DPA case 2024-0.796.258 – €2,000 Fine (Austria, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian company was fined for secretly taking and storing nude pictures of a person without their consent. Although the initial picture was taken with permission, the company violated privacy rules by sending and keeping additional images. This case serves as a warning that even seemingly minor privacy breaches can lead to serious consequences.
What happened
The company took additional nude pictures of a person without their consent and stored them on their phone for a day.
Who was affected
The person whose nude pictures were taken and stored without their consent.
What the authority found
The authority determined that the company violated GDPR rules by processing sensitive personal data without a valid legal basis for the additional pictures.
Why this matters
This ruling highlights the importance of obtaining clear consent for all personal data processing, especially when dealing with sensitive information. Companies should ensure they have proper consent mechanisms in place.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller and the data subject had agreed that the controller would take one nude picture of the data subject for the data subject’s personal use. The controller took this picture. However, the controller had secretly taken more nude pictures of the data subject on the data subject’s phone. He then sent the pictures to his own phone without the data subject’s consent. The controller stored the pictures on his phone for one day. The data subject noticed the next day and demanded the controller to delete the pictures. The controller responded that he can delete the pictures and that he merely wanted to photoshop them for the data subject. The controller did delete the pictures. The data subject filed a complaint on the 28 August 2024 with the Austrian DPA (Datenschutzbehörde – DSB) against the controller. Throughout the course of the investigation, the controller did not respond to any of the requests of the DSB. The DSB held that the taking of the pictures did not constitute unlawful processing as the data subject’s consent had been obtained. However, for the transmission of the pictures to his own phone and the storage for one day, the controller was held to have violated Article 9(2) GDPR, Article 5(1)(a),(b)&(c) GDPR. The court found that the nude pictures related to the data subject's sex life and therefore constituted sensitive data under Article 9 GDPR. The court highlighted that it did not matter whether the controller knew he was violating the GDPR. The court considered that the controller had deleted the pictures after he was requested to do so. The court based the fine off the median income of film crew, which was the controller’s profession. Therefore, the DSB set a fine of €2,000 for the unlawful processing.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2024-0.796.258 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2024-0.796.258 - Austria (2024). Retrieved from cookiefines.eu
Last updated: