DPA case DSB-D770.1336 – Dismissed (Austria, 2022)

A data subject received a letter from the umbrella association of Austrian social insurance institutions - the controller - suggesting him to show up for an appointment for a vaccine against covid-19. The data subject believed that the letter had been sent to him on the basis of unlawful processing of his personal data by the controller. He thus filed a complaint with the Austrian DPA (Datenschutzbehörde, DSB) on 23 December 2021, asking the DSB to prohibit such processing and impose a fine on the controller. Given the high number of similar complaints, the DSB took for granted that the umbrella association was the controller and asked it to provide its submission on the matter. On 14 January 2022, the controller submitted as sole controller it sent letters about the possibility of getting a covid-19 vaccine to those people who had not been vaccinated before a certain date. In the controller’s view, this was legitimate as it occurred on the basis of [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10008147 § 750(1a) and (2) of the Austrian General Law on Social Insurance (ASVG)]. First of all, the DSB considered that the controller in this case is an entity under public law. The controller checked the central vaccination register whether the data subject had been vaccinated against covid-19 before 22 November 2021, and, as he had not, the controller retrieved the address of the data subject from the central patient register and sent him the letter. The DSB also found that the sending of the letter with information about the risk of covid-19 and a suggestion of an appointment for a free vaccine were not unlawfully transmitted to third parties, in this case, a printing service provider. As a matter of fact, the latter, as a processor, later confirmed deletion of the data. Further, the DSB concluded that, since the controller is a public entity acting in accordance with [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bunde