Facts
In August 2023, a female patient left a negative review of a specialist's practice on Google. In her review, she expressed criticism regarding her treatment. The specialist concerned responded with a detailed reply in which he disclosed, among other things, the patient's medical diagnosis („irritation of a tendon insertion“).
The Data Protection Authority (DPA) became aware of this incident and initiated administrative penalty proceedings against the doctor. The DPA considered the publication of the diagnosis to be a violation of the General Data Protection Regulation (GDPR), as it constituted unlawful processing of special categories of personal data (health data).
Decision of the Federal Administrative Court
The Federal Administrative Court largely upheld the decision of the Data Protection Authority, but reduced the fine. The following key points were established:
- Unlawful processing of health data: The specialist's publication of the diagnosis in a Google response constituted a processing of special categories of personal data, which is only permitted under certain conditions (Art. 9(2) GDPR). None of these exceptions were met in the present case.
- No justifying legitimate interest: The doctor argued that he had to defend himself against a negative review. However, the court ruled that this was not a sufficient justification for publishing the sensitive health data.
- Principle of data minimization violated: According to Art. 5 (1) lit. c GDPR, personal data may only be used to the extent necessary for the purpose of the processing. Mentioning the diagnosis was not necessary to respond to the criticism.
- Extenuating circumstances: The doctor had deleted the response to the Google review at the request of the data protection authority and showed cooperation during the proceedings. These circumstances led to a reduction of the original fine from 4,000 euros to 3,000 euros.
Legal assessment and implications
The decision of the BVwG underlines that companies and service providers must strictly comply with the GDPR when handling online reviews. The publication of sensitive personal data such as health information is particularly delicate. The following points are especially relevant for companies:
1. Carefully craft responses to Google reviews
Companies must not disclose personal data of their customers or patients in public review responses. A factual, general response without disclosing sensitive information is legally safer.
2. Data protection training for employees
All employees who handle online reviews should be trained on data protection regulations. This helps avoid costly penalties.
3. Use of internal communication channels
If a review addresses sensitive topics, it is advisable to contact the person concerned directly rather than publicly. This helps prevent data privacy violations.
4. Legal advice regarding critical reviews
Companies, especially in the healthcare sector, should seek legal advice in case of doubt before responding to negative reviews. Data protection violations can lead to severe penalties.
5. Requesting the removal of inadmissible reviews
If a review itself violates data protection regulations, its deletion can be requested from Google.
Conclusion
The decision of the Federal Administrative Court is an important indication of how sensitively personal data must be handled in online reviews. Healthcare providers in particular should be aware that merely mentioning a diagnosis can constitute a GDPR violation. Companies should therefore implement strict data protection guidelines for handling Google reviews to avoid costly sanctions.
ATB.LAW offers comprehensive support in the areas of data protection, compliance, and litigation. Contact us by email at taudes@atb.law or by phone at +43 1 3912345.
