Austria

Private individual

700 €

GDPR enforcement action by Austrian Data Protection Authority (dsb) on 2026-01-27.

Rank · Sector

#215

of 368 in Individuals and Private Associations

Rank · Austria

#32

of 41

Rank · All fines

#2,973

of 3,267

Case details

Authority: Austrian Data Protection Authority (dsb)
Date: 2026-01-27
Controller / Processor: Private individual
Sector: Individuals and Private Associations
Quoted Articles: Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Austrian DPA has imposed a fine of EUR 700 on a private individual. An employee of a telecoms provider used an internal software tool to access a data subject's account. They then shared the data subject's phone number with a private acquaintance, who proceeded to repeatedly call the data subject. The DSB treated the employee as the controller because they had acted on their own initiative and outside of their employer's instructions. The Federal Administrative Court lowered the initial fine of EUR 1,000.

Open original source Links to the regulator's original publication or another source.