DSB (Austria) - 2026-0.483.002
Austrian DPA fines employee €1,200 for unauthorized sharing of patient health data.
The Austrian Data Protection Authority (DSB) fined a medical services employee €1,200 for photographing two patients and sharing the images with unauthorized third parties. The photographs contained sensitive health data, and the employee acted as the controller, determining the purposes and means of processing outside his work duties. The DPA found the processing unlawful as it lacked a legitimate purpose, legal basis, and applicable exception under GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DSB?
Get an email when a new story names DSB, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA medical services employee violated GDPR by photographing two patients and sharing those images with unauthorized third parties, acting as an independent data controller outside the scope of his employment duties. The root failure was a lack of security awareness and disregard for data protection obligations, compounded by insufficient workplace policies around personal device use in sensitive environments. Because the data involved constituted special category health data under GDPR Article 9, the breach carried heightened legal consequences. This case illustrates that individual employees can bear personal legal liability for mishandling patient data, not just their organizations.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.