Austria’s First GDPR Fine Is For Video Surveillance

Good piece. 

A fine for "Filming Public Areas"???

"The cameras were not registered with authorities"

How Lame!

"Nanny State" at its best....

The reason behind the GDPR vs non-GDPR split is that “the majority of the alleged conduct occurred before 25 May 2018” i.e. the date the GDPR was enacted. Therefore violations 2, 3, and 4 were charged under previous privacy legislation while the first was charged under the GDPR.

this implies that had the conduct only occurred after May 25 2018 that just the GDPR fine of $2,400 would have been levied; and conversely, had it only occurred before May 25 2018, that just the 3 $800 fines would have been imposed.

If this is so, why do you say that

it was the GDPR-related fine that was by far the highest.

when it they appear to both be $2400, just with the non-GDPR spread over three items, but both for the same conduct?

I have a LPR camera that covers all cars that drive by my offices, if people don't like it they drive another way. The cops loved the video when some teenagers smashed up one of our cars.

  With the required camera registration, it just sounds like a way for the govt to have knowledge and access to all cameras with a view of the public without having to pay/install themselves. Or there is crooked dealings going on in the streets that the govt is wanting to hide.

  Also, I would think a sign is unnecessary if the cameras are in plain view.  Call me pessimistic if you want

I support strict enforcement of GDPR rules where they exist, and I advocate for compliant practices in areas where the laws do not exist.  The encroachment of ubiquitous surveillance on everyday life is offensive in a notionally free country.

I'm really glad that we don't have such laws in Australia, where private cameras in shops that happen to film the footpath in front of the shops have been largely responsible for the apprehension of 2 rapist/murderers, and solving a number of other crimes.  The police regularly call on private CCTV video.

We do have some other stupid laws around encryption though.

Informative article, please keep them coming as you learn about GDPR violations and fines.  Also any knowledge of GDPR like privacy laws and fines in the United States and other countries.

reference: 

Senate discusses a federal privacy law

States leading the way on privacy

Another brilliant example of the government wasting time and resources.  Do they really think that bad people doing bad things are going to comply with rules and regulations.  I'm all for best practices, personal privacy and controlling my personal data, but people have to be realistic about what makes sense and rules are only for the ones that follow them.

UPDATE: less than two weeks after this betting shop fine was issued, Austria's data protection authority imposed a $2,700 fine on a man for violating the GDPR after he installed security cameras in his apartment that filmed common areas in the complex.

On December 20, 2018, the Austrian DPA found that a man named Mr. Rudolf - his first name was not disclosed - installed 2 cameras (one at his doorway, the other at his window) that also filmed "areas of the property intended for general use" such as:

Rudolf also "published in social media" at least some of the footage and didn't put up a sign indicating the video surveillance.

The DPA found all this violated Articles 5 and 6 of the GDPR, just like the betting shop case, and fined Mr. Rudolf 2,420 euros or about $2,700:

The main takeaway from Rudolf's case: common areas in apartments like parking, walkways, etc are also considered "public"; to be GDPR compliant, residents can only film their own property.

UPDATE: Fine Overturned Following Appeal

In April 2020, Austria's highest court overturned the fine based on a legal technicality unrelated to video surveillance. The high court determined that the DSB had not sufficiently tied the shop's illegal video surveillance to a specific person, i.e. the manager:

this decision was canceled without replacement and the proceedings were discontinued, because it was a fine against a GmbH [limited liability company] and insufficient acts of persecution against a natural person ("leader" within the meaning of Section 30 DSG ) in the administrative proceedings of the DSB (at least name will appear in the penal; out the method for a concrete form individual) set were.

Below is a legal analysis of the high court's move from Austrian law firm Schima Mayer Starlinger:

According to Austrian jurisdiction, the Data Protection Authority can impose administrative fines on a legal entity for violations of the GDPR and the Austrian Data Privacy Act respectively, if the violations are committed by individuals who hold a leading position in the legal entity concerned or if the violations are caused by lack of supervision or control by a person in a leadership role. However, neither the decision nor any other procedural act of the Data Protection Authority indicated what behaviour by which individual had led to the infringements and was therefore attributable to the legal entity and could therefore be used as a basis for the administrative fine imposed. As the leading individual required was never named and thus never specified by the Data Protection Authority within the statutory time limits for prosecution, the Federal Administrative Court had to annul the administrative penalty imposed on the company.