Health data is among the particularly protected data categories under Article 9 of the GDPR. Its processing is generally prohibited unless a specific exception applies. However, in legal proceedings, the processing of sensitive data may be necessary to assert or defend against claims. This regularly raises the question of who may receive information: only the immediate case worker, management, a collegial body, internal witnesses, or also external representatives? The Austrian Supreme Court (OGH) recently dealt with such a case.<\/p>\n\n\n\n
A registered nurse brought legal action against a hospital operator. During the course of the dispute, sensitive information, including health data, was processed. The plaintiff accused the hospital operator of unlawfully disclosing this data to third parties, particularly in connection with legal documents and internal decision-making processes. The hospital operator maintained that the data processing was necessary for the purposes of the legal defense. <\/p>\n\n\n\n
The plaintiff initially filed a lawsuit with the competent regional court seeking an injunction against the disclosure of health data and other procedural files to non-parties or "non-organs" of the hospital operator. The court of first instance ruled on the primary and alternative claims; the appellate court dismissed the plaintiff's appeal and essentially upheld the decision. The plaintiff then filed an extraordinary appeal against this judgment with the Supreme Court.<\/p>\n\n\n\n
The Supreme Court dismissed the appeal for lack of a significant legal question, thereby essentially confirming the previous application of the law. The Supreme Court clarified that, according to Article 9(2)(f) GDPR, the processing of special categories of personal data is permitted if it is "necessary" for the establishment, exercise, or defense of legal claims. "Necessary" in this context means that without the data, asserting the claim or defending against it would be impossible or significantly more difficult. Due to its importance for the rule of law and the enforcement of claims, the limit of "necessity" should not be interpreted too strictly. For example, in the case of pleadings, the exception clause only ceases to apply if sensitive data, which is completely unrelated to the subject matter of the dispute, is arbitrarily and deliberately disclosed. In the specific case, the data in question was necessary, and the defendant could rely on a legitimate interest within the meaning of Article 9(2)(f) GDPR. The Supreme Court upheld the Court of Appeal's legal opinion that, based on the circumstances of the case, the interest in confidentiality did not outweigh the interest in legal defense. The plaintiff's appeal was therefore dismissed.<\/p>\n\n\n\n
The Austrian Supreme Court (OGH) therefore confirms that the processing of health data in the context of legal defense is permissible under Article 9(2)(f) GDPR if the disclosure of the data is essential and indispensable for the exercise or defense of legal claims in the specific case. Organizations may therefore also disclose the data to competent bodies and internal decision-makers, provided these individuals are involved in the legal defense and the data is not used beyond its scope. It remains crucial that the data processing is purpose-bound, proportionate, and transparently documented \u2013 the controller within the meaning of the GDPR bears the responsibility for this. <\/strong><\/p>\n\n\n\n Supreme Court 22.01.2025, 9 ObA 79\/24v<\/strong><\/p>\n\n\n\n <\/p>","protected":false},"excerpt":{"rendered":" Health data is among the particularly protected data categories under Article 9 of the GDPR. Its processing is generally prohibited unless a specific exception applies.<\/p>","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[41],"tags":[],"class_list":["post-8367","post","type-post","status-publish","format-standard","hentry","category-aktuelles"],"acf":[],"_links":{"self":[{"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/posts\/8367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/comments?post=8367"}],"version-history":[{"count":1,"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/posts\/8367\/revisions"}],"predecessor-version":[{"id":8368,"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/posts\/8367\/revisions\/8368"}],"wp:attachment":[{"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/media?parent=8367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/categories?post=8367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lsr.at\/en\/wp-json\/wp\/v2\/tags?post=8367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}