# DSB (Austria) - DSB-D124.0850/25

- Type: Enforcement
- Source: DSB (Austria)
- Date: 2026-01-28
- Original: https://gdprhub.eu/index.php?title=DSB_(Austria)_-_DSB-D124.0850/25
- Canonical: https://overview.legal/posts/353787
- Topics: Recipient, Supervisory Authorities, Pseudonymization, Law Enforcement, Anonymization, Security, Controllers, Personal Data, Anonymization, Health Data

## Summary

Facts — The data subject was involved in a legal dispute before a civil court in which the findings of an expert opinion led to the dismissal of the case. The expert opinion concerned the health status of the data subject. The data subject challenged the expert opinion in court in an individual legal proceeding. The court, in that second proceeding, ordered another expert (controller) to review whether the expert opinion in the first legal dispute was issued lege artis. In order for the controller to assess the findings of the expert opinion, the other party of the legal dispute made available to the controller the health data of the data subject via an online link. The health data included not only the data concerning the body part that was subject to the legal dispute, but all the data subject’s health data that the other party of the legal dispute processed. Additionally, the controller made the health data available to a neurologist in an anonymised form in order to receive a second opinion on their findings. The data subject’s complaint before the DPA concerned both the making available of the health data by the other party in the legal dispute to the controller as well as the making available by the controller to the neurologist. Holding — The DPA dismissed the complaint fully. Disclosure to the controller As far as the making available of health data by the other party in the legal dispute was concerned, the DPA held that the processing of health data fell under Article 9(2)(f) and (g) GDPR. National law provides for a legal basis for the making available of health data where the health condition of a person is relevant for a decision in the public interest. The other party in the legal dispute made the data subject’s health data available in the context of a court proceeding that was dealing with the subject matter of an expert opinion on the health status of the data subject. The processing thus fell under the legal basis provided for by national law. Moreover, national civil procedural law provides for a legal obligation for parties and third persons to cooperate in legal proceedings. Thus, the DPA held that the other party in the legal dispute was obliged to make the health data available in order to fulfil their obligation to cooperate in the legal proceeding. According to the DPA, the other party in the legal dispute was allowed to make available all health data, not just the health data concerning the body part that was subject to the legal dispute and the expert opinion. This is because it is for the controller, the expert appointed by the court, to decide what methods and means to apply, and what data was needed in order to fulfil their duty to the court. The other party of the legal dispute could not determine which health data was relevant in order for the controller to assess whether the expert opinion was carried out lege artis. Neither does the DPA have the competence to assess what data is relevant for the expert to make an expert assessment in the context of legal proceedings before a court. The decision as to the selection of relevant data lies solely with the controller that was appointed specifically because of their expert knowledge that neither the other party to the legal dispute nor the DPA possess. It is plausible that in order to assess the health status of the data subject, health data concerning other body regions than the one that was subject to the challenged expert opinion was required. Therefore, the other party in the legal dispute could reasonably share all available health data. 2. Disclosure to the neurologist As far as the making available of anonymised data by the controller to the neurologist was concerned, the DPA held that the processing was not unlawful because anonymised data falls outside the scope of the GDPR.

## Full text

Text Ref. No.: 2025-0.931.163 dated January 28, 2026 (Case No.: DPA-D124.0850/25) [Processing Officer’s Note: Names and company names, legal forms and product names, addresses (including URLs, IP addresses, and email addresses), case numbers (and the like), statistical data, etc., as well as their initials and abbreviations, may have been abbreviated and/or altered for pseudonymization purposes. Obvious spelling, grammar, and punctuation errors have been corrected.] DECISION RULING The Data Protection Authority rules on the data protection complaint filed by Antonia-Gerlinde A***, represented by MMag. Siegmund A***, MA (complainant), filed on April 5, 2025, against M***klinik GmbH (first respondent) and against Univ.-Prof. Dr. Josef N*** (second respondent) regarding a violation of the right to confidentiality as follows: 1. The complaint against the first respondent is dismissed as unfounded. 2. The complaint against the second respondent is dismissed as unfounded. Legal basis: Art. 51(1), Art. 57(1)(f), and Art. 77(1) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of May 4, 2016, p. 1; Sections 1, 18(1), and 24(1) and (5) of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999, as amended; Section 359(2) of the Code of Civil Procedure (ZPO), RGBl. No. 113/1895, as amended; § 35(9) of the Salzburg Hospitals Act 2000 (SKAG), LGBl. No. 24/2000, as amended.Legal Basis: Article 51, paragraph 1; Article 57, paragraph 1, subparagraph f; and Article 77, paragraph 1, of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), Official Journal No. L 119 of May 4, 2016, p. 1; Sections 1, 18(1), and 24(1) and (5) of the Data Protection Act (DSG), Federal Law Gazette Part I, No. 165 of 1999, as amended; Section 359(2) of the Code of Civil Procedure (ZPO), Federal Law Gazette No. 113 of 1895, as amended; Section 35, paragraph 9, of the Salzburg Hospitals Act 2000 (SKAG), Provincial Law Gazette No. 24 of 2000, as amended. STATEMENT OF REASONS A. Arguments of the Parties and Course of Proceedings A.1. In a petition initiating proceedings dated April 5, 2025, amended by petitions dated April 17, 2025, and April 25, 2025, the complainant, represented by MMag. Siegmund A***, MA, argued in summary that the first respondent had violated her right to confidentiality by granting the second respondent unrestricted electronic access to all of the complainant’s existing data concerning health dating back more than 15 years. A.2. In a letter dated May 30, 2025, the first respondent was requested to submit a statement. A.3. The first respondent’s statement was received by the Data Protection Authority on June 26, 2025. A.4. The first respondent was requested to submit a supplementary statement by letter dated June 30, 2025. A.5. The first respondent’s statements were forwarded to the complainant during the hearing on July 11, 2025. A.6. The complainant’s statement was received by the Data Protection Authority on July 17, 2025. A.7. Subsequently, the second respondent was summoned as a witness. The oral hearing took place online on August 22, 2025. The transcript of the hearing was sent to the second respondent on August 22, 2025. The second respondent did not raise any objections to the transcript within the specified time limit. A.8. As part of the hearing of the parties, the transcript of the second respondent’s hearing was transmitted to the first respondent and the complainant on September 22, 2025. A.9. In a letter dated September 23, 2025, received by the Office on September 25, 2025, the complainant submitted another statement. In it, the complainant expanded her complaint against the second respondent. A.10. The second respondent was requested to submit a statement by letter dated October 27, 2025. A.11. By letter dated October 9, 2025, another statement was received from the first respondent. A.12. On November 12, 2025, the second respondent’s statement was received. B. Subject Matter of the Complaint B.1. With regard to the first respondent, the subject matter of the complaint is whether the first respondent violated the complainant’s right to confidentiality by granting the second respondent unrestricted electronic access to all of the complainant’s data concerning health. B.2. With regard to the second respondent, the subject matter of the complaint is whether the second respondent violated the complainant’s right to confidentiality by unlawfully disclosing the complainant’s personal data concerning health to a neurologist consulted in connection with the preparation of an expert opinion. C. Findings of Fact C.1. The proceedings before the Data Protection Authority were preceded by a claim for damages brought by the complainant against the first respondent before the Salzburg Regional Court (Case No.: 3 Cg 63/20a), which was dismissed. Subsequently, the complainant filed a civil lawsuit against the expert appointed in the proceedings before the Salzburg Regional Court (Case No.: 3 Cg 63/20a). The subject matter of the proceedings now pending before the Vienna Regional Court [Editor’s note: presumably referring to the Vienna Regional Court for Civil Matters] (Case No.: 19 Cg 42/24x) was the question of whether the expert’s report, which relates to facts from 2016, was prepared in accordance with professional standards, or whether the expert reached an incorrect conclusion that erroneously led to the dismissal of the complaint in the proceedings before the Salzburg Regional Court. Assessment of the Evidence: The findings of fact are derived from the complainant’s initial pleadings and were not contested by the respondents. C.2. The second respondent was appointed as an expert in the proceedings before the Vienna Regional