Austria’s First GDPR Fine Is For Video Surveillance

By: Charles Rollet, Published on Jan 29, 2019

Should EU businesses be concerned if police see a business' surveillance cameras filming public areas?

This is what happened with Austria’s first GDPR fine, imposed on a betting shop for filming public areas with its security cameras.

austria gdpr fine

The case racked up a total of almost $6,000 in fines, some of which were for non-GDPR violations. It has been appealed, so is not final. The case is nevertheless an important example of the heightened risk faced by end users in the GDPR era, particularly since it was the GDPR-related fine that was by far the highest.

In this note, we examine:

  • How They Got Caught
  • Alleged Violations
  • GDPR vs non-GDPR Violations
  • How The Fines Were Calculated
  • Why the GDPR Fine was the Highest
  • The frequency of Video Surveillance Fines in Austria
  • Timing & Gravity of Offense
  • Broader Meaning

****** ** ********** ** concerned ** ****** *** a ********' ************ ******* filming ****** *****?

**** ** **** ******** with *******’* ***** **** fine, ******* ** * betting **** *** ******* public ***** **** *** security *******.

austria gdpr fine

*** **** ****** ** a ***** ** ****** $6,000 ** *****, **** of ***** **** *** non-GDPR **********. ** *** been ********, ** ** not *****. *** **** is ************ ** ********* example ** *** ********** risk ***** ** *** users ** *** **** era, ************ ***** ** was *** ****-******* **** that *** ** *** the *******.

** **** ****, ** examine:

  • *** **** *** ******
  • ******* **********
  • **** ** ***-**** **********
  • *** *** ***** **** Calculated
  • *** *** **** **** was *** *******
  • *** ********* ** ***** Surveillance ***** ** *******
  • ****** & ******* ** Offense
  • ******* *******

[***************]

*** *** **** *** Caught

********* ** ********** **** *******, ***** ****** ******** ******* two ************ ******* ******* public ***** ***** *** entrance ** * ******* shop ** *** ****** of****** ** ***** **, ****. (Betting ***** *** ****** in ***** ** ****** and ******* ******* ** a ***** *****/*** ***** patrons *** *** **** machines ** ***** ****.)

* **** *** ****** which *** *********** ** the ******** **** ********** agency,*** ***, ***** *** **, 2018, *** **** *** GDPR *** *******. **** is ******* ***** ** the ****, ******* ***** surveillance ***** **** ******* by ***** ***********, *** the ***, *** ****** told ****.

List ** **********

*** *** ****** **** the ******* **** ********* four ******** ******* **********:

  1. *** ******** ******* ******* at *** ****’* ******** monitored * ****** ******* lot *** ******* *****, recording ****** ******* ** and ********’ ******* ******.
  2. *** ******* **** *** registered **** ***********.
  3. ***** ************ ******* *** kept *** ** ********** time ****** **** ** justification ********. (******** ******* law ******** ***** ************* for *** ***** ************ storage ******* ****** **** 72 *****.)
  4. ***** *** ** ****** sign ********** **** ***** surveillance *** ***** ****.

*** ******* **** *** unnamed ** *** *** does *** **** **********, although *** ******* *** mention ** *** **** of * *****. 

GDPR ** ***-**** **********

*** ***** ********* – filming ****** ***** – was *** **** ****** listed ** ********* *** GDPR, **** *** *** highlighting *** ******** ******** of *** ***:

  • ******* *, ***** ****** **** the ********** ** ******** data ** “******* ** **** ** necessary ** ******** ** the ******** *** ***** they *** *********”. *** DSB ***** **** *** betting ****’* ********** *********** *** *** cameras’ ******** ******* ** surveilling *** ********.
  • ******* *, ***** **** *** the ********** *** ****** processing, **** ** “*******” and “********** ********”. *** DSB ***** **** *** betting ****’* ******* ********* none ** ***** **********.

*** ***** ***** ******* were *** ********** *********’* ******** ******* ***, ***** *** ****** in ****.

*** ****** ****** *** GDPR ** ***-**** ***** is **** “*** ******** of *** ******* ******* occurred ****** ** *** 2018” *.*. *** **** the **** *** *******. Therefore ********** *, *, and * **** ******* under ******** ******* *********** while *** ***** *** charged ***** *** ****.

