A student (defendant) – Court Ruling (Austria, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that a teacher was not responsible for a privacy breach when he shared students' grades with class representatives. The court found that the teacher was acting under the school's authority and not as an independent controller of the data. This case highlights the importance of understanding who is legally responsible for data protection in educational settings.
What happened
A teacher shared students' grades with class representatives, which was challenged as a privacy breach.
Who was affected
Students whose grades were shared with class representatives and then communicated to classmates.
What the authority found
The court decided that the teacher was not responsible as he was acting under the school's supervision, not as an independent controller of the data.
Why this matters
This case clarifies that teachers may not be individually liable for data protection breaches when acting within their professional roles under school supervision. Schools should ensure clear guidelines on data handling responsibilities.
GDPR Articles Cited
National Law Articles
A student, the defendant, had allegedly told her teacher, the plaintiff, that she did not want her examination grades to be published or otherwise communicated to third parties other than herself. Nonetheless, the plaintiff had released the grades of all his students, the defendant's included, to their class representatives in order for them to communicate the results to their classmates in a common WhatsApp group. As a result, the defendant lodged a complaint before the Austrian data protection authority, claiming that the disclosing of her grades constituted a violation of confidentiality, to which she considered her teacher to be subject to. The data protection authority sustained the defendant's - plaintiff before them - complaint and held that the teacher - defendant before them - had violated his student's right to confidentiality, arguing that a grade constitutes a personal data such as defined in Article 4(1) GDPR and had to be protected according to the applicable principles of the law, such as confidentiality. The disclosing of grades from the teacher to the class representatives had in view thereof to be considered a breach of confidentiality of the data. This decision was appealed by the teacher before the Federal Administrative Court of Austria, primarily arguing that it should not be him as teacher but the competent authority he was acting on behalf of, the Ministry of education, that should be held responsible as data controller. Can a teacher be considered data controller as defined in Article 4(7) GDPR and therefore be held liable in case of a breach of the applicable data protection principles? The Federal Administrative Court of Austria amended the data protection authority's decision by holding that the plaintiff could not be considered data controller since he was only teaching as part of the school's organisation and under official and professional supervision of the headmaster (§ 56 of the national school teaching law). This would also
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for A student (defendant) in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. A student (defendant) - Austria (2020). Retrieved from cookiefines.eu
Last updated: