Austria

Private Individual

600 €

GDPR enforcement action by Austrian Data Protection Authority (dsb) on 2020-10-19.

Rank · Sector

#264

of 270 in Health Care

Rank · Austria

#31

of 38

Rank · All fines

#2,769

of 3,050

Case details

Authority: Austrian Data Protection Authority (dsb)
Date: 2020-10-19
Controller / Processor: Private Individual
Sector: Health Care
Quoted Articles: Art. 5 (1) a) GDPR, Art. 9 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

Between February and June 2020, a private individual published information about patients on his personal Facebook page. The information included health data in terms of Art. 4 (15) GDPR. In detail, the published data comprised patient names, diagnostic findings, medical diagnoses, medication data, data on hospital admissions and discharges, patients' social security numbers and the names of the treating physicians.

Open original source Links to the regulator's original publication or another source.