VwGH - Ra 2024/04/0408
VwGH - Ra 2024/04/0408 | |
---|---|
Court: | VwGH (Austria) |
Jurisdiction: | Austria |
Relevant Law: | Article 5 GDPR Article 6 GDPR Article 9 GDPR Article 9(2)(h) GDPR Article 9(2) GDPR Article 9(2)(a) GDPR Article 9(2)(c) GDPR paragraph 1(1) Datenschutzgesetz – DSG paragraph 1(2) Datenschutzgesetz – DSG paragraph 1(3) Bundesgesetz über die gehobenen medizinisch-technischen Dienste paragraph 11b(2) Bundesgesetz über die gehobenen medizinisch-technischen Dienste paragraph 2(3) Bundesgesetz über die gehobenen medizinisch-technischen Dienste |
Decided: | 26.11.2024 |
Published: | |
Parties: | |
National Case Number/Name: | Ra 2024/04/0408 |
European Case Law Identifier: | |
Appeal from: | |
Appeal to: | Not appealed |
Original Language(s): | German |
Original Source: | Verwaltungsgerichtshof (VwGH) (in German) |
Initial Contributor: | elu |
The Austrian Administrative Supreme Court dismissed an appeal related to the sharing of the data subject´s MRI scans from her authorized representative in the context of a treatment procedure at a rehabilitation center.
English Summary
Facts
The data subject advanced an appeal to a DPA decision concerning an alleged violation of her fundamental right to privacy, as laid out in Article 1(1) of the Austrian Data Protection Act (Datenschutzgesetz – DSG).
The initial complaint advanced by the data subject related to the sharing of the data subject´s MRI scans without the data subject´s consent, in the context of a treatment procedure at a rehabilitation centre following a hip operation. At the time of the follow-up treatment, the appellant was seventy-seven years old and suffered from dementia and significant cognitive impairment due to two brain operations in 2018.
Therefore, the data subject was unable to provide any information about her medication and previous findings and thus had an authorized representative. A few days after the data subject´s admission to the hospital, the data subject´s authorized representative, a doctor, submitted a bundle of radiological images.
One of the MRI scan's radiological images was missing so the medical team of the rehabilitation centre asked the data subject´s authorized representative to send a duplicate.
The requested MRI was faxed to the rehabilitation centre by the data subject´s authorized representative on the same day without the consent of the data subject, who only learned of this disclosure verbally from doctors at the rehabilitation center.
The data subject advanced a complaint, claiming that, in the case at hand, Article 1(1) of the Austrian Data Protection Act (Datenschutzgesetz – DSG) was violated.
Holding
The Administrative Court Holding
The Administrative Court dismissed the complaint as unfounded due to the following reasons.
First, the Administrative Court found that the data subject´s authorized representative was the controller under Article 4(7) GDPR.
Then, it proceeded by considering that, while paragraph 1(1) of the Austrian Data Protection Act (Datenschutzgesetz – DSG) provides for a fundamental right to privacy, paragraph 1(2) of the Austrian Data Protection Act (Datenschutzgesetz – DSG) permits restrictions on the right to confidentiality only if, among others, the use of personal data is in the vital interest of the person concerned or with their consent.
The processing that took place in the case at hand concerns health data, which is sensitive data, as per Article 9(1) GDPR. As processing of sensitive data is in principle prohibited, the only grounds for processing available are the ones listed in Article 9(2) GDPR. Any violation of Article 5 GDPR, Article 6 GDPR and Article 9 GDPR entails a violation of paragraph 1(1) of the Austrian Data Protection Act (Datenschutzgesetz – DSG).
In the case at hand, the Administrative Court considers it undisputable that processing of sensitive data is taking place, under Article 9(1) GDPR. Therefore, for the MRI sharing to be compliant with the GDPR, one of the grounds in Article 9(2) GDPR should apply:
- “Consent” as per Article 9(2)(a) GDPR: the controller cannot rely on the consent of the data subject as her cognitive impairment was known to the medical team;
- “Vital interest of the data subject” as per Article 9(2)(c) GDPR: processing is permissible if it is necessary to protect the vital interests of the data subject or another natural person and the data subject is physically or legally incapable of giving consent. This ground should be limited to a specific risk situation, and the protection of vital interests of affected persons could be present above all in the case of medical emergencies, which, however, are not the circumstances of the case at hand;
- “Medical diagnosis, care or treatment in the health or social sector on the basis of Union law or the law of a Member State or on the basis of a contract with a healthcare professional” Article 9(2)(h) GDPR: in the case, the controller is a qualified radiologist and therefore falls within paragraph 1(3) in conjunction with paragraph 2(3) of the Austrian MTD Act (Bundesgesetz über die gehobenen medizinisch-technischen Dienste - MTD). The data subject is subject to the duty of confidentiality as per paragraph 11c(1) of the Austrian MTD Act (Bundesgesetz über die gehobenen medizinisch-technischen Dienste - MTD), but pursuant to paragraph 11b(2) of the Austrian MTD Act (Bundesgesetz über die gehobenen medizinisch-technischen Dienste - MTD) she is also obliged to provide other healthcare professionals who treat or care for the patients or clients concerned with the information required for treatment. If this information is passed on, the duty of confidentiality is not breached.
Thus, on the basis of the legal foundations in the MTD Act, the controller was authorized to provide the rehabilitation center with the information required for the treatment. Thus, the transmission of the MRI scans was necessary to be able to plan the further course of treatment of the appellant in the physiotherapeutic treatment.
Therefore, the transmission of the MRI scans as per Article 9(2)(h) GDPR was allowed as it was necessary for medical diagnostics, care or treatment in the healthcare sector on the basis of paragraph 11b(2) of the Austrian MTD Act (Bundesgesetz über die gehobenen medizinisch-technischen Dienste - MTD) in conjunction with Article 9(2)(h) GDPR.
The data subject appealed this decision.
The Supreme Administrative Court Holding
Pursuant to paragraph 133(4) of the Austrian Federal Constitutional Law (Bundesverfassungsgesetz -B-VG), an appeal against a decision of the Administrative Court is admissible if it depends on the resolution of a legal question of fundamental importance, in particular due to a deviation from the case law of the Administrative Court or if the legal question to be resolved has not been answered uniformly in the case law.
Against the background, the submission of the appeal in the case at hand is merely cited without stating a legal question or presenting a specific case reference, and thus is not sufficient to meet the requirement of a specific statement of the legal question of fundamental importance pursuant to paragraph 28(3) of the Austrian Law of the Supreme Administrative Court (Verwaltungsgerichtshofgesetz – VwGG).
Thus, the Supreme Administrative Court deemed it appropriate to dismiss the appeal.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Subject The Administrative Court, through the presiding Senate President Dr. Pollak, the court councilor Mag. Hainz-Sator and the court councilor Dr. Pürgy as judges, with the participation of the secretary Mag. Vonier, on the appeal by Mag. F G in W, represented by Dr. Thomas Schweiger, lawyer in 4020 Linz, Huemerstrasse 1/Kaplanhofstrasse 2, against the decision of the Federal Administrative Court of June 27, 2024, Zl. W176 2248629-1/17E, concerning a data protection matter (authority concerned before the administrative court: data protection authority; party involved: D Ges.m.b.H., W; other party: Federal Minister of Justice), has passed the following decision: Ruling The appeal is dismissed. Reasons 1 1. In a letter dated September 28, 2020, the appellant filed a data protection complaint with the data protection authority (the authority in question before the Federal Administrative Court) against the co-defendant for a violation of the fundamental right to confidentiality pursuant to Section 1 Paragraph 1 of the Data Protection Act. In it, she essentially argued that MRI findings had been requested from the co-defendant in the course of a medical procedure in a rehabilitation center without her consent. The co-defendant had forwarded these findings to the rehabilitation center without the appellant's consent. The appellant learned of this violation verbally from doctors at the rehabilitation center on June 25, 2020. 2 The authority in question dismissed the complaint as unfounded. 3 2. With the contested decision, the administrative court dismissed the appellant's complaint against this decision and declared the appeal inadmissible. 4 The Administrative Court based its findings on the following, in summary: Following hip surgery, the appellant underwent follow-up treatment in accordance with Section 65a B-KUVG in a rehabilitation centre between 16 June 2020 and 17 July 2020. The appellant was 77 years old at the time of the follow-up treatment and has been suffering from dementia and significantly cognitive impairment since two brain operations in 2018. The medical team at the rehabilitation centre was aware of this. The appellant began rehabilitation without any findings and was unable to provide any information about her medication or previous findings. MMag. Dr. P.R., who had been authorized by the appellant, presented a bundle of radiological images a few days after the appellant was admitted to hospital. The medical team at the rehabilitation centre viewed these radiological images, classified them, examined them radiologically and interpreted them neurosurgically. One of the radiological images submitted was missing the corresponding part of the findings. This neurological MRI finding was considered important by the medical team at the rehabilitation center for assessing the applicant’s state of health and the further course of treatment in the physiotherapy follow-up treatment. The medical team at the rehabilitation center therefore asked the co-defendant to send them a duplicate on June 22, 2020. The requested part of the findings was faxed to the rehabilitation center by the co-defendant on the same day. 5 Based on these facts, the administrative court concluded from a legal point of view that the co-defendant was to be qualified as the person responsible for data protection in accordance with the definition in Article 4, Paragraph 7 of the GDPR. According to Section 1 Paragraph 1 DSG, everyone has the right to keep personal data concerning them confidential, in particular with regard to respect for their private and family life, provided that there is a legitimate interest in doing so. According to Section 1 Paragraph 2 DSG, restrictions on the right to confidentiality are only permissible if personal data is used in the vital interest of the data subject or with his or her consent, or to protect the overriding legitimate interests of another, and in the case of interventions by a state authority only if there is a qualified legal basis. If special categories of data within the meaning of Article 9 Paragraph 1 GDPR are processed, which include health data, this must be permitted under Article 9 Paragraph 2 GDPR. A violation of Articles 5, 6 and 9 GDPR leads to a violation of Section 1 Paragraph 1 DSG. It is undisputed that the subject matter involves processing of a special category of data in accordance with Article 9 Paragraph 1 GDPR. Health data is defined as “personal data relating to the physical or mental health of a natural person [...] and which reveal information about that state of health” (Article 4(15) GDPR). 6 Processing of the appellant’s MRI findings would therefore only be possible if there was an exception under Article 9(2) GDPR to the processing prohibition under Article 9(1) GDPR. The co-party cannot rely on the appellant’s explicit consent to data processing under Article 9(2)(a) GDPR because the medical team was aware of her cognitive impairment. 7 Furthermore, pursuant to Article 6(1)(d) GDPR, processing is lawful if it is necessary to protect the vital interests of the data subject or of another natural person. If special categories of data within the meaning of Art. 9 Para. 1 GDPR, the processing is permissible if it is necessary to protect the vital interests of the data subject or of another natural person and the data subject is physically or legally unable to give his or her consent (Art. 9 Para. 2 lit. c GDPR). Since the requirements under Art. 9 Para. 2 lit. c GDPR are stricter, there is no need to examine the requirements there in more detail if the requirements under Art. 6 Para. 1 lit. d GDPR are not met. 8 The justification under Art. 6 Para. 1 lit. d GDPR is to be interpreted narrowly (reference to OGH November 27, 2019, 6 Ob 150/19f;). In addition, the applicability of Article 6(1)(d) GDPR should be limited to cases in which a specific dangerous situation exists, which is why preventive data processing is not covered. The protection of the vital interests of data subjects may apply above all in the event of accidents or other emergency situations. In view of the examples from case law and literature, a medical emergency cannot be used to justify data processing in the present case. 9 The processing of special categories of data within the meaning of Article 9(1) GDPR is permissible, among other things, if it is necessary for medical diagnosis, care or treatment in the health or social sector on the basis of Union or Member State law or on the basis of a contract with a health professional and subject to the conditions and guarantees referred to in paragraph 3 (Article 9(2)(h) GDPR). Health data may be processed for these purposes if the data is processed by specialist staff or under their responsibility and this specialist staff is subject to professional secrecy under Union law or the law of a Member State or the provisions of national competent bodies, or if the processing is carried out by another person who is also subject to an obligation of confidentiality under Union law or the law of a Member State or the provisions of national competent bodies. 10 The co-participant is to be classified as a radiological-technical service and consequently as a senior medical-technical service in accordance with Section 1(3) in conjunction with Section 2(3) of the MTD Act. It carries out examinations independently on the basis of medical orders that are necessary within the framework of medical examination, treatment and research operations. It is subject to the duty of confidentiality pursuant to Section 11c Paragraph 1 of the MTD Act, but is also obliged pursuant to Section 11b Paragraph 2 of the MTD Act to provide other healthcare professionals who treat or care for the patients or clients concerned with the information necessary for the treatment or care about the measures it has taken. If this information is passed on, the duty of confidentiality is not violated. 11 There is no evidence to suggest that the conditions and guarantees set out in Article 9 Paragraph 3 of the GDPR have not been met. Based on the legal basis in the MTD Act, the co-party was authorized to provide the rehabilitation center, as a special hospital of the BVAEB, where the appellant received medical treatment, with the information necessary for the treatment about the measures it had taken. The transmission of the MRI findings to the rehabilitation center was necessary in order to be able to assess and plan the applicant’s state of health and further course of treatment in the physiotherapy follow-up treatment. Members of the senior medical-technical services must protect the well-being and health of patients and clients in compliance with the applicable regulations and in accordance with professional and scientific knowledge and experience (Section 11 Paragraph 1 of the MTD Act). The applicant also stated in her complaint that the findings could have been provided by her representatives in a timely manner without interfering with the treatment. This fact and the blanket reference that the findings were not medically necessary are not sufficient to refute the reasons given by the co-parties, which relate to the assessment of the treating doctors in the rehabilitation center. The same applies to the appellant’s argument that the written report is at best secondary and that the images are always used primarily for diagnosis. The argument that private or public health insurance companies do not fall under Article 9(2)(h) GDPR is irrelevant because the present data protection complaint is not directed against the social insurance provider. The statements on the "legal balancing of interests" cannot justify impermissible processing because in the present case there is a qualified legal basis within the meaning of the GDPR. In summary, the transmission of the MRI findings was permissible in accordance with Article 9(2)(h) GDPR because it was necessary for medical diagnostics, care or treatment in the healthcare sector on the basis of the MTD Act. As a result, the co-party can base its justification for the processing of the appellant’s health data on the provisions governing the purposes of medical diagnosis, care or treatment in the healthcare sector pursuant to Section 11b, Paragraph 2 of the MTD Act in conjunction with Article 9, Paragraph 2, Letter h of GDPR. The argument that private or public health insurance companies do not fall under Article 9, Paragraph 2, Letter h of GDPR is irrelevant because the present data protection complaint is not directed against the social insurance provider. The statements on the “legal balancing of interests” cannot justify impermissible processing because in the present case there is a qualified legal basis within the meaning of the GDPR. In summary, the transmission of the MRI findings was permissible under Article 9, Paragraph 2, Letter h, GDPR because it was necessary for medical diagnosis, care or treatment in the healthcare sector on the basis of the MTD Act. As a result, the co-participant can base its justification with regard to the processing of the applicant's health data on the provisions on the purposes of medical diagnosis, care or treatment in the healthcare sector under Paragraph 11 b, Paragraph 2, MTD Act in conjunction with Article 9, Paragraph 2, Letter h, GDPR. 12 3. The extraordinary appeal is directed against this finding. 13 4. According to Article 133, Paragraph 4 of the Federal Constitutional Court, an appeal against a decision of the administrative court is admissible if it depends on the resolution of a legal question of fundamental importance, in particular because the decision deviates from the case law of the Administrative Court of Appeal, there is no such case law, or the legal question to be resolved is not answered uniformly in the previous case law of the Administrative Court of Appeal. 14 According to Section 34, Paragraph 1 of the Administrative Court Act, appeals which are not suitable for consideration because the requirements of Article 133, Paragraph 4 of the Federal Constitutional Court are not met must be dismissed by order without further proceedings. 15 According to Section 34, Paragraph 1a of the Administrative Court Act, when assessing the admissibility of an appeal pursuant to Article 133, Paragraph 4 of the Federal Constitutional Court, the Administrative Court is not bound by the ruling of the administrative court pursuant to Section 25a, Paragraph 1 of the Administrative Court Act. The Administrative Court must review the admissibility of an extraordinary appeal pursuant to Article 133, Paragraph 4 of the Federal Constitutional Court Act within the framework of the reasons put forward in the appeal (Section 28, Paragraph 3 of the Administrative Court Act). 16 4.1. In its grounds for admissibility, the appeal states verbatim that “in this case there is no uniform case law of the Administrative Court, or the decision deviates from any existing case law of the Administrative Court, or the case law is not transferable to the specific case and the decision of the Federal Administrative Court deviates from it or from the guidelines of the Administrative Court.” The appeal then sets out a whole series of business figures from the Administrative Court. 17 4.2. An applicant for an appeal who - contrary to the ruling of the administrative court - claims that the contested finding deviates from the case law of the Administrative Court of Appeal must demonstrate specifically that the facts underlying the decision contested in the present case are similar to the decision cited by him, but that the administrative court decided differently in the case subject to the appeal and thus deviated from the consistent case law of the Administrative Court of Appeal. A mere reproduction of legal principles is not sufficient to demonstrate the deviation from case law, nor is a mere quotation from literature sources without any reference to such case law (VwGH 21.11.2017, Ra 2017/16/0157) or the citation of findings based on figures without addressing the alleged substantive deviations from this case law (VwGH 6.2.2024, Ra 2021/04/0199, mwN). Against the background of these requirements, the arguments put forward by the appeal as to its admissibility, which merely cite the case law of the Administrative Court on the basis of business figures, without naming a legal question or presenting a specific reference to the case, are not sufficient to satisfy the requirement of a concrete presentation of the legal question of fundamental importance under Section 28, Paragraph 3 of the Administrative Court Act.Against the background of these requirements, the arguments put forward by the appeal as to its admissibility, which merely cite the case law of the Administrative Court on the basis of business figures, without naming a legal question or presenting a specific reference to the case, are not sufficient to satisfy the requirement of a concrete presentation of the legal question of fundamental importance under Section 28, Paragraph 3 of the Administrative Court Act. 18 It is just as impossible to see that the contested decision - which was, moreover, extensively substantiated - was not made on a procedurally and substantively sound basis and not within the framework of the principles developed by the case law, as it is to see which legal question the appeal seeks to raise as the one that would be suitable, within the meaning of Article 133, Paragraph 4 of the Federal Constitutional Law, to justify admissibility contrary to the ruling of the administrative court. 19 The appeal therefore does not raise any legal questions that would be of fundamental importance within the meaning of Article 133, Paragraph 4 of the Federal Constitutional Law. The appeal was therefore dismissed. Vienna, 26 November 2024