Court case W292 2292202-1 – Court Ruling (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court upheld a decision that a military unit could share a soldier's health information in a legal context. The soldier had complained that sharing his health status violated privacy rules, but the court found it was necessary for legal proceedings. This case illustrates the balance between privacy and legal obligations.
What happened
The court upheld a decision that allowed a military unit to process a soldier's health data in relation to legal claims.
Who was affected
The soldier in the military who claimed his health data was shared improperly during legal proceedings.
What the authority found
The court ruled that the processing of the soldier's health data was justified under legal claims and did not violate privacy rules.
Why this matters
This ruling shows that legal obligations can sometimes override privacy concerns. Companies should be aware of how legal requirements may affect their handling of sensitive data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 9 September 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject is in the military. The unit he is employed at (controller) and the data subject are involved in a multitude of legal disputes concerning his employment, disciplinary proceedings, data protection matters as well as procedures of criminal law. After the controller revealed information on one of the legal proceedings concerning a penalty he received in an official meeting to third persons, the data subject lodged a complaint with the DPA. In the course of the DPA investigation of the complaint, the controller revealed to the DPA a statement written by the data subject concerning his declining health status because of the multitude of proceedings between the two parties. The data subject considered the sharing of this document as a processing of health data, in violation of Article 9 GDPR. The proceeding before the DPA dealt with the question of whether the data subject’s complaint was excessive pursuant to Article 57(4) GDPR. The DPA held that the statement constituted health data pursuant to Article 4(15) GDPR. Since the processing of the statement happened in the context of the enforcement of legal claims, the DPA did not find a violation of Article 9 GDPR. The data subject appealed the DPA's decision. The Court upheld the DPA’S decision and decided that the controller could rely on the legal basis of Article 9(2)(f) GDPR. The Court held that the notion of “legal claims” pursuant to Article 9(2)(f) GDPR must be understood broadly as meaning any legal conflict. The notion of necessity in the context of Article 9(2)(f) GDPR is to be applied broadly as well because of the role the exemption plays for the enforcement of legal claims and because of Article 47 CFR, the right to an effective remedy and fair trial. “Necessary” must be understood as meaning that without the data in question, the enforcement of legal claims must be impossible or considerably more difficult. According to the Court, the requirement of necessity is not met where the process
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W292 2292202-1 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W292 2292202-1 - Austria (2026). Retrieved from cookiefines.eu
Last updated: