BF (insured/data subject) – Court Ruling (Austria, 2022)

The controller was an insurer, and the data subject was one of its policy holders. In 2012, the data subject subject suffered a whiplash injury in a car accident and was later diagnosed with "post-traumatic depressive adjustment disorder with somatization." In 2014, the data subject filed a claim with the controller for occupational disability; the data subject had been self-employed as a management consultant and energy technician. The controller rejected the claim on the basis that the data subject had not provided adequate proof of disability. On October 28, 2015, the data subject applied to the district court of Wels for a conditional payment order to be issued against the controller. At the time of the DPA's decision, the civil proceedings were suspended. In 2016, the controller offered the data subject a one-time payment of €25,000, which the data subject rejected. The insurance contract between the two parties was terminated in October 2017. On May 13, 2019, the data subject emailed an access request, requesting specifically the "risk assessment" associated with her contract and the "reserve amount" associated with her disability claim. In a response dated Nobember 27, 2019, the controller asked the data subject for an explanation of what she meant by those terms. On April 26, 2020, the data subject filed a complaint with the Austrian DPA alleging that the controller had violated her right of access and additionally requested all of her personal data processed by the controller. The controller responded that it had answered the data subject's access request to the best of its ability and that the terms she used were not meaningful to the firm. The controller claimed the data subject believed she was entitled to an insurance payout and was abusing data protection law for her benefit in the related civil procedure. As the complaint was the first time the data subject had requested all her personal data, the controller sent a 200-page response including among others her tariff type, the surrender value paid out, her responses on a medical questionaire, and payment history. The data subject disagreed that this information was comprehensive, insisting that, because the controller had offered her a settlement, it must have calculated a case-related accrual amount. The controller denied this, explaining that accrual amounts were calculated in aggregate, not on a specific, case-by-case basis. On June 7, 2021, the DPA rejected the data subject's complaint because it had responded to her access request with all the information available to it; the missing information she continued to request was never available to the controller. The data subject appealed, requesting an on-site investigation of the data held by the controller. The Court rejected the data subject's appeal. It concluded that the data subject's complaint was based on the alleged incompleteness of the controller's response to her access request (missing an assessment of the subject's health and the calculation of the settlement). The Court noted that, in regards to the missing health data, the controller had supplied the data subject with the only information it had, which were the questionaires and medical documents she had personally submitted. Regarding the calculation of the offered settlement, the Court held that these calculations were trade secrets under the DSG because they were secret, had commercial value, and were protected with appropriate confidentiality measures. Article 15(4) GDPR provides that the right to access is not absolute and that access requests shall not adversely affect the rights and freedoms of others, and Article 4(6) DSG specifically makes exception for business or trade secrets. The DPA held that the controller had in fact provided all the personal data it had on the data subject and was not obliged to share the process by which it assessed this information and calculated the settlement it offered her. The rejection of the data subject's appeal was deemed final, as the legal situation was sufficiently clear as to not cause any difficulty in interpretation.