Enforcement · DSB EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

DSB-D124.2437/25

The DSB held that a therapy association violated a patient's right of access by failing to disclose personal data in a therapist's handwritten notes and by omitting required information on purposes, categories, recipients and retention. English Summary. Facts. The controller, an Austrian registered association, operates a therapy centre for psychosomatic illnesses. The data subject was a patient of the controller. On 28 July 2025, the data subject sent an access request by email under

Austria
Automated Decision-Making Profiling Artificial Intelligence Right of Access Procedures Data Controller Right to Explanation Processing Right of Access
Aug 25, 2026 Source

How it connects

Related across sources

Literature HOW GDPR TREATS AUTOMATED DECISION-MAKING Journal Scientific and Applied Research Guidance Report of the work undertaken by the ChatGPT Taskforce EDPB Guidance Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (LED) under Article 62 EDPB Guidance EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( EDPB Literature Artificial Intelligence in Decision-making: A Test of Consistency between the “EU AI Act” and the “General Data Protection Regulation” Athens Journal of Law Guidance Guidelines 8/2020 on the targeting of social media users EDPB

Full text

The DSB held that a therapy association violated a patient's right of access by failing to disclose personal data in a therapist's handwritten notes and by omitting required information on purposes, categories, recipients and retention. English Summary. Facts. The controller, an Austrian registered association, operates a therapy centre for psychosomatic illnesses. The data subject was a patient of the controller. On 28 July 2025, the data subject sent an access request by email under Article 15 GDPR, asking for full information on all personal data processed about him including specific categories of data, processing purposes, recipients, storage periods, data origin, any automated decision-making, a copy of his data in electronic format and what data had been processed by two named individuals (a doctor and a body therapist working for the controller) and whether either had disclosed his data to third parties. The controller's chairperson replied by email on 12 August

Original document at the source gdprhub.eu
Related documents