On July 10, 2024, the Austrian data protection authority (DSB) announced, in its Newsletter 2/2024, that the Constitutional Court's (VfGH) ruling in Case No. G 287/2022 et al., of December 14, 2022, in which it repealed the media privilege provided under Section 9(1) of the Federal Act on the Protection of Individuals With Regard to the Processing of Personal Data (DSG), came into effect on July 1, 2024. The DSB noted that Section 9(1) of the DSG was amended in line with the VfGH's ruling. 

What is the media privilege amendment?

The VfGH held Section 9(1) of the DSG to be unconstitutional and therefore, the amendments to Section 9(1) were introduced that provide comprehensive rules on privilege for media companies for journalistic purposes.

According to Section 9(1) of the DSG, for the processing of personal data by media owners, publishers, media employees, and employees of a media company or media service within the meaning of the Media Act, as well as by other persons who, on the basis of a contract, contribute journalistically to the content design of a medium or the content design of the communications of a media service in a media company or media service, for journalistic purposes of the media company or media service, the provisions of the General Data Protection Regulation (GDPR) and DSG apply but with the following provisions, among others:

• the controller is entitled to process personal data, including the special categories of personal data under Article 9(1) of the GDPR, and data related to criminal convictions as provided under Article 10 of the GDPR, insofar as this is done for journalistic purposes;
• Articles 13 and 14 of the GDPR (duty to provide information) and Article 21(1) of the GDPR (right of objection) do not apply;
• the right to information under Article 15 of the GDPR does not apply to personal data on the basis of which no publication has taken place. The right to information applies with the provision that the data subject may only request information in relation to certain publications that are to be specifically identified in the request for information and must individually justify their concern and that the controller is entitled, in derogation from Article 12(5) of the GDPR, to charge a fee of €9 for processing requests for information;
• Articles 16 (right to rectification), 17 (right to erasure), and 18 (right to restriction of processing) of the GDPR do not apply with various conditions; and
• Article 33 of the GDPR (notification of breach) will only apply if it is likely to result in a high risk to the personal rights and freedoms of natural persons. Notification to the person affected is only required in accordance with an instruction from the data protection authority insofar as editorial confidentiality under data protection law is not thereby compromised.

You can read the newsletter here, the DSG here, and the press release from Parliament here, all only available in German.