Austrian DPA fines controller in the medical sector

On 12 August 2019, the Austrian DPA imposed an administrative fine of 55,000 (of which 5,000 are procedural costs) on a controller operating in the medical sector.

Metadata

Provider:

EDPB

URL:

https://edpb.europa.eu/news/national-news/2019/austrian-dpa-fines-controller-medical-sector_en

Retrieved on:

Monday, September 9, 2019

Information

Tags:

Data security, Data protection, Information privacy, Privacy law, Information governance, Privacy, General Data Protection Regulation, In Europe, DPA, Data protection (privacy) laws in Russia, Data Protection Officer, Draft:THE EU REPRESENTATIVE

Summary

Key Points:

On 12 August 2019, the Austrian DPA imposed an administrative fine of 55,000 (of which 5,000 are procedural costs) on a controller operating in the medical sector.
Over the course of more than six months, the controller had neither appointed a data protection officer nor published its contact details or reported those to the supervisory authority.
In addition, the controller had obliged the data subjects to give their consent to a data processing, which did not meet the criteria set out in Art.
7 GDPR and also violated its duty to provide information pursuant to Art.