[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f46ID-14oordndJ6mjvPAsiBm3_1IZJMom3JmTGYH8LU":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"8d0960da-d669-425f-b152-bfc1c5269863","BVwG - W298 2314952-1","bvwg-w298-2314952-1-ff6b2d","Facts ← Older revision Revision as of 06:38, 23 September 2026 Line 100: Line 100: The data subject filed a complaint with the court under national law concerning a violation of the protection of his personal data, claiming insufficient anonymisation. The data subject filed a complaint with the court under national law concerning a violation of the protection of his personal data, claiming insufficient anonymisation. === Holding === === Holding === The court held that the complaint was partly justified. The court held that the complaint was partly justified. Line 114: Line 110: The processing of the religious function the data subject was exercising was lawful, according to the court. This is because it was necessary to mention his function in order to understand a conversation between the data subject and a witness in the context of the disciplinary decision. The processing of the religious function the data subject was exercising was lawful, according to the court. This is because it was necessary to mention his function in order to understand a conversation between the data subject and a witness in the context of the disciplinary decision. == Comment == == Comment == ''Share your comments here!'' ''Share your comments here!''","An Austrian court ruled that publishing unredacted personal data in legal decisions on a government website is unlawful if it's not necessary for understanding the decision or serving transparency. The data subject, a policeman facing disciplinary action, complained about insufficient anonymization in a published decision that revealed his professional role, teaching location, and mental health status.","Austrian court rules publication of unredacted personal data in legal decisions unlawful if not necessary.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=BVwG_-_W298_2314952-1&diff=53158&oldid=53135","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-09-23T06:38:51+00:00","2026-09-23T08:00:09.411889+00:00",7,[17,20],{"name":18,"type":19},"Rechtsinformationssystem des Bundes","product",{"name":21,"type":22},"Federal Chancellery of Austria","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":45},{"id":23,"icon":25,"name":26,"slug":27},[],[21,18],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":65},"austrian-court-rules-unredacted-personal-data-in-published-legal-decisions-violates-privacy-law","Austrian Court Rules Unredacted Personal Data in Published Legal Decisions Violates Privacy Law","An Austrian administrative court found that a government website published a legal decision containing insufficiently anonymized personal data, including a policeman's professional role, teaching location, and mental health status. The root cause was a failure to implement proper data minimization and anonymization procedures before publishing official documents online. Exposing sensitive categories of data — such as mental health information — without necessity violates GDPR principles of data minimization and purpose limitation. This case demonstrates that transparency obligations do not override an individual's right to privacy, and organizations must carefully balance public interest against personal data protection. Failing to establish clear redaction workflows for published documents can result in legal liability and reputational harm for public institutions.",[56,57,58,59,60,61,62,63,64],"GDPR Article 5(1)(c) – Data Minimisation","GDPR Article 9 – Processing of Special Categories of Personal Data","GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST SP 800-188 – De-Identification of Government Datasets","NIST Privacy Framework PR.DS-P1 – Data at Rest Protection","CIS Control 3 – Data Protection","ISO\u002FIEC 29101 – Privacy Architecture Framework","ITIL Service Design – Information Security Management",{}]