A medical ambulatory, whose corporate purpose includes in particular the diagnosis and therapy of allergic diseases

The medical ambulatory had violated the obligation to appoint a data protection officer. It obliged the personas concerned to give their unlawful consent and did not correctly comply with the duty to provide information on several points. Finally, the allergy outpatient clinic did not fulfil its duty to examine the need to carry out data protection impact assessments to the necessary extent. Authority: Austrian Data Protection Authority (Österreichische Datenschutzbehörde "DSB")