W211 2281442-1

Date of Decision June 12, 2024 Legal Provision B-VG Art. 133(4) DSG §1 GDPR Art. 2 GDPR Art. 4 GDPR Art. 6 GDPR Art. 9 B-VG Art. 133 (current version); B-VG Art. 133 effective from January 1, 2019, to May 24, 2018, last amended by BGBl. I No. 138/2017 B-VG Art. 133 effective as of January 1, 2019, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 effective from May 25,May 2018 through December 31, 2018; last amended by Federal Law Gazette I No. 22/2018; B-VG Art. 133, effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164/2013, B-VG Art. 133, effective from Jan. 1, 2014, through July 31, 2014, last amended by Federal Law Gazette I No. 51/2012 Federal Constitutional Law (B-VG) Art. 133, effective from January 1, 2004, through December 31, 2013, last amended by Federal Law Gazette I No. 100/2003 Federal Constitutional Law (B-VG) Art.

133, effective from January 1, 1975, through December 31, 2003, last amended by Federal Law Gazette No. 444/1974 Federal Constitutional Law (B-VG) Art. 133, effective from December 25, 1946, through December 31, 1974, last amended by Federal Law Gazette No. 211/1974 Federal Constitutional Law (B-VG) Art. 133, effective from December 25, 1946, through December 31, 1974, last amended by Federal Law Gazette No. 211/1974-VG Art. 133 valid from Dec. 25, 1946, through Dec. 31, 1974, last amended by Federal Law Gazette No. 211/1946 B-VG Art. 133 valid from Dec. 19,December 1945 through December 24, 1946; last amended by State Law Gazette No. 4/1945; B-VG Art. 133; in effect from January 3, 1930, through June 30, 1934 DSG Art. 1 § 1 (now DSG Art. 1 § 1), effective as of Jan. 1, 2014, last amended by Federal Law Gazette I No. 51/2012; DSG Art. 1 § 1 in effect from Jan. 1, 2000, through Dec. 31, 2013 Ruling , W211 2281442-1/10E IN THE NAME OF THE REPUBLIC!

, presiding, and lay judges Margareta MAYER-HAINZ and Dr. Ulrich E. ZELLENBERG as associate judges, has ruled on the complaint filed by XXXX, represented by XXXX, against the decision of the Data Protection Authority dated XXXX 2023, Ref. No. M, presiding, and the expert lay judges Margareta MAYER-HAINZ and Dr. Ulrich E. ZELLENBERG as lay assessors, has ruled, following an oral hearing, on the complaint filed by Roman numeral 40, represented by Roman numeral 40, against the decision of the Data Protection Authority dated Roman numeral 40, 2023, Ref. No. Roman 40, after conducting an oral hearing, rightly rules as follows: A) The complaint is dismissed as unfounded. The appeal is not admissible pursuant to article 133, paragraph 4, of the Federal Constitutional Law (B-VG). , Text Reasons for the Decision:, Reasons for the Decision: I. Course of Proceedings: Roman numeral I. Course of Proceedings: 1.

In a petition initiating proceedings dated XXXX 2023, XXXX (complainant before the Data Protection Authority and intervening party before the Federal Administrative Court, as defined in mP) argued, in summary, that she considered her right to confidentiality to have been violated by XXXX (respondent before the Data Protection Authority and complainant before the Federal Administrative Court, hereinafter “BF”) had been violated. BF was a licensed health care and nursing professional at the time of mP’s own inpatient treatment on the XXXX ward more than ten years ago. When mP began working at the same hospital on the XXXX ward in the year XXXX, BF informed the ward management that mP had been an inpatient on the XXXX ward as a teenager. This allegedly resulted in mP being bullied at work. 1. In a motion to initiate proceedings filed on Roman numeral 40 2023, Roman numeral 40 (complainant before the Data Protection Authority and intervening party before the Federal Administrative Court, hereinafter referred to as mP) stated, in summary, that she considered her right to confidentiality to have been violated by Roman numeral 40 (the respondent before the Data Protection Authority and the complainant before the Federal Administrative Court, hereinafter “BF”).

BF was a licensed nurse at the time of mP’s own inpatient treatment on Ward 40 more than ten years ago. When mP began working at the same hospital on Ward 40 in the year Roman 40, BF informed the ward management that mP had been an inpatient on Ward 40 as a teenager. This allegedly resulted in mP being bullied at work. 2. In a statement dated XXXX 2023, the BF summarized that when the mP began working at the hospital on XXXX, she had not known that the mP was a former patient. The BF could not comment on the bullying allegations because they had both been employed on different wards. She had been on duty on XXXX, while the mP had been assigned to XXXX. Both wards—XXXX and XXXX—had a shared WhatsApp group, of which the mP was also a member. BF’s daughter did not tell her until some time later—in any case, after mP had begun her employment—that mP had been in inpatient treatment during their time together in school.

However, BF kept this information to herself. It was not until days after the termination that BF informed the ward management of this during a conversation. 2. In a statement dated Roman 40, 2023, the BF summarized that when the mP began working at the hospital on Roman 40, she had not known that the mP was a former patient. The BF could not comment on the allegations of bullying because they had both been employed on different wards. She had been on duty on Ward 40, while the mP had been assigned to Ward 40. Both wards—Ward 40 and Ward 40—had a shared WhatsApp group, of which the mP was also a member. The BF’s daughter had only told her after some time—in any case, after the mP’s employment had begun—that the mP had been in inpatient treatment during their time together in school. However, the BF had kept this information to herself. It was not until days after the termination that the BF informed the ward management of this during a conversation.

3. In her statement dated XXXX 2023, submitted as part of the hearing granted to the parties, the mP argued that her own conversation with the ward management had taken place a few days after the termination. The conversation with the ward manager concluded with the ward manager stating that, had she been aware of mP’s medical history, she would not have hired her. The mP could not say when the BF had passed on the information to the ward manager. 3. In her statement dated Roman 40, 2023, submitted as part of the hearing granted to the parties, the mP stated that her own conversation with the ward manager had taken place a few days after the termination. The conversation with the ward manager concluded with the ward manager stating that, had she been aware of the mP’s medical history, she would not have hired her. The mP could not say when the BF had passed on this information to the ward manager.

4. In a decision dated XXXX 2023, the Data Protection Authority (hereinafter “DPA”) upheld mP’s complaint and determined that BF had thereby violated mP’s right to confidentiality by disclosing orally to a third party the fact that mP had been treated at the XXXX in the past. to third parties. 4. In a decision dated Roman 40, 2023, the Data Protection Authority (hereinafter “DPA”) upheld Ms. M’s complaint and determined that BF had violated Ms. M’s right to confidentiality by by verbally disclosing to third parties the fact that mP had been treated at Roman 40 in the past. In its reasoning, the DPA essentially stated that the GDPR did not apply due to the oral disclosure of the personal data; however, the fundamental right to data protection under § 1 DSG—which does not depend on a specific type of disclosure—was applicable. However, the GDPR and the principles enshrined therein must be taken into account when interpreting the right to confidentiality.

The mP’s personal data (data concerning health) would constitute sensitive data pursuant to Article 9 of the GDPR. The mP’s interest, which is particularly worthy of protection, must be taken into account. Conversely, this means that the BF must present particularly compelling reasons to justify the disclosure that took place. However, the BF did not present such particularly compelling reasons. Nor does the case file reveal any such grounds. In its reasoning, the DPA essentially stated that while the GDPR does not apply due to the oral disclosure of the personal data, the fundamental right to data protection under Section 1 of the DSG—which does not depend on a specific type of disclosure—is applicable. However, the GDPR and the principles enshrined therein must be taken into account when interpreting the right to confidentiality. The data subject’s personal data (data concerning health) would constitute sensitive data pursuant to article 9 of the GDPR.

The data subject’s interest, which is particularly worthy of protection, must be taken into account. Conversely, this means that the BF must present particularly compelling reasons to justify the disclosure that took place. However, the BF did not present such particularly compelling reasons. Nor does a corresponding reason appear from the case file. Therefore, in the present case, the balancing of interests favors the mP. 5. In a complaint filed on XXXX 2023 against this decision by the DPA, the BF essentially argued—insofar as relevant to the proceedings—that the DPA had misinterpreted the legal assessment of the facts. The information regarding the mP’s inpatient hospital stay constituted data that was already publicly available, since the mP had been in the same school class as the BF’s daughter, and the mP’s illness had been discussed with the entire class during class time. The alleged conversation with the ward management took place a few days after the mP’s termination and could not have been a decisive factor in any alleged harassment.

Since the data in question is publicly available, reference should be made to the processing basis set forth in Article 9(2)(e) of the GDPR. Furthermore, pursuant to Article 9(2)(a) in conjunction with para 3 of the cited provision, disclosure to specialized personnel bound by professional confidentiality should be considered an appropriate safeguard. Since the notice period had not yet expired at the time of the alleged data breach, the legal basis for processing under Article 9(2)(h) of the GDPR must also be taken into account. Furthermore, the mP lacks the necessary standing to be a defendant. 5. In a complaint filed on Roman 40 2023 against this decision by the DPA, the BF essentially argued—insofar as relevant to the proceedings—that the DPA had misinterpreted the legal assessment of the facts. The information regarding the mP’s inpatient hospital stay constituted data that was already publicly available, since the mP had been in the same school class as the BF’s daughter, and the mP’s illness had been discussed with the entire class during class time.

The alleged conversation with the ward manager took place a few days after mP’s termination and could not have been decisive for any bullying. Since the data in question was already publicly available, reference should be made to the processing grounds set forth in paragraph 2 of Article 9 of the GDPR. Furthermore, pursuant to article 9(2)(a) in conjunction with paragraph 3 of the cited provision, disclosure to specialized personnel bound by professional confidentiality should be considered an appropriate safeguard. Since the notice period had not yet expired at the time of the alleged data protection violation, the legal basis for processing under article 9(2)(h) of the GDPR must also be taken into account. Furthermore, the mP lacks the necessary standing to be a defendant. 6. The DPA submitted the complaint and the administrative decision, together with a statement dated XXXX 2023, to the Federal Administrative Court, moved to dismiss the complaint, and referred in full to the contested decision.

6. The DPA submitted the complaint and the administrative file, along with a statement dated Roman numeral 40 2023, to the Federal Administrative Court, moved to dismiss the complaint, and referred in full to the contested decision. 7. In a statement dated XXXX 2023, the mP further argued, insofar as relevant to the proceedings and by way of supplement, that the BF had been an important support person during her inpatient stay approximately ten years ago, that the disclosure had led to bullying, and that she had subsequently been forced to take sick leave. The disclosure took place during the notice period—that is, while the employment relationship was still in effect—and a specific diagnosis was never discussed with her classmates. Regardless of how the disclosed information was obtained, a violation of data protection is evident. 7. In a statement dated Roman 40 2023, the mP further argued, insofar as relevant to the proceedings and by way of supplement, that the BF had been an important support person during her inpatient stay approximately ten years ago, that the disclosure had led to bullying, and that she had consequently had to take sick leave.

The disclosure took place during the notice period—that is, while her employment relationship was still in effect—and a specific diagnosis was never discussed with her classmates. Regardless of whether the disclosed information was obtained, a data protection violation is evident. 8. In a letter dated XXXX 2024, the complainant requested that the ward manager and the site manager of the hospital involved be summoned and questioned for or during the scheduled oral complaint hearing. 8. In a letter dated Roman numeral 40 2024, the BF requested that the ward manager and the site manager of the hospital involved be summoned and examined for and during the scheduled oral complaint hearing. Furthermore, the issue of disclosing a specific diagnosis is not the subject of these proceedings. 9. On XXXX 2024, a public oral appeal hearing took place at the Federal Administrative Court, during which the parties were able to present their arguments and two witnesses were examined.

Insofar as it was relevant to the proceedings, the complainant argued that she had learned of the patient’s hospitalization from her own daughter. The personal data was therefore already public. Since the BF had been the deputy ward manager for two and a half years, regular discussions took place to exchange information about current events. On XXXX 2023, the BF disclosed the mP’s hospitalization to the ward management because the mP had submitted her resignation shortly before. There was no other reason for the disclosure. From a legal perspective, the BF argued that the disclosure was covered by Art. 9(2)(h) in conjunction with (3) of the GDPR, as the processing was necessary for assessing employees’ fitness for work. 9. On Roman 40, 2024, a public oral hearing on the appeal took place at the Federal Administrative Court, during which the parties were able to present their arguments and two witnesses were examined.

Insofar as it was relevant to the proceedings, the BF argued that she had learned of the mP’s hospitalization from her own daughter. The personal data was therefore already public. Since the BF had been the deputy ward manager for two and a half years, regular discussions took place to exchange information about current events. On Roman 40 2023, the BF disclosed the mP’s inpatient stay to the ward management, as the mP had submitted her resignation shortly before. There was no other reason for the disclosure. From a legal perspective, the BF argued that the disclosure was covered by article 9, paragraph 2, subparagraph h, in conjunction with paragraph 3, of the GDPR, since the processing was necessary for assessing employees’ fitness for work. The argument regarding the lack of standing to be sued was withdrawn. The mP essentially reiterated the arguments she had already submitted in writing and added that she had shared her hospital stay and the corresponding diagnosis only with her closest friends; this had not been a topic of discussion in her school class.

I. The Federal Administrative Court considered: I. The Federal Administrative Court considered: 1. 1. Approximately ten years ago, the plaintiff was hospitalized as a patient at the XXXX. The BF was working there at that time as a certified health and nursing professional (DGKP). 1. The mP was a patient receiving inpatient treatment at the Roman 40 approximately ten years ago. The BF was working there at that time as a certified health and nursing professional (DGKP). The BF’s daughter attended school with the mP. At the time, the mP told her closest friends about her inpatient stay at the hospital; however, this was not a major topic of discussion when she returned to school. The BF’s daughter visited the mP in the hospital at that time. For the class, the mP’s hospital stay was discussed once during a social studies lesson. Neither the mP nor her mother publicly disclosed a diagnosis at school.

2. After completing her nursing training, the mP was employed at XXXX in the XXXX department from October XXXX to April XXXX. Although the BF worked in a different department—XXXX—she was employed at the same hospital. Both XXXX wards had a shared WhatsApp group, of which both the BF and the mP were members. 2. After completing her nursing training, the mP was employed in Roman 40 in the Roman 40 ward from October Roman 40 to April Roman 40. Although the BF worked in a different ward—Roman 40—she was employed at the same hospital. Both wards [Roman numeral 40] had a shared WhatsApp group to which both the BF and the mP belonged. Around Christmas [year] XXXX, the BF’s daughter recognized the mP in her WhatsApp profile picture. She then pointed out to her mother—the BF—that she had gone to school with the mP. She also asked her mother if she didn’t remember that the mP had been a patient of hers undergoing treatment.

The fact that the BF shared this information with the ward manager arose naturally from the course of the conversation. At the time, the BF also wondered whether the mP’s medical history might have had something to do with her decision to resign. On the same day—that is, also on XXXX 2023, which was effectively the mP’s last day of work before her sick leave—the ward manager informed the mP that it was known at the hospital that the mP had previously been hospitalized. The ward manager wanted to prepare mP for the possibility that colleagues might bring this up with her. mP learned that it was BF who had passed this information on to the ward manager during a conversation with the site manager of XXXX. On the same day—that is, Roman numeral 40 2023, and thus effectively the mP’s last day of work before her sick leave—the ward manager informed the mP that it was known within the hospital that the mP had previously been hospitalized for inpatient treatment.

