Court case W137 2292450-1/4E – Court Ruling (Austria, 2024)

The data subject filed a complaint against a gym operator with the Austrian DPA (Datenschutzbehörde – DSB) alleging that the gym operator had unlawfully disclosed her personal data. When the data subject signed-up to the gym membership, she had ticked a box which meant that she did not consent to the further processing of her data. Civil dispute The data subject had brought a civil claim against the gym operator as it alleged that the controller had increased the membership fees without the members agreement. In the course of the court proceedings email communication between the data subject and the gym operator were used as evidence. Through providing the email communication as evidence, the data subject alleged that the gym operator had unlawfully disclosed the name, e-mail address and the fact that the data subject had a gym membership. The gym operator argued that they had merely provided the data subject’s lawyer with the email correspondence as it was relevant to the civil claim. The e-mail communications had been sent by the gym operator's lawyer to the data subject's lawyer. Later, the gym operator added that the data subject’s details were necessary for the contractual relationship and further that the use of this data fell under the gym operator’s legitimate interest. DSB decision The DSB held that gym operator had violated that data subject’s right to privacy by disclosing data beyond what was necessary. It found that the data subject had rejected the transfer of her personal data when signing up with the gym. The DSB determined that Article 6(1)(b) GDPR did not apply to the processing and therefore analysed the gym operator’s legitimate interest and found that the evidence would have been equally powerful if the data subject’s details had been redacted. Appeal The gym operator appealed this decision to the Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG) stating that the change in purpose for the processing was legitim