DPA case DSB-D550.038/0003-DSB/2018 – €5,280 Fine (Austria, 2018)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian betting company was fined for improperly using video surveillance cameras that recorded areas beyond its entrance. The company failed to mark the cameras and did not delete footage after 72 hours, which is required by law. This case highlights the importance of following privacy rules when using surveillance technology.
What happened
The betting company recorded video footage from cameras that captured areas beyond its entrance without proper signage or deletion protocols.
Who was affected
Visitors to the betting location and people in the surrounding public areas were affected by the surveillance.
What the authority found
The authority found that the company violated GDPR principles by lacking a valid legal basis for processing personal data and failing to comply with local data protection laws.
Why this matters
This ruling emphasizes that businesses must clearly inform people about surveillance and follow strict data retention rules. Companies using surveillance should ensure they comply with privacy laws to avoid penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A betting company is running a video surveillance system with two cameras that are mounted next to the entrance of the location. The cameras are filing a wide area of more than 20 meters that goes beyond the immanent entry area, including a public parking facility. There was no marking of the camera system and the videos were not deleted after 72 hours (as required under § 13 of the Austria Data Protection Act, "Datenschutzgesetz"). No protocol of the video usage (as required under § 13(2) Austrian Data Protection Act) was made. Is the filming of public areas that go beyond the immanent entrance area of a location still covered as a "legitimate interest" in Article 6(1)(f) GDPR? How are penalties under GDPR and the Austrian Data Protection Act ("DSG") to be calculated? The legitimate interest for video surveillance under Article 6 GDPR has to take into account (1) the relationship between the data subject and the controller, (2) the expectation of the data subject that he may be under surveillance. People in the public space (including drivers of passing cars) do not have the expectation to be filmed by the owner of the location. Principles in Article 5(1)(a) and (c) and Article 6(1)(f) GDPR are therefore violated. In addition there were violations against § 13 Austrian Data Proteciton Act ("DSG") by lacking a deletion period, processing protocols and warning signs. As parts of the violations happened before 25. 5. 2018, parts of the penalties are based on the previous national law. The maximum fine for the first count was € 20 Mio under GDPR, while the maximum fine for the other counts was € 50.000 under national law. The fines were calculated in the following way: * € 2.400 under Article 6(1)(f) and 83(5)(a) GDPR (illegal surveillance) * € 800 under §§ 52(2)(6), 62(1)(4) and 69(5) DSG 2000 (missing protocol) * € 800 under §§ 52(2)(7), 62(1)(4) and 69(5) DSG 2000 (missing deletion) * € 800 under §§ 52(2)(4), 62(1)(4) and 69(5) DSG 2000 (missing signage) * +10
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DSB-D550.038/0003-DSB/2018 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DSB-D550.038/0003-DSB/2018 - Austria (2018). Retrieved from cookiefines.eu
Last updated: