DPA case 2024-0.917.161 – Complaint Upheld (Austria, 2025)

A data subject discovered that a real estate agency (the controller) had published drone photographs of her home in an online property advertisement on a website. The images included not only the advertised property but also surrounding houses, making her home identifiable. The data subject argued that this violated her right to secrecy under the [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=1&Paragraf=1&Anlage=&Uebergangsrecht= Austrian Data Protection Act (DSG)] and GDPR. The controller contended that the drone flights were legal, that the images did not contain full addresses, and that no personal information of neighboring houses was visible. The controller had also removed the data subject’s property from subsequent publications. The Data Protection Authority held that the data subject’s home was identifiable from the published drone images and location information, making the photographs personal data under Article 4 GDPR and [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=1&Paragraf=1&Anlage=&Uebergangsrecht= §1 DSG.] The publication of unpixelated drone images violated her right to secrecy as guaranteed by [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=1&Paragraf=1&Anlage=&Uebergangsrecht= § 1 DSG] , because it was unnecessary for the marketing purpose of the advertisement. While marketing the property could be a legitimate interest under Article 6(1)(f) GDPR, the respondent could have achieved this goal using pixelated or anonymized images. Consequently, the data subject’s complaint was granted.