Court case W298 2323263-1/11E – Court Ruling (Austria, 2026)

The controller was an Austrian advertising company. The data subjects were persons whose conversation was recorded during a meeting with a representative of the controller. On 24 April 2024, a representative of the controller visited the office during business hours to offer advertising services. According to the findings of the court, when scheduling and conducting the meeting, the representative gave the impression that he was acting in connection with the municipality and that the purpose of the meeting was to update data. During the meeting, the representative made an audio recording. The recording captured the conversation with the data subjects and also included information such as an email address, names, social media account names, information about education, and conversations involving other persons nearby. The meeting took place without physical separation from the rest of the office. The representative presented contractual documents during the meeting and one of the data subjects signed the documents. These documents contained a clause stating that, for quality improvement purposes, the client consented to the recording of all conversations and to the taking of photographs when placing an order. The data subjects were informed about the recording clause only during the meeting. They stated that they had not been aware at the beginning that the ongoing conversation was being recorded. The data subjects filed a complaint with the Austrian DPA. The DPA first found that the controller had violated their right to confidentiality by recording the conversation without prior consent, nor overriding legitimate interest. The DPA then opened administrative criminal proceedings and imposed a fine of €6,300, plus procedural costs of €630. The controller appealed. It argued that the processing hadn’t begun when its representative entered the office, but only when the audio file was saved, that one of the data subjects had consented by signing the documents, that no personal data was processed because the voices in the recording couldn’t be linked to identifiable persons and that it had an overriding legitimate interest in the recording. The court relied on the testimony of the data subjects. It found credible their statement that they had not noticed any recording device at the beginning of the meeting and that, had they known about the recording, they would not have held the meeting during office hours or without separating it from other office activities. The court also accepted that one of the data subjects was unaware that the ongoing conversation was being recorded. The court held that the audio recording involved personal data. It reasoned that the persons recorded could be identified because the controller could link the audio file to the date of the meeting, the location, the participants, the practice name and the services discussed. The recording therefore constituted processing of personal data. The court rejected the controller’s argument that the processing only began after the meeting because the data was stored only then. It noted that the controller’s representative had admitted that the recording had started before the conversation started and that more than five minutes had passed before any reference was made to the privacy policy. The court stated that the controller couldn’t rely on consent under Article 6(1)(a) GDPR and Article 7 GDPR. The data subjects were not properly informed about the recording before it began. The reference to the recording clause in the contractual documents was made only during the conversation, after the recording had already started. The court also considered that the strict requirements for voluntary consent were not met, especially because the alleged consent was linked to contractual documents. Moreover, the court held that the controller could not rely on legitimate interests under Article 6(1)(f) GDPR. The controller referred to quality improvement and the possible defence of legal claims. The court pointed out that the purpose of improving quality or supplementing transcripts was excessive and it wasn’t foreseeable that such legal claims would arise. Also, the controller didn’t show that recording the conversation was necessary for those purposes or that less intrusive means wouldn’t have been sufficient. The court also noted that secret audio recordings are generally unlawful and permissible only in exceptional circumstances, which weren’t present in this case. Τhe court additionally found that the controller hadn’t complied with its information obligations under Article 13 GDPR. The required information had to be provided at the time of data collection. Providing information only after a recorded conversation had already begun couldn’t retroactively cure the failure to inform the data subjects in time. The court also upheld the assessment of fault. It considered that the controller, through its representative, recorded the conversation without a legal basis and without providing prior information. The court accepted the DPA’s view that the conduct was intentional or at least negligent. Regarding the fine, the court held that the €6,300 fine was effective, proportionate and dissuasive. The court also ordered the controller to pay €1,260 for the appeal proceedings. The court dismissed the appeal and upheld the DPA’s decision.