{"id":6691,"date":"2024-09-23T11:24:34","date_gmt":"2024-09-23T09:24:34","guid":{"rendered":"https:\/\/atb.law\/?post_type=blog-post&p=6691"},"modified":"2025-03-14T11:11:27","modified_gmt":"2025-03-14T10:11:27","slug":"baden-data-leak-legal-consequences-and-preventive-measures-for-data-protection-in-austria","status":"publish","type":"blog-post","link":"https:\/\/atb.law\/en\/blog-post\/baden-datenleck-rechtliche-folgen-und-praeventivmassnahmen-fuer-den-datenschutz-in-oesterreich\/","title":{"rendered":"Data leak in Baden: Claims for damages and data protection consequences"},"content":{"rendered":"

Background of the incident<\/h2>\n

In March 2022, due to a configuration error, personal data of 33,000 citizens of the city of Baden was made publicly accessible for four days. The data included names, dates of birth, addresses, and phone numbers, but no critical information such as credit card details. The city argued that the data was available in public registers, which was intended to mitigate the severity of the incident.<\/p>\n

Court judgment and legal aspects<\/h2>\n

The Higher Regional Court upheld the judgment of the Regional Court of Wiener Neustadt and emphasized that, even without concrete proof of misuse, non-material damage, such as psychological stress, is sufficient for damages. This decision follows the case law of the Court of Justice of Justice of the European Union (CJEU), according to which the violation of the right to data protection is eligible for compensation independently of direct damage.ECJ, Judgment of July 4, 2023, Case C-300\/21<\/a>).<\/p>\n

Responsibilities of public institutions<\/h2>\n

The ruling shows that public institutions have a special responsibility to protect personal data. In this case, the city tried to shift the responsibility onto the IT service provider, which was rejected by the court. The city had launched the Baden-Card online before the IT security measures were fully implemented, which led to the security vulnerability. Such violations are subject to the GDPR, and public institutions cannot rely on external service providers to avoid their own liability.<\/p>\n

Reactions and precedent<\/h2>\n

This ruling strengthens the position of citizens in cases of data protection violations and could lead to a wave of claims for damages. The ECJ's decision regarding non-material damage caused by data protection violations gives affected citizens a broader entitlement to compensation. This jurisprudence is expected to impact future rulings across Europe and raise awareness of personal data protection. For public institutions, this means increased responsibility, particularly in the selection and monitoring of IT service providers.<\/p>\n

Preventive measures and recommendations<\/h2>\n

To prevent similar incidents, public authorities should:<\/p>\n