On September 1, 2025, the Federal Administrative Court („BVwG“) ruled in decision W256 2235360-1 that the so-called Labor Market Opportunities Assistance System („AMAS“) – an algorithm-based system intended to make the allocation of support measures more efficient by calculating the labor market opportunities of job seekers – does not violate Art 22 GDPR. This marked a turning point in the long-standing legal dispute between the Public Employment Service („AMS“) and the Data Protection Authority („DSB“), which most recently focused on the question of the extent to which human influence excludes the scope of application of Article 22 GDPR.

Background of the proceedings

The proceedings were initiated by a decision of the DSB in August 2020 prohibiting the AMS from using the AMAS from January 2021 onwards. The DSB justified this decision on the grounds that there was no sufficient legal basis for data processing and, furthermore, that there was an inadmissible automated decision within the meaning of Article 22 GDPR.

After an appeal was filed, the BVwG initially lifted this ban. However, the Administrative Court („VwGH“) overturned this decision after a regular review by the DSB and referred the case back to the BVwG for additional findings and a renewed legal assessment. In its decision, the VwGH based its decision on the “SCHUFA judgment” of the European Court of Justice (C-634/21), which held that an automated score may constitute a prohibited decision, even if a human is formally involved, but the machine effectively plays the decisive role.

The VwGH also clarified that the data processing in the context of AMAS was not a sovereign (governmental) activity, but rather was attributable to the private sector. While unemployment benefits are granted as a public-law entitlement, there are no legal claims to counseling or support plans, and no formal rulings are issued for such services.

Furthermore, the VwGH found that, although a legal basis for the data processing existed, the case needed to be reassessed with regard to the core question of whether AMAS constituted an inadmissible automated decision.

In its latest decision on September 1, 2025, the BVwG declared the DSB's prohibition unlawful, annulled the decision without replacement, and rejected the ordinary appeal as inadmissible. AMAS would therefore have been admissible under the specified conditions. Ultimately, the only option left for the DSB is an extraordinary appeal.

AMAS and the question of substantial human control

The Labor Market Opportunity Assistance System was intended to make the work of the AMS more efficient by calculating individuals' labor market opportunities based on data such as age, education, or professional background and classifying them into three categories—high, medium, or low. This classification had direct consequences for funding opportunities. For example, expensive or lengthy measures were initially ruled out for the group with low opportunities. At the same time, however, AMS advisors retained the right to override such limits in individual cases. They could not only ignore the algorithm value, but also correct it permanently – so the final decision always rested with humans.

This precise issue became the focal point of the latest proceedings before the BVwG. Article 22 of the GDPR generally prohibits automated individual decision-making. The central question was therefore whether AMAS constituted such a system or whether human influence was in fact substantial. The BVwG found that the role of the advisors was not merely symbolic, but essential. They were required to make their own assessments and to take into account factors such as motivation, living situation, language skills, or caregiving responsibilities. Discrepancies between the system and their own assessment had to be actively documented and the AMAS value had to be permanently corrected. In addition, personal interviews between advisors and job seekers were planned to discuss the work assessment. There were also training courses, internal controls, and ombudsman offices to ensure that this responsibility was fulfilled. The court considered this to fulfill the requirements for “meaningful human oversight.” AMAS was thus clearly classified as an assistance system and not as an automated decision-maker.

Implications for companies

This case is particularly relevant for companies because the VwGH clarified that the standards for assessing automated data processing apply not only to sovereign actions,
but also to private-sector use. To ensure that automated systems such as scoring models or AI-supported decision aids do not result in inadmissible automated decisions under Article 22 GDPR, companies must ensure genuine and substantive human oversight, which must also be demonstrably transparent. A purely theoretical right to intervene is not sufficient.