pharmacy customer (data subject) – Court Ruling (Austria, 2026)

The data subject did not pay for items ordered and collected from a pharmacy (controller). After several reminders, the controller commissioned a debt collection agency, which pointed to several enforcement proceedings against the data subject. The controller then reported the data subject for fraud and provided the police with a record of the enforcement proceedings. The data subject lodged a complaint with the Austrian DPA (DSB) regarding the violation of their right to confidentiality, claiming the disclosure of the record constitutes a violation of [https://www.ris.bka.gv.at/eli/rgbl/1896/79/P427/NOR40233943?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=EO&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=427&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=03.08.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=c7a56c5c-2040-47e7-91fe-3ae37e4eb965 § 427 EO] in conjunction with [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=03.08.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=607193ce-5b62-4d7a-abab-5027790e9ed4 § 1 DSG]. On 13. January 2026, the DPA dismissed the data subject's complaint and requests. The data subject subsequently appealed against the DPA's decision arguing that the provisioning of the record would violate the principle of data minimisation under Article 5(1)(c) GDPR, since handing over bills and reminders would have been sufficient. They also argued that the disclosure of the record would constitute a significant interference with their rights and, therefore, the conducted balancing of interests under Article 6(1)(f) GDPR was incorrect. Additionally, some of the listed enforceable titles were no longer current, thus violating the right to accuracy under Article 5(1)(d) GDPR. First, the court held that the controller had not violated the data subject's right to confidentiality under [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=03.08.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=607193ce-5b62-4d7a-abab-5027790e9ed4 § 1(1) DSG], as the provision of the record of enforcement proceedings to the police was in the legitimate interest of the controller under Article 6(1)(f) GDPR and did not violate the right to data minimisation pursuant to Article 5(1)(c) GDPR. The record was necessary as it provided a substantive evidence of the alleged fraud - providing only bills and reminders would not have been sufficient - as well as for the collection of outstanding debts. Thus, the record was also the least intrusive means. Given their prior history, the data subject should have reasonably anticipated such legal action. Consequently, the data subject's rights were found not to outweigh the controller's competing interests. Secondly, the court held that the professional and ethical confidentiality obligations of a pharmacist do not prevent them from reporting (potential) criminal offences or pursuing civil causes of action. Therefore, the court dismissed the appeal, as the DPA's decision was not found to be unlawful.