Court case W2522299666-1/6E – Court Ruling (Austria, 2024)

A public-law body (the data controller) sent a letter to an individual (the data subject) inviting them to receive a Covid-19 vaccination. On 14 December 2021, the data subject submitted a complaint with the Datenschutzbehörde (hereinafter DSB/data protection authority), alleging that the controller had violated their right to confidentiality of personal data under §1(2) DSG since they could not establish how the controller obtained information about their vaccination. Following a series of proceedings conducted against the wrong responsible party, the data subject identified the correct controller through a letter dated 01 August 2024. In particular, the data subject requested: (i) a finding of a violation of their fundamental rights; (ii) a prohibition of further data processing under §22(4) DSG; and (iii) the imposition of a fine. Decision of the Data Protection Authority (DSB) By means of a decision rendered on 03 September 2024, the DSB upheld the complaint in part. Firstly, it held that the controller had unlawfully accessed and processed the data subject’s records from the central vaccination register and central patient index. In the absence of a legal basis in accordance with §1 para. 2 DSG, the DSB maintained that the data subject’s right to confidentiality was infringed upon. Secondly, the DSB dismissed the request for prohibition of processing given that the processing had already been completed and therefore fell short of the standard stipulated under §22 para 4 DSG. Thirdly, it rejected the request for a fine for two-fold reasons: the data subject held no subject right to demand one, and fines cannot be imposed on bodies of public law under §30(5) DSG. The data subject subsequently appealed the decision to the Federal Administrative Court on grounds that they found it “outrageous” that their vaccination data had been shared. Despite a court order issued on 02 October 2024 to clarify their grounds of appeal, the data subject did not submit further statements. On standing to appeal The Federal Administrative Court held that a complainant lacks the necessary legal standing to appeal a DPA decision where the DPA has already fully ruled in their favour on the core issue. Since the DSB upheld the data subject’s complaint and found a violation of their right to confidentiality under §1(2) DSG, the data subject did not suffer legal grievances from that part of the decision and had no grounds to challenge it. On the prohibition of data processing The Court furthermore held that §22(4) DSG is a discretionary provision which requires a finding of imminent danger—namely, a significant and immediate threat to the data subject’s protected confidentiality interests—before a prohibition of processing may be ordered. This condition was not met because the processing had been brought to an end. Moreover, the Court maintained that §22(4) DSG does not confer a subjective legal entitlement on the data subject to demand such a measure. On the imposition of a fine As its last point, the Court held that fines cannot be imposed within the framework of administrative proceedings, and that no subjective right to demand the initiation of fine proceedings can be derived from Article 77(1) GDPR or §24(1) and (5) DSG. Additionally, the Court held that fines cannot be imposed on bodies of public law in accordance with §30 para. 5 DSG. In light of these reasons, the Court concluded that the data subject’s subjective rights were not violated. Overall conclusion Since the DSB’s decision had granted the data subject their rights in all the areas where they held a subjective right, and only dismissed or rejected their requests in realms where no such right existed, the prerequisites for a valid appeal were unfulfilled. The complaint was thus dismissed as inadmissible in its entirety. The Court further held that no appeal on points of law was admissible pursuant to Art. 133 para. 4 B-VG, as the decision rested on long-established and consistent case law of the Austrian Administrative Court and raised no legal question(s) of fundamental importance.