beneficiary of financial aid (data subject) – Dismissed (Austria, 2020)

== Facts == The Arbeitsmarktservice, an entity of public law, entrusted with paying benefits (controller) shared a data subject's social security number with a financial service provider in order to provide financial aid. The data subject lodged a complaint with the Austrian DPA (DSB) regarding the disclosure of their social security number. The procedure was in accordance with the [https://www.bmf.gv.at/en.html Austrian Federal Ministry of Finance] et al. in order to fulfill statutory services. The social security number allows easier data management and traceability, for example when financial transactions fail, and is not used for health-related purposes. The DPA held that the use of the data subject's social security number by the controller was reasonable in order to fulfill their statutory duties under the principal of data minimisation. The social security number constitutes personal data, which essentially poses an interest of confidentiality for the data subject under [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=05.11.2020&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=43c38f3f-daa5-4144-bb4f-4332e4426caf § 1(1) DSG]. As a government agency under [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=05.11.2020&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=43c38f3f-daa5-4144-bb4f-4332e4426caf § 1(2) DSG], the controller is only authorized to use this category of data if there is a sufficient legal basis. Among other things, to provide financial services and manage the respective workload, they must inevitably process data types listed in [https://www.ris.bka.gv.at/eli/bgbl/1994/313/P25/NOR40202475?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=AMSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=25&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=05.11.2020&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=0f3802d4-9933-4312-b339-0f76f0d12f81 § 25(1) AMSG], which constitutes a proportionate interference with the right to data protection under [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=05.11.2020&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=43c38f3f-daa5-4144-bb4f-4332e4426caf § 1(1) DSG]. The processing of the data subject's social security number was necessary for the compliance with a legal obligation of the controller. Secondly, the DPA assessed whether the special regime of Article 9 GDPR concerning sensitive data was applicable. From [https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1787030007971&uri=CELEX%3A32016R0679 Recital 35 GDPR] it can be derived that identifiers can be qualified as health data where they give information linking to the data subject's health status. The social security number is such an identifier. The DPA held that no information relating to the data subject's health status can be derived from the social security number as it was used independently from any health service and solely as an identifier. Therefore, Article 9 GDPR was not applicable.