Court case W258 2242162-1 – Court Ruling (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The resident of a flat (a data subject) filed a complaint with the Austrian DPA (DSB) alleging that her neighbor (the controller) had unlawfully recorded her and her children in her private garage and disclosed the images to a third party. The data subject and the controller were neighbors living in a shared residential complex with individual garage boxes in a common underground garage. The controller claimed that he had only a wildlife camera in his own car, or that he received the photos anonymously on a DVD, but these explanations were later found contradictory and not credible by the DPA. The DSB found that the controller had infringed the data subject in the right to secrecy. He unlawfully took pictures of the data subject using at least one camera installed in the garage box and he transmitted unlawfully these images to a third party. DSB argued that the GDPR is applicable because the data processing had intervened in the sphere of third parties. The processing of data was not exclusively for personal or family activities and thus did not take effect the household exception of Article 2(2)(c) GDPR. The controller appealed to the Federal Administrative Court (BVwG). The Court dismissed the appeal and upheld the DSB’s decision. The court held that the video recording of natural persons, provided that it enables the identification of the data subject, constitutes processing of personal data, that falls within the scope of the GDPR, see CJEU case law. However, in accordance with Article 2(2)(c) GDPR, the regulation does not apply to the processing of personal data by natural persons for the exercise of only personal or family activities, see CJEU case law. Insofar as video surveillance extends only partially to the public space and is therefore directed to an area outside the private sphere of the person who processes the data in this way, the court found that it cannot be regarded as an exclusively “personal or family” activity, under CJEU case law. The cont
GDPR Articles Cited
The resident of a flat (a data subject) filed a complaint with the Austrian DPA (DSB) alleging that her neighbor (the controller) had unlawfully recorded her and her children in her private garage and disclosed the images to a third party. The data subject and the controller were neighbors living in a shared residential complex with individual garage boxes in a common underground garage. The controller claimed that he had only a wildlife camera in his own car, or that he received the photos anonymously on a DVD, but these explanations were later found contradictory and not credible by the DPA. The DSB found that the controller had infringed the data subject in the right to secrecy. He unlawfully took pictures of the data subject using at least one camera installed in the garage box and he transmitted unlawfully these images to a third party. DSB argued that the GDPR is applicable because the data processing had intervened in the sphere of third parties. The processing of data was not exclusively for personal or family activities and thus did not take effect the household exception of Article 2(2)(c) GDPR. The controller appealed to the Federal Administrative Court (BVwG). The Court dismissed the appeal and upheld the DSB’s decision. The court held that the video recording of natural persons, provided that it enables the identification of the data subject, constitutes processing of personal data, that falls within the scope of the GDPR, see CJEU case law. However, in accordance with Article 2(2)(c) GDPR, the regulation does not apply to the processing of personal data by natural persons for the exercise of only personal or family activities, see CJEU case law. Insofar as video surveillance extends only partially to the public space and is therefore directed to an area outside the private sphere of the person who processes the data in this way, the court found that it cannot be regarded as an exclusively “personal or family” activity, under CJEU case law. The cont
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W258 2242162-1 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W258 2242162-1 - Austria (2025). Retrieved from cookiefines.eu
Last updated: