- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2022-0.930.971 – Violation Found (Austria, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Austrian research institute wanted to test automated vehicles on public roads and needed to process personal data, including videos. The authority found that while the processing was important for safety, the institute needed proper authorization to use personal data. This case highlights the importance of following legal requirements when handling personal data for research.
What happened
The research institute applied for authorization to process personal data for testing automated vehicles.
Who was affected
Individuals whose images were captured by the cameras on the automated vehicles.
What the authority found
The authority noted that the institute could only rely on specific legal provisions for processing personal data, requiring proper authorization.
Why this matters
This case emphasizes the need for companies to ensure they have the right legal basis when processing personal data, especially in innovative fields like automated driving.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller, a research institute active in the field of automated drive, applied for a data processing authorisation with the Austrian DPA. The controller wanted to test automated vehicles on public highways and needed to process a large amount of personal data – in particular, videos from both outside and inside the vehicles – to train their algorithm. The controller claimed that the identity of data subjects whose images were captured by the cameras was of no importance for the processing. However, the recording was essential to ensure that automated vehicles were safe for road users. The controller performed a DPIA according to Article 35 GDPR and held that risks could be sufficiently mitigated. Preliminarily, the DPA noted that the processing of personal data in the context of archiving, scientific, historical or statistical purposes is regulated under Austrian law by [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 § 7 of the Data Protection Law] (Datenschutzgesetz - DSG). Such a provision is an implementation of Article 89 GDPR, which enables Member States to adopt rules limiting data subjects’ rights in the context of the above mentioned processing activities, provided that safeguards are implemented. According to § 7(2) DSG, processing of personal data that were not previously publicly available or were not subsequently anonymised could be based only on specific legal provisions, consent or authorisation by the supervisory authority. In the case at issue, the controller could rely exclusively on the latter legal basis. The DPA considered several elements in the authorisation process: 1) The controller planned to erase or anonymise data as soon as they were no longer necessary for the purposes of the processing. These considerations also applied to data transferred to third parties, insofar as the disclosure was necessary to the research purposes. The controller guaranteed that when anonymisation was not a fea
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2022-0.930.971 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2022-0.930.971 - Austria (2023). Retrieved from cookiefines.eu
Last updated: