Albin D. (controller) – €1,200 Fine (Austria, 2026)

The employee, acting as a controller, was working for a rescue and aid organisation that operated a care facility for people with special needs. Between 1 December and 19 December 2025, he used his private smartphone to photograph two patients in wheelchairs. Their physical impairments and their use of care or health services were visible in the pictures, meaning that the images revealed information about their health. The images were shared to third parties through a chat application. The controller made the decision to take and disclose the photographs himself, acted outside his work duties and did not pursue any purpose connected with caring for the patients or operating the facility. The organisation informed the DPA of the incident. First, the DPA held that taking the pictures constituted the collection or recording of personal data, while sharing them through a chat application constituted disclosure by transmission or another form of making the data available under Article 4(2) GDPR, which qualifies both as processing data. Second, the authority held that the employee, rather than the organisation, was the controller under Article 4(7) GDPR as he determined the purposes and means of the processing, used his private smartphone and acted outside the scope of his duties for his own purposes. The organisation was therefore not the controller for this processing. Third, it held that the photographs contained health data under Article 4(15) GDPR. The patients appeared as persons receiving care in a specialised facility, and the photographs revealed their physical impairments and use of care or health services. The processing therefore concerned a special category of personal data. Fourth, the DPA considered that lawful processing had to comply with the principles in Article 5(1) GDPR and have a legal basis under Article 6(1) GDPR. Because the photographs contained health data, the processing also required an applicable exception under Article 9(2) GDPR. It found that it had no legitimate purpose, no legal basis and no applicable exception. The DPA therefore held that the processing was unlawful and that the data subject had violated Article 5(1), 6 (1) and 9(1) GDPR and ultimately imposed a €1,200 fine under Article 83(5)(a) GDPR.