
For further information, please see Article 4 (7) of the GDPR.
The term “processor” means a person or entity, public authority, agency or other body that processes personal data on behalf of the controller.
For further information, please see Article 4 (8) of the GDPR.
The full text of the GDPR can be found on EUR-Lex at eur-lex.europa.eu. The full text of the DSG (in German) and the full text of the Austrian Code of Fiscal Offences (Finanzstrafgesetz) (in German) in the version of 25 May 2018 can be found in the legal information system of the Federal government at http://www.ris.bka.gv.at/. For more information on data protection, please see also the website of the Austrian Data Protection Authority at http://www.dsb.gv.at/.
The task fulfilment of the organisational units of the finance department is based on legal foundations, i.e. on national laws and regulations as well as on directly applicable regulations of the European Union. Our basic task is to ensure the financial interests of the Republic of Austria and the European Union, and thus in particular to collect federally levied charges and contributions, and to grant family allowances and other benefits.
The Federal Fiscal Court is responsible for deciding on complaints pursuant to Art. 130 I 1 to 3 of the B-VG (Federal Constitutional Law), especially in legal matters of public tax affairs, insofar as these are provided by tax offices, customs offices, the Federal Ministry of Finance and the Municipal Authority of the City of Vienna.
Please note that the following purposes, legal bases and processing modalities are a general listing. For individual and detailed information about your personal data, you have the right to information. The person to contact for this purpose is listed in the Data Protection Rights section.
We process personal data in the context and for the purpose of fulfilling our statutory duties.
Where we fulfil our statutory duties and the processing of personal data is required for the fulfilment of these duties, this is done on the basis of the exercise of duties in the public interest or the exercise of official authority within the meaning of Article 6 (1) (e) of the GDPR and § 38 of the DSG.
Where we are under legal obligation to process personal data, such as statutory documentation and retention obligations, this is done on the basis of the fulfilment of a legal provision within the meaning of Article 6 (1) (c) of the GDPR.
The legal bases and legal framework conditions arise from numerous laws and regulations, such as the Austrian Federal Constitutional Law, the Austrian Federal Ministries Act of 1986, the Austrian Federal Tax Code, the Austrian Code of Fiscal Offences, the Austrian Code of Criminal Procedure, the Austrian Customs Law Implementation Act, the Austrian Tax Administration Organisation Act of 2010, the Ordinance of the Federal Minister of Finance on Implementation of the Tax Administration Organisation Act of 2010, the Austrian Federal Finance Court Act, the Austrian Accounts Register and Account Inspection Act, the EU Convention on Mutual Assistance in Criminal Matters, the Austrian Common Reporting Standard Act, the Austrian Transfer Pricing Documentation Act, the Austrian Family Assistance Equalisation Fund Act of 1967, the Austrian Civil Servants Act of 1979, the Austrian Contract Employees Act of 1948, the Austrian Federal Budget Act of 2013, the Austrian Federal Budget Ordinance of 2013, the Austrian Gambling Act, the Austrian Transparency Database Act of 2012, the General Data Protection Regulation, the Austrian Data Protection Act, the Austrian Information Security Act, the FinanzOnline Ordinance of 2006, the Austrian Cash Register Security Ordinance and the Austrian e-Invoicing Ordinance.
Where processing of personal data is required for the conclusion of contracts, such as in contracts with suppliers and service providers, this takes place on the basis of the fulfilment of the contract or the performance of pre-contractual measures within the meaning of Article 6 (1) (b) of the GDPR.
Furthermore, in certain cases, we process personal data on the basis of the consent of the data subject within the meaning of Article 6 (1) (a) of the GDPR, e.g. when ordering publications and forms, or when registering for newsletters and events. The scope and content of the processing always result from the respective consent. In these cases, there is no obligation for the provision of personal data, and of course there is the right to revoke the consent at any time. However, the revocation does not affect the legality of the processing done until revocation. In addition, we cannot process your request further in case of revocation.
For the processing of personal data for purposes of the tax and customs administration of the Federal government and for purposes of preventing, investigating, detecting or prosecuting financial offenses as well as for the execution of financial penalties, responsibility rests with the competent and locally responsible tax or financial penal authorities. As a rule, these are the tax offices for the tax administration and the customs offices for the customs administration. The Federal Ministry of Finance is responsible for managing the affairs of the supreme Federal administration in accordance with the Federal Ministries Act of 1986.
The Federal Fiscal Court is responsible for the processing of personal data in the fulfilment of the tasks entrusted to it; these are primarily complaint proceedings concerning financial and customs offices.
As part of the processing of personal data in the grant procedure, the Federal Ministry of Finance shares responsibility with the Federal Chancellery.
The Federal Ministry of Finance is responsible for the processing of personal data for the purpose of communication and IT coordination.
Questions and concerns in data protection matters can be addressed to the heads of the respectively competent body responsible for the processing of your personal data, or to the Data Protection Officer of the Ministry of Finance, to the extent that the judicial activities of the Federal Fiscal Court are not affected.
The contact details of the Federal Ministry of Finance can be found at http://www.bmf.gv.at/ in the “Contact” section. The contact details of the tax offices and customs offices are likewise to be found at http://www.bmf.gv.at/ in the province-specific overviews under the heading “Offices and Authorities” (in German). The contact details of the Federal Fiscal Court can be found at www.bfg.gv.at in the “Contact” section. For the contact details of other jointly responsible bodies, please refer to the respective linked websites.
The data protection officer of the Federal Ministry of Finance acts as the data protection officer for the entire finance department and is available to answer questions on data protection matters.
In the field of activity of thethe Federal Fiscal Court, we process on the one hand the data provided by the tax and customs administration of the Federal government, the Municipal Authority of the City of Vienna or the Federal Ministry of Finance on the occasion of a complaint submission, as well as further information required for complaint proceedings.
We collect special categories of personal data, also known as sensitive data, if this is necessary for the procedure, and the legal basis for this is available. For example, we need information about the religious denomination to account for church tax payments.
Most of the personal data we process are collected directly from the data subject concerned, e.g. through tax and customs procedures or through business relationships. In addition, we collect personal data from third parties, especially if this is legally required.
Furthermore, we receive tax-relevant information from other authorities or through inter-governmental information exchange, in particular in the context of mutual assistance requests and automatic exchange of information. In the Transparency Database, we store data on benefits received, which are communicated by the providing bodies or with regard to which there is the possibility of querying. We also process publicly available information, such as online and offline media, public registers or public announcements.
As a matter of principle, we disclose personal data only if the transfer of certain data is legally required, e.g. within the scope of legal information obligations, in compliance with the respective legal requirements, or if you have consented to the disclosure.
We store personal data as long as necessary for the fulfilment of the respective processing purposes. The measures for this are the statutory retention obligations and limitation periods.
The periods for retention or deletion, respectively, arise from the applicable statutory provisions, such as from the Federal Tax Code, the Austrian Code of Fiscal Offences, and the Federal Budget Act.
As a matter of principle, we take legally binding decisions on the basis of automated processing of personal data only if this is legally required, such as in the case of automated employee tax assessment pursuant to § 41 of the Austrian Income Tax Act of 1988.
When you visit our websites, your IP address, date and time of the retrieval, connection information (destination address, files accessed, amounts of data transferred and status) as well as information about the operating system and the web browser are stored in a log file for a limited time. Collection of these data is indispensable for the operation of the web pages, in particular to ensure stability and security.
In addition, we use a web analysis service on our websites, whereby we anonymise IP addresses immediately. The analysis serves exclusively for optimisation of our web offer.
We process personal data with utmost care and have taken extensive technical and organisational security measures to ensure that the applicable data protection regulations are observed and complied with by all responsible bodies as well as by the processors contractually commissioned by us.
This applies in particular to the protection of personal data against unauthorised or unlawful processing, accidental or unlawful destruction, loss or alteration, unauthorised disclosure or unauthorised access to personal data that are transmitted, stored or otherwise processed. The security measures are state-of-the-art and include, among other things, use of advanced security technologies and encryption techniques, physical access controls and anti-intrusion measures.
Data protection and information security were given high priority by us even before 25 May 2018. For this reason, as early as 2008 we implemented an Information Security Management System (ISMS) that is certified according to the international security standard ISO 27001 and reviewed annually. This made us the first Federal Ministry in Europe to have obtained such certification. Among other things, the ISMS ensures that existing risks are systematically identified, assessed and addressed by appropriate measures. It also ensures that the effectiveness of the measures is regularly reviewed, assessed and evaluated.
The GDPR and the DSG also regulate the data protection rights of the data subjects, i.e. the persons whose personal data are being processed. The legal rights of the data subjects are directed against the controller, that is, against the competent body responsible for the data processing.
the right to information whether personal data concerning you are being processed and what their contents are, as well as the right to rectification or completion as well as to erasure of your personal data, to restriction of the processing, to objection to processing and to data portability, provided the legal requirements exist.
The respective legal requirements as well as any exceptions from and limitations to these rights result from Articles 12 to 22 of the GDPR and from §§ 42 to 45 of the DSG, as well as from the statutory provisions that underlie the respective data processing. Pursuant to § 48f of the Austrian Federal Tax Code (Bundesabgabenordnung, BAO) and § 57b of the Austrian Code of Fiscal Offences (Finanzstrafgesetz, FinStrG), for personal data processed on the basis of the BAO or the FinStrG and contained in a file, the right to information is based exclusively on § 90 of the BAO or § 79 of the FinStrG (access to records). Access to records permits you to demand access and receipt of a copy of your files (or parts thereof) whose knowledge is necessary to safeguard your rights and enable you to fulfil your obligations in the context of fiscal and financial criminal proceedings. Further specific data protection regulations or restrictions result in particular from §§ 48d to 48i of the BAO and §§ 57c and 57d of the FinStrG.
In cases where there are legal exceptions or limitations to these rights, we may not, or only partially, comply with your application. If legally permissible, we will inform you in this case of the reason for the refusal or restriction.
Please write your application as specifically as possible. Only in this way can we process it efficiently and quickly. Please also note that in the area of application of the Austrian Federal Tax Code (Bundesabgabenordnung, BAO), requests for information pursuant to § 48f of the BAO must specify which information or processing operations the request for information relates to.
Insofar as the request for information relates to personal data contained in a file, pursuant to § 48f II of the BAO the access procedure of the BAO applies. Electronic application is therefore possible only via FinanzOnline. In the cases of § 48g I of the BAO, for the right of correction according to Art. 16 of the GDPR the procedure according to the regulations of the BAO is likewise to be carried out.
Please understand that in cases of doubt we may have to request further information about your identity. This is solely for the protection of your personal data and intended to ensure that only you yourself receive information about your personal data.
We will provide you with the relevant information about the measures as soon as possible, but no later than within one month of receipt of your application.
Please note that this period may be extended for a further two months, if this is necessitated by the complexity or number of applications. However, we will inform you of any extension of the deadline and the reasons for this within one month of receipt of your application.
Personal data are a matter of trust. As an unencrypted email unfortunately cannot be considered secure and resembles more a postcard than a letter, we may never send you the answer to your request by email. You will therefore receive the answer by letter mail (RSa) or in tax matters possibly by means of the FinanzOnline Databox.
If you have any questions, suggestions or complaints in data protection matters, please contact the BMF Data Protection Officer.
If you feel that the processing of your personal data by us violates data protection regulations, or your data protection rights have otherwise been violated, you can lodge a complaint with the competent supervisory authority. In Austria, this is the Österreichische Datenschutzbehörde (Austrian Data Protection Authority).
If you believe that the Federal Fiscal Court has violated your rights under the General Data Protection Regulation in the exercise of its jurisdictive competence, you may file a complaint with the Federal Fiscal Court in writing or by fax.

References: § 1
 Art. 130
 § 38
 § 41
 § 48
 § 57
 § 90
 § 79
 § 48
 § 48
 § 48
 Art. 16