Austrian Court Rules Unredacted Personal Data in Government Legal Decisions Violates Privacy Law
An Austrian court found that publishing unredacted personal data — including a police officer's workplace, teaching role, and health information — in official legal decisions on a government website violated privacy law. The root cause was a failure to apply data minimisation principles before publishing sensitive documents publicly, meaning no redaction review process was in place. This matters because even lawful government transparency activities must be balanced against individuals' rights to privacy, particularly when sensitive categories of data (such as health information) are involved. Organisations handling public-facing document publication must treat redaction as a mandatory procedural step, not an afterthought, especially when GDPR obligations apply.
Tactical Insight
Immediate actions
- Audit all publicly accessible legal or administrative documents to identify unredacted personal or sensitive data and apply retroactive redaction where required.
- Establish an emergency review process to temporarily restrict access to documents flagged as potentially non-compliant while full review is conducted.
Policy & process improvements
- Implement a mandatory pre-publication redaction workflow requiring a privacy review sign-off before any legal decision or government document is published online.
- Define clear data minimisation criteria specifying which personal data elements are strictly necessary for legal transparency versus what must be redacted.
- Train all staff involved in document publication on GDPR obligations, particularly regarding special category data such as health information.
Long-term governance measures
- Integrate automated redaction tooling or AI-assisted PII detection into the document publishing pipeline to reduce human error.
- Conduct regular Data Protection Impact Assessments (DPIAs) for all public-facing document publication systems and processes.
- Appoint or empower the Data Protection Officer (DPO) to perform periodic compliance audits on government publication platforms.