Court (Case No.: 19 Cg 42/24x) by order dated December 30, 2024, and was commissioned to prepare an expert opinion. The Vienna Regional Court did not impose any restrictions on the method to be used or on the personal data concerning health to be considered. The order included the following instruction in part: “[…whether the aforementioned defendant in the proceedings before the Salzburg Regional Court (Case No. 3 Cg 63/20a) prepared a proper expert opinion on the questions posed there, or whether he reached an incorrect conclusion that—incorrectly (based on the findings)—led to the dismissal of the complaint. […]” Assessment of the Evidence: The facts of the case are established by the consistent statements of the complainant on this point and the first respondent’s statement of June 26, June 2025, as well as from the decision of the Vienna Regional Court for Civil Matters (Case No.: 9 Cg 42/24x) dated December 30, 2024, and are undisputed. C.3. The second respondent prepared an expert opinion dated March 25, 2025, using the complainant’s data concerning health. Assessment of Evidence: The finding regarding the second respondent’s expert opinion dated March 25, 2025, is based on the expert opinion submitted by the complainant on April 17, 2025. C.4. The first respondent granted the second respondent access to the complainant’s data concerning health via electronic links. The second respondent’s electronic access encompassed items No. 100 through No. 185 listed in his expert opinion dated March 25, 2025. Assessment of the Evidence: The findings of fact are based on the first respondent’s statement of June 26, 2025, as well as the second respondent’s witness testimony of August 22, August 2025, as well as the expert opinion dated March 25, 2025, submitted by the complainant on April 17, 2025. C.5. The second respondent engaged a neurologist to prepare the expert opinion and provided her with anonymized data concerning health pertaining to the complainant. Personal data concerning health was not disclosed. Assessment of the Evidence: The facts of the case are established by the second respondent’s statement dated November 12, 2025. In this statement, the second respondent credibly asserts that the complainant’s data concerning health was transmitted in anonymized form to a neurologist in order to obtain a second opinion. It is understandable—and falls within the realm of common experience—for a medical expert to seek a second opinion to ensure the compliance and quality of a Court-ordered expert opinion. There are no indications that, contrary to the second respondent’s statement, the data concerning health transmitted for this purpose was not anonymized. Nor are there any other indications that would cast doubt on this. D. From a legal perspective, the following conclusions follow: D.1. On the Right to Confidentiality in General Pursuant to § 1(1) of the Data Protection Act (DSG), every person has the right to confidentiality regarding personal data concerning them, provided there is a legitimate interest in such confidentiality. The existence of such an interest is ruled out if data is not subject to a right to confidentiality due to its general availability or because it cannot be traced back to the data subject. The GDPR, and in particular the legal definitions and principles enshrined therein, must be consulted when interpreting the right to confidentiality (see the DPA’s decision of October 31, 2018, Ref. No.: DPA-D123.076/0003-DPA/2018). An essential prerequisite for the applicability of § 1 of the Data Protection Act (DSG) is thus the processing of a data subject’s personal data. According to Section 1, Paragraph 1, of the DSG, every person has a right to confidentiality regarding personal data concerning them, provided there is a legitimate interest therein. The existence of such an interest is ruled out if data is not subject to a right to confidentiality due to its general availability or because it cannot be traced back to the data subject. The GDPR, and in particular the legal definitions and principles enshrined therein, must be consulted when interpreting the right to confidentiality; see the decision of the DPA dated October 31, 2018, Ref. No.: DPA-D123.076/0003-DPA/2018). An essential prerequisite for the applicability of Section 1 of the DSG is thus the processing of a data subject’s personal data. According to Article 4(15) of the GDPR, data concerning health is personal data relating to the physical or mental health of a natural person, including the provision of health care services, and from which information about that person’s health status can be derived. The processing of a natural person’s data concerning health is generally prohibited under Article 9(1) of the GDPR, unless one of the grounds for authorization set forth in para 2 of the aforementioned article applies. In the present case, the complainant’s personal data concerning health was undoubtedly processed. According to article 4(15) of the GDPR, data concerning health is personal data relating to the physical or mental health of a natural person, including the provision of health services, and from which information about that person’s health status can be derived. The processing of a natural person’s data concerning health is generally prohibited under Article 9(1) of the GDPR, unless one of the grounds for authorization set forth in paragraph 2 of the aforementioned provision applies. In the present case, there is no doubt that the complainant’s personal data concerning health was processed. D.2. Regarding Issue 1 In the present case, the first respondent provided the second respondent with electronic access to retrieve the complainant’s data concerning health. Since the personal data in question constitutes data concerning health, its processing is lawful only if an exception under Article 9(2) of the GDPR applies. The first respondent relies on the legal basis of para 35(9) of the Salzburg Hospital Act 2000 (SKAG StF: LGBl. No. 24/2000 (WV)). According to this provision, data concerning health must be disclosed to Courts upon request in “matters in which the determination of a person’s state of health is relevant to a decision or order in the public interest.” In the present case, the first respondent provided the second respondent with electronic access to retrieve the complainant’s data concerning health. Since the personal data in question constitutes data concerning health, its processing is lawful only if an exception under Article 9(2) of the GDPR applies. The first respondent relies on the legal basis of paragraph 35(9) of the Salzburg Hospital Act 2000 (SKAG), as originally enacted, State Law Gazette No. 24 of 2000 (WV). According to this provision, data concerning health must be disclosed to Courts upon request in “matters in which the determination of a person’s state of health is relevant to a decision or order in the public interest.” The subject matter of the proceedings is an order by the Regional Court instructing the second respondent to prepare an expert opinion determining whether the initial expert opinion was prepared in accordance with professional standards (lege artis) or whether the expert at that time reached an incorrect conclusion in his initial expert opinion, which erroneously led to the dismissal of the claim in the previous proceedings. This expert opinion, which has now been commissioned, is essential for the decision in the ongoing civil proceedings before the Regional Court, which essentially concern the assessment of the complainant’s state of health—albeit at a point in time in the past. Furthermore, reference is made to Section 359(2) of the ZPO (Code of Civil Procedure), according to which, in civil proceedings, not only the parties but also third parties—such as the first respondent in the ongoing civil proceedings before the Regional Court—are obligated to cooperate. The first respondent was therefore under a legal obligation to disclose the personal data at issue in the proceedings.Furthermore, reference should be made to paragraph 359(2) of the ZPO (Code of Civil Procedure), according to which, in civil court proceedings, parties—as well as third parties, such as the first respondent in the ongoing civil court proceedings before the Regional Court—are obligated to cooperate. The first respondent was therefore under a legal obligation to disclose the personal data at issue in the proceedings. Consequently, there is a valid legal basis for the processing of personal data concerning health—and thus, in the present proceedings, for the provision of the complainant’s data concerning health to the second respondent—pursuant to Article 9(2)(f) and (g) of the GDPR.Thus, there is a valid legal basis for the processing of personal data concerning health—and, in the present proceedings, for the disclosure of the complainant’s data concerning health to the second respondent—pursuant to article 9(2)(f) or (g) of the GDPR. Therefore, if the complainant argues that a Court order directing the first respondent to provide the complainant’s medical history to the expert witness—who is now the second respondent— such an order does not exist, it must be pointed out to her that, according to settled case law, while experts are not organs exercising public authority within the meaning of § 1(2) AHG—since they do not make decisions themselves but merely provide evidence to the Court through their expert opinions— they nevertheless assist judges—and thus the Courts—as auxiliaries in establishing the facts of the case. (See, in this regard: Supreme Court decision of May 24, 2016, 1 Ob 79/16y, and RS0040624.) This is also the case here. Therefore, if the complainant argues that an order by the Court to the first respondent—requiring the latter to forward the complainant’s medical history to the expert witness and now second respondent— did not exist, it must be pointed out to her that, according to established case law, while experts are not organs executing the law within the meaning of paragraph 1(2) of the Administrative Court Act (AHG)—since they do not make decisions themselves but merely provide evidence to the Court through their expert opinions— they nevertheless assist judges—and thus the Courts—as auxiliaries in establishing the facts of the case. (See, in this regard: Supreme Court decision of May 24, 2016, 1 Ob 79/16y, as well as RS0040624.) This is also the case here. On the Status of the Expert To answer the question of whether the first respondent should have restricted access to the electronic data concerning health, the status of the court-appointed expert must first be examined. According to the case law of the Federal Administrative Court, experts are—at least jointly with the Court that commissioned them to prepare the expert opinion—data controllers under data protection law, as they “make independent decisions regarding the means (the ‘manner in which a result or goal is achieved’).” With regard to the methodology used to prepare the expert opinion and the decision as to which specific personal data are processed, the Court has no influence whatsoever on the content of the expert opinion and no authority to issue instructions in this regard. Thus, the experts decide on essential aspects of the means.” (see BVwG case law of September 27, 2018, W214 2196366-2) The methodology for preparing the expert opinion is therefore to be made independently by the expert, not by the Court, because the Court relies on an expert precisely due to its own lack of specialized knowledge. The expert’s task is to assist the Court with specific technical expertise in determining the facts of the case. It therefore remains the expert’s responsibility “to select, based on their relevant expertise, the method best suited to clarifying the disputed factual issue(s) relevant to the court’s mandate.” This choice of method constitutes the core of the expert’s work, which is why, in general, the Court does not prescribe to experts which method(s) to use to fulfill the Court’s mandate. (See also the Supreme Court decision of October 8, 2025, 16 Ok 9/15g, RS0119439). This also includes the expert’s assessment and decision regarding which specific data—whether existing data, data yet to be determined, or existing data that must first be modified—should be used to fulfill the court’s mandate (see, in this regard, Supreme Court case law of October 12, 2004, 1 Ob 141/04y). In the present proceedings, it follows from the findings of fact under point C.2 that the Court’s order did not specify either a particular method or a specific instruction regarding which of the complainant’s data concerning health were to be collected for the purpose of fulfilling the Court’s order. Rather, the Court’s order to the second respondent essentially directed him to determine whether the expert opinion used in the proceedings before the Salzburg Regional Court (Case No.: 3 Cg 63/20a) had been prepared in accordance with professional standards. The complainant’s argument—that, in the course of preparing the expert opinion, only data concerning health pertaining to a specific region of the complainant’s body were to be processed—must be countered by pointing out, with reference to the aforementioned established case law of the highest court, it is solely up to the second respondent, in his capacity as a court-appointed expert, to make the decision regarding which method to use and which personal data concerning health he deems necessary for processing in order to fulfill the Court’s mandate. As is evident from the oral examination of the second respondent, he credibly argues that, in order to prepare a useful and meaningful expert opinion, the complainant’s medical history, as well as—due to the complainant’s classification as a pain patient—documents concerning other parts of the body may also be relevant. In response to a specific inquiry by the Data Protection Authority during the oral hearing regarding the relevance of medical records that were either created long before or only after the events under review in 2016, he reasonably states that “it is not always possible to determine exactly in advance, without precise knowledge of the medical facts,” which specific data may be relevant. It would not be appropriate for the first respondent to restrict the available data concerning health, since the second respondent must first assess for himself which information he considers relevant or irrelevant for the preparation of the expert opinion and ultimately uses. Since the second respondent cannot make such a preliminary assessment of the relevance of data it has not yet reviewed, this preliminary assessment cannot, by extension, be made by the first respondent either. For the same reasons, the Data Protection Authority is also precluded from making a decision on which data a court-appointed medical expert may request—and which it may not—in the performance of its judicial duties, since such authority is not derived from either the GDPR or the DSG and—given the DPA’s lack of medical expertise—would significantly impede, if not entirely prevent, the preparation of Court expert opinions. Therefore, if the appointing Court has not restricted the processing of the complainant’s personal data concerning health by the second respondent on its behalf for the purpose of preparing an expert opinion, this cannot be required of the first respondent either. Furthermore, the first respondent would thereby interfere with the expert’s Court-ordered mandate, as she would be making a decision on which specific data the expert is to process or not to process. However, as explained above, based on the Court’s order, only the second respondent, in his capacity as an expert, is authorized to make this decision. Under all these circumstances, no violation of the right to confidentiality by the first respondent can be established; therefore, the complaint on this point had to be dismissed as ruled. As is evident from the factual account in Section C.5., the second respondent disclosed anonymized data concerning health of the complainant to a neurologist in order to obtain a second opinion for quality assurance purposes during the preparation of the commissioned expert opinion. Anonymized data no longer constitutes personal data within the meaning of the GDPR, because a link to a natural person—and thus, in the present case, to the complainant—no longer exists and can no longer be established. However, since a violation of the right to confidentiality requires the existence of personal data, no violation of the right to confidentiality pursuant to Section 1 of the Data Protection Act (DSG) can be established in this case.However, since a violation of the right to confidentiality requires the existence of personal data, there can be no violation of the right to confidentiality under Section 1 of the DSG in this case. The complaint was therefore dismissed on this point. D.4. Conclusion Overall, the decision was therefore made in accordance with the ruling.

---
Generated by overview.legal · https://overview.legal/posts/353787 · 2026-09-09