https://gdprhub.eu/api.php?hidebots=1&urlversion=1&days=7&limit=50&target=Category%3AArticle_5%281%29%28b%29_GDPR&action=feedrecentchanges&feedformat=atomGDPRhub - Changes related to "Category:Article 5(1)(b) GDPR" [en]2024-03-29T14:32:17ZRelated changesMediaWiki 1.39.6https://gdprhub.eu/index.php?title=DSB_(Austria)_-_2023-0.420.407&diff=40604&oldid=40565DSB (Austria) - 2023-0.420.4072024-03-27T14:56:37Z<p></p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:56, 27 March 2024</td>
</tr><tr><td colspan="4" class="diff-multi" lang="en">(One intermediate revision by the same user not shown)</td></tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l14">Line 14:</td>
<td colspan="2" class="diff-lineno">Line 14:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Original_Source_Language_1=German</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Original_Source_Language_1=German</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Original_Source_Language__Code_1=DE</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Original_Source_Language__Code_1=DE</div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>|Original_Source_Name_2=</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>|Original_Source_Name_2=<ins style="font-weight: bold; text-decoration: none;">BVwG (Austria)</ins></div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Original_Source_Link_2=</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Original_Source_Link_2=</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Original_Source_Language_2=</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Original_Source_Language_2=</div></td></tr>
<tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l58">Line 58:</td>
<td colspan="2" class="diff-lineno">Line 58:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Party_Link_3=</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Party_Link_3=</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>|Appeal_To_Body=BVwG</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>|Appeal_To_Body=BVwG <ins style="font-weight: bold; text-decoration: none;">(Austria)</ins></div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Appeal_To_Case_Number_Name=</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Appeal_To_Case_Number_Name=</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Appeal_To_Status=Pending appeal</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Appeal_To_Status=Pending appeal</div></td></tr>
<!-- diff cache key gdprwiki:diff::1.12:old-40565:rev-40604 -->
</table>Imhttps://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_(Island)_-_2021051091&diff=40567&oldid=40559Persónuvernd (Island) - 20210510912024-03-27T09:35:45Z<p></p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 09:35, 27 March 2024</td>
</tr><tr><td colspan="4" class="diff-multi" lang="en">(One intermediate revision by the same user not shown)</td></tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l75">Line 75:</td>
<td colspan="2" class="diff-lineno">Line 75:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>}}</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>}}</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>The <del style="font-weight: bold; text-decoration: none;">Icelandic </del>DPA imposed a fine of €10,059.92 (ISK 1,500,00) on Stjörnuna ehf, the operator of Subway in Iceland, for unlawfully monitoring its employees without adequately informing them.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The DPA imposed a fine of €10,059.92 (ISK 1,500,00) on Stjörnuna ehf, the operator of Subway in Iceland, for unlawfully monitoring its employees without adequately informing them.</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== English Summary ==</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== English Summary ==</div></td></tr>
<tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l86">Line 86:</td>
<td colspan="2" class="diff-lineno">Line 86:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>The data subject filed a complaint to the Icelandic DPA (Persónuvernd) on 4 May 2021.</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>The data subject filed a complaint to the Icelandic DPA (Persónuvernd) on 4 May 2021.</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>The data subject claimed that the store manager <del style="font-weight: bold; text-decoration: none;">monitored him </del>in real time <del style="font-weight: bold; text-decoration: none;">at home, and thus outside the workplace, </del>and called the workplace to give comments on the data subject’s work style based on the footage. This was done without the data subject’s knowledge. </div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The data subject claimed that the store manager <ins style="font-weight: bold; text-decoration: none;">was at home monitoring the data subject </ins>in real time and called the workplace to give comments on the data subject’s work style based on the footage. This was done without the data subject’s knowledge. </div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>The controller argued in a letter to the DPA that it had installed the surveillance cameras for the sake of security and property protection. The surveillance camera system was used in a reasonable manner and it was been used for the control of workers or for monitoring work results. The controller claimed that the store manager went beyond the stated purpose of the monitoring and used the footage to monitor the work performance of the employees without the consent or knowledge of the company representatives. Immediate action was taken to prevent this from happening again.</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>The controller argued in a letter to the DPA that it had installed the surveillance cameras for the sake of security and property protection. The surveillance camera system was used in a reasonable manner and it was been used for the control of workers or for monitoring work results. The controller claimed that the store manager went beyond the stated purpose of the monitoring and used the footage to monitor the work performance of the employees without the consent or knowledge of the company representatives. Immediate action was taken to prevent this from happening again.</div></td></tr>
<tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l95">Line 95:</td>
<td colspan="2" class="diff-lineno">Line 95:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Holding ===</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Holding ===</div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Firstly, the DPA found the arguments of the controller conflicting as the purpose for processing was either in the interests of security and property protection or quality control. <del style="font-weight: bold; text-decoration: none;">Regardless of which argument should </del>be <del style="font-weight: bold; text-decoration: none;">taken into account</del>, the DPA held that it is clear that the store manager’s use of the footage from the surveillance cameras did not fall under the <del style="font-weight: bold; text-decoration: none;">stated </del>purpose of <del style="font-weight: bold; text-decoration: none;">the company’s monitoring for </del>security and property protection. Moreover, the DPA held that monitoring of employees for this purpose is only possible if there are no other means available and <del style="font-weight: bold; text-decoration: none;">it </del>is necessary due to an agreement. The controller did not demonstrate this necessity. <del style="font-weight: bold; text-decoration: none;">Under Article 5(1)(b) GDPR</del>, <del style="font-weight: bold; text-decoration: none;">monitoring must be carried out for specified, explicit and legitimate purpose. The </del>DPA found that the controller did not demonstrate that quality control was the purpose of monitoring or that the objectives of quality control cannot be achieved with other and less intrusive measures. Therefore, the DPA found that there was no legal basis for processing under [[Article 6 GDPR#1|Article 6(1) GDPR]]. </div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Firstly, the DPA found the arguments of the controller conflicting as the purpose for processing was either <ins style="font-weight: bold; text-decoration: none;">(1) </ins>in the interests of security and property protection or <ins style="font-weight: bold; text-decoration: none;">(2) </ins>quality control. <ins style="font-weight: bold; text-decoration: none;">The DPA explained that under [[Article 5 GDPR#1b|Article 5(1)(b) GDPR]], monitoring must </ins>be <ins style="font-weight: bold; text-decoration: none;">carried out for specified, explicit and legitimate purpose. </ins></div></td></tr>
<tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">Regarding the first potential purpose</ins>, the DPA held that it is clear that the store manager’s use of the footage from the surveillance cameras did not fall under the purpose of security and property protection. Moreover, the DPA held that monitoring of employees for this purpose is only possible if there are no other means available and is necessary due to an agreement. The controller did not demonstrate this necessity. <ins style="font-weight: bold; text-decoration: none;"> </ins></div></td></tr>
<tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">Regarding the second potential purpose</ins>, <ins style="font-weight: bold; text-decoration: none;">the </ins>DPA found that the controller did not demonstrate that quality control was the purpose of monitoring or that the objectives of quality control cannot be achieved with other and less intrusive measures. Therefore, the DPA found that there was no legal basis for processing under [[Article 6 GDPR#1|Article 6(1) GDPR]]. </div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Secondly, the DPA explained that personal data must be processed in a fair and transparent manner in relation to the data subject under [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]]. This means that data subjects should be aware when their personal data is collected, used, viewed or processed in another way. Moreover, in light of [[Article 13 GDPR|Article 13 GDPR]], information must be provided to the data subject and must be given a clear picture of the monitoring, including its purpose, how it is carried out, how access to monitoring material arranged and how long the data is stored. The DPA found that the data subject was not adequately informed about the monitoring or what his rights were concerning the monitoring. Moreover, the DPA rejected the controller’s claim that the installation of signs about the monitoring was satisfactory as these signs did not state who is responsible for the monitoring. </div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Secondly, the DPA explained that personal data must be processed in a fair and transparent manner in relation to the data subject under [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]]. This means that data subjects should be aware when their personal data is collected, used, viewed or processed in another way. Moreover, in light of [[Article 13 GDPR|Article 13 GDPR]], information must be provided to the data subject and must be given a clear picture of the monitoring, including its purpose, how it is carried out, how access to monitoring material arranged and how long the data is stored. The DPA found that the data subject was not adequately informed about the monitoring or what his rights were concerning the monitoring. Moreover, the DPA rejected the controller’s claim that the installation of signs about the monitoring was satisfactory as these signs did not state who is responsible for the monitoring. </div></td></tr>
<!-- diff cache key gdprwiki:diff::1.12:old-40559:rev-40567 -->
</table>Echttps://gdprhub.eu/index.php?title=DSB_(Austria)_-_2023-0.420.407&diff=40565&oldid=40556DSB (Austria) - 2023-0.420.4072024-03-27T09:23:32Z<p></p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 09:23, 27 March 2024</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l67">Line 67:</td>
<td colspan="2" class="diff-lineno">Line 67:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>}}</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>}}</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>The <del style="font-weight: bold; text-decoration: none;">Austrian </del>DPA imposed a fine of €10,000 on a gynaecologist after he disclosed the data subject's diagnosis in a public response to an online negative review <del style="font-weight: bold; text-decoration: none;">of </del>the data subject.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The DPA imposed a fine of €10,000 on a gynaecologist after he disclosed the data subject's diagnosis in a public response to an online negative review <ins style="font-weight: bold; text-decoration: none;">by </ins>the data subject.</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== English Summary ==</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== English Summary ==</div></td></tr>
<tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l75">Line 75:</td>
<td colspan="2" class="diff-lineno">Line 75:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Holding ===</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Holding ===</div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Firstly, the Austrian DPA (DSB) held that the controller processed personal data of the data subject by publishing his response online. Moreover, the DPA held that the information regarding a personal’s vaginal infection is data concerning health data under [[Article 4 GDPR#15|Article 4(15) GDPR]]. This is a special category of personal data according to [[Article 9 GDPR#1|Article 9(1) GDPR]] and whose processing is prohibited unless one of the exceptions in [[Article 9 GDPR#2|Article 9(2) GDPR]] applies. The DPA found that this was not the case. Thus, the controller violated [[Article 9 GDPR]] and the principle of <del style="font-weight: bold; text-decoration: none;">legality </del>under [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]].</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Firstly, the Austrian DPA (DSB) held that the controller processed personal data of the data subject by publishing his response online. Moreover, the DPA held that the information regarding a personal’s vaginal infection is data concerning health data under [[Article 4 GDPR#15|Article 4(15) GDPR]]. This is a special category of personal data according to [[Article 9 GDPR#1|Article 9(1) GDPR]] and whose processing is prohibited unless one of the exceptions in [[Article 9 GDPR#2|Article 9(2) GDPR]] applies. The DPA found that this was not the case. Thus, the controller violated [[Article 9 GDPR]] and the principle of <ins style="font-weight: bold; text-decoration: none;">lawfulness </ins>under [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]].</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Secondly, the controller violated the principle of purpose limitation under [[Article 5 GDPR#1b|Article 5(1)(b) GDPR]]. The DPA found that there was no concrete link between the purpose of the data collection (the diagnosis) and the further processing of the data. Moreover, it was not foreseeable to the data subject that the controller would collect data on her medical diagnosis and publish this in a response to the data subject’s review.</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Secondly, the controller violated the principle of purpose limitation under [[Article 5 GDPR#1b|Article 5(1)(b) GDPR]]. The DPA found that there was no concrete link between the purpose of the data collection (the diagnosis) and the further processing of the data. Moreover, it was not foreseeable to the data subject that the controller would collect data on her medical diagnosis and publish this in a response to the data subject’s review.</div></td></tr>
<!-- diff cache key gdprwiki:diff::1.12:old-40556:rev-40565 -->
</table>Echttps://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_(Island)_-_2021051091&diff=40559&oldid=40543Persónuvernd (Island) - 20210510912024-03-27T09:02:02Z<p><span dir="auto"><span class="autocomment">English Summary</span></span></p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 09:02, 27 March 2024</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l75">Line 75:</td>
<td colspan="2" class="diff-lineno">Line 75:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>}}</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>}}</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>The Icelandic DPA imposed a fine of €10,059.92 (ISK 1,500,00) on Stjörnuna ehf, the operator of Subway in Iceland for unlawfully monitoring its employees without adequately informing them.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The Icelandic DPA imposed a fine of €10,059.92 (ISK 1,500,00) on Stjörnuna ehf, the operator of Subway in Iceland<ins style="font-weight: bold; text-decoration: none;">, </ins>for unlawfully monitoring its employees without adequately informing them.</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== English Summary ==</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== English Summary ==</div></td></tr>
<tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l88">Line 88:</td>
<td colspan="2" class="diff-lineno">Line 88:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>The data subject claimed that the store manager monitored him in real time at home, and thus outside the workplace, and called the workplace to give comments on the data subject’s work style based on the footage. This was done without the data subject’s knowledge. </div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>The data subject claimed that the store manager monitored him in real time at home, and thus outside the workplace, and called the workplace to give comments on the data subject’s work style based on the footage. This was done without the data subject’s knowledge. </div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>The controller argued in a letter to the DPA that it had installed the surveillance cameras for the sake of security and property protection. The <del style="font-weight: bold; text-decoration: none;">purpose of the monitoring is factual, the </del>surveillance camera system <del style="font-weight: bold; text-decoration: none;">has been </del>used in a reasonable manner and it <del style="font-weight: bold; text-decoration: none;">has not </del>been used for the control of workers or for monitoring work results. The controller claimed that the store manager went beyond the stated purpose of the monitoring and used the footage to monitor the work performance of the employees without the consent or knowledge of the company representatives. Immediate action was taken to prevent this from happening again.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The controller argued in a letter to the DPA that it had installed the surveillance cameras for the sake of security and property protection. The surveillance camera system <ins style="font-weight: bold; text-decoration: none;">was </ins>used in a reasonable manner and it <ins style="font-weight: bold; text-decoration: none;">was </ins>been used for the control of workers or for monitoring work results. The controller claimed that the store manager went beyond the stated purpose of the monitoring and used the footage to monitor the work performance of the employees without the consent or knowledge of the company representatives. Immediate action was taken to prevent this from happening again.</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>However, in a following letter, the controller denied that the store manager regularly monitored staff in real time through the restaurant's surveillance camera system and commented on their work style and behaviour. The controller argued that the store manager was looking at the surveillance camera system on the day in question out of fear that bread was running out. However, the store manager noticed that there was a big queue which did not change after 5 minutes, and therefore called the data subject who was in the rest area to request that the data subject serves the customers. </div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>However, in a following letter, the controller denied that the store manager regularly monitored staff in real time through the restaurant's surveillance camera system and commented on their work style and behaviour. The controller argued that the store manager was looking at the surveillance camera system on the day in question out of fear that bread was running out. However, the store manager noticed that there was a big queue which did not change after 5 minutes, and therefore called the data subject who was in the rest area to request that the data subject serves the customers. </div></td></tr>
<tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l95">Line 95:</td>
<td colspan="2" class="diff-lineno">Line 95:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Holding ===</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Holding ===</div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Firstly, the DPA found the arguments of the controller conflicting as the purpose for processing was either in the interests of security and property protection or quality control. Regardless which argument should be taken into account, the DPA held that it is clear that the store manager’s use of the footage from the surveillance cameras <del style="font-weight: bold; text-decoration: none;">does </del>not fall under the stated purpose of the company’s monitoring for security and property protection. Moreover, the DPA held that monitoring <del style="font-weight: bold; text-decoration: none;">for controlling the work </del>of <del style="font-weight: bold; text-decoration: none;">the </del>employees is only possible if there are no other means available and it is necessary due to an agreement. The controller did not demonstrate this. <del style="font-weight: bold; text-decoration: none;">Moreover, under </del>Article 5(1)(b), monitoring must be carried out for specified, explicit and legitimate purpose. The DPA found that the controller did not demonstrate that quality control was the purpose of monitoring or that the objectives of quality control cannot be achieved with other and less intrusive measures. Therefore, the DPA found that there was no <del style="font-weight: bold; text-decoration: none;">authorisation </del>for processing under [[Article 6 GDPR#1|Article 6(1) GDPR]]. </div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Firstly, the DPA found the arguments of the controller conflicting as the purpose for processing was either in the interests of security and property protection or quality control. Regardless <ins style="font-weight: bold; text-decoration: none;">of </ins>which argument should be taken into account, the DPA held that it is clear that the store manager’s use of the footage from the surveillance cameras <ins style="font-weight: bold; text-decoration: none;">did </ins>not fall under the stated purpose of the company’s monitoring for security and property protection. Moreover, the DPA held that monitoring of employees <ins style="font-weight: bold; text-decoration: none;">for this purpose </ins>is only possible if there are no other means available and it is necessary due to an agreement. The controller did not demonstrate this <ins style="font-weight: bold; text-decoration: none;">necessity</ins>. <ins style="font-weight: bold; text-decoration: none;">Under </ins>Article 5(1)(b) <ins style="font-weight: bold; text-decoration: none;">GDPR</ins>, monitoring must be carried out for specified, explicit and legitimate purpose. The DPA found that the controller did not demonstrate that quality control was the purpose of monitoring or that the objectives of quality control cannot be achieved with other and less intrusive measures. Therefore, the DPA found that there was no <ins style="font-weight: bold; text-decoration: none;">legal basis </ins>for processing under [[Article 6 GDPR#1|Article 6(1) GDPR]]. </div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Secondly, the DPA explained that personal data must be processed in a fair and transparent manner in relation to the data subject under [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]]. This means that data subjects should be aware when their personal data is collected, used, viewed or processed in another way. Moreover, in light of [[Article 13 GDPR|Article 13 GDPR]], information must be provided to the data subject and must be given a clear picture of the monitoring, including its purpose, how it is carried out, how access to monitoring material arranged and how long the data is stored. The DPA found that the data subject was not adequately informed about the monitoring or what his rights were concerning the monitoring. Moreover, the DPA rejected the controller’s claim that the installation of signs about the monitoring was satisfactory as these signs <del style="font-weight: bold; text-decoration: none;">do </del>not state who is responsible for the monitoring. </div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Secondly, the DPA explained that personal data must be processed in a fair and transparent manner in relation to the data subject under [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]]. This means that data subjects should be aware when their personal data is collected, used, viewed or processed in another way. Moreover, in light of [[Article 13 GDPR|Article 13 GDPR]], information must be provided to the data subject and must be given a clear picture of the monitoring, including its purpose, how it is carried out, how access to monitoring material arranged and how long the data is stored. The DPA found that the data subject was not adequately informed about the monitoring or what his rights were concerning the monitoring. Moreover, the DPA rejected the controller’s claim that the installation of signs about the monitoring was satisfactory as these signs <ins style="font-weight: bold; text-decoration: none;">did </ins>not state who is responsible for the monitoring. </div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Thirdly, the DPA found that the controller did not keep a record of the processing activities required under [[Article 30 GDPR|Article 30 GDPR]].</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Thirdly, the DPA found that the controller did not keep a record of the processing activities required under [[Article 30 GDPR|Article 30 GDPR]].</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Thus, the DPA ordered the controller under [[Article 58 GDPR#2|Article 58(2) GDPR]] to erase all screenshots of the data subject at work and to inform its <del style="font-weight: bold; text-decoration: none;">data subject </del>about the monitoring, including the purpose of the monitoring and their rights related to it, and to keep record of its processing activities. Moreover, the DPA imposed an administrative fine of €10,059.92 (ISK 1,500,00) on the controller under [[Article 83 GDPR|Article 83 GDPR]] due to the controller’s violations of [[Article 5 GDPR#1|Article 5(1) GDPR]], [[Article 6 GDPR|Article 6 GDPR]], [[Article 12 GDPR|Article 12 GDPR]] and [[Article 13 GDPR|Article 13 GDPR]].</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Thus, the DPA ordered the controller under [[Article 58 GDPR#2|Article 58(2) GDPR]] to erase all screenshots of the data subject at work and to inform its <ins style="font-weight: bold; text-decoration: none;">employees </ins>about the monitoring, including the purpose of the monitoring and their rights related to it, and to keep record of its processing activities. Moreover, the DPA imposed an administrative fine of €10,059.92 (ISK 1,500,00) on the controller under [[Article 83 GDPR|Article 83 GDPR]] due to the controller’s violations of [[Article 5 GDPR#1|Article 5(1) GDPR]], [[Article 6 GDPR|Article 6 GDPR]], [[Article 12 GDPR|Article 12 GDPR]] and [[Article 13 GDPR|Article 13 GDPR]].</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Comment ==</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Comment ==</div></td></tr>
<!-- diff cache key gdprwiki:diff::1.12:old-40543:rev-40559 -->
</table>Mghttps://gdprhub.eu/index.php?title=DSB_(Austria)_-_2023-0.420.407&diff=40556&oldid=40537DSB (Austria) - 2023-0.420.4072024-03-27T08:46:36Z<p><span dir="auto"><span class="autocomment">Holding</span></span></p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 08:46, 27 March 2024</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l75">Line 75:</td>
<td colspan="2" class="diff-lineno">Line 75:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Holding ===</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Holding ===</div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Firstly, the Austrian DPA (DSB) held that the controller processed personal data of the data subject by publishing his response online. Moreover, the DPA held that the information regarding a personal’s vaginal infection is health data under [[Article 4 GDPR#15|Article 4(15) GDPR]]. This is a special category of personal data according to [[Article 9 GDPR#1|Article 9(1) GDPR]] and prohibited unless one of the exceptions in [[Article 9 GDPR#2|Article 9(2) GDPR]] applies. The DPA found that this was not the case. Thus, the controller violated [[Article 9 GDPR]] and the principle of legality under [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]].</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Firstly, the Austrian DPA (DSB) held that the controller processed personal data of the data subject by publishing his response online. Moreover, the DPA held that the information regarding a personal’s vaginal infection is <ins style="font-weight: bold; text-decoration: none;">data concerning </ins>health data under [[Article 4 GDPR#15|Article 4(15) GDPR]]. This is a special category of personal data according to [[Article 9 GDPR#1|Article 9(1) GDPR]] and <ins style="font-weight: bold; text-decoration: none;">whose processing is </ins>prohibited unless one of the exceptions in [[Article 9 GDPR#2|Article 9(2) GDPR]] applies. The DPA found that this was not the case. Thus, the controller violated [[Article 9 GDPR]] and the principle of legality under [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]].</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Secondly, the controller violated the principle of purpose limitation under [[Article 5 GDPR#1b|Article 5(1)(b) GDPR]]. The DPA found that there was no concrete link between the purpose of the data collection and the further processing of the data. Moreover, it was not foreseeable to the data subject that the controller would collect data on her medical diagnosis and publish this in a response to the data subject’s review.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Secondly, the controller violated the principle of purpose limitation under [[Article 5 GDPR#1b|Article 5(1)(b) GDPR]]. The DPA found that there was no concrete link between the purpose of the data collection <ins style="font-weight: bold; text-decoration: none;">(the diagnosis) </ins>and the further processing of the data. Moreover, it was not foreseeable to the data subject that the controller would collect data on her medical diagnosis and publish this in a response to the data subject’s review.</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Thirdly, the controller violated the principle of data minimisation under [[Article 5 GDPR#1c|Article 5(1)(c) GDPR]], as the purpose to create a truthful image for readers could have been fulfilled without mentioning the diagnosis.</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Thirdly, the controller violated the principle of data minimisation under [[Article 5 GDPR#1c|Article 5(1)(c) GDPR]], as the purpose to create a truthful image for readers could have been fulfilled without mentioning the diagnosis.</div></td></tr>
<!-- diff cache key gdprwiki:diff::1.12:old-40537:rev-40556 -->
</table>Mghttps://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_(Island)_-_2021051091&diff=40543&oldid=40542Persónuvernd (Island) - 20210510912024-03-26T15:48:18Z<p></p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 15:48, 26 March 2024</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l75">Line 75:</td>
<td colspan="2" class="diff-lineno">Line 75:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>}}</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>}}</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>The Icelandic DPA imposed a fine of €10,059.92 (ISK 1,500,00) on Stjörnuna ehf, the operator of Subway in Iceland for unlawfully monitoring its employees.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The Icelandic DPA imposed a fine of €10,059.92 (ISK 1,500,00) on Stjörnuna ehf, the operator of Subway in Iceland for unlawfully monitoring its employees <ins style="font-weight: bold; text-decoration: none;">without adequately informing them</ins>.</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== English Summary ==</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== English Summary ==</div></td></tr>
<!-- diff cache key gdprwiki:diff::1.12:old-40542:rev-40543 -->
</table>Echttps://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_(Island)_-_2021051091&diff=40542&oldid=0Persónuvernd (Island) - 20210510912024-03-26T15:46:11Z<p>Created page with "{{DPAdecisionBOX |Jurisdiction=Iceland |DPA-BG-Color= |DPAlogo= |DPA_Abbrevation=Persónuvernd |DPA_With_Country=Persónuvernd (Island) |Case_Number_Name=2021051091 |ECLI= |Original_Source_Name_1=Persónuvernd |Original_Source_Link_1=https://www.personuvernd.is/urlausnir/voktun-med-vinnuskilum-starfsmanns-a-veitingastadnum-subway%20 |Original_Source_Language_1=Icelandic |Original_Source_Language__Code_1=IS |Original_Source_Name_2= |Original_Source_Link_2= |Original_So..."</p>
<p><b>New page</b></p><div>{{DPAdecisionBOX<br />
<br />
|Jurisdiction=Iceland<br />
|DPA-BG-Color=<br />
|DPAlogo=<br />
|DPA_Abbrevation=Persónuvernd<br />
|DPA_With_Country=Persónuvernd (Island)<br />
<br />
|Case_Number_Name=2021051091<br />
|ECLI=<br />
<br />
|Original_Source_Name_1=Persónuvernd<br />
|Original_Source_Link_1=https://www.personuvernd.is/urlausnir/voktun-med-vinnuskilum-starfsmanns-a-veitingastadnum-subway%20<br />
|Original_Source_Language_1=Icelandic<br />
|Original_Source_Language__Code_1=IS<br />
|Original_Source_Name_2=<br />
|Original_Source_Link_2=<br />
|Original_Source_Language_2=<br />
|Original_Source_Language__Code_2=<br />
<br />
|Type=Complaint<br />
|Outcome=Upheld<br />
|Date_Started=04.05.2021<br />
|Date_Decided=12.03.2024<br />
|Date_Published=20.03.2024<br />
|Year=2024<br />
|Fine=1,500,00<br />
|Currency=ISK<br />
<br />
|GDPR_Article_1=Article 5(1)(b) GDPR<br />
|GDPR_Article_Link_1=Article 5 GDPR#1b<br />
|GDPR_Article_2=Article 5(1)(a) GDPR<br />
|GDPR_Article_Link_2=Article 5 GDPR#1a<br />
|GDPR_Article_3=Article 6(1) GDPR<br />
|GDPR_Article_Link_3=Article 6 GDPR#1<br />
|GDPR_Article_4=Article 12 GDPR<br />
|GDPR_Article_Link_4=Article 12 GDPR<br />
|GDPR_Article_5=Article 13 GDPR<br />
|GDPR_Article_Link_5=Article 13 GDPR<br />
|GDPR_Article_6=Article 30 GDPR<br />
|GDPR_Article_Link_6=Article 30 GDPR<br />
|GDPR_Article_7=Article 58(2) GDPR<br />
|GDPR_Article_Link_7=Article 58 GDPR#2<br />
|GDPR_Article_8=Article 83 GDPR<br />
|GDPR_Article_Link_8=Article 83 GDPR<br />
|GDPR_Article_9=<br />
|GDPR_Article_Link_9=<br />
|GDPR_Article_10=<br />
|GDPR_Article_Link_10=<br />
<br />
|EU_Law_Name_1=<br />
|EU_Law_Link_1=<br />
|EU_Law_Name_2=<br />
|EU_Law_Link_2=<br />
<br />
|National_Law_Name_1=<br />
|National_Law_Link_1=<br />
|National_Law_Name_2=<br />
|National_Law_Link_2=<br />
<br />
|Party_Name_1=Stjörnuna ehf, the operator of Subway in Iceland<br />
|Party_Link_1=<br />
|Party_Name_2=<br />
|Party_Link_2=<br />
|Party_Name_3=<br />
|Party_Link_3=<br />
<br />
|Appeal_To_Body=<br />
|Appeal_To_Case_Number_Name=<br />
|Appeal_To_Status=Unknown<br />
|Appeal_To_Link=<br />
<br />
|Initial_Contributor=ec<br />
|<br />
}}<br />
<br />
The Icelandic DPA imposed a fine of €10,059.92 (ISK 1,500,00) on Stjörnuna ehf, the operator of Subway in Iceland for unlawfully monitoring its employees.<br />
<br />
== English Summary ==<br />
<br />
=== Facts ===<br />
The data subject is an employee at Subway in Iceland. <br />
<br />
The controller is Stjörnuna ehf, the operator of Subway in Iceland.<br />
<br />
The data subject filed a complaint to the Icelandic DPA (Persónuvernd) on 4 May 2021.<br />
<br />
The data subject claimed that the store manager monitored him in real time at home, and thus outside the workplace, and called the workplace to give comments on the data subject’s work style based on the footage. This was done without the data subject’s knowledge. <br />
<br />
The controller argued in a letter to the DPA that it had installed the surveillance cameras for the sake of security and property protection. The purpose of the monitoring is factual, the surveillance camera system has been used in a reasonable manner and it has not been used for the control of workers or for monitoring work results. The controller claimed that the store manager went beyond the stated purpose of the monitoring and used the footage to monitor the work performance of the employees without the consent or knowledge of the company representatives. Immediate action was taken to prevent this from happening again.<br />
<br />
However, in a following letter, the controller denied that the store manager regularly monitored staff in real time through the restaurant's surveillance camera system and commented on their work style and behaviour. The controller argued that the store manager was looking at the surveillance camera system on the day in question out of fear that bread was running out. However, the store manager noticed that there was a big queue which did not change after 5 minutes, and therefore called the data subject who was in the rest area to request that the data subject serves the customers. <br />
<br />
Lastly, the controller argued that since there was no systematic collection of information, they had no obligation beyond the installation of signs about the surveillance cameras in the workplace to inform employees more about the monitoring.<br />
<br />
=== Holding ===<br />
Firstly, the DPA found the arguments of the controller conflicting as the purpose for processing was either in the interests of security and property protection or quality control. Regardless which argument should be taken into account, the DPA held that it is clear that the store manager’s use of the footage from the surveillance cameras does not fall under the stated purpose of the company’s monitoring for security and property protection. Moreover, the DPA held that monitoring for controlling the work of the employees is only possible if there are no other means available and it is necessary due to an agreement. The controller did not demonstrate this. Moreover, under Article 5(1)(b), monitoring must be carried out for specified, explicit and legitimate purpose. The DPA found that the controller did not demonstrate that quality control was the purpose of monitoring or that the objectives of quality control cannot be achieved with other and less intrusive measures. Therefore, the DPA found that there was no authorisation for processing under [[Article 6 GDPR#1|Article 6(1) GDPR]]. <br />
<br />
Secondly, the DPA explained that personal data must be processed in a fair and transparent manner in relation to the data subject under [[Article 5 GDPR#1a|Article 5(1)(a) GDPR]]. This means that data subjects should be aware when their personal data is collected, used, viewed or processed in another way. Moreover, in light of [[Article 13 GDPR|Article 13 GDPR]], information must be provided to the data subject and must be given a clear picture of the monitoring, including its purpose, how it is carried out, how access to monitoring material arranged and how long the data is stored. The DPA found that the data subject was not adequately informed about the monitoring or what his rights were concerning the monitoring. Moreover, the DPA rejected the controller’s claim that the installation of signs about the monitoring was satisfactory as these signs do not state who is responsible for the monitoring. <br />
