# DSB (Austria) - 2026-0.483.002

- Type: Enforcement
- Source: DSB
- Date: 2026-10-06
- Original: https://gdprhub.eu/index.php?title=DSB_(Austria)_-_2026-0.483.002
- Canonical: https://overview.legal/posts/593205
- Topics: Special Categories of Data, Healthcare, Controllers, Supervisory Authorities, Health Data, Healthcare, Types of Special Categories of Personal Data

## Summary

The DPA fined a medical services employee €1,200 for photographing two patients and sharing the images with unauthorised third parties because they contained health data under Article 9(1) GDPR. English Summary. Facts. The employee, acting as a controller, was working for a rescue and aid organisation that operated a care facility for people with special needs. Between 1 December and 19 December 2025, he used his private smartphone to photograph two patients in wheelchairs. Their physical impair

## Full text

The DPA fined a medical services employee €1,200 for photographing two patients and sharing the images with unauthorised third parties because they contained health data under Article 9(1) GDPR. English Summary. Facts. The employee, acting as a controller, was working for a rescue and aid organisation that operated a care facility for people with special needs. Between 1 December and 19 December 2025, he used his private smartphone to photograph two patients in wheelchairs. Their physical impairments and their use of care or health services were visible in the pictures, meaning that the images revealed information about their health. The images were shared to third parties through a chat application. The controller made the decision to take and disclose the photographs himself, acted outside his work duties and did not pursue any purpose connected with caring for the patients or operating the facility. The organisation informed the DPA of the incident. Holding. First, the DPA held that

---
Generated by overview.legal · https://overview.legal/posts/593205 · 2026-10-08