- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2024-0.796.258 – €2,000 Fine (Austria, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Austrian individual was fined €2,000 for secretly taking and sharing nude pictures of a person without consent. The court found that this action violated GDPR rules regarding sensitive data. This case serves as a strong reminder that consent is crucial when handling personal and sensitive information.
What happened
An individual was fined for taking and sending nude pictures of a person without their consent.
Who was affected
The individual whose nude pictures were taken and shared without consent.
What the authority found
The authority determined that the individual violated GDPR by unlawfully processing sensitive personal data.
Why this matters
This case highlights the critical importance of obtaining consent before processing sensitive personal data. It serves as a warning that violations can lead to significant fines.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller and the data subject had agreed that the controller would take one nude picture of the data subject for the data subject’s personal use. The controller took this picture. However, the controller had secretly taken more nude pictures of the data subject on the data subject’s phone. He then sent the pictures to his own phone without the data subject’s consent. The controller stored the pictures on his phone for one day. The data subject noticed the next day and demanded the controller to delete the pictures. The controller responded that he can delete the pictures and that he merely wanted to photoshop them for the data subject. The controller did delete the pictures. The data subject filed a complaint on the 28 August 2024 with the Austrian DPA (Datenschutzbehörde – DSB) against the controller. Throughout the course of the investigation, the controller did not respond to any of the requests of the DSB. The DSB held that the taking of the pictures did not constitute unlawful processing as the data subject’s consent had been obtained. However, for the transmission of the pictures to his own phone and the storage for one day, the controller was held to have violated Article 9(2) GDPR, Article 5(1)(a),(b)&(c) GDPR. The court found that the nude pictures related to the data subject's sex life and therefore constituted sensitive data under Article 9 GDPR. The court highlighted that it did not matter whether the controller knew he was violating the GDPR. The court considered that the controller had deleted the pictures after he was requested to do so. The court based the fine off the median income of film crew, which was the controller’s profession. Therefore, the DSB set a fine of €2,000 for the unlawful processing.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2024-0.796.258 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2024-0.796.258 - Austria (2024). Retrieved from cookiefines.eu
Last updated: