DSB (Austria) – Court Ruling (Austria, 2024)

The data subject underwent a rehabilitation stay in a therapy centre approved by the controller, a social insurance provider. On 27 June 2022, a district court requested the controller to disclose the location of the data subject’s rehabilitation stay in the context of enforcement proceedings. The controller provided the name and address of the therapy centre. The data subject later argued that this information revealed sensitive health data and that the disclosure was unlawful. He also claimed that the controller failed to properly assess the legality of the court’s request and should have refused or sought clarification. On 10 January 2023, the data subject filed a complaint with the DPA, alleging a violation of his right to confidentiality and unlawful processing of health data. The DPA rejected the complaint. The data subject appealed to the court, maintaining that the disclosure lacked a legal basis and exceeded what was necessary. First, the court classified the information about the rehabilitation location as health data within the meaning of Article 9 GDPR, as it allowed inferences about the data subject’s medical condition. Second, the court held that the disclosure was lawful under Article 6(1)(c) GDPR and Article 6(1)(e) GDPR because the controller acted under a legal obligation and in the exercise of a task in the public interest. The relevant legal basis derived from national provisions requiring social insurance bodies to provide information to courts. Third, the court found that Article 9(2)(g) GDPR applied, as the processing was necessary for reasons of substantial public interest based on national law. Fourth, the court emphasised that the controller complied with the principle of data minimisation under Article 5(1)(c) GDPR, as it disclosed only the specific information requested by the court and nothing beyond that. Fifth, the court rejected the argument that the controller had to assess the legality of the court order in detail. It held that there was no obvious unlawfulness or excess of competence in the request, and the controller could reasonably rely on it. Finally, the court concluded that the interference with the right to confidentiality under § 1 DSG was justified and proportionate. It therefore dismissed the appeal and confirmed that no GDPR violation had occurred.