DPA case DSB-D213.2544 – Complaint Upheld (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An individual was found to have uploaded photos of people, including children, online without their consent. The Austrian data protection authority ruled that this violated privacy rights, especially for vulnerable individuals like children. This case stresses the importance of obtaining consent before sharing images of others.
What happened
Photos of individuals, including children, were taken and shared online without consent.
Who was affected
Individuals photographed, particularly children and a woman depicted inappropriately.
What the authority found
The authority determined that the individual did not have consent to process and share the images, violating privacy laws.
Why this matters
This case reinforces the necessity of consent in sharing images, particularly of vulnerable groups, and sets a standard for protecting personal privacy in public spaces.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller was an individual who took photos of people on the street and uploaded them online. Some of the photos taken were of children. In one instance, a photo revealed that the children were Jewish, evidenced by their hairstyle and the kippah they were wearing. In another instance, a photo taken from a high angle was uploaded, revealing a large amount of a woman’s cleavage. Other photos uploaded depicted people eating in restaurants. The controller did not seek consent for the taking and uploading of these photos, although sometimes offered a business card to data subjects (or their guardians, in the case of children) with his contact details. The DSB (Austrian DPA) received an anonymous complaint about the processing activity. In their submissions, the controller sought to invoke their constitutional right to artistic freedom. The DPA referenced the exception in favour of artistic freedom in Article 85(2) GDPR and noted that a balancing of interests in each specific case is required to reconcile the competing rights. In balancing the interests at hand, the DPA referenced Recital 38 GDPR, noting that children are vulnerable data subjects and worthy of additional protection under the GDPR. In relation to the photograph exposing the woman’s cleavage, the DPA referenced other legislation which criminalises unwanted images of female body parts in certain circumstances. The DPA reasoned that there is therefore an increased interest on the part of the data subject that such images not be processed, in particular without consent. In relation to the photographs revealing the religious beliefs of the data subjects, the DPA found that the inclusion of religious beliefs in the general prohibition on processing in Article 9 requires a higher level of protection and indicates an increased interest on the part of the data subject to not have such data processed and published without consent. The DPA noted that this was particularly important as members of the Jewis
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DSB-D213.2544 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DSB-D213.2544 - Austria (2025). Retrieved from cookiefines.eu
Last updated: