Court case W258 2271494-1 – Court Ruling (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that a municipal authority unlawfully processed personal health data by sending vaccination reminder letters. This matters because it shows that even public bodies must follow data protection rules. Small businesses should be aware that they also need to handle personal data carefully to avoid legal issues.
What happened
The court upheld a complaint that a municipal authority unlawfully processed health data by sending vaccination reminders.
Who was affected
The person who received the vaccination reminder letter was affected by the unlawful processing of their health data.
What the authority found
The court found that the municipal authority did not have a valid legal basis for processing the personal health data in the vaccination reminders.
Why this matters
This ruling highlights the need for all organizations, including public ones, to comply with data protection laws when handling personal information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 12 May 2026.
Processing notes: authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In late 2021, the data subject received a personalised COVID-19 vaccination reminder letter containing the data subject’s name, address and proposed vaccination appointments. This information was taken from the central vaccination register and patient index, and the letter displayed logos of several public bodies and social insurance entities. On 10 December 2021, the data subject filed a complaint with the DPA. They alleged that the municipal authority (assumed to be the controller) had unlawfully processed and disclosed sensitive health data by sending the vaccination reminder. Separately, the DPA opened an ex officio investigation into the vaccination reminder campaign. In that investigation, the DPA concluded that the municipal authority involved in the campaign acted as controller under Article 4(7) GDPR. The DPA later upheld the data subject’s complaint, as it held that the assumed controller had unlawfully accessed and processed data from the central vaccination register and patient index while having no sufficient legal basis. It rejected the data subject’s request to prohibit further processing and rejected the request for a fine. The municipal authority appealed before the court. It argued, among other things, that it was not the controller for the processing and that the processing had formed part of pandemic management measures. First, the court examined who acted as controller under Article 4(7) GDPR. The court found that the relevant political officeholder, acting within the framework of public health administration, had determined the purpose and essential means of the processing. The municipal authority involved in the campaign merely implemented their instructions. The court therefore held that it had not determined the purposes and means of the processing and was actually not the controller under Article 4(7) GDPR. Second, the court considered that the data subject could not reasonably identify the correct controller because the vaccination rem
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W258 2271494-1 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W258 2271494-1 - Austria (2025). Retrieved from cookiefines.eu
Last updated: