Confidentiality duties of a data protection officer under Section 5 of Austria's DSG

Section 5 of Austria's Data Protection Act (DSG) requires the data protection officer and the people working for the officer to keep information confidential. The law expressly protects the identity of a person who contacts the data protection officer and circumstances that could reveal that person's identity. Information obtained in this role may be used only to perform the officer's tasks. The duty continues after the work ends.

This article focuses on the specific confidentiality duty of a company data protection officer under Austrian law. General employee data secrecy under Section 6 DSG and reporting a personal data breach are separate matters.

Section 5(1) DSG binds the data protection officer and the people working for the officer to confidentiality when they perform the officer’s tasks. The provision therefore follows the role and the work being carried out. It also covers people who assist with the data protection function.

Article 37(6) GDPR allows the data protection officer to be a staff member of the controller or processor, or to perform the tasks under a service contract. The confidentiality duty in Section 5 DSG is therefore not limited to an in-house appointment. The Austrian Data Protection Authority also describes both internal and external arrangements.

This special duty is distinct from the general data secrecy that applies to employees under Section 6 DSG. A person’s contact with the data protection officer falls within the specific protection of Section 5 DSG. This article addresses paragraphs 1 and 2 of Section 5 DSG. Paragraphs 3 to 5 contain additional organizational rules for data protection officers in the public sector.

Section 5(1) DSG expressly protects the identity of data subjects who contact the data protection officer. It also covers circumstances that could lead to their identification. Omitting a person’s name therefore does not always prevent identification.

A report may reveal someone through the department, timing, project or unique nature of the concern. Before sharing it, consider which details are needed for the assessment and which could point to the person. In some cases the issue can be described without naming or otherwise identifying the person.

A whistleblowing channel is a separate reporting route with its own legal framework. The data protection officer’s confidentiality duty instead arises from the officer’s role and specifically protects people who contact the officer about their data or data protection rights.

Article 38(3) GDPR requires the data protection officer to report directly to the highest management level of the controller or processor. That reporting duty does not set aside the specific confidentiality duty in Section 5(1) DSG.

Article 38(3) does not state a general exception that allows the identity of every person who contacts the officer to be disclosed. The duties have to be applied together. A report can describe the process, risk and corrective action without naming the person where identity is not needed for the officer’s task.

Independence and direct reporting are separate parts of the officer’s role. The article on data protection officer independence, reporting lines and resources explains that organizational framework.

Section 5(1) DSG limits use of information made available to the officer to the performance of the officer’s tasks. Article 39 GDPR includes informing and advising the organization, monitoring compliance, advising on data protection impact assessments, cooperating with the supervisory authority and acting as its contact point.

Information received in the data protection role does not automatically become a general personnel record or a free-standing source for an internal investigation. A proposed use for another company purpose requires its own legal assessment. The organization must also define the responsibilities and access rights of other employees separately.

The article on roles, logs and controls for employee data access addresses general access management. For a DPO task, the specific purpose restriction applies alongside the data minimization principle in Article 5(1)(c) GDPR.

Section 5(1) DSG allows identity or identifying circumstances to be disclosed where the data subject has expressly released the officer from confidentiality. The release must therefore be clearly expressed. A request for the officer to look into an issue does not, by itself, release the person’s identity.

For the practical assessment, identify what the release covers. Clarify which details may be shared, with whom and for what reason. A written record helps establish the scope, although Section 5 DSG does not itself prescribe a particular form for the release.

The release concerns the specific duty under Section 5 DSG only to the extent it covers. The provision expressly leaves other confidentiality duties unaffected. It should not be treated as a general waiver of every other duty of secrecy.

The final sentence of Section 5(1) DSG expressly keeps the data protection officer and the people working for the officer bound to confidentiality after their work ends. A change of role does not make information about earlier contacts available for unrestricted use.

When an officer changes, the organization should arrange access rights, open matters and responsibility for existing records. The continuing confidentiality duty remains relevant during that handover. Section 5 DSG does not set a specific retention period for notes or case records.

A later personnel decision should distinguish information learned in the former DPO role from information obtained through another function. Section 5 does not permit DPO information to be used later for an unrelated company purpose.

Section 5(2) DSG addresses a specific situation. If an employee of an organization supervised by the data protection officer has a statutory right to refuse to give evidence about particular data and exercises that right, the officer and people working for the officer have the same right to that extent.

Within the scope of that right, the officer’s files and other documents are also protected from seizure and confiscation. The rule depends on an existing right held by an employee and on that person actually relying on it.

The DPO role alone does not create a comprehensive privilege in every proceeding or a blanket ban on seizure of all records. The relevant person, information and scope of the existing right must be identified.

We advise organizations on the information received by the data protection officer, whether a person can be identified and how the information may be used. A description of the information flow, the possible recipients and any express release will help with an initial assessment. Contact us when a proposed disclosure of someone’s name or identifying details needs legal review.