Germany

Private individual

2,000 €

GDPR enforcement action by Data Protection Authority of Baden-Wuerttemberg on 2023.

Rank · Sector

#139

of 351 in Individuals and Private Associations

Rank · Germany

#89

of 116

Rank · All fines

#2,354

of 3,050

Case details

Authority: Data Protection Authority of Baden-Wuerttemberg
Date: 2023
Controller / Processor: Private individual
Sector: Individuals and Private Associations
Quoted Articles: Art. 6 GDPR, Art. 9 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The DPA of Baden-Wuerttemberg has imposed a fine of EUR 2,000 on a clinic employee. The employee had unlawfully accessed a patient administration system in order to find out more about their new neighbor. This not only gave them access to personal details of the data subject, but also to medical information about them.

Open original source Links to the regulator's original publication or another source.