Court case W292 2292202-1 – Court Ruling (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court ruled on a case involving a military employee's health data. It matters because it clarifies how health data can be processed in legal disputes. Companies should understand that sharing sensitive information may be allowed under certain legal circumstances.
What happened
The court upheld a decision that a military unit could process an employee's health data related to legal claims.
Who was affected
The military employee whose health data was shared during legal proceedings was affected.
What the authority found
The court decided that the processing of the employee's health data was justified under the legal claims provision of GDPR.
Why this matters
This ruling sets a precedent for how health data can be handled in legal contexts. Businesses should be aware of the legal bases for processing sensitive information.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The data subject is in the military. The unit he is employed at (controller) and the data subject are involved in a multitude of legal disputes concerning his employment, disciplinary proceedings, data protection matters as well as procedures of criminal law. After the controller revealed information on one of the legal proceedings concerning a penalty he received in an official meeting to third persons, the data subject lodged a complaint with the DPA. In the course of the DPA investigation of the complaint, the controller revealed to the DPA a statement written by the data subject concerning his declining health status because of the multitude of proceedings between the two parties. The data subject considered the sharing of this document as a processing of health data, in violation of Article 9 GDPR. The proceeding before the DPA dealt with the question of whether the data subject’s complaint was excessive pursuant to Article 57(4) GDPR. The DPA held that the statement constituted health data pursuant to Article 4(15) GDPR. Since the processing of the statement happened in the context of the enforcement of legal claims, the DPA did not find a violation of Article 9 GDPR. The data subject appealed the DPA's decision. The Court upheld the DPA’S decision and decided that the controller could rely on the legal basis of Article 9(2)(f) GDPR. The Court held that the notion of “legal claims” pursuant to Article 9(2)(f) GDPR must be understood broadly as meaning any legal conflict. The notion of necessity in the context of Article 9(2)(f) GDPR is to be applied broadly as well because of the role the exemption plays for the enforcement of legal claims and because of Article 47 CFR, the right to an effective remedy and fair trial. “Necessary” must be understood as meaning that without the data in question, the enforcement of legal claims must be impossible or considerably more difficult. According to the Court, the requirement of necessity is not met where the process
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W292 2292202-1 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W292 2292202-1 - Austria (2026). Retrieved from cookiefines.eu
Last updated: