DPA case 2021-0.285.169 – Dismissed (Austria, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A complaint about a mother sharing sensitive information about her ex-husband was dismissed by the Austrian DPA. This matters because it clarifies that personal data shared in private situations may not always violate data protection laws. It reminds individuals to be cautious about sharing personal information.
What happened
A mother shared a court order containing personal health information about her ex-husband via WhatsApp.
Who was affected
Mr. X, the father whose health information was shared.
What the authority found
The Austrian DPA found that the GDPR did not apply due to the household exception, meaning the sharing was not a legal violation.
Why this matters
This case highlights that personal data shared within households may not always be subject to strict data protection laws. It serves as a reminder for individuals to be careful with sensitive information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Mr X and Ms Y have a son and are divorced. Ms Y has sole custody of their son. Reliable care is required for the son due to special needs (e.g. hyperactivity, medication, etc.). The mother of the Mr X often takes care of him. In a court order, a number of the data subject's health conditions had been identified. The order referred to the data subject only as the "father of the child" or “father”. Among other things, it lists Mr X's depressive currents and rapid mental exhaustion/overstrain, so that Mr X is dependent on a specially created daily structure with many breaks. Ms Y forwarded this court order to the Mr X's mother via WhatsApp. In an accompanying message, the Ms Y referred to the data subject by his first name and questioned whether he still is an eligible to take care for the son. Mr X filed a complaint with the Austrian DPA (Datenschutzbehörde, DSB) alleging a violation of the his right to data protection as well as to confidentiality. The complaint was dismissed as unfounded. Neither the GDPR nor the Austrian Data Protection Act (DSG) applied due to the exception in Article 2(2)(c) GDPR. = The DSB first found that the data transferred was personal data. Furthermore, the information relates to the physical or mental health of the data subject and contains information about the health status of the data subject, i.e. data concerning health within the meaning of Article 4(15) GDPR. = The DSB founds that the GDPR does not apply due to the household exception provided for in Article 2(2)(c) GDPR. Pursuant to Article 2(2)(c) GDPR, the GDPR does not apply to the processing of personal data by natural persons in the course of purely personal or household activities. As a restriction of the fundamental right under Article 8 EU Charter, this provision was to be interpreted restrictively in accordance with Article 52(1) EU Charter. The criterion of delimitation is the absence of any reference to a professional or economic activity. This means that the central
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2021-0.285.169 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2021-0.285.169 - Austria (2021). Retrieved from cookiefines.eu
Last updated: