beneficiary of financial aid (data subject) – Dismissed (Austria, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A case in Austria was dismissed where a financial aid beneficiary complained about their social security number being shared without consent. This is important as it clarifies the conditions under which data sharing can be considered acceptable.
What happened
The controller shared the beneficiary's social security number with a financial service provider without consent.
Who was affected
The individual who applied for financial aid and whose social security number was shared.
What the authority found
The authority found that the sharing of the social security number was reasonable for fulfilling statutory duties and did not violate GDPR.
Why this matters
This case illustrates that data sharing can be permissible under certain conditions, emphasizing the need for organizations to understand their legal obligations when handling personal data.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
Entities Involved
The controller shared the data subject's social security number with a financial service provider in order to provide financial aid, to which the data subject did not consent. On 17.02.2020, the data subject lodged a complaint with the Austrian DPA (DSB) regarding the unlawful disclosure of their date of birth under Article 9 GDPR, which posed a risk of accessing the data subject's health records using their social security number. On 19.03.2020, the controller stated that the complaint was unfounded, since the data subject had not mentioned anyone taking note of their social security number. Furthermore, financial transactions in contemporary business environments are fully automated, and the field containing the social security number is usually only visible in detailed transaction views. The procedure is also in accordance with the [https://www.bmf.gv.at/en.html Austrian Federal Ministry of Finance] et al. in order to fulfill statutory services. The social security number allows easier data management and traceability, for example when financial transactions fail, and is not used for health-related purposes. First, the DPA held that the use of the data subject's social security number by the controller was reasonable in order to fulfill their statutory duties under the principal of data minimisation. The social security number constitutes personal data, which essentially poses an interest of confidentiality for the data subject under [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=05.11.2020&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&R
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for beneficiary of financial aid (data subject) in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. beneficiary of financial aid (data subject) - Austria (2020). Retrieved from cookiefines.eu
Last updated: