DSB (Austria) - DSB-D550.1284

Summary

An employee in Austria acted as an independent controller when they shared a customer's phone number with a third party for personal reasons, violating company rules and GDPR. The Austrian Data Protection Authority (DSB) fined the employee €1,000 for unlawful data transmission, as 'benevolence' or a third party's interest in harassing someone does not constitute a legitimate basis for processing personal data.

Full text

Help DSB (Austria) - DSB-D550.1284: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 08:46, 18 August 2026 view source Lh (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators3 edits Tag: Decisions [1.0] (No difference) Latest revision as of 08:46, 18 August 2026 DSB - DSB-D550.1284 Authority: DSB (Austria) Jurisdiction: Austria Relevant Law: Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 4(7) GDPR Article 6(1)(f) GDPR Article 83(5)(a) GDPR Type: Complaint Outcome: n/a Started: Decided: Published: Fine: 1000.0 EUR Parties: n/a National Case Number/Name: DSB-D550.1284 European Case Law Identifier: ECLI:AT:DSB:2026:2026.0.074.279 Appeal: n/a Original Language(s): German Original Source: RIS (in DE) Initial Contributor: lh The DPA held that an employee who shared a customer’s phone number with a third person for a personal favour, overstepping company rules, acted as separate controller. Further, the DPA fined the controller € 1,000 for the unlawful data transmission. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts An employee (controller) of a company shared the telephone number of a costumer (data subject) with a third person. The third person who was a personal acquaintance of the controller, asked the controller to share the telephone number of the data subject, who was the third person’s ex-partner, in order to gift her a present. In reality, the third person used the information to repeatedly call the data subject. The controller’s employer had rules in place to avoid such data transmissions. Those company rules were overstepped by the controller by providing the third person with the telephone number of the data subject without asking for the password connected to the data subject’s account held with the company. The controller stated that he acted out of benevolence to do the third person a favour, believing that the third person intended to make the data subject a gift. Holding The DPA held that the employee acted as controller pursuant to Article 4(7) GDPR because he acted on his own initiative and not on behalf of the company. The controller could not rely on any legal basis for his processing of personal data. “Benevolence” is not a legitimate interest as provided for by Article 6(1)(f) GDPR. Neither can the controller rely on a legitimate interest of the third person, as “overwhelming a person with phone calls” is not a legitimate interest. The DPA held that in order to determine the legitimate interest of a third person, what matters is the actual interest, not the interest the controller believes the third person to have. The DPA held that the controller has to act with intent or negligence for the DPA to issue a fine. The controller intentionally shared the personal data without requesting the credentials to the data subject’s account and misused his competences as an employee. The DPA issued a fine of €1,000. In the DPA’s publication of the decision, it is pointed out that the fine was reduced to €700 upon appeal of the controller with the Federal Administrative Court (Bundesverwaltungsgericht). Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Text Ref. No.: 2026-0.074.279 dated January 27, 2026 (Case No.: DPA-D550.1284) [Note from the processor: Names and company names, legal forms and product names, addresses (including URLs, IP addresses, and email addresses), case numbers (and the like), statistical data, etc., as well as their initials and abbreviations, may be abbreviated and/or altered for pseudonymization purposes. Obvious spelling, grammar, and punctuation errors have been corrected.] Penalty Notice Defendant: Aydin B***, born on **.**.1994 As the controller within the meaning of Art. 4(7) of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: “GDPR”), OJ No. L 119 of May 4, 2016, p. 1, as amended, committed the following administrative offense by engaging in the acts described below: As the controller within the meaning of article 4, paragraph 7, of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data, on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “GDPR”), Official Journal No. L 119 of May 4, 2016, page 1, as amended, committed the following administrative offense by engaging in the acts described below: On December 3, 2025 (hereinafter “date of the offense”), as an employee of V*** GmbH (hereinafter “V***”), headquartered at 1*** Vienna, K***-Gasse 1*7/F/*8 (hereinafter “scene of the offense”), by using it without an official assignment and contrary to all official instructions in such a way that you accessed the customer data of Ms. Manuela O*** (hereinafter “data subject”) and disclosed the data subject’s (new) phone number to a third party —with whom you were personally acquainted—(hereinafter “Third Party”), to whom you disclosed the data subject’s (new) phone number out of goodwill and based on a long-standing relationship of trust during a telephone conversation. The data subject subsequently received numerous calls from the Third Party. The processing of the Data Subject’s personal data and its disclosure to an unauthorized person took place without a legal basis pursuant to Article 5(1)(a) in conjunction with Article 6(1) of the GDPR and without a legitimate purpose pursuant to Article 5(1)(b) of the GDPR.The processing of the data subject’s personal data and its disclosure to an unauthorized person took place without a legal basis pursuant to Article 5(1)(a) in conjunction with Article 6(1) of the GDPR and without a legitimate purpose pursuant to Article 5(1)(b) of the GDPR. Administrative offense pursuant to: Art. 5(1)(a) and (b) and Art. 6(1) in conjunction with Art. 83(3) and (5)(a) of the GDPR, OJ L 2016/119, p. 1, as amended; Article 5, paragraph 1, subparagraphs (a) and (b), and Article 6, paragraph 1, in conjunction with Article 83, paragraph 3 and paragraph 5, subparagraph (a), of the GDPR, Official Journal L 2016/119, p. 1, as amended The following penalty is imposed for this administrative offense: [Processing Officer’s Note: For the amended and final penalty determination, see the section “Appeal to the BVwG/VwGH/VfGH”] Fine of Euro if this is uncollectible, a substitute custodial sentence of pursuant to €1,000 60 hours Art. 83(5)(a) GDPR in conjunction with § 16 of the Administrative Penalties Act of 1991 (VStG) Article 83, paragraph 5, subparagraph (a), GDPR in conjunction with Section 16 of the Administrative Penalties Act of 1991 (VStG) Furthermore, pursuant to § 64 of the Administrative Penalties Act of 1991 (VStG), you are required to pay: Furthermore, pursuant to § 64 of the Administrative Penalties Act of 1991 (VStG), you are required to pay: 100 euros as a contribution toward the costs of the penalty proceedings, which amounts to 10% of the fine, but at least 10 euros; The total amount due (fine/costs/out-of-pocket expenses) is therefore 1,100 euros Payment deadline: If no complaint is filed, this penalty notice is immediately enforceable. In this case, the total amount must be paid into the account [omitted here] within two weeks after the decision becomes final. Please indicate the reference number and the date of settlement as the payment description. If payment is not made within this period, the total amount may be subject to collection proceedings. In this case, a flat-rate fee of five euros mus

Entities