In its ruling Ro 2021/04/0010-11 of 21 December 2023, the Supreme Administrative Court (VwGH) dealt with the data protection aspects of "AMAS", a labour market opportunity assistance system developed by the Public Employment Service Austria (AMS). It is a tool using a variety of personal data (such as age, gender, education and work experience, etc.) to calculate placement opportunities for jobseekers. The focal question was whether or not the AMAS tool involved automated decision-making as described in Art. 22 GDPR ("profiling").
The case at hand and decisions of the lower courts
AMAS was supposed to be used in the counselling process and to serve as a starting point for counsellors as they work with clients to assess their potentials, to see if there are any obstacles to labour market integration, and to define the optimum support strategy. Clients are allocated to groups, and depending on this, clients may or may not be entitled to subsidies, for example.
In regulatory proceedings initiated ex officio, the Data Protection Authority issued a decision prohibiting the AMS from using AMAS. The underlying reasoning was that there was no legal basis for this type of processing (in the form of "profiling") within the meaning of the GDPR. The AMS could not rely on any legal authorisation for such data processing. Furthermore, this would be a prohibited automated decision-making process pursuant to Art. 22 GDPR. It would not be possible to rule out with certainty that the decisions of the counsellors or the PES would not be based exclusively on profiling in individual cases.
The AMS lodged an appeal against the decision with the Federal Administrative Court (BVwG). The BVwG set aside the decision of the Data Protection Authority. It held that the counsellors would not rely on the AMAS results exclusively. Apart from internal guidelines, the AMS would also have issued related instructions to the counsellors. The final decision would therefore rest with the counsellors. Accordingly, no automated decision-making pursuant to Art. 22 GDPR would be involved. Data processing would also be justified on the basis of sections 25 and 29 of the Public Employment Service Act (AMSG). According to these provisions, data processing would be necessary for the performance of a task carried out in the public interest (job placement).
The third-instance ruling
The Supreme Administrative Court acknowledged (substantial) public interest in AMAS data processing. The question of whether data processing using AMAS would constitute (prohibited) automated decision-making as described in Art. 22 GDPR could not be reviewed by the Supreme Administrative Court with final effect. The reason for this was that the Federal Administrative Court had not, for example, provided any findings as to which other parameters should be taken into account in the decision-making and to what extent this should be done, or which procedure was envisaged for the utilisation of the AMAS group allocation. Therefore, substantive assessment was lacking. In the absence of these findings, the Administrative Court was unable to assess the degree to which the AMAS group allocation was in fact taken into account in the decision-making.
If automated decision-making were to be affirmed, AMAS data processing could be considered to be unauthorised processing. Authorisation on the basis of a legal provision would be the only exception to this rule. However, according to the Supreme Administrative Court, the provisions of the AMSG do not contain such a provision as would authorise automated decision-making in individual cases. Furthermore, the Federal Administrative Court did not examine whether there were other provisions as would authorise such data processing.
The matter was referred back to the Federal Administrative Court for consideration of the legal situation and rectification of the deficiencies in the findings. The new decision is eagerly awaited.
The KWR Data Protection Team will be happy to answer any questions you might have.