[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fy-mmZFLdwAkQt00zmosss7BZjzWnZo9z_1gKKGrvYV8":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"1a1f753b-eec4-4078-ad0f-ba207e5c485d","DSB (Austria) - 2026-0.483.002","dsb-austria-2026-0-483-002-758fe0","Holding: link fixes and some repetitive stuff changed ← Older revision Revision as of 15:55, 6 October 2026 Line 169: Line 169: First, the DPA held that taking the pictures constituted the collection or recording of personal data, while sharing them through a chat application constituted disclosure by transmission or another form of making the data available under [[Article 4 GDPR|Article 4(2) GDPR]], which qualifies both as processing data. First, the DPA held that taking the pictures constituted the collection or recording of personal data, while sharing them through a chat application constituted disclosure by transmission or another form of making the data available under [[Article 4 GDPR|Article 4(2) GDPR]], which qualifies both as processing data. Second, the DPA held that the employee, rather than the organisation, was the controller under [[Article 4 GDPR|Article 4(7) GDPR]] as he determined the purposes and means of the processing, used his private smartphone and acted outside the scope of his duties for his own purposes. The organisation was therefore not the controller for this processing. Second, the authority held that the employee, rather than the organisation, was the controller under [[Article 4 GDPR|Article 4(7) GDPR]] as he determined the purposes and means of the processing, used his private smartphone and acted outside the scope of his duties for his own purposes. The organisation was therefore not the controller for this processing. Third, the DPA held that the photographs contained health data under [[Article 4 GDPR|Article 4(15) GDPR]]. The patients appeared as persons receiving care in a specialised facility, and the photographs revealed their physical impairments and use of care or health services. The processing therefore concerned a special category of personal data. Third, it held that the photographs contained health data under [[Article 4 GDPR|Article 4(15) GDPR]]. The patients appeared as persons receiving care in a specialised facility, and the photographs revealed their physical impairments and use of care or health services. The processing therefore concerned a special category of personal data. Fourth, the DPA considered that lawful processing had to comply with the principles in [[Article 5 GDPR|Article 5(1) GDPR]] and have a legal basis under [[Article 6 GDPR|Article 6(1) GDPR]]. Because the photographs contained health data, the processing also required an applicable exception under [[Article 9 GDPR|Article 9(2) GDPR]]. It found that it had no legitimate purpose, no legal basis and no applicable exception. Fourth, the DPA considered that lawful processing had to comply with the principles in [[Article 5 GDPR|Article 5(1) GDPR]] and have a legal basis under [[Article 6 GDPR|Article 6(1) GDPR]]. Because the photographs contained health data, the processing also required an applicable exception under [[Article 9 GDPR|Article 9(2) GDPR]]. It found that it had no legitimate purpose, no legal basis and no applicable exception. The DPA therefore held that the processing was unlawful and that the data subject had violated Articles 5(1) and (b), 6(1) and 9(1) GDPR and ultimately imposed a €1,200 fine under [[Article 83 GDPR|Article 83(5)(a) GDPR]]. The DPA therefore held that the processing was unlawful and that the data subject had violated [[Article 5 GDPR|Article 5(1)]], [[Article 6 GDPR|6 (1)]] and [[Article 9 GDPR|9(1) GDPR]] and ultimately imposed a €1,200 fine under [[Article 83 GDPR|Article 83(5)(a) GDPR]]. == Comment == == Comment ==","Austria's Data Protection Authority (DSB) has fined an employee €1,200 for unlawfully processing sensitive health data. The employee took and shared photographs of patients in a specialized facility, revealing their physical impairments and care services. The DPA determined that the employee, not the organization, was the controller, and that the processing violated multiple GDPR articles, including those concerning special categories of personal data and lawful processing principles.","Austria's DPA fines employee €1,200 for unlawful processing of patient health data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DSB_(Austria)_-_2026-0.483.002&diff=53315&oldid=53314","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F1\u002F1f\u002FLogoAT.png","2026-10-06T15:55:23+00:00","2026-10-06T16:00:16.162521+00:00",7,[17],{"name":18,"type":19},"DSB","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":44,"vendors":45},[],[],{"slug":47,"title":48,"body":49,"framework_refs":50,"framework_notes":63},"employee-fined-for-photographing-and-sharing-patients-sensitive-health-data","Employee Fined for Photographing and Sharing Patients' Sensitive Health Data","An employee at a specialized care facility unlawfully photographed patients — revealing their physical impairments and care details — and shared those images, violating GDPR rules governing special categories of sensitive personal data. Austria's DPA determined the employee acted as an independent data controller, meaning individual staff members can bear direct legal and financial liability, not just their organizations. This case highlights that GDPR obligations extend to individuals, not solely to institutions, making personal accountability a very real risk. The incident underscores that insufficient staff training on data privacy — particularly around sensitive health information — can result in serious legal consequences for both the individual and the organization's reputation.",[51,52,53,54,55,56,57,58,59,60,61,62],"GDPR Article 9 – Processing of special categories of personal data","GDPR Article 5 – Principles relating to processing of personal data","GDPR Article 6 – Lawfulness of processing","GDPR Article 83 – General conditions for imposing administrative fines","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 MP-1 – Media Protection Policy","CIS Control 14 – Security Awareness and Skills Training","CIS Control 3 – Data Protection","ISO\u002FIEC 27001 Annex A 6.3 – Information Security Awareness, Education and Training","ISO\u002FIEC 27001 Annex A 5.34 – Privacy and Protection of Personal Identifiable Information","ITIL – Service Transition: Knowledge Management (staff competency)",{}]