N*** Ärztezentrum-Dr. U*** & Co GmbH

What happened

The Austrian DPA (DSB) held that the negative PCR (SARS_CoV-2) test is to be qualified as a health data pursuant to Article(4)(15) GDPR and that the scope of protection of Article 9(2) must be taken into account as a standard in the subsequent review of lawfulness. The DPA also comes to the conclusion that in context of the current pandemic the transfer of health data relevant here can be based on the legal obligation of the respondent to also transfer negative PCR test results to the competent district administrative authority, which is laid down in § 3(1) EpiG in connection with § 1( 3) of the ordinance of the Minister of Health, Federal Law Gazette II No. 323/2020.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 4Definitions4(15)Read →
• Art. 6Lawfulness of processing6(1)(c)Read →
• Art. 9Processing of special categories of personal dataRead →

• Special categories
• Unlawful processing