Skip to content
Enforcement · Austrian Data Protection Authority (dsb) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Medical Student: Insufficient legal basis for data processing

€200 Fine
Medical Student
Austria
Art. 6 GDPR Art. 9 GDPR
Individuals and Private Associations
Decided 2026-01-12

How it connects

Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE) Background informationDate of final decision: 28 August 2026National caseLegal Reference(s): Article 5 (Principles relating to processing of personal data), Article 32 (Security… Sep 3, 2026 Data Breaches Notification Obligation Integrity and Confidentiality Principle
2026 EWCA Civ 1130 EWCA (UK) - 2026 EWCA Civ 1130 Three persons who had brought personal injury claims arising from road traffic accidents and whose personal and health data were included in a spreadsheet prepared for use in… Court of Appeal (Civil Division) Sep 2, 2026 Retention Period Anonymization Pseudonymization
1 As 183/2023-62 OAKS Consulting s.r.o. (the company) provided consulting services concerning market access conditions for medicinal products and medical devices Pursuant to the Czech Act on Free Access to Information, it requested information from the General Health Insurance Company of the Czech Republic concerning the treatment of… NSS - 1 As 183/2023-62 ·Supreme Administrative Court Aug 4, 2026 Special Categories of Data Personal Data Pseudonymization
C‑474/24 NADA Austria and Others CJEU - C‑474/24 - NADA Austria and Others Several data subjects were subject to suspension proceedings by the Austrian Anti-Doping Legal Commission (ÖADR). Under Austrian law, the National Anti-Doping Agency (“NADA”)… Jul 24, 2026 Criminal Data Special Categories of Data Types of Special Categories of Personal Data
SAN 3154/2026 In May 2021, a data subject lodged a complaint with the DPA against KFC Restaurants Spain, S.L.U., the controller, concerning the processing of personal data through its website The data subject claimed that the privacy information applicable to users in the EEA was not easily accessible, as the main privacy link led to a global policy. The data subject… AN - SAN 3154/2026 ·National Court Jul 16, 2026 Supervisory Authorities Controllers Personal Data
EWCA Civ 899 Vince v. Associated Newspapers Limited CA - EWCA Civ 899 Vince v. Associated Newspapers Limited Associated Newspapers Limited, the controller, published print and online articles in the Daily Mail and Mail+ on 8 and 9 June 2023 concerning a data subject. The articles were… Court of Appeal Jul 15, 2026 Liability Processing Personal Data

We hold a reference to this item, not its text.

www.enforcementtracker.com Read at the source

Austrian Data Protection Authority (dsb) · Jan 12, 2026