unknown data subject (complainant before the DSB) – Court Ruling (Austria, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A retired employee claimed that Innsbruck's municipality shared their personal data with a lawyer without permission. The Austrian court sent the case back to the data authority to gather more facts. This highlights the importance of clear data handling rules for public bodies.
What happened
A retired employee alleged that their personal data was shared by the municipality of Innsbruck with a lawyer without proper authorization.
Who was affected
A retired employee whose personal data was allegedly shared by the municipality with an attorney.
What the authority found
The court did not make a final decision but instructed the data authority to investigate the facts more thoroughly.
Why this matters
This case emphasizes the need for public authorities to handle personal data carefully and transparently, especially when involving legal proceedings. It also shows the role of courts in ensuring data protection authorities conduct thorough investigations.
GDPR Articles Cited
National Law Articles
The data subject is a retired employee of the municipality of Innsbruck. According to the data subject, the municipality had unlawfully disclosed the data subject's data in the course of a court procedure, inter alia by sharing them with an attorney which represented the municipality. The data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB). The municipality argued before the DSB that the disclosure of the data subject's data to the attorney had been necessary for the exercise of legal claims and therefore for the purposes of the legitimate interests under Article 6(1)(f) GDPR. The data subject was heard on this statement and filed a submission, arguing that Article 6(1)(f) GDPR does not apply on the municipality as it qualifies as a public authority. The DSB invited the municipality to submit a statement on this reply. The municipality filed a statement (mostly repeating their previous arguments) which was in turn again provided to the data subject who issued yet another submission (also mostly repeating their arguments). In September 2019, the DSB issued its decision, rejecting the complaint. In essence, the DSB (for unknown reasons) did not assess the case under Article 6 and 9 GDPR but held that the disclosure of data under § 1 Austrian Data Protection Act (DSG) was lawful. In particular, Austrian law allowed for parties to be represented by an attorney, which included the sharing of personal data. The data subject filed an appeal with the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG did not issue a decision on the merits of the case but remitted it to the DSB, ordering it to establish the facts of the case properly. It held that the DSB failed to assess which personal data of the data subject had actually been shared with the attorney. Furthermore, the Court pointed out that the DSB had also failed to establish when and how the respective data were shared with the attorney. In parti
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for unknown data subject (complainant before the DSB) in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. unknown data subject (complainant before the DSB) - Austria (2021). Retrieved from cookiefines.eu
Last updated: