- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case DSB-D124.0850/25 – Violation Found (Austria, 2026)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Austrian authority dismissed a complaint about the sharing of health data during a legal dispute. The data was shared to assess an expert opinion related to the person's health. This ruling clarifies that sharing health data can be lawful in specific legal contexts.
What happened
Health data was shared between parties in a legal dispute to evaluate an expert opinion.
Who was affected
The person whose health data was shared during the legal proceedings.
What the authority found
The authority ruled that the sharing of health data was permissible under national law due to its relevance in the legal context.
Why this matters
This case illustrates that health data can be shared legally in certain circumstances, especially in legal proceedings. It highlights the need for individuals to understand their rights regarding health information in legal contexts.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject was involved in a legal dispute before a civil court in which the findings of an expert opinion led to the dismissal of the case. The expert opinion concerned the health status of the data subject. The data subject challenged the expert opinion in court in an individual legal proceeding. The court, in that second proceeding, ordered another expert (controller) to review whether the expert opinion in the first legal dispute was issued lege artis. In order for the controller to assess the findings of the expert opinion, the other party of the legal dispute made available to the controller the health data of the data subject via an online link. The health data included not only the data concerning the body part that was subject to the legal dispute, but all the data subject’s health data that the other party of the legal dispute processed. Additionally, the controller made the health data available to a neurologist in an anonymised form in order to receive a second opinion on their findings. The data subject’s complaint before the DPA concerned both the making available of the health data by the other party in the legal dispute to the controller as well as the making available by the controller to the neurologist. The DPA dismissed the complaint fully. # Disclosure to the controller As far as the making available of health data by the other party in the legal dispute was concerned, the DPA held that the processing of health data fell under Article 9(2)(f) and (g) GDPR. National law provides for a legal basis for the making available of health data where the health condition of a person is relevant for a decision in the public interest. The other party in the legal dispute made the data subject’s health data available in the context of a court proceeding that was dealing with the subject matter of an expert opinion on the health status of the data subject. The processing thus fell under the legal basis provided for by national law. Moreover, nat
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DSB-D124.0850/25 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DSB-D124.0850/25 - Austria (2026). Retrieved from cookiefines.eu
Last updated: