Enforcing jurisdiction
Austria · Geography does not establish applicable law.
Confirmed applicable legislation
Privacy topics

Court case Ro 2019/04/0229 – Court Ruling (Austria, 2020)

Court Ruling
DPA BVwG12 May 2020Austria
final
Court Ruling

Privacy enforcement record

This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.

An Austrian court overturned a fine against a company for violations related to CCTV use. The court found that the data protection authority did not properly accuse specific managers responsible for the company's actions. This ruling highlights the importance of clearly identifying responsible individuals in data protection cases.

What happened

The court repealed a fine against a company for alleged GDPR violations involving CCTV.

Who was affected

The company and its managers who were supposed to be held accountable for the alleged violations.

What the authority found

The court ruled that the data protection authority failed to accuse specific individuals responsible for the company's actions, which is necessary for imposing fines.

Why this matters

This decision emphasizes the need for data protection authorities to clearly identify responsible individuals when enforcing data protection rules. Companies should ensure they have proper oversight and accountability in their data handling practices.

Recorded legal citations
Automatically processed
Art. 4(7) GDPR
Art. 83 GDPR
View original scraped data
Art. 4(7) GDPR
Art. 83(GDPR)

Original imported citations before automated processing; the processing history does not establish independent verification.

National Law Articles
AI-identified
Article I EVGV
Article II EVGV
§ 3 VbVG
§ 30 DSG (Austrian Data Protection Act)
§ 31 VStG
Decision AuthorityVwGH
Reviewed AuthorityBVwG (Austria)‎

Source checks

Linked-source text retrieved.

Automated check recorded — 17 March 2026.

Processing notes: national law identified, authority corrected.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

The Austrian Data Protection Authority (DSB) had issued a fine of EUR 4,800 under Article 83 GDPR against a legal person based in Austria ("the company"). The reason for this fine were four violations of the GDPR and the DSG (Austrian Data Protection Act) in connection with a CCTV (closed circuit television). The company filed an appeal against this fine with the BVwG (Austrian Federal Administrative Court). On 19 August 2019 the BVwG repealed the fine and suspended the administrative penal procedure. It held that the DSB had failed to make an accusation pursuant to § 30(1) and (2) DSG (Austrian Data Protection Act) against specific persons who have a decisive influence on the accused company's business (managers) and whose own culpable actions (own actions, own omissions or lack of supervision of subordinate employees) can be attributed to the accused company. In its reasoning, the BVwG also referred to a VwGH (Austrian Supreme Administrative Court) decison regarding violations of the BWG (Austrian Banking Act). This is because § 30 DSG, that establishes rules for data protection liability of legal persons, has a very similar wording to § 99d BWG. The DSB filed an appeal against this decision with the VwGH requesting it to repeal the BVwG's decision and to reinstate the decision of the DSB. A) Is the VwGH case law on § 99d BWG relevant with regard to § 30 DSG and Article 83 GDPR? (§ 99d BWG requires culpable conduct on the part of a natural person who is entitled to decision-making or asserting control within the legal person.) B) Or rather, is the CJEU case law on fines under competition law relevant with regard to § 30 DSG and Article 83 GDPR? (EU competition law allows the European Commission to impose a fine against a legal person without having to specifically accuse a natural person of culpable conduct.) C) Is § 30 DSG even applicable or is there a lack of a corresponding opening-clause in the GDPR? (§ 30 DSG requires the same culpable conduct of a natural

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Related Cases (0)

No other cases found for Court case Ro 2019/04/0229 in AT

This is the only recorded case for this entity in this jurisdiction.

Details

Ruling Date

12 May 2020

Authority

DPA BVwG

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. Court case Ro 2019/04/0229 - Austria (2020). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: