DSB (Austria) - 2026-0.483.002
Austria's DPA fines employee €1,200 for unlawful processing of patient health data.
Austria's Data Protection Authority (DSB) has fined an employee €1,200 for unlawfully processing sensitive health data. The employee took and shared photographs of patients in a specialized facility, revealing their physical impairments and care services. The DPA determined that the employee, not the organization, was the controller, and that the processing violated multiple GDPR articles, including those concerning special categories of personal data and lawful processing principles.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DSB?
Get an email when a new story names DSB, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn employee at a specialized care facility unlawfully photographed patients — revealing their physical impairments and care details — and shared those images, violating GDPR rules governing special categories of sensitive personal data. Austria's DPA determined the employee acted as an independent data controller, meaning individual staff members can bear direct legal and financial liability, not just their organizations. This case highlights that GDPR obligations extend to individuals, not solely to institutions, making personal accountability a very real risk. The incident underscores that insufficient staff training on data privacy — particularly around sensitive health information — can result in serious legal consequences for both the individual and the organization's reputation.