Court case W137 2271316-1 – Court Ruling (Austria, 2024)

An individual (the controller) installed a video surveillance system (CCTV) on their premises. The CCTV filmed a forest path, which run alongside their premises. The CCTV was active upon detection of movement and stored the recording on a SD card. The path was on the property of the controller but members of a partnership had the right to use the path for forestry and hunting purposes. In principle, other strangers were not allowed to use the path. As the controller explained, the members of the partnership decided, in majority but without the controller’s agreement, to use the path for hunting purposes. The route was necessary for the hunters to access the hunting area, located on the premises of a third party (a member of the partnership). According to the controller, the CCTV was installed as a protection and to gather evidence that unauthorised people used the path. Two of the members of the partnership lodged a complaint with the Austrian DPA (DSB), claiming the controller violated their right to privacy. The DPA found the controller filmed the area to collect evidence of the path’s misuse. However, the permanent surveillance of the path to make several potential complaints was not permissible. Nevertheless, the DPA noted that the controller removed the CCTV, so there was no mandate for further actions of the DPA. The controller initiated the appeal proceedings before The Federal Administrative Court (Bundesverwaltungsgericht) against the DPA’s decision. The court upheld the appeal, overturned the DPA’s decision and rejected the complaints by the data subjects. The court examined the legitimate interest pursued by the controller. All criteria of the legitimate interest stemming from the CJEU case law was fulfilled. The controller had a legitimate interest to monitor access to the path and bring cases against people misusing it. The court found no alternative, less privacy intrusive way to supervise the path. Moreover, the legitimate interest of the controller, i.e. to prevent the use of the path by unauthorised persons, outweighed the fundamental rights and freedoms of path users.