[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fi9YwU8QFZxY9Fs8PAWPjqCt-gTvQOQh28r4HCKzUHs8":3},{"article":4,"iocs":44},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":26},"109af30c-1a47-4fc5-a1a6-cad08d51cd8c","DSB (Austria) - 2026-0.016.479","dsb-austria-2026-0-016-479-c9ad3b","Created page with \"{{DPAdecisionBOX |Jurisdiction=Austria |DPA-BG-Color= |DPAlogo=LogoAT.png |DPA_Abbrevation=DSB |DPA_With_Country=DSB (Austria) |Case_Number_Name=2026-0.016.479 |ECLI=ECLI:AT:DSB:2026:2026.0.016.479 |Original_Source_Name_1=RIS |Original_Source_Link_1=https:\u002F\u002Fwww.ris.bka.gv.at\u002FDokument.wxe?ResultFunctionToken=d51723de-dcba-464e-831f-8df9395195c3&Position=1&SkipToDocumentPage=True&Abfrage=Dsk&Entscheidungsart=Undefined&Organ=Undefined&SucheNachRechtssatz=True&SucheNachTe...\" New page {{DPAdecisionBOX |Jurisdiction=Austria |DPA-BG-Color= |DPAlogo=LogoAT.png |DPA_Abbrevation=DSB |DPA_With_Country=DSB (Austria) |Case_Number_Name=2026-0.016.479 |ECLI=ECLI:AT:DSB:2026:2026.0.016.479 |Original_Source_Name_1=RIS |Original_Source_Link_1=https:\u002F\u002Fwww.ris.bka.gv.at\u002FDokument.wxe?ResultFunctionToken=d51723de-dcba-464e-831f-8df9395195c3&Position=1&SkipToDocumentPage=True&Abfrage=Dsk&Entscheidungsart=Undefined&Organ=Undefined&SucheNachRechtssatz=True&SucheNachText=True&GZ=&VonDatum=01.01.1990&BisDatum=&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=EinerWoche&ResultPageSize=100&Suchworte=DSGVO&Dokumentnummer=DSBT_20260112_2026_0_016_479_00 |Original_Source_Language_1=German |Original_Source_Language__Code_1=DE |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Other |Outcome= |Date_Started= |Date_Decided=12.01.2026 |Date_Published=10.07.2026 |Year=2026 |Fine=200 |Currency=EUR |GDPR_Article_1=Article 4(15) GDPR |GDPR_Article_Link_1=Article 4 GDPR#15 |GDPR_Article_2=Article 5(1)(a) GDPR |GDPR_Article_Link_2=Article 5 GDPR#1a |GDPR_Article_3=Article 5(1)(b) GDPR |GDPR_Article_Link_3=Article 5 GDPR#1b |GDPR_Article_4=Article 6(1) GDPR |GDPR_Article_Link_4=Article 6 GDPR#1 |GDPR_Article_5=Article 9(2) GDPR |GDPR_Article_Link_5=Article 9 GDPR#2 |GDPR_Article_6= |GDPR_Article_Link_6= |GDPR_Article_7= |GDPR_Article_Link_7= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1= |Party_Link_1= |Party_Name_2= |Party_Link_2= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status= |Appeal_To_Link= |Initial_Contributor=ds | }} The DPA fined a medical student €200 for filming a hospital patient with dementia and sharing the video with a fellow student. It found that the recording and disclosure constituted unlawful processing of health data. == English Summary == === Facts === A medical student (the controller) worked as a ward attendant at a hospital. Her duties were to remain in the immediate vicinity of patients, ensure their safety and notify the nursing staff immediately when necessary. While assigned to a patient with dementia (the data subject), she recorded a video of him wearing a hospital gown and throwing a newspaper to the floor. She subsequently sent the video to a fellow student through a messaging service. The recording lasted about eleven seconds. === Holding === The DPA treated the medical student as the controller of the relevant processing pursuant to [[Article 4 GDPR#7|Article 4(7) GDPR]] because she decided to record the data subject and disclose the video to a third party. It found that the context of the video, the data subject’s clothing and behaviour revealed information concerning his health within the meaning of [[Article 4 GDPR#15|Article 4(15) GDPR]]. The video therefore contained special categories of personal data. The DPA noted that an applicable condition under [[Article 9 GDPR#2|Article 9(2) GDPR]] was required for the processing. The DPA found that the controller lacked a legal basis for the relevant processing. It emphasized that the controller could not rely on [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]] since [[Article 9 GDPR#2|Article 9(2) GDPR]] restricts processing based on legitimate interest. The DPA pointed out that no scientific purpose was apparent for this recording and disclosure. It further noted that the video recording of the data subject was made for the purpose of exchanging comments with a fellow student. It therefore held that the processing also lacked a legitimate purpose under [[Article 5 GDPR#1b|Article 5(1)(b) GDPR]]. The DPA concluded that the controller infringed [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]], [[Article 5 GDPR#1b|Article 5(1)(b) GDPR]], [[Article 6 GDPR#1|Article 6(1) GDPR]] and [[Article 9 GDPR#2|Article 9(2) GDPR]]. It found that she had acted intentionally, as she had knowingly recorded and transmitted the video and was aware that the processing was unlawful. It imposed a fine of €200, with twelve hours’ substitute imprisonment if the fine proved uncollectible. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the German original. Please refer to the German original for more details. Text File No.: 2026-0.016.479 dated January 12, 2026 (Case No.: DSB-D550.1269) [Note from Editor: Names and companies, legal forms and product names, addresses (including URLs, IP and email addresses), file numbers (and the like), statistical data, etc., as well as their initials and abbreviations may be abbreviated and\u002For altered for pseudonymization purposes.] Obvious spelling, grammar, and punctuation errors have been corrected. Penalty Notice Defendant: Liselotte D***, born on **.**.2003 As a data controller within the meaning of Article 4(7) of Regulation (EU) 2016\u002F679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\u002F46\u002FEC (General Data Protection Regulation, hereinafter: \"GDPR\"), OJ No. L 119 of 4 May 2016, p. 1 as amended, you have committed the following offense and thereby the following administrative offence: As a data controller within the meaning of Article 4(7) of Regulation (EU) 2016\u002F679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\u002F46\u002FEC (General Data Protection Regulation, hereinafter: \"GDPR\"), Official Journal No. L 119 of 4 May 2016, page 1 as amended, you have committed the following act and thereby the following administrative offense: On 23 March 2025 (hereinafter referred to as the \"time of the offense\"), in Ward ** - **** Neurology and **** - in Pavilion ** on the 1st floor of Clinic V*** at \"B***gasse **4, in **** J***stadt\" (hereinafter referred to as the \"location of the offense\"), you recorded a video of patient N*** N*** (hereinafter referred to as the \"affected person\") with your mobile phone in order to disclose it to a third party, specifically Ms. Doris Ü***, and to discuss it with her. The video shows the affected person, who has dementia, wearing a hospital gown in the hallway, holding a newspaper and then throwing it to the ground. The recording lasts approximately eleven seconds. At the end of the video, you can be seen holding your hand over your mouth and breathing heavily. By creating the video recording and sharing it with third parties, you processed personal data, namely health data, without a legitimate purpose as defined in Article 5(1)(b) GDPR or a legal basis as defined in Article 6(1) in conjunction with Article 9(2) and Article 5(1)(a) GDPR. By creating the video recording and sharing it with third parties, you processed personal data, namely health data, without a legitimate purpose as defined in Article 5(1)(b) GDPR or a legal basis as defined in Article 6(1) in conjunction with Article 9(2) and Article 5(1)(a) GDPR. Administrative offense pursuant to: Article 5(1)(a) and (b) and Article 6(1) in conjunction with Article 9(2) and Article 83(1) and (5)(a) GDPR, Official Journal L 2016\u002F119, p. 1, as amended; Article 5(1), letters a and b, and Article 6(1) in conjunction with Article 9(2) and Article 83(1) and (5), letter a, GDPR, Official Journal L 2016\u002F119, p. 1, as amended The following penalty is imposed for this administrative offense: A fine of EUR If this fine cannot be collected, a substitute custodial sentence of pursuant to EUR 200 12 hours Article 83(5)(a) GDPR in conjunction with Section 16 Administrative Penal Code 1991 (VStG), Article 83, Paragraph 5, Letter a, GDPR in conjunction with Section 16, Administrative Penal Code 1991 (VStG) Furthermore, pursuant to Section 64 of the Administrative Penal Code 1991 (VStG), you are required to pay: €20 as a contribution to the costs of the proceedings, which is 10% of the penalty, but at least €10; The total amount payable (penalty\u002Fcosts\u002Fout-of-pocket expenses) is therefore €220 Payment deadline: If no appeal is filed, this penalty order is immediately enforceable. In this case, the total amount must be paid within two weeks of the order becoming legally binding to the account [Note: abbreviated here], payable to the Data Protection Authority. Please include the file number and the date of completion in the payment reference. If payment is not received within this period, the total amount may be demanded. In this case, a flat fee of five euros is payable. If payment is still not received, the outstanding amount will be enforced, and in the event of non-payment, the corresponding substitute custodial sentence will be served. Justification: 1. The following facts relevant to the decision have been established based on the evidence presented: 1.1. The defendant is a medical student and was also employed part-time as a so-called \"patient sitter\" by Z*** GmbH, which was contracted by [Editor's note: Name of hospital operator removed for reasons of anonymity] to provide sitters in various clinics. In this role, her task was to remain directly with patients to ensure their safety and, if necessary, to immediately notify the nursing staff. 1.2. On March 23, 2025 (hereinafter referred to as \"time of the offense\"), the accused was on duty in ward ** – **** Neurology and **** – in Pavilion ** on the first floor of Clinic V*** at the address \"B***gasse **4, in **** J***stadt\" (hereinafter referred to as \"scene of the offense\"). During this workday, the accused was assigned to patient N*** N***, who suffers from dementia (hereinafter referred to as \"patient\"). The patient was restless that day. The accused tried to keep him occupied; however, he immediately threw away all the items she brought him. In this situation, the accused made a recording with her mobile phone to show this behavior to her fellow student, Ms. Doris Ü***. 1.3. The video shows the patient, who was under her care, wearing a hospital gown in the hallway, holding a newspaper and then throwing it to the floor. The recording lasts approximately eleven seconds. At the end of the video, the accused can be seen holding her hand to her mouth and breathing heavily. An excerpt of the video is as follows (formatting not reproduced verbatim): [Editor's note: The still image from a video recording, originally displayed here as a screenshot in a graphic format, has been removed for reasons of pseudonymization (the person concerned is depicted). It shows the events described above.] 1.4. The accused subsequently transmitted this video to her fellow student via the telecommunications service K***Messenger. 1.5. The accused currently receives child benefits in the amount of EUR 290 per month and has cash assets of EUR 3,700. 2. The findings are based on the following evaluation of the evidence: 2.1. The findings made regarding points 1.1 and 1.2. These findings are based on the transcript of the accused's oral justification dated January 8, 2026 (file number: D550.1269; 2026-0.015.896) and the report submitted by [Editor's note: Name of reporting organization removed for pseudonymization reasons] on October 14, 2025, recorded under file number: D084.8137. Furthermore, on January 12, 2026, the Data Protection Authority conducted an official inquiry via the website of Z*** GmbH (https:\u002F\u002Fwww.z***.at\u002Fpersonal\u002F). 2.2 The findings regarding the video are based on the video material submitted as part of the report by [Editor's note: Name of reporting organization removed for pseudonymization reasons]. This was played in its entirety to the accused during her oral statement on January 8, 2026 (Ref. No. D550.1269; 2026-0.015.896). 2.3. The finding that the accused forwarded the video in question to Ms. Ü*** via K***Messenger is based on Ms. Ü***'s statement on January 8, 2026 (Ref. No. D550.1269; 2026-0.015.896). 2.4. The findings regarding the financial circumstances in point 1.5 are based on the accused's statements during her oral statement on January 8, 2026 (Ref. No. 550.1269; 2026-0.015.896). 3. The following legal conclusions follow: 3.1. Regarding the objective elements of the offense In the present case, the accused, as the data controller pursuant to Article 4(7) GDPR, produced personal (video) data of the data subject at the scene of the offense at the time of the offense, in accordance with Article 4(1) GDPR (see ECJ 11.12.2014, C-212\u002F13, para. 2), and transmitted it to a third party. ... According to the established case law of the CJEU, in order to be lawful within the meaning of the GDPR, data processing must comply with all the principles set out in Article 5(1) GDPR and, in addition, be able to be based on at least one legal basis under Article 6(1) GDPR and, in the context of sensitive data, also on Article 9(2) GDPR (see, for example, CJEU judgment of 4 May 2023, C-60\u002F22, paragraphs 56 and 57). Paragraphs 56 and 57). Furthermore, the video context, as well as the clothing and behavior, allow for an unambiguous conclusion regarding the health status of the data subject within the meaning of Article 4(15) GDPR, and consequently, the stricter regulatory regime of Article 9(2) GDPR must be considered. In the absence of other legal grounds for processing, the only remaining issue to be examined is the \"legitimate interest\" implicitly invoked by the accused through the purpose of the processing, namely communication with her fellow student. The GDPR itself does not define \"legitimate interest,\" but Recitals 47 et seq. provide several examples. \"Legitimate interests\" within the meaning of Article 6(1)(f) GDPR are to be interpreted broadly; in principle, they can be any interest approved by the legal system (see Wolff in Schantz\u002FWolff, Datenschutzrecht [Data Protection Law] para. 643; Frenzel in Paal\u002FPauly, GDPR\u002FBDSG2, Article 6 para. 28). “Legitimate interests” within the meaning of Article 6(1)(f) GDPR are to be interpreted broadly; in principle, they can be any interest approved by the legal system (see Wolff in Schantz\u002FWolff, Datenschutzrecht [Data Protection Law] para. 643; Frenzel in Paal\u002FPauly, GDPR\u002FBDSG2, Article 6, para. 28). However, Article 9(2) GDPR restricts processing based on “legitimate interests” to the extent that the processing can only be justified on the basis of the “legitimate interests” mentioned in Article 9(2) GDPR. Article 9(2) GDPR restricts processing based on “legitimate interests” to the extent that the processing can only be justified on the basis of the “legitimate interests” mentioned in Article 9(2) GDPR. It can therefore be stated at this point that no legitimate interest approved by the legal system can be identified for processing special categories of data, namely health data, for the purpose of exchanging information about the video with a fellow student and seemingly having fun with it. Consequently, the existence of a legitimate purpose pursuant to Article 5(1)(b) GDPR must also be denied. In any case, no scientific interest on the part of the accused is apparent. Firstly, she was unable to explain in detail during her oral justification how the video recording in question was intended to be discussed in a scientific context or was suitable for stimulating scientific discourse. Secondly, the defendant's self-presentation at the end of the video—where she can be seen holding her hand to her mouth and panting, or, according to her own account, taking a deep breath—is diametrically opposed to any potential scientific purpose. Consequently, there is no legal basis for processing the data within the meaning of Article 5(1)(a) and Article 9(2) GDPR. The objective elements of the offense are therefore fulfilled. 3.2. Regarding the subjective element of the offense The CJEU has held that only violations of the GDPR provisions committed culpably by the controller, i.e., intentionally or negligently, can lead to the imposition of a fine (see CJEU of 5 December 2023, C-807\u002F21, para. 68) and that such culpability already exists if the accused could not have been unaware of the unlawfulness of his conduct, regardless of whether he was aware that he was infringing the provisions of the GDPR (see CJEU C-807\u002F21, para. 76). The accused has a corresponding duty to inquire if he was unclear about the legal situation (Austrian Administrative Court [VwGH] 25.06.2013, 2013\u002F09\u002F0022). The European Court of Justice (ECJ) has held that only violations of the GDPR provisions committed culpably by the controller, i.e., intentionally or negligently, can lead to the imposition of a fine (see ECJ of 5.12.2023, C-807\u002F21, para. 68), and that such culpability already exists if the accused could not have been unaware of the unlawfulness of his conduct, regardless of whether he was aware that he was violating the provisions of the GDPR (see ECJ C-807\u002F21, para. 76). The accused has a corresponding duty to inquire if they were unaware of the legal situation (Austrian Administrative Court [VwGH] 25.06.2013, 2013\u002F09\u002F0022). In the present case, the accused, as the data controller pursuant to Article 4(7) GDPR, consciously decided to record and transmit the video of the data subject and was aware – as they themselves stated in their oral justification of January 8, 2026 – that such processing is unlawful. Therefore, the subjective element of the offense, namely intent, is also fulfilled. ``` 4. Regarding sentencing, the following should be noted: The maximum penalty in this specific case, pursuant to Article 83(5)(a) GDPR, is EUR 20,000,000. The following aggravating factors were considered in determining the penalty in the present case: ● Nature and severity of the infringement: the accused abused her supervisory duties to record video footage of a patient (Article 83(2)(a) GDPR). Nature and severity of the infringement: the accused abused her supervisory duties to record video footage of a patient (Article 83(2)(a) GDPR). ● There is culpability in the form of intent (Article 83(2)(b) GDPR). With regard to the present case, the following mitigating factors were taken into account when determining the sentence: ● The accused had no prior relevant convictions on file with the data protection authority (Article 83(2)(e) GDPR). ● The accused cooperated in the present investigation and contributed to establishing the facts. The accused also admitted the violation (confession) and expressed remorse (Article 83(2)(k) GDPR). The accused cooperated in the present investigation and contributed to establishing the facts. The accused also admitted the violation (confession) and expressed remorse (Article 83(2)(k) GDPR). With regard to the accused's income, the data protection authority assumed a monthly net income of approximately EUR 290. One of the essential objectives of the GDPR, according to Article 1(2) GDPR, is the protection of the fundamental rights and freedoms of natural persons, and in particular their right to the protection of personal data under Article 8 of the Charter of Fundamental Rights of the European Union. The accused violated the data subject's fundamental rights, as explained above. The imposition of this specific fine is therefore necessary, at least for reasons of general deterrence, to raise awareness regarding the creation and distribution of abusive video recordings. In particular, it is intended to clarify that such processing is not covered by the legal basis of Article 6(1)(f) in conjunction with Article 9(2) GDPR. One of the essential objectives of the GDPR, according to Article 1(2), is the protection of the fundamental rights and freedoms of natural persons, and in particular their right to the protection of personal data under Article 8 of the Charter of Fundamental Rights of the European Union. The accused has violated the fundamental rights of the data subject, as explained above. The imposition of this specific fine is therefore necessary, at least for reasons of general deterrence, to raise awareness regarding the creation and distribution of abusive video recordings. In particular, it is intended to clarify that such processing is not covered by the legal basis of Article 6(1)(f) in conjunction with Article 9(2) GDPR. The data protection authority assumes that the accused will refrain from carrying out such processing activities in the future. Therefore, in the opinion of the data protection authority, there are no grounds for special preventive action. The data protection authority assumes that the accused will refrain from carrying out such processing activities in the future. The specific penalty imposed, amounting to EUR 200, therefore appears proportionate to the seriousness of the offense, measured against the available penalty range under Article 83(5) GDPR (here up to EUR 20,000,000) and taking into account the relevant sentencing criteria under Article 83(2) GDPR. Due to the first offense, the penalty is at the lower end of the available range. The specific penalty imposed, amounting to EUR 200, therefore appears proportionate to the seriousness of the offense, measured against the available penalty range under Article 83(5) GDPR (here up to EUR 20,000,000) and taking into account the relevant sentencing criteria under Article 83(2) GDPR. Due to the first offense, it is at the lower end of the available penalty range. If a fine is imposed on a natural person, Section 16 Paragraph 1 of the Administrative Penal Code (VStG) stipulates that a substitute custodial sentence must be imposed simultaneously in the event of non-payment. In this case, 12 hours were set. As a result, the specific penalty imposed is therefore effective, proportionate, and dissuasive in this case within the meaning of Article 83 Paragraph 1 of the GDPR. A lower amount would no longer meet these criteria for a fine.","The Austrian Data Protection Authority (DSB) has fined a medical student €200 for unlawfully processing health data. The student filmed a patient with dementia and shared the video with a colleague, violating GDPR articles related to data processing, legitimate purpose, and special categories of data. The DPA found the processing was intentional and lacked a legal basis, emphasizing that personal communication with a fellow student does not constitute a legitimate purpose for processing sensitive health information.","Austrian DPA fines medical student €200 for filming and sharing patient video.","Help DSB (Austria) - 2026-0.016.479: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 11:12, 14 July 2026 view source Ds (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators161 edits Tag: submission [1.0] (No difference) Latest revision as of 11:12, 14 July 2026 DSB - 2026-0.016.479 Authority: DSB (Austria) Jurisdiction: Austria Relevant Law: Article 4(15) GDPR Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 6(1) GDPR Article 9(2) GDPR Type: Other Outcome: n\u002Fa Started: Decided: 12.01.2026 Published: 10.07.2026 Fine: 200 EUR Parties: n\u002Fa National Case Number\u002FName: 2026-0.016.479 European Case Law Identifier: ECLI:AT:DSB:2026:2026.0.016.479 Appeal: n\u002Fa Original Language(s): German Original Source: RIS (in DE) Initial Contributor: ds The DPA fined a medical student €200 for filming a hospital patient with dementia and sharing the video with a fellow student. It found that the recording and disclosure constituted unlawful processing of health data. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts A medical student (the controller) worked as a ward attendant at a hospital. Her duties were to remain in the immediate vicinity of patients, ensure their safety and notify the nursing staff immediately when necessary. While assigned to a patient with dementia (the data subject), she recorded a video of him wearing a hospital gown and throwing a newspaper to the floor. She subsequently sent the video to a fellow student through a messaging service. The recording lasted about eleven seconds. Holding The DPA treated the medical student as the controller of the relevant processing pursuant to Article 4(7) GDPR because she decided to record the data subject and disclose the video to a third party. It found that the context of the video, the data subject’s clothing and behaviour revealed information concerning his health within the meaning of Article 4(15) GDPR. The video therefore contained special categories of personal data. The DPA noted that an applicable condition under Article 9(2) GDPR was required for the processing. The DPA found that the controller lacked a legal basis for the relevant processing. It emphasized that the controller could not rely on Article 6(1)(f) GDPR since Article 9(2) GDPR restricts processing based on legitimate interest. The DPA pointed out that no scientific purpose was apparent for this recording and disclosure. It further noted that the video recording of the data subject was made for the purpose of exchanging comments with a fellow student. It therefore held that the processing also lacked a legitimate purpose under Article 5(1)(b) GDPR. The DPA concluded that the controller infringed Article 5(1)(a) GDPR, Article 5(1)(b) GDPR, Article 6(1) GDPR and Article 9(2) GDPR. It found that she had acted intentionally, as she had knowingly recorded and transmitted the video and was aware that the processing was unlawful. It imposed a fine of €200, with twelve hours’ substitute imprisonment if the fine proved uncollectible. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Text File No.: 2026-0.016.479 dated January 12, 2026 (Case No.: DSB-D550.1269) [Note from Editor: Names and companies, legal forms and product names, addresses (including URLs, IP and email addresses), file numbers (and the like), statistical data, etc., as well as their initials and abbreviations may be abbreviated and\u002For altered for pseudonymization purposes.] Obvious spelling, grammar, and punctuation errors have been corrected. Penalty Notice Defendant: Liselotte D***, born on **.**.2003 As a data controller within the meaning of Article 4(7) of Regulation (EU) 2016\u002F679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\u002F46\u002FEC (General Data Protection Regulation, hereinafter: \"GDPR\"), OJ No. L 119 of 4 May 2016, p. 1 as amended, you have committed the following offense and thereby the following administrative offence: As a data controller within the meaning of Article 4(7) of Regulation (EU) 2016\u002F679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\u002F46\u002FEC (General Data Protection Regulation, hereinafter: \"GDPR\"), Official Journal No. L 119 of 4 May 2016, page 1 as amended, you have committed the following act and thereby the following administrative offense: On 23 March 2025 (hereinafter referred to as the \"time of the offense\"), in Ward ** - **** Neurology and **** - in Pavilion ** on the 1st floor of Clinic V*** at \"B***gasse **4, in **** J***stadt\" (hereinafter referred to as the \"location of the offense\"), you recorded a video of patient N*** N*** (hereinafter referred to as the \"affected person\") with your mobile phone in order to disclose it to a third party, specifically Ms. Doris Ü***, and to discuss it with her. The video shows the affected person, who has dementia, wearing a hospital gown in the hallway, holding a newspaper and then throwing it to the ground. The recording lasts approximately eleven seconds. At the end of the video, you can be seen holding your hand over your mouth and breathing heavily. By creating the video recording and sharing it with third parties, you processed personal data, namely health data, without a legitimate purpose as defined in Article 5(1)(b) GDPR or a legal basis as defined in Article 6(1) in conjunction with Article 9(2) and Article 5(1)(a) GDPR. By creating the video recording and sharing it with third parties, you processed personal data, namely health data, without a legitimate purpose as defined in Article 5(1)(b) GDPR or a legal basis as defined in Article 6(1) in conjunction with Article 9(2) and Article 5(1)(a) GDPR. Administrative offense pursuant to: Article 5(1)(a) and (b) and Article 6(1) in conjunction with Article 9(2) and Article 83(1) and (5)(a) GDPR, Official Journal L 2016\u002F119, p. 1, as amended; Article 5(1), letters a and b, and Article 6(1) in conjunction with Article 9(2) and Article 83(1) and (5), letter a, GDPR, Official Journal L 2016\u002F119, p. 1, as amended The following penalty is imposed for this administrative offense: A fine of EUR If this fine cannot be collected, a substitute custodial sentence of pursuant to EUR 200 12 hours Article 83(5)(a) GDPR in conjunction with Section 16 Administrative Penal Code 1991 (VStG), Article 83, Paragraph 5, Letter a, GDPR in conjunction with Section 16, Administrative Penal Code 1991 (VStG) Furthermore, pursuant to Section 64 of the Administrative Penal Code 1991 (VStG), you are required to pay: €20 as a contribution to the costs of the proceedings, which is 10% of the penalty, but at least €10; The total amount payable (penalty\u002Fcosts\u002Fout-of-pocket expenses) is therefore €220 Payment deadline: If no appeal is filed, this penalty order is immediately enforceable. In this case, the total amount must be paid within two weeks of the order becoming legally binding to the account [Note: abbreviated here], payable to the Data Protection Authority. Please include the file number and the date of completion in the payment reference. If payment is not received within this period, the total amount may be demanded. In this case, a flat fee of five euros is payable. If payment is still not received, the outstanding amount will be enforced, and in the event of non-payment, the corresponding substitute custodial sentence will be served. Justification: 1. The following facts relevant to the decision have been established based on the evidence presented: 1.1. The defendant is a medical stude","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DSB_(Austria)_-_2026-0.016.479&diff=52209&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F1\u002F1f\u002FLogoAT.png","2026-07-14T11:12:02+00:00","2026-07-14T12:00:22.53041+00:00",7,[18],{"name":19,"type":20},"K***Messenger","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":21,"icon":23,"name":24,"slug":25},null,"Policy","policy",[27,32,37,39],{"category":28},{"id":29,"icon":23,"name":30,"slug":31},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":33},{"id":34,"icon":23,"name":35,"slug":36},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":38},{"id":21,"icon":23,"name":24,"slug":25},{"category":40},{"id":41,"icon":23,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]