Natural person (complainant) – Court Ruling (Austria, 2020)

The plaintiff, an Austrian resident, had asked the Austrian social security administration to inform him about the status of his son's insurance, a boy living under the care of his mother in Italy. After a survey of both the mother and child's social security administrations, the Austrian administration informed the plaintiff that his son was not entitled to Austrian social security, since the place of residence of the child was not Austria. Following this, the plaintiff lodged a complaint with the Austrian DPA (Datenschutzbehörde Österreichs), claiming that the confidentiality of both his and his son's personal data had been breached by the illicit transfer of said data from the Austrian to the Italian social security administration. However, the Austrian DPA dismissed the complaint, arguing, regarding the alleged breach of his son's personal data, that the plaintiff was not authorized to act on behalf of the child and, regarding the alleged breach of the plaintiff's own personal data, that the Austrian social security administration had to share the data with third parties, especially with the Italian social security, as part of the inquiry into the entitlement of the Austrian social security of the plaintiff's son. 1) Can a parent lodge a complaint with a DPA on behalf of their child when the other parent has not given their consent for that purpose? 2) Does the transfer of data from one European social security administration to another constitute a breach of confidentiality? The Federal Administrative Court started by confirming that the Austrian DPA was right to dismiss the part of the complaint lodged by the plaintiff on behalf of his son. Indeed, the plaintiff lacked power of representation in this regard and could not produce evidence of the mother's consent for a joint complaint. Beyond that, it was also shown that the mother alone - contrary to the sayings of the plaintiff - had the right of custody of the child. The Court then pointed out that data processing and possible transfer to third parties in the context of an administrative procedure would always be considered legitimate if they are necessary for establishing and confirming relevant facts. Since a person resident in the European Union can only be entitled to social security in one member state at a time, the Austrian social security administration was in its right to communicate with the Italian social security administration on the matter, in order to clarify the situation of the plaintiff's son pursuant to Article 11 of the regulation on the coordination of social security systems. In doing so, the Austrian social security administration also had to communicate data relating to the plaintiff himself. In accordance with Article 6(1)(c) GDPR, this data processing in form of a data transfer could be considered necessary for compliance with a legal obligation to which the controller is subject and not a breach of confidentiality of the plaintiff's data. Hence, the data protection authority was also right to dismiss the plaintiff's complaint on that regard.