Post by @yawnbox@disobey.net

interesting judgement* regarding GDPR, and I agree. applies to the #fediverse i believe, and may protect fediverse admins

*a Data Protection Authority, not a court

# Facts

"A data subject published a post concerning their ADHD diagnosis on a publicly accessible online forum under a pseudonym. A person (the controller) who was a follower of the data subject and had previously been in personal contact with them, knew that the pseudonym belonged to the data subject.

The controller subsequently sent a WhatsApp message to a mutual acquaintance stating that the data subject had received an ADHD diagnosis and included a link to the forum post.

The data subject lodged a complaint with the Austrian DPA (DSB), arguing that their health data had been disclosed to a third party. They alleged that the controller by forwarding the pseudonymous forum profile, had unequivocally linked it to their real identity."

# Holding

"The [Data Protection Authority (in Austria)] held that the data subject was identifiable to the controller as regards the publication of the forum post under her profile name. Since the post also included information concerning her gender, age and diagnosis, it concluded that it constituted her personal data under Article 4(1) GDPR.

The DPA further held that the prohibition on processing special categories of personal data under Article 9(1) GDPR did not apply because the data subject had manifestly made their health data public within the meaning of Article 9(2)(e) GDPR. It reasoned that actively disclosing the ADHD diagnosis in a publicly accessible forum constituted an unambiguous and conscious act by which the data subject made the information available to the public.

The DPA therefore dismissed the complaint as unfounded."

https://gdprhub.eu/index.php?title=DSB_(Austria)_-_2025-0.968.031

#mastoadmin #lawfedi #gdpr

#mastoadmin #lawfedi #gdpr #fediverse

8 Replies

0 Boosts

IFTAS

@iftas@mastodon.iftas.org 2 hours ago

@yawnbox I don't think this is a one-to-one comparison for Social Web admins/moderators, who are privy to additional information regarding a given data subject. In this case, the respondent is merely another end-user who happens to know or have inferred that pseudonym is realname.

Social web admins ARE controllers, account holders are not.

sometimes christopher

@yawnbox@disobey.net 1 hour ago

@iftas

i certainly agree! in no small part because it's a DPA judgement not a court judgement, and certainly not an EU wide judgement. just very interesting to see such a close parity to the fediverse / public forum posts

the facts around WhatsApp messages seemed to have no bearing on the outcome too though. it was centered on merit of what information the complainant had already published on a fourm

edit: i don't think i implied anything about users (account holders) as being controllers

IFTAS

@iftas@mastodon.iftas.org 1 hour ago

@yawnbox

>i don't think i implied anything about users (account holders) as being controllers

I may have misinterpreted your comment, I took it as implying this would add protection for admins, which it doesn't because 1. this case did not involve the "admin" of that web site, just another regular account holder, and 2. admins are indeed data controllers and would be held to a different standard.

I feel this is a good time to remind people of this resource: https://about.iftas.org/library/gdpr/

sometimes christopher

@yawnbox@disobey.net 1 hour ago

@iftas

ah, the interesting point to me is about special category data that is manifestly made public by posting about one's ADHD status on a public forum, in effect protecting admins who are controllers of said data, that may be perceived to be retaining and disseminating special category data of users who complain

1 more replies

Neil Brown

@neil@mastodon.neilzone.co.uk 2 hours ago

@yawnbox

Hmm... reconciling the summary with the actual decision is not easy, because the summary talks about a "controller", and the decision does not!

It is not clear to me, in particular, why one person forwarding a link to another person (entirely normal private, personal communication) was considered to be within the material scope of the GDPR at all!

IFTAS

@iftas@mastodon.iftas.org 1 hour ago

@neil @yawnbox I think it falls under the rubric of perceived boundaries.

Content was posted on a specific web site, and then forwarded off-platform.

The data subject likely held the belief that the content should not exceed the boundaries of the web site she was using, and the forwarding to a third party off-platform likely exceeded her expectations of reach.

Neil Brown

@neil@mastodon.neilzone.co.uk 1 hour ago

@iftas @yawnbox

I can understand that, genuinely.

I'm not convinced that the GDPR is properly engaged here though, and the court's decision is bare bones (but that might be just what happens in that court / jurisdiction).

Discussion

Discussion