DPA case 2023-0.583.644 – €20,000 Fine (Austria, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian restaurant was found to have illegally recorded its employees with cameras in the kitchen. This decision matters because it highlights the importance of respecting workers' privacy and following data protection laws.
What happened
The restaurant recorded its employees in the kitchen without proper consent.
Who was affected
Two former employees of the restaurant who were recorded by the cameras.
What the authority found
The Austrian DPA ruled that the restaurant violated privacy rights by unlawfully recording employees and failing to keep proper records of data processing.
Why this matters
This case shows that businesses must be careful with surveillance practices and ensure they comply with privacy laws. Companies should review their data handling and consent processes to avoid similar issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Two data subjects, formerly employed in a restaurant, the controller, filed a complaint with the Austrian DPA (Datenschutzbehörde, DSB) because they noticed they had been recorded by a camera in the workplace and the recordings could be accessed by the employer at all times. The controller submitted that the cameras served the purpose of protecting its property and the workers and that the processing was based on the employee’s consent under Article 6(1)(a) GDPR. The controller added that recordings would be saved for a period of 14 days, then automatically deleted. The DSB issued its decision decision on 26 September 2022 stating that the controller violated the data subjects’ right to privacy because it installed cameras that unlawfully recorded the kitchen working area of its premises, not just the outside. Further, the DSB added that the controller acted in violation of Article 30 GDPR as it failed to maintain a record of processing activities. The controller appealed this decision before the Federal Administrative Court (Bundesverwaltungsgericht, BVwG) and the case is still pending. On 8 March 2023, the DSB initiated sanctioning proceedings against the controller and requested it to submit further justifications. The controller only provided generic statements apart from changing the legal basis for processing from Article 6(1)(a) GDPR to Article 6(1)(f) GDPR and did not provide any information about its annual global turnover, which the DSB had to research itself. The DSB then suspended the sanctioning proceedings until the CJEU decision in C-807/21. The DSB reopened the sanctioning proceedings on 5 December 2023, after publication of the CJEU judgment. First of all, the DSB reassessed the facts of the case and ascertained that the controller had cameras in place that not only recorded the outside area of the restaurant but also the kitchen, bar, entrance and storage room and did not maintain any records of its processing activities at least since 2018. T
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2023-0.583.644 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2023-0.583.644 - Austria (2023). Retrieved from cookiefines.eu
Last updated: