DSB (Austria) - 2026-0.016.479

Summary

The Austrian Data Protection Authority (DSB) has fined a medical student €200 for unlawfully processing health data. The student filmed a patient with dementia and shared the video with a colleague, violating GDPR articles related to data processing, legitimate purpose, and special categories of data. The DPA found the processing was intentional and lacked a legal basis, emphasizing that personal communication with a fellow student does not constitute a legitimate purpose for processing sensitive health information.

Full text

Help DSB (Austria) - 2026-0.016.479: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 11:12, 14 July 2026 view source Ds (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators161 edits Tag: submission [1.0] (No difference) Latest revision as of 11:12, 14 July 2026 DSB - 2026-0.016.479 Authority: DSB (Austria) Jurisdiction: Austria Relevant Law: Article 4(15) GDPR Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 6(1) GDPR Article 9(2) GDPR Type: Other Outcome: n/a Started: Decided: 12.01.2026 Published: 10.07.2026 Fine: 200 EUR Parties: n/a National Case Number/Name: 2026-0.016.479 European Case Law Identifier: ECLI:AT:DSB:2026:2026.0.016.479 Appeal: n/a Original Language(s): German Original Source: RIS (in DE) Initial Contributor: ds The DPA fined a medical student €200 for filming a hospital patient with dementia and sharing the video with a fellow student. It found that the recording and disclosure constituted unlawful processing of health data. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts A medical student (the controller) worked as a ward attendant at a hospital. Her duties were to remain in the immediate vicinity of patients, ensure their safety and notify the nursing staff immediately when necessary. While assigned to a patient with dementia (the data subject), she recorded a video of him wearing a hospital gown and throwing a newspaper to the floor. She subsequently sent the video to a fellow student through a messaging service. The recording lasted about eleven seconds. Holding The DPA treated the medical student as the controller of the relevant processing pursuant to Article 4(7) GDPR because she decided to record the data subject and disclose the video to a third party. It found that the context of the video, the data subject’s clothing and behaviour revealed information concerning his health within the meaning of Article 4(15) GDPR. The video therefore contained special categories of personal data. The DPA noted that an applicable condition under Article 9(2) GDPR was required for the processing. The DPA found that the controller lacked a legal basis for the relevant processing. It emphasized that the controller could not rely on Article 6(1)(f) GDPR since Article 9(2) GDPR restricts processing based on legitimate interest. The DPA pointed out that no scientific purpose was apparent for this recording and disclosure. It further noted that the video recording of the data subject was made for the purpose of exchanging comments with a fellow student. It therefore held that the processing also lacked a legitimate purpose under Article 5(1)(b) GDPR. The DPA concluded that the controller infringed Article 5(1)(a) GDPR, Article 5(1)(b) GDPR, Article 6(1) GDPR and Article 9(2) GDPR. It found that she had acted intentionally, as she had knowingly recorded and transmitted the video and was aware that the processing was unlawful. It imposed a fine of €200, with twelve hours’ substitute imprisonment if the fine proved uncollectible. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Text File No.: 2026-0.016.479 dated January 12, 2026 (Case No.: DSB-D550.1269) [Note from Editor: Names and companies, legal forms and product names, addresses (including URLs, IP and email addresses), file numbers (and the like), statistical data, etc., as well as their initials and abbreviations may be abbreviated and/or altered for pseudonymization purposes.] Obvious spelling, grammar, and punctuation errors have been corrected. Penalty Notice Defendant: Liselotte D***, born on **.**.2003 As a data controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: "GDPR"), OJ No. L 119 of 4 May 2016, p. 1 as amended, you have committed the following offense and thereby the following administrative offence: As a data controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: "GDPR"), Official Journal No. L 119 of 4 May 2016, page 1 as amended, you have committed the following act and thereby the following administrative offense: On 23 March 2025 (hereinafter referred to as the "time of the offense"), in Ward ** - **** Neurology and **** - in Pavilion ** on the 1st floor of Clinic V*** at "B***gasse **4, in **** J***stadt" (hereinafter referred to as the "location of the offense"), you recorded a video of patient N*** N*** (hereinafter referred to as the "affected person") with your mobile phone in order to disclose it to a third party, specifically Ms. Doris Ü***, and to discuss it with her. The video shows the affected person, who has dementia, wearing a hospital gown in the hallway, holding a newspaper and then throwing it to the ground. The recording lasts approximately eleven seconds. At the end of the video, you can be seen holding your hand over your mouth and breathing heavily. By creating the video recording and sharing it with third parties, you processed personal data, namely health data, without a legitimate purpose as defined in Article 5(1)(b) GDPR or a legal basis as defined in Article 6(1) in conjunction with Article 9(2) and Article 5(1)(a) GDPR. By creating the video recording and sharing it with third parties, you processed personal data, namely health data, without a legitimate purpose as defined in Article 5(1)(b) GDPR or a legal basis as defined in Article 6(1) in conjunction with Article 9(2) and Article 5(1)(a) GDPR. Administrative offense pursuant to: Article 5(1)(a) and (b) and Article 6(1) in conjunction with Article 9(2) and Article 83(1) and (5)(a) GDPR, Official Journal L 2016/119, p. 1, as amended; Article 5(1), letters a and b, and Article 6(1) in conjunction with Article 9(2) and Article 83(1) and (5), letter a, GDPR, Official Journal L 2016/119, p. 1, as amended The following penalty is imposed for this administrative offense: A fine of EUR If this fine cannot be collected, a substitute custodial sentence of pursuant to EUR 200 12 hours Article 83(5)(a) GDPR in conjunction with Section 16 Administrative Penal Code 1991 (VStG), Article 83, Paragraph 5, Letter a, GDPR in conjunction with Section 16, Administrative Penal Code 1991 (VStG) Furthermore, pursuant to Section 64 of the Administrative Penal Code 1991 (VStG), you are required to pay: €20 as a contribution to the costs of the proceedings, which is 10% of the penalty, but at least €10; The total amount payable (penalty/costs/out-of-pocket expenses) is therefore €220 Payment deadline: If no appeal is filed, this penalty order is immediately enforceable. In this case, the total amount must be paid within two weeks of the order becoming legally binding to the account [Note: abbreviated here], payable to the Data Protection Authority. Please include the file number and the date of completion in the payment reference. If payment is not received within this period, the total amount may be demanded. In this case, a flat fee of five euros is payable. If payment is still not received, the outstanding amount will be enforced, and in the event of non-payment, the corresponding substitute custodial sentence will be served. Justification: 1. The following facts relevant to the decision have been established based on the evidence presented: 1.1. The defendant is a medical stude

Entities