In a decision dated December 7, 2022, the data protection authority addressed the question of whether the monitoring of employee e-mail logs is permissible from a data protection perspective. The proceedings were initiated on the basis of a complaint filed by three employees against the respondent, alleging a violation of the fundamental right to secrecy… […]
D124.2941 (2022-0.360.359), Processing of biometric data using palm vein scanners; video surveillance in the workplace.
The complainant, as a former employee of the respondent, considered his right to confidentiality violated because the respondent processed his biometric data using a palm vein scanner and recorded him with video surveillance cameras. The respondent operates a restaurant in Vienna. She uses a palm vein scanner there, which uses infrared light to measure the… […]
2022-0.263.348 (D485.009), Request for prior consultation under Article 36 of the GDPR regarding the COVID-19 mandatory vaccination law.
A service provider in the health care sector argued that it was being discriminated against by the Federal Act on the Obligation to Vaccinate against COVID-19 (COVID-19-Impfpflichtgesetz – COVID-19-IG), BGBl. I No. 4/2022 as amended by BGBl. I No. 22/2022, on the data controller for the personal processing of exemptions from the general COVID-19 vaccination… […]
2022-0.286.157 (D213.1560), Warning in administrative proceedings.
In its decision of May 30, 2022, the data protection authority addressed the question of whether members of a service committee may use data from the staff directory to send postal promotional letters for joining a trade union. The data protection authority has initiated an official investigation procedure against two members of a departmental committee… […]
2022-0,244,681 (D550,540), Unlawful queries in e-vaccination record.
In a penalty decision dated April 5, 2022, the data protection authority imposed a fine of EUR 3,300 in response to the unlawful processing of sensitive data (health data). The defendant processed health data of three subjects by accessing the data in the e-vaccination record to learn about the subjects’ vaccination status. The defendant performed… […]
2022-0,094,281 (D124,2499), Scope of information pursuant to Art. 15 of the GDPR by a successor to a cash plan pursuant to sec. 51 para. 4 ÄrzteG
In the decision of February 7, 2022, GZ: DSB-D124.2499, 2022-0.094.281, the data protection authority had to deal with the scope of a right to information in the context of a so-called succession to a fund position. The respondent, a licensed pulmonary specialist, had obtained from his retired predecessor the complainant’s patient records pursuant to sec…. […]
2022-0.083.310 (D124.0128/22), Dismissal of the application for a writ of mandate pursuant to Section 22 of the Data Protection Act; no imminent danger in connection with the data processing in question.
In its decision of February 14, 2022, the data protection authority dealt with an application for the issuance of a mandate decision due to alleged imminent danger in connection with the transfer of files by a federal minister requested by a committee of inquiry pursuant to Section 25 of the Ordinance. Initially, the data protection… […]
2021-0.785.022 (D124.4309), respondent not responsible party when employees make Elga queries for their own interest, no lack of control system
In its decision of January 27, 2022, the data protection authority dealt with the legality, the controller status and the concept of a control system when an employee of the respondent carries out Elga queries in her own interest.The complainant alleged that there was unauthorized access to his medication and immunization status data by two… […]
2021-0.789.408 (D124.3940), Use of GPS system in official vehicle.
In a decision dated March 1, 2022, the data protection authority addressed the legality of the use of GPS systems in official vehicles. The complainant was employed by the respondent as a customer service technician. In this context, he was provided with a vehicle in which a GPS device was installed and which he was… […]