DSB (Austria) - DSB-D550.1284

The DPA held that an employee who shared a customer’s phone number with a third person for a personal favour, overstepping company rules, acted as separate controller. Further, the DPA fined the controller € 1,000 for the unlawful data transmission. English Summary. Facts. An employee (controller) of a company shared the telephone number of a costumer (data subject) with a third person. The third person who was a personal acquaintance of the controller, asked the controller to share the telephone number of the data subject, who was the third person’s ex-partner, in order to gift her a present. In reality, the third person used the information to repeatedly call the data subject. The controller’s employer had rules in place to avoid such data transmissions. Those company rules were overstepped by the controller by providing the third person with the telephone number of the data subject without asking for the password connected to the data subject’s account held with the company. The con