BVwG - W171 2298465-1

BVwG - W171 2298465-1

Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 4 GDPR Article 4(15) GDPR Article 5(1) GDPR Article 6(1)(f) GDPR Article 6(4) GDPR Article 9 GDPR Article 14 GDPR § 1 DSG
Decided:	30.04.2025
Published:	01.07.2025
Parties:
National Case Number/Name:	W171 2298465-1
European Case Law Identifier:	ECLI:AT:BVWG:2025:W171.2298465.1.00
Appeal from:
Appeal to:	Appealed - Confirmed
Original Language(s):	German
Original Source:	RIS (in German)
Initial Contributor:	Annkathrin.a.dix

A court held that an ambulance service unlawfully processed a patient’s personal data to send a letter about donations. The data was originally obtained for providing emergency services and constituted sensitive data under Article 9(1) GDPR

English Summary

Facts

On 10 November 2023, an ambulance service (the controller) transported a patient (the data subject) during a medical emergency. In the course of this operation, the controller collected personal data through the data subject's e-card. This included the data subject’s name and address. The stated purpose for this initial data collection was to provide emergency services.

On 11 December 2023, the controller sent a postal donation request to the data subject for paramedic training, referencing the prior emergency transport. On 26 December 2023, the data subject filed a complaint with the DPA. They argued that the data used included health data within the meaning of Article 4(15) GDPR, meaning the controller could not rely on legitimate interests (Article 6(1)(f) GDPR) to further process the data. Moreover, the processing for direct marketing without consent violated the GDPR and their right to confidentiality of their personal data.

In a response dated 13 March 2024, the controller argued that the change of purpose was permissible under Article 6(4) GDPR. The further processing complied with Article 14 GDPR because said change was noted in the footer of the donation letter. Furthermore, the controller contended that no special category data (Article 9 GDPR) was processed.

On 1 July 2024, the DPA upheld the complaint. It found that the further processing of the data subject’s information for the purpose of sending a donation request violated their right to confidentiality under National data protection law (DSG) and was unlawful under the GDPR. Strikingly, the DPA found that the data constituted personal data under Article 4(1) GDPR and also as health data under Article 4(15) GDPR. None of the exemptions under Article 9(2) GDPR applied, rendering the further processing unlawful under Article 9(1) GDPR. Even if the data in question had not qualified as health data, the DPA found that the controller had violated the principles of lawfulness, fairness, and purpose limitation under Article 5(1)(a) and (b) GDPR; the further processing of data for a new purposes (i.e. marketing) was incompatible with the original purpose. The DPA also held that the controller failed to meet the conditions, and that referencing the new purpose only in the footer of the letter was insufficient to meet the controller’s duty as per Article 14 GDPR.

The controller appealed the DPA’s decision in full, disputing all findings.

Holding

The Federal Administrative Court dismissed the appeal and upheld the DPA’s decision. However, it limited its assessment strictly to the lawfulness of the processing under Article 9(2) GDPR. The Court did not examine the DPA’s alternative reasoning concerning the hypothetical processing of non-sensitive personal data under Articles 5, 6, or 14 GDPR.

The Court agreed that the controller had processed health data within the meaning of Article 4(15) GDPR, as the combination of the data subject’s name, address, and reference to a medical rescue operation implied information about their health status. Referring to CJEU judgments C-21/23 (Lindenapotheke) and C-184/20, the Court reiterated that health data must be interpreted broadly to include personal data from which sensitive health information can be inferred. Since no valid exception under Article 9(2) GDPR applied (the data subject had not given consent, and none of the other legal bases were applicable), the processing was found to be unlawful under Article 9(1) GDPR.

The Court did note, however, that the DPA’s decision was too broadly worded; while the combination of name, address, and reference to treatment rendered the data sensitive, name and address alone do not constitute health data within the meaning of Article 9(1) GDPR. The Court thus emphasised that only the combined context rendered the data sensitive and required more precise legal framing. Ultimately, the Court held that the controller’s processing breached the data subject’s right to confidentiality under Section 1 DSG, as the donation letter established a clear and direct link to the individual’s use of emergency medical services. The DPA’s decision was thus upheld.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Decision Date

April 30, 2025

Standard

B-VG Art. 133 Para. 4
DSG §1
GDPR Art. 4
GDPR Art. 4 Z15
GDPR Art. 9

B-VG Art. 133 today B-VG Art. 133 valid from January 1, 2019, to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017 B-VG Art. 133 valid from January 1, 2019, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 valid from May 25, 2018, to December 31, 2018, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 valid from August 1, 2014 to May 24, 2018 last amended by BGBl. I No. 164/2013 B-VG Art. 133 valid from January 1, 2014 to July 31, 2014 last amended by BGBl. I No. 51/2012 B-VG Art. 133 valid from January 1, 2004 to December 31, 2013 last amended by BGBl. I No. 100/2003 B-VG Art. 133 valid from January 1, 1975 to December 31, 2003 last amended by BGBl. No. 444/1974 B-VG Art. 133 valid from December 25, 1946 to December 31, 1974 last amended by BGBl. No. 211/1946 B-VG Art. 133 valid from December 19, 1945 to December 24, 1946, last amended by StGBl. No. 4/1945 B-VG Art. 133 valid from January 3, 1930 to June 30, 1934

DSG Art. 1 § 1 today DSG Art. 1 § 1 valid from January 1, 2014, last amended by BGBl. I No. 51/2012 DSG Art. 1 § 1 valid from January 1, 2000 to December 31, 2013

Ruling

W171 2298465-1/8E

IN THE NAME OF THE REPUBLIC!

The Federal Administrative Court, with Judge Mag. Gregor MORAWETZ, MBA as presiding judge, as well as Mag. Huberta MAITZ-STRASSNIG and Mag. Dr. Wolfgang GORICNIK, M.B.L as expert lay judge on the complaint of XXXX , represented by Höhne, In der Maur & Partner Rechtsanwälte GmbH & Co KG, co-participating party XXXX , against the decision of the data protection authority dated 01.07.2024, XXXX after a closed session in a data protection matter rightly ruled:The Federal Administrative Court, chaired by Judge Mag. Gregor MORAWETZ, MBA as well as Mag. Huberta MAITZ-STRASSNIG and Mag. Dr. Wolfgang GORICNIK, M.B.L., as an expert lay judge, ruled on the appeal by roman 40, represented by Höhne, In der Maur & Partner Rechtsanwälte GmbH & Co KG, co-participating party roman 40, against the decision of the Data Protection Authority dated July 1, 2024, roman 40, after a closed hearing in a data protection matter, rightly ruled:

A) The appeal is dismissed with the proviso that paragraph 1 of the contested decision should read as follows:

The appeal is granted, and it is determined that the respondent violated the complainant's right to confidentiality by further processing the medical record of an ambulance transport in connection with treatment, which medical record he obtained as part of her care during a rescue operation in November 2023, to send a postal donation letter.

B) The appeal is admissible pursuant to Article 133, Paragraph 4 of the Federal Constitutional Act. B) The appeal is admissible pursuant to Article 133, Paragraph 4 of the Federal Constitutional Act.

Text

Reasons for the Decision:

I. Course of proceedings: Roman one. Course of proceedings:

The co-participating party (hereinafter referred to as the mP) was transported on November 10, 2023, in an ambulance belonging to the complaining party (hereinafter referred to as the bP). During this time, the bP collected data from the mP.

In a letter dated December 11, 2023, the bP thanked the mP for the trust placed in it "...on the way to and from your treatment..." In the subsequent paragraphs of the letter, the mP was requested to make a donation for the training of paramedics.

In a letter dated December 26, 2023, the MP filed a complaint with the Data Protection Authority, enclosing the donation letter in question dated December 11, 2023. The complaint essentially stated that the further processing of personal data for the creation of the submitted donation letter, which had been extracted from the e-card during a rescue operation, violated the GDPR, or rather, the right to confidentiality of their personal data. The MP had not given consent for this.

In a statement dated March 13, 2024, the bP justified itself by arguing that it was dependent on donations and that the data was collected for documentation purposes and for billing insurance providers. The collected data (name and address) were permissible subject to a change of purpose for sending the donation letters, in compliance with the criteria of Art. 6 (4) GDPR. The further processing was therefore legally compliant. The mP was informed of the change of purpose in the footer of the letter dated December 11, 2023, in accordance with Article 14 of the GDPR. In a statement dated March 13, 2024, the bP justified this by stating that it relies on donations and that the data is collected for documentation purposes and for billing insurance providers. The collected data (name and address) were subjected to a permissible change of purpose for sending donation letters, in compliance with the criteria of Article 6, Paragraph 4, GDPR. The subsequent processing was therefore legally compliant. The mP was informed of the change of purpose in the footer of the letter dated December 11, 2023, in accordance with Article 14 of the GDPR.

During a hearing, the MP further argued that her data constituted health data within the meaning of Article 9 (1) GDPR and was therefore not accessible to a balancing of interests pursuant to Article 8 (1) (f) GDPR. During a hearing, the MP further argued that her data constituted health data within the meaning of Article 9 (1) GDPR and was therefore not accessible to a balancing of interests pursuant to Article 8 (1) (f) GDPR.

In the contested decision of the DSB dated July 1, 2024, the DSB upheld the MP's complaint and found that the further processing of the MP's data to create a donation letter had violated her right to confidentiality. The decisive factor for this decision was that the processed data had to be qualified as "personal data" within the meaning of Article 4, Paragraph 1 GDPR and had also to be regarded as health data within the meaning of Article 4, Paragraph 15. Although the primary processing was covered by Section 1, Paragraph 2 of the Data Protection Act (DSG), the further processing of the personal health data (secondary processing) was not subject to any exceptions under Article 9, Paragraph 2 GDPR and was therefore not lawful. In the contested decision of the DSB dated July 1, 2024, the DSB upheld the mP's complaint and found that the further processing of the mP's data to create a donation letter had violated her right to confidentiality. The decisive factor for this decision was that the processed data had to be qualified as "personal data" within the meaning of Article 4, Paragraph 1 GDPR and had also to be regarded as health data within the meaning of Article 4, Paragraph 15. Although primary processing is covered by paragraph 1, paragraph 2, of the Data Protection Act (DSG), the further processing of personal health data (secondary processing) is not subject to any exceptions under Article 9, paragraph 2, GDPR and is therefore not lawful.

Even if one assumes that no health data exists (and therefore only that personal data exists within the meaning of Article 4, paragraph 1), further processing is inadmissible, since the existence of an overriding interest pursuant to Article 6, paragraph 1, letter f, GDPR alone is not sufficient; all other principles of Article 5 GDPR must also be observed. In the present case, the principle under Article 5 (1) (a) and (b) GDPR was violated, and thus the data processing in question was unlawful under Article 6 (1) (f) GDPR. Even if one does not assume the existence of health data (and therefore only the existence of personal data within the meaning of Article 4 (1)), further processing is inadmissible, since the existence of an overriding interest under Article 6 (1) (f) GDPR alone is not sufficient; all other principles of Article 5 GDPR must also be observed. In the present case, the principle under Article 5 (1) (a) and (b) GDPR was violated, and thus the data processing in question was unlawful under Article 6 (1) (f) GDPR.

The present complaint, filed in a timely manner by the bP, was directed against this decision and is essentially based on the fact that the data processed as part of the change of purpose does not constitute a special category of personal data. It was ensured that the department that processed the data had not received any of the mP's health data and only knew that she was a client of the bP. A context regarding the mP's health could not be established, and therefore the data was not health data. Since only a portion of the data set, not the entire data set, was subject to a change of purpose, the DPO misjudged the legal situation.

In the context of the DPO's alternative approach (assuming that no health data existed), Article 6 (4) GDPR must be examined. The criteria specified therein were all met, and the GS also acted in good faith. Furthermore, the mP's information about the change of purpose of her data was timely, as it was brought to her attention at the same time as further processing. Therefore, there was no violation of the right to confidentiality, and the appeal was requested. If appropriate, the appeal should be upheld and the matter referred back to the authority of first instance for a decision.
In the context of the DPO's alternative approach (assuming that no health data exists), Article 6, Paragraph 4, GDPR should be examined. The criteria specified therein are all met, and the GS also acts in good faith. Furthermore, the information provided to the mP about the change in the purpose of their data was timely, as it was communicated to them at the same time as further processing. Therefore, there has been no violation of the right to confidentiality, and the appeal is being upheld. If appropriate, the appeal should be upheld and the matter referred back to the authority of first instance for a decision.

II. The Federal Administrative Court considered: Roman II. The Federal Administrative Court considered:

II.1. Findings: Roman II.1. Findings:

1.1 In November 2023, during a rescue operation, at least the name and address of the mP were recorded by the bP for billing the costs to the social insurance provider and for documentation purposes.

1.2. From this existing data set, the name and address were further processed to address a donation letter to the mP.

1.3. In the donation letter subsequently dated December 11, 2023, the printed phrase "... I would like to thank you for the trust you have placed in me on the way to and from your treatment." refers to a service previously provided by the bP in connection with transporting the mP to and from treatment.

1.4. The mP did not consent to the further processing of her data.

1.5. There was no necessity for the data processing in question to assert the mP's rights under labor or social law.

1.6. There was no regular contact between the bP and the mP.

1.7. The mP had not previously made the data in question public.

1.8. The processing of the data was not in the public interest.

II.2. Assessment of evidence: Roman II.2. Assessment of evidence:

Regarding 1.1.: The finding corresponds to the previous submissions of both parties and is conclusively derived from the available file contents and the contested decision of the DSB dated July 1, 2024.

Regarding 1.2.: The change of purpose of the data collected by the bP with regard to the name and address is evident from the file contents and is undisputed in the proceedings.

Regarding 1.3.: The finding in 1.3. This is evident from the letter from the Federal Administrative Court (BVwGG) to the Federal Administrative Court (MP) dated December 11, 2023, submitted by the MP in the proceedings, and the wording used in the first paragraph of this letter.

Regarding 1.4.: The lack of consent from the MP to the further processing of her data is evident from the MP's undisputed submissions in this regard in the administrative proceedings, and this was also the basis for the administrative decision.

Regarding 1.5.-1.8.: The above findings are based on the fact that no indications for such positive findings emerged in the proceedings.

II.3. Legal assessment: Roman II.3. Legal assessment:

II.3.1. Jurisdiction: Roman II.3.1. Jurisdiction:

According to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court (Bundesverwaltungsgericht) decides by a single judge, unless federal or state law provides for decisions by panels. Pursuant to Section 27 of the Data Protection Act (DSG), as amended, the Federal Administrative Court decides by senate in proceedings concerning appeals against decisions based on violations of the duty to provide information pursuant to Section 24, Paragraph 7, and the data protection authority's duty to make a decision. The senate consists of a presiding judge and one expert lay judge each from the circle of employers and one from the circle of employees. Pursuant to Section 6 of the Federal Administrative Court Act (BVwGG), the Federal Administrative Court decides by a single judge, unless federal or state law provides for decisions by senates. Pursuant to Section 27 of the Data Protection Act (DSG), as amended, the Federal Administrative Court decides by senate in proceedings concerning appeals against decisions based on violations of the duty to provide information pursuant to Section 24, Paragraph 7, and the data protection authority's duty to make a decision. The senate consists of a presiding judge and one expert lay judge each from the circle of employers and one from the circle of employees.

The procedure of the administrative courts, with the exception of the Federal Finance Court, is governed by the Administrative Courts Act (VwGVG), Federal Law Gazette I 2013/33, as amended by Federal Law Gazette I 2013/122 (Section 1, leg.cit.). Pursuant to Section 58 (2) of the Administrative Courts Act (VwGVG), any conflicting provisions already promulgated at the time of entry into force of this federal law remain in force. The procedure of the administrative courts, with the exception of the Federal Finance Court, is governed by the Administrative Courts Act (VwGVG), Federal Law Gazette Roman one 2013/33, as amended by Federal Law Gazette Roman one 2013/122 (Section 1, leg.cit.). Pursuant to Section 58 (2) of the Administrative Courts Act (VwGVG), any conflicting provisions already promulgated at the time of entry into force of this federal law remain in force.

According to Section 17 of the Administrative Court Act (VwGVG), unless otherwise provided in this federal law, the provisions of the Administrative Court Act (AVG) with the exception of Sections 1 to 5 and Part IV, the provisions of the Federal Fiscal Code (BAO), Federal Law Gazette No. 194/1961, the Agricultural Procedure Act (AgrVG), Federal Law Gazette No. 173/1950, and the Civil Service Procedure Act 1984 (DVG), Federal Law Gazette No. 29/1984, and, in addition, those procedural provisions in federal or state laws that the authority has applied or should have applied in the proceedings before the administrative court prior to the proceedings, shall apply mutatis mutandis to the proceedings concerning complaints pursuant to Article 130, Paragraph 1, B-VG. to 5 and Part IV of Roman Law, the provisions of the Federal Fiscal Code (BAO), Federal Law Gazette No. 194 of 1961, the Agricultural Procedure Act (AgrVG), Federal Law Gazette No. 173 of 1950, and the Civil Service Procedure Act 1984 (DVG), Federal Law Gazette No. 29 of 1984, and, in addition, those procedural provisions in federal or state laws that the authority has applied or should have applied in the proceedings before the administrative court prior to the proceedings, shall be applied mutatis mutandis.

According to Section 28 (1) of the Administrative Court Act (VwGVG), the administrative court must resolve the case by judgment, unless the appeal is to be dismissed or the proceedings are to be discontinued. According to Section 31, Paragraph 1 of the Administrative Court Act (VwGVG), decisions and orders are made by resolution unless a judgment is required. According to Paragraph 28, Paragraph 1 of the Administrative Court Act (VwGVG), the administrative court must resolve the case by resolution unless the appeal is dismissed or the proceedings are discontinued. According to Paragraph 31, Paragraph 1 of the Administrative Court Act (VwGVG), decisions and orders are made by resolution unless a judgment is required.

According to Section 28, Paragraph 2 of the Administrative Court Act (VwGVG), the administrative court must decide on the merits of appeals pursuant to Article 130, Paragraph 1, Item 1 of the Federal Constitutional Act (B-VG) if (1) the relevant facts are established or (2) the determination of the relevant facts by the administrative court itself is in the interest of expeditiousness or is associated with significant cost savings. According to Section 28, Paragraph 2 of the Administrative Court Act (VwGVG), the administrative court must decide on the merits of appeals pursuant to Article 130, Paragraph 1, Item 1 of the Federal Constitutional Act (B-VG) if (1) the relevant facts are established or (2) the determination of the relevant facts by the administrative court itself is in the interest of expeditiousness or is associated with significant cost savings.

Therefore, the Senate has jurisdiction over the present case.

II.3.2. On Point A) Roman II.3.2. On Decision Point A)

II.3.2.1. On the legal situation in the present complaint proceedings: Roman II.3.2.1. On the legal situation in the present complaint proceedings:

Section 1 of the Data Protection Act reads in part: Paragraph one of the Data Protection Act reads in part:

Fundamental right to data protection

Section 1. (1) Everyone has the right to confidentiality of personal data concerning him or her, in particular with regard to respect for his or her private and family life, provided that there is a legitimate interest in doing so. The existence of such an interest is excluded if data is not accessible to a claim of confidentiality due to its general availability or its inability to trace back to the data subject. Paragraph one. (1) Everyone has the right to confidentiality of personal data concerning him or her, in particular with regard to respect for his or her private and family life, provided that there is a legitimate interest in doing so. The existence of such an interest is excluded if data cannot be subject to a claim to confidentiality due to their general availability or their inability to trace them back to the data subject.

(2) To the extent that the use of personal data is not in the vital interest of the data subject or with their consent, restrictions on the right to confidentiality are only permissible to protect the overriding legitimate interests of another person, and in the case of interventions by a state authority, only on the basis of laws that are necessary for the reasons stated in Article 8 (2) of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210/1958. Such laws may only provide for the use of data that, by their nature, are particularly worthy of protection to safeguard important public interests and must simultaneously establish appropriate safeguards to protect the interests of data subjects in confidentiality. Even in the case of permissible restrictions, the interference with the fundamental right may only be carried out in the mildest way that achieves the objective. (2) Insofar as the use of personal data is not in the vital interest of the data subject or with his consent, restrictions on the right to confidentiality are only permissible to protect the overriding legitimate interests of another person, and in the case of interference by a state authority only on the basis of laws that are necessary for the reasons stated in Article 8, paragraph 2, of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), Federal Law Gazette No. 210 of 1958. Such laws may only provide for the use of data which, by their nature, are particularly worthy of protection to protect important public interests and must at the same time establish appropriate guarantees for the protection of the data subject's interests in confidentiality. Even in the case of permissible restrictions, the interference with the fundamental right may only be carried out in the mildest way that achieves the objective.

(3) …

(4)…

Article 4 of the GDPR reads in part:

For the purposes of this Regulation, the following definitions shall apply:

1.

“Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

2.

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;

3.

“Restriction of processing” means the marking of stored personal data with the aim of limiting their future processing;

4.

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;

5.-10. (…)

11.

“Consent” of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

12.-14. (…)

15.

“Data concerning health” means personal data relating to the physical or mental health of a natural person, including the provision of healthcare services, which reveal information about his or her health status;

16.-26. (…)

Article 9 of the GDPR reads in part:

(1) The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation, shall be prohibited.

(2) Paragraph 1 shall not apply in the following cases:

a)

The data subject has explicitly consented to the processing of those personal data for one or more specified purposes, unless Union or Member State law does not allow the prohibition in paragraph 1 to be lifted by the data subject's consent;

b)

Processing is necessary for the controller or the data subject to exercise their rights and fulfil their obligations under labour law, social security and social protection law, insofar as this is permitted by Union or Member State law or by a collective agreement under Member State law which provides appropriate safeguards for the fundamental rights and interests of the data subject;

c)

Processing is necessary to protect the vital interests of the data subject or of another natural person and the data subject is physically or legally incapable of giving consent;

d)

Processing is carried out on the basis of appropriate safeguards by a politically, a foundation, association, or other non-profit organization with an ideological, religious, or trade union orientation, within the scope of its legitimate activities, provided that the processing relates exclusively to the members or former members of the organization or to persons who maintain regular contact with it in connection with the purpose of its activities, and the personal data are not disclosed externally without the consent of the data subject;

e)

the processing relates to personal data that the data subject has manifestly made public;

f)

the processing is necessary for the establishment, exercise, or defense of legal claims or in the course of judicial proceedings;

g)

the processing is necessary for reasons of substantial public interest on the basis of Union or Member State law which is proportionate to the aim pursued, respects the essence of the right to data protection, and provides for appropriate and specific measures to safeguard the fundamental rights and interests of the data subject;

h)

the processing is necessary for the purposes of preventive healthcare or occupational health; necessary for the assessment of the employee's ability to work, for medical diagnosis, health or social care or treatment, or for the management of health or social systems and services on the basis of Union or Member State law or on the basis of a contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

i)

processing is necessary for reasons of public interest in the area of public health, such as protection against serious cross-border threats to health or to ensure high standards of quality and safety of healthcare, medicinal products and medical devices, on the basis of Union or Member State law which provides for appropriate and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy; or

j)

processing is necessary on the basis of Union or Member State law which is proportionate to the aim pursued, respects the essence of the right to data protection and provides for appropriate and specific measures to safeguard the fundamental rights and interests of the data subject person, for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1).

(3) The personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 if those data are processed by professional personnel or under their responsibility and that professional personnel is subject to an obligation of professional secrecy under Union or Member State law or the rules of national competent authorities, or if the processing is carried out by another person who is also subject to an obligation of professional secrecy under Union or Member State law or the rules of national competent authorities.

(4) Member States may introduce or maintain additional conditions, including limitations, where the processing of genetic, biometric, or health data is concerned.

II.3.2.2. In light of the above, the following conclusions apply to the case at issue: Roman II.3.2.2. In light of the above, the following conclusions apply to the case at issue:

II.3.2.2.1. The data processed by the bP, specifically the name, address, and the information that the mP was cared for during a rescue operation, are already unequivocally to be qualified as personal data according to the wording of the statutory provision of Article 4, Paragraph 1 GDPR. However, this also constitutes health data within the meaning of Article 4, Paragraph 15 GDPR, as will be discussed later. Roman II.3.2.2.1. The data processed by the bP, specifically the name, address, and the information that the mP was cared for during a rescue operation, are already unequivocally to be qualified as personal data according to the wording of the statutory provision of Article 4, Paragraph 1 GDPR. However, this also constitutes health data within the meaning of Article 4, Paragraph 15 GDPR, as will be discussed later.

II.3.2.2.2. This raises the question of whether the processed data also fall into the category of health data within the meaning of Article 4(15) of the GDPR. While the DPO affirms this after a thorough examination, this is again questioned and ultimately denied in the appeal. Roman II.3.2.2.2. This raises the question of whether the processed data also fall into the category of health data within the meaning of Article 4(15) of the GDPR. While the DPO affirms this after a thorough examination, this is again questioned and ultimately denied in the appeal.

Article 4(15) of the GDPR defines the technical term "health data" as personal data relating to the physical or mental health of a natural person, including the provision of healthcare services, and from which information about that person's health status can be derived. This term is to be interpreted broadly. This includes, for example, descriptions of conditions, findings, events, illnesses, and information on alcohol, medication, and drug use or abuse, as well as on therapies. Both current and past data are recorded, regardless of whether they are still current. The origin of the data is irrelevant (RIS-Justiz RS0132575). Article 4, Item 15 GDPR defines the technical term "health data" as personal data relating to the physical or mental health of a natural person, including the provision of healthcare services, and from which information about their state of health can be derived. The term should be interpreted broadly. This includes, for example, descriptions of conditions, findings, events, illnesses, and information on alcohol, medication, and drug use or abuse, as well as on therapies. This includes both current and past data, regardless of whether they are still current. The origin of the data is irrelevant (RIS-Justiz RS0132575).

In its landmark decision of October 4, 2024, Case C-21/23 (Lindenapotheke), the ECJ also clarified that, for example, the sale of non-prescription but pharmacy-only medicines involves the processing of health data. This understanding of the scope of Article 9 of the GDPR can therefore be seen as quite broad.

Furthermore, according to the case law of the ECJ, data from which sensitive information can be indirectly derived by means of a reasoning process, deduction, or comparison also falls within the general prohibition on processing in Article 9 (1) GDPR (ECJ 1 August 2022, C-184/20). Furthermore, according to the case law of the ECJ, data from which sensitive information can be indirectly derived by means of a reasoning process, deduction, or comparison also falls within the general prohibition on processing in Article 9 (1) GDPR (ECJ 1 August 2022, C-184/20).

In this specific case, at least the following data was used for processing:

- Name of the mP

- Address of the mP and

- Information that the mP had been cared for during a rescue operation

The latter information conclusively indicates that the mP had required the assistance of an emergency service in the past, which in turn suggests that the mP had limited health. A connection between the name, address, and the fact that the mP required an emergency service is straightforward and easy to establish, since the bP explicitly referred to the service provided by the bP in her letter of December 11, 2023.

In the present case, therefore, in the court's legal opinion, this constitutes processing of health data within the meaning of Article 4, Paragraph 15 of the GDPR.

II.3.2.2.3. Pursuant to Article 9(1) GDPR, the processing of personal health data is prohibited. It must be examined whether one of the exceptions listed in paragraph 2 of the leg. cit. applies. Roman II.3.2.2.3. Pursuant to Article 9(1) GDPR, the processing of personal health data is prohibited. It must be examined whether one of the exceptions listed in paragraph 2 of the leg. cit. applies.

II.3.2.2.3a.: Consent to the processing of the personal data mentioned was not given (see finding 1.4.). Roman II.3.2.2.3a.: Consent to the processing of the personal data mentioned was not given (see finding 1.4.).

II.3.2.2.3b.: The processing in question was not necessary or required to pursue a right arising from labor or social law. There is no such connection (see finding 1.5.).
II.3.2.2.3c.: During the proceedings, it neither emerged that the vital interests of the mP had to be protected, nor that the mP would have been unable to consent to such data processing. Roman II.3.2.2.3b.: The processing in question was not necessary or required to pursue a right arising from labor or social law. There is no such connection (see finding 1.5.).
II.3.2.2.3c.: During the proceedings, it neither emerged that the vital interests of the mP had to be protected, nor that the mP would have been unable to consent to such data processing.

II.3.2.2.3d.: The file does not indicate that the MP could ever have been a member of the bP's organization, nor were there regular contacts related to the purpose of the bP's activities (1.6.). Roman II.3.2.2.3d.: The file does not indicate that the MP could ever have been a member of the bP's organization, nor were there regular contacts related to the purpose of the bP's activities (1.6.).

II.3.2.2.3e.: There is no evidence that the MP has obviously made her personal data public (1.7.). Roman II.3.2.2.3e.: There is no evidence that the MP has obviously made her personal data public (1.7.).

II.3.2.2.3f.: The initial data collection (primary processing of the data) at that time was, as the official proceedings have shown, lawful and sufficient to enable settlement with the social insurance provider. However, the further processing in question was not necessary for the assertion, exercise, or defense of legal claims or for actions by the courts in the course of their judicial activities. Roman II.3.2.2.3f.: The initial data collection (primary processing of the data) at that time was, as the official proceedings have shown, lawful and sufficient to enable settlement with the social insurance provider. However, the further processing in question was not necessary for the assertion, exercise, or defense of legal claims or for actions by the courts in the course of their judicial activities.

II.3.2.2.3g.: A public interest in processing the health data did not emerge during the procedure (1.8.). Roman II.3.2.2.3g.: A public interest in processing the health data did not emerge during the procedure (1.8.).

II.3.2.2.3h.: Secondary processing was not necessary for the purposes stated in Article 9 (2) (h) GDPR. Roman II.3.2.2.3h.: Secondary processing was not necessary for the purposes stated in Article 9 (2) (h) GDPR.

II.3.2.2.3i.: A public interest in processing the health data did not emerge during the procedure. Roman II.3.2.2.3i.: A public interest in processing the health data did not emerge during the procedure.

II.3.2.2.3j.: A public interest in processing the health data did not emerge during the procedure. Roman II.3.2.2.3j.: A public interest in processing the health data did not emerge during the procedure.

II.3.2.3.: Accordingly, none of the exceptions listed exhaustively in Article 9 (2) GDPR are met, and the further processing of the health data in question is unlawful. Therefore, by further processing the mP's health data, the bP has violated her right to confidentiality. Roman II.3.2.3.: Accordingly, none of the exceptions listed exhaustively in Article 9 (2) GDPR are met, and the further processing of the health data in question is unlawful. Therefore, by further processing the mP's health data, the bP has violated her right to confidentiality.

II.4.: In the court's legal opinion, the administrative ruling under point 1. was too broad, as the name and address data do not constitute sensitive data in themselves within the meaning of Article 9 (1) GDPR, but are nevertheless covered by the wording of the administrative decision. The ruling therefore needed to be narrower. II.4.: In the court's legal opinion, the administrative ruling under point 1. was too broad, as the name and address data do not constitute sensitive data in themselves within the meaning of Article 9 (1) GDPR, but are nevertheless covered by the wording of the administrative decision. The ruling therefore needed to be narrower.

II.5.: Pursuant to Section 24 (1) VwGVG, the administrative court must hold a public oral hearing upon request or, if it deems it necessary, ex officio. Roman II.5.: According to Section 24, Paragraph 1, of the Administrative Court Act (VwGVG), the administrative court must hold a public oral hearing upon request or, if it deems it necessary, ex officio.

According to Section 24, Paragraph 4 of the Administrative Court Act (VwGVG), the administrative court may – unless otherwise provided by federal or state law – dispense with a hearing notwithstanding a party's request if the records indicate that the oral discussion is unlikely to provide further clarification of the legal matter, and neither Article 6, Paragraph 1 of the ECHR nor Article 47 of the Charter of Fundamental Rights preclude the dispensation of the hearing.According to Section 24, Paragraph 4, of the Administrative Court Act (VwGVG), the administrative court may – unless otherwise provided by federal or state law – dispense with a hearing notwithstanding a party's request if the records indicate that the oral discussion is unlikely to provide further clarification of the legal matter, and neither Article 6, Paragraph 1 of the ECHR nor Article 47 of the Charter of Fundamental Rights preclude the dispensation of the hearing.

In the present case, the omission of an oral hearing can be based on the fact that the facts of the case were clear from the file. The Federal Administrative Court was required to rule exclusively on a point of law (cf. ECtHR June 20, 2013, Appl. No. 24510/06, Abdulgadirov/AZE, paras. 34 et seq.). According to the case law of the Constitutional Court, an oral hearing may also be omitted if the facts are undisputed and the legal issue is not particularly complex (VfSlg. 17,597/2005; VfSlg. 17,855/2006; most recently, for example, VfGH June 18, 2012, B 155/12). In the present case, the omission of an oral hearing can be based on the fact that the facts of the case were clear from the file. The Federal Administrative Court had to rule exclusively on a point of law (see ECtHR 20.06.2013, Appl. No. 24510/06, Abdulgadirov/AZE, paras. 34 et seq.). According to the case law of the Constitutional Court, an oral hearing may be omitted if the facts are undisputed and the legal issue is not particularly complex (VfSlg. 17.597/2005; VfSlg. 17.855/2006; most recently, for example, VfGH 18.06.2012, B 155/12).

Therefore, an oral hearing could be omitted.

II.3.3. On point B) of the ruling – Admissibility of the appeal on points of law: Roman II.3.3. Regarding Decision B) – Admissibility of an appeal:

According to Section 25a, Paragraph 1 of the Administrative Court Act (VwGG), the administrative court must state in its decision or ruling whether the appeal is admissible pursuant to Article 133, Paragraph 4 of the Federal Constitutional Constitution Act (B-VG). The decision must be briefly reasoned. According to Section 25a, Paragraph 1 of the Administrative Court Act (VwGG), the administrative court must state in its decision or ruling whether the appeal is admissible pursuant to Article 133, Paragraph 4 of the Federal Constitutional Constitution Act (B-VG). The decision must be briefly reasoned.

In the present case, the court has declared the appeal admissible pursuant to Article 133(4) B-VG because there is still no case law of the VwGH on the question of the interpretation of health data within the meaning of Article 4(15) GDPR and the solution to this question is of fundamental importance.In the present case, the court has declared the appeal admissible pursuant to Article 133(4) B-VG because there is still no case law of the VwGH on the question of the interpretation of health data within the meaning of Article 4(15) GDPR and the solution to this question is of fundamental importance.