On July 12, 2024, the Supreme Administrative Court (VwGH) published a summary of its decision in Case No. Ro 2022/04/0026 to 0027 from May 17, 2024, in which it determined the admissibility of rating platforms for hotels and restaurants under the General Data Protection Regulation (GDPR), upholding the Austrian data protection authority's (DSB) decision.

Background to the decision

The VwGH noted that the operators of a hotel and restaurant requested that the operator of a rating platform delete their personal data, including reviews and experience reports in which the hotel operators were named. The DSB rejected the data protection complaint on the grounds that the processing served to protect legitimate interests within the meaning of Article 6(1)(f) of the GDPR, namely freedom of expression and information. 

The hotel operators filed an appeal with the Federal Administrative Court which also rejected the appeal and finally, appealed with the VwGH. 

Findings of the VwGH

Notably, the VwGH found, among other things, that former guests are entitled to express their opinion about a business, just as potential guests have the right to find out about the business. The GDPR protects not only the legitimate interests of the controller but also the interests of third parties, which in the present case are potential guests. It is also not important that the reviews only appeal to a small part of the public.

Outcomes

The VwGH did not contradict the balancing of interests carried out by the Federal Administrative Court in favor of the platform operator and dismissed the appeal.

You can read the summary of the decision here and the decision here, both only available in German.