XXXX – Court Ruling (Austria, 2026)

XXXX as the party lodged a complaint at the Austrian DPA (District Hospital XXXX as the co-party) on the unauthorised sharing of her personal data in seven different instances by the District Hospital XXXX. XXXX complained that the municipal association running the hospital infringed her fundamental right to secrecy of personal data. During a bitter employment dispute, her court submissions, which included health data, were circulated to the hospital's collegiate management, the members of the association's committee, their secretaries and others, and were discussed at a committee meeting on 27 October 2020. She also filed 27 further procedural applications, on service of documents, an oral hearing, file management, and injunctions against further processing. The Court held that the disclosures were lawful, as they were based on the controller's legitimate interests under Article 6(1)(f) GDPR (and, for health data, the exception for legal claims in Article 9(2)(f) GDPR). The Court affirmed that the recipients were authorised in this case to review the data, as they needed the information gained from the personal data to decide on the dismissal, could not be classified as "unauthorised third parties". The processing was found to be necessary, in line with respected data minimisation, and no overriding interests of the appellant could be established for XXXX. The Court relied on earlier final BVwG judgments and on an Austrian Supreme Court (OGH) decision of 28 July 2021 concerning the same dispute. The Court further rejected the XXXX's argument that the hospital's administrative director was a "falsus procurator" (false agent) and that only the association's chairman could access her data. The Court supported DPA's stance, confirming XXXX has no subjective right to assert how an authority should conduct the proceedings, where the Court dismissed on some aspects of the appeal as they had already been previously decided (res iudicata ). An appeal on points of law (Re