Immediate supervisory stop for data processing: order under Section 22 DSG

The Austrian Data Protection Authority may prohibit the continuation of data processing by an order issued under Section 22(4) DSG where the operation creates a substantial and immediate threat to the protected confidentiality interests of data subjects and there is danger in delay. The authority may also issue a partial prohibition where that is technically feasible, suitable for the purpose and sufficient to remove the threat.

For an organisation, this starts an immediate legal and technical response. The processing identified in the order must be stopped or limited without delay. At the same time, the organisation must assess whether to file a Vorstellung within two weeks. A Vorstellung does not suspend a prohibition. This article addresses that supervisory emergency stop. The separate questions of an erasure request where a retention obligation remains and the difference between anonymisation and pseudonymisation concern different processing situations.

Section 22(4) DSG requires a qualified threat. The operation of data processing must create a substantial and immediate threat to the protected confidentiality interests of data subjects. There must also be danger in delay. The authority may then prohibit continuation by an order under Section 57(1) AVG.

The standard focuses on the continuing operation and the threatened interference with confidentiality interests. General dissatisfaction with a processing operation or an unresolved legal question, by itself, does not establish the emergency stop. The concrete processing, affected persons, threat and urgency therefore have to be assessed together.

The order exists alongside other data protection procedures. A supervisory inspection, an ordinary access or complaint procedure and a request for restriction under Article 18 GDPR each require separate analysis. Section 22(4) DSG connects the immediate stop to an acute threat.

The Data Protection Authority may prohibit continuation of the processing in full. Where a partial prohibition is technically feasible, suitable for the purpose of the processing and sufficient to remove the threat, the authority may prohibit only part of the processing. The order must therefore be compared with the actual data flow and the systems in use.

Implementation requires a record of the processing operation, data categories, groups of data subjects, systems, interfaces, recipients and automated routines. A control that affects only the visible interface may be too narrow where background jobs, exports or service providers continue to process the data.

A partial prohibition is not a general permission to continue the rest of the operation. The permitted activities must be clearly separated from the prohibited part. The organisation should record the technical boundary, responsible persons and checks on the control without delay.

The Data Protection Authority may request necessary explanations from the controller or processor and may seek inspection of processing operations and related documents. The controller or processor must provide the necessary assistance. The inspection must be carried out with the greatest possible regard for the rights of the organisation and third parties.

For an inspection, the authority may, after notifying the premises holder and the controller or processor, enter premises where processing takes place. It may operate data-processing equipment, carry out the processing under review and make copies of storage media to the extent strictly necessary for its control powers.

Information received during the inspection may be used only for supervision under data protection law. The statutory duty of confidentiality therefore creates a separate protective framework. Organisations should make records complete and orderly, identify the processing clearly and assign responsibility for responses.

Once continuation is prohibited, the organisation must implement the order without delay within the stated scope. The practical response begins with a secured copy of the order, review of its operative part and technical mapping. New inputs, automated routines, access and disclosures must then be stopped or limited to the permitted part.

Implementation should be recorded with the time, system, change, responsible person and control step. This includes preserving relevant logs and informing the teams that control processing, support, deletion or disclosure. Documentation must not circumvent the ordered control through additional copies or substitute processes.

Section 22(4) DSG expressly provides that the Data Protection Authority must proceed under Article 83(5) GDPR if the prohibition is not complied with without delay. This creates a separate sanction risk. The specific consequence depends on the further proceedings and the circumstances of the case.

Section 57(1) AVG allows an order without a preceding investigation where danger in delay makes immediate measures necessary. An order under Section 22(4) DSG can be issued on that basis. The order must therefore be treated as immediately effective even where the factual investigation is not yet complete.

A Vorstellung against an order issued under Section 57(1) AVG may be filed with the authority that issued it within two weeks. The time limit must be calculated from the documented service of the individual order. The Vorstellung has suspensive effect only where the order imposes a monetary payment. It therefore does not suspend a prohibition on continuing data processing.

The legal review should read the operative part, reasons, service, threat assessment, affected processing and scope together. It may also be important to ask whether a technically feasible and sufficient partial prohibition could have been used instead of a complete prohibition.

A Vorstellung does not automatically lift the emergency stop. Under Section 57(3) AVG, the authority must initiate the investigation within two weeks after the Vorstellung is received. If it fails to do so, the challenged order ceases to have effect by operation of law. At the party's request, the authority must confirm that cessation in writing.

The organisation should therefore preserve proof of filing, receipt and subsequent steps by the authority. Technical implementation of the prohibition and communication with the authority need separate responsibilities. This keeps time-limit control possible without exposing the protective measure to unclear internal ownership.

The further review focuses on the concrete threat, necessity and scope of the order. New technical measures, a safe separation of processing parts or a changed processing design may be relevant to the assessment. They do not replace a timely Vorstellung or compliance with the existing order.

For a focused review, prepare the complete order, proof of service, affected processing, technical implementation, relevant data flows and protective measures already taken. We assess the threat, scope, immediate compliance and Vorstellung together. This makes it possible to determine which processing must stop at once and which steps must be prepared within the time limit.