# Data protection officer: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Data Protection Authority of Thüringen
- Date: 2022-01-01
- Original: https://www.enforcementtracker.com/ETid-1974
- Canonical: https://overview.legal/posts/48089
- Topics: Controllers, Personal Data, Processing Agreement, Processing, Supervisory Authorities, Data Controller, Human Resources, Consent

## Summary

The DPA of Thüringen has imposed a three-digit fine on the data protection officer of a company. The controller had posted a photo in a WhatsApp group of the company which showed the data subject bleeding heavily after a physical attack. The data subject had not consented to the publication in the WhatsApp group, which is why the DPA concluded that the publication was unlawful due to the lack of a valid legal basis.

## Full text

The DPA of Thüringen has imposed a three-digit fine on the data protection officer of a company. The controller had posted a photo in a WhatsApp group of the company which showed the data subject bleeding heavily after a physical attack. The data subject had not consented to the publication in the WhatsApp group, which is why the DPA concluded that the publication was unlawful due to the lack of a valid legal basis.

GDPR Articles: Art. 6 GDPR
Industry: Not assigned

---
Generated by overview.legal · https://overview.legal/posts/48089 · 2026-08-22