Austria’s First GDPR Fine Is For Video Surveillance

Published Jan 29, 2019 11:47 AM

Should EU businesses be concerned if police see a business' surveillance cameras filming public areas?

This is what happened with Austria’s first GDPR fine, imposed on a betting shop for filming public areas with its security cameras.

austria gdpr fine

The case racked up a total of almost $6,000 in fines, some of which were for non-GDPR violations. It has been appealed, so is not final. The case is nevertheless an important example of the heightened risk faced by end users in the GDPR era, particularly since it was the GDPR-related fine that was by far the highest.

In this note, we examine:

  • How They Got Caught
  • Alleged Violations
  • GDPR vs non-GDPR Violations
  • How The Fines Were Calculated
  • Why the GDPR Fine was the Highest
  • The frequency of Video Surveillance Fines in Austria
  • Timing & Gravity of Offense
  • Broader Meaning

*** *** **** *** ******

********* ** ********** **** *******, ***** ****** ******** ******* *** ************ cameras ******* ****** ***** ***** *** entrance ** * ******* **** ** the ****** ******** ** ***** **, ****. (******* ***** are ****** ** ***** ** ****** and ******* ******* ** * ***** store/bar ***** ******* *** *** **** machines ** ***** ****.)

* **** *** ****** ***** *** transferred ** *** ******** **** ********** agency,*** ***, ***** *** **, ****, *** date *** **** *** *******. **** is ******* ***** ** *** ****, illegal ***** ************ ***** **** ******* by ***** ***********, *** *** ***, the ****** **** ****.

List ** **********

*** *** ****** **** *** ******* shop ********* **** ******** ******* **********:

  1. *** ******** ******* ******* ** *** shop’s ******** ********* * ****** ******* lot *** ******* *****, ********* ****** passing ** *** ********’ ******* ******.
  2. *** ******* **** *** ********** **** authorities.
  3. ***** ************ ******* *** **** *** an ********** **** ****** **** ** justification ********. (******** ******* *** ******** legal ************* *** *** ***** ************ storage ******* ****** **** ** *****.)
  4. ***** *** ** ****** **** ********** that ***** ************ *** ***** ****.

*** ******* **** *** ******* ** the *** **** *** **** **********, although *** ******* *** ******* ** was **** ** * *****. 

GDPR ** ***-**** **********

*** ***** ********* – ******* ****** areas – *** *** **** ****** listed ** ********* *** ****, **** the *** ************ *** ******** ******** of *** ***:

  • ******* *, ***** ****** **** *** ********** of ******** **** ** “******* ** **** ** ********* ** relation ** *** ******** *** ***** they *** *********”. *** *** ***** that *** ******* ****’* ********** *********** *** *** *******’ ******** purpose ** *********** *** ********.
  • ******* *, ***** **** *** *** ********** for ****** **********, **** ** “*******” and “********** ********”. *** *** ***** that *** ******* ****’* ******* ********* none ** ***** **********.

*** ***** ***** ******* **** *** violations *********’* ******** ******* ***, ***** *** ****** ** ****.

*** ****** ****** *** **** ** non-GDPR ***** ** **** “*** ******** of *** ******* ******* ******** ****** 25 *** ****” *.*. *** **** the **** *** *******. ********* ********** 2, *, *** * **** ******* under ******** ******* *********** ***** *** first *** ******* ***** *** ****.

How *** ***** **** **********

*** *** **** *********, *** **** was ***** *,*** ***** ($*,***). *** other *****, ***-**** ********** ******** ***** of *** ***** **** ($***), ** laid *** ** ******** ******** ******* law. *** ***** ** ***** *** **** 4,800 ***** ($*,***). * **% ***** fee *** *****, ******** *** ***** to *,*** ***** ** $*,***.

(**********: “**** ** *****”, “******* ** case ***** *** *** *********”, “************ period”, “[*****] *********”)

GDPR ****** ****** *****

*** **** **** *** **** ********* was ***** *** *,*** ***** ***** the ***-**** ***** **** **** *** euros ** *** * ***********.

*** ***'* ****** **** ******* ******* confirmed ** **** (******** *****):

********* ********, *** **** ****** ****** its*** **(*) *** (*)significantly ****** **** concerning the determination of the total amount of an imposed fine in relation to prior legal provisions in force before the GDPR.

************, ******* **** ************* ********************* **** ***** **** ** ************ ** the **** ** *** ********; * small ******* **** ***** *** ** slapped **** *** ******* **** ****, which *** ***** ** ******* ***** or *% ** ****** ****** *******.

*** **** ** ** *************. *** example, * ****** **** * ******** who *** ** ****** ****** ** 40,000 ***** [$**,***] **** * **-*******-**** fine [$** *******].

Frequency ** ***** ************ ***** ** *******

**** ** *** *** ***** **** illegal ***** ************ ** ***** ** Austria. ******** ** *** *** ******* statistics, ******* **** **** **** ***** are * "****** **********", ****** *** after *** ****:

*** ******** ** *** ****** ***** concern *** ******** ******* *** ** CCTV.

Timing/Gravity ** *******

*** ****** ************* ** *** ******* shop ***** ** ***** **** *** the ***** **** ********* ** ********* 2018. *** **** *** ******** *** case *** *** *** ** *******’* federal *****, ***** *** *** ** rule ** **, *** *** ********* to ****.

*** *** **** ********* **** **** is *******’* ***** **** ****. *** months-long ***** ** **** ***** ***** from *** **** **** **** ********** are ***** ******* * ******* ** cases ***** ***** **** ****** *** GDPR’s *********.

*** *** ****** *** ****’* ******* to ** “*********” ****** “**********” ** “aggravating”. **** ** ******* *** ******* shop ****’* **** *** ******** ****** of **********, ******* *** ******* *** months-long ***** ************.

**********

**** **** ******** * ************ ************ example ** *** ***** *** ** higher ****** ** *** ****. * $*,*** **** *** * ****** small **** *** ** ***** * significant ******, *** ** ** ****** that *** ***** **** ***** **** been ****** *** *** *** ********** taken ***** ***** *** ****’* ********* on *** **. 

**** ** ********* *** *****, ***********, and *** ****** ********** ***** ************ data ****** ****** **** ** ****.

Comments (34)
DE
Donald Erickson
Jan 29, 2019

**** *****. 

(2)
Avatar
Sean Nelson
Jan 29, 2019
Nelly's Security

* **** *** "******* ****** *****"???

"*** ******* **** *** ********** **** authorities"

*** ****!

(3)
(3)
(1)
Avatar
Charles Rollet
Jan 30, 2019

***** ** *** **, ******* ** privacy **** **** *** * **** time ********* ***** ************ **** **** stringently (*** **** ******** *** ****.) For ******* ** ****** *** ******************** **** ********** **** ********** ******** ******* **** film ****** *****, "**** ** **** want ** ****** *** ******** ** their ******* ****** ** ***** ** their ****.”

(1)
(4)
UI
Undisclosed Integrator #1
Jan 29, 2019

"***** *****" ** *** ****....

(3)
(5)
U
Undisclosed #5
Jan 30, 2019

************** *********, *** ***** *** ****** of ***** ******* “*******” ******** ******** of ****** ***** ******. *** ** sight *** ** ****...

U
Undisclosed #2
Jan 29, 2019
IPVMU Certified

*** ****** ****** *** **** ** non-GDPR ***** ** **** “*** ******** of *** ******* ******* ******** ****** 25 *** ****” *.*. *** **** the **** *** *******. ********* ********** 2, *, *** * **** ******* under ******** ******* *********** ***** *** first *** ******* ***** *** ****.

**** ******* **** *** *** *************************** ** **** **** **** *** GDPR **** ** $*,*** ***** **** been ******; *** **********, *** *********************** ** ****, **** **** *** 3 $*** ***** ***** **** **** imposed.

** **** ** **, *** ** you *** ****

** *** *** ****-******* **** **** was ** *** *** *******.

**** ** **** ****** ** **** be $****, **** **** *** ***-**** spread **** ***** *****, *** **** for *** **** *******?

 

 

Avatar
Charles Rollet
Jan 30, 2019

****, *** ** *******. **** *'* saying ** **** *** *** *** alleged ********** ***** ***** ***** *** 25, *** * ********** ***** **** been *********** ** **** **********, ****** than **** *. ***** *** **** gives *********** ************* **** ****** ** imposing *****, **** ** *** ********** could **** **** *****, *** *******, 2,400 ***** - ** ****'* *,*** x * = *,*** ***** ***** in *****, ** ****** $**,***.

**** *** ***-**** ********** **** *** "spread **** ***** *****"; **** *** was * ********** ********* ** ******* regulations.

* **** **** ** ***** ** interpretation **** ***** *** **** ********** are ********* ****** **** *** ****** head ** *** ******** **** ********** agency ******** *******. ** ********* **** to **, ******* ** **** (******** added):

"********* ********, *** **** ****** ****** its *** ** (*) *** (*)significantly ****** **** concerning the determination of the total amount of an imposed fine in relation to prior legal provisions in force before the GDPR. In addition, in this particular case, the Austrian DPA had to take transitional provisions into account, which ******* *** ***** ***** ***** ** *** ******** ***** ********* prior to the GDPR in which the infringing action started before the 25th of Mai 2018."

(2)
U
Undisclosed #2
Jan 30, 2019
IPVMU Certified

**** *'* ****** ** **** *** all *** ******* ********** ***** ***** after *** **, *** * ********** would **** **** *********** ** **** violations, ****** **** **** *.

** *** *** ****** ************ **, *** **** ******* ******* was *** ******* ** ******* *****?

*** **** *********, ***************** **, **** *** ********** *** cameras, *** ***** **, ******** *** retention ****** ***?

**** ****** ******** ** **, *** it’s ********.

** *** ***** ****, ** *** of *** * ******** ******** ** both ************* * *** ******* ***** **** statutes, ** ***** **** * *** arbitrary ** ****** **** ************ *** asymmetrically, **** ******* **** **** ********* over * ****** ** ******* **** period.

**** **** **** ***** :)

* *** *** ** ***** ******, but *** **** *** **** ******** the *******  “*** ***** ***** ***** gefunden”...

Avatar
Charles Rollet
Jan 30, 2019

** *** *** ****** **** ***** *** **, *** **** ******* ******* was *** ******* ** ******* *****?

*** **** *********, ******** ****** *** **, **** *** ********** *** cameras, *** ***** **, ******** *** retention ****** ***?

*** **** ***** **** "**** ** the ******* ********** ******** ****** *** 25." ** ********** *, *, *** 4 **** ***** ** *********** ****** the ****, *** ********* * *** only ********* **********. ******* ********** *-* were ******* ***** ************ ***** ** GDPR, *** **** ***'* ** ********** for *** **** ******* ****-****. ***** ** no ******* ** *** **** *********** cameras, ******* ** *****, ***.

* *** *** ** ***** ******, but *** **** *** **** ******** the ******* “*** ***** ***** ***** gefunden”...

** ***, * ***** *** **** in *** *******. *** *** ********* ****.

UE
Undisclosed End User #3
Jan 29, 2019

* **** * *** ****** **** covers *** **** **** ***** ** my *******, ** ****** ***'* **** it **** ***** ******* ***. *** cops ***** *** ***** **** **** teenagers ******* ** *** ** *** cars.

(1)
(2)
BP
Bas Poiesz
Jan 30, 2019

*** ** *** ****** *** ****** driving *****? ****, *** *** ****** the **** *** *** ********* ** some ******** ******** ************* ** ***** in ******** ** *** ******?

* ***** *** ********** * ****** company ** ****** ******** *** ******* where * *****.

(3)
(1)
JH
John Honovich
Jan 30, 2019
IPVM

***** ** ******** ** *** ******?

** *** ******... :)

(2)
(1)
BP
Bas Poiesz
Jan 30, 2019

**** *** ***** ** *** ****** or ****** :)

* ****** ***'* ********** *** ******** reception ** ****. **** ***-** ******* seem ** **** ** ******* **** than * ******.

** ** * *** *** ***** positives

- **** ************* ** ****
- **** ***** *** *************

********** *** ****** ****** ****** ** applauded. **** ***** * ****** ***** for *** ******** *** ****** *** a ****** ***** ** ********* *** installation.
********** **** ****** **** * ****** quality *** ****** ******.

(1)
(2)
UE
Undisclosed End User #3
Jan 30, 2019

******* ****, ****** ******* ******, *** just **** *** *********** ******, (**** up *** *** **). 

* **** * ****** ****'* ***** on ** ******** ** ***, * see *** **** ** **** ******* by, *** ** ****** **** **** turn **** ** ********. ** *****'* see *** ** ***** *****, *********, or ***** *****. **'* * "***** neighborhood" ** ** * ******* *** angle ** **** ****** ******* ** they ******'* ****.

* ****** **** *** ** ** neighbors *** * *** ******* **' off *** ****** ** *** **** of ***** *****, ****** **** ** don't ** * **** ***** **** play. ******* **** ******* ** ** neighborhood *** * ***** **** ****** got **** ** ******* **** **** decided ** **** ******** ** * honor **** ******* ******* ******* ***** backyard **** ***** ******** ****. *** kid *******'* ** **** *****, *** posting ** ** *** ***** ******* Facebook ***** (**** ** ******* ** see) *** ****** ** *** **** in ******* *** ****.

BP
Bas Poiesz
Jan 30, 2019

* **** * *** ****** **** covers *** **** **** ***** ** my *******, ** ****** ***'* **** it **** ***** ******* ***.

* ****** **** **** ******* ** was ********* *** ***, ***** *** no ********* ** **** ******** ******** being ********.

** **'* **** ******** *** *** within *** ******, **** **** *** the *** *******. ** ******** *****.

**'* *** ****** ** *** ****** a ****** ** ***** ******, ** public ***** ** ******* ******* ** to **** ******* ********. **** *** enter ******** ******* ******** *** ***'* have *** *** ** ***** ****** choices. *********** **** *** **** ** be ***** ******... * ***'* ***** agree **** **** ****

UE
Undisclosed End User #3
Jan 30, 2019

** ******* **** ** *** ******, a ******* **** **** **** ******* to ** ** *** ******** **** between *** ** *** *********, ** someone **** *** **** ** ***** that *** ** *** ***** * entrances ** *** ***** **** **** to ** ****'* ***** ******.

** *** ** *****, ** *** camera ****** ** * ****** ****, I *** *** **** ** ***** car, *** **** *** ***** ** the **** **** **** **** ** driveway, **** ** **'* **** ** turn ******. ****** * *** *** a ****** ***** **** *** **** into ****** * ******* ***'* *** same ** * ***** ****** **** sees * ******** ****. 

*** ** *** ****** *** **** up *****/******** ** ****** ** ***** backyard ** ********, ** ** ******** or * **** *** **** ** shame ****** ****** ** ***** ** running **** ****** ** *** ***. I'm *** **** ** *** **, but ** *** ******, **** ** intended ** ** **** *******, *** published ****** ** ********.

U
Undisclosed #5
Jan 30, 2019

******** *** ******** ** *** *** two ******** ********* ******.

Avatar
Michael Votaw
Feb 14, 2019

******, ***** *** ********* ******* **** everything ***** **.

UI
Undisclosed Integrator #4
Jan 29, 2019

  **** *** ******** ****** ************, it **** ****** **** * *** for *** **** ** **** ********* and ****** ** *** ******* **** a **** ** *** ****** ******* having ** ***/******* **********. ** ***** is ******* ******** ***** ** ** the ******* **** *** **** ** wanting ** ****.

  ****, * ***** ***** * sign ** *********** ** *** ******* are ** ***** ****.  **** ** pessimistic ** *** ****

(1)
(2)
(1)
Avatar
Charles Rollet
Jan 30, 2019

**** **** ** ************** ** * practical *****, *******, *****'* ** ********* anywhere ** *** **** ** ******** EU ******* **** **** ***** ******** video ************ *** *** ******** ** long ** *** ******* *** ** plain ****. (*** *** *** ***: a *********** *** ***** ***** ******* are ****** ******* **** **** ******** don't **** ****** ** **** ** and ****** ****).

CK
Carl Kristoffersen
Feb 03, 2019

*** * **** ** *** ***** and **** ***'* **** *** **.

**** ** *****, "***'** ** ******".

 

BP
Bas Poiesz
Jan 30, 2019

* *** ********** *** **** **** way, *** **** ******* **** **** not ** ******** ********* ******** ******* on *** *****, ******* ** *** road *** **** ******* ** **** garden *** ******* ****?

**** ** * ******, *** * good ***** *** *** *** ****

(3)
(1)
U
Undisclosed #2
Jan 31, 2019
IPVMU Certified

...*** **** ******* **** **** *** so ******** ********* ******** ******* ** his *****, ******* ** *** **** but **** ******* ** **** ****** and ******* ****?

****?

(1)
U
Undisclosed #5
Jan 30, 2019

* ******* ****** *********** ** **** rules ***** **** *****, *** * advocate *** ********* ********* ** ***** where *** **** ** *** *****.  The ************ ** ********** ************ ** everyday **** ** ********* ** * notionally **** *******.

(1)
(1)
Avatar
Alf Katz
Jan 30, 2019

*'* ****** **** **** ** ***'* have **** **** ** *********, ***** private ******* ** ***** **** ****** to **** *** ******** ** ***** of *** ***** **** **** ******* responsible *** *** ************ ** * rapist/murderers, *** ******* * ****** ** other ******.  *** ****** ********* **** on ******* **** *****.

** ** **** **** ***** ****** laws ****** ********** ******.

 

(3)
JH
John Honovich
Jan 30, 2019
IPVM

***, **** *****. * ******* ******** exists ** *** ** **** ******* to ***** ******* ******* ** **** solve ****** *****. ******, ** *** US, * ****** ** ***** ****** departments ***** ********* ** ******* ******* to **** ***** ******. ** ** is ** *********** ******** ******* *******, security, *** **** (*.*., ***** ******* cameras *** **** **** ********* **** building *** ********** ****** *******).

(2)
UE
Undisclosed End User #6
Feb 01, 2019

*********** *******, ****** **** **** ****** as *** ***** ***** **** ********** and *****.  **** *** ********* ** GDPR **** ******* **** *** ***** in *** ****** ****** *** ***** countries.

*********: 

****** ********* * ******* ******* ***

****** ******* *** *** ** *******

Avatar
Michael Votaw
Feb 14, 2019

******* ********* ******* ** *** ********** wasting **** *** *********.  ** **** really ***** **** *** ****** ***** bad ****** *** ***** ** ****** with ***** *** ***********.  *'* *** for **** *********, ******** ******* *** controlling ** ******** ****, *** ****** have ** ** ********* ***** **** makes ***** *** ***** *** **** for *** **** **** ****** ****.

(2)
Avatar
Charles Rollet
Nov 05, 2019

******: **** **** *** ***** ***** this ******* **** **** *** ******, Austria's **** ********** **************** * $*,*** ****** * *** *** ********* *** GDPR ***** ** ********* ******** ******* in *** ********* **** ****** ****** areas ** *** *******.

** ******** **, ****, *** ******** DPA ***** **** * *** ***** Mr. ****** - *** ***** **** was *** ********* - ********* * cameras (*** ** *** *******, *** other ** *** ******) **** **** filmed "***** ** *** ******** ******** for ******* ***" **** **:

****** **** "********* ** ****** *****" ** ***** some ** *** ******* *** ****'* put ** * **** ********** *** video ************.

*** *** ***** *** **** ******** Articles * *** * ** *** GDPR, **** **** *** ******* **** case, *** ***** **. ****** *,*** euros ** ***** $*,***:

*** **** ******** **** ******'* ****: common ***** ** ********** **** *******, walkways, *** *** **** ********** "******"; to ** **** *********, ********* *** only **** ***** *** ********.

(1)
U
Undisclosed #2
Nov 05, 2019
IPVMU Certified

* *** ***** **. ****** - his ***** **** *** *** *********...

******* ** ****? ;)

Avatar
Charles Rollet
Nov 05, 2019

**, **, * ***** **** ** just ************ ****** (**** ******** *** GDPR) ** *********** *** ****** ********/****** involved ** ***** *****/***. **** ******** countries **** ******* ********.

U
Undisclosed #2
Nov 05, 2019
IPVMU Certified

******, * ***** **** *** **** name ** *** *********, *****?

Avatar
Charles Rollet
May 13, 2020

******: **** ********** ********* ******

** ***** ****, *******'* ******* *************** *** ********* ** * ***** ************ ********* to ***** ************. *** **** ***** determined **** *** *** *** *** sufficiently **** *** ****'* ******* ***** surveillance ** * ******** ******, *.*. the *******:

**** ******** *** ******** ******* *********** and *** *********** **** ************, ******* it *** * **** ******* * GmbH [******* ********* *******] *** ************ acts ** *********** ******* * ******* person ("******" ****** *** ******* ********* ** ***) ** *** ************** *********** ** the *** (** ***** **** **** appear ** *** *****; *** *** method *** * ******** **** **********) set ****.

******* * ***** ********** *** **** *****'* **** **** Austrian *** **** ****** ***** **********:

********* ** ******** ************, *** **** Protection ********* *** ****** ************** ***** on * ***** ****** *** ********** of *** **** *** *** ******** Data ******* *** ************, ** *** violations *** ********* ** *********** *** hold * ******* ******** ** *** legal ****** ********* ** ** *** violations *** ****** ** **** ** supervision ** ******* ** * ****** in * ********** ****. *******, ******* the ******** *** *** ***** ********** act ** *** **** ********** ********* indicated **** ********* ** ***** ********** had *** ** *** ************* *** was ********* ************ ** *** ***** entity *** ***** ********* ** **** as * ***** *** *** ************** fine *******. ** *** ******* ********** required *** ***** ***** *** **** never ********* ** *** **** ********** Authority ****** *** ********* **** ****** for ***********, *** ******* ************** ***** had ** ***** *** ************** ******* imposed ** *** *******.

Avatar
Charles Rollet
May 13, 2020

**** ** ** *****, ***** ** no ******** ***** ********* *** *** away **** * ********* ** ** wasn't *** *******/****** ************ *** ********* one. ** * ******* ******** ******* a *********, *** ********** ***** ****** ***********:

*** ******** ********* ** *** ***** person [...] ** ***** ** *** accusation **** *** ********** ***** ***** that *** ******** *** "***********" ******or **** **** *** **** ** "******** ***" ******** ******* **** ** ******* ** **********