BVwG - W258 2242162-1
From GDPRhub
| BVwG - W258 2242162-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 2(2)(c) GDPR Article 5(1)(a) GDPR |
| Decided: | 15.09.2025 |
| Published: | 24.10.2025 |
| Parties: | |
| National Case Number/Name: | W258 2242162-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2025:W258.2242162.1.00 |
| Appeal from: | DSB (Austria) |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | RIS (in German) |
| Initial Contributor: | xz |
A court held that a mother and her children were unlawfully and secretly recorded by their neighbour in their garage. According to the court, the neighbour’s recording did not fall under the GDPR’s household exemption.
English Summary
Facts
The resident of a flat (a data subject) filed a complaint with the Austrian DPA (DSB) alleging that her neighbor (the controller) had unlawfully recorded her and her children in her private garage and disclosed the images to a third party.
The data subject and the controller were neighbors living in a shared residential complex with individual garage boxes in a common underground garage.
The controller claimed that he had only a wildlife camera in his own car, or that he received the photos anonymously on a DVD, but these explanations were later found contradictory and not credible by the DPA.
The DSB found that the controller had infringed the data subject in the right to secrecy. He unlawfully took pictures of the data subject using at least one camera installed in the garage box and he transmitted unlawfully these images to a third party. DSB argued that the GDPR is applicable because the data processing had intervened in the sphere of third parties. The processing of data was not exclusively for personal or family activities and thus did not take effect the household exception of Article 2(2)(c) GDPR.
The controller appealed to the Federal Administrative Court (BVwG).
Holding
The Court dismissed the appeal and upheld the DSB’s decision.
The court held that the video recording of natural persons, provided that it enables the identification of the data subject, constitutes processing of personal data, that falls within the scope of the GDPR, see CJEU case law. However, in accordance with Article 2(2)(c) GDPR, the regulation does not apply to the processing of personal data by natural persons for the exercise of only personal or family activities, see CJEU case law.
Insofar as video surveillance extends only partially to the public space and is therefore directed to an area outside the private sphere of the person who processes the data in this way, the court found that it cannot be regarded as an exclusively “personal or family” activity, under CJEU case law.
The controller has created photographs of the data subject by setting up a camera in a garage box without the consent of the data subject. He has captured the private space of the data subject and thus directed the data processing to an area outside his private sphere. The creation of the photographs cannot therefore be regarded as an exclusively ‘personal or family’ activity under Article 2(2)(c) GDPR. The controller also forwarded at least part of the photographs to a third party. Since this activity is also directed to an area outside the private sphere of the controller and can therefore not be regarded as an exclusively “personal or family” activity.
Furthermore, the court considered the processing of personal data as inadmissible if the principles of processing of the data mentioned in Article 5(1) GDPR are not complied with. A processing of personal data transparent to the data subject requires that the data subject is aware that the data will be processed, to what extent the processing is carried out and to what extent they will still be processed in the future. The data collection and transfer of data therefore proved to be unlawful.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Decision Date
September 15, 2025
Standard
Federal Constitutional Law Art. 133 (4)
DSG §1
GDPR Art. 2 (2) lit c
GDPR Art. 5 (1)
Federal Constitutional Law Art. 133 (current) Federal Constitutional Law Art. 133 valid from January 1, 2019, to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017. Federal Constitutional Law Art. 133 valid from January 1, 2019, last amended by Federal Law Gazette I No. 22/2018. Federal Constitutional Law Art. 133 valid from May 25, 2018, to December 31, 2018, last amended by Federal Law Gazette I No. 22/2018. Federal Constitutional Law Art. 133 valid from August 1, 2014, to May 24, 2018, last amended amended by BGBl. I No. 164/2013 B-VG Art. 133 valid from 01.01.2014 to 31.07.2014 last amended by BGBl. I No. 51/2012 B-VG Art. 133 valid from 01.01.2004 to 31.12.2013 last amended by BGBl. I No. 100/2003 B-VG Art. 133 valid from 01.01.1975 to 31.12.2003 last amended by BGBl. No. 444/1974 B-VG Art. 133 valid from 25.12.1946 to 31.12.1974 last amended by BGBl. No. 211/1946 B-VG Art. 133 valid from December 19, 1945 to December 24, 1946, last amended by StGBl. No. 4/1945, Federal Constitutional Law Art. 133, valid from January 3, 1930 to June 30, 1934
DSG Art. 1 § 1 today, DSG Art. 1 § 1, valid from January 1, 2014, last amended by BGBl. I No. 51/2012, DSG Art. 1 § 1, valid from January 1, 2000 to December 31, 2013
Ruling
W258 2242162-1/24E
IN THE NAME OF THE REPUBLIC!
The Federal Administrative Court, with Judge Mag. Gerold PAWELKA-SCHMIDT as presiding judge and the expert lay judges Dr. Gerd TRÖTZMÜLLER and Gerhard RAUB as assessors on the complaint from XXXX , represented by RA Dr. Heinz MELLER, 1070 Vienna, Neubaugasse 66, co-participating party before the Administrative Court XXXX , represented by Mag. Maria KINCSES, 4060 Leonding, Mayrhansenstraße 11, against the decision of the Data Protection Authority dated October 12, 2021, GZ XXXX , in a closed session in a data protection matter after conducting an oral hearing by circulation, rightly ruled:The Federal Administrative Court, with Judge Mag. Gerold PAWELKA-SCHMIDT as chairman and the expert lay judges Dr. Gerd TRÖTZMÜLLER and Gerhard RAUB as assessors, on the complaint from roman 40 , represented by RA Dr. Heinz MELLER, 1070 Vienna, Neubaugasse 66, co-participating party before the Administrative Court Roman 40, represented by Mag. Maria KINCSES, 4060 Leonding, Mayrhansenstraße 11, against the decision of the Data Protection Authority dated October 12, 2021, GZ Roman 40, in a data protection matter, in a closed session following an oral hearing by circulation, rightly ruled:
A) The appeal is dismissed and the ruling of the contested decision is confirmed with the proviso that it should read:
"The appeal is upheld and it is established that the respondent violated the complainant's right to confidentiality by taking photographs of the complainant using a camera that was installed in the garage at address XXXX for an unknown period between June 24, 2020, and July 3, 2020. to XXXX." "The complaint is upheld, and it is found that the respondent violated the complainant's right to confidentiality by taking photographs of the complainant and transmitting them to roman 40 using a camera that was installed in the garage at the address roman 40 during an unspecified period between June 24, 2020, and July 3, 2020."
B) The appeal is inadmissible pursuant to Article 133, paragraph 4, of the Federal Constitutional Law.
Text
Reasons for the decision:
I. Course of proceedings: roman one. Procedure:
1. By submission dated June 27, 2020, amended by letter dated August 4, 2020, and by submission dated July 3, 2020, the co-participating party (appellant in the administrative proceedings) filed a data protection complaint with the authority concerned, alleging, in summary and essence, that the appellant (respondent in the administrative proceedings) had violated their right to confidentiality pursuant to Section 1 (1) of the Data Protection Act (DSG) by, on the one hand, installing a camera in their car between June 24, 2020, and June 26, 2020 (the letter dated August 4, 2020, apparently erroneously stated June 27, 2020 as the end date), and, on the other hand, by concealing another camera in their garage. He sent the images taken with the device, which he claimed were of her and her children, to her former partner. In doing so, he violated the principles for the processing of personal data pursuant to Article 5 of the GDPR.1. By submission of June 27, 2020, via the rectification order of July 15, 2020, improved by letter of August 4, 2020, and by submission of July 3, 2020, the co-participating party (appellant in the administrative proceedings) filed a data protection complaint with the authority concerned and, in summary and essence, argued that the complainant (respondent in the administrative proceedings) had violated their right to confidentiality pursuant to paragraph one, subsection one, of the Data Protection Act by, on the one hand, installing a camera in their car between June 24, 2020 and June 26, 2020 (the letter of August 4, 2020 apparently erroneously stated June 27, 2020 as the end date), and, on the other hand, hiding another camera in their garage. He allegedly sent the images taken with the camera, which he claimed showed her and her children, to her former partner. In doing so, he allegedly violated the principles for the processing of personal data pursuant to Article 5 