GDPR Fines

A public record of GDPR enforcement across Europe — compiled by INPLP members

Private Person - Doctor

Country
Austria
Fine
600 EUR
Date
2020-10-19
Sector
Private Sector
Articles
Art.4 (15) GDPRArt.5 (1) a) GDPRArt.9 (1) and (2) GDPRArt.83 (5) a) GDPR

Monetary fine; Lack of legal basis for data processing

For a period of approximately 4 to 5 months, a doctor published patient data and medical records on his personal Facebook page. The published data included patient names, diagnostic data, medical diagnoses, medication data, hospital admission and discharge data, patients' social security numbers, and the names of the treating doctors. The decision was passed in a simplified procedure in which the imposed fine of 600,- Euros is the maximum penalty. Authority: Austrian Data Protection Authority (DSB)