The ward manager wanted to prepare the mP for the possibility that colleagues might bring this up with her. The mP learned that it was the BF who had passed this information on to the ward manager during a conversation with the site manager of Roman numeral 40. 4. There is no obligation for employees to inform their employer of previous hospital stays. Nor does this employer have any specific measures in place as part of a general duty of care to take potential previous hospital stays into account. If applicants raise such matters on their own initiative, the Nursing Directorate might address them under certain circumstances. However, such potential prior hospital stays are not generally known within the Nursing Directorate. 2. 1. 1 regarding the applicant’s stay at XXXX over ten years ago are based primarily on the applicant’s statements made during the administrative and Court proceedings, as well as during the oral appeal hearing.

No evidence emerged during the proceedings to cast doubt on these statements. 1. 1 regarding the mP’s stay at Roman 40 over ten years ago are based primarily on the mP’s statements made during the administrative and Court proceedings, as well as during the oral appeal hearing. No evidence emerged during the proceedings to cast doubt on this information. 1 regarding the fact that the mP attended school with the BF’s daughter is based on the consistent statements made by the mP and the BF in this regard, most recently during the oral hearing before the BVwG. The findings regarding the extent to which mP’s hospitalization was discussed and known within the school community at that time are based on the verifiable and credible statements made by mP and BF on this matter during the proceedings and, in particular, during the oral hearing. The statements made by the mP and the BF on this matter can be accepted in parallel, since, although they may have different understandings of “public” and “making public,” their submissions on this point do not ultimately contradict one another: it is understandable that the mP spoke with her closest friends about her hospital stay, but that this was no longer a major topic of discussion after her return to school.

Similarly, the BF’s argument can be accepted to the effect that, during the mP’s hospital stay, her stay at XXXX was discussed in a social studies class—which the mP did not necessarily have to know, since she was not present at the time. The fact that neither the mP nor her mother disclosed a diagnosis at school is understandable and is not in doubt; the BF also did not present any evidence suggesting that this claim by the mP was incorrect. The findings regarding the extent to which the mP’s hospital stay was discussed and known within the school environment at that time are based on the verifiable and credible statements made by the mP and the BF in this regard during the proceedings and, in particular, during the oral hearing. The statements made by the plaintiff and the defendant on this matter can be accepted in parallel, since, although they may have different understandings of “public” and “making public,” they do not ultimately contradict each other in the context of their respective arguments: it is understandable that the mP spoke with her closest friends about her hospital stay, but that this was no longer a major topic of discussion after her return to school.

Similarly, the BF’s argument can be accepted to the effect that, during the mP’s stay in the hospital, her stay was discussed in a social studies class—which the mP did not necessarily have to know, since she was not present at the time. The fact that neither the mP nor her mother disclosed a diagnosis at school is understandable and is not disputed; the BF also did not present any evidence suggesting that this claim by the mP was incorrect. 2. 2 above regarding the mP’s activities at the hospital, the division of the mP and the BF between wards XXXX, and the WhatsApp group are based on the consistent statements made by the mP and the BF in this regard during the proceedings, including at the oral hearing. No grounds for doubting the accuracy of these statements emerged during the proceedings. 2. 2 above regarding the mP’s activities at the hospital, the division of the mP and the BF among wards Roman 40, and the WhatsApp group are based on the consistent statements made by the mP and the BF in this regard during the proceedings, including during the oral hearing.

The finding regarding the ward manager’s motivation for broaching this subject with the mP is based on the credible and verifiable statements made by the ward manager as a witness during the grievance hearing. The fact that the ward manager spoke with the mP on the same day about her stay at “Römisch 40” more than ten years ago was stated consistently and plausibly by both the mP and the ward manager as a witness; therefore, a finding could be made on this point. The finding regarding the ward manager’s motivation for bringing this up with the mP is based on the credible and plausible statements made by the ward manager as a witness during the grievance hearing. The mP presents a coherent and plausible account of how, during a conversation with the facility director, she learned who had informed the ward manager about her stay at Roman 40. 4. The findings regarding whether employees have a duty to inform XXXX about previous hospital stays, whether there are specific measures within the scope of a duty of care that require consideration in such a case—such that, in the event of such a disclosure by an applicant,such information may, under certain circumstances, be taken into account, and that the nursing administration is generally unaware of such information—are based on credible statements in this regard, in particular from the ward manager as a witness and the site manager as a witness.

The adjudicating Senate has no doubt that the accuracy of the statements made by the witness is confirmed. 4. The findings regarding whether employees have a duty to disclose information to Roman 40 concerning previous hospital stays, whether there are measures within the scope of a duty of care that would allow for such information to be taken into account in such a case—should an applicant disclose it—such information may, under certain circumstances, be taken into account, and that the nursing administration is generally not aware of such information, are based on the credible statements in this regard, in particular those of the ward manager as a witness and the site manager as a witness. The adjudicating Senate has no doubt that the accuracy of the statements made by the witness is confirmed. 3. 1. Legal Basis: Art. 2 GDPR: Material Scope of ApplicationArticle 2, GDPR: Material Scope of Application (1) This Regulation applies to the processing of personal data, whether fully or partially automated, as well as to the non-automated processing of personal data that is stored or is intended to be stored in a filing system.

(2) This Regulation does not apply to the processing of personal data a) in the course of an activity that does not fall within the scope of Union law, (b) by Member States in the course of activities falling within the scope of Title V, Chapter 2 of the TEU, (b) by Member States in the course of activities falling within the scope of Title V, Chapter 2 of the TEU, (c) by natural persons in the course of purely personal or family activities, (d) by competent authorities for the purpose of the prevention, investigation, detection, or prosecution of criminal offenses or the execution of criminal penalties, including the protection against and prevention of threats to public security. (…) Art. 4: Definitions: Article 4: Definitions: For the purposes of this Regulation, the following terms shall have the meanings set forth below: 1. “personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person; (…) 15.

“Data concerning health” means personal data relating to the physical or mental health of a natural person, including the provision of health care services, and from which information regarding the data subject’s health status can be derived; (…) Article 6: Lawfulness of Processing (1) Processing is lawful only if at least one of the following conditions is met: a) The data subject has given consent to the processing of personal data concerning him or her for one or more specific purposes; b) the processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request; c) the processing is necessary for compliance with a legal obligation to which the controller is subject; d) The processing is necessary to protect the vital interests of the data subject or of another natural person; e) The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f) the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Subparagraph 1(f) does not apply to processing carried out by public authorities in the performance of their duties. (…) Article 9: Processing of Special Categories of Personal Data (1) The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation, is prohibited. (2) Paragraph 1 does not apply in the following cases: (a) The data subject has explicitly consented to the processing of the aforementioned personal data for one or more specified purposes, unless, under Union law or the law of the Member States, the prohibition set forth in paragraph 1 cannot be lifted by the data subject’s consent; b) the processing is necessary for the controller or the data subject to exercise their rights or fulfill their obligations arising from labor law and social security and social protection law, to the extent that this is permitted under Union law or the law of the Member States, or under a collective agreement governed by the law of the Member States that provides appropriate safeguards for the fundamental rights and interests of the data subject, (c) the processing is necessary to protect the vital interests of the data subject or of another natural person, and the data subject is physically or legally incapable of giving consent; d) the processing is carried out on the basis of appropriate safeguards by a non-profit foundation, NGO, or other organization with political, ideological, religious, or trade union objectives, within the scope of its lawful activities and provided that that the processing relates exclusively to members or former members of the organization, or to persons who maintain regular contact with it in connection with its purposes, and that the personal data is not disclosed to third parties without the consent of the data subjects, e) the processing relates to personal data that the data subject has manifestly made public, f) the processing is necessary for the establishment, exercise, or defense of legal claims or in the context of judicial proceedings conducted by Courts in the exercise of their judicial functions, g) the processing is necessary for reasons of substantial public interest on the basis of Union law or the law of a Member State, which is proportionate to the objective pursued, respects the essence of the right to data protection, and provides for appropriate and specific measures to safeguard the fundamental rights and interests of the data subject, h) the processing is necessary for the purposes of preventive healthcare or occupational medicine, for the assessment of an employee’s fitness for work, for medical diagnosis, care or treatment in the health or social care sector, or for the administration of health or social care systems and services, on the basis of Union law or the law of a Member State, or pursuant to a contract with a health professional, and subject to the conditions and safeguards referred to in paragraph 3; i) the processing is necessary for reasons of public interest in the area of public health, such as protection against serious cross-border threats to health or to ensure high standards of quality and safety in healthcare and with regard to medicinal products and medical devices, is necessary on the basis of Union law or the law of a Member State that provides for appropriate and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy; or (j) the processing is based on Union law or the law of a Member State that is proportionate to the objective pursued, respects the essence of the right to data protection, and provides for appropriate and specific measures to safeguard the fundamental rights and interests of the data subject, is necessary for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with article 89 paragraph 1.

(3) The personal data referred to in paragraph 1 may be processed for the purposes set forth in paragraph 2(h) if such data are processed by or under the responsibility of qualified personnel who are subject to a duty of professional secrecy under Union law, the law of a Member State, or the regulations of competent national authorities, or if the processing is carried out by another person who is also subject to a duty of confidentiality under Union law, the law of a Member State, or the rules of national competent authorities. (4) Member States may introduce or maintain additional conditions, including restrictions, insofar as the processing of genetic, biometric, or data concerning health is concerned. Section 1 DSG: Fundamental Right to Data Protection; Paragraph 1, DSG: Fundamental Right to Data Protection (1) Everyone has the right, in particular with regard to respect for their private and family life, to the confidentiality of personal data concerning them, provided there is a legitimate interest in such confidentiality.

The existence of such an interest is excluded if data are not subject to a right to confidentiality due to their general availability or because they cannot be traced back to the data subject. (2) To the extent that the use of personal data is not in the vital interest of the data subject or does not occur with the data subject’s consent, restrictions on the right to confidentiality are permissible only to safeguard the overriding legitimate interests of another party, and, in the case of interventions by a government authority, only on the basis of laws derived from the provisions of Art. 8, para. 2 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210/1958. Such laws may provide for the use of data that, by its Art, is particularly worthy of protection only to safeguard important public interests and must, at the same time, establish appropriate safeguards for the protection of the data subjects’ privacy interests.

Even in the case of permissible restrictions, the interference with the fundamental right must in each instance be carried out in the least intrusive manner necessary to achieve the objective. […](2) To the extent that the use of personal data is not in the vital interest of the data subject or does not occur with the data subject’s consent, restrictions on the right to privacy are permissible only to safeguard the overriding legitimate interests of another; in the case of interventions by a state authority, such restrictions may be imposed only on the basis of laws that are necessary for the reasons set forth in article 8, paragraph 2, of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210 of 1958. Such laws may provide for the use of data that, by its Art, is particularly worthy of protection only to safeguard important public interests and must, at the same time, establish appropriate safeguards for the protection of the privacy interests of the individuals concerned.

Even in the case of permissible restrictions, the interference with the fundamental right must, in each instance, be carried out only in the least intrusive Art necessary to achieve the objective. […] In her complaint dated XXXX 2023, BF asserted that the DPA had made an incorrect legal assessment, arguing that the information disclosed to the ward manager consisted of data that was already publicly available and, furthermore, that a legal basis for processing could be found in Art. 9(2)(a), (e), or (h) of the GDPR. This argument in the complaint cannot be upheld for the following reasons:In her complaint dated Roman numeral 40 2023, BF alleged that the DPA had made an incorrect legal assessment, arguing that the information disclosed to the station manager consisted of data that was already publicly available, and, furthermore, that a legal basis for processing could be found in Article 9(2)(a), (e), or (h) of the GDPR.

This argument in the complaint cannot be upheld for the following reasons: It should be noted at the outset that the DPA correctly assumed that the material scope of application of the GDPR pursuant to Art. 2 GDPR is not met, as this involves the oral disclosure of personal data within the meaning of Art. 4(1) GDPR (see Heißl in Knyrim, GDPR Art. 2, margin note 55 (as of Dec. at); Thiele/Wagner, Practical Commentary on the Data Protection Act (DSG)2 § 1, margin note 13 (as of Feb. at)). The data subject was clearly identified by the disclosure of the fact of her inpatient stay at XXXX in conjunction with the mention of her specific name. Therefore, the facts of the case must be examined in light of the standard set forth in § 1 DSG. Furthermore, the personal data regarding the inpatient stay constitutes health data within the meaning of Art. 4(15) GDPR, as the CJEU adopts a broad interpretation in this context, such that all information relating to a person’s health in all aspects (both physical and mental) (see Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Art.

9 GDPR para. at); CJEU Nov. 6, 2003, C-101/01, Lindqvist). It should be noted at the outset that the DPA correctly assumed that the material scope of application of the GDPR pursuant to article 2, GDPR, since this involves the oral disclosure of personal data within the meaning of Article 4(1) of the GDPR; see Heißl in Knyrim, DatKomm Article 2, GDPR, Marginal Note 55 (as of Dec. at); Thiele/Wagner, Practical Commentary on the Data Protection Act (DSG) 2, Section 1, Marginal Note 13 (as of Feb. at)). The complainant was clearly identified by the disclosure of the fact of her inpatient stay at Römische 40 in conjunction with the mention of her specific name. Therefore, the facts of the case must be examined based on the standard set forth in Section 1 of the DSG. Furthermore, the personal data regarding the inpatient stay constitutes health data within the meaning of article 4(15) of GDPR, as the CJEU adopts a broad interpretation in this context, such that all information relating to a person’s health in all aspects (both physical and mental) is covered; see Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm article 9, GDPR, para.

at); CJEU, Nov. 6, 2003, C-101/01, Lindqvist). 1. The general availability of data within the meaning of § 1(1), para 2, of the DSG expressly precludes any violation of a legitimate interest in confidentiality on the part of data subjects. 1. General availability of data within the meaning of Section 1, paragraph 1, sentence 2 of the DSG expressly precludes the infringement of a legitimate interest in confidentiality on the part of data subjects. The data subject is thus precluded from asserting a confidentiality interest if data is generally available, although the DSG does not define this attribute in further detail. 419/0007-DSK/2009), because a limited number of individuals with access to confidential information does not constitute a public audience that would justify the “general” availability of data. All types of public records and registers, such as the commercial register, the land register, or the telephone directory, meet these criteria.

It makes no difference whether these are maintained by government agencies or a private party, or who is responsible for their publication (see Ennöckl in Kahl/Khakzadeh/Schmid, Commentary on Federal Constitutional Law B-VG and Fundamental Rights, Art. 1 DSG, Marginal Note 17 (as of Jan. at)). The data subject is thus precluded from asserting an interest in confidentiality if the data is generally available, although the DSG does not define this attribute in further detail. 419/0007-DSK/2009), because a limited number of persons with access to confidential information does not constitute a public audience that would justify the “general” availability of data. All types of public records and registers—such as the commercial register, the land register, or the telephone directory—meet these criteria. It makes no difference whether these are maintained by government agencies or a private individual, nor who is responsible for the publication—see Ennöckl in Kahl/Khakzadeh/Schmid, Commentary on Federal Constitutional Law (B-VG) and Fundamental Rights, Article 1, DSG Margin Note 17 (as of Jan.

at)). Accordingly, however, the disclosure of the mP’s residential address by the mP to her closest friends does not meet the requirements for general availability within the meaning of § 1(1), second sentence, of the DSG. There is only a limited number of so-called “trustees of the information” (friends) in this case, meaning that the information is by no means open to or was open to a group of users not individually identified. In the absence of disclosure to the public, the exception regarding general availability therefore does not apply. , the group of classmates), the criterion of access is not broadened in a way that would allow any person to access this information (unlike, for example, and under certain circumstances, if the information were published on a social network). Accordingly, however, mP’s disclosure of her inpatient stay to her closest friends does not meet the requirements for general availability within the meaning of Section 1, Paragraph 1, Sentence 2 of the DSG.

There is only a limited number of so-called “trustees of confidential information” (friends) in this case, meaning that the information is by no means open to or was open to a group of users that is not individually specified. In the absence of disclosure to the public, the exception regarding general availability therefore does not apply. , the group of classmates), the criterion of access is not broadened in a way that would allow any person to access this information (unlike, for example, and under certain circumstances, if the information were published on a social network). It follows that the particularly sensitive data regarding mP’s hospital stay is covered and protected by the fundamental right to data protection pursuant to Para 1 of the Data Protection Act (DSG). It follows that the particularly sensitive information regarding the mP’s hospital stay is covered and protected by the fundamental right to data protection pursuant to Section 1, paragraph 1, of the DSG.

Consequently, the BF’s arguments justifying the infringement of fundamental rights within the meaning of § 1 para. Consequently, the BF’s arguments justifying the infringement of fundamental rights within the meaning of paragraph 1(2) of the DSG must be examined. 2. An alleged violation of the right to confidentiality by a private individual must be examined in accordance with para 1 of Section 1 of the DSG. In this context, restrictions on this right may arise from para 2 of the aforementioned provision, but not (directly) from Article 6(1) (or Article 9(2)) of the GDPR. However, the GDPR—and in particular the principles enshrined therein—must in any case be taken into account when interpreting the right to confidentiality. The processing of such data also requires appropriate justification within the meaning of § 1(2) of the DSG or Art. 6(1) or Art. 9(2) of the GDPR (see Thiele/Wagner, Practical Commentary on the Data Protection Act (DSG)2 § 1, margin note 39, 236 (as of Feb.

at)). 2. A case involving an alleged violation of the right to confidentiality by a private individual must be reviewed in accordance with Section 1, paragraph 1, of the DSG. In this context, limitations on this claim may arise from paragraph 2, leg. , but not (directly) from article 6, paragraph 1, (or article 9, paragraph 2,) of the GDPR. However, the GDPR—and in particular the principles enshrined therein—must in any case be taken into account when interpreting the right to confidentiality. at)). Article 9(2)(e) GDPR: Article 9, paragraph 2, subparagraph (e), GDPR: Article 9(2)(e) permits the processing of sensitive personal data (concerning the data subject) if the data subject has manifestly made such data public (either personally or through a third party authorized to do so, such as a press spokesperson). , data freely accessible on the Internet or disseminated through the media (see Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Art.

9 GDPR, paras. at)). As already explained above regarding the scope of protection under § 1(1) of the DSG, there is no published or generally accessible sensitive data concerning the data subject in the present case. Article 9(2)(e) permits the processing of sensitive personal data (concerning the data subject) if the data subject has manifestly made such data public (either personally or through an authorized third party, such as a press spokesperson). at)). As already explained above regarding the scope of protection under Section 1, paragraph 1, of the DSG, there is no published or generally accessible sensitive data pertaining to the data subject in the present case. The disclosure made by the Federal Court is therefore not justified under article 9, paragraph 2, subparagraph e, of the GDPR. Art. 9(2)(a) in conjunction with (3) of the GDPR: Article 9, paragraph 2, subparagraph (a), in conjunction with paragraph 3, of the GDPR: Insofar as the complaint dated XXXX 2023 cites the legal basis for processing under Article 9(2)(a) of the GDPR in conjunction with para 3 thereof as the legal basis for processing, it should be noted that this first ground for admissibility (Art.

9(2)(a) GDPR) addresses consent to the processing of (sensitive) personal data for one or more specified purposes. However, consent under Article 9(2)(a) of the GDPR must be given explicitly, thereby precluding implied consent. The term “explicitly” refers here to the manner in which the data subject’s consent is expressed (see Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Art. 9 GDPR para. at)). It did not emerge during the entire proceedings that the data subject had given such explicit consent to the data processing at issue. Consequently, this legal basis cannot be invoked to establish the lawfulness of the processing. Insofar as the complaint dated Roman 40 2023 cites Article 9(2)(a) of the GDPR in conjunction with paragraph 3, leg. , GDPR as a justification for the processing, it should be noted that this first ground for admissibility (Article 9(2)(a) of the GDPR) addresses consent to the processing of (sensitive) personal data for one or more specified purposes.

However, consent under Article 9(2)(a) of the GDPR must be given explicitly, thereby precluding implied consent. at)). It did not emerge during the entire proceedings that the data subject had given such explicit consent to the data processing at issue. Accordingly, this legal basis cannot be invoked to establish the lawfulness of the processing. Art. 9(2)(h) in conjunction with Art. 9(3) of the GDPR: Article 9(2)(h) of the GDPR ensures the necessary processing of sensitive data, in particular data concerning health as defined in Article 4(15) of the GDPR, for the purposes of preventive healthcare, occupational medicine, assessing an employee’s ability to work, medical diagnosis, care or treatment in the health or social sectors, and the administration of systems and services in the health or social sectors. This is intended to cover all health-related services, regardless of whether they are preventive, diagnostic, curative, or follow-up in nature.

Whereas the predecessor provision, Article 8(3) of the Data Protection Directive, contained a uniform rule, Article 9(3) of the GDPR must now be read in conjunction with Article 9(2)(h), which cross-reference each other. Accordingly, the processing of special categories of personal data for the purposes listed in Article 9(2)(h) is permitted only if the processing is carried out by qualified professionals or under their supervision, and the qualified professionals are subject to professional secrecy (“professionals bound by professional secrecy”). , § 6 GuKG (see Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Art. 9 GDPR Marg. No. at)). Article 9(2)(h) of the GDPR ensures the necessary processing of sensitive data, in particular data concerning health within the meaning of Article 4(15) GDPR for the purposes of preventive healthcare, occupational medicine, the assessment of an employee’s ability to work, medical diagnosis, care or treatment in the health or social care sector, and the management of systems and services in the health or social care sector.

