Father (data subject) – Court Ruling (Austria, 2026)

The father (the data subject) and the mother (controller) shared a minor child. On 18 May 2024, the data subject brought the child to the retail branch where the controller worked and left the child there. A video surveillance system by the branch recorded the handover. The controller obtained access to the footage and on 1 July 2024, she submitted it to the family court to raise concerns about the child's welfare. During the proceedings, a court-appointed expert assessed the incident and concluded that the father's conduct did not amount to a child welfare risk. On 12 July 2024, the data subject filed a complaint with the DPA. He argued that the use of the retail camera footage for private purposes breached the purpose limitation principle and lacked a legal basis. He also claimed that the retail branch had inadequate security measures because the mother had been able to access the footage. The DPA rejected the complaint. It found that the retail branch was not the controller for the video surveillance processing and that the mother's processing was lawful under Article 6(1)(f) GDPR. The father appealed to the court. First, the court held that the complaint against the retail branch failed because the branch was not the controller for the CCTV system, as another company within the corporate group had decided the purposes and means of the surveillance. Second, the court held that the mother was also a controller for the separate processing, purposes, and for submitting it to the family court. Third, the court assessed the lawfulness of the mother's processing under Article 6(1)(f) GDPR. The court found that the mother had a legitimate interest in asserting her rights in the child contact proceedings and in addressing a potentially problematic handover situation. The court also considered the child's interest in avoiding harmful or conflict-laden handovers to be a relevant third-party legitimate interest. It noted that behaviour and interactions during child handovers are difficult to prove and that a video recording could provide more objective evidence than the parents' conflicting accounts. Finally, the court balanced the competing interests. It acknowledged that the data subject could not reasonably expect the mother to access and use footage from her employer's CCTV system. However, the footage was recorded in a publicly accessible shop, so the child's interests outweighed the data subject's interest in confidentiality. Consequently, the court held that the processing was lawful under Article 6(1)(f) GDPR and dismissed the appeal.