DPA case 2025-0.861.933 (retailer) – Dismissed (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian data protection authority dismissed a complaint against a retailer regarding the use of CCTV footage. The authority found that reviewing the footage was justified and did not violate data protection rules. This decision clarifies how surveillance can be used in payment disputes without infringing on privacy rights.
What happened
A complaint against a retailer over the use of CCTV footage in a payment dispute was dismissed.
Who was affected
Peter A., the complainant, and the anonymized retailer involved in the dispute.
What the authority found
The authority ruled that the use of CCTV footage was justified and did not breach data protection rules.
Why this matters
This case illustrates that surveillance can be lawful when used appropriately. Retailers should understand the legal boundaries of using CCTV in their operations.
Entities Involved
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Austrian DSB dismissed the complaint against an anonymised retailer on 28 October 2025 in case 2025-0.861.933 (DSB-D124.3382/25). After a payment dispute, the customer alleged coercion. Reviewing the relevant CCTV footage to investigate that alleged criminal conduct was covered by the surveillance purpose, limited to what was necessary and followed by deletion. Consent was not required in those circumstances. Although the underlying payment dispute itself was not a data-protection issue, the footage review gave the complaint a sufficient data-protection connection to be examined. The authority found it unfounded and imposed no fine or corrective order. RIS states that this decision is legally final. Both its decision header and opening identify 28 October 2025; an inconsistent incident-year reference in the published narrative is not used as the decision date.
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2025-0.861.933 (retailer) in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2025-0.861.933 (retailer) - Austria (2025). Retrieved from cookiefines.eu
Last updated: