Fundamental rights section Health data are sensitive data “deserving of special protection”. These data are subject to a general prohibition of use that is only overruled by the exceptions exhaustively listed in § 9 of the Data Protection Act. § 14 of the Data Protection Act contains a detailed obligation to take measures to ensure data security. In this investigation procedure, the OB achieved that it is being examined whether it is possible that the diagnostic data as the basis of a transport order do not reach the transport company. Instead the data should be passed on directly to the health-insurance authority rendering the benefits. The health-insurance authority can then consolidate these data with the transport account and thereby check whether the transport was allowable. A regulation to this effect entered into force on 1 January 2009. The OB hopes that this problem will no longer occur in the future. 3.4.2. Lacking legal basis for video surveillance A street lamp owned by the municipality of Ternitz in Lower Austria was regularly damaged. N.N., who received a diversion offer from the public prosecution office because he was a suspect, complained to the Ombudsman Board. The municipality of Ternitz had demanded in a letter to the complainant that besides the costs for the maintenance of the “damage” he had caused he should also assume the costs for the renting of a video surveillance tool by the Ternitz police. In the investigative proceeding the Ombudsman Board set out the legal bases for data applications in the “public domain” and requested the municipality of Ternitz for comments in connection with the necessary reporting to the data-protection commission. It also inquired why local authorities had asked local police to act as the invoice recipient (the video surveillance was installed by a private enterprise) and consequently charge the amount of the invoice to the municipality of Ternitz, who then asked the complainant to pay this amount. In its comments, the urban municipality of Ternitz admitted that the report to the data-protection commission had been forgotten and that there is no legal basis for the request to the police. The municipality affirmed that it would act in conformity with the law in the future. The investigation procedure was concluded with the formal objection to the conduct of the urban municipality of Ternitz. 32nd Report of the Austrian Ombudsman Board to the National Council and the Federal Council 2008 23