unknown data subject (complainant before the DSB) – Court Ruling (Austria, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A retired employee claimed that Innsbruck's municipality shared their personal data with a lawyer without permission. The Austrian court sent the case back to the data authority to gather more facts. This highlights the importance of clear data handling rules for public bodies.
What happened
A retired employee alleged that their personal data was shared by the municipality of Innsbruck with a lawyer without proper authorization.
Who was affected
A retired employee whose personal data was allegedly shared by the municipality with an attorney.
What the authority found
The court did not make a final decision but instructed the data authority to investigate the facts more thoroughly.
Why this matters
This case emphasizes the need for public authorities to handle personal data carefully and transparently, especially when involving legal proceedings. It also shows the role of courts in ensuring data protection authorities conduct thorough investigations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 21 March 2026.
Processing notes: national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject is a retired employee of the municipality of Innsbruck. According to the data subject, the municipality had unlawfully disclosed the data subject's data in the course of a court procedure, inter alia by sharing them with an attorney which represented the municipality. The data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB). The municipality argued before the DSB that the disclosure of the data subject's data to the attorney had been necessary for the exercise of legal claims and therefore for the purposes of the legitimate interests under Article 6(1)(f) GDPR. The data subject was heard on this statement and filed a submission, arguing that Article 6(1)(f) GDPR does not apply on the municipality as it qualifies as a public authority. The DSB invited the municipality to submit a statement on this reply. The municipality filed a statement (mostly repeating their previous arguments) which was in turn again provided to the data subject who issued yet another submission (also mostly repeating their arguments). In September 2019, the DSB issued its decision, rejecting the complaint. In essence, the DSB (for unknown reasons) did not assess the case under Article 6 and 9 GDPR but held that the disclosure of data under § 1 Austrian Data Protection Act (DSG) was lawful. In particular, Austrian law allowed for parties to be represented by an attorney, which included the sharing of personal data. The data subject filed an appeal with the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG did not issue a decision on the merits of the case but remitted it to the DSB, ordering it to establish the facts of the case properly. It held that the DSB failed to assess which personal data of the data subject had actually been shared with the attorney. Furthermore, the Court pointed out that the DSB had also failed to establish when and how the respective data were shared with the attorney. In parti
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (3)
Other cases involving unknown data subject (complainant before the DSB) in AT
Court Ruling
Details
About this data
Cite as: Cookie Fines. unknown data subject (complainant before the DSB) - Austria (2021). Retrieved from cookiefines.eu
Last updated: