DSB (Austria) - 2026-0.016.479
Content
The DPA fined a medical student €200 for filming a hospital patient with dementia and sharing the video with a fellow student. It found that the recording and disclosure constituted unlawful processing of health data. English Summary. Facts. A medical student (the controller) worked as a ward attendant at a hospital. Her duties were to remain in the immediate vicinity of patients, ensure their safety and notify the nursing staff immediately when necessary. While assigned to a patient with dementia (the data subject), she recorded a video of him wearing a hospital gown and throwing a newspaper to the floor. She subsequently sent the video to a fellow student through a messaging service. The recording lasted about eleven seconds. Holding. The DPA treated the medical student as the controller of the relevant processing pursuant to Article 4(7) GDPR because she decided to record the data subject and disclose the video to a third party. It found that the context of the video, the data subje