Court case W256 2337399-1 – Court Ruling (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A marketing company was reprimanded for recording phone interviews without properly informing customers. This is important because it highlights the need for transparency when handling personal information. Small businesses should ensure they inform users about data collection practices to avoid legal issues.
What happened
The marketing company recorded phone interviews without adequately informing the participants.
Who was affected
Potential customers whose phone interviews were recorded were affected.
What the authority found
The court upheld the DPA's decision that the company violated GDPR by not informing users about the recordings.
Why this matters
This case underscores the importance of transparency in data processing. Small businesses should always inform users about how their data is being used.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 22 September 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A marketing company (controller) that specialises in recruiting personnel for third companies was fined by the DPA for recording telephone interviews with potential customers (data subjects) with €25,500. The records were used for internal training purposes for the controller’s staff. In some occasions, the data subjects were not informed about the recording, in other cases only after the recording has already started. After the DPA’s reprimand, the controller stopped the processing, cooperated with a law firm and a data protection officer to establish and adapt a privacy notice, internal contracts and other documents and guidelines in conformity with the GDPR. The controller employs on average 18-20 people and has an annual turnover of €4,231,213.16 for the year prior the infringement. The controller appealed the DPA’s fine, not the unlawfulness of the processing. The court partially upheld the DPA’s decision, but reduced the amount of fine to €22,000. As far as the calculation of the fine was concerned, the court added the individual fines for the two violations, but limited the total amount of fine to the specified fine for the graves infringement, in accordance with Article 83(3) GDPR. Since both processing operations were linked to each other, Article 83(3) GDPR applied. Both infringements fell under Article 83(5) GDPR. Therefore, the specified amount of fine for the infringements is €20,000,000 or 4% of the total worldwide annual turnover of the preceding financial year. Since the first sum was higher, the static maximum fine in this case was €20,000,000. The static maximum fine must be adjusted to the individual case at hand: When assessing the amount of fine, Article 83(1) GDPR postulates that the fine must be effective, proportionate and dissuasive. One of the aims of the fine is the specific deterrence of the controller. For this purpose, the amount of fine should be in proportion to the size of the enterprise (in this case 18-20 employees, therefo
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W256 2337399-1 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W256 2337399-1 - Austria (2026). Retrieved from cookiefines.eu
Last updated: