Data protection

Personal data are personal details or other information about identified or identifiable individuals, including data about their Internet surfing and communication activities. Anonymous data, i.e. information which cannot be linked to the identity of an individual (not even via a specific identification number such as an IP address), are not considered personal data (e.g. top-hit results or the number of visitors to a website). The Fiscal Advisory Council processes personal data in line with the provisions laid down in the General Data Protection Regulation (GDPR) (EU) and the Austrian Data Protection Act (DSG).

The Fiscal Advisory Council takes all necessary technical and organizational security measures to protect your personal data against loss and misuse. Your data will be processed in the secure, state-of-the-art environment operated by the OeNB’s IT services, as contracted between the Fiscal Advisory Council and the OeNB's IT business area, pursuant to Article 3 para 11 Fiscal Advisory Council and Productivity Board Act of 2021 (Fiskalrat- und Produktivitätsratgesetz – FPRG). The OeNB's IT infrastructure is certified under the international ISO 9001 and 27001 standards.

Access to the Fiscal Advisory Council’s websites is secured via HTTPS. This means that communication between your browser and the OeNB’s servers is encrypted. Regarding any e-mail communication you may have with the Fiscal Advisory Council or its employees, please note that the confidentiality of such communication cannot be guaranteed, given the way electronic mail protocols work. For example, the content of unencrypted e-mails can be viewed by third parties.

As contracted with the Fiscal Advisory Council, the OeNB uses website support services offered by providers that are established, or whose parent companies are established, in third countries outside the EEA (in particular Google LLC, headquartered in the USA) to optimize its websites. Where such services are used, it cannot be ruled out that personal data are transferred to a third country within the meaning of the GDPR.

The data controller responsible for users of Google services in Europe is Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland). It cannot be excluded, however, that Google Ireland Limited transfers your personal data to servers run by its head office in the USA, i.e. Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043), or may have to disclose your personal data to US authorities or US intelligence services under the US CLOUD Act. The Court of Justice of the European Union (CJEU) classifies the USA as a third country that does not ensure a level of data protection corresponding to European standards. In particular, there is the risk that, under US law, service providers must disclose personal data to US authorities or US intelligence services for surveillance purposes without data subjects being adequately legally protected. Pursuant to Article 49 para 1 lit a GDPR, you therefore need to consent to transfers of your personal data to service providers in third countries in order for the respective website support services to be put to use. You can give, make changes to or withdraw your consent in the cookie consent banner.

According to Article 21 GDPR, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data carried out by the Fiscal Advisory Council on the basis of its legal mandate, as laid down in the Fiscal Advisory Council and Productivity Board Act of 2021 (Article 6 para 1 lit e GDPR), or for the purposes of its legitimate interests (Article 6 para 1 lit f GDPR). For further details, please refer to the section “Your rights as a data subject.”

When you visit any of the Fiscal Advisory Council’s websites, the respective server processes certain personal communication data.

When Fiscal Advisory Council websites are accessed, the web server records the following data in a combined log format for the purpose of ensuring appropriate information and system security as well as stopping denial of service attacks and saves these data for a period of three years: IP address, username (if required), date and time of your visit as well as technical information about the web object you retrieved and the browser and operating system you used (combined log format). Additional personal information, such as your name, address, telephone number or e-mail address, is not recorded unless you have opted to provide this information in the space provided (e.g. when registering for a newsletter or requesting information via a contact form). In case improper use is made of the OeNB’s websites or in other legitimate exceptional cases, we will forward the data to the authorities in charge for the purpose of the enforcement, exercise or defense of legal claims.

If you register for the Fiscal Advisory Council’s newsletters, we will use the personal data you provided, in particular your e-mail address, for sending you the desired information and on the basis of previous consent (Article 6 para 1 lit a GDPR). You can unsubscribe from the newsletter at any time by using the link provided in each e-mail. After unsubscribing from the newsletter, we will delete your data immediately. Your data will be transferred exclusively to the OeNB, as contracted with the Fiscal Advisory Council (Article 3 para 11 Fiscal Advisory Council and Productivity Board Act of 2021), and to EWORX CENTER, Hanriederstraße 25, 4150 Rohrbach-Berg, Austria, which, in their capacity as subproviders, use the data for the purpose of providing this e-mail service. Your data will not be transferred to third parties for them to use for their own purposes. You can only register for the newsletter if you provide the required personal data.

