Austrian Data Protection Authority – Court Ruling (Austria, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Austrian Data Protection Authority ruled on a case involving a nurse who discussed a colleague's past hospitalization. The nurse's comments led to a complaint about privacy violations. This case illustrates the risks of sharing personal information in workplace conversations.
What happened
A nurse discussed a colleague's past hospitalization with a ward manager, leading to a privacy complaint.
Who was affected
The nurse who was discussed, who had previously been a patient of the other nurse.
What the authority found
The authority found that the discussion did not violate data protection rules, as it did not disclose any sensitive information.
Why this matters
This case underscores the importance of discretion in workplace discussions about colleagues' personal histories. It serves as a reminder for employees to be mindful of privacy in their conversations.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
The data subject and the controller both worked as nurses at the same hospital, on different wards. Over ten years before the events in question, the data subject had been hospitalised as a patient on the ward where the controller worked as a nurse. The controller's daughter, a school classmate of the data subject at the time, had visited her in hospital and the data subject's hospitalisation had briefly been discussed once in a social-skills class at school, without any diagnosis being disclosed. The data subject only told her closest friends about the hospitalisation itself. The data subject was later employed as a nurse at the same hospital, on a different ward, from October to April of a subsequent year. She and the controller belonged to a shared WhatsApp group used by both wards. Around Christmas, the controller's daughter recognised the data subject from her WhatsApp profile picture and reminded the controller that the data subject had once been her patient, the controller herself had not previously made this connection. The data subject resigned from her position, with her last working day followed by sick leave through the end of her notice period. On her first day back from holiday, the controller, deputy head of her ward, discussed recent events with the ward manager, including the data subject's resignation. In the course of this conversation, the controller mentioned that her daughter had gone to school with the data subject and asked the ward manager whether she had known that the data subject had been hospitalised on the relevant ward over ten years earlier. That same day, the ward manager told the data subject that staff at the hospital were aware of her earlier hospitalisation, intending to prepare her for the possibility that colleagues might raise it. The data subject later learned, from the site manager, that it was the controller who had disclosed this information to the ward manager. The data subject alleged that this disclosure led to her bein
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (3)
Other cases involving Austrian Data Protection Authority in AT
Court Ruling
Details
About this data
Cite as: Cookie Fines. Austrian Data Protection Authority - Austria (2024). Retrieved from cookiefines.eu
Last updated: