DPA case 2020-0.225.643 – Dismissed (Austria, 2020)

As a civil servant, the complainant has a supplementary insurance policy with the defendant, which was set up by the Land of Upper Austria as a group insurance scheme. The defendant requires the original pharmacy receipts to be provided in order to provide the service. These vouchers state the names of the medicines purchased. The insurance company required the complainant to submit original pharmacy receipts. The submitted proof of customer sales from the pharmacy was not sufficient. In order to benefit from an insurance policy, he was forced to disclose health-related data, which would be subject to confidentiality. These pharmacy receipts list the names of the medicines purchased. He considers that the insurance company has no interest in knowing what medicines the customer needs. This is subject to the confidentiality obligation of both the doctor and the pharmacy. The subject of the complaint is whether the defendant infringed the complainant's right to confidentiality by requiring the original invoices of a pharmacy, and not merely the pharmacy's proof of customer sales, in order to pay an insurance benefit to the complainant. In substantive terms, however, the matter is to be assessed in accordance with the provisions of Sections 1 to 9 of the DSG 2000 and the VersVG applicable until the end of 24 May 2018, the date of the alleged breach of the right to confidentiality, because at that time the DSGVO and the necessary amendments to the VersVG by Federal Law Gazette I No. 16/2018 were not yet applicable. Under Section 9 No. 3 DSG 2000, the use of sensitive data is permissible, inter alia, if the authorisation or obligation to use it arises from statutory provisions, provided that these serve to safeguard an important public interest. The complainant has an obligation to provide information and evidence to the respondent on the basis of the clear order in § 34 VersVG. In this case, the transmission of health data can be based on § 11a (1) item 3 and (2) it