How *** ***** **** **********

*** *** **** *********, the **** *** ***** 2,400 ***** ($*,***). *** other *****, ***-**** ********** received ***** ** *** euros **** ($***), ** laid *** ** ******** Austrian ******* ***. *** ***** ** ***** was **** *,*** ***** ($5,435). * **% ***** fee *** *****, ******** the ***** ** *,*** euros ** $*,***.

(**********: “**** ** *****”, “Penalty ** **** ***** are *** *********”, “************ period”, “[*****] *********”)

GDPR ****** ****** *****

*** **** **** *** GDPR ********* *** ***** was *,*** ***** ***** the ***-**** ***** **** only *** ***** ** not * ***********.

*** ***'* ****** **** Matthis ******* ********* ** IPVM (******** *****):

********* ********, *** **** allows ****** ****** **(*) *** (*)significantly ****** **** concerning the determination of the total amount of an imposed fine in relation to prior legal provisions in force before the GDPR.

************, ******* **** ************* ********************* **** ***** **** ** proportional ** *** **** of *** ********; * small ******* **** ***** not ** ******* **** the ******* **** ****, which *** ***** ** million ***** ** *% of ****** ****** *******.

*** **** ** ** proportionate. *** *******, * cannot **** * ******** who *** ** ****** income ** **,*** ***** [$45,300] **** * **-*******-**** fine [$** *******].

Frequency ** ***** ************ ***** ** *******

**** ** *** *** first **** ******* ***** surveillance ** ***** ** Austria. ******** ** *** not ******* **********, ******* told **** **** ***** are * "****** **********", before *** ***** *** GDPR:

*** ******** ** *** fining ***** ******* *** presumed ******* *** ** CCTV.

Timing/Gravity ** *******

*** ****** ************* ** the ******* **** ***** in ***** **** *** the ***** **** ********* in ********* ****. *** shop *** ******** *** case *** *** *** to *******’* ******* *****, which *** *** ** rule ** **, *** DSB ********* ** ****.

*** *** **** ********* that **** ** *******’* first **** ****. *** months-long ***** ** **** fines ***** **** *** fact **** **** ********** are ***** ******* * backlog ** ***** ***** began **** ****** *** GDPR’s *********.

*** *** ****** *** shop’s ******* ** ** “negligent” ****** “**********” ** “aggravating”. **** ** ******* the ******* **** ****’* have *** ******** ****** of **********, ******* *** illegal *** ******-**** ***** surveillance.

**********

**** **** ******** * particularly ************ ******* ** how ***** *** ** higher ****** ** *** GDPR. * $*,*** **** *** a ****** ***** **** can ** ***** * significant ******, *** ** is ****** **** *** total **** ***** **** been ****** *** *** the ********** ***** ***** after *** ****’* ********* on *** **. 

**** ** ********* *** users, ***********, *** *** others ********** ***** ************ data ****** ****** **** in ****.

Comments (34)

**** *****. 

* **** *** "******* Public *****"???

"*** ******* **** *** registered **** ***********"

*** ****!

***** ** *** **, however ** ******* **** have *** * **** time ********* ***** ************ much **** *********** (*** this ******** *** ****.) For ******* ** ****** the ******************** **** ********** **** ********** ******** cameras **** **** ****** areas, "**** ** **** want ** ****** *** security ** ***** ******* parked ** ***** ** their ****.”

"***** *****" ** *** best....

************** *********, *** ***** are ****** ** ***** unknown “*******” ******** ******** of ****** ***** ******. Out ** ***** *** of ****...

*** ****** ****** *** GDPR ** ***-**** ***** is **** “*** ******** of *** ******* ******* occurred ****** ** *** 2018” *.*. *** **** the **** *** *******. Therefore ********** *, *, and * **** ******* under ******** ******* *********** while *** ***** *** charged ***** *** ****.

**** ******* **** *** the *************************** ** **** **** just *** **** **** of $*,*** ***** **** been ******; *** **********, had *********************** ** ****, **** just *** * $*** fines ***** **** **** imposed.

** **** ** **, why ** *** *** that

** *** *** ****-******* fine **** *** ** far *** *******.

**** ** **** ****** to **** ** $****, just **** *** ***-**** spread **** ***** *****, but **** *** *** same *******?

 

 

****, *** ** *******. What *'* ****** ** that *** *** *** alleged ********** ***** ***** after *** **, *** 4 ********** ***** **** been *********** ** **** violations, ****** **** **** 1. ***** *** **** gives *********** ************* **** leeway ** ******** *****, each ** *** ********** could **** **** *****, for *******, *,*** ***** - ** ****'* *,*** x * = *,*** euros ***** ** *****, or ****** $**,***.

**** *** ***-**** ********** were *** "****** **** three *****"; **** *** was * ********** ********* of ******* ***********.

* **** **** ** check ** ************** **** fines *** **** ********** are ********* ****** **** the ****** **** ** the ******** **** ********** agency ******** *******. ** confirmed **** ** **, stating ** **** (******** added):

"********* ********, *** **** allows ****** *** *** 83 (*) *** (*)significantly ****** **** concerning the determination of the total amount of an imposed fine in relation to prior legal provisions in force before the GDPR. In addition, in this particular case, the Austrian DPA had to take transitional provisions into account, which ******* *** ***** ***** ***** ** *** ******** ***** ********* prior to the GDPR in which the infringing action started before the 25th of Mai 2018."

**** *'* ****** ** that *** *** *** alleged ********** ***** ***** after *** **, *** 4 ********** ***** **** been *********** ** **** violations, ****** **** **** 1.

** *** *** ****** that******** **, *** **** illegal ******* *** *** filming ** ******* *****?

*** **** *********, ***************** **, **** *** registered *** *******, *** signs **, ******** *** retention ****** ***?

**** ****** ******** ** me, *** **’* ********.

** *** ***** ****, if *** ** *** 4 ******** ******** ** both ************* * *** ******* under **** ********, ** would **** * *** arbitrary ** ****** **** capriciously *** **************, **** because **** **** ********* over * ****** ** shorter **** ******.

**** **** **** ***** :)

* *** *** ** check ******, *** *** link *** **** ******** the *******  “*** ***** wurde ***** ********”...

** *** *** ****** that ***** *** **, *** **** illegal ******* *** *** filming ** ******* *****?

*** **** *********, ******** ****** *** **, **** *** registered *** *******, *** signs **, ******** *** retention ****** ***?

*** **** ***** **** "most ** *** ******* misconduct ******** ****** *** 25." ** ********** *, 3, *** * **** found ** *********** ****** the ****, *** ********* 1 *** **** ********* afterwards. ******* ********** *-* were ******* ***** ************ prior ** ****, *** shop ***'* ** ********** for *** **** ******* post-GDPR. There ** ** ******* of *** **** *********** cameras, ******* ** *****, etc.

* *** *** ** check ******, *** *** link *** **** ******** the ******* “*** ***** wurde ***** ********”...

** ***, * ***** the **** ** *** article. *** *** ********* ****.

* **** * *** camera **** ****** *** cars **** ***** ** my *******, ** ****** don't **** ** **** drive ******* ***. *** cops ***** *** ***** when **** ********* ******* up *** ** *** cars.

*** ** *** ****** the ****** ******* *****? Also, *** *** ****** the **** *** *** retrieved ** **** ******** firmware ************* ** ***** in ******** ** *** switch?

* ***** *** ********** a ****** ******* ** person ******** *** ******* where * *****.

***** ** ******** ** the ******?

** *** ******... :)

**** *** ***** ** the ****** ** ****** :)

* ****** ***'* ********** the ******** ********* ** GDPR. **** ***-** ******* seem ** **** ** nothing **** **** * hassle.

** ** * *** two ***** *********

- **** ************* ** data
- **** ***** *** trunkslammers

********** *** ****** ****** should ** *********. **** makes * ****** ***** for *** ******** *** better *** * ****** level ** ********* *** installation.
********** **** ****** **** a ****** ******* *** higher ******.

******* ****, ****** ******* design, *** **** **** the *********** ******, (**** up *** *** **). 

* **** * ****** that's ***** ** ** driveway ** ***, * see *** **** ** cars ******* **, *** no ****** **** **** turn **** ** ********. It *****'* *** *** of ***** *****, *********, or ***** *****. **'* a "***** ************" ** if * ******* *** angle ** **** ****** driving ** **** ******'* mind.

* ****** **** *** of ** ********* *** a *** ******* **' off *** ****** ** the **** ** ***** house, ****** **** ** don't ** * **** comes **** ****. ******* just ******* ** ** neighborhood *** * ***** wifi ****** *** **** in ******* **** **** decided ** **** ******** of * ***** **** student ******* ******* ***** backyard **** ***** ******** them. *** *** *******'* of **** *****, *** posting ** ** *** towns ******* ******** ***** (over ** ******* ** see) *** ****** ** get **** ** ******* for ****.

* **** * *** camera **** ****** *** cars **** ***** ** my *******, ** ****** don't **** ** **** drive ******* ***.

* ****** **** **** message ** *** ********* all ***, ***** *** no ********* ** **** driveway ******** ***** ********.

** **'* **** ******** you *** ****** *** rights, **** **** *** the *** *******. ** argument *****.

**'* *** ****** ** not ****** * ****** of ***** ******, ** public ***** ** ******* looking ** ** **** private ********. **** *** enter ******** ******* ******** you ***'* **** *** say ** ***** ****** choices. *********** **** *** need ** ** ***** though... * ***'* ***** agree **** **** ****

** ******* **** ** odd ******, * ******* road **** **** ******* to ** ** *** property **** ******* *** of *** *********, ** someone **** *** **** to ***** **** *** vs *** ***** * entrances ** *** ***** they **** ** ** that's ***** ******.

** *** ** *****, my *** ****** ****** on * ****** ****, I *** *** **** of ***** ***, *** only *** ***** ** the **** **** **** down ** ********, **** if **'* **** ** turn ******. ****** * PTZ *** * ****** story **** *** **** into ****** * ******* isn't *** **** ** a ***** ****** **** sees * ******** ****. 

*** ** *** ****** who **** ** *****/******** of ****** ** ***** backyard ** ********, ** my ******** ** * felt *** **** ** shame ****** ****** ** would ** ******* **** issues ** *** ***. I'm *** **** ** the **, *** ** the ******, **** ** intended ** ** **** private, *** ********* ****** to ********.

******** *** ******** ** law *** *** ******** different ******.

******, ***** *** ********* already **** ********** ***** us.

  **** *** ******** camera ************, ** **** sounds **** * *** for *** **** ** have ********* *** ****** to *** ******* **** a **** ** *** public ******* ****** ** pay/install **********. ** ***** is ******* ******** ***** on ** *** ******* that *** **** ** wanting ** ****.

  ****, * ***** think * **** ** unnecessary ** *** ******* are ** ***** ****.  Call ** *********** ** you ****

**** **** ** ************** on * ********* *****, however, *****'* ** ********* anywhere ** *** **** or ******** ** ******* laws **** ***** ******** video ************ *** *** required ** **** ** the ******* *** ** plain ****. (*** *** see ***: * *********** may ***** ***** ******* are ****** ******* **** many ******** ***'* **** bother ** **** ** and ****** ****).

*** * **** ** eye ***** *** **** won't **** *** **.

**** ** *****, "***'** on ******".

 

* *** ********** *** feel **** ***, *** what ******* **** **** not ** ******** ********* installs ******* ** *** house, ******* ** *** road *** **** ******* at **** ****** *** private ****?

**** ** * ******, but * **** ***** for *** *** ****

...*** **** ******* **** your *** ** ******** neighbour ******** ******* ** his *****, ******* ** the **** *** **** looking ** **** ****** and ******* ****?

****?

* ******* ****** *********** of **** ***** ***** they *****, *** * advocate *** ********* ********* in ***** ***** *** laws ** *** *****.  The ************ ** ********** surveillance ** ******** **** is ********* ** * notionally **** *******.

*'* ****** **** **** we ***'* **** **** laws ** *********, ***** private ******* ** ***** that ****** ** **** the ******** ** ***** of *** ***** **** been ******* *********** *** the ************ ** * rapist/murderers, *** ******* * number ** ***** ******.  The ****** ********* **** on ******* **** *****.

** ** **** **** other ****** **** ****** encryption ******.

 

***, **** *****. * similar ******** ****** ** the ** **** ******* to ***** ******* ******* to **** ***** ****** cases. ******, ** *** US, * ****** ** local ****** *********** ***** databases ** ******* ******* to **** ***** ******. It ** ** ** interesting ******** ******* *******, security, *** **** (*.*., those ******* ******* *** much **** ********* **** building *** ********** ****** systems).

*********** *******, ****** **** them ****** ** *** learn ***** **** ********** and *****.  **** *** knowledge ** **** **** privacy **** *** ***** in *** ****** ****** and ***** *********.

*********: 

****** ********* * ******* privacy ***

****** ******* *** *** on *******

******* ********* ******* ** the ********** ******* **** and *********.  ** **** really ***** **** *** people ***** *** ****** are ***** ** ****** with ***** *** ***********.  I'm *** *** **** practices, ******** ******* *** controlling ** ******** ****, but ****** **** ** be ********* ***** **** makes ***** *** ***** are **** *** *** ones **** ****** ****.

******: **** **** *** weeks ***** **** ******* shop **** *** ******, Austria's **** ********** **************** * $*,*** ****** * *** *** violating *** **** ***** he ********* ******** ******* in *** ********* **** filmed ****** ***** ** the *******.

** ******** **, ****, the ******** *** ***** that * *** ***** Mr. ****** - *** first **** *** *** disclosed - ********* * cameras (*** ** *** doorway, *** ***** ** his ******) **** **** filmed "***** ** *** property ******** *** ******* use" **** **:

****** **** "********* ** ****** *****" at ***** **** ** the ******* *** ****'* put ** * **** indicating *** ***** ************.

*** *** ***** *** this ******** ******** * and * ** *** GDPR, **** **** *** betting **** ****, *** fined **. ****** *,*** euros ** ***** $*,***:

*** **** ******** **** Rudolf's ****: ****** ***** in ********** **** *******, walkways, *** *** **** considered "******"; ** ** GDPR *********, ********* *** only **** ***** *** property.

* *** ***** **. Rudolf - *** ***** name *** *** *********...

******* ** ****? ;)

**, **, * ***** this ** **** ************ policy (**** ******** *** GDPR) ** *********** *** naming ********/****** ******** ** court *****/***. **** ******** countries **** ******* ********.

******, * ***** **** his **** **** ** not *********, *****?

******: **** ********** ********* Appeal

** ***** ****, *******'* highest *************** *** ********* ** * ***** technicality ********* ** ***** surveillance. *** **** ***** determined **** *** *** had *** ************ **** the ****'* ******* ***** surveillance ** * ******** person, *.*. *** *******:

**** ******** *** ******** without *********** *** *** proceedings **** ************, ******* it *** * **** against * **** [******* liability *******] *** ************ acts ** *********** ******* a ******* ****** ("******" within *** ******* ********* ** ***) ** *** ************** proceedings ** *** *** (at ***** **** **** appear ** *** *****; out *** ****** *** a ******** **** **********) set ****.

******* * ***** ********** *** **** *****'* move **** ******** *** firm ****** ***** **********:

********* ** ******** ************, the **** ********** ********* can ****** ************** ***** on * ***** ****** for ********** ** *** GDPR *** *** ******** Data ******* *** ************, if *** ********** *** committed ** *********** *** hold * ******* ******** in *** ***** ****** concerned ** ** *** violations *** ****** ** lack ** *********** ** control ** * ****** in * ********** ****. However, ******* *** ******** nor *** ***** ********** act ** *** **** Protection ********* ********* **** behaviour ** ***** ********** had *** ** *** infringements *** *** ********* attributable ** *** ***** entity *** ***** ********* be **** ** * basis *** *** ************** fine *******. ** *** leading ********** ******** *** never ***** *** **** never ********* ** *** Data ********** ********* ****** the ********* **** ****** for ***********, *** ******* Administrative ***** *** ** annul *** ************** ******* imposed ** *** *******.

**** ** ** *****, there ** ** ******** where ********* *** *** away **** * ********* if ** ****'* *** manager/leader ************ *** ********* one. ** * ******* employee ******* * *********, the ********** ***** ****** ***********:

*** ******** ********* ** the ***** ****** [...] is ***** ** *** accusation **** *** ********** named ***** **** *** violated *** "***********" ******or **** **** *** **** ** "******** ***" ******** ******* **** ** ******* ** **********

Read this IPVM report for free.

This article is part of IPVM's 6,367 reports, 855 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.

Already a member? Login here | Join now

Related Reports

Terrible Convergint Coronavirus Thermal Camera Recommendation on Apr 01, 2020
A week after Convergint disclosed falling revenue, pay and job cuts, Convergint is touting 'extensive research' that is either grossly incompetent...
First GDPR Facial Recognition Fine For Sweden School on Aug 22, 2019
A school in Sweden has been fined $20,000 for using facial recognition to keep attendance in what is Sweden's first GDPR fine. Notably, the fine is...
First Video Surveillance GDPR Fine In France on Jul 08, 2019
The French government has imposed a sizeable fine on a small business for violating the GDPR after it constantly filmed employees without informing...
Axis Will Not Block Resellers on Jun 10, 2019
While Axis generally has strong favorability amongst integrators, the biggest complaint is their channel model, which results in smaller integrator...
Amazon Go Store Tested on Nov 13, 2018
IPVM's trip to and testing of Amazon Go's San Francisco store shows a number of significant operational and economic issues that undermine the...
When Your Salesperson Creates An International Incident (Amazon / ICE) on Oct 23, 2018
Having your salespeople be aggressive and go after big accounts is a virtue, mostly. On occasions, it can cause problems. A new case involves...
France Political Scandal Reveals Video Surveillance Problems on Aug 22, 2018
In what French media describes as "the most damaging crisis yet for" French President Macron, a political scandal has revealed major gaps in the...
Broken Hikvision App Exposes Hypocrisy on Dec 06, 2017
While Hikvision talks about a commitment to cybersecurity, their broken app and their insecure 'solution' exposes not only their engineering...
Exporting Video Surveillance Tutorial on Oct 05, 2017
Exporting video surveillance is important when incidents or crimes occur. However, there are multiple ways to export video which have their pros...
NRF 2017 Exhibits Traffic Weak on Jun 28, 2017
The 'retail apocalypse' is not sparing the security industry. The National Retail Federation's Protect 2017's exhibit traffic is weak, notably...

Most Recent Industry Reports

Verkada: "IPVM Should Never Be Your Source of News" on Jul 02, 2020
Verkada was unhappy with IPVM's recent coverage declaring that reading IPVM is 'not a good look' and that 'IPVM should never be your source of...
Vintra Presents FulcrumAI Face Recognition on Jul 02, 2020
Vintra presented its FulcrumAI face recognition and mask detection offering at the May 2020 IPVM Startups show. Inside this report: A...
Uniview Wrist Temperature Reader Tested on Jul 02, 2020
Uniview is promoting measuring wrist temperatures whereas most others are just offering forehead or inner canthus measurements. But how well does...
Dahua USA Admits Thermal Solutions "Qualify As Medical Devices" on Jul 02, 2020
Dahua USA has issued a press release admitting a controversial point in the industry but an obvious one to the US FDA, that the thermal temperature...
Access Control Online Show - July 2020 - With 40+ Manufacturers - Register Now on Jul 01, 2020
IPVM is excited to announce our July 2020 Access Control Show. With 40+ companies presenting across 4 days, this is a unique opportunity to hear...
Hanwha Face Mask Detection Tested on Jul 01, 2020
Face mask detection or, more specifically lack-of-face-mask detection, is an expanding offering in the midst of coronavirus. Hanwha in partnership...
UK Government Says Fever Cameras "Unsuitable" on Jul 01, 2020
The UK government's medical device regulator, MHRA, told IPVM that fever-seeking thermal cameras are "unsuitable for this purpose" and recommends...
Camera Course Summer 2020 on Jun 30, 2020
This is the only independent surveillance camera course, based on in-depth product and technology testing. Lots of manufacturer training...
Worst Over But Integrators Still Dealing With Coronavirus Problems (June Statistics) on Jun 30, 2020
While numbers of integrators very impacted by Coronavirus continue to drop, most are still moderately dealing with the pandemic's problems, June...