DPA case 2025-0.607.071 – Complaint Upheld (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Neighbors operating a restaurant in Austria were found to have violated a person's privacy by installing surveillance cameras that recorded public areas. This is significant because it shows that even in the name of security, privacy rights must be respected.
What happened
The restaurant owners installed cameras that recorded public spaces and private individuals without consent.
Who was affected
The individual whose privacy was invaded by the restaurant's surveillance cameras.
What the authority found
The authority determined that the restaurant's surveillance was excessive and violated the individual's right to privacy under GDPR.
Why this matters
This ruling highlights that businesses must balance security measures with respect for individual privacy. Companies should evaluate their surveillance practices to ensure they are not infringing on people's rights.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject filed a complaint with the Austrian Data Protection Authority (DSB) alleging a violation of his right to privacy by his neighbours (the controller). The controller, who operated a restaurant and reside in the same building, installed five video cameras on their property. The cameras recorded continuously, including audio, and stored the footage for 14 days. Three cameras captured parts of a public street that the data subject regularly used, while the remaining cameras also recorded the restaurant’s guests and employees. The controllers justified the surveillance by referring to prior incidents in which the data subject had behaved aggressively and some incidents were even criminally relevant. Nonetheless, the cameras monitored public areas and data subjects who had not consented to being recorded. No written consent was obtained from employees or guests, and the extent of the monitoring exceeded what could be justified under the circumstances. The DSB held that the controllers’ video surveillance violated the data subject’s right to privacy under [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=1&Paragraf=1&Anlage=&Uebergangsrecht= § 1 DSG] and the GDPR. Although the controllers had legitimate interests under Article 6(1)(f) GDPR in documenting the data subject’s past aggressive and criminal behavior, the video surveillance failed the necessity test due to the fact that the continuous, broad, and long-term monitoring of a public street was disproportionate and less intrusive measures existed . Therefore, the surveillance of public space was not necessary and violated the right to privacy. The DSB further held that the monitoring of employees and guests through some cameras was also unnecessary and disproportionate because continuous monitoring of employees in their workplace is a highly intrusive measure and affects human dignity when data subjects are filmed during most of their working time without
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2025-0.607.071 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2025-0.607.071 - Austria (2025). Retrieved from cookiefines.eu
Last updated: