- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Court case W274 2251055-1/5E – Court Ruling (Austria, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that a bank's practice of recording phone calls without an opt-out option violated a person's right to confidentiality. This decision reinforces the importance of user consent in data processing. The ruling also confirmed the DPA's authority to oversee such complaints.
What happened
A bank recorded customer phone calls without providing an option to opt-out.
Who was affected
A customer whose phone calls with the bank were recorded.
What the authority found
The court upheld the DPA's decision, stating that the bank's actions violated GDPR's requirement for user confidentiality.
Why this matters
This ruling emphasizes that companies must respect users' rights to control their personal data. Businesses should review their practices to ensure they comply with data protection laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 21 March 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In the original case before the Austrian DPA, the data subject filed a complaint, claiming that the controller (a bank) recorded their phone calls and there was no possibility to opt-out from such a processing. Clients were informed about the recording by a tape announcement at the beginning of the call. The controller justified the processing as a legitimate interest pursuant to Article 6(1)(f) GDPR, stating that recording was necessary to ensure the best service quality for clients. The controller also referred to their obligations under EU law, especially [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32014L0065 Directive 2014/65/EU (MiFID II)], and national banking laws, such as [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20010182 § 66(1) Payment Services Act] (Zahlungsdienstegesetz - ZaDiG) and [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20009943 § 33(2) and (3) Securities Supervision Act 2018] (Wertpapieraufsichtsgesetz 2018 - WAG). The DPA upheld the data subject's claim and issued a decision against the controller. The controller appealed this decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG). To the arguments mentioned above, the controller added that that it was impossible not to record all incoming calls. Furthermore, the controller questioned the DPA's competence, as the case allegedly fell under the WAG and not the GDPR. The court rejected the controller's appeal. The court confirmed that the DPA was competent. The data subject's complaint was about their right to confidentiality of personal data. The infringement of Article 6(1) GDPR could lead to an infringement of [https://ris.bka.gv.at/geltendefassung.wxe?abfrage=bundesnormen&gesetzesnummer=10001597&tid=121676594&ShowPrintPreview=True § 1(1) Austrian Data Protection Act] (Datenschutzgesetz - DSG) which contains the fundamental right to data protection. The right t
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W274 2251055-1/5E in AT
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
23 June 2023
Authority
DPA DPA
About this data
Cite as: Cookie Fines. Court case W274 2251055-1/5E - Austria (2023). Retrieved from cookiefines.eu
Last updated: