Austrian Data Protection Authority – Court Ruling (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An assistant professor in Austria shared a court judgment online that included a witness's name and details. The court ruled that this was not allowed, which is important because it shows that sharing sensitive information can lead to legal issues. This case highlights the need for caution when posting legal documents that contain personal data.
What happened
The assistant professor published a court judgment online that included identifying information about a witness.
Who was affected
The witness, whose name and details were shared, was affected by this action.
What the authority found
The authority found that the assistant professor had no valid justification for disclosing the witness's personal information.
Why this matters
This case underscores the importance of protecting personal data in legal documents. It serves as a warning for anyone sharing sensitive information online to ensure they comply with privacy laws.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
The controller, an assistant professor at a private university (the appellant), was engaged in an employment dispute with her university employer before a labour and social court. The data subject, a senior legal counsel employed by the university gave testimony as a witness in that employment proceeding. On 23 January 2025, the labour and social court ruled in the controller's favour, finding that her employment relationship continued beyond the university's purported termination date. The judgment referred to the data subject several times by her academic title and surname in connection with her witness testimony. In April 2025, the controller published the unredacted judgment in full, including the data subject's title and surname on social media. She shared a downloadable link (first via Dropbox, later via Adobe) on her public Facebook profile and in a closed Facebook group of around 230 members connected to the university community. The files were later removed by Dropbox and Adobe after the data subject reported them. The data subject's full first name and additional details could also be found by combining her academic title and surname with the university's name in a Google search, which surfaced her LinkedIn profile. The data subject filed a complaint with the Austrian DPA, arguing that the controller had no justification for naming her and had drawn her into a public dispute with her employer. The controller argued that the judgment concerned matters of wider relevance to university staff, that the Facebook group was closed and that the data subject's name and role were already public via the university directory and LinkedIn. On 15 October 2025, the DPA upheld the complaint, finding that the controller had violated the data subject's right to secrecy under §1(1) of the Austrian Data Protection Act (DSG) by publishing the judgment without a legal basis. The DPA found that a legitimate interest existed in principle, but that both publications were excessive
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (3)
Other cases involving Austrian Data Protection Authority in AT
Court Ruling
Details
About this data
Cite as: Cookie Fines. Austrian Data Protection Authority - Austria (2026). Retrieved from cookiefines.eu
Last updated: