In the decision of January 16, 2020, GZ: DSBD123.815/0002-DSB/2019, the data protection authority had to deal with a complaint regarding the right to confidentiality (Section 1 of the Data Protection Act).
The complainant was ordered by his employer to undergo a periodic examination at the respondent’s (an occupational medical
Center) invited. Prior to the examination, the complainant completed a patient form and provided information about his medical condition and medications. A few days later, the complainant was contacted by a former work colleague (who was himself summoned to an examination at the respondent) and made aware that the complainant’s patient form was lying around open. The former colleague was able to provide the medications by name as well as the complainant’s home address.
In the case at hand, it was the case that an employee of the respondent had the complainant’s records on her desk
had discarded. In the course of a short-term absence of the employee, it was possible for the former work colleague to inspect the data. How exactly the latter managed to gain access to the documents and whether – as claimed by the respondent – a deliberate and intentional act led to this – could no longer be determined in the preliminary proceedings. However, it could be established that the respondent’s employee had openly filed sensitive documents of the complainant in the immediate vicinity of third parties.
Legally, therefore, it was found that the respondent had violated the complainant’s right to confidentiality by disclosing documents that were
information on the complainant’s state of health and use of medication were left in the open, thus making it possible for a third party to
was able to inspect them.
The decision is legally binding.