The data subject did not pay for items ordered and collected from a pharmacy (controller)

Date of Decision August 3, 2026 Legal Provisions B-VG Art. 133, para. 4 DSG §1, para. 1 DSG §24, para. 1 DSG §24, para. 5 GDPR Art. 4, subpara. 1 GDPR Art. 4, subpara. 2 GDPR Art. 4, subpara. 7 GDPR Art. 5 GDPR Art. 6(1) VwGVG §28(2) B-VG Art. 133 (current version), effective from January 1, 2019, through May 24, 2018, last amended by BGBl. I No. 138/2017 B-VG Art. 133 effective as of January 1, 2019, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 effective from May 25,May 2018 through December 31, 2018; last amended by Federal Law Gazette I No. 22/2018; B-VG Art. 133, effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164/2013, B-VG Art. 133, effective from Jan. 1, 2014, through July 31, 2014, last amended by Federal Law Gazette I No. 51/2012 Federal Constitutional Law (B-VG) Art. 133, effective from January 1, 2004, through December 31, 2013, last amended by Federal Law Gazette (BGBl.)

I No. 138/2017; VwGVG § 28 valid from Jan. 1, 2014, through Dec. 31, 2018 Decision , W137 2334047-1/5E IN THE NAME OF THE REPUBLIC! The Federal Administrative Court, with Judge Mag. Peter HAMMER presiding and lay judges Mag. Ursula ILLIBAUER and Mag. Martina CHLESTIL as associate judges, ruled on the complaint filed by XXXX against the decision of the Data Protection Authority dated January 13, 2026, Ref. No. D124.0207/25, 2026-0.017.473, has rightly ruled as follows: The Federal Administrative Court, presided over by Judge Mag. Peter HAMMER and with expert lay judges Mag. Ursula ILLIBAUER and Mag. Martina CHLESTIL as associate judges, having considered the complaint filed by Roman 40 against the decision of the Data Protection Authority dated January 13, 2026, Ref. No. D124.0207/25, 2026-0.017.473, has correctly ruled as follows: A) The complaint is dismissed as unfounded pursuant to § 28(2) VwGVG in conjunction with § 24(1) and (5) DSG, as amended.The complaint is dismissed as unfounded pursuant to § 28(2) VwGVG in conjunction with § 24(1) and (5) DSG, as amended.

The appeal is not admissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG). The appeal is not admissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG). Text Reasons for the Decision: I. Course of Proceedings: Roman numeral I. Course of Proceedings: 1. In a procedural filing dated January 27, 2025, XXXX (= complainant before the Federal Administrative Court and petitioner before the Data Protection Authority) filed a data protection complaint against XXXX (= co-party before the Federal Administrative Court and respondent before the Data Protection Authority) regarding an alleged violation of the right to confidentiality. In support of her claim, she essentially argued that she was accused in proceedings before the XXXX District Attorney’s Office of fraud involving €211.90 because, in the course of the police investigation, the co-party had submitted an enforcement data extract concerning the complainant.

However, this transfer constituted a violation of § 427 EO in conjunction with § 1 DSG, because the co-party could have chosen a less intrusive means, such as filing a motion for evidence with the Court. 1. In a procedural motion dated January 27, 2025, Roman 40 (= the complainant before the Federal Administrative Court and the petitioner before the Data Protection Authority) filed a data protection complaint against Roman 40 (= the co-party before the Federal Administrative Court and the respondent before the Data Protection Authority) alleging a violation of the right to confidentiality. In essence, it was argued that she was accused in proceedings before the Roman 40 District Attorney’s Office of fraud involving €211.90, because, in the course of the police investigation, the co-party had submitted an enforcement data extract concerning the complainant. However, this transfer constituted a violation of Section 427, EO, in conjunction with Section 1, DSG, because the co-party could have chosen a less intrusive measure, such as filing a motion for evidence with the Court. 2.

In its statement dated May 7, 2025, the co-party essentially stated, insofar as relevant to the proceedings, that the complainant had ordered goods twice from the co-party’s pharmacy but subsequently failed to pay the corresponding invoices despite reminders. Consequently, the co-party commissioned a collection agency to recover the outstanding debts. After the collection agency informed her that several enforcement proceedings were pending against the complainant, she filed a report of fraud with the police and submitted a list of the pending enforcement proceedings to substantiate the suspicion of fraud. 3. In a statement dated May 14, 2025, the complainant essentially argued—insofar as relevant to the proceedings—that the statement submitted by the co-party proved that she had disclosed personal data to an unauthorized entity. This action was taken solely to strategically bolster a criminal complaint, as the police have no jurisdiction whatsoever over civil enforcement matters.

In this context, the complainant requests an investigation into abuse of office, disclosure of the source of the data regarding the diversion cited by the co-party, and notification of the Austrian Chamber of Pharmacists regarding the facts of the case. 4. In its decision dated January 13, 2026, Ref. No. D124.0207/25, 2026-0.017.473, the Data Protection Authority dismissed the data protection complaint of January 27, 2025, as unfounded (Point 1 of the decision) and rejected the remaining requests (Point 2 of the decision). In this decision, the Data Protection Authority essentially made the following findings of fact: The co-party is the owner of XXXX. The co-party is the owner of Roman numeral 40. The complainant had ordered goods from the aforementioned pharmacy, which she picked up but did not pay for. After repeated reminders regarding the outstanding debts, the co-party engaged a debt collection agency with the purpose of collecting them.

After the collection agency pointed out several pending enforcement proceedings concerning the complainant, the co-party filed a criminal complaint with the police alleging fraud and submitted an enforcement records extract. Based on these findings of fact, the respondent authority essentially concluded the following from a legal standpoint: Regarding Issue 1: The co-party submitted the list of enforcement proceedings to the police station when filing the report of fraud. Since the data processing at issue was neither in the complainant’s vital interest nor based on consent, the only permissible ground for processing in this case is legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Since the data processing at issue was neither in the complainant’s vital interests nor was consent given, the only legal basis that applies here is legitimate interest within the meaning of article 6(1)(f) of the GDPR.

The co-party forwarded the documents to the police in order to collect outstanding debts and report suspected fraud. The disclosure served to enforce its claims and as evidence for the outstanding debts. Therefore, the co-party had a legitimate interest in disclosing the documents. The transfer of the documents in question to the police, as the competent authority, also constituted the least intrusive means, and thus there was no violation of the principle of data minimisation pursuant to Article 5(1)(c) of the GDPR. The transfer of the documents in question to the police, as the competent authority, also constituted the least intrusive means; therefore, there was no violation of the principle of data minimisation pursuant to article 5(1)(c) of the GDPR. Thus, the transfer of the documents by the co-party was permissible under Article 6(1)(f) of the GDPR. Thus, the transfer of the documents by the co-party was permissible under Article 6(1)(f) of the GDPR.

Regarding Point 2: Pursuant to the principle of administrative discretion, the authority is entitled to determine the course of the investigative proceedings at its own discretion; therefore, the complainant’s requests regarding the investigation of an abuse of office, the disclosure of the source of the data regarding the alleged diversion, and the notification of the Austrian Chamber of Pharmacists regarding the facts of the case, had to be rejected. 5. In the complaint filed against this decision within the prescribed time limit, the complainant essentially argued: The respondent authority considers the transmission of the enforcement extract to be permissible across the board, which is legally incorrect, as the principle of data minimisation under Article 5(1)(c) of the GDPR has been violated in this case. In the present case, it would have been sufficient to transmit only invoices, reminders, etc., to establish a suspicion of fraud.

The respondent authority considers the transmission of the enforcement statement to be permissible across the board, which is legally incorrect, as this constitutes a violation of the principle of data minimisation under article 5(1)(c) of the GDPR. In the present case, it would have been sufficient to submit only invoices, payment reminders, etc., to establish a suspicion of fraud. In addition, the enforcement record provided contains, to a significant extent, entries that have already been paid off and are therefore no longer current, which constitutes a violation of the principle of accuracy and timeliness under Article 5(1)(d) of the GDPR. Furthermore, the enforcement record that was transmitted contains, to a significant extent, entries that have already been cleared and are therefore no longer current, which constitutes a violation of the principle of accuracy and timeliness under article 5(1)(d) of the GDPR.

Furthermore, the balancing of interests under Article 6(1)(f) of the GDPR was also conducted incorrectly, as the transfer in question was not necessary and the resulting intrusion was significant. Furthermore, the balancing of interests under Article 6(1)(f) of the GDPR was also incorrectly carried out, as the transfer in question was not necessary and the resulting intrusion was significant. The complainant therefore requested that the Federal Administrative Court 1. set aside or amend point 1 of the contested decision and find that the co-party had violated the complainant’s right to confidentiality; 2. in the alternative, set aside paragraph 1 of the contested decision and remand the matter to the respondent authority for further proceedings; 3. set aside paragraph 2 of the contested decision and rule that the respondent authority must make a decision on the merits of the claims filed; and 4. conduct an oral hearing. 6.

By letter from the Data Protection Authority dated January 27, 2026 (received on January 30, 2026), the complaint, together with the administrative decision, was forwarded to the Federal Administrative Court. The letter essentially referred to the decision and requested that the complaint be dismissed. II. The Federal Administrative Court considered: Roman numeral two. The Federal Administrative Court considered: 1. Findings: The co-party operates XXXX. The co-party operates Roman numeral 40. The complainant ordered goods from this pharmacy, which she subsequently picked up but did not pay for. After the outstanding debt remained unpaid despite several reminders, the co-party commissioned a debt collection agency to collect the debt. The collection agency subsequently informed the co-party that several enforcement proceedings were pending against the complainant. As a result, the co-party filed a criminal complaint with the police on suspicion of fraud.

As part of the criminal complaint, the co-party submitted an enforcement records extract concerning the complainant to the police. 2. Assessment of the Evidence: The findings regarding the relevant facts are derived from the administrative record, the complaint, and the court record. In particular, the finding that the co-party submitted the complainant’s enforcement data extract to the police is based on the co-party’s statement dated May 7,May 2025, as well as on the portions of the criminal case file for Case No. XXXX submitted by the complainant, and is undisputed. In particular, the finding that the complainant’s enforcement record was submitted to the police by the co-party is based on the co-party’s statement dated May 7,May 7, 2025, as well as on the portions of the criminal case file with reference number Roman numeral 40 submitted by the complainant, and is undisputed. 3. Legal Assessment: 3.1.

Pursuant to § 6 BVwGG, the Federal Administrative Court decides through a single judge, unless federal or state laws provide for a decision by a panel. 3.1. Pursuant to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court makes its decisions through a single judge, unless federal or state laws provide for a decision by a panel. Pursuant to § 27(1) DSG, the Federal Administrative Court rules through a panel on complaints against decisions based on a violation of the duty to provide information under § 24(7) leg.cit. and the Data Protection Authority’s duty to make a decision. Pursuant to § 27(2), first sentence, of the DSG, the panel consists of a chairperson and one expert lay judge each from the ranks of employers and employees. In the present case, the Senate therefore has jurisdiction. Pursuant to Section 27(1) of the DSG, the Federal Administrative Court, sitting as a Senate, rules on complaints against decisions regarding violations of the duty to provide information pursuant to paragraph 24(7) of the aforementioned Act and the Data Protection Authority’s duty to decide.

Pursuant to Section 28, paragraph 1, of the VwGVG, the administrative court must resolve the case by a final judgment, unless the complaint is to be dismissed or the proceedings are to be discontinued. Re A) 3.3. The Relevant Provisions of the GDPR: Article 4 Definitions For the purposes of this Regulation, the following terms shall have the following meanings: 1. “personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person; 2. “Processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transfers, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction; 3.–6.

(…) 7. “Controller” means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, makes the decision on the purposes and means of the processing of personal data; if the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for by Union law or the law of the Member States; 8–26. (…) Article 5 Principles Governing the Processing of Personal Data (1) Personal data must a) be processed lawfully, fairly, and in a transparent manner in relation to the data subject (“lawfulness, fairness, and transparency”); b) be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes is not considered incompatible with the original purposes pursuant to article 89(1) (“purpose limitation”); c) be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”); d) be factually accurate and, where necessary, kept up to date; all reasonable measures must be taken to ensure that personal data that is inaccurate in light of the purposes for which it is processed is erased or rectified without delay (“accuracy”); e) be stored in a form that permits identification of data subjects only for as long as is necessary for the purposes for which they are processed; Personal data may be stored for a longer period provided that, subject to the implementation of appropriate technical and organizational measures required by this Regulation to protect the rights and freedoms of the data subject, processed exclusively for archiving purposes in the public interest, or for scientific or historical research purposes, or for statistical purposes in accordance with Article 89(1) (“storage limitation”); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, accidental destruction, or accidental damage, through appropriate technical and organizational measures (“Integrity and Confidentiality”); (2) The controller is responsible for compliance with paragraph 1 and must be able to demonstrate such compliance (“accountability”).

Article 6 Lawfulness of Processing (1) Processing is lawful only if at least one of the following conditions is met: a) the data subject has given consent to the processing of personal data concerning him or her for one or more specific purposes; b) processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of precontractual measures taken at the data subject’s request; c) processing is necessary for compliance with a legal obligation to which the controller is subject; d) the processing is necessary to protect the vital interests of the data subject or of another natural person; e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f) the processing is necessary to safeguard the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail, in particular where the data subject is a child.

Subparagraph 1(f) does not apply to processing carried out by public authorities in the performance of their duties. (2) – (4) (…) 3.4 The relevant provisions of the DSG: Article 1 (Constitutional Provision) Fundamental Right to Data Protection § 1. (1) Every person has the right, particularly with regard to respect for their private and family life, to the confidentiality of personal data concerning them, to the extent that there is a legitimate interest therein. The existence of such an interest is excluded if data are not subject to a right to confidentiality due to their general availability or because they cannot be traced back to the data subject. Paragraph one, (1) Every person has the right, particularly with regard to respect for their private and family life, to the confidentiality of personal data concerning them, provided there is a legitimate interest in such confidentiality.

The existence of such an interest is excluded if data are not subject to a right to confidentiality due to their general availability or because they cannot be traced back to the data subject. (2) To the extent that the use of personal data is not in the vital interest of the data subject or is not carried out with his or her consent, restrictions on the right to confidentiality are permissible only to safeguard the overriding legitimate interests of another, and, in the case of interventions by a government authority, only on the basis of laws that are necessary for the reasons specified in Article 8(2) of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210/1958. Such laws may provide for the use of data that, by its Art, is particularly worthy of protection only to safeguard important public interests and must, at the same time, establish appropriate safeguards for the protection of the confidentiality interests of the data subjects.

Even in the case of permissible restrictions, the interference with the fundamental right must in each instance be limited to the least intrusive Art necessary to achieve the objective. (2) To the extent that the use of personal data does not occur in the vital interest of the data subject or with his or her consent, restrictions on the right to privacy are permissible only to safeguard the overriding legitimate interests of another; in the case of interventions by a government authority, such restrictions are permissible only on the basis of laws that are necessary for the reasons set forth in article 8, paragraph 2, of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210 of 1958. Such laws may provide for the use of data that, by its Art, is particularly worthy of protection only to safeguard important public interests and must, at the same time, establish appropriate safeguards for the protection of the data subjects’ interests in confidentiality.

Even in the case of permissible restrictions, the interference with the fundamental right may only be carried out in the least intrusive Art necessary to achieve the objective. (…) Complaint to the Data Protection Authority § 24. (1) Every data subject has the right to lodge a complaint with the Data Protection Authority if he or she believes that the processing of personal data concerning him or her violates the GDPR or § 1 or Article 2, Section 1. Paragraph 24, (1) Every data subject has the right to lodge a complaint with the Data Protection Authority if he or she believes that the processing of personal data concerning him or her violates the GDPR or Paragraph 1 or article 2, part 1. (2) The complaint must include: 1. the designation of the right deemed to have been violated, 2. to the extent reasonably possible, the designation of the legal entity or body to which the alleged violation is attributed (respondent), 3. the facts from which the violation is derived, 4. the grounds on which the allegation of unlawfulness is based, 5. a request to determine the alleged violation, and 6. the information necessary to assess whether the complaint was filed in a timely manner.

(3) Where applicable, a complaint must be accompanied by the underlying request and any response from the respondent. In the event of a complaint, the Data Protection Authority must provide further assistance at the request of the data subject. (4) The right to have a complaint addressed expires if the complainant does not file it within one year after becoming aware of the event giving rise to the complaint, but no later than three years after the event allegedly occurred. Late complaints shall be dismissed. (5) If a complaint is found to be justified, it must be addressed. If a violation is attributable to a controller in the private sector, that controller must be instructed to comply with the complainant’s requests for access, rectification, erasure, restriction, or data portability to the extent necessary to remedy the established violation. If the complaint proves to be unfounded, it shall be dismissed.

(6) A respondent may subsequently remedy the alleged violation before the conclusion of the proceedings before the Data Protection Authority by complying with the complainant’s requests. If the Data Protection Authority deems the complaint to be without merit in this respect, it shall hear the complainant on the matter. At the same time, the respondent must be informed that the Data Protection Authority will informally discontinue the proceedings if the respondent does not, within a reasonable period of time, provide a reasoned explanation as to why the respondent still considers the originally alleged violation to be, at least in part, unresolved. If such a statement by the complainant alters the nature of the matter (Section 13(8) AVG), it shall be presumed that the original complaint has been withdrawn and a new complaint has been filed simultaneously. In this case as well, the original complaint proceedings must be informally discontinued, and the complainant must be notified accordingly.

Late submissions shall not be taken into account.(6) A respondent may, until the conclusion of the proceedings before the Data Protection Authority, subsequently remedy the alleged violation by complying with the complainant’s requests. If the Data Protection Authority deems the complaint to be without merit in this respect, it must hear the complainant on this matter. At the same time, the complainant must be advised that the Data Protection Authority will informally dismiss the proceedings if the respondent does not, within a reasonable period of time, provide reasons why the respondent still considers the originally alleged violation to be, at least in part, unresolved. If such a statement by the complainant substantially alters the nature of the matter (Paragraph 13(8) of the Administrative Procedure Act [AVG]), it shall be presumed that the original complaint has been withdrawn and a new complaint has been filed.

In this case as well, the original complaint proceedings shall be informally discontinued, and the complainant shall be notified thereof. Late statements shall not be taken into account. (7) The Data Protection Authority shall inform the complainant of the status and outcome of the investigation within three months of the filing of the complaint. (8) Any data subject may bring the matter before the Federal Administrative Court if the Data Protection Authority fails to address the complaint or fails to inform the data subject of the status or outcome of the complaint within three months. (9) The Data Protection Authority may—to the extent necessary—call upon official experts in the proceedings. (10) The following periods are not included in the decision-making period pursuant to § 73 AVG:(10) The following periods are not included in the decision-making period pursuant to § 73 AVG: 1. the time during which the proceedings are suspended pending a final decision on a preliminary issue; 2. the time during proceedings under Articles 56, 60, and 63 of the GDPR.2. the time during proceedings under Articles 56, 60, and 63 of the GDPR. 3.5.

On the Right to Confidentiality: Pursuant to the constitutional provision of § 1(1) of the Data Protection Act (DSG), every person has the right to the confidentiality of personal data concerning them—particularly with regard to respect for private and family life—to the extent that there is a legitimate interest in confidentiality. All personal data—i.e., both data processed by automated means and manually—must be kept confidential if there is a legitimate interest in confidentiality; otherwise, the processing of such data is prohibited.According to the constitutional provision of Section 1, paragraph 1, of the DSG, every person has the right to confidentiality regarding personal data concerning them—particularly with regard to the respect for private and family life—to the extent that there is a legitimate interest in confidentiality. All personal data—that is, both data processed by automated means and data processed manually—must be kept confidential if there is a legitimate interest in confidentiality; otherwise, the processing of such data is prohibited.

The key factor in determining whether a fundamental right under Section 1(1) of the DSG exists at all is the existence of interests worthy of protection. When assessing these interests, a balancing of interests must be conducted. In this context, particular consideration must be given to the data protection principle of lawfulness.The key factor in determining whether a fundamental right under Section 1(1) of the DSG exists at all is the existence of interests worthy of protection. When assessing these interests, a balancing of interests must be conducted. In this context, particular consideration must be given to the principle of lawfulness under data protection law. The fundamental right to data protection is not absolute but may be restricted by certain permissible interventions. Pursuant to Section 1(2) of the DSG, restrictions on the right to confidentiality—insofar as the use of personal data is not in the vital interest of the data subject or does not occur with the data subject’s consent— permissible only to safeguard the overriding legitimate interests of another party; in the case of interventions by a government authority, these may occur only on the basis of laws that are necessary for the reasons set forth in Article 8(2) of the ECHR.

In this context, restrictions on this right may arise from para. 2 of the cited provision, but not (directly) from Article 6(1) of the GDPR. However, the GDPR—and in particular the principles enshrined therein—must in any case be taken into account when interpreting the right to confidentiality. The processing of this data also requires appropriate justification within the meaning of § 1(2) of the Data Protection Act (DSG) or Article 6(1) of the GDPR (see Thiele/Wagner, Practical Commentary on the Data Protection Act (DSG)2 § 1, margin note 39, 236 [as of February 1, 2022, rdb.at]). The fundamental right to data protection is not absolute but may be restricted by certain permissible interventions. Pursuant to Section 1(2) of the DSG, restrictions on the right to confidentiality—insofar as the use of personal data is not in the vital interest of the data subject or does not occur with the data subject’s consent— permissible only to safeguard the overriding legitimate interests of another party; furthermore, in the case of interventions by a government authority, these may occur only on the basis of laws that are necessary for the reasons set forth in article 8, paragraph 2, of the ECHR.

In this context, restrictions on this right may arise from paragraph 2, leg. cit., but not (directly) from article 6, paragraph 1, of the GDPR. However, the GDPR—and in particular the principles enshrined therein—must in any case be taken into account when interpreting the right to confidentiality. The processing of this data also requires appropriate justification within the meaning of Section 1(2) of the Data Protection Act (DSG) or article 6(1) of the GDPR; see Thiele/Wagner, Practical Commentary on the Data Protection Act (DSG)2, paragraph 1, margin note 39, 236 [as of February 1, 2022, rdb.at]). It should be noted that, in her data protection complaint dated January 27, 2025, the complainant alleged a violation of her right to confidentiality by the co-party. She argued that the co-respondent unlawfully submitted the enforcement data extract, including the complainant’s personal data, to the police during a witness interview.

The co-party explained in this regard that the complainant had ordered goods twice from the co-party’s pharmacy but had failed to pay for them despite several reminders. Consequently, the co-party had commissioned a debt collection agency to recover the outstanding debts. After the collection agency informed the co-party that several enforcement proceedings were pending against the complainant, the co-party filed a report of fraud with the police and submitted a list of the pending enforcement proceedings to substantiate the suspicion. The respondent authority’s position must be upheld, when it states in summary in the contested decision that, based on the co-party’s legitimate interest pursuant to Article 6(1)(f) of the GDPR, the transfer of the complainant’s enforcement data extract to the police was lawful. The respondent authority is correct when it states in summary in the contested decision that, based on the legitimate interest of the co-party pursuant to article 6, paragraph 1, (f) of the GDPR, the transfer of the complainant’s enforcement record to the police was lawful.

First, it is clear that the complainant’s name, date of birth, address, and information regarding pending proceedings contained in the enforcement data extract are, without a doubt, personal data within the meaning of Art. 4(1) of the GDPR. According to the case law of the CJEU, the concept of personal data is not limited solely to sensitive or private information but potentially encompasses all types of information, whether of an objective or subjective nature. As a prerequisite for such a broad interpretation of personal data, the CJEU holds that the information must relate to the individual in question. This requirement is met if the information is linked to a specific person by virtue of its content, purpose, or effects (CJEU, Dec. 20, 2017, C-434/16, Peter Nowak v. Data Protection Commissioner, para. 34 et seq.), which is the case here; consequently, with regard to this personal data, the complainant generally has a legitimate interest in confidentiality pursuant to § 1(1) of the Data Protection Act (DSG) (see Thiele/Wagner, Practical Commentary on the Data Protection Act (DSG) § 1 [as of Jan. 1, 2020], para. 16).First, it is clear that the complainant’s name, date of birth, address, and information regarding pending proceedings contained in the enforcement data extract unquestionably constitute personal data within the meaning of Article 4(1) of the GDPR.

In accordance with the case law of the CJEU, the concept of personal data is not limited solely to sensitive or private information but potentially encompasses all types of information, whether of an objective or subjective nature. As a prerequisite for such a broad interpretation of personal data, the CJEU holds that the information must relate to the individual in question. This requirement is met when the information is linked to a specific person by virtue of its content, purpose, or effects (CJEU, Dec. 20, 2017, C-434/16, Peter Nowak v. Data Protection Commissioner, para. 34 et seq.), which is the case here; consequently, with regard to this personal data, the complainant generally has a legitimate interest in confidentiality pursuant to Section 1, paragraph 1, DSG—see Thiele/Wagner, Practical Commentary on the Data Protection Act (DSG), Section 1, [as of January 1, 2020], para. 16).

It is equally undisputed that the co-party processed the complainant’s personal data within the meaning of Article 4(2) of the GDPR by presenting the complainant’s enforcement data extract during the police witness interview and that this action qualifies as processing within the meaning of Article 4(7) of the GDPR—is equally undisputed. That the co-respondent processed the complainant’s personal data within the meaning of article 4(2), GDPR by presenting the complainant’s enforcement data extract during the police witness interview and, as such, qualifies as the controller within the meaning of article 4(7) of the GDPR, is equally undisputed. However, the lawfulness of this data processing is disputed—specifically, whether the co-party, through its actions, violated the complainant’s right to confidentiality under § 1 of the Data Protection Act (DSG).However, the lawfulness of this data processing is disputed, namely whether the co-involved party, through its actions, violated the complainant’s right to confidentiality under Section 1 of the DSG.

In accordance with the case law of the CJEU, any processing of personal data must, as a general rule, comply with the principles set forth in Article 5 of the GDPR regarding the processing of personal data and with one of the principles listed in Article 6 of the GDPR regarding the lawfulness of data processing (regarding the predecessor provision, Article 6 of the Data Protection Directive: CJEU May 20, 2003, joined cases C-465/00, C-138/01, and C-139/01, Österreichischer Rundfunk et al., para. 65; Dec. 16, 2008, C-524/06, Huber, para. 48). In accordance with the case law of the CJEU, any processing of personal data must, as a general rule, comply with the principles set forth in Article 5, GDPR regarding the processing of personal data and one of the principles listed in Article 6 of the GDPR regarding the lawfulness of data processing (regarding the predecessor provision, Article 6 of the Data Protection Directive: CJEU May 20, 2003, Joined Cases C-465/00, C-138/01, and C-139/01, Österreichischer Rundfunk et al., para. 65; Dec. 16, 2008, C-524/06, Huber, para. 48).

With regard to the lawfulness of the processing of personal data, Article 6(1) of the GDPR contains an exhaustive and definitive list of six cases (regarding the predecessor provision, Article 7 of the Data Protection Directive: CJEU Nov. 24, 2011, Joined Cases C-468/10 and C-469/10, ASNEF, para. 30 et seq.; Oct. 19, 2016, C-582/14, Breyer, para. 57). Article 6(1) of the GDPR contains an exhaustive and definitive list of six cases regarding the lawfulness of the processing of personal data (regarding the predecessor provision, Article 7 of the Data Protection Directive: CJEU, Nov. 24, 2011, Joined Cases C-468/10 and C-469/10, ASNEF, para. 30 et seq.; Oct. 19, 2016, C-582/14, Breyer, para. 57). Pursuant to Article 5(1)(c) of the GDPR, personal data must be adequate, relevant, and limited to what is necessary for the purposes of the processing (principle of data minimisation). The last sentence of para 1(2) of the DSG (Data Protection Act), in accordance with this principle, stipulates that any interference with the fundamental right to data protection may only be carried out in the least intrusive Art necessary to achieve the objective (Dopplinger in Bresich/Dopplinger/Dörnhöfer/Kunnert/Riedl, DSG § 1 [as of June 12, 2018], rdb.at).

The processing of personal data should be limited to what is unavoidable. This ensures that processing is actually restricted to the specified purpose (see OGH, Dec. 22, 2021, 6 Ob214/21w, citing Hötzendorfer/Tschohl/Kastelitz in Knyrim, DatKomm Art. 5 GDPR, paras. 21 and 34). Data is relevant if it is conducive to achieving the purpose—that is, if it is suitable within the meaning of the constitutional principle of proportionality. If, on the other hand, the processing of certain data can be dispensed with without hindering the achievement of the purpose, then such data is not relevant (Hötzendorfer/Tschohl/Kastelitz in Knyrim, DatKomm Art. 5 GDPR para. 34 et seq. [as of May 7, 2020], rdb.at). According to Article 5, paragraph 1, subparagraph c, of the GDPR, personal data must be adequate and relevant to the purpose and limited to what is necessary for the purposes of the processing (principle of data minimisation).

The last sentence of paragraph 2 of Section 1 of the DSG, in accordance with this principle, stipulates that any interference with the fundamental right to data protection may only be carried out in the least intrusive Art necessary to achieve the objective (Dopplinger in Bresich/Dopplinger/Dörnhöfer/Kunnert/Riedl, DSG Section 1, [as of June 12, 2018], rdb.at). The processing of personal data should be reduced to what is unavoidable. This ensures that processing is actually limited to the specified purpose; see OGH Dec. 22, 2021, 6 Ob214/21w, with reference to Hötzendorfer/Tschohl/Kastelitz in Knyrim, DatKomm article 5, GDPR Marginal Notes 21 and 34). Data is relevant if it is conducive to achieving the purpose—that is, if it is suitable within the meaning of the constitutional doctrine of proportionality. If, on the other hand, one can conceive of processing certain data being omitted without hindering the achievement of the purpose, then such data is not relevant (Hötzendorfer/Tschohl/Kastelitz in Knyrim, DatKomm article 5, GDPR Marginal Note 34 et seq. [as of May 7, 2020], rdb.at).

The requirements for the lawfulness of data processing are specified in Art. 6 of the GDPR. Accordingly, the lawfulness of any processing requires that the processing—in addition to the other principles set forth in Article 5(1)—must satisfy at least one of the legal grounds exhaustively listed in Article 6(1) of the GDPR (see Selmayr in Ehmann/Selmayr, General Data Protection Regulation, Commentary 3, 2024, Art. 5, para. 11). The requirements for the lawfulness of data processing are specified in Article 6 of the GDPR. Accordingly, the lawfulness of any processing requires that the processing—in addition to the other principles set forth in Article 5(1)—must satisfy at least one of the legal grounds exhaustively listed in Article 6(1) exhaustively listed in article 6, paragraph 1, of the GDPR (see Selmayr in Ehmann/Selmayr, General Data Protection Regulation, Commentary 3, 2024, article 5, margin note 11).

In the present case, the use of the complainant’s personal data is not in the vital interest of the other party involved. Furthermore, as established, the complainant did not consent to the use of her data. Therefore, the legal basis set forth in Article 6(1)(f) of the GDPR must be examined. In the present case, the use of the complainant’s personal data is not in the vital interest of the other party involved. Furthermore, as established, the complainant did not consent to the use of her data. Therefore, the grounds for authorization under Article 6(1)(f) of the GDPR must be examined. Such processing is permissible under Article 6(1)(f) of the GDPR if the processing is necessary to protect the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, take precedence.

Such processing is permitted under Article 6(1)(f) of the GDPR if the processing is necessary to protect the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail. The EDPB provides for a test framework under which the processing of personal data is permissible if three cumulative conditions are met, thereby following the CJEU, which had already established this for the largely identical predecessor provision (Art. 7(f) of the Data Protection Directive), which is also relied upon by DPA and the Austrian Supreme Court (OGH) in their case law:The EDPB provides for a test framework under which the processing of personal data is permissible if three cumulative conditions are met, thereby following the CJEU, which had already established this for the largely consistent predecessor provision (article 7(f), Data Protection Directive) and which is also relied upon by DPA and the Austrian Supreme Court (OGH) in their case law: 1.

The existence of a legitimate interest pursued by the controller or by the third party or parties, 2. The processing of personal data is necessary to fulfill the legitimate interest, and 3. The fundamental rights and freedoms of the data subject are not overridden. Essentially, a balancing of the interests involved (balancing of interests) must be carried out on a case-by-case basis, “in which case it must also be examined whether a data subject, at the time the personal data is collected and in light of the circumstances under which such collection takes place, can reasonably foresee that processing for this purpose may occur.” (see EDPB Guidelines 01/2024). This balancing must be conducted from an objective perspective and not from the subjective perspective of individual data subjects; thus, individual sensitivities are not to be taken into account. It has not been conclusively clarified whether a balancing of interests must always be conducted on a case-by-case basis or summarily for each instance of processing.

While the Administrative Court (VwGH) assumes a general case-by-case assessment, some scholars—citing the (lack of) practical feasibility of a case-by-case review, some scholars in the literature also consider a summary balancing of interests based on typical circumstances to be sufficient—a view that could also be supported by the existence of a right to object. Essentially, a balancing of the interests involved (balancing of interests) must be conducted on a case-by-case basis, “in which case it must also be examined whether a data subject, at the time the personal data is collected and in light of the circumstances under which it is collected, can reasonably foresee that processing for this purpose may take place.” (See EDPB Guidelines 01 from 2024.) The balancing must be conducted from an objective perspective and not from the subjective perspective of individual data subjects; thus, individual sensitivities are not to be taken into account.

It has not been conclusively clarified whether a balancing of interests must always be conducted on a case-by-case basis or summarily for each instance of processing. While the Administrative Court (VwGH) assumes a fundamental case-by-case assessment, some scholars—citing the (lack of) practical feasibility of a case-by-case review, some scholars in the literature also consider a summary balancing of interests—based on typical circumstances—to be sufficient, a view that could also be supported by the existence of a right to object. If this balancing of interests favors the controller or a third party, the processing is generally permissible (subject to compliance with the other requirements mentioned above, and in particular Article 5). The controller is responsible for conducting the balancing of interests and bears the burden of proof (see Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Art. 6 GDPR, para. 51 [as of Oct. 1, 2025, rdb.at]).

If this balancing of interests favors the controller or a third party, the processing is generally permissible (subject to compliance with the other conditions mentioned above, and in particular article 5). The controller is responsible for conducting the balancing of interests and bears the burden of proof; see Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm article 6, GDPR, Marg. No. 51 [as of Oct. 1, 2025, rdb.at]). According to the case law of the CJEU, the concept of “legitimate interest” within the meaning of Article 6(1)(f) of the GDPR must be interpreted broadly. In principle, all legitimate interests of the controller or a third party may be considered legitimate interests; these need not be specified by law. The Court thus recognizes a broad spectrum of economic, legal, non-material, and factual interests as generally eligible for consideration (see CJEU, Oct. 4, 2024, Case C-621/22 Koninklijke Nederlandse Lawn Tennisbond).

The concept of “legitimate interest” within the meaning of Article 6(1)(f) of the GDPR must be interpreted broadly in accordance with the case law of the CJEU. In principle, all legitimate interests of the controller or a third party may be considered legitimate interests; these need not be specified by law. The Court thus recognizes a broad spectrum of economic, legal, non-material, and factual interests as generally eligible for consideration (see CJEU, October 4, 2024, Case C-621/22, Koninklijke Nederlandse Lawn Tennisbond). Since, in principle, a broad spectrum of interests can be considered “legitimate,” the interest of the party involved in reporting a criminal offense to the police and/or pursuing a claim to which it is entitled is certainly eligible for consideration. Regarding the necessity of data processing, the CJEU has ruled that, in assessing necessity, it must be examined whether the legitimate interest in processing the data cannot be achieved just as effectively, by reasonable means, through other measures that interfere less significantly with the fundamental rights and freedoms of the data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the CFR (cf. CJEU July 4, 2023, C-252/21, Meta Platforms et al., para. 108).

In this context, the CJEU has stated, for example, that processing must take place within the limits of what is “strictly necessary” to achieve the legitimate interest (see CJEU July 4, 2023, C-252/21, para. 126), or that exceptions and restrictions regarding the protection of personal data must be limited to what is “absolutely necessary” (see CJEU June 17, 2021, C-597/19, M.I.C.M., para. 110).Regarding the necessity of data processing, the CJEU has ruled that, in assessing necessity, it must be examined whether the legitimate interest in processing the data cannot be achieved just as effectively, by reasonable means, through other measures that interfere less severely with the fundamental rights and freedoms of the data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed by articles 7 and 8 of the CFR; see CJEU, July 4, 2023, C-252/21, Meta Platforms et al., para. 108).

In this context, the CJEU has stated, for example, that processing must take place within the limits of what is “strictly necessary” to achieve the legitimate interest (see CJEU, July 4, 2023, C-252/21, para. 126), or that exceptions and restrictions regarding the protection of personal data must be limited to what is “absolutely necessary” (see CJEU, June 17, 2021, C-597/19, M.I.C.M., para. 110). The requirement that data processing be necessary must be assessed in conjunction with the so-called principle of “data minimisation” within the meaning of Art. 5(1)(c) of the GDPR, which requires that personal data be “relevant and limited to what is necessary for the purposes of the processing” (see CJEU, July 4, 2023, Meta Platforms et al. [General Terms of Use of a Social Network], C-252/21, EU:C:2023:537, para. 109 and the case law cited therein).The requirement that data processing be necessary must be examined in conjunction with the so-called principle of “data minimisation” within the meaning of article 5, paragraph 1, subparagraph (c), GDPR, which requires that personal data be “adequate, relevant, and limited to what is necessary for the purposes of the processing”; see CJEU, July 4, 2023, Meta Platforms et al. [General Terms of Use of a Social Network], C-252/21, EU:C:2023:537, para. 109 and the case law cited therein).

In the present case, the processing of the complainant’s personal data from the enforcement records must also be deemed necessary, because, on the one hand, the co-party had to submit relevant documents as evidence to the police in order to report the alleged offense of fraud, and, on the other hand, this data served to pursue claims against the complainant. Furthermore, the submission of the complainant’s enforcement data extract to the police constituted the least intrusive measure, as it clearly demonstrated that numerous enforcement proceedings were and are pending against the complainant, inter alia, due to the non-payment of outstanding claims. In the present case, the adjudicating panel also sees no less severe means available. If the complainant asserts in her complaint that it would have been sufficient to submit only invoices or demand letters to the police, it must be countered that invoices and demand letters can only pertain to the specific legal transaction, whereas only the enforcement data extract (in conjunction with the co-respondent’s unpaid debts) provides substantial evidence of the existence of a criminal offense or substantiates or strengthens any suspicion thereof.

Consequently, the co-party did not violate the principle of data minimisation within the meaning of Article 5(1)(c) of the GDPR. Consequently, the co-party did not violate the principle of data minimisation within the meaning of article 5(1)(c) of the GDPR. Since the complainant’s fundamental rights and freedoms were not found to outweigh the interests at stake, the co-respondent did not violate the complainant’s right to confidentiality by transmitting her personal data to the police in connection with the filing of the complaint. This is also because, given a relevant history of necessary compulsory collections—which, incidentally, is undisputed—the complainant objectively had to anticipate that, in the event of renewed non-fulfillment of contractual payment obligations, corresponding steps would be taken by potentially aggrieved business partners. Since the data was disclosed only to the law enforcement agency responsible for the report, the co-party cannot be required to conduct a time-consuming preliminary review of any repayment deadlines. 3.6.

A party has no subjective right to dictate to the authority the nature or course of the proceedings; for this reason alone, these motions were to be dismissed by the responding authority as inadmissible. These motions concern the conduct of the proceedings and do not contain any specific requests that could form the basis of a decision on the merits. Pursuant to Section 39(2) of the Administrative Procedure Act (AVG), it is incumbent upon the authority to determine the course of the investigative proceedings. The conduct of the proceedings is governed by statutory requirements, in particular by the principles of expediency, promptness, simplicity, and cost-effectiveness. A party has no subjective right to dictate to the authority the Art or course of the proceedings; for this reason alone, the motions were properly dismissed as inadmissible by the respondent authority. Furthermore, it must be emphasized that a pharmacist’s duty of confidentiality under professional and ethical law does not extend to circumstances related to actual or even merely potential criminal offenses that affect her.