Court case W137 2292450-1/4E – Court Ruling (Austria, 2024)

The data subject filed a complaint against a gym operator with the Austrian DPA (Datenschutzbehörde – DSB) alleging that the gym operator had unlawfully disclosed her personal data. When the data subject signed-up to the gym membership, she had ticked a box which meant that she did not consent to the further processing of her data. Civil dispute The data subject had brought a civil claim against the gym operator as it alleged that the controller had increased the membership fees without the members agreement. In the course of the court proceedings email communication between the data subject and the gym operator were used as evidence. Through providing the email communication as evidence, the data subject alleged that the gym operator had unlawfully disclosed the name, e-mail address and the fact that the data subject had a gym membership. The gym operator argued that they had merely provided the data subject’s lawyer with the email correspondence as it was relevant to the civil claim. The e-mail communications had been sent by the gym operator's lawyer to the data subject's lawyer. Later, the gym operator added that the data subject’s details were necessary for the contractual relationship and further that the use of this data fell under the gym operator’s legitimate interest. DSB decision The DSB held that gym operator had violated that data subject’s right to privacy by disclosing data beyond what was necessary. It found that the data subject had rejected the transfer of her personal data when signing up with the gym. The DSB determined that Article 6(1)(b) GDPR did not apply to the processing and therefore analysed the gym operator’s legitimate interest and found that the evidence would have been equally powerful if the data subject’s details had been redacted. Appeal The gym operator appealed this decision to the Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG) stating that the change in purpose for the processing was legitimised through the fact that in this civil proceeding, redacted documents would prove insufficient as evidence. The gym operator explained that it had to prove, in court, that individual negotiations were carried out which meant that the personal details had to be disclosed. The gym operator therefore requested the BVwG to annul the decision of the DSB. The DSB requested for the claim of the gym operator to be rejected. The BVwG highlighted that the gym operator’s lawyer and not the gym operator himself had disclosed the personal data. It assessed that the DSB had erred in its decision, which stated that the gym operator had disclosed the personal data. The BVwG held that the gym operator’s lawyer was the true controller as per Article 4(7) GDPR in this case and that the data subject had therefore filed the complaint against the wrong person. Paragraph 24(2) of the Austrian Data Protection Act ([https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&tid=121166093 §24 Abs 2 Datenschutzgesetz - DSG]) provides that the person bringing a complaint must identify the controller as far as this is reasonably clear. The data subject had been informed by their lawyer that the gym operator had supplied the email communication. It could not have been expected of the data subject to deduct from the stamp of the lawyer’s law firm that the lawyer was the true controller. The BVwG therefore ordered the DSB to reevaluate its decision. The BVwG lastly added that the data subject’s refusal of data processing had only been related to marketing purposes and therefore could not pose any opposition to the processing in court.