Court case W292 2292202-1 – Court Ruling (Austria, 2026)

The data subject is in the military. The unit he is employed at (controller) and the data subject are involved in a multitude of legal disputes concerning his employment, disciplinary proceedings, data protection matters as well as procedures of criminal law. After the controller revealed information on one of the legal proceedings concerning a penalty he received in an official meeting to third persons, the data subject lodged a complaint with the DPA. In the course of the DPA investigation of the complaint, the controller revealed to the DPA a statement written by the data subject concerning his declining health status because of the multitude of proceedings between the two parties. The data subject considered the sharing of this document as a processing of health data, in violation of Article 9 GDPR. The proceeding before the DPA dealt with the question of whether the data subject’s complaint was excessive pursuant to Article 57(4) GDPR. The DPA held that the statement constituted health data pursuant to Article 4(15) GDPR. Since the processing of the statement happened in the context of the enforcement of legal claims, the DPA did not find a violation of Article 9 GDPR. The data subject appealed the DPA's decision. The Court upheld the DPA’S decision and decided that the controller could rely on the legal basis of Article 9(2)(f) GDPR. The Court held that the notion of “legal claims” pursuant to Article 9(2)(f) GDPR must be understood broadly as meaning any legal conflict. The notion of necessity in the context of Article 9(2)(f) GDPR is to be applied broadly as well because of the role the exemption plays for the enforcement of legal claims and because of Article 47 CFR, the right to an effective remedy and fair trial. “Necessary” must be understood as meaning that without the data in question, the enforcement of legal claims must be impossible or considerably more difficult. According to the Court, the requirement of necessity is not met where the processing of health data is arbitrary and bears no connection to the legal proceeding. This question must be assessed from an ex-ante perspective. For the case at hand, the Court decided, that the statement concerning the data subject’s health data was lawfully shared with the DPA. This is because the DPA had to decide on the question of whether the data subject’s complaint was excessive pursuant to Article 57(4) GDPR. In order for the DPA to answer this legal question, it is necessary for the DPA to receive all information on the multitude of legal disputes between the parties to get an understanding of the situation, and the statement is part of the correspondence between the parties on their disputes. Moreover, since the DPA is obliged to treat the information it receives confidentially, a higher level of protection of health data is guaranteed. According to the Court, the data subject deserves less protection because he made the statement available to the controller himself.