DPA case 07121-1/2021/400 – Violation Found (Slovenia, 2021)

Question: Is it permissible for a person reading the content of a publicly available blog to disclose to a third party the personal information provided about himself by the author of the blog. Namely, a person writes a personal blog (which includes photos of his or her face) that is publicly available and has written down his or her health information about a particular medical condition. The third party to whom the information is shared via private messages online does not know the author of the blog. They are also interested in whether it is still sensitive personal information if it is only published by the patient. They also believe that freedom of expression is at stake. Generally, it is permissible for an individual to disclose to a third party the blog author's specific health information that the individual lawfully obtained from the author's publicly available website and that the author freely posted. Information whose content meets the definition of health data in point 15 of Article 4 of the General Regulation on Data Protection is health information even if it is published by the person himself. It does not matter where the data come from, what the purpose of the publication is, whether the data are correct and complete and whether they are defined in a technically correct way.