This is intended to cover all health-related services, regardless of whether they are preventive, diagnostic, curative, or follow-up in nature. Whereas the predecessor provision, Article 8(3) of the Data Protection Directive, still contained a uniform regulation, article 9(3) of the GDPR must now be read in conjunction with article 9(2)(h), which refer to one another. Accordingly, the processing of special categories of personal data for the purposes listed in Article 9(2)(h) is permitted only if the processing is carried out by qualified personnel or under their supervision, and the qualified personnel are subject to a duty of professional confidentiality (“professionals bound by professional confidentiality”). , Section 6 of the GuKG; see Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm article 9, GDPR paras. at)). A balancing of interests must take place in this regard, within which two cumulative conditions must be met for this legal basis to apply, namely necessity (on the one hand, the processing must be necessary to safeguard the legitimate interests of the controller or a third party) and proportionality (on the other hand, the fundamental rights and freedoms of the data subject that require the protection of personal data must not override these interests) (see Thiele/Wagner, Practical Commentary on the Data Protection Act (DSG)2 § 1, margin note 43 (as of Feb.

at). at). In its complaint dated XXXX 2023 and during the oral hearing on XXXX 2024, BF argued, citing Art. In her complaint dated Roman 40 2023 and during the oral hearing on Roman 40 2024, the BF argued, citing article 9, paragraph 2, subparagraph h, in conjunction with paragraph 3, GDPR, that the disclosure of the mP’s inpatient hospital stay served the purpose of assessing the employees’ ability to work, since the employment relationship with the mP was still in effect until the end of Roman numeral 40 2023, the mP had terminated it unexpectedly, and that the BF and the ward manager were subject to the duty of confidentiality pursuant to Section 6 of the GuKG. In this context, it should be noted that the employees’ ability to work and their health care may constitute a legitimate interest within the meaning of Section 1(2) of the DSG. In this context, it should be noted that employees’ ability to work and their health care may constitute a legitimate interest within the meaning of paragraph 1(2) of the DSG.

However, the disclosure must also be necessary to safeguard the legitimate interests of the controller or a third party, and must not override the fundamental rights and freedoms of the employee that require the protection of personal data. In the present case, however, the disclosure of the employee’s health data by the BF to the ward manager was not necessary: It follows from the findings that the employer in question has not provided for any special measures to take into account an employee’s inpatient hospital stay at XXXX that occurred approximately ten years ago. Furthermore, the employee was under no obligation to disclose her inpatient hospital stay to her employer at the time. 3, the BF disclosed this information to the ward manager during a conversation about events on the ward while the BF was on leave and regarding the mP’s termination. However, the proceedings did not reveal that this should have led, for example, to specific measures to accommodate this fact in mP’s daily work on her ward at XXXX during the notice period, or that there had been any concern regarding patient care.

In the present case, however, the BF’s disclosure of the mP’s health information to the ward manager was not necessary: It follows from the findings that the employer in question does not have any specific measures in place to accommodate an employee’s inpatient hospital stay—which occurred approximately ten years ago—on Ward 40. Furthermore, the employee was under no obligation to disclose her inpatient hospital stay to her employer at the time. 3, the BF disclosed this information to the ward manager during a conversation about events on the ward while the BF was on leave and regarding the mP’s termination. However, it did not emerge during the proceedings that this disclosure should have led, for example, to specific measures to take this fact into account in mP’s day-to-day work on her ward at Roman 40 during the notice period, or that there had been any concern regarding patient care.

Therefore, in the present case, the requirement that the disclosure by the BF be necessary is lacking for the admissibility criteria of Article 9(2)(h) in conjunction with para 3 of the GDPR to apply. Consequently, in the present case, the requirement that the disclosure by the BF be necessary is lacking for the application of the grounds for permissibility under Article 9(2)(h) in conjunction with paragraph 3 of the GDPR. It must not be overlooked here that sensitive data—such as health data in the present case—is subject to a particularly high level of protection, which, in this specific case, precludes even a balance of interests between BF and mP. At the time of disclosure on XXXX 2023, the mP had already given notice of termination and had less than XXXX months of remaining employment. It must not be overlooked here that sensitive data—such as health data in the present case—is subject to a particularly high level of protection, which, in this specific case, precludes even a balance between the interests of the BF and those of the mP.

At the time of disclosure on Roman numeral 40 2023, the employee had already given notice and had less than Roman numeral 40 months of remaining employment. Given this short period of time, the mP’s interest in the confidentiality of her data concerning health must, in any event, be regarded as prevailing over the interests of the BF and her employer. The adjudicating Senate sees no further grounds for justification under Article 9(2) of the GDPR to establish that the legitimate interests of third parties prevail within the meaning of paragraph 1(2) of the DSG. Consequently, the DPA is correct in finding that the BF violated the mP’s right to confidentiality under § 1 DSG by verbally disclosing the fact that the mP had been hospitalized at XXXX in the past. Consequently, the DPA is correct in finding that the BF violated the mP’s right to confidentiality under Section 1 of the DSG by verbally disclosing the fact that the mP had previously been hospitalized at Roman 40.