Enforcing jurisdiction
Austria · Geography does not establish applicable law.
Confirmed applicable legislation
Privacy topics

DPA case GZ: 2022-0.332.606 vom 8. Juni 2022 (Verfahrenszahl: DSB-D124.4108) – Dismissed (Austria, 2022)

Dismissed
Datenschutzbehörde8 June 2022Austria
final
Dismissed

Privacy enforcement record

This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.

An Austrian woman complained after her private phone call was recorded and shared without her knowledge. The Austrian Data Protection Authority found that the GDPR did not apply because the recording was made in a private context, not for business purposes. This ruling emphasizes the limits of data protection laws in personal situations.

What happened

A phone call made via Whatsapp was recorded and shared without the caller's consent.

Who was affected

The woman who made the phone call and her friends who received the recorded conversation.

What the authority found

The Austrian DPA determined that the GDPR did not apply to this situation as it was a private matter.

Why this matters

This case illustrates that personal communications may not always fall under data protection laws, highlighting the need for awareness about privacy in informal settings.

Recorded legal citations
Automatically processed
View original scraped data
Art. 2(2)(c) GDPR
Art. 5(1)(a) GDPR

Original imported citations before automated processing; the processing history does not establish independent verification.

National Law Articles
AI-identified
Section 1(1) DSG

Source checks

Secondary-source text retrieved.

Automated check recorded — 18 October 2026.

Processing notes: articles corrected, national law identified.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

The data subject had a phone call via Whatsapp with a friend (the controller) in which she confessed to misconduct against her ex partner as well as to having had an abortion. She was unaware that the phone call was recorded and later on forwarded to the ex partner and other friends of the data subject. The data subject filed a complaint with the Austrian DPA alleging a breach of her right to data protection and secrecy by recording and disseminating a phone call conversation without her consent. First, the Austrian DPA had to determine whether the GDPR was applicable. The DPA checked whether the material scope was met, in particular whether the case fell under the household exception found in Article 2(2)(c) GDPR. According to this provision, the GDPR does not apply to the processing of personal data by natural persons to carry out exclusively personal or family activities. The absence of any reference to a professional or economic activity was considered as an important factor. The DPA held that the concept of "family" was not to be interpreted strictly in accordance with family law, but also included other relationships considered as "family" by the general public, regardless of marriage and parenthood. In this respect, it was irrelevant whether there was a formal bond or whether personal relationships between the parties existed on a purely informal basis. The DPA noted that Recital 18 GDPR describes the use of social networks and online activities as part of a personal or family activity. In this case, the data subject had a phone call over the private messaging platform, Whatsapp. Despite extensive investigations, the DPA found no indications that this data processing was in any way connected to a professional or economic activity. The decisive factor was that the data processing was an exclusively private matter within a limited circle of acquaintances. Further, the DPA decided whether [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563 Sect

Outcome

Dismissed

The complaint or investigation was dismissed.

Related Enforcement Actions (0)

No other enforcement actions found for DPA case GZ: 2022-0.332.606 vom 8. Juni 2022 (Verfahrenszahl: DSB-D124.4108) in AT

This is the only recorded action for this entity in this jurisdiction.

Details

Decision Date

8 June 2022

Authority

Datenschutzbehörde

GDPRhub ID

gdprhub-5473

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. DPA case GZ: 2022-0.332.606 vom 8. Juni 2022 (Verfahrenszahl: DSB-D124.4108) - Austria (2022). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: