BVwG - W256 2337399-1

BVwG - W256 2337399-1
Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 83(3) GDPR Article 83(5) GDPR Article 83(1) GDPR Article 83(2)(k) GDPR Article 83(4)(a) GDPR
Decided:	03.09.2026
Published:
Parties:
National Case Number/Name:	W256 2337399-1
European Case Law Identifier:	ECLI:AT:BVWG:2026:W256.2337399.1.00
Appeal from:
Appeal to:
Original Language(s):	German
Original Source:	RIS (in German)
Initial Contributor:	lh

A court reduced a fine issued by the DPA for unlawfully recording job interviews from €25,500 to €22,000. Amongst other things, the court took into account the controller’s cooperation with the DPA and the fact that the controller stopped the unlawful processing after being ordered to do so.

English Summary

Facts

A marketing company (controller) that specialises in recruiting personnel for third companies was fined by the DPA for recording telephone interviews with potential customers (data subjects) with €25,500. The records were used for internal training purposes for the controller’s staff.

In some occasions, the data subjects were not informed about the recording, in other cases only after the recording has already started.

After the DPA’s reprimand, the controller stopped the processing, cooperated with a law firm and a data protection officer to establish and adapt a privacy notice, internal contracts and other documents and guidelines in conformity with the GDPR.

The controller employs on average 18-20 people and has an annual turnover of €4,231,213.16 for the year prior the infringement.

The controller appealed the DPA’s fine, not the unlawfulness of the processing.

Holding

The court partially upheld the DPA’s decision, but reduced the amount of fine to €22,000.

As far as the calculation of the fine was concerned, the court added the individual fines for the two violations, but limited the total amount of fine to the specified fine for the graves infringement, in accordance with Article 83(3) GDPR. Since both processing operations were linked to each other, Article 83(3) GDPR applied.

Both infringements fell under Article 83(5) GDPR. Therefore, the specified amount of fine for the infringements is €20,000,000 or 4% of the total worldwide annual turnover of the preceding financial year. Since the first sum was higher, the static maximum fine in this case was €20,000,000.

The static maximum fine must be adjusted to the individual case at hand:

When assessing the amount of fine, Article 83(1) GDPR postulates that the fine must be effective, proportionate and dissuasive. One of the aims of the fine is the specific deterrence of the controller. For this purpose, the amount of fine should be in proportion to the size of the enterprise (in this case 18-20 employees, therefore a small enterprise with a structural adjacency to a micro-enterprise). Its annual turnover can be considered as well.

The court held that the infringement at hand was of medium gravity. This is because on the one hand, all data subjects that were interviewed by the controller were affected, several data of each data subject were unlawfully processed and the unlawful processing continued for a period of four months. On the other hand, according to the court, the controller violated the GDPR with negligence not intent, the data processed was not of special importance and the obtained data was merely used for internal training purposes.

The court considered, as aggravating factors (Article 83(2)(k) GDPR), that the controller violated the GDPR on two occasions: the unlawful recording of the interviews and failure to comply with the obligation to inform the data subjects pursuant to Article 13 GDPR.

From the fact that the specified amount of fine for the infringements was this high, the court concluded a special importance of the protected legal interest.

As a mitigating factor (Article 83(2)(k) GDPR), the court took into account that there were no previous GDPR violations by the controller. Moreover, the controller cooperated with the DPA by providing further audio material of interviews. This could be considered a mitigating factor, because with it, the controller exceeded its obligations under Article 31 GDPR and by doing so, did more than what was asked from him under the GDPR anyways. Also, the controller stopped the unlawful processing after the DPA ordered it to do so.

The lack of damages suffered by the data subject was not a mitigating factor, contrary to the controllers claim, because the court held that the data subject suffered immaterial damages by loss of control over their data. Neither did the other privacy safety measures that the controller conducted be considered a mitigating factor (technical and organisational measures pursuant to Article 83(4)(a) GDPR) because they did not exceed what was asked from it under the GDPR).

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Date of Decision

September 3, 2026

Legal Provision

B-VG Art. 133, para. 4
GDPR Art. 12, para. 1
GDPR Art. 13
GDPR Art. 4(7)
GDPR Art. 5(1)(lita)
GDPR Art. 5(1)(litc)
GDPR Art. 5(1)(lite)
GDPR Art. 6
GDPR Art. 83
VStG §64
VwGVG §52(8)

B-VG Art. 133 as currently in force; B-VG Art. 133 effective from Jan. 1, 2019, through May 24, 2018; last amended by BGBl. I No. 138/2017 B-VG Art. 133 effective as of January 1, 2019, last amended by BGBl. I No. 22/2018 B-VG Art. 133 effective from May 25,May 2018 through December 31, 2018; last amended by Federal Law Gazette I No. 22/2018; B-VG Art. 133; effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164/2013, B-VG Art. 133, effective from Jan. 1, 2014, through July 31, 2014, last amended by Federal Law Gazette I No. 51/2012 Federal Constitutional Law (B-VG) Art. 133, effective from Jan. 1, 2004, through Dec. 31, 2013, last amended by Federal Law Gazette (BGBl.) I No. 100/2003 B-VG Art. 133 effective from January 1, 1975, through December 31, 2003, last amended by BGBl. No. 444/1974 B-VG Art. 133 valid from Dec. 25, 1946, through Dec. 31, 1974, last amended by Federal Law Gazette No. 211/1946 B-VG Art. 133 valid from Dec. 19,December 1945 through December 24, 1946; last amended by State Law Gazette No. 4/1945; B-VG Art. 133; in effect from January 3, 1930, through June 30, 1934

VStG § 64 (currently VStG § 64), effective as of Jan. 1, 2019, last amended by Federal Law Gazette I No. 57/2018; VStG § 64, effective from Aug. 15,2018 through December 31, 2018; last amended by Federal Law Gazette I No. 57/2018 VStG § 64 in effect from January 1, 2014, through August 14, 2018; last amended by Federal Law Gazette I No. 33/2013 VStG § 64, effective from July 1, 2013, through December 31, 2013, last amended by Federal Law Gazette I No. 33/2013 VStG § 64 valid from March 1, 2013, through June 30, 2013, last amended by Federal Law Gazette (BGBl.) I No. 33/2013 VStG § 64 valid from JanuaryJanuary 2002 through February 28, 2013; last amended by Federal Law Gazette I No. 137/2001; VStG § 64 valid from February 1, 1991, through December 31, 2001

VwGVG § 52 (currently VwGVG § 52), effective as of September 1, 2018, last amended by Federal Law Gazette I No. 57/2018; VwGVG § 52 in effect from January 1, 2014, through August 31, 2018

Judgment

,

W256 2337399-1/19E

IN THE NAME OF THE REPUBLIC!

The Federal Administrative Court, composed of Judge Mag. Caroline KIMM as presiding judge, along with expert lay judge Dr. Claudia Rosenmayr-Klemenz and expert lay judge Mag. Matthias Schachner as associate judges, ruled on the complaint filed by XXXX, represented by Dr. Thomas Schweiger, LL.M., attorney at law in 4020 Linz, against the penalty notice issued by the Data Protection Authority on January 19, 2026, Ref. No. D550.1231 (2025-1.049.138), and has lawfully ruled as follows:The Federal Administrative Court, presided over by Judge Mag. Caroline KIMM, with expert lay judge Dr. Claudia Rosenmayr-Klemenz and expert lay judge Mag. Matthias Schachner serving as associate judges, ruled on the complaint filed by Roman 40, with Dr. Thomas Schweiger acting as representative, LL.M., attorney at law in 4020 Linz, against the penalty order issued by the Data Protection Authority on January 19, 2026, Ref. No. D550.1231 (2025-1.049.138), has rightly ruled as follows:

A) 1. The complaint is granted, and the imposed fine is reduced to 22,000 euros; accordingly, the fee for proceedings before the administrative authority is reduced to 2,200 euros pursuant to para 52(8) VwGVG in conjunction with para 64( 2 of the VStG to 2,200 euros. A) 1. The complaint is granted, and the fine imposed is reduced to 22,000 euros; accordingly, the fee for the proceedings before the responding authority pursuant to paragraph 52, VwGVG in conjunction with Section 64(2) VStG, to 2,200 euros.

2. Pursuant to § 52(8) VwGVG, the complainant shall not be required to bear any costs of the administrative court proceedings.2. Pursuant to § 52(8) VwGVG, the complainant shall not be required to bear any costs of the administrative court proceedings.

B) The appeal is not admissible pursuant to Article 133, paragraph 4, B-VG.B) The appeal is not admissible pursuant to Article 133, paragraph 4, B-VG.

Text

Reasons for the Decision

I. Course of Proceedings: Roman numeral I. Course of Proceedings:

In the contested penalty order, the complainant was charged with the following:

“I. Since August 1, 2025, and in any case until November 27, 2025 (hereinafter the ‘period of the offense’), the defendant is engaged in processing at her place of business located at [..] (hereinafter “scene of the offense”) by unlawfully recording in their entirety the telephone job interviews conducted with the data subjects for pre-qualification purposes (1) and retained/archived these recordings indefinitely (2). The content of the interviews included, in each case, the first and last names, specific educational background, and professional history. The data subjects were not informed prior to the start of the recording and storage in accordance with Art. 12 in conjunction with Art. 13 of the GDPR (see Point II of the ruling) nor did they consent to this prior to the start in accordance with Art. 6(1)(a) of the GDPR. In this context, the processing (both the recording (1) and the storage/retention (2)) could not be based on any legal basis under Article 6(1) in conjunction with Article 5(1)(a) of the GDPR and was also carried out in violation of the principles of data minimisation (Art. 5(1)(c) of the GDPR) and storage limitation (Art. 5(1)(e) of the GDPR).“I. Since August 1, 2025, and in any case until November 27, 2025 (hereinafter “the period in question”), the defendant is engaged in processing at its headquarters located at [..] (hereinafter “scene of the offense”) by unlawfully recording in their entirety the telephone job interviews conducted with the data subjects for pre-qualification purposes (1) and stored/archived these recordings indefinitely (2). The content of the conversations included, in each case, the first and last names, specific educational background, and professional history. The data subjects were not informed prior to the start of the recording and storage in accordance with Article 12, in conjunction with Article 13, of the GDPR (see Roman numeral two) nor did they consent to this prior to the start in accordance with Article 6, paragraph 1, subparagraph (a), of the GDPR. In this context, the processing (both the recording (1) and the storage (2)) could not be based on any legal basis under Article 6(1), in conjunction with Article 5(1)(a), GDPR, and was also carried out in violation of the principles of data minimisation (article 5(1)(c) of the GDPR) and storage limitation (article 5(1)(e) of the GDPR).

II. Furthermore, in her role as the controller pursuant to Article 4(7) of the GDPR, the defendant, in connection with the processing of (Allegation I) of personal data during the period described above, by failing to provide information to the data subjects or by providing insufficient information to them. Roman numeral two. Furthermore, in her role as the controller pursuant to Article 4(7) of the GDPR, in connection with the processing of personal data described above (Allegation Roman numeral one) during the period described above, the defendant violated her obligation to provide information pursuant to Article 13, GDPR by failing to provide information to the data subjects or by providing insufficient information to them.

Administrative offenses pursuant to:

Re I.: Art. 5(a), (c), and (e) as well as Art. 6(1)(1) in conjunction with Art. 83(1) and (5)(a) of the GDPR (OJ L 2016/119), p. 1, as amended. Re. Roman numeral I: Article 5, subparagraphs (a), (c), and (e), as well as Article 6, paragraph 1, subparagraph 1, in conjunction with Article 83, paragraph 1 and 5(a) of the GDPR, Official Journal L 2016/119, p. 1, as amended

Re. II.: Art. 5(1)(a) in conjunction with Art. 12 and 13 in conjunction with Art. 83(1) and (5)(a) and (b) of the GDPR, OJ L 2016/119, p. 1, as amended”Re. Roman numeral two: Article 5, paragraph 1, subparagraph (a), in conjunction with Articles 12 and 13, in conjunction with Article 83, paragraphs 1 and 5, subparagraphs (a) and (b) of the GDPR, Official Journal L 2016/119, p. 1, as amended”

Due to these administrative offenses, a fine of 25,500 euros was imposed on the complainant pursuant to Article 83(3) and (5)(a) of the GDPR, and she was ordered to pay a contribution toward procedural costs in the amount of 2,550 euros. In doing so, the authority in question assumed, for the 2024 fiscal year, a net income of EUR 1,459,067.97 and liabilities amounting to EUR 109,810.32.Due to these administrative offenses, a fine of 25,500 euros was imposed on the complainant pursuant to article 83, paragraphs 3 and 5(a) of the GDPR, and she was ordered to pay a contribution toward the costs of the proceedings in the amount of 2,550 euros. In doing so, the authority in question assumed, for the 2024 fiscal year, a net income of EUR 1,459,067.97 and liabilities totaling EUR 109,810.32.

The facts of the case were essentially determined as follows: the complainant operates an advertising agency in the field of “digital marketing.” Her employees were tasked with “pre-qualifying” potential candidates for clients through phone calls and interviews. During these calls, the advertised position was explained, and the applicants were assessed in more detail or questioned about their previous professional experience. During the relevant period, some of these conversations were recorded from start to finish—in some cases with a notice that they were being recorded, in others without—and stored for an indefinite period. In this regard, the employees were actively encouraged by a supervisor to record and store job interviews for training purposes, even without obtaining the consent of the individuals concerned.

From a legal perspective, the respondent authority stated that, as established, employees of the complainant had recorded and stored the content of job interviews at the scene of the incident during the relevant period and had thus processed the personal data of the data subjects in accordance with Art. 4(1) of the GDPR. Consent as a legal basis is ruled out, among other reasons,  This is true simply because the data subjects had no information about the actual controller. The legal basis for processing based on legitimate interests is therefore ruled out because the data subjects were either not informed at all about the legitimate interests, or were only informed after the collection of their data had begun. Furthermore, the processing in the form carried out was not necessary to achieve the stated purpose, namely the alleged improvement of employee performance. There were less intrusive alternatives available for the intended purposes, such as mock interviews with colleagues. The obligation to provide information was also violated because the complainant, in some cases, did not inform the data subjects at all about the data processing. In other cases, the information was provided only after processing had begun and, moreover, not on behalf of the controller—namely, the accused herself—but on behalf of “Company XY.” The complainant is at least guilty of slight negligence in that she provided her employees with the opportunity to record and perform storage of data, and this was in fact possible even without obtaining explicit consent. Furthermore, a superior employee publicly promoted this practice. There is fault in the form of negligence, especially since such working practices had not been ruled out in advance in any case.From a legal perspective, the respondent authority stated that, as established, the complainant’s employees recorded and stored the content of job interviews at the scene of the incident during the relevant time period and thus processed the personal data of the data subjects in accordance with article 4(1) of the GDPR. Consent as a legal basis is ruled out, among other reasons, because the data subjects had no information about the actual controller. The legal basis of processing based on legitimate interests is therefore ruled out because the data subjects were either not informed at all about the legitimate interests or were only informed after the collection of their data had begun. Furthermore, the processing in the form carried out was not necessary to achieve the stated purpose, namely the alleged improvement of employee performance. Less intrusive alternatives existed for the intended purposes, such as mock interviews with colleagues. The obligation to provide information was also violated because, in some cases, the complainant did not inform the data subjects at all about the data processing. In other cases, the information was provided only after processing had begun and, moreover, not on behalf of the controller—namely, the accused herself—but on behalf of “Company XY.” The complainant is at least guilty of slight negligence in that she provided her employees with the means to record and perform storage of data, and this was in fact possible even without obtaining explicit consent. Furthermore, a superior employee publicly promoted this practice. There is fault in the form of negligence, especially since such working practices had not been ruled out in advance in any case.

With regard to the determination of the fine, the complainant is classified under the Fines Directives in the category “Enterprises with revenue of EUR 2 million to EUR 10 million,” taking into account the annual financial statements as of December 31, 2024. Taking into account the moderate severity of the offense, the complainant’s financial capacity, mitigating factors (no relevant prior violations, contribution to the discovery of the truth), and general preventive considerations, the imposition of the specific fine is justified.

The complainant filed a complaint with the Federal Administrative Court against this penalty decision on both points of the ruling “on the grounds of excessive penalty assessment and penalty amount.” The complainant’s profit had been incorrectly determined by the authority in question. The responding authority had determined the complainant’s profit to be EUR 1,459,000.00 and had failed to take into account that this figure included a profit carryforward of EUR 501,000.00. The (relevant) profit is thus reduced by more than one-third, specifically to well below EUR 1,000,000.00, namely EUR 958,000.00. According to the European Commission’s Guidelines on the Calculation of Administrative Fines (Fines Guidelines), the complainant should therefore be classified as an enterprise in the lowest category (profit of EUR 958,000.00). The accuracy of the calculation performed by the responding authority was therefore not ensured. Furthermore, the responding authority wrongly classified the violation as “moderate,” and the fine imposed is disproportionate to the data protection violations committed. The complainant attaches great importance to data protection and compliance with data protection requirements. For this purpose, an external data protection officer had even been appointed, and—in collaboration with this officer and law firms—internal employment contracts, work-from-home agreements, a large number of privacy policies, and contractual documents had been adapted to comply with the GDPR, and other legally required documents had been drafted. The complainant’s conduct was unintentional, and the complainant ceased it immediately upon realizing that her actions were not in compliance with data protection regulations. Against this background, the alleged severity of the violation is untenable. Rather, this constitutes a minor infraction that is based neither on gross negligence nor on systemic deficiencies and should therefore be weighted more leniently in the assessment under data protection law. The authority in question had merely taken into account the mitigating factors that no prior violations had been committed and that the complainant had cooperated during the proceedings. Additional mitigating factors that should have been taken into account include the fact that the processing in question was discontinued immediately, that no data requiring special protection was affected, and other mitigating circumstances. In light of other criminal convictions, it does not appear appropriate or proportionate in this specific case to impose a fine of 1%. In the complainant’s view, it would also be appropriate in this case (particularly in light of the mitigating factors) to impose a fine in the lower range of 0.13%, as was done in a similar case decided by the Courts. Furthermore, the complaint contains arguments regarding the lawfulness of the data processing in question and the lack of culpability. The complainant therefore requests that 1. the contested penalty decision be set aside without replacement and the proceedings be discontinued, 2. in the alternative, a mere warning be issued, 3. in the alternative, the amount of the penalty be reduced to a level commensurate with the offense and the degree of culpability.

In a letter dated March 2, 2026, the respondent authority submitted the complaint, together with the administrative act, to the Federal Administrative Court and issued a statement in response. In essence, the statement explained that the term “turnover” in Article 83 of the GDPR does not correspond to net income; the latter can only be taken into account as an additional factor when determining the penalty. The issuance of a warning is at the discretion of the respondent authority and was not considered in this case. In a letter dated March 2, 2026, the respondent authority submitted the complaint together with the administrative file to the Federal Administrative Court and issued a statement on the matter. In it, it was essentially stated that the term “turnover” in article 83 of the GDPR does not correspond to net income, and that net income can only be taken into account as an additional factor in determining the penalty. The issuance of a warning is at the discretion of the respondent authority and was not considered in this case.

In her statement of April 7, 2026, the complainant explained that she was referring exclusively to the determination of the penalty under Article 83 of the GDPR and the question of the appropriateness and proportionality of the administrative fine. The annual turnover for 2024 amounted to EUR 4,231,213.16. The respondent authority had already classified the relevant annual revenue into this category, but without sufficiently taking into account the “structural proximity to a micro-enterprise” and the associated limited economic viability. The complainant is an owner-managed, labor-intensive service company with low margins, no affiliation with a corporate group, no market power, and employs only 18 to 20 employees. Furthermore, the severity of the violation should be classified as “low” or in the “lower range of medium,” especially since the recordings were not disclosed to third parties, no misuse of the data can be proven, and the severity of the infringement is to be regarded as relatively low compared to other data protection violations. The conversations were used exclusively for internal purposes, and no profit was made through this practice. The number of data subjects is limited and manageable; no data within the meaning of Articles 9 or 10 of the GDPR is affected; and there has been no concrete material damage to the data subjects, no lasting infringement of their privacy, or economic disadvantage. It should also be taken into account that the complainant was unaware of the unlawfulness in question due to the complex legal situation, but that she otherwise acts professionally in other areas of data protection by appointing an external data protection officer, obtaining regular data protection advice from specialized attorneys, and by drafting internal directives and conducting training sessions and implementing processes to ensure compliance with the GDPR.  Furthermore, she cooperated with the administrative proceedings from the outset and immediately ceased the practice in question. In addition, annual financial statements for the year 2024 were submitted. In her statement dated April 7, 2026, the complainant explained that she was referring exclusively to the determination of the penalty under article 83 of the GDPR and the question of the appropriateness and proportionality of the administrative fine. The annual turnover for 2024 amounted to EUR 4,231,213.16. The authority in question had already classified the relevant revenue into this category, but without sufficiently taking into account the “structural proximity to a micro-enterprise” and the associated limited economic viability. The complainant is an owner-managed, labor-intensive service company with low margins, no affiliation with a corporate group, no market power, and only 18 to 20 employees. Furthermore, the severity of the violation should be classified as “low” or in the “lower range of medium,” especially since the recordings were not disclosed to third parties, no misuse of the data can be proven, and the severity of the infringement is to be regarded as relatively low compared to other data protection violations. The conversations were used exclusively for internal purposes, and no profit was made through this conduct. The number of data subjects is limited and manageable; no data within the meaning of articles 9 or 10 of the GDPR is affected; and there has been no concrete material damage to the data subjects, no lasting violations of their privacy, or economic disadvantages. It should also be taken into account that the complainant was unaware of the unlawfulness in question due to the complex legal situation, but that it otherwise acts professionally in other areas of data protection by appointing an external data protection officer, seeking regular legal advice on data protection from specialized attorneys, and by drafting internal directives, conducting training sessions, and implementing processes to ensure compliance with the GDPR. Furthermore, she cooperated with the administrative proceedings from the outset and immediately ceased the practice in question. In addition, annual financial statements for the year 2024 were submitted.

In this regard, the respondent was granted the right to be heard.

At the Court’s request, the complainant submitted a profit and loss statement for the year 2024 in a letter dated May 8, 2026. Although this statement—according to her submission—shows a positive net income for the year, this figure—when measured against revenue, total assets, and number of employees—falls within the range typical of a small agency or service company, not that of a large enterprise or corporate group. In addition, various documents were submitted, such as data processing agreements with customers, a current TOM document—which, among other things, addresses access control, data carrier and storage control, user and access control, password policies, and encryption—as well as several internal Directives on core areas of the GDPR (data erasure, data subject rights, handling of data protection and security incidents, and information security)—were submitted to substantiate the otherwise high level of data protection that has been described for years. Furthermore, the submitted model employment contract and model work-from-home agreement—which include detailed clauses on IT use, confidentiality, data protection, and the use of photos and videos—as well as work-from-home agreements with strict requirements regarding the use of company-provided hardware exclusively, demonstrate that data protection is firmly embedded within the enterprise. These documents would prove that the complainant is not merely “establishing” data security and data protection in connection with the present proceedings, but has been operating a systematic GDPR management system for years, and that the incident constituted a one-time violation resulting from erroneous assumptions, but that the complainant otherwise complies with the requirements of the GDPR.

In this regard, the authority against which the complaint was filed was granted the right to be heard.

In its statement of July 6, 2026, the complainant, represented by counsel, expressly stated that its complaint was directed solely against the penalty or the amount of the penalty. Therefore, the complainant expressly did not wish for the Court to re-examine the evidence, and such a review was consequently waived.

Upon a renewed request by the Court, the complainant explicitly clarified in a letter dated August 20, 2026, that the findings regarding the violation were no longer being contested and that the complaint concerned exclusively the determination of the penalty or the amount of the fine. The appellant no longer seeks a finding that no violation occurred, but rather that the specific fine imposed be significantly reduced. Motions for the complete annulment of the penalty order, as well as objections regarding the unlawfulness and attributable nature of the violation, were no longer being maintained. Furthermore, the appellant reiterated her arguments regarding the determination of the penalty. She added that the determination of the penalty is a case-by-case decision, as demonstrated by the recent decision of the Berlin I Regional Court dated June 9, 2026, 526 OWi LG 1/20 in the Deutsches Wohnen case, in which the fine had been significantly reduced. Unfortunately, the grounds for the judgment in the aforementioned Berlin Regional Court proceeding, 526 OWi LG 1/20 of June 9, 2026, are not yet available. It is therefore requested that a period of 6 weeks be granted, during which the grounds for the judgment in this case can be submitted to the Federal Administrative Court, thereby allowing the relevant arguments for the substantial reduction to be clarified within the context of the GDPR.Following a renewed request from the Court, the appellant expressly clarified in a letter dated August 20, 2026, that the findings regarding the violation were no longer being contested and that the complaint concerned exclusively the determination of the penalty or the amount of the fine. The complainant no longer sought a finding that no violation had occurred, but rather that the specific fine imposed be significantly reduced. Motions for the complete annulment of the penalty notice, as well as objections regarding the unlawfulness and attributable nature of the violation, were no longer being maintained. Furthermore, the appellant reiterated her arguments regarding the determination of the penalty. She added that the determination of the penalty is a decision made on a case-by-case basis, as demonstrated by the recent decision of the Berlin Regional Court, Roman No. 1, dated June 9, 2026, 526 OWi LG 1/20 in the Deutsches Wohnen case, in which the fine had been significantly reduced. Unfortunately, the grounds for the judgment in the aforementioned Berlin Regional Court proceeding, 526 OWi LG 1/20 dated June 9, 2026, are not yet available. It is therefore requested that a period of 6 weeks be granted, during which the grounds for the judgment in this proceeding can be submitted to the Federal Administrative Court, thereby allowing the relevant arguments for the significant reduction to be clarified within the context of the GDPR.

In this regard, the complainant was informed by letter dated August 21, 2026, that the determination of the penalty —as she herself stated—is a case-by-case decision, which is why a six-week period for the purpose of submitting the decision of the Berlin Regional Court I dated June 9, 2026, 526 OWi LG 1/20, in the Deutsches Wohnen case, would not be granted. In this regard, the complainant was informed by letter dated August 21, 2026, that the determination of the penalty—as she herself had stated—was a decision made on a case-by-case basis, and therefore a six-week period for the purpose of submitting the decision of the Berlin Regional Court I dated June 9, 2026, 526 OWi LG 1/20, in the matter of Deutsches Wohnen, would not be granted.

II. The Federal Administrative Court has considered: II. The Federal Administrative Court has considered:

1. Findings:

The complainant, a limited liability company, operates an advertising agency focused on social recruiting (staff recruitment). In this context, the complainant assists enterprises in their search for employees, among other things, by conducting pre-qualification assessments—including targeted telephone interviews—to ensure that only truly suitable candidates are referred to the hiring enterprise.

As part of their duties, the complainant’s employees conduct these telephone pre-qualification interviews with applicants on behalf of the complainant’s clients. These interviews last about five minutes and include a brief introduction to the client’s enterprise, a description of the advertised position (including potential demands such as shift work or weekend work), questions about professional experience, and, if applicable, scheduling an in-person interview.

Between August 1, 2025, and November 27, 2025, the complainant granted its employees the option to record job interviews for internal training purposes. Furthermore, during this period, employees were actively encouraged by a supervisor via an intranet announcement to record and save job interviews for training purposes, even without obtaining the consent of the individuals concerned.

The employees made use of this option during this period by recording these telephone interviews with applicants—and thus the personal data of the individuals concerned (first and last names, specific education, and professional history)—either with or without a corresponding notice of the recording—from start to finish and stored them for an indefinite period. 

In some cases, the individuals concerned were not informed at all about the data processing. In other cases, the information was provided only after processing had begun—and not on behalf of the controller, namely the defendant herself, but on behalf of “Company XY” (the client).

The complainant immediately ceased this practice following an official objection.

In 2024, the complainant generated annual revenue of EUR 4,231,213.16. According to the income statement for 2024, retained earnings amount to EUR 1,459,067.97, which includes retained earnings carried forward of EUR 501,713.95. The complainant employs an average of 18 to 20 people.

Prior to the incident, the complainant had addressed the issue of data protection by appointing an external data protection officer and, in collaboration with law firms and the data protection officer, adapting internal employment contracts, work-from-home agreements, privacy policies, and contractual documents to be GDPR-compliant, and drafted other legally required documents, such as Directives for handling data security incidents, technical access controls, and agreements with processors.

2. Assessment of the Evidence:

The findings are based on the undisputed findings in the contested decision, in conjunction with the complainant’s supplementary submissions and the documents submitted in the proceedings before the Federal Administrative Court.

3. Legal Assessment:

The relevant provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119 of May 4, 2016, hereinafter referred to as the GDPR, read as follows: The relevant provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Official Journal L 119 of May 4, 2016, hereinafter referred to as the “GDPR,” read as follows:

“Article 4

Definitions

For the purposes of this Regulation, the following terms shall have the following meanings:

[…]

7. “controller” means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, makes the decision on the purposes and means of the processing of personal data; if the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for by Union law or the law of the Member States;

[…]

Article 5

Principles Governing the Processing of Personal Data

(1) Personal data must be

a) processed lawfully, fairly, and in a manner that ensures transparency with regard to the data subject (“lawfulness, fairness, and transparency”);

[…]

c) be appropriate and relevant to the purpose and limited to what is necessary for the purposes of the processing (“data minimisation”);

[…]

e) be stored in a form that permits identification of data subjects only for as long as is necessary for the purposes for which they are processed; personal data may be stored for a longer period provided that, subject to the implementation of appropriate technical and organizational measures required by this Regulation to protect the rights and freedoms of the data subject, processed exclusively for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1) (“storage limitation”);

[…]

Article 6

Lawfulness of Processing

(1) Processing is lawful only if at least one of the following conditions is met:

a) The data subject has given consent to the processing of personal data concerning him or her for one or more specified purposes;

b) processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of precontractual measures taken at the data subject’s request;

c) processing is necessary for compliance with a legal obligation to which the controller is subject;

d) The processing is necessary to protect the vital interests of the data subject or of another natural person;

e) The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

f) the processing is necessary to protect the legitimate interests of the controller or of a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail, in particular where the data subject is a child.

[…]

Article 12

Transparent Information, Communication, and Procedures for Exercising the Data Subject’s Rights

(1) The controller shall take appropriate measures to provide the data subject with all information pursuant to Articles 13 and 14 and all communications pursuant to Articles 15 through 22 and Article 34 relating to the processing in a precise, transparent, understandable, and easily accessible form, using clear and plain language; this applies in particular to information specifically addressed to children. The information shall be provided in writing or in another form, including electronically where appropriate. If requested by the data subject, the information may be provided orally, provided that the data subject’s identity has been verified by other means.

[…]

Article 13

Obligation to Provide Information When Collecting Personal Data from the Data Subject

(1) Where personal data are collected from the data subject, the controller shall provide the data subject with the following information at the time of collection:

a) the name and contact details of the controller and, where applicable, of its representative;

b) where applicable, the contact details of the data protection officer;

c) the purposes for which the personal data are to be processed, as well as the legal basis for the processing;

d) where the processing is based on Article 6(1)(f), the legitimate interests pursued by the controller or by a third party;

e) where applicable, the recipients or categories of recipients of the personal data; and

f) where applicable, the controller’s intention to transfer the personal data to a third country or an international organisation, as well as the existence or absence of an adequacy decision by the Commission or, in the case of transfers pursuant to article 46, article 47, or the second subparagraph of paragraph 49(1), a reference to the appropriate or adequate safeguards and the possibility of how to obtain a copy of them or where they are available.

(2) In addition to the information provided for in paragraph 1, the controller shall provide the data subject, at the time the personal data are collected, with the following further information necessary to ensure fair and transparent processing:

(a) the period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period;

b) the existence of a right to obtain from the controller information regarding the personal data in question, as well as the right to rectification, erasure, restriction of processing, or right to object to processing, and the right to data portability;

c) where the processing is based on Article 6(1)(a) or Article 9(2)(a), the existence of a right to withdraw consent at any time, without affecting the lawfulness of the processing carried out on the basis of consent prior to withdrawal;

d) the existence of a right to lodge a complaint with a supervisory authority;

e) whether the provision of personal data is required by law or contract or is necessary for the conclusion of a contract, whether the data subject is obligated to provide the personal data, and what the possible consequences of failure to provide such data would be; and

f) the existence of automated decision-making, including profiling, pursuant to article 22 paragraphs 1 and 4, and—at least in such cases—meaningful information regarding the logic involved, as well as the scope and intended consequences of such processing for the data subject.

