DPA case 2020-0.759.615 – Dismissed (Austria, 2020)

The controller runs the ski lift service in a ski resort (name is not known). When a day ticket or multi-day ticker holder passes through the access controls the first time, the controller takes a first photo of the user. After that, each time the user passes an access point, another photo is taken and compared with the first one by an authorised employee to check whether the ticket holder transferred their ticket to a third person, which is prohibited according to the terms and conditions of the service. The first photo is deleted after the ticket is expired while the other(s) after 30 minutes the user has passed a certain control point. The data subject used the controller's service from 27 to 29 December 2019. On 7 January 2020, he lodged a complaint with the Austrian DPA (Datenschutzbehörde - DSB) alleging that the controller's conduct was unlawful since no consent had ever been provided by the user. The controller counterargued that it did not rely on consent but rather on its legitimate interest to check whether a customer violates the terms and conditions by transferring the ticket to a third person. The DSB rejected the complaint because the controller's conduct was justified under Article 6(1)(f) GDPR. It reasoned that the controller's interest to check whether the data subject violated the terms and conditions was legitimate and that it was not overridden by the data subject's interest to data protection. By referring to sentence 3 of Recital 51 GDPR, the DSB found that the pictures taken from the data subject did not constitute biometric data according to Article 9(1) GDPR because they did not result from "specific technical processing", as required by Article 4(14) GDPR, but are rather used to manually check the identity of the customer. It then held that the measures taken by the controller are not unusual nowadays and, therefore, the data subject could have reasonably expected them (first sentence of Recital 47 GDPR).