Court case W298 2314952-1 – Court Ruling (Austria, 2026)

The data subject was a policeman who was subject to disciplinary measures. He filed a complaint concerning those disciplinary measures. The decision concerning the complaint was published on an official website of the Federal Chancellery of Austria that makes available legal decisions (Rechtsinformationssystem des Bundes). In the published decision, the professional position of the data subject within the police was not redacted. Neither was the place of the police school redacted where he was teaching (including the address of the school and the courses he was teaching). Moreover, the workplace where he was referred to after the disciplinary measure was not redacted. The published decision also mentioned the mental health status of the data subject, as it was relevant for the disciplinary measure, and a religious function he was exercising. Any other personal information of the data subject was redacted. The data subject filed a complaint with the court under national law concerning a violation of the protection of his personal data, claiming insufficient anonymisation. The court held that the complaint was partly justified. The combination of personal data about the data subject’s professional career that was made available on the website made the data subject identifiable pursuant to Article 4(1) GDPR to a significant number of persons. Thus, the data subject’s health status was made available to an undefined group of people. As far as the personal data concerning the data subject’s professional career was concerned, the court held that the making available violated the data subject’s data right to protection of their personal data. Legal decisions are published with the aim of guaranteeing legal certainty as well as transparency. By anonymising the data subject’s personal information concerning his professional career, none of those aims would be impaired. The meaning of the decision would not be altered. The court held that the making available of the health data was lawful under Article 5(1)(a) GDPR, Article 6(1)(e) GDPR in conjunction with Article 6(3) GDPR. The interest of the public to learn about jurisprudence, especially in the field of disciplinary decisions where the health status was relevant for the decision, prevailed over the data subject’s right. The processing of the religious function the data subject was exercising was lawful under Article 5(1) GDPR, Article 6(1)(c) GDPR, according to the court. This is because it was necessary to mention his function in order to understand a conversation between the data subject and a witness in the context of the disciplinary decision.