The Fiscal Advisory Council technical tools to analyze how its websites are used. This allows us to improve usability and user experience. As a rule, the tools we use do not provide us with information about your identity.

Matomo On-Premise:
We use Matomo On-Premise, an analytics tool that helps us optimize our websites and make them more user friendly. Matomo creates analyses of and statistics on how our websites are used on the basis of pseudonymized user IDs. For this purpose, persistent cookies are stored on your device. This allows us to recognize and count returning visitors, track click paths and measure interest in our website content. We do not collect any data related to your identity. We anonymize web server log data by IP masking before using them for analytics purposes. Matomo runs on the OeNB’s infrastructure.

Cookies are small text files that are stored on your computer and allow us to identify your device when you return to our websites. We use cookies for analytics purposes on the basis of your consent in accordance with Article 165 para. 3 Telecommunications Act 2021 in conjunction with Article 6 para. 1 lit. a General Data Protection Regulation (GDPR) if you have agreed to the relevant options on the cookie consent banner, where you can also change or withdraw your consent at any time. You can open the banner by clicking the check mark in the bottom left corner.

For further information about Matomo and its privacy policy, please visit https://matomo.org/privacy.

Use of Google Analytics:
The Fiscal Advisory Council's websites use Google Analytics, a web analytics service which uses cookies to help analyze website use. Cookies are small text files that a website stores on your computer when you visit the site, allowing the website to identify your device when you return. This feature enables website providers to keep track of browsing patterns, which serves to improve website usability and user experience. The cookie-related information cannot be used, as a rule, to identify individual users.

The information generated by using Google Analytics (including your IP address) is transferred to a Google server. To protect your privacy, Google Analytics has been configured in such a way that your IP address will be anonymized immediately within the area of EU or EEA countries after it has been transferred to Google servers and that it will be stored by Google exclusively in its anonymized form (anonymizeIp=true). Only in exceptional cases is the full IP address sent to Google servers in the USA and shortened there. On behalf of the Fiscal Advisory Council, Google will use the information gathered to analyze your use of the Fiscal Advisory Council's websites and to compile reports on website activities.

You can enable Google Analytics by agreeing to the setting of statistical cookies in the cookie consent banner on our website (Article 6 para 1 lit a and Article 49 para 1 lit a GDPR), where you can give, change or revoke this consent via the cookie consent banner, which can be opened at any time via the checkmark icon at the bottom left. In addition, the OeNB concluded a data processing agreement with Google Ireland Limited pursuant to Article 28 GDPR.

The Fiscal Advisory Council uses Google reCAPTCHA (see www.google.com/recaptcha) on its websites. The purpose of this tool is to ensure that the data, or queries, submitted to the OeNB are coming from a human and not a bot. For this, reCAPTCHA will evaluate the following personal data, which will be forwarded to the service provider: IP address of the device you used, the website you visited before ours (referrer URL), date and duration of your visit, identification data of the browser and operating system you used, Google account if you are signed in to Google at the same time, mouse movements around the reCAPTCHA checkboxes, cookies, display instructions and scripts as well as tests requiring you to correctly evaluate images displayed on your screen. These data are processed in accordance with Article 6 para 1 lit f GDPR and on the basis of our legitimate interests in maintaining the security of our web server and protecting the forms on our website against abuse and fraudulent input made by automated software. The OeNB has concluded a data processing agreement with Google Ireland Limited pursuant to Article 28 GDPR.

This website uses cookies to collect data about visitors to the website in order to personalize content, provide log-in functionality, integrate social media plug-ins and analyze website traffic based on anonymized data. Pursuant to Article 165 para 3 Telecommunications Act (Telekommunikationsgesetz – TKG), cookies that are essential for accessing our content and using our online services may be stored on your device without your explicit consent. For storing nonessential cookies on your device, we need your consent, which you can give, or change and withdraw at any time, in the cookie consent banner. In the banner, you will also find information on how long the OeNB will, as a rule, store cookie data unless you delete the data manually or adjust your browser settings to refuse cookies. You can also change or withdraw your consent at any time in this cookie consent banner.

The Fiscal Advisory Council facilitates electronic communication via e-mail, in the course of which personal contact and communication data are being processed for the purpose of enabling electronic communication between the Fiscal Advisory Council and users and to maintain electronic contact management systems. The legal basis for the processing of data is Article 6 para 1 lit e GDPR in conjunction with the Fiscal Advisory Council and Productivity Board Act of 2021 whenever the Fiscal Advisory Council acts in its statutory capacity. In all other instances, the legal basis is Article 6 para 1 lit f GDPR. In the latter case, the legitimate interest is to enable electronic correspondence also for private-law matters. The Fiscal Advisory Council stores e-mails for up to ten years unless longer-term storage is required by the underlying purpose of the e-mail correspondence. To use the respective electronic communication channel, you have to provide the required personal data. Otherwise you cannot use it and have to switch to other means of communication (e.g. postal delivery). The personal data you provide will be processed exclusively for the purpose of dealing with your request.

E-mails are checked for spam and harmful content. By default, e-mails are automatically scanned for spam or malware; only in suspicious cases or in case of doubt are individual e-mails scrutinized in more detail by specialists (in consultation with the recipient if necessary). In case of misuse or criminal content, all relevant e-mails are forwarded to the authorities in charge.

For the purpose of ensuring an appropriate degree of information and system security as well as detecting and handling malware, the e-mail server generates log data on e-mail correspondence and stores them for three years. When you send an e-mail to a Fiscal Advisory Council or OeNB address, the following data are recorded: recipient’s e-mail address, IP address and hostname; number of recipients; sender’s e-mail address, IP address and hostname; subject, date and time when e-mail was received by server; file name of any attachments; size of message; risk classification for spam and delivery status. These data will not be transferred to third parties. In case improper use is made of the Fiscal Advisory Council’s e-mail system, log data will be forwarded to the authorities in charge.

The Fiscal Advisory Council processes photographs and videos of individuals to document its events and activities. With due regard to the rights of individuals shown in photographs and/or videos, the Fiscal Advisory Council makes selected photographs and/or videos available to newspapers and TV programs and/or uses them on its websites and in Fiscal Advisory Council information material. The Fiscal Advisory Council processes this visual material for the purposes of its legitimate interests according to Article 6 para 1 lit f GDPR. The Fiscal Advisory Council stores photographs and videos for archiving purposes in the public interest and deletes them if documentation is no longer required (Article 7 Data Protection Act).

You have the right to obtain confirmation as to whether or not your personal data, and which of your personal data, are being processed by of Fiscal Advisory Council (Article 15 GDPR). You have the right to obtain the rectification of inaccurate personal data or to have incomplete personal data completed (Article 16 GDPR) as long as the rectification and/or completion of the data are necessary for the purpose of the processing operation. You have the right to obtain the erasure of your personal data if the Fiscal Advisory Council has processed them unlawfully (Article 17 GDPR). Under certain conditions, you have the right to obtain restriction of the processing of your data (Article 18 GDPR). According to Article 21 GDPR, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data carried out by the Fiscal Advisory Council in its statutory capacity, as laid down in the Fiscal Advisory Council and Productivity Board Act of 2021 (Article 6 para 1 lit e GDPR), or for the purposes of its legitimate interests (Article 6 para 1 lit f GDPR). You have the right to withdraw your consent to any consent-based processing of your personal data at any time. Withdrawing your consent will be without prejudice to the lawful use of personal data collected up to the point of consent withdrawal (Article 7 para 3 GDPR). Should you consider your right to data protection infringed by any processing of your personal data by the Fiscal Advisory Council, you may lodge a complaint with the Austrian Data Protection Authority (DSB).

To assert your rights as a data subject, write to the Office of the Austrian Fiscal Advisory Council, c/o Oesterreichische Nationalbank, Otto-Wagner-Platz 3, 1090 Vienna, Austria, or office@fiskalrat.at. In it, state in what way your personal data are subject to data processing, as outlined above, and clearly specify the details of your request. Moreover, please provide proof of your identity by enclosing a black-and-white copy of an official photo identification (e.g. your passport, driver’s license, identity card) or using a qualified electronic signature within the meaning of Article 3 no. 12 eIDAS Regulation. This is to prevent improper requests by unauthorized third parties that might endanger the protection of your personal data. For the reasons outlined above, such requests must be made in writing.