Österreichischer Rundfunk: When Salary Transparency Meets the Right to Privacy

Joined Cases C-465/00, C-138/01 and C-139/01 | Court of Justice of the European Union | Full Court | 20 May 2003

Practice takeaways: ① An employee’s income linked to their name is personal data. ② Sending named salary information to a public authority interferes with private life even if the information is not classified as sensitive and no concrete harm is shown. ③ Public accountability can justify disclosure, but it does not eliminate necessity, data-minimization, and proportionality requirements. ④ A court must ask whether less intrusive measures—such as limiting named information to oversight bodies or publishing salary entitlements without actual individualized totals—would work equally well. ⑤ Directive 95/46 applied even without a demonstrated cross-border movement of data or workers. ⑥ The Directive’s necessity and proportionality provisions were sufficiently precise and unconditional to be invoked against incompatible national law.

In Rechnungshof v Österreichischer Rundfunk, the Court of Justice of the European Union considered a question that remains familiar today: how far may a government go in publishing personal information in the name of transparency and accountability?

Austria required bodies subject to audit by the Rechnungshof—the Austrian Court of Audit—to report employees and pensioners whose annual income exceeded a statutory threshold. The Rechnungshof understood the law to require a public report pairing each qualifying person’s name with the amount received. Several covered bodies and two employees of Austria’s public broadcaster objected.

The Court did not treat either transparency or privacy as absolute. It accepted that monitoring public expenditure and keeping publicly funded salaries within reasonable limits could serve a legitimate public interest. But it held that identifying individual recipients was lawful only if the broad disclosure of both names and actual annual income was necessary and appropriate to the proper management of public funds. The Austrian courts had to decide whether that demanding condition was satisfied. (Judgment, paras. 84–94.)

The case is also important for two broader propositions.

• First, the former Data Protection Directive had a wide field of application that did not depend on proof of a cross-border element in each individual dispute.
• Second, its rules requiring data to be adequate, relevant, not excessive, and processed only when necessary could be invoked directly before national courts.

(Judgment, paras. 39–43, 52–54, 98–101.)

The short version

An Austrian constitutional law sought to promote restraint in the use of public funds. Bodies controlled by the Rechnungshof had to report persons whose salaries or pensions exceeded a specified annual threshold. The Rechnungshof would consolidate the information into a report transmitted to Austria’s federal and provincial legislatures and made widely available to the public. (Judgment, paras. 5–12.)

Disagreement arose over whether the report had to identify the individuals concerned. A group of local and regional authorities, public undertakings, and a statutory professional body either refused to provide the information, supplied it in anonymized form, or restricted access to the underlying records. Separately, two employees of Österreichischer Rundfunk (ÖRF), Austria’s public broadcaster, sought orders preventing ÖRF from disclosing their data. (Judgment, paras. 17–19, 24–27.)

The Austrian Constitutional Court and Supreme Court asked whether EU data-protection law precluded legislation requiring the collection, transmission, and publication of named income information, and whether the relevant provisions of Directive 95/46 could be relied upon directly. (Judgment, paras. 20–30.)

The CJEU held that the Directive applied. The salary amounts and recipients were personal data, while their recording, use, transmission to the Rechnungshof, and inclusion in a widely distributed report were processing operations. (Judgment, para. 64.)

The Court then interpreted the Directive in light of the right to respect for private life protected by Article 8 of the European Convention on Human Rights. Communicating named professional-income data to a third party interfered with private life regardless of whether the data were sensitive or whether the person had suffered a demonstrated inconvenience. (Judgment, paras. 68–75.)

The interference could be justified only if it was in accordance with law, pursued a legitimate aim, and was necessary in a democratic society. The proper management of public funds was capable of qualifying as a legitimate aim. But publication of both the names and the actual annual income of affected employees had to be necessary and appropriate to that aim. The national courts had to test whether less intrusive alternatives could achieve the same result. (Judgment, paras. 76–94.)

Finally, the Court held that Articles 6(1)(c) and 7(c) and (e) of Directive 95/46 were sufficiently precise and unconditional to have direct effect. Individuals could rely on them before national courts to displace conflicting national rules. (Judgment, paras. 95–101.)

Why the case matters

Rundfunk is an early and unusually clear statement that government transparency is itself a form of personal-data processing. A disclosure rule does not escape data-protection scrutiny merely because it serves public accountability, concerns professional income, or operates through a statute.

The decision is particularly valuable because it separates three questions that are often collapsed:

• Is the information personal data? Named salary information plainly is.
• Does the transfer or publication interfere with private life? Yes. Professional activity is not categorically outside private life, and communication to a third party is enough to establish an interference.
• Is the interference justified? That requires a separate examination of legality, legitimate purpose, necessity, and proportionality.

The case also gives practical content to data minimization. Even when oversight bodies need detailed information, it does not follow that the general public needs the same information in identified form. The Court expressly asked whether names could be disclosed only to monitoring bodies and whether the public could instead receive information about salary entitlements rather than the precise sums received by particular individuals. (Judgment, para. 88.)

That distinction—between information needed for institutional oversight and information suitable for broad public release—is the case’s most enduring operational lesson.

Key holding

The Court reached four connected conclusions.

• The Directive applied broadly. Directive 95/46 applied to the processing required by the Austrian law even though the dispute did not establish a specific connection to free movement between Member States. Requiring a cross-border link in every case would make the Directive’s scope uncertain and could produce different levels of protection within a Member State. (Judgment, paras. 39–43, 52–54.)
• Named income information implicated private life. Income data linked to an identified employee were personal data. Communicating those data to the Rechnungshof interfered with private life, whatever the later use of the information and without any need to show that the information was sensitive or caused actual inconvenience. (Judgment, paras. 64, 73–75.)
• Transparency required a proportionality showing. Articles 6(1)(c) and 7(c) and (e) did not preclude the Austrian legislation only if broad disclosure of both the annual income above the threshold and the names of recipients was necessary and appropriate to the proper management of public funds. That determination belonged to the national courts. (Judgment, paras. 84–94.)
• The relevant Directive provisions had direct effect. Individuals could invoke Articles 6(1)(c) and 7(c) and (e) before national courts to set aside incompatible national rules. (Judgment, paras. 98–101.)

The Austrian disclosure framework

Austria’s Federal Constitutional Law on the Limitation of Salaries of Public Officials, commonly referred to in the judgment as the BezBegrBVG, gave the Rechnungshof a reporting role extending beyond conventional public offices. The bodies involved included regional and local authorities, a public broadcaster, a national central bank, a statutory representative body, and partially state-controlled commercial undertakings. (Judgment, paras. 5–16, 23.)

The reporting obligation covered salaries and pensions exceeding a statutory annual threshold. For 1998 and 1999, the referring court described thresholds of ATS 1,120,000 (approximately US$90,500 at the 1998 average exchange rate) and ATS 1,127,486 (approximately US$91,100 at the 1998 average exchange rate) respectively. The Rechnungshof interpreted the legislation to require a list identifying the recipients and showing their total annual income. (Judgment, paras. 19, 21.)

The reach of the intended disclosure mattered. The information would not remain within the employee’s organization or even within the Rechnungshof. The report would pass to legislative institutions and be widely disseminated to the public. The Court therefore confronted not a single processing operation but a disclosure chain: employer recording, employer-to-auditor transmission, consolidation by the Rechnungshof, legislative distribution, and public release. (Judgment, paras. 64, 87.)

The Court’s analysis

1. Directive 95/46 did not require a case-specific cross-border link

The parties disputed whether Directive 95/46 applied because the Austrian reporting scheme concerned domestic public-sector auditing and no concrete exercise of free movement had been established.

The Court rejected a narrow approach. The Directive was intended to ensure a high and equivalent level of protection across Member States so that personal data could move within the internal market. Because personal data are capable of moving between Member States, the EU legislature could harmonize national rules without requiring proof, in every case, that the particular processing operation had an actual connection to cross-border movement. (Judgment, paras. 39–43.)

The Court also held that the reporting activity did not fall within the Directive’s exclusion for processing in the course of an activity outside the scope of Community law. It was not one of the State activities expressly identified by the Directive, such as public security, defense, State security, or criminal-law activity. Nor was the exclusion for purely personal or household activity relevant. (Judgment, paras. 44–47.)

The result was a broad scope rule: Directive 95/46 applied to the processing prescribed by the Austrian legislation. (Judgment, para. 54.)

2. Named salary information was personal data, and its disclosure was processing

The amounts paid and the identities of their recipients constituted information relating to identified or identifiable natural persons and therefore personal data under Article 2(a) of Directive 95/46. The recording and use of those data by covered bodies, transmission to the Rechnungshof, and inclusion in a report intended for political institutions and broad circulation were all processing under Article 2(b). (Judgment, para. 64.)

That classification triggered both sides of the Directive’s basic lawfulness structure. Processing had to comply with the data-quality principles in Article 6 and satisfy at least one lawful-processing criterion in Article 7. In particular, the data had to be collected for specified, explicit, and legitimate purposes and be adequate, relevant, and not excessive. Processing based on legal obligation or public interest also had to be necessary. (Judgment, paras. 65–67.)

3. Data-protection law had to be read in light of the right to private life

The Court treated fundamental rights as integral to the interpretation of Directive 95/46. Although the Directive’s internal-market objective remained important, Article 1(1) expressly required Member States to protect fundamental rights and freedoms, particularly privacy. The Court therefore interpreted Articles 6, 7, and 13 in light of Article 8 ECHR. (Judgment, paras. 68–72.)

Professional information was not excluded from private life. The Court relied on European Court of Human Rights authority rejecting a restrictive understanding of private life and recognizing that professional activities may fall within its scope. (Judgment, para. 73.)

The Court drew a careful line between internal recording and external communication. An employer’s mere recording of named remuneration data did not, by itself, constitute the interference at issue. But communicating the information to a third party—in this case, a public authority—did interfere with the employees’ right to respect for private life. (Judgment, para. 74.)

No heightened classification or proof of injury was required. The interference existed whether or not the information was sensitive and whether or not the individuals had been inconvenienced. Communication of the remuneration data was enough. (Judgment, para. 75.)

4. Public accountability was legitimate—but naming individuals still had to be necessary

Article 8 ECHR permits interferences with private life only when they are in accordance with law, pursue a legitimate aim, and are necessary in a democratic society. (Judgment, para. 76.)

• The Court accepted that Austria’s objective could be legitimate. Ensuring the best use of public funds and keeping salaries within reasonable limits related to the economic well-being of the country and the proper management of public resources. The Rechnungshof and legislative bodies needed information about personnel expenditure, and taxpayers had a legitimate interest in knowing how public revenues were used. (Judgment, paras. 80–85.)
• But the existence of that public interest did not resolve the proportionality question. “Necessary” implied a pressing social need and required the measure to be proportionate to the legitimate aim. The State’s interest had to be balanced against the seriousness of the interference. (Judgment, paras. 83–84.)

The key question was not whether salary oversight was legitimate in the abstract. It was whether pairing the names of all covered employees with the actual amounts each had received—and then widely publishing that information—was necessary and supported by relevant and sufficient reasons. (Judgment, paras. 86–87.)

5. Less intrusive alternatives were central to proportionality

The Court identified two possible alternatives for the Austrian courts to examine.

• Could the objective be achieved by transmitting named information only to the Rechnungshof and other monitoring bodies, without publishing the names to the general public?
• Could public transparency be achieved by publishing the remuneration and benefits attached to the positions, without publishing the actual annual sums received by named individuals—amounts that might reflect personal and family circumstances?

(Judgment, para. 88.)

The Court also recognized possible consequences of public disclosure. Publicity concerning income might negatively affect an employee’s prospects with other employers in Austria or elsewhere. (Judgment, para. 89.)

Accordingly, the legislation could be justified only insofar as the wide disclosure of both names and annual income was necessary and appropriate to keeping salaries within reasonable limits. The national courts had to decide whether that test was met. (Judgment, para. 90.)

6. The Directive and Article 8 ECHR pointed to the same proportionality requirement

The Court connected the fundamental-rights analysis back to the Directive. If the national courts found the legislation incompatible with Article 8 ECHR, it could not satisfy the proportionality requirements of Articles 6(1)(c) and 7(c) or (e). Nor could Austria rely on Article 13’s exceptions, which themselves had to comply with proportionality and could not legitimize an interference contrary to Article 8. (Judgment, para. 91.)

Even if disclosure was necessary and appropriate, the national courts still had to consider foreseeability. The statute did not expressly state that names must be disclosed alongside income; that interpretation appeared to derive from legal commentary and legislative history. The applicable rule had to be formulated with enough precision to allow those affected to foresee its consequences. (Judgment, paras. 77–79, 92.)

7. Articles 6(1)(c) and 7(c) and (e) had direct effect

The second referred question concerned whether individuals could invoke the Directive’s rules directly in national court.

The Court applied its settled rule that a directive provision may be relied upon against incompatible national law when, as to its subject matter, it is unconditional and sufficiently precise and the implementation period has expired. (Judgment, para. 98.)

It held that the requirements that data be adequate, relevant, and not excessive and that processing based on a legal obligation or public-interest task be necessary were sufficiently precise for judicial application. Although Directive 95/46 afforded Member States discretion in implementing some provisions, Articles 6(1)(c) and 7(c) and (e) imposed unconditional obligations. (Judgment, paras. 99–100.)

Individuals could therefore rely on those provisions to displace contrary national rules. (Judgment, para. 101.)

The Advocate General’s Opinion

Advocate General Antonio Tizzano proposed a materially different answer. In his view, the Austrian processing operations were carried out in the course of the Rundfunk's public audit activity, an activity outside the scope of Community law within Article 3(2) of Directive 95/46. He would therefore have held that the Directive did not apply. (Opinion, paras. 31–56.)

His reasoning focused on the purpose of the processing. The transmission and publication obligations existed solely to support the Rechnungshof’s audit and reporting responsibilities. In the Advocate General’s view, a possible effect on worker mobility or market competition was too indirect to bring that public audit activity within Community law. (Opinion, paras. 36–54.)

The Court rejected that narrow scope analysis. Its judgment treated Directive 95/46 as applicable without requiring the processing at issue to have a demonstrated cross-border link. That difference makes Rundfunk important not only for transparency and proportionality, but also for the early development of the broad territorial and material reach of EU data-protection law.

The personal-data dimension

Rundfunk makes two points about personal data that are easy to underestimate.

• First, workplace and financial information can fall within private life. The fact that a salary arises from professional activity does not place it outside privacy protection.
• Second, context and disclosure change the impact of data. An employer necessarily holds payroll information. The legal difficulty arose when identified income data moved from internal payroll records to an audit authority and then toward legislative and public distribution.

The Court’s statement that sensitivity and demonstrated inconvenience were unnecessary to establish an interference is especially significant. Data-protection analysis does not begin only when information falls into a specially protected category. Ordinary personal data can implicate fundamental rights when disclosure expands the audience, changes the purpose, or exposes an individual to public scrutiny.

What the Court did—and did not—decide

The Court did decide that:

• named income information was personal data and its recording, transmission, and publication were processing operations;
• Directive 95/46 applied without proof that the particular processing had a concrete cross-border connection;
• communicating named salary information to a third party interfered with private life;
• proper management of public funds could be a legitimate objective;
• broad publication of names and actual income was permissible only if necessary and appropriate to that objective; and
• Articles 6(1)(c) and 7(c) and (e) of Directive 95/46 could be invoked directly before national courts.

The Court did not decide that:

• Austria’s named-publication regime was definitively lawful or unlawful;
• a general interest in government transparency automatically justifies publishing identifiable salary information;
• oversight bodies and the general public must receive the same level of identifying detail;
• salary information must be legally “sensitive” before disclosure interferes with private life; or
• any statutory disclosure obligation automatically satisfies the Directive’s necessity requirement.

Rundfunk under the GDPR

Directive 95/46 has been replaced by the General Data Protection Regulation, but much of Rundfunk’s reasoning remains visible in the current framework.

The GDPR continues to define personal data and processing broadly in Articles 4(1) and 4(2). Its core principles require purpose limitation and data minimization: personal data must be collected for specified, explicit, and legitimate purposes and must be adequate, relevant, and limited to what is necessary for those purposes. Article 5(1)(b) and (c). Processing may be lawful when necessary to comply with a legal obligation or perform a task in the public interest or in the exercise of official authority. Article 6(1)(c) and (e). But identifying a lawful basis does not eliminate the separate need to comply with Article 5’s principles.

Article 86 now addresses the relationship between data protection and public access to official documents expressly. It permits personal data in official documents to be disclosed under Union or Member State law in order to reconcile public access with the right to data protection. That language reinforces rather than displaces Rundfunk’s central lesson: transparency rules must be designed to reconcile competing interests.

Today, the analysis would also be framed directly by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, protecting private life and personal data, together with Article 52(1), which requires limitations on Charter rights to be provided by law, respect the essence of the rights, and comply with necessity and proportionality.

The current question therefore remains close to the one the Court asked in 2003: does the transparency objective require identifying the individual and publishing the actual amount received, or could a more limited disclosure achieve the same public purpose?

Conclusion

Rundfunk did not hold that employee privacy defeats public accountability. It held that public accountability does not make identification self-justifying.

Austria could seek to monitor public expenditure and keep publicly funded salaries within reasonable limits. Oversight bodies and taxpayers had legitimate interests in understanding how public money was spent. But the most intrusive version of the measure—widely publishing both an employee’s name and actual annual income—had to be shown necessary and appropriate. The availability of less intrusive alternatives was therefore not peripheral; it was central to the legal analysis.

Put simply: the government may have a legitimate reason to disclose salary information, but it must still explain why the public needs the name.

Sources and Additional Resources

Sources

CJEU judgments, Advocate General opinions, procedural orders, summaries, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database.

Search Joined Cases C-465/00, C-138/01 and C-139/01.

• Court of Justice of the European Union, Full Court, Joined Cases C-465/00, C-138/01 and C-139/01, Rechnungshof v Österreichischer Rundfunk and Others and Christa Neukomm and Joseph Lauermann v Österreichischer Rundfunk, Judgment of 20 May 2003, ECLI:EU:C:2003:294.
• Advocate General Tizzano, Opinion in Joined Cases C-465/00, C-138/01 and C-139/01, delivered 14 November 2002, ECLI:EU:C:2002:662.

Regulation (EU) 2016/679, General Data Protection Regulation. See in particular Articles 4(1), 4(2), 5(1)(b)–(c), 6(1)(c) and (e), and 86. Read the GDPR.

Related reading from The de la Torre Review

• “Lindqvist: When a Parish Website Became Data Processing.” A companion 2003 decision addressing the broad scope of Directive 95/46, online publication of personal data, the household exemption, sensitive health information, and third-country transfers. Read the article.
• Schecke: Transparency Does Not Automatically Trump Data Protection — The CJEU built on Österreichischer Rundfunk in holding that publication of financial information linked to identifiable individuals can interfere with private life even when it concerns professional activities, and that transparency must be balanced against privacy and data-protection rights. Joined Cases C-92/09 and C-93/09, Schecke and Eifert, paras. 58–59, 79. Read the Article.
• Bavarian Lager: When Transparency Requests Become Data-Protection Questions — The tension identified here would later reappear in Bavarian Lager, this time in the context of access to EU documents. There, the Court held that even names appearing in meeting minutes in a professional context were personal data and that an obligation of transparency did not eliminate the data-protection requirements governing their disclosure. Read the Article.
• ASNEF: When Member States Cannot Rewrite the Lawful Bases for Processing — Develops the lawful-processing framework applied in Österreichischer Rundfunk. ASNEF holds that the lawful bases established by EU data-protection law form an exhaustive and restrictive list and explains that Member States may clarify those bases but cannot add requirements that alter their scope. Read the Article.
• “EU Data Protection Law and the General Data Protection Regulation (GDPR).” A comprehensive guide to the European data-protection framework, including the principles of purpose limitation and data minimization and the lawful bases for processing necessary to comply with a legal obligation or perform a public-interest task. It provides the current framework for understanding Rundfunk’s proportionality analysis. Read the article. (Free Subscription Required)
• “What Is the Charter of Fundamental Rights of the European Union?” An introduction to the EU’s bill of rights and its recognition of privacy and personal-data protection as distinct fundamental rights under Articles 7 and 8. It explains the modern fundamental-rights framework underlying the balance between public transparency and employee data protection in Rundfunk. Read the article