Court case W298 2323263-1/11E – Court Ruling (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The controller was an Austrian advertising company. The data subjects were persons whose conversation was recorded during a meeting with a representative of the controller. On 24 April 2024, a representative of the controller visited the office during business hours to offer advertising services. According to the findings of the court, when scheduling and conducting the meeting, the representative gave the impression that he was acting in connection with the municipality and that the purpose of the meeting was to update data. During the meeting, the representative made an audio recording. The recording captured the conversation with the data subjects and also included information such as an email address, names, social media account names, information about education, and conversations involving other persons nearby. The meeting took place without physical separation from the rest of the office. The representative presented contractual documents during the meeting and one of the data subjects signed the documents. These documents contained a clause stating that, for quality improvement purposes, the client consented to the recording of all conversations and to the taking of photographs when placing an order. The data subjects were informed about the recording clause only during the meeting. They stated that they had not been aware at the beginning that the ongoing conversation was being recorded. The data subjects filed a complaint with the Austrian DPA. The DPA first found that the controller had violated their right to confidentiality by recording the conversation without prior consent, nor overriding legitimate interest. The DPA then opened administrative criminal proceedings and imposed a fine of €6,300, plus procedural costs of €630. The controller appealed. It argued that the processing hadn’t begun when its representative entered the office, but only when the audio file was saved, that one of the data subjects had consented by signing the documents, that no p
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The controller was an Austrian advertising company. The data subjects were persons whose conversation was recorded during a meeting with a representative of the controller. On 24 April 2024, a representative of the controller visited the office during business hours to offer advertising services. According to the findings of the court, when scheduling and conducting the meeting, the representative gave the impression that he was acting in connection with the municipality and that the purpose of the meeting was to update data. During the meeting, the representative made an audio recording. The recording captured the conversation with the data subjects and also included information such as an email address, names, social media account names, information about education, and conversations involving other persons nearby. The meeting took place without physical separation from the rest of the office. The representative presented contractual documents during the meeting and one of the data subjects signed the documents. These documents contained a clause stating that, for quality improvement purposes, the client consented to the recording of all conversations and to the taking of photographs when placing an order. The data subjects were informed about the recording clause only during the meeting. They stated that they had not been aware at the beginning that the ongoing conversation was being recorded. The data subjects filed a complaint with the Austrian DPA. The DPA first found that the controller had violated their right to confidentiality by recording the conversation without prior consent, nor overriding legitimate interest. The DPA then opened administrative criminal proceedings and imposed a fine of €6,300, plus procedural costs of €630. The controller appealed. It argued that the processing hadn’t begun when its representative entered the office, but only when the audio file was saved, that one of the data subjects had consented by signing the documents, that no p
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W298 2323263-1/11E in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W298 2323263-1/11E - Austria (2026). Retrieved from cookiefines.eu
Last updated: