- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Dr. Uwe A*** (complainant) – Complaint Upheld (Austria, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A customer complained that a restaurant in Vienna required him to provide personal information for contact tracing related to COVID-19. The data protection authority found that the restaurant's collection of this information was not lawful because it was mandatory for entry, violating privacy rules. This case highlights the importance of obtaining proper consent when collecting personal data.
What happened
The restaurant required customers to provide their name, phone number, and table number for COVID-19 contact tracing.
Who was affected
Customers visiting the restaurant who were asked to provide personal information.
What the authority found
The authority ruled that the restaurant violated privacy rules by not obtaining valid consent for processing personal data.
Why this matters
This decision emphasizes that businesses must ensure they have proper consent when collecting personal data, especially during health crises. It serves as a reminder for restaurants and similar businesses to review their data collection practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Linked-source text retrieved.
Automated check recorded — 23 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject (customer) filed a complaint against a Viennese restaurant claiming a violation of § 1 Austrian Data Protection Act (Datenschutzgesetz - DSG) and Article 6 GDPR: the restaurant required customers to provide their name, phone number, email (optional) and table number upon being seated. In its data protection notice, the restaurant stated that it collected said data "to protect the life and health of our employees and our guests in connection with the occurrence of the coronavirus and the COVID-19 epidemic". The customer provided his data by using a QR-Code Scanner on 2 October 2020 and sent an access request under Article 15 GDPR afterwards. In their reply the restaurant stated that the processing was based on the Viennese Regulation on Contact Tracing (Wiener Contact-Tracing Verordnung). Was it lawful under Articles 6 and 9 GDPR to collect data on the customer for the purposes stated by the restaurant? The DSB held, that the data provided by the customer qualify as health data under Article 4(15) GDPR. Data such as name, phone number, email do not qualify as health data per se but in the context of COVID-19 contact tracing they contain information about the past, present and future physical or mental state of health of the customer. The data are supposed to be processed solely to protect the health of restaurant customers and to forward this data to the local authorities in accordance with the Austrian Epidemic Law. Accordingly, the data processing must also be compliant with the requirements of Article 9 GDPR. In the DSB held that the processing violated Articles 5, 6 and 9 GDPR: *Consent under Articles 6(1)(a), 7 and 9(2)(a) GDPR cannot be considered as freely given in the context at hand. It was obligatory for the customer to provide his data to the restaurant, otherwise he would not have been allowed to enter the restaurant or would have been asked to leave. In addition, there was no acceptable alternative for the customer, because all resta
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Dr. Uwe A*** (complainant) in AT
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
19 November 2020
Authority
Datenschutzbehörde
About this data
Cite as: Cookie Fines. Dr. Uwe A*** (complainant) - Austria (2020). Retrieved from cookiefines.eu
Last updated: