[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXYV9awovmK4f3H6AEsObh3PvmrDcVCh8gOxD5Ig98Rg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"2fbf464b-e864-499d-8d8f-546997a6707e","employee-fined-1000-for-sharing-customer-phone-number-without-legal-basis","bc72b528-0de9-4357-981c-33e7c1ccb56f","Employee Fined €1,000 for Sharing Customer Phone Number Without Legal Basis","An Austrian employee acting outside their professional authority shared a customer's personal phone number with a third party for entirely personal reasons, constituting an unlawful data transmission under GDPR. The core failure was a lack of understanding — or disregard — of the principle that personal data may only be processed when a legitimate legal basis exists, such as consent, contract, or legal obligation. 'Benevolence' or satisfying a third party's personal interest does not qualify as a lawful basis under Article 6 GDPR. This case highlights that GDPR liability can extend to individual employees, not just organisations, making personal accountability a real and enforceable consequence. It underscores how insider misuse of data — even seemingly minor disclosures — can result in regulatory sanctions.","**Immediate actions:**\n- Conduct targeted GDPR refresher training for all staff with access to customer personal data, emphasising lawful basis requirements.\n- Audit access controls to ensure employees can only access personal data necessary for their specific role (data minimisation).\n\n**Policy & Governance improvements:**\n- Establish and enforce a clear Acceptable Use Policy for personal data that explicitly prohibits sharing data for personal reasons.\n- Implement a data sharing approval workflow requiring authorisation before any customer data is transmitted to third parties.\n- Define disciplinary consequences for unauthorised data disclosures in employment contracts and staff handbooks.\n\n**Detection & Monitoring measures:**\n- Deploy Data Loss Prevention (DLP) tools to flag or block unauthorised transmission of personal data via email, messaging, or other channels.\n- Enable audit logging of access to customer contact records to detect anomalous or unexplained lookups by employees.",[12,13,14,15,16,17,18,19,20,21,22,23],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 6 – Lawfulness of processing","GDPR Article 5(1)(b) – Purpose limitation","GDPR Article 5(1)(c) – Data minimisation","CIS Control 3 – Data Protection","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 SI-12 – Information Management and Retention","ISO\u002FIEC 27001:2022 A.5.34 – Privacy and protection of personal data","ISO\u002FIEC 27001:2022 A.6.3 – Information security awareness, education and training",{},"published","2026-08-18T10:21:09.512265+00:00","2026-08-18T10:21:09.428+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DSB_(Austria)_-_DSB-D550.1284&diff=52709&oldid=0","dsb-austria-dsb-d550-1284-0f5d09","DSB (Austria) - DSB-D550.1284",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":40,"name":41,"slug":42,"description":43,"color":44},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[53],{"slug":54,"name":55,"problem":56},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up."]