Court case W211 2210458-1/10 – Court Ruling (Austria, 2019)

A kebab shop installed three cameras, two inside one outside. The outside camera has also captured a public street and a gas station on the other side. Instead of 72h under Austrian law, it kept data for 14-16 days. No warning signs were installed. The system was installed and accessed by the husband of the owner of the kebab place. A police officer reported the case, which was ultimately handled by the DPA. The DPA a violation of (I.) Articles 5(1)(a) and (c) as well as Article 6(1) GDPR and (II.) §§ 12, 50a and 50d of the Austrian Data Protection Act (DSG). The violations of the GDPR was taxed with EUR 1,200, the violation of the DSG with two times EUR 300. The controller disputed the legal and factual findings. He claimed that he has e.g. installed warning signs and changed the scope of the cameras and the deletion period. He further argued that he was not the controller, because his wife was the owner of the kebap place. The court saw no mistake in any factual findings. Later changes are irrelevant to find a violation of the GDPR. As the husband has actually bought and installed the camera, as well as reviewed the footage, he had factual control and is the controller under Article 4(7) GDPR. The court considered §§ 12 and 13 Austrian Data Protection Act (Datenschutzgesetz - DSG) inapplicable in lack of an opening clause specifically for the processing of pictures and videos under the GDPR. Hence the lawfulness of processing was assessed under Article 5 and 6 GDPR only. Given the financial situation of the controller, the penalty was reduced from EUR 1,800 to EUR 1,500.