Austrian Data Protection Authority – Court Ruling (Austria, 2024)

The data subject and the controller both worked as nurses at the same hospital, on different wards. Over ten years before the events in question, the data subject had been hospitalised as a patient on the ward where the controller worked as a nurse. The controller's daughter, a school classmate of the data subject at the time, had visited her in hospital and the data subject's hospitalisation had briefly been discussed once in a social-skills class at school, without any diagnosis being disclosed. The data subject only told her closest friends about the hospitalisation itself. The data subject was later employed as a nurse at the same hospital, on a different ward, from October to April of a subsequent year. She and the controller belonged to a shared WhatsApp group used by both wards. Around Christmas, the controller's daughter recognised the data subject from her WhatsApp profile picture and reminded the controller that the data subject had once been her patient, the controller herself had not previously made this connection. The data subject resigned from her position, with her last working day followed by sick leave through the end of her notice period. On her first day back from holiday, the controller, deputy head of her ward, discussed recent events with the ward manager, including the data subject's resignation. In the course of this conversation, the controller mentioned that her daughter had gone to school with the data subject and asked the ward manager whether she had known that the data subject had been hospitalised on the relevant ward over ten years earlier. That same day, the ward manager told the data subject that staff at the hospital were aware of her earlier hospitalisation, intending to prepare her for the possibility that colleagues might raise it. The data subject later learned, from the site manager, that it was the controller who had disclosed this information to the ward manager. The data subject alleged that this disclosure led to her being bullied in the workplace. The controller denied any obligation on employees to disclose past hospitalisations to the employer and stated she had no other motive for the disclosure. The data subject lodged a complaint with the Austrian DPA, alleging a violation of her right to secrecy. The DPA upheld the complaint, finding that although the GDPR did not directly apply to this oral disclosure, the national constitutional right to secrecy under Section 1 DSG did apply, that the disclosed health data warranted heightened protection and that the controller had not shown sufficiently weighty grounds to justify the disclosure. The controller appealed to the Federal Administrative Court, arguing that the information was already publicly available (since it had once been mentioned at school) and that the disclosure was justified as processing of manifestly public data, as processing by a professional subject to confidentiality obligations, or as necessary for assessing an employee's fitness for work. The court dismissed the appeal and confirmed the DPA's decision in full. First, the court held that the GDPR's substantive scope did not apply to this case, since it concerned a purely oral disclosure of personal data, not automated or file-based processing. The applicable standard was instead the national constitutional right to secrecy under §1 DSG, interpreted in light of GDPR principles. The court noted that the disclosed information, the fact of a past hospitalisation, qualified as health data under Article 4(15) GDPR, given the broad interpretation the CJEU applies to that concept. Second, the court held that the information was not "generally available" within the meaning of §1(1) DSG, which would have excluded any protectable secrecy interest. It reasoned that data are only "generally available" if accessible to an indeterminate group of people, not merely to a limited circle of confidants. Since the data subject had only shared her hospitalisation with a small group of close friends and even the one classroom discussion of it involved only a defined group of classmates (not the public), the general-availability exception did not apply and the data subject retained a protectable secrecy interest. Third, addressing the controller's justification arguments in turn, the court held Article 9(2)(e) GDPR (data manifestly made public by the data subject) did not apply, for the same reasons the data was not "generally available“, Article 9(2)(a) GDPR (explicit consent) did not apply, since no explicit consent to this specific disclosure had ever been given and Article 9(2)(h) GDPR (processing necessary for assessing an employee's working capacity, among other health-related purposes) did not apply, because the disclosure was not shown to be necessary. The employer had no policy of taking such hospitalisations into account, the data subject had no duty to disclose them and no concrete workplace measures were linked to the disclosure. The court emphasised that health data attracts a particularly high level of protection, meaning that even if the controller's interest had been considered on a par with the data subject's, this would not have been sufficient to justify disclosure, given that the data subject was already leaving employment within a short period, her interest in confidentiality clearly outweighed any interest of the controller. The court accordingly confirmed that the controller had violated the data subject's right to secrecy under §1 DSG and declared an appeal on points of law (Revision) inadmissible, since the case turned on an individual assessment of undisputed facts and raised no question of fundamental legal importance.