The Austrian Data Protection Authority (DSB) addressed a complaint filed by a data subject who received a letter from the umbrella association of Austrian social insurance institutions, inviting them to receive a COVID-19 vaccine.

The data subject alleged unlawful processing of personal data and requested the DSB to prohibit the processing and impose a fine on the controller.

On 15 June 2022, the DSB determined that the controller, an entity under public law, had legitimate grounds for sending the letters based on the Austrian General Law on Social Insurance. The controller had checked vaccination records, identified unvaccinated individuals, and sent them vaccine appointment invitations. The DSB found no unlawful transmission of information and justified the restriction of data protection rights due to the public entity's actions in compliance with relevant legal provisions.

Consequently, the DSB rejected the complaint, stating that no reasons were found to cease processing or impose fines on the controller.

Reference: case number DSB-D770.1336 / ECLI:AT:DSB:2022:2022.0.432.117.

Full text of the decision available at de