<br />
Thirdly, the DPA found that the controller did not keep a record of the processing activities required under [[Article 30 GDPR|Article 30 GDPR]].<br />
<br />
Thus, the DPA ordered the controller under [[Article 58 GDPR#2|Article 58(2) GDPR]] to erase all screenshots of the data subject at work and to inform its data subject about the monitoring, including the purpose of the monitoring and their rights related to it, and to keep record of its processing activities. Moreover, the DPA imposed an administrative fine of €10,059.92 (ISK 1,500,00) on the controller under [[Article 83 GDPR|Article 83 GDPR]] due to the controller’s violations of [[Article 5 GDPR#1|Article 5(1) GDPR]], [[Article 6 GDPR|Article 6 GDPR]], [[Article 12 GDPR|Article 12 GDPR]] and [[Article 13 GDPR|Article 13 GDPR]].<br />
<br />
== Comment ==<br />
''Share your comments here!''<br />
<br />
== Further Resources ==<br />
''Share blogs or news articles here!''<br />
<br />
== English Machine Translation of the Decision ==<br />
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.<br />
<br />
<pre><br />
<br />
</pre></div>Echttps://gdprhub.eu/index.php?title=DSB_(Austria)_-_2023-0.420.407&diff=40537&oldid=40529DSB (Austria) - 2023-0.420.4072024-03-26T12:35:21Z<p>Hi Magdalena, thank you for the great concise summary! I just made sure all the GDPR articles were linked and made the short summary a bit more to the point/juicier for the newsletter! Just to note: to make summaries consistent throughout the GDPR hub, we use DPA instead of the national abbreviation, in this case the DSB. Also to make sure the GDPR articles are automatically linked in your summary you have to specifically write “Article ..(..)(..) GDPR” also if you are mentioning multiple.</p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 12:35, 26 March 2024</td>
</tr><tr><td colspan="4" class="diff-multi" lang="en">(2 intermediate revisions by the same user not shown)</td></tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l58">Line 58:</td>
<td colspan="2" class="diff-lineno">Line 58:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Party_Link_3=</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Party_Link_3=</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>|Appeal_To_Body=<del style="font-weight: bold; text-decoration: none;">VwGH (Austria)</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>|Appeal_To_Body=<ins style="font-weight: bold; text-decoration: none;">BVwG</ins></div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Appeal_To_Case_Number_Name=</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Appeal_To_Case_Number_Name=</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Appeal_To_Status=Pending appeal</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Appeal_To_Status=Pending appeal</div></td></tr>
<tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l67">Line 67:</td>
<td colspan="2" class="diff-lineno">Line 67:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>}}</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>}}</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>The Austrian <del style="font-weight: bold; text-decoration: none;">Data Protection Authority (DSB) held that a gynaecologist, the controller, has violated Article 9 and Article 5 (1) (a), (b), (c) GDPR by publishing health data of his patient and </del>imposed a fine of €10,000.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The Austrian <ins style="font-weight: bold; text-decoration: none;">DPA </ins>imposed a fine of €10,000 <ins style="font-weight: bold; text-decoration: none;">on a gynaecologist after he disclosed the data subject's diagnosis in a public response to an online negative review of the data subject</ins>.</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== English Summary ==</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== English Summary ==</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Facts ===</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Facts ===</div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>On 26 September 2022 the data subject posted a negative review on a website in her own name on her experiences <del style="font-weight: bold; text-decoration: none;">in the surgery of </del>a <del style="font-weight: bold; text-decoration: none;">gynaecologist</del>. One day later, the controller, the gynaecologist, responded to <del style="font-weight: bold; text-decoration: none;">it by disclosing </del>that <del style="font-weight: bold; text-decoration: none;">she </del>was diagnosed with a vaginal infection<del style="font-weight: bold; text-decoration: none;">. This post was publicly accessible at least until 3 October 2022</del>. The controller argued that he <del style="font-weight: bold; text-decoration: none;">published </del>the data<del style="font-weight: bold; text-decoration: none;">, </del>in order to create a truthful image for readers.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>On 26 September 2022 the data subject posted a negative review on a website in her own name on her experiences <ins style="font-weight: bold; text-decoration: none;">at </ins>a <ins style="font-weight: bold; text-decoration: none;">gynaecologist’s office</ins>. One day later, the controller, the gynaecologist, <ins style="font-weight: bold; text-decoration: none;">publically </ins>responded to <ins style="font-weight: bold; text-decoration: none;">the review and disclosed </ins>that <ins style="font-weight: bold; text-decoration: none;">the data subject </ins>was diagnosed with a vaginal infection. The controller argued that he <ins style="font-weight: bold; text-decoration: none;">disclosed </ins>the <ins style="font-weight: bold; text-decoration: none;">personal </ins>data in order to create a truthful image for readers<ins style="font-weight: bold; text-decoration: none;">. The response was publicly available at least until 3 October 2023</ins>.</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Holding ===</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Holding ===</div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Firstly, the DSB held that the <del style="font-weight: bold; text-decoration: none;">GDPR is undoubtedly applicable in </del>the <del style="font-weight: bold; text-decoration: none;">given case and </del>that the data <del style="font-weight: bold; text-decoration: none;">disclosed </del>(<del style="font-weight: bold; text-decoration: none;">health data</del>) is special category data according to [[Article 9 GDPR#1|Article 9(1)]]<del style="font-weight: bold; text-decoration: none;">. Therefore, the processing </del>of the <del style="font-weight: bold; text-decoration: none;">respective data would have been generally prohibited and no </del>exceptions <del style="font-weight: bold; text-decoration: none;">according to </del>Article 9 (2) <del style="font-weight: bold; text-decoration: none;">could be applied</del>. <del style="font-weight: bold; text-decoration: none;">So</del>, the controller violated the principle of legality <del style="font-weight: bold; text-decoration: none;">(Article 9 and </del>[[Article 5 GDPR#1a|Article 5(1)(a)]]<del style="font-weight: bold; text-decoration: none;">)</del>.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Firstly, the <ins style="font-weight: bold; text-decoration: none;">Austrian DPA (</ins>DSB<ins style="font-weight: bold; text-decoration: none;">) </ins>held that the <ins style="font-weight: bold; text-decoration: none;">controller processed personal data of the data subject by publishing his response online. Moreover, </ins>the <ins style="font-weight: bold; text-decoration: none;">DPA held </ins>that the <ins style="font-weight: bold; text-decoration: none;">information regarding a personal’s vaginal infection is health </ins>data <ins style="font-weight: bold; text-decoration: none;">under [[Article 4 GDPR#15|Article 4</ins>(<ins style="font-weight: bold; text-decoration: none;">15</ins>) <ins style="font-weight: bold; text-decoration: none;">GDPR]]. This </ins>is <ins style="font-weight: bold; text-decoration: none;">a </ins>special category <ins style="font-weight: bold; text-decoration: none;">of personal </ins>data according to [[Article 9 GDPR#1|Article 9(1) <ins style="font-weight: bold; text-decoration: none;">GDPR</ins>]] <ins style="font-weight: bold; text-decoration: none;">and prohibited unless one </ins>of the exceptions <ins style="font-weight: bold; text-decoration: none;">in [[Article 9 GDPR#2|</ins>Article 9(2) <ins style="font-weight: bold; text-decoration: none;">GDPR]] applies. The DPA found that this was not the case</ins>. <ins style="font-weight: bold; text-decoration: none;">Thus</ins>, the controller violated <ins style="font-weight: bold; text-decoration: none;">[[Article 9 GDPR]] and </ins>the principle of legality <ins style="font-weight: bold; text-decoration: none;">under </ins>[[Article 5 GDPR#1a|Article 5(1)(a) <ins style="font-weight: bold; text-decoration: none;">GDPR</ins>]].</div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Secondly, the <del style="font-weight: bold; text-decoration: none;">disclosure of health data was contrary to </del>the principle of purpose limitation <del style="font-weight: bold; text-decoration: none;">(</del>[[Article 5 GDPR#1b|Article 5(1)(b)]]<del style="font-weight: bold; text-decoration: none;">), as </del>there was no link between the purpose of the data collection and the further processing.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Thirdly, the controller violated the principle of data minimisation <del style="font-weight: bold; text-decoration: none;">(</del>[[Article 5 GDPR#1c|Article 5(1)(c)]]<del style="font-weight: bold; text-decoration: none;">)</del>, as the purpose to create a truthful image for readers could have been fulfilled without mentioning the diagnosis.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Secondly, the <ins style="font-weight: bold; text-decoration: none;">controller violated </ins>the principle of purpose limitation <ins style="font-weight: bold; text-decoration: none;">under </ins>[[Article 5 GDPR#1b|Article 5(1)(b) <ins style="font-weight: bold; text-decoration: none;">GDPR</ins>]]<ins style="font-weight: bold; text-decoration: none;">. The DPA found that </ins>there was no <ins style="font-weight: bold; text-decoration: none;">concrete </ins>link between the purpose of the data collection and the further processing <ins style="font-weight: bold; text-decoration: none;">of the data. Moreover, it was not foreseeable to the data subject that the controller would collect data on her medical diagnosis and publish this in a response to the data subject’s review</ins>.</div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>The <del style="font-weight: bold; text-decoration: none;">DSB </del>issued a fine of €10,000 based on the estimated income of the controller, as he did not disclose his financial circumstances. </div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>The decision <del style="font-weight: bold; text-decoration: none;">is not final as </del>the amount of the penalty has been <del style="font-weight: bold; text-decoration: none;">contested</del>.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Thirdly, the controller violated the principle of data minimisation <ins style="font-weight: bold; text-decoration: none;">under </ins>[[Article 5 GDPR#1c|Article 5(1)(c) <ins style="font-weight: bold; text-decoration: none;">GDPR</ins>]], as the purpose to create a truthful image for readers could have been fulfilled without mentioning the diagnosis.</div></td></tr>
<tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The <ins style="font-weight: bold; text-decoration: none;">DPA </ins>issued a fine of €10,000 <ins style="font-weight: bold; text-decoration: none;">under [[Article 83 GDPR#1|Article 83(1) GDPR]] </ins>based on the estimated income of the controller, as he did not disclose his financial circumstances.</div></td></tr>
<tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The decision <ins style="font-weight: bold; text-decoration: none;">regarding </ins>the amount of the penalty has been <ins style="font-weight: bold; text-decoration: none;">challenged at the Federal Administrative Court (Bundesverwaltungsgericht, BVwG)</ins>.</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Comment ==</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Comment ==</div></td></tr>
<!-- diff cache key gdprwiki:diff::1.12:old-40529:rev-40537 -->
</table>Echttps://gdprhub.eu/index.php?title=DSB_(Austria)_-_2023-0.420.407&diff=40529&oldid=0DSB (Austria) - 2023-0.420.4072024-03-25T10:28:28Z<p>Created page with "{{DPAdecisionBOX |Jurisdiction=Austria |DPA-BG-Color= |DPAlogo=LogoAT.png |DPA_Abbrevation=DSB |DPA_With_Country=DSB (Austria) |Case_Number_Name=2023-0.420.407 |ECLI=ECLI:AT:DSB:2023:2023.0.420.407 |Original_Source_Name_1=RIS |Original_Source_Link_1=https://www.ris.bka.gv.at/Dokument.wxe?ResultFunctionToken=07ee55d2-a0a6-4e00-8111-c779c3c97ceb&Position=1&SkipToDocumentPage=True&Abfrage=Dsk&Entscheidungsart=Undefined&Organ=Undefined&SucheNachRechtssatz=True&SucheNachTe..."</p>
<a href="https://gdprhub.eu/index.php?title=DSB_(Austria)_-_2023-0.420.407&diff=40529">Show changes</a>Magdalena04