# Private Individual: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Austrian Data Protection Authority (dsb)
- Date: 2020-10-19
- Original: https://www.enforcementtracker.com/ETid-461
- Canonical: https://overview.legal/posts/46576
- Topics: Health Data, Healthcare, Healthcare, Social Media, Special Categories of Data, Types of Special Categories of Personal Data, Processing, Security, Supervisory Authorities

## Summary

Between February and June 2020, a private individual published information about patients on his personal Facebook page. The information included health data in terms of Art. 4 (15) GDPR. In detail, the published data comprised patient names, diagnostic findings, medical diagnoses, medication data, data on hospital admissions and discharges, patients' social security numbers and the names of the treating physicians.

## Full text

Between February and June 2020, a private individual published information about patients on his personal Facebook page. The information included health data in terms of Art. 4 (15) GDPR. In detail, the published data comprised patient names, diagnostic findings, medical diagnoses, medication data, data on hospital admissions and discharges, patients' social security numbers and the names of the treating physicians.

GDPR Articles: Art. 5 (1) a) GDPR, Art. 9 GDPR
Industry: Health Care

---
Generated by overview.legal · https://overview.legal/posts/46576 · 2026-08-22