DPA case DSB-D124.1328/24 – Complaint Upheld (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian care worker discovered that cameras were installed in her client's home without her consent. The data protection authority found that the cameras violated privacy rules because they were not necessary for the client's safety when the care worker was present. This decision highlights the importance of respecting privacy and only using surveillance when absolutely necessary.
What happened
Cameras were installed in a client's home without the care worker's consent.
Who was affected
The care worker and the client, whose home was monitored.
What the authority found
The authority ruled that the use of internal cameras was unlawful and violated data minimization principles.
Why this matters
This ruling emphasizes that companies must carefully consider privacy when using surveillance. It sets a precedent that could affect how home care services use monitoring equipment.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A care worker (data subject) noticed cameras had been set up in the home of one of her clients (controller) in March 2024. After noticing them, the data subject and her colleagues told the controller she did not wish to be recorded and the controller assured her that they were dummy cameras. After the controller showed the data subject a recording of herself from the CCTV, the data subject filed a complaint with the DSB (Austrian DPA) on 12 May 2024. During the course of the investigation, the controller had noted that the cameras were installed in response to a suspected break-in at his house and concerns that he may fall over and require assistance. The controller had attended a consultation day at his local court and a judge advised him to install them, but to cover them while the carers were present. There were three cameras installed, covering both inside and outside of the property and capturing both audio and sound. They were remotely accessible by a family member of the controller. The DPA firstly considered the outside camera. The DPA found that it did not face the entrance to the house and there was no evidence of it having captured footage of the data subject. Accordingly, as no processing of personal data had occurred, the DPA ruled that the GDPR did not apply. The DPA then considered the cameras inside the house, and whether there the legitimate interest of the controller’s safety could legitimise the processing under Article 6(1)(f) GDPR. The DPA reasoned that the continued use of the cameras when the data subject was present was not necessary to ensure the controller’s safety, as the data subject could help in the event that the controller fell over. The DPA accordingly found that the processing was not safeguarding a legitimate interest and infringed the principle of data minimisation under Article 5(1)(c). After finding that the use of internal cameras was unlawful, the DPA further noted that even if the cameras had been covered, the processing
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DSB-D124.1328/24 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DSB-D124.1328/24 - Austria (2025). Retrieved from cookiefines.eu
Last updated: