DPA case 2021-0.410.237 – Dismissed (Austria, 2021)

The data subject entered the retail store of the controller. Because she did not were a face mask, she was denied entry by an employee of the controller. She explained that she could not wear a face mask for health reasons. The employee asked her to show an appropriate doctor's certificate which the data subject did. The data subject lodged a complaint against the controller with the Austrian DPA (Datenschutzbehörde - DSB) asserting that the controller violated her right to privacy because already the fact that she cannot wear a face mask for health reasons is sensitive data. The controller objected to this assertion stating that, under § 19 of the forth Austrian Covid-19 Protection Ordinance ([https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20011470&FassungVom=2021-05-05 § 19 4. COVID-19-SchuMaV]), it had to check whether customers are wearing face masks and, if not, verify which health reason prevents them from doing so. The data subject replied to this argument that the ordinance violates the GDPR and is therefore not to be applied according to the principle of Primacy of EU Law. The DPA rejected the complaint. It held that the data subjects' rights are sufficiently safeguarded because according to [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 § 6(1) DSG] (Austrian Data Protection Law) the employees of the controller are obliged to secrecy regarding data which they accessed exclusively in their professional occupation. Furthermore, the DPA found that the protection of public health overrides the interest of the data subject to not disclose (part of) her health record and that [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20011470&FassungVom=2021-05-05 § 19 4. COVID-19-SchuMaV] constitutes an exception under Article 9(1)(i) GDPR.