DPA case 2025-0.607.071 – Complaint Upheld (Austria, 2025)

A data subject filed a complaint with the Austrian Data Protection Authority (DSB) alleging a violation of his right to privacy by his neighbours (the controller). The controller, who operated a restaurant and reside in the same building, installed five video cameras on their property. The cameras recorded continuously, including audio, and stored the footage for 14 days. Three cameras captured parts of a public street that the data subject regularly used, while the remaining cameras also recorded the restaurant’s guests and employees. The controllers justified the surveillance by referring to prior incidents in which the data subject had behaved aggressively and some incidents were even criminally relevant. Nonetheless, the cameras monitored public areas and data subjects who had not consented to being recorded. No written consent was obtained from employees or guests, and the extent of the monitoring exceeded what could be justified under the circumstances. The DSB held that the controllers’ video surveillance violated the data subject’s right to privacy under [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=1&Paragraf=1&Anlage=&Uebergangsrecht= § 1 DSG] and the GDPR. Although the controllers had legitimate interests under Article 6(1)(f) GDPR in documenting the data subject’s past aggressive and criminal behavior, the video surveillance failed the necessity test due to the fact that the continuous, broad, and long-term monitoring of a public street was disproportionate and less intrusive measures existed . Therefore, the surveillance of public space was not necessary and violated the right to privacy. The DSB further held that the monitoring of employees and guests through some cameras was also unnecessary and disproportionate because continuous monitoring of employees in their workplace is a highly intrusive measure and affects human dignity when data subjects are filmed during most of their working time without