Source: https://www.gdpr-expert.com/article.html?mid=6&id=17&post_type=post
Timestamp: 2019-11-18 02:08:03
Document Index: 634437648

Matched Legal Cases: ['§ 4', '§ 7', '§ 367', '§ 27', '§ 46', '§ 26', '§ 30', '§ 31']

Scope of application and implementing provision
§ 4 DSG
(2) If personal data processed by automated means cannot be rectified or erased immediately because they can be rectified or erased only at certain times for economic or technical reasons, processing of the personal data concerned shall be restricted until that time, with the effect as stipulated in Article 18 para. 2 of the General Data Protection Regulation.
§ 7 DSG
(1) For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes whose goal is not to obtain results in a form relating to specific data subjects, the controller may process all personal data that
are publicly accessible
the controller has lawfully collected for other research projects or other purposes, or
are pseudonymised personal data for the controller, and the controller cannot establish the identity of the data subject by legal means.
(2) In the case of processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes that do not fall under para. 1, personal data may be processed only
pursuant to specific legal provisions,
with the consent of the data subject, or
with a permit of the Data Protection Authority pursuant to para. 3.
(3) A permit of the Data Protection Authority for the processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall be granted at the request of the controller ordering the research project, if
the consent of the data subject is impossible to obtain because the data subject cannot be reached or the effort would otherwise be unreasonable,
there is a public interest in the processing for which a permit is sought, and
the professional aptitude of the controller has been satisfactorily demonstrated.
If special categories of personal data (Article 9 of the General Data Protection Regulation) are to be collected, an important public interest in the research project must exist; furthermore, it must be ensured that the personal data are processed at the premises of the controller ordering the research project only by persons who are subject to a statutory obligation of confidentiality regarding the subject matter of the research project or whose reliability in this respect is credible. The Data Protection Authority shall issue the permit subject to terms and conditions, insofar as this is necessary to safeguard the data subjects’ interests which deserve protection.
(4) A request according to para. 3 must, however, be accompanied by a statement signed by the person authorised to exercise rights in respect of the data files from which the personal data are to be collected, stating that this person is making the data files available for the research project. Instead of this statement, a writ of enforcement (§ 367 para. 1 of the Enforcement Code, Imperial Law Gazette No 79/1896) replacing this statement may be submitted.
(5) Even in cases where the processing of personal data for scientific research purposes or statistical purposes is permitted in a form which allows the identification of data subjects, the data shall be coded without delay so that the data subjects are no longer identifiable if specific phases of scientific or statistical work can be performed with personal data pursuant to para. 1 subpara. 3. Unless otherwise expressly provided for by law, data in a form which allows the identification of data subjects shall be rendered unidentifiable as soon as it is no longer necessary for scientific or statistical work to keep them identifiable.
(6) Legal restrictions on the right to use personal data for other reasons, in particular for copyright reasons, shall not be affected.
§ 27 DSG 2000
(1) Every controller shall rectify or erase data that are incorrect or have been processed contrary to the provisions of this federal law.
1. on his own, as soon the incorrectness of the data or the inadmissibility of the processing becomes known to him, or
2. on a well-founded application by the data subject.
The obligation to rectify data according to sub-para. 1 shall apply only to those data whose correctness is significant for the purpose of the data application. The incompleteness of data shall only justify a claim to rectification if the incorrectness, with regard to the purpose of the data application, results in the entire information being incorrect. As soon as data are no longer needed for the purpose of the data application, they shall be regarded as illegally processed data and shall be erased unless their archiving is legally permitted and unless the access to these data is specially secured. Any further use for another purpose shall be legitimate only if a transmission of the data for this purpose is legitimate; the legitimacy of further uses for scientific or statistical purposes is laid down in §§ 46 and 47.
(2) It shall be the obligation of the controller to prove that the data are correct unless specifically provided otherwise by law insofar as the data have not been collected exclusively based on statements made by the data subject.
(3) No rectification or erasure of data is possible insofar as the documentation purpose of a data application does not permit later changes. In such case, the necessary rectifications shall be effected by means of additional comments.
(4) The application for rectification or erasure shall be complied with within eight weeks after receipt and the applicant shall be informed thereof, or a reason in writing shall be given why the requested erasure or rectification was not carried out.
(5) In the areas of the executive responsible for the fields described in § 26 para. 2 sub paras. 1 to 5, the following procedure shall be applied to applications for rectification or erasure, insofar as this is required to safeguard those public interests that require secrecy: The rectification or erasure shall be carried out if the demands of the data subject are justified in the opinion of the controller. The required information pursuant to para. 4 shall in all cases be that a check of the data files of the controller with regard to the application for rectification or erasure has been performed. The legality of this course of action is subject to review by the Data Protection Authority according to § 30 para. 3 and the special complaint proceeding before the Data Protection Authority pursuant to § 31 para. 4.
(6) If the erasure or rectification of data kept solely on media readable by means of automatic processing systems can be carried out only at specific times for economic reasons, the data to be erased shall be kept inaccessible and a correcting remark shall be attached the data that are to be corrected.
(7) If data are used whose correctness is disputed by the data subject, and if neither their correctness nor incorrectness can be established, an entry about the dispute shall be attached upon request by the data subject. The entry about the dispute shall be erased only with the consent of the data subject or on grounds of a decision of the competent court of law or of the Data Protection Authority.
(8) If data that were rectified or erased in terms of para. 1 were transmitted before having been rectified or erased, the controller shall inform the recipient of the data by appropriate means, insofar as this does not constitute an unreasonable effort, in particular with regard to a legitimate interest in the information, and that the recipient can still be determined.
(9) The provisions of para. 1 to 8 shall be applied to the criminal records, kept according to the Criminal Records Act 1968 as well as to public books and registers kept by public sector controllers only insofar as
1. the obligation to rectification and erasure ex officio or
2. the procedure to assert and the competence to decide applications to rectification and erasure of data subjects
is not regulated otherwise by federal law.