In June 2024, shortly before the end of my employment at the University of Natural Resources and Life Sciences, Vienna (BOKU) https://boku.ac.at/, I became aware that my private mobile telephone number had been forwarded to another member of my research group without my prior knowledge or consent. I was subsequently contacted via Telegram regarding my university work laptop.
As I considered the disclosure of my private contact details to be inappropriate, I submitted a complaint to the Austrian Data Protection Authority (Datenschutzbehörde – DSB) https://dsb.gv.at/ concerning my right to confidentiality under Austrian data protection law.
During the proceedings, the Authority initially requested clarification regarding the factual background, the chronology of the events, and the persons involved. I provided the requested information and the proceedings continued.
The respondents later submitted a written statement to the Data Protection Authority. According to the respondents’ written submission:
at the time of the incident, the colleagues involved and I belonged to the same research group at BOKU, led by Prof. Andreas Holzinger (https://www.aholzinger.at/);
discussions had taken place within the research group regarding the future allocation of university laptops after my departure; the respondents stated that the task of contacting me had originally been assigned by Prof. Andreas Holzinger
to one colleague and subsequently delegated to another colleague due to a planned vacation; they further stated that my private telephone number had been forwarded in connection with that task so that I could be contacted via Telegram regarding the work laptop.
Separately from the DSB proceedings, one of the colleagues acknowledged by email that my private telephone number had been passed on without asking me beforehand, acknowledged that this had been a mistake, confirmed that my number had been deleted from his phone, and stated that future communication would take place via my university email address.
Following this incident, I informed the persons concerned that I no longer wished to be contacted through private communication channels. I requested that any future communication take place exclusively through official university channels or, where appropriate, through designated university representatives.
The purpose of documenting this incident is to explain why I subsequently became particularly attentive to the handling of my personal contact details and why I have exercised my data protection rights in later cases involving the processing of my personal information.
My response to the respondents’ statement
After receiving the respondents’ written submission from the Austrian Data Protection Authority, I provided a reply in which I clarified several factual points from my perspective.
In particular, I noted that:
- my employment at BOKU had ended on 30 April 2024;
- the respondents’ submission did not, in my view, fully clarify how differing information regarding my university equipment had arisen;
- I questioned why my private mobile telephone number had been shared internally and why communication had taken place via Telegram,
although official university communication channels, including email, were available; - I emphasized the importance of handling employees’ private contact details with particular care when
private messaging applications are used for work-related communication.
I further explained that my complaint was not directed at the organisational handling of university equipment itself, but at the processing of my private personal data and the choice of communication channel.
Finally, I informed the Authority that I had nothing further to add regarding the factual circumstances of the case and wished the research group, the Institute of Forest Engineering, and BOKU all the best for the future.