In its decision dated January 15, 2019, GZ DSBD123.527/0004-DSB/2018, the data protection authority had to decide whether the respondent, which operates a physician search and evaluation platform, was justified in not complying with the deletion request of a physician who requested the complete deletion of all his data, including evaluations and testimonials, from this platform.
In doing so, the data protection authority first held that the linking of data pursuant to Section 27 para. 1 Z 1 to 17 ÄrzteG 1998 with the possibility of submitting an evaluation as well as a progress report is a (new) processing operation that requires an authorization. In this regard, the respondent relied on legitimate interests under Art. 6 para. 1 lit DSGVO, which is why a balancing of interests had to be carried out. In this weighing of interests, it was first necessary to take into account that the respondent has implemented suitable protective measures so that factually unjustified comments are reported and multiple evaluations – as far as technically possible – are prevented. The complainant
is therefore not at the mercy of the ratings without protection, which is why no pillorying effect is discernible. In addition, the professional activity is to be assigned to the social sphere, which is why a lower level of protection is to be assumed than when data is affected that is to be assigned to the “intimate or secret sphere”. In contrast, the legitimate interest of patients to obtain information about medical services, especially since in Austria
in principle, there is a free choice of physician. Through a search and evaluation portal, such as the one operated by the respondent, people who sometimes do not know each other are just given the opportunity to easily and efficiently exchange information about a certain topic and to
people can use such a platform as an additional source of search and information about medical care.
and health care services.
Against this background, the data protection authority came to the conclusion that the legitimate interests of the portal users (the patients) outweighed the stated impairments of the complainant’s legitimate interests, which is why the respondent rightly did not comply with the request for deletion and the complaint was therefore dismissed. This decision is legally binding.