Austria

Medical Student

200 €

GDPR enforcement action by Austrian Data Protection Authority (dsb) on 2026-01-12.

Rank · Sector

#338

of 352 in Individuals and Private Associations

Rank · Austria

#36

of 39

Rank · All fines

#3,051

of 3,085

Case details

Authority: Austrian Data Protection Authority (dsb)
Date: 2026-01-12
Controller / Processor: Medical Student
Sector: Individuals and Private Associations
Quoted Articles: Art. 6 (1) f) GDPR, Art. 9 (2) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Austrian DPA has imposed a fine of EUR 200 on a Medical Student. The student in their role oversseing hallway of a hospitals neurological department, took a video of a dementia patient. They then shared that video with a colleague. The video is personal data with the patient being the data subject, the medical student as data controller did therefore not have legal basis for capturing or sharing the video.

Open original source Links to the regulator's original publication or another source.