DPA case 2022-0.858.901 – Violation Found (Austria, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A public middle school in Austria was found to be using video cameras during school hours, which the Datenschutzbehörde ruled was not allowed. The school argued it was necessary for safety, but the authority decided that they couldn't rely on this reason while students were present. This ruling highlights the importance of following privacy rules even in educational settings.
What happened
The school used video surveillance cameras during school hours without a valid legal basis.
Who was affected
Students and staff present at the school during operating hours.
What the authority found
The authority ruled that the school could not use video surveillance during school hours, violating GDPR's requirement for legal basis.
Why this matters
This decision emphasizes that schools must respect privacy laws, particularly during hours when students are on site. Other educational institutions should review their surveillance practices to ensure compliance.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A public middle school (the controller) had four cameras on its property: one in front of the school entrance, one in front of a computer space, one in front of the teacher’s lounge and management area, and one near the escape stairs. According to the controller, the purpose of the video surveillance was to protect persons from theft or attacks. The use of video cameras is signaled at the school's entrance. The controller maintained video records for 48 hours. In response to the Austrian DPA's (DSB) investigation, the controller noted that preventing pupils from being endangered by other pupils during school is part of the duty of supervision assigned to teachers and schools. It relied on legitimate interests as a legal basis pursuant to Article 6(1)(f) GDPR to process personal data via the video surveillance cameras. The controller cited a DSB ruling that video surveillance of public bodies in the context of private sector activities for the purpose of self-protection or responsibility may be permissible even without express legal authorisation if carried out in response to specific dangerous situations and consistent with the principle of proportionality. As such, it argued that the use of technical surveillance measures in this context were authorised under national law [https://www.ris.bka.gv.at/Dokumente/Erv/ERV_1999_1_165/ERV_1999_1_165.html (§ 1 para. 2 DSG]). The DSB concluded that video surveillance in the school was impermissible during hours of operation, ordering a restriction on processing from all cameras during school hours. The DSB distinguished between the controller's behavior during school hours and outside of school hours. During school hours, the controller is behaving as a public entity. As a result, the controller cannot rely on Article 6(1)(f) GDPR for its usage of video surveillance during school hours. The DSB thus ordered that no recordings be taken by any of the cameras during school operations, or else that the cameras be decommissio
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2022-0.858.901 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2022-0.858.901 - Austria (2023). Retrieved from cookiefines.eu
Last updated: