MP (Data subject) – Court Ruling (Austria, 2026)

In December 2023, callers to a service telephone number operated by a public broadcaster (the controller) heard an automated message stating that calls were recorded and could also be broadcast. Several times during December 2023, the data subject called the service number. The controller recorded the call. On 12 December 2023 and again on 18 December 2023, the data subject complained to the DPA that the controller recorded calls without obtaining consent. The controller argued that the recordings formed part of its statutory quality-assurance obligations. It relied on national legislation requiring it to maintain a quality-assurance system and submitted that the recordings supported that objective. During the proceedings, it also stated that it would adapt its system so that future callers could prevent or interrupt recordings. The DPA upheld the complaint and found that the recording violated the data subject's right to confidentiality. The controller appealed to the Federal Administrative Court. First, the court held that the recording constituted processing of personal data and that the broadcaster acted as controller under Article 4(7) GDPR. Second, the court rejected the broadcaster's reliance on Article 6(1)(c) GDPR. Although national law required the broadcaster to operate a quality-assurance system, the court found that those provisions did not impose a sufficiently specific legal obligation to record callers. Recording service-line calls was not necessary to fulfil the statutory quality-assurance requirements, which could be achieved through other measures such as representative audience surveys, studies and audience consultations. Third, the court rejected using Article 6(1)(e) GDPR as a basis. While the broadcaster's quality-assurance activities served a task in the public interest, recording callers was not necessary for carrying out that task because less intrusive alternatives were available. Fourth, the court rejected Article 6(1)(f) GDPR. The court accepted that the broadcaster had a legitimate interest in maintaining and improving the quality of its public-service activities. However, it found that recording callers was not necessary for achieving that objective. Referring to the principle of data minimisation in Article 5(1)(c) GDPR, the court held that the same purpose could be achieved through less intrusive methods. Finally, the court rejected Article 6(1)(a) GDPR. The court noted that consent requires an active indication of agreement and that the controller must be able to demonstrate it under Article 7(1) GDPR. The fact that the data subject called the service number again after hearing the recording notice did not constitute valid consent. The broadcaster failed to prove that the data subject had actively agreed to the recording. The court therefore upheld the DPA's decision and held that the recording lacked a valid legal basis under Article 6 GDPR.