Doctor´s Office
€3,300
Insufficient legal basis for data processing
Decision Date
January 1, 2024
Authority
Data Protection Authority of Hessen
DE
Sector
Health Care
Country
DE
Law
GDPRStatus
FINALDescription
The DPA of Hessen has imposed a fine of EUR 3,300 on a doctor´s office. While responding to negative Google reviews, the controller revealed health data about the reviewers.
Legal Citations
Art. 5 (1)Art. 6 (1)Art. 9 (1)
Issues & Violations
Insufficient legal basis for data processing