Court case 6 C 7.24 – Court Ruling (Germany, 2026)

An insured person (the data subject) lodged a complaint with a DPA in March 2019 against a mutual health insurance association (the controller) that offered screening and preventive programs for i.e. diabetes, asthma and back problems. The data subject stated the controller had violated Articles 5(1)(a), 6(1) and 9(1) GDPR by analysing invoices containing health data of its insured persons for reimbursement in connection with offering individualised preventive programs without first obtaining consent. The DPA issued the controller a reprimand in February 2022 and ordered it to only carry out such processing operations based on consent. The administrative court revoked the DPA decision in March 2023 in response to the appeal brought against it. The higher administrative court dismissed the DPA’s subsequent appeal in June 2024. It considered the challenged DPA decision to be materially unlawful: the court held that the processing was necessary for the purposes of preventive medicine and thus fell under the exception to the prohibition of the processing of sensitive categories of personal data in Article 9(2)(h) GDPR. The DPA appealed the court’s decision to the German Federal Administrative Court. The dispute before it concerned whether the processing operations carried out by the controller were covered by exception in Article 9(2)(h) GDPR and whether there was a legal basis for the processing operations under Article 6(1)(f) GDPR. The German Federal Administrative Court held that the exception in Article 9(2)(h) GDPR was applicable to the processing operations in connection with the screening and preventive programs offered by the controller. The court amended the judgments of the lower courts and dismissed the controller’s claims. The DPA’s appeal was justified. First, the court found that Article 9(2)(h) GDPR was applicable to the present case despite the fact that the controller did not directly provide the health-related services itself, but only arranged them. According to the court, a systematic reading of Article 9(2)(h) supports the view that the concept of preventive healthcare covers the entirety of measures aimed at preventing illness as far as possible, not only the narrow area of a doctor-patient relationship. The necessity criterion was also satisfied: the controller’s interest in the processing was not limited to self-serving economic interests, as improved healthcare will regularly also reduce the financial burden on a large number of insured persons. Furthermore, the processing was carried out on the basis of Member State law in accordance with Article 9(2)(h). Second, the court held that there was no legal basis for the processing of personal data under Article 6(1) GDPR and amended the appealed judgment in this regard. In the present case, Article 6(1)(f) was the only possible legal basis as no consent of the data subject had been obtained. However, the controller had not informed the data subject of its legitimate interests as required by Article 13(1)(d) GDPR. In addition, the court ruled that the balancing test under Article 6(1)(f) GDPR could only lead to the conclusion that the interests of the data subject outweigh the legitimate interests of the controller. This was supported by the higher level of protection of sensitive health data, the wide range of data processing by the controller, and the fact that the health care programs offered by the controller were not a part of the core area of medical care.