In a recently published blog article, we explained how one should respond to a negative Google review. This article focuses on a negative example of a response to a review. This review resulted in a legal proceeding and ultimately a conviction before the data protection authority.

Background and Review

A patient (hereinafter referred to as "the data subject") had written a Google review under her real name after a visit to a gynecologist (hereinafter referred to as "the accused"). In his public response, the doctor revealed the diagnosis of the data subject:

"Hello Karina!

I diagnosed your vaginal infection and treated it professionally right away. You could come on the same day and didn't have to pay anything. Unfortunately, that's not sufficient for you, and now you accuse me of lacking empathy...

I, on my part, expect a certain level of cooperation and attention so that I can conduct the necessary medical consultation."

Decision of the Data Protection Authority

The data protection authority considered this a violation of the General Data Protection Regulation (GDPR), especially since the responsible party could not provide a legal basis under Article 9(2) GDPR for processing health data. On June 29, 2023, the data protection authority imposed a fine of EUR 10,000 against the accused. By now, this penalty decision is partially legally effective (appeal of the penalty amount pending before the Federal Administrative Court). The data protection authority justified the fine with special preventive considerations (i.e., preventing further such actions by the accused). During the proceedings before the data protection authority, it became evident that the accused regularly mentioned details of his examinations in response to negative reviews.

How to Respond to a Negative Google Review?

This case illustrates clearly how one should definitely not respond to a negative Google review. Publicizing personal data of the customer/client/patient is strictly forbidden, especially for doctors and other professional confidentiality holders. If you intend to respond to a review, make sure that no personal data (such as information on an illness) is disclosed. This applies especially in cases where thee affected person wrote the review under their real name. If you plan to have the negative Google review removed, we recommend refraining from comments altogether.

Do you have further questions about data protection or your online reputation?

If you have additional questions on this topic or wish to seek legal advice in other areas of data protection law, we, as specialized attorneys, are here to help. Feel free to contact our law firm at office@geuer.at or by phone at +43-1-4380072. We look forward to your inquiry.

Source

Full text of the DPA Decision D550.747 (2023-0.420.407) German only