Court case W256 2337399-1 – Court Ruling (Austria, 2026)

A marketing company (controller) that specialises in recruiting personnel for third companies was fined by the DPA for recording telephone interviews with potential customers (data subjects) with €25,500. The records were used for internal training purposes for the controller’s staff. In some occasions, the data subjects were not informed about the recording, in other cases only after the recording has already started. After the DPA’s reprimand, the controller stopped the processing, cooperated with a law firm and a data protection officer to establish and adapt a privacy notice, internal contracts and other documents and guidelines in conformity with the GDPR. The controller employs on average 18-20 people and has an annual turnover of €4,231,213.16 for the year prior the infringement. The controller appealed the DPA’s fine, not the unlawfulness of the processing. The court partially upheld the DPA’s decision, but reduced the amount of fine to €22,000. As far as the calculation of the fine was concerned, the court added the individual fines for the two violations, but limited the total amount of fine to the specified fine for the graves infringement, in accordance with Article 83(3) GDPR. Since both processing operations were linked to each other, Article 83(3) GDPR applied. Both infringements fell under Article 83(5) GDPR. Therefore, the specified amount of fine for the infringements is €20,000,000 or 4% of the total worldwide annual turnover of the preceding financial year. Since the first sum was higher, the static maximum fine in this case was €20,000,000. The static maximum fine must be adjusted to the individual case at hand: When assessing the amount of fine, Article 83(1) GDPR postulates that the fine must be effective, proportionate and dissuasive. One of the aims of the fine is the specific deterrence of the controller. For this purpose, the amount of fine should be in proportion to the size of the enterprise (in this case 18-20 employees, therefore a small enterprise with a structural adjacency to a micro-enterprise). Its annual turnover can be considered as well. The court held that the infringement at hand was of medium gravity. This is because on the one hand, all data subjects that were interviewed by the controller were affected, several data of each data subject were unlawfully processed and the unlawful processing continued for a period of four months. On the other hand, according to the court, the controller violated the GDPR with negligence not intent, the data processed was not of special importance and the obtained data was merely used for internal training purposes. The court considered, as aggravating factors (Article 83(2)(k) GDPR), that the controller violated the GDPR on two occasions: the unlawful recording of the interviews and failure to comply with the obligation to inform the data subjects pursuant to Article 13 GDPR. From the fact that the specified amount of fine for the infringements was this high, the court concluded a special importance of the protected legal interest. As a mitigating factor (Article 83(2)(k) GDPR), the court took into account that there were no previous GDPR violations by the controller. Moreover, the controller cooperated with the DPA by providing further audio material of interviews. This could be considered a mitigating factor, because with it, the controller exceeded its obligations under Article 31 GDPR and by doing so, did more than what was asked from him under the GDPR anyways. Also, the controller stopped the unlawful processing after the DPA ordered it to do so. The lack of damages suffered by the data subject was not a mitigating factor, contrary to the controllers claim, because the court held that the data subject suffered immaterial damages by loss of control over their data. Neither did the other privacy safety measures that the controller conducted be considered a mitigating factor (technical and organisational measures pursuant to Article 83(4)(a) GDPR) because they did not exceed what was asked from it under the GDPR).