DSB (Austria) - 2021-0.820.321

DSB (Austria) - 2021-0.820.321
Authority:	DSB (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 51(1) GDPR Article 57(1)(f) GDPR Article 77(1) GDPR §1 DSG §18(1) DSG §24(1) DSG §24(5) DSG
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	24.11.2021
Published:
Fine:	None
Parties:	Disziplinarrat der Österreichischen Ärztekammer
National Case Number/Name:	2021-0.820.321
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	[[:Category:{{{Original_Source_Language_1}}}|{{{Original_Source_Language_1}}}]] [[Category:{{{Original_Source_Language_1}}}]]
Original Source:	[{{{Original_Source_Link_1}}} {{{Original_Source_Name_1}}} (in {{{Original_Source_Language__Code_1}}})]
Initial Contributor:	n/a

The Austrian DPA (DSB) held that the Disciplinary Council of the Austrian Medical Association violated a data subject's right to secrecy by sharing their name to the doctor they reported to the body.

English Summary

Facts

The complainant is a data subject who learned a general practitioner was spreading misinformation about COVID-19 by displaying booklets containing non-scientific and partially conspirational information in their practice. The complainant reported the doctor to the Medical Association for Lower Austria, attaching a picture of the booklets as evidence. This body forwarded the complaint to the Disciplinary Council of the Austrian Medical Association to begin an inquiry into the matter.

The Council then notified the practitioner that was complained about about the inquiry. In doing so it attached the original (non-redacted) email from the complainant, de facto revealing their identity to the practitioner.

Thus, they complained to the Austrian DPA about a violation of their right to secrecy under §1 DSG.

Holding

The DSB assessed whether the Disciplinary Council of the Austrian Medical Association violated the complainant's right to secrecy by sharing their name to the doctor they reported to the body.

The Disciplinary Council of the Austrian Medical Association argued the transfer of personal data to the practitioner was lawful under §153(4) of the national 'Ärztegesetz' ('Doctor Law'). The DSB disagreed, stating the forwarding of the complainant's name does not comply with the principle of data minimisation.

Thus, the DSB held that the Disciplinary Council of the Austrian Medical Association violated a data subject's right to secrecy by sharing the email containing their name to the doctor they reported.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Page 1
Barichgasse 40-42
A-1030 Vienna
Tel .: + 43-1-52152 302560
Email: dsb@dsb.gv.at
GZ: D124.3487
Clerk: REDACTEDREDACTED
2021-0.820.321
REDACTEDREDACTED
Data protection complaint (confidentiality)
REDACTEDREDACTED / Disciplinary Council of the Austrian Medical Association
by email REDACTEDREDACTED
NOTICE
SPEECH
The data protection authority decides on the data protection complaint of REDACTEDREDACTED
(Complainant) of January 13, 2021 against the Disciplinary Council of the Austrian Medical Association
(Respondent) for a breach of the right to secrecy as follows:
- The appeal is allowed and it is found that the respondent denies
Has violated the complainant's right to secrecy by submitting the
Name of the complainant in the course of disciplinary proceedings to the accused doctor
forwarded.
Legal basis: Article 51 (1), Article 57 (1) (f) and Article 77 (1) of Regulation (EU) 2016/679
(General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of 4.5.2016 p. 1; §§ 1, 18
Paragraph 1 and 24 Paragraph 1 and Paragraph 5 of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999 as amended; §§ 151
Paragraph 4 and 153 Paragraph 4 of the Federal Act on the Practice of the Medical Profession and the
Professional representation of doctors (Ärztegesetz 1998 - ÄrzteG 1998), Federal Law Gazette I. No. 169/1998 as amended; § 17 des
General Administrative Procedure Act 1991 (AVG), Federal Law Gazette No. 51/1991 as amended.
Page 2
- 2 -
REASON
A. Arguments of the parties and course of the procedure
In its submission of January 13, 2021 and its opinion of
March 10, 2021 to the data protection authority essentially that the respondent had a
Email in which the complainant addressed to the competent medical association
Initiated disciplinary proceedings against a doctor due to possible misconduct,
forwarded unredacted to the doctor concerned as part of a file inspection. This is true
his email address but not his name has been deleted. Unlike the respondent
citing requires Section 153 (4) of the Doctors Act if interpreted in accordance with Union law and constitutional law
under no circumstances that personal data of the reporter as part of the file inspection for
Are to be made available. Section 52 (2) of the Code of Criminal Procedure permits in judicial criminal proceedings
to exclude the personal data of a reporter from the inspection of files. Nothing else could
apply to mere disciplinary proceedings. The identity of the reporter is also for the accused doctor
completely irrelevant. It was not the intention of the complainant to contact the specific doctor
accuse why he had given her name in brackets only as an example, he had many more
to general misconduct through dissemination of pseudoscientific and
want to point out conspiracy theoretic claims by doctors in times of a pandemic.
The respondent also had to assume that an unnecessary and avoidable
Disclosure of personal data is generally a disadvantage within the meaning of Section 17 (3) AVG.
The respondent replied with an opinion of February 11, 2021 summarized that
The complainant's message was forwarded to the disciplinary attorney in accordance with Section 150 ÄrtzeG 1998
which then submitted an application to the Disciplinary Board to conduct surveys
have. The accused was from the initiation of investigations according to § 151 Abs. 4 ÄrzteG 1998
stating the name of the investigator and the main reasons for suspicion
communicate. This was substantive by sending the complainant's email to
the accused doctor takes place, with the e-mail address of the complainant prior to the transmission
had been blackened. According to the Doctors Act, the respondent also has an obligation to do so
Guarantee of access to files, since Section 153 (4) DoctorsG 1998 regulates that the notification of the
Complainant to the accused doctor to this in a fair trial
make it possible to examine all allegations made against them and to take action on their own
Take defense. Section 17 AVG also standardizes such a legal obligation. One
There is no statutory exception to the inspection of files in the present case. It have
the complainant must also be aware that his data may be used for the
Execution of the suggested procedure would be processed.
Page 3
- 3 -
B. Subject matter of the complaint
Based on the submissions of the complainant, it emerges that the subject of the complaint is the question
is whether the respondent thereby exercising his right to secrecy
violated by submitting the complainant's name to the
forwarded the accused doctor.
C. Factual Findings
The complainant learned that a general practitioner in Amstetten was in her ordination
supposedly unscientific and partly conspiracy-theoretical views regarding COVID-19
disseminated by placing appropriate information at the reception desk for their patients
would have.
On March 13, 2020, the complainant reported the doctor's alleged misconduct by email
to the Medical Association for Lower Austria and attached a photo of the
Information that was required by the doctor at the reception desk.
The Medical Association for Lower Austria then forwarded this email to the disciplinary attorney,
which subsequently, based on the complainant's email, with the respondent
submitted an application for the investigator to conduct surveys.
In May 2020, the respondent informed the accused doctor about the implementation of
Surveys as part of a disciplinary procedure and informed her, sending the
E-mails from the complainant containing the allegations made against them.
The accused doctor did not request access to the files.
From the email sent, the name of the complainant was for the accused doctor
evident.
Assessment of evidence: The findings made are based on what is consistent in this respect
Arguments of the parties.
D. From a legal point of view, it follows:
According to Section 1, Paragraph 1 of the Data Protection Act, everyone has the right to secrecy about those who concern them
personal data insofar as there is a legitimate interest in it. The existence of one
such interest is excluded if data is due to their general availability or because of
their lack of traceability to the data subject not a claim to confidentiality
are accessible.
Page 4
- 4 -
The GDPR and in particular the principles anchored in it are for the interpretation of the law
to take into account confidentiality (see the decision of the DSB of October 31, 2018, GZ
DSBD123.076 / 0003-DSB / 2018).
In the case at hand, the scope of application of Section 1 (1) DSG is opened, since it is the
Name of the complainant undisputed about a personal date according to Art. 4 Z 1 GDPR
acts.
Restrictions on the right to secrecy are permitted in accordance with Section 1 (2) DSG if
personal data are used in the vital interest of the data subject
Affected party has given their consent (or in the terminology of the GDPR: consent) if a
qualified legal basis for the use exists, or if the use by
overriding legitimate interests of a third party are justified.
According to Section 1, Paragraph 2, last sentence, leg. Cit. may encroachment on the
The fundamental right to data protection can only be exercised in the mildest way that leads to the goal.
Based on the subject matter of the complaint, the question arises whether the respondent does
Unlawfully passed the name of the complainant on to the accused doctor.
The objective use of the data was not in the vital interest of the
Complainant and neither was his consent available.
Rather, the respondent bases the transfer of the proceedings, on the one hand, on §
151, Paragraph 4 of the Doctors Act 1998 and, on the other hand, the right to inspect files in accordance with Section 153, Paragraph 4 of the Doctors Act
1998 or § 17 AVG.
The provision of Section 151, Paragraph 4 of the ÄrzteG 1998 reads as follows ( emphasized by the
Data protection authority ):
§ 151. (4) If the disciplinary committee decides to conduct surveys, the chairman has
the investigating officer to carry out the surveys he deems necessary
instruct the accused, stating the name of the
Investigator and the main grounds for suspicion as well as the disciplinary attorney
communicate.
Insofar as the respondent relies on this provision, he fails to recognize that the
The name of the investigating officer is to be forwarded to the accused, but not that of the
Scoreboard. Also the name of the scoreboard is not one of the main reasons for suspicion
subsume or significantly for the clarification of the alleged misconduct, especially such
Misconduct was substantively based not on a doctor-patient relationship, but on oneself
on, information available in the doctor's office of the accused doctor relates to the COVID
19 pandemic relates.
Page 5
- 5 -
This information, which represents the alleged misconduct of the accused doctor,
were also documented by means of a photograph and by the complainant of his complaint
attached.
The forwarding of the complainant's name also does not comply with the principle of
Data minimization and is to be seen objectively as excessive, especially since the interference is not in the
the least possible type has been carried out (Section 1 (2) last sentence DSG). With constitutional
To proceed, the respondent would have the accused doctor about the essentials
Be able to report suspicious facts without disclosing the name of the complainant,
especially since the announcement of the name for the clarification of the alleged misconduct in the
present case is not required.
The respondent also cannot rely on the right to inspect files under Section 153 (4)
DoctorsG 1998 and § 17 AVG because - as stated - the transfer of the name is not in the
In the course of an inspection of the files requested by the accused doctor.
The use of the right to inspect files does not make a formal request, but it does
but a concrete request to inspect the files of a certain procedure (cf.
Hengstschläger / Leeb , AVG § 17, margin no. 6 (status 1.1.2014, rdb.at)). A specific one is therefore required
Request to inspect the files, which the accused doctor did not, however, and
was also not alleged by the respondent. Rather, the name of the
Complainant proactively by the respondent in the course of the communication according to § 151
Paragraph 4 of the Doctors Act and thus made available to the accused doctor. The judgment
however, the need to inspect the files is not incumbent on the respondent, but solely on the
Party, ie. the accused doctor (see Hengstschläger / Leeb , AVG § 17, margin no.3 (as of 01/01/2014,
rdb.at)).
The right to inspect files also does not pursue the purpose of proactively forwarding parts of the files to the parties
but should allow the parties to inspect the files - also in order to guarantee equality of arms
- only give the opportunity to gain direct insight into the results of the
To form an opinion yourself during the preliminary investigation process and thus to have precise knowledge of the course of the
Procedure and the basis for decision-making (see Hengstschläger / Leeb , AVG § 17, margin no.1
(As of January 1, 2014, rdb.at).
But even if the accused doctor had requested access to the files, it should still be noted that
Page 6
- 6 -
Section 17 (3) AVG provides for certain restrictions on this right of inspection. Excepted from the
Inspection are file components in particular if the inspection is certain legitimate
Conflicting interests, whereby the Respondent has the interest of the party in the
Inspection of files with regard to their purpose against the legitimate interests of other parties or third parties
(here: the complainant) has to weigh up in the individual case (cf. for example the decision of the VwGH of
May 22, 2012, 2009/04/0187 and from April 9, 2013, 2011/04/0207). Objective, however, was on that
Restrictions of Section 17 (3) AVG and those made by the respondent
Consideration, in the absence of a file inspection by the accused doctor, not to go into detail.
As a result, the respondent's disclosure of his name creates a
Violation of the complainant's right to secrecy and was thus
to decide according to the ruling.
Legal remedies
You can lodge a written complaint against this notification within four weeks of delivery
to the Federal Administrative Court. The complaint is with the data protection authority
bring in and must
- the name of the contested decision (GZ, subject)
- the name of the authority concerned,
- the reasons on which the allegation of illegality is based,
- the desire as well
- the information required to assess whether the complaint has been submitted in good time,
contain.
The data protection authority has the option to either through within two months
The preliminary decision on the complaint to change your decision or the complaint with the files of the
Procedure to be submitted to the Federal Administrative Court .
The complaint against this decision is subject to a fee. The fixed fee for a
the corresponding entry including attachments is 30 euros . The fee is stating the
To be paid for the purpose of use to the account of the Austrian tax office.
The fee is generally to be transferred electronically using the “tax office payment” function. as
The recipient is to indicate the Austrian Tax Office - Special Responsibilities Office or
(IBAN: AT83 0100 0000 0550 4109, BIC: BUNDATWW). Furthermore they are
Tax number / tax account number 10 999/9102, the tax type "EEE complaint fee", the
State the date of the decision as the period and the amount.
Page 7
- 7 -
If the e-banking system of your bank does not have the "tax office payment" function,
the eps procedure can be used in FinanzOnline. From an electronic transfer can
can only be waived if no e-banking system has been used so far (even if the
Taxpayer has an internet connection). Payment must then be made by means of
Payment instructions take place, paying attention to the correct allocation. additional Information
can be obtained from the tax office and in the manual “ Electronic payment and reporting for payment of
Self-assessment taxes ".
The fee is paid when the complaint is lodged with the data protection authority
by means of a payment receipt to be added to the entry or a printout of which has been made
Evidence of issuing a payment order . If the fee is not or not completely
is paid, a report is sent to the responsible tax office .
Has a timely and admissible complaint to the Federal Administrative Court
suspensive effect . The suspensive effect can be excluded in the ruling of the decision
have been or have been excluded by a separate decision.
November 24, 2021
For the head of the data protection authority:
REDACTEDREDACTED