Enforcement · Austrian Data Protection Authority (dsb) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Medical Student: Insufficient legal basis for data processing
The Austrian Data Protection Authority (dsb) fined a medical student €200 for processing personal data without a sufficient legal basis under GDPR Article 6(1)(f) and Article 9(2).
Status Not cited by any decision here yet
Summary
The case addressed the unlawful processing of personal data, including special category health data, where the respondent failed to establish a valid legal basis for the processing activities. The authority imposed a modest fine, reflecting the individual status of the respondent and the specific circumstances of the violation.
We hold a reference to this item, not its text.
enforcementtracker.com Read at the sourceHow it connects
References
Related across sources
C-667/21 ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts The CJEU (Third Chamber) ruled on a preliminary reference from the Bundesarbeitsgericht in a case where ZQ sought compensation from his employer, Medizinischer Dienst der… CJEU ·Third Chamber Dec 21, 2023 Health Data Healthcare Integrity and Confidentiality Principle
W137 2334258-1/5E Federal Administrative Court · BVwG - W137 2334258-1/5E XXXX as the party lodged a complaint at the Austrian DPA (District Hospital XXXX as the co-party) on the unauthorised sharing of her personal data in seven different instances by… Sep 7, 2026 Legitimate Interest Personal Data Integrity and Confidentiality Principle
W292 2292202-1 The data subject is in the military The unit he is employed at (controller) and the data subject are involved in a multitude of legal disputes concerning his employment, disciplinary proceedings, data protection… BVwG - W292 2292202-1 ·Federal Administrative Court Jun 30, 2026 Health Data Integrity and Confidentiality Principle Healthcare
C-252/21 Meta Platforms v noyb C-252/21 (Meta Platforms (noyb)) CJEU Jan 12, 2023 Supervision IP Address Integrity and Confidentiality Principle
C-203/22 CK v Magistrat der Stadt Wien In Case C-203/22, the Court of Justice of the European Union interpreted Article 15(1)(h) of the GDPR in response to a preliminary ruling from the Verwaltungsgericht Wien… CJEU ·First Chamber Feb 27, 2025 Profiling Personal Data Automated Decision-Making
C-169/23 Nemzeti Adatvédelmi és Információszabadság Hatóság v UC In Case C-169/23, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Kúria (Hungary) concerning whether the Budapest Metropolitan… CJEU ·Third Chamber Nov 28, 2024 Personal Data Legitimate Interest Fairness & Transparency