DSB (Austria) - 2021-0.518.795

Summary

The Austrian Data Protection Authority (DSB) imposed a €600 fine on an individual for unlawfully disclosing another person's medical data to their employer. The disclosure was deemed unlawful as there was no legal basis under GDPR, particularly Article 9(2)(f), to share the health data for the establishment or defense of legal claims, as the claim was time-barred and no further action had been taken.

Full text

Help DSB (Austria) - 2021-0.518.795: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 10:13, 10 March 2022 view sourceHha (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators839 edits← Older edit Latest revision as of 09:44, 25 July 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators100 editsTag: Visual edit Line 50: Line 50: |GDPR_Article_Link_13=Article 83 GDPR#5a|GDPR_Article_Link_13=Article 83 GDPR#5a |EU_Law_Name_1=Art 7 CFR|EU_Law_Name_1=Article 7 CFR |EU_Law_Link_1=https://fra.europa.eu/en/eu-charter/article/7-respect-private-and-family-life|EU_Law_Link_1=https://fra.europa.eu/en/eu-charter/article/7-respect-private-and-family-life Latest revision as of 09:44, 25 July 2026 DSB (Austria) - 2021-0.518.795 Authority: DSB (Austria) Jurisdiction: Austria Relevant Law: Article 4(2) GDPR Article 4(7) GDPR Article 4(10) GDPR Article 4(15) GDPR Article 5(1)(f) GDPR Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 9(1) GDPR Article 9(2) GDPR Article 9(2)(f) GDPR Article 83(1) GDPR Article 83(2)(b) GDPR Article 83(5)(a) GDPR Article 7 CFR§ 1489 General Civil Code (Allgemeines Bürgerliches Gesetzbuch - ABGB) Type: Other Outcome: n/a Started: Decided: 05.08.2021 Published: 20.12.2021 Fine: 600 EUR Parties: unnkown individual (controller and perpetrator) National Case Number/Name: 2021-0.518.795 European Case Law Identifier: ECLI:AT:DSB:2021:2021.0.518.795 Appeal: Unknown Original Language(s): German Original Source: Rechtsinformationssystem des Bundes (RIS) (in DE) Initial Contributor: n/a The Austrian DPA imposed a fine of €600 on an individual for unlawfully disclosing the medical data of a data subject to the latter's employer. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts Person A is employed at a municipality and has been on sick leave for several weeks in 2013 and 2014. In September 2014, the municipality concluded that Person A's sickness had been caused by another individual (Person B) who was then asked for damages. In another proceeding between Person A and Person B, the latter obtained a medical assessment concerning Person A's state of health. According to Person B's view, this document would have proved the municipality's claim wrong. The document was therefore shared with the municipality (even though no further steps had been taken following the initial claim). For this reasons, Person B is considered controller of Person A's personal data. Holding The DPA held that there was no legal basis under Article 9(2) GDPR for sending the medical assessment, which contained health data under Article 14 GDPR#15Article 4(15) GDPR, to the municipality. In particular, the controller could not invoke Article 9(2)(f) GDPR ("necessary for the establishment, exercise or defence of legal claims") because i) the municipality had taken no further steps to claim damages from the controller since September 2014 and ii) the claim had already been time-barred under § 1489 General Civil Code (Allgemeines Bürgerliches Gesetzbuch - ABGB) since more than three years had passed since the event that allegedly caused the damage (harming behaviour towards the data subject). Consequently, the DPA held that the disclosure of the data subject's health data were not necessary "for the establishment, exercise or defence of legal claims". To lawfully disclose the data, the data subject's explicit consent would have been required. When deciding on the amount of the administrative fine, the DSB took into account the sensitive nature of the data and wilful conduct of the controller but also the controller's low income and the fact that the controller collaborated with the DSB in the course of the procedure. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Decisive authority Data protection authority Decision date 08/05/2021 Business number 2021-0.518.795 Appeal at the BVwG / VwGH / VfGH This penalty decision is final. text GZ: 2021-0.518.795 of August 5, 2021 (case number: DSB-D550.214) [Note processor: names and companies, legal forms and product names, addresses (incl. URLs, IP and e-mail addresses), file numbers (and the like), etc., as well as their initials and abbreviations can be abbreviated and / or changed for reasons of pseudonymisation being. Obvious spelling, grammar, and punctuation errors have been corrected.] Penalty judgment Accused: Martin N ***, born on: 13.06.19 **, S *** straße 2 *, 1 *** W *** As the person responsible within the meaning of Art. 4 No. 7 of Regulation (EU) 2016/679 on the protection of natural persons when processing personal data, on the free movement of data and on the repeal of Directive 95/46 / EC (General Data Protection Regulation, hereinafter : "GDPR"), OJ No. L 119 of 04.05.2016 p. 1, the following facts have been realized and the following administrative offense (s) have been committed as a result: They have - on June **, 2019, 1 *: 11 a.m. (time of the offense) - using an appropriate terminal a message by email from the email address you used (martinn*@*mail.at) to the email address of the municipality of S *** (post@gemeinde.s***abteilung***.at) , transmitted with the following content: "To the department *** Since Ms. Susanne F *** works as a kindergarten teacher for you and said on the TV show ***, she is * 0% disabled because her neighbor is harassing her. But the court opinion says something different (see appendix). Please send a read receipt. Kind regards" As part of the above-mentioned e-mail message, you have a document attached (Statement by Rudolf L ***, * Dr., Dated **. 04.2014), which you will receive as part of civil proceedings before the Regional Court *** regarding the number * 3 Cg * 34 / 13r as a party to the proceedings, this document containing health-related data in relation to Ms. Susanne F ***. You have therefore processed health-related data by sending the email message including attachments, contrary to the prohibition in Art. 9 GDPR and disclosed the personal data concerned to several people who are attributable to Ms. Susanne F *** as the employer. As a result, you have violated the following principles of the GDPR:  Principle of processing personal data in a lawful manner, in good faith and in a manner that is understandable for the data subject ("lawfulness, processing in good faith, transparency") Administrative offense (s) after: Article 5 (1) (a), Article 9 (1) and (2) in conjunction with Article 83 (1) and (5) (a) GDPR, OJ L 2016/119, 1 as amended L 2016/314 , 72 and L 2018/127, 2 The following penalty is imposed for these administrative offense (s): Fine of euros if this is irrecoverable, a substitute imprisonment of According to € 600.00 36 hours Art 83 (5) lit. Furthermore, according to § 64 of the Administrative Penal Act 1991 - VStG, you have to pay: 60.00 Euros as a contribution to the costs of the criminal proceedings, that is 10% of the penalty, but at least 10 euros; Euros to replace cash expenses for The total amount to be paid (penalty / costs / cash outlays) is therefore 660.00 Euro Payment term: If no complaint is made, this penalty decision is immediately enforceable. In this case, the total amount is to be paid into the account BAWAG P.S.K., Georg-Coch-Platz 2, 1018 Vienna, IBAN: AT460100000005490031, BIC: BAWAATWW, according to the data protection authority, within two weeks after it becomes legally binding. The transaction number and the completion date should be given as the intended purpose. If no payment is made within this period, the total amount can be dunned. In this case, a flat fee of five euros has to be paid. If

Entities