MP (Data subject) – Court Ruling (Austria, 2026)

In December 2023, callers to a service telephone number operated by a broadcaster (the controller) heard an automated message stating that calls were recorded and could also be broadcast. Several times during December 2023, the data subject called the service number. The controller recorded the call. On 12 December 2023 and again on 18 December 2023, the data subject complained to the DPA that the controller recorded calls without obtaining consent. The controller argued that the recordings formed part of its statutory quality-assurance obligations. It relied on national legislation requiring it to maintain a quality-assurance system and submitted that the recordings supported that objective. During the proceedings, it also stated that it would adapt its system so that future callers could prevent or interrupt recordings. The DPA upheld the complaint and found that the recording violated the data subject's right to confidentiality. The controller appealed to the Federal Administrative Court. First, the court held that the recording constituted processing of personal data and that the broadcaster acted as controller under Article 4(7) GDPR. Second, the court rejected the broadcaster's reliance on Article 6(1)(c) GDPR. Although national law required the broadcaster to operate a quality-assurance system, the court found that those provisions did not impose a sufficiently specific legal obligation to record callers. Recording service-line calls was not necessary to fulfil the statutory quality-assurance requirements, which could be achieved through other measures such as representative audience surveys, studies and audience consultations. Third, the court rejected using Article 6(1)(e) GDPR as a basis. While the broadcaster's quality-assurance activities served a task in the public interest, recording callers was not necessary for carrying out that task because less intrusive alternatives were available. Fourth, the court rejected Article 6(1)(f) GDPR. The court accep