(3) If the controller intends to further process the personal data for a purpose other than that for which the personal data was collected, the controller shall provide the data subject with information regarding that other purpose and all other relevant information referred to in paragraph 2 prior to such further processing.

(4) Paragraphs 1, 2, and 3 shall not apply if and to the extent that the data subject already has the information.

[…]

Article 83

General Conditions for the Imposition of Administrative Fines

(1) Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this article for infringements of this Regulation, in accordance with paragraphs 4, 5, and 6, is effective, proportionate, and dissuasive in each individual case. 

(2) Administrative fines shall be imposed, depending on the circumstances of the individual case, in addition to or in lieu of the measures set forth in Article 58(2)(a) through (h) and (j). When making the decision to impose an administrative fine and determining its amount, due consideration shall be given in each individual case to the following:

(a) the nature, gravity, and duration of the infringement, taking into account the nature, scope, or purpose of the processing in question, as well as the number of data subjects affected by the processing and the extent of the harm suffered by them;

(b) whether the infringement was intentional or negligent;

(c) any measures taken by the controller or the processor to mitigate the damage suffered by the data subjects;

(d) the degree of responsibility of the controller or the processor, taking into account the technical and organizational measures implemented by them in accordance with Articles 25 and 32;

e) any relevant prior breaches by the controller or the processor;

f) the extent of cooperation with the supervisory authority to address the breach and mitigate its potential adverse effects;

g) the categories of personal data affected by the breach;

h) how the breach came to the attention of the supervisory authority, in particular whether and, if so, to what extent the controller or processor reported the breach;

i) compliance with measures previously ordered against the controller or processor in question under Article 58(2) regarding the same subject matter, if such measures were ordered;

j) compliance with approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and

k) any other aggravating or mitigating circumstances in the specific case, such as financial benefits obtained or losses avoided, directly or indirectly, as a result of the breach.

(3) Where a controller or processor intentionally or negligently infringes several provisions of this Regulation in relation to the same or linked processing operations, the total amount of the administrative fine shall not exceed the amount applicable to the most serious infringement.

[…]

(5) For violations of the following provisions, administrative fines of up to 20,000,000 EUR or, in the case of an enterprise, up to 4% of its total worldwide annual turnover in the preceding fiscal year shall be imposed in accordance with paragraph 2, whichever amount is higher:

a) the principles governing processing, including the conditions for consent, pursuant to Articles 5, 6, 7, and 9;

b) the rights of the data subject pursuant to Articles 12 through 22;”

Subject Matter of the Present Proceedings

The present complaint is directed exclusively against the amount of the fine imposed by the contested penalty order. Although the complaint’s statement of reasons also contains arguments regarding the lawfulness of the violations and the culpability thereof, and furthermore includes, among other things, a request to set aside the contested penalty order without replacement and to dismiss the proceedings, However, in her statements of July 6, 2026, and August 20, 2026, the appellant, represented by counsel, expressly clarified—upon the Court’s prompting— that her complaint is directed exclusively against the amount of the fine imposed by the contested penalty order and that she no longer maintains the contradictory arguments and motions contained in her complaint.

Pursuant to § 27 of the Administrative Court Procedure Act (BGBl. I 2013/33, as amended by BGBl. I 2018/57) (hereinafter: “VwGVG”), the Administrative Court must review the contested decision on the basis of the complaint or on the basis of the statement regarding the scope of the challenge, unless the decision is unlawful due to the authority’s lack of jurisdiction. Pursuant to Section 27 of the Administrative Court Procedure Act (BGBl. I 2013/33), as amended by BGBl. I 2018/57 (hereinafter: “VwGVG”), the Administrative Court must review the contested decision on the basis of the complaint or the statement specifying the scope of the challenge, unless the decision is unlawful due to the authority’s lack of jurisdiction.

In view of the present factual and legal situation, the subject matter of the present proceedings can and may therefore be solely the imposition of the penalty, but not a review extending beyond that of the conviction and thus of the penalty itself. With regard to the question of criminal liability, partial res judicata has taken effect (see, in this regard, VwGH, Oct. 27, 2014, Ra 2014/02/0053; VwGH, July 24, 2019, Ra 2018/02/0034, and many others).

On the Determination of the Penalty

1. It should be noted that the contested penalty notice charged the complainant with two separate violations of the GDPR; specifically, she was accused of unlawfully processing personal data of potential applicants of her clients (hereinafter: data subjects) in connection with the recording and storage of telephone job interviews from August 1, August 2025 through November 27, 2025, 1. unlawfully processed personal data of potential applicants of its clients (hereinafter: data subjects), thereby violating the principles governing processing under Art. 5(a), (c), and (e) as well as Art. 6(1) of the GDPR (Point I of the ruling); and 2. that it also failed to adequately inform these data subjects, thereby violating its duty to provide information under Article 13 of the GDPR (Point II of the ruling). 1. It should be noted that the contested penalty notice charged the complainant with two separate violations of the GDPR; specifically, she was accused of unlawfully processing personal data of potential applicants of its clients in connection with the recording and storage of telephone job interviews from August 1, August 2025 through November 27, 2025, 1. unlawfully processed personal data of potential applicants of its clients (hereinafter: data subjects) and thereby violated the principles governing processing under Article 5, subparagraphs (a), (c), and (e), as well as Article 6, paragraph 1, of the GDPR (Point 1.) and 2. also failed to adequately inform these data subjects, thereby violating its duty to provide information pursuant to article 13 of the GDPR (point Roman numeral two).

Due to these two (undisputed) violations, the responding authority imposed a total fine of 25,500 euros on the complainant, pursuant to para 83(3) of the GDPR.Due to these two (undisputed) violations, the respondent authority imposed a total fine of 25,500 euros on the complainant, citing article 83(3) of the GDPR.

Since the two violations at issue are based on “interrelated” processing operations and there is otherwise no indication that these violations are mutually exclusive, the respondent authority correctly assumed the applicability of Art. 83(3) of the GDPR, and this is, moreover, not at all disputed by the complainant in her complaint (see, in this regard, the detailed explanations by Nemitz in Ehmann/Selmayr [eds.], General Data Protection Regulation 3, Art. 83, para. 46, in particular paras. 49 and 50, as well as Bergt in Kühling/Buchner [eds.], GDPR – BDSG4, Art. 83, para. 60). Since the two violations at issue are based on “interrelated” processing operations and there is otherwise no indication that these violations are mutually exclusive, the authority in question correctly assumed the applicability of paragraph 83(3) GDPR, and, moreover, this is not even questioned by the complainant in her complaint; see, in this regard, the more detailed explanations by Nemitz in Ehmann/Selmayr [eds.], General Data Protection Regulation3, article 83, para. 46, in particular paras. 49 and 50, as well as Bergt in Kühling/Buchner [eds.], GDPR – BDSG4, article 83, para. 60).

Art 83(3) of the GDPR stipulates that in cases of identical or related processing operations that intentionally or negligently violate multiple provisions of the GDPR, the total amount of the administrative fine shall not exceed the amount for the most serious infringement. Article 83(3) GDPR provides that in cases of identical or related processing operations that intentionally or negligently violate multiple provisions of the GDPR, the total amount of the administrative fine shall not exceed the amount applicable to the most serious violation.

The term “total amount” means that all violations committed must be taken into account when determining the amount of the administrative fine, and the phrase “amount set for the most serious violation” refers to the statutory maximum amounts for administrative fines (Art. 83, paras. 4–6). Therefore: Even though the administrative fine itself may not exceed the statutory maximum amount for the highest fine tier, the offender must nevertheless be expressly found guilty of violating multiple provisions, and these violations must be taken into account when calculating the amount of the administrative fine ultimately to be imposed (see Nemitz in Ehmann/Selmayr [eds.], General Data Protection Regulation 3, Art. 83, para. 57). As a result, the administrative fines for all individual violations are added together but are ultimately capped at the maximum amount prescribed for the most serious offense (see Bergt in Kühling/Buchner [eds.], GDPR – BDSG4, Art. 83, para. 62, with reference to the English version “the amount specified for the gravest infringement”).The term “total amount” means that all infringements committed must be taken into account when determining the amount of the administrative fine, and the phrase “amount specified for the gravest infringement” refers to the statutory maximum amounts for administrative fines (Article 83, paragraphs 4 through 6). Therefore: Even though the administrative fine itself may not exceed the statutory maximum amount for the highest fine tier, the offender must nevertheless be expressly found guilty of violating multiple provisions, and these violations must be taken into account when calculating the amount of the administrative fine ultimately to be imposed (see Nemitz in Ehmann/Selmayr [eds.], General Data Protection Regulation 3, article 83, para. 57). As a result, the administrative fines for all individual violations are added together, but the total is ultimately capped at the maximum amount prescribed for the most serious violation (see Bergt in Kühling/Buchner [eds.], GDPR – BDSG4, article 83, para. 62, with reference to the English version: “the amount specified for the gravest infringement”). 

When calculating the total amount, despite the cap set forth in para 3, it must be taken into account that, for each individual violation and the corresponding administrative fine estimated pursuant to para 2(a), the fact that there have been multiple violations of the GDPR must be considered. Therefore, the total amount of the administrative fine will in any case be higher than if there were only a single violation in a given case (see Nemitz in Ehmann/Selmayr [eds.], General Data Protection Regulation 3, Art. 83, para. 60). When calculating the total amount, despite the cap in paragraph 3, it must be taken into account that, for each individual violation and the administrative fine estimated for it under paragraph 2(a), the fact that there were multiple violations of the GDPR must already be considered. Therefore, the total amount of the administrative fine will in any case be higher than if only a single violation were present in the specific case (see Nemitz in Ehmann/Selmayr [eds.], General Data Protection Regulation 3, article 83, para. 60).

2. Since, in this specific case, both violations fall under the sanction provision of Article 83(5) of the GDPR, the maximum amount is 20,000,000 EUR or 4 percent of the previous year’s turnover, whichever is higher. 2. Since, in the present case, both violations fall under the penalty provision of Article 83(5) of the GDPR, the maximum amount is 20,000,000 EUR or 4 percent of the previous year’s turnover, whichever is higher.

In the present case, it emerged during the proceedings before the Federal Administrative Court—as was undisputedly established—that the complainant’s annual revenue for the fiscal year 2024 (the fiscal year immediately preceding the violation and, at the same time, the last for which annual financial statements are already available) amounted to EUR 4,231,213.16.

Under these circumstances, the starting point for calculating the amount of the penalty in this case—as already assumed by the prosecuting authority and, moreover, undisputed by the complainant—is —the (static) upper limit of Article 83(5) of the GDPR, in the amount of EUR 20,000,000, must be used as the starting point.Under these circumstances, the starting point for calculating the amount of the present fine—as already assumed by the authority in question and, moreover, undisputed by the complainant—is the (static) upper limit of paragraph 83(5) GDPR, in the amount of 20,000,000 EUR, must be used as the starting point for calculating the amount of the fine in this case.

3. Article 83(2) of the GDPR lists criteria for determining the amount of an administrative fine, which must be “duly” taken into account in each individual case when making a decision on whether to impose an administrative fine and, if so, its amount. Accordingly, the following factors are particularly relevant: the nature, gravity, and duration of the violation; the number of data subjects affected by the processing; the extent of the damage; whether the violation was intentional or negligent; the category of personal data involved; the enterprise’s efforts to mitigate the damage; The nature and extent of cooperation with Data Protection Authorities, and the degree of responsibility of controllers. 3. Article 83(2) of the GDPR lists assessment criteria that must be “duly” taken into account when making a decision on whether to impose an administrative fine and determining its amount in each individual case. Accordingly, the following factors are particularly relevant: the nature, gravity, and duration of the violation; the number of data subjects affected by the processing; the extent of the damage; whether the violation was intentional or negligent; the category of personal data concerned; the enterprise’s efforts to mitigate the damage; the nature and extent of cooperation with Data Protection Authorities, and the degree of responsibility as a controller.

Since the applicable penalty range under Article 83(5) of the GDPR—up to EUR 20,000,000—is very high, the significance of the protected legal interest cannot, in any case, be classified as low. Since the applicable penalty range under article 83(5) of the GDPR is very high—up to EUR 20,000,000—the significance of the protected legal interest cannot, in any case, be considered minor.

Given that the complainant, in the course of its core business activity of “digital” marketing and the conduct of job interviews on behalf of other companies,” all job interviews she conducted with applicants during the relevant period were affected, the violations occurred over a period of just under four months, and multiple pieces of data pertaining to the respective applicants were affected, it must be noted that, even though the violations were committed negligently, the data are not of excessive significance, and their processing was carried out solely for internal training purposes, they were by no means minor but rather, when assessed according to the criteria set forth in Article 83(2)(a) of the GDPR—as already assumed by the authority in question—constitute a moderate level of severity. Given that the complainant culpably and unlawfully recorded and stored the personal data of the data subjects—without providing sufficient information—in the course of its core business activity of “digital” marketing and the conduct of job interviews on behalf of other companies”—and that all job interviews she conducted with applicants during the relevant period were affected by this, the violations occurred over a period of just under four months, and multiple pieces of data pertaining to the respective applicants were affected, it must be noted that, even though the violations were committed negligently, the data were not of excessive importance, and their processing was carried out solely for internal training purposes, they were certainly not minor but rather, when assessed according to the criteria set forth in article 83(2)(a) of the GDPR—as already assumed by the authority in question—constitute a medium level of severity.

Consequently, the respondent authority’s conclusion that the violation in this case is of medium severity is not to be challenged.

Given the medium severity of the violation as described, the Federal Administrative Court finds that a—as requested by the complainant— — is out of the question, nor is a discontinuation of the proceedings, a counseling session without the imposition of a penalty pursuant to § 33a of the Administrative Offenses Act (VStG), or a formal warning pursuant to § 45(1)(4) VStG. Relevant in this context is Recital 148 of the GDPR, which states, among other things, that supervisory authorities are permitted to refrain from imposing an administrative fine in the case of a minor infringement or if the administrative fine likely to be imposed would place a disproportionate burden on a natural person, and instead issue a warning.Given the moderate severity of the violation as described, the Federal Administrative Court holds that a mere warning—as requested by the complainant—is just as unlikely to be considered as a dismissal of the proceedings, counseling without the imposition of a penalty pursuant to Section 33a, VStG, or an official admonition pursuant to paragraph 45(1)(4) VStG—as requested by the complainant—are not options. Relevant in this context is Recital 148 of the GDPR, which states, among other things, that supervisory authorities are permitted to refrain from imposing an administrative fine in the case of a minor infringement or if the administrative fine likely to be imposed would place a disproportionate burden on a natural person, and instead issue a warning.

According to Guidelines EDPB 04/2022, a starting amount of 10% to 20% of the statutory maximum (EUR 20,000,000.00) should be assumed for a violation of medium severity. In light of the above, the Federal Administrative Court therefore considers a preliminary starting amount of EUR 2,000,000.00 (10% of the statutory maximum) to be appropriate. According to the EDPB 04 guidelines from 2022, a starting amount of 10% to 20% of the statutory maximum (EUR 20,000,000.00) is to be assumed for a violation of moderate severity. In light of the above considerations, the Federal Administrative Court therefore considers a preliminary base amount of EUR 2,000,000.00 (10% of the statutory maximum) to be appropriate.

4. Pursuant to Article 83(1) of the GDPR, each supervisory authority shall ensure that the imposition of administrative fines in each individual case is effective, proportionate, and dissuasive. 4. Pursuant to Article 83(1) of the GDPR, each supervisory authority shall ensure that the imposition of administrative fines in each individual case is effective, proportionate, and dissuasive.

The enterprise’s annual turnover is not mentioned in Article 83(2) of the GDPR as a criterion for determining the amount of the administrative fine. However, this does not mean that the enterprise’s annual turnover is irrelevant when determining the amount of the administrative fine. “On the one hand, for enterprises with high revenue, revenue determines the upper limit of the fine and thereby establishes the framework within which the specific data protection violation must be classified and assessed. The fine range provides the necessary guidance for the specific determination of the administrative fine. On the other hand, administrative fines imposed on enterprises pursuant to Article 83(1) of the GDPR must be effective and dissuasive. This also depends on the respective enterprise’s sensitivity to penalties. The larger the enterprise, the lower its sensitivity to penalties generally is, and the higher the fine must typically be set so that it can have its specific preventive effect. The amount of revenue is a suitable indicator of the enterprise’s size and thus of its sensitivity to penalties; retained earnings and other key figures reflecting the enterprise’s economic performance may also be taken into account” (see BVwG, March 27, 2024, W214 2243436-1/39E, with further references).  The EDPB’s guidelines on the calculation of administrative fines also (with reference to EDPB Decision 1/2021, which is binding in this regard, paras. 411 and 412) that the size of the enterprise must be taken into account when calculating the administrative fine, which is why its revenue must be considered. However, this does not relieve a supervisory authority of its responsibility to conduct a review of effectiveness, deterrence, and proportionality at the conclusion of the calculation (see, once again, the EDPB Guidelines 04/2022, paras. 63 et seq.).The enterprise’s revenue is not listed as a criterion for determining the administrative fine in paragraph 83 of the GDPR. However, this does not mean that the enterprise’s revenue is irrelevant when determining the administrative fine. “On the one hand, for enterprises with high turnover, the turnover determines the upper limit of the fine and thereby establishes the framework within which the specific data protection violation must be classified and assessed. The fine range provides the necessary guidance for the specific determination of the administrative fine. On the other hand, administrative fines imposed on enterprises pursuant to article 83(1) of the GDPR must be effective and dissuasive. This also depends on the respective enterprise’s sensitivity to penalties. The larger the enterprise, the lower its sensitivity to penalties generally is, and the higher the fine must typically be set so that it can have its specific preventive effect. The amount of revenue is a suitable indicator of enterprise size and thus of sensitivity to penalties; retained earnings and other key figures reflecting the enterprise’s economic performance may also be taken into account” (see BVwG, March 27, 2024, W214 2243436-1/39E, with further references). The EDPB’s guidelines on the calculation of administrative fines also assume (with reference to a binding EDPB decision 1 from 2021 on this matter, paras. 411 and 412) that the size of the enterprise must be taken into account when calculating the administrative fine, which is why its revenue must be considered. However, this does not relieve a supervisory authority of its responsibility to conduct a review of effectiveness, deterrence, and proportionality at the conclusion of the calculation (see, again, the EDPB 04 Guidelines from 2022, paras. 63 et seq.).

Nor does this contradict the Administrative Court (VwGH) decision cited by the complainant in Case No. Ra 2025/04/0089 of September 29, 2025, especially since, according to the reasoning in that decision, both the severity of the violation and the enterprise’s financial capacity must be taken into account when determining the penalty (para. 26), which corresponds to the assessment steps set forth in Chapters 4.2 and 4.3 of the Guidelines. By way of explanation, the Administrative Court stated in para. 28 that, with regard to the enterprise’s ability to pay in the context of determining the penalty, the annual revenue of the (previous) fiscal year should not be the sole factor taken into account.

Since the complainant’s revenue falls between EUR 2,000,000.00 and EUR 10,000,000.00, an adjustment based on the size of the enterprise must be made in accordance with the EDPB 04/2022 Guidelines. Given the complainant’s annual revenue of EUR 4,231,213.16, the EDPB recommends that the calculations be based on an amount between 0.3% and 2% of the determined base amount. This recommendation is based on the Commission’s Recommendation of May 6, 2003, concerning the definition of micro, small, and medium-sized enterprises. EU Recommendation 2003/361/EC defines micro, small, and medium-sized enterprises (SMEs) based on the number of employees and annual turnover. Accordingly, a microenterprise should have no more than 10 employees and an annual turnover of less than 2 million, while a small enterprise should have no more than 50 employees and an annual turnover of no more than 10 million. Taking into account the “structural similarity to a microenterprise” as outlined by the complainant, a final base amount of 0.7% of the provisional base amount—that is, EUR 14,000—therefore appears appropriate. Since the complainant’s revenue falls between EUR 2,000,000.00 and EUR 10,000,000.00, an adjustment based on the size of the enterprise must be made in accordance with the EDPB 04 Guidelines from 2022. Given the complainant’s annual turnover of EUR 4,231,213.16, the EDPB recommends that the calculations be based on an amount between 0.3% and 2% of the determined base amount. This recommendation is based on the Commission’s Recommendation of May 6, 2003, concerning the definition of micro, small, and medium-sized enterprises. EU Recommendation 2003/361/EC defines micro, small, and medium-sized enterprises (SMEs) based on the number of employees and annual turnover. Accordingly, a microenterprise should have no more than 10 employees and an annual turnover of less than 2 million, while a small enterprise should have no more than 50 employees and an annual turnover of no more than 10 million. Taking into account the “structural proximity to a ‘microenterprise’” as described by the complainant, a final base amount of 0.7% of the preliminary base amount—i.e., EUR 14,000—therefore appears appropriate.

5. As mitigating factors, the authority taking action considered the absence of prior violations of the GDPR by the complainant and the complainant’s cooperation in the present investigation proceedings before the Data Protection Authority. In this regard, it should be clarified that Article 31 of the GDPR already provides for a general obligation to cooperate with the supervisory authority, and that failure to comply with this obligation may even result in the imposition of an administrative fine (Article 83(4)(a)), so that, in accordance with Guidelines 04/2022, para. 96, a corresponding reduction in the penalty under Article 83(2)(f) can only be considered if cooperation went beyond this statutory requirement (see Illibauer in Knyrim, DatKomm Art. 83 GDPR (as of Oct. 1, 2025, rdb.at), para. 80/1 with further references). In the present case, however, the complainant must at least be credited with having, as part of her defense before the respondent authority, voluntarily submitted an additional audio recording of a job interview, so that the mitigating factor applies here. 5. As mitigating factors, the authority in question took into account the absence of prior violations of the GDPR before that authority and the complainant’s cooperation in the present investigation proceedings before the Data Protection Authority. In this regard, it should be clarified that article 31 of GDPR already provides for a general obligation to cooperate with the supervisory authority, and failure to comply with this obligation may even result in the imposition of an administrative fine by the authority (article 83(4)(a)), so that, in accordance with Guidelines 04 of 2022, para. 96, a corresponding reduction in the penalty under article 83(2)(f) can only be considered if cooperation extended beyond this statutory scope (see Illibauer in Knyrim, DatKomm article 83, GDPR (as of Oct. 1, 2025, rdb.at), para. 80/1 with further references). In the present case, however, the complainant must at least be credited with having, on her own initiative, submitted an additional audio recording of a job interview as part of her defense before the competent authority, so that the mitigating factor applies here.

Furthermore, the fact that the complainant immediately ceased data processing upon receipt of the request for justification and thus demonstrated cooperation should be taken into account as a mitigating factor (Article 83(2)(k)). Another mitigating factor is the fact that the complainant immediately ceased the data processing upon receipt of the request for justification and thus demonstrated a cooperative attitude (Article 83, paragraph 2, subparagraph k).

No evidence has emerged to suggest that the complainant had previously engaged in an in-depth examination of data protection law regarding the lawfulness of the data processing at issue and its associated obligation to provide information; nor, for that matter, did the complainant make such a claim. The fact that the complainant classified the alleged unlawfulness as incorrect in and of itself (without significant dispute) does not, in any case—contrary to her argument—constitute a mitigating factor.

Insofar as the complainant emphasizes its general efforts regarding data protection in this context, it must be acknowledged that—as established—the complainant had already addressed the issue of data protection within its enterprise in advance and, accordingly, had also implemented measures to ensure data security.

Pursuant to Article 83(2)(d) of the GDPR, when determining the penalty, the degree of responsibility of the controller must be taken into account, with due consideration given to the technical and organizational measures implemented in accordance with Articles 25 and 32. Article 25 of the GDPR sets forth requirements for the technical and organizational measures to be taken by the controller, such as pseudonymisation. Article 32 of the GDPR addresses the security of processing through technical and organizational measures.According to Article 83(2)(d) of the GDPR, when determining the amount of the fine, the degree of responsibility of the controller must be taken into account, considering the technical and organizational measures implemented in accordance with articles 25 and 32. Article 25 of the GDPR sets forth requirements for the technical and organizational measures to be taken by the controller, such as pseudonymisation. Article 32 of the GDPR addresses the security of processing through technical and organizational measures.

Since failure to comply with the obligations set forth in Articles 25 and 32 of the GDPR may in itself result in an administrative fine pursuant to Article 83(4)(a) of the GDPR, however—as also stated in Guidelines 04/22— —a corresponding reduction in the penalty under Article 83(2)(d) of the GDPR may be considered a mitigating factor only under exceptional circumstances in which the controller or processor has gone beyond the obligations imposed on them. However, the complainant did not demonstrate the existence of such exceptional circumstances, which is why such a mitigating factor could not be taken into account. Since a failure to comply with the obligations set forth in Articles 25 and 32 of the GDPR may in and of itself result in an administrative fine under paragraph 83(4)(a) of the GDPR, it follows—as also stated in Guidelines 04/22— —a corresponding reduction of the penalty under Article 83(2)(d) of the GDPR may be considered a mitigating factor only under exceptional circumstances in which the controller or processor has gone beyond the obligations imposed upon them. However, the complainant did not demonstrate the existence of such exceptional circumstances; therefore, such a mitigating factor could not be taken into account. 

From the Federal Administrative Court’s perspective, no further mitigating factors are apparent, nor were any such factors presented by the complainant. Similarly, the complainant’s arguments in this regard—namely, that no harm was caused at all—cannot be accepted, given that it is undisputed that data processing occurred in the present case, and therefore cannot be taken into account as a mitigating factor, especially since, given the loss of control by the data subjects over their personal data, (non-material) harm has indeed occurred. The fact that the complainant did not derive any (identifiable) benefits from the infringement is to be assessed neutrally (neither as a mitigating nor an aggravating factor) (see EDPB Guidelines 04/2022, para. 110, concerning economic benefits obtained and their consideration as an aggravating factor under Article 83(2)(k)). The Federal Administrative Court sees no other grounds for mitigation, nor were any such grounds presented by the complainant. Likewise, the complainant’s arguments in this regard—that no harm was caused at all—cannot be accepted, given that it is undisputed that data processing took place in the present case, and therefore cannot be considered as a mitigating factor, especially since, in view of the data subjects’ loss of control over their personal data, (non-material) harm has indeed occurred. The fact that the complainant did not derive any (identifiable) benefits from the infringement is to be assessed neutrally (neither as a mitigating nor an aggravating factor) (see EDPB 04 Guidelines from 2022, para. 110, concerning economic benefits obtained and their consideration as an aggravating factor under article 83(2)(k)).

The adjudicating panel therefore sees no grounds for applying additional mitigating factors. However, the respondent authority failed to take into account the commission of multiple criminal offenses as an aggravating factor in determining the penalty (cf. Lewisch in Lewisch/Fister/Weilguni, VStG2 § 19, para. 11 [as of May 1, 2017, rdb.at]), especially since the complainant was charged here with two violations of data protection provisions (unlawful recording/storage and failure to inform the data subjects). The adjudicating panel therefore sees no grounds for applying additional mitigating factors. However, the authority in question failed to take into account the commission of multiple criminal offenses as an aggravating factor in determining the penalty; see Lewisch in Lewisch/Fister/Weilguni, VStG2 § 19, margin note 11 [as of May 1, 2017, rdb.at]), especially since the complainant was charged here with two violations of data protection provisions (unlawful recording/storage and failure to inform the data subjects).

Nor does the consideration of aspects of general prevention by the prosecuting authority in the course of determining the penalty raise any concerns in the present case. As can be seen from the explanatory notes on the GDPR, the GDPR is intended to ensure EU-wide protection of personal data, which requires strengthening and precisely defining the rights of data subjects as well as tightening the obligations of those who engage in data processing (see Recital 11). In the interest of more consistent enforcement of the provisions of this Regulation, administrative fines shall also be imposed for violations of this Regulation (Recital 148), and these fines are intended, among other things, to give greater effect to administrative sanctions (Recital 150).

Against this background, the authority in question cannot be contradicted if it also regards the present administrative fine as a means of reaffirming the authority of the GDPR—both from the perspective of maintaining public confidence in the enforcement of data protection law, as well as to maintain and strengthen compliance among potential “offenders” in similar situations—and has accordingly considered it an aggravating factor.

Finally, as already explained above, it must not be overlooked in the present case that the complainant committed two violations of the GDPR.

Taking these considerations into account, the initial amount had to be adjusted accordingly, so that an administrative fine of EUR 22,000 appears proportionate to the culpability and the offense. The complaint was therefore granted to the extent stated, and the administrative fine was reduced to EUR 22,000.

Pursuant to § 64(1) of the Administrative Offenses Act (VStG), the penalty notice must state that the person penalized is required to pay a contribution toward the costs of the administrative proceedings. Pursuant to § 64(2) VStG, this contribution for the first-instance proceedings is to be set at 10% of the penalty imposed, but not less than 10 euros. The contribution toward costs was to be reduced to 2,200 euros based on the penalty now imposed. Pursuant to paragraph 64 of the VStG, the penalty order must state that the person penalized is required to contribute toward the costs of the criminal proceedings. Pursuant to Section 64, paragraph 2, of the VStG, this contribution for the first-instance proceedings is to be calculated as 10 percent of the penalty imposed, but not less than 10 euros. The contribution toward costs was to be reduced to 2,200 euros based on the penalty now imposed.

Since the complaint was thus partially granted, the appellant was not to be required to bear any costs of the complaint proceedings (Section 52, para 1 and para 2, of the VwGVG). Since the complaint was thus partially upheld, no costs of the complaint proceedings were to be imposed on the complainant (Section 52, paragraphs 1 and 2, VwGVG).

This decision could be rendered pursuant to § 44(3)(2) VwGVG without holding an oral hearing, since the complaint—as explained above —is directed solely against the amount of the penalty, and furthermore, no party to the proceedings requested an oral hearing, and the complainant even expressly waived the right to one. This decision could be rendered pursuant to paragraph 44(3)(2), VwGVG without holding an oral hearing, since the complaint—as explained above—is directed solely against the amount of the penalty and, moreover, no party to the proceedings requested an oral hearing; in fact, the appellant expressly waived the right to one.

The decision was therefore rendered as stated.

Payment Information

You must pay the total amount of EUR 24,200 (penalty, costs of the administrative proceedings, costs of the administrative court proceedings) within two weeks to the account of the Federal Administrative Court (BVwG) with the IBAN AT840100000005010167 (BIC BUNDATWW), citing the case number, with no charges to the recipient. In the event of default, you must expect that the amount will be collected by compulsory means following a formal notice.

Re B) Inadmissibility of the appeal:

Pursuant to § 25a(1) VwGG, the Administrative Court must state in the operative part of its judgment or order whether the appeal is admissible under Art. 133(4) B-VG. The ruling must be briefly justified. Pursuant to Section 25a(1) of the VwGG, the Administrative Court must state in the operative part of its judgment or order whether the appeal is admissible pursuant to Article 133(4) of the B-VG. The ruling must be briefly justified.

The present decision does not depend on the resolution of a legal issue of fundamental importance. There is no lack of case law from the Administrative Court, nor does the present decision deviate from the case law of the Administrative Court; furthermore, the relevant case law of the Administrative Court cannot be regarded as inconsistent. Nor are there any other indications that the legal issues to be resolved are of fundamental importance. It was therefore necessary to rule that the appeal is not admissible pursuant to Art. 133(4) of the Federal Constitutional Law (B-VG). The present decision does not depend on the resolution of a legal issue of fundamental significance. There is no lack of case law from the Administrative Court, nor does the present decision deviate from the Administrative Court’s case law; furthermore, the existing case law of the Administrative Court cannot be regarded as inconsistent. Nor are there any other indications that the legal issues to be resolved are of fundamental importance. It was therefore necessary to rule that the appeal pursuant to article 133(4) of the Federal Constitutional Law (B-VG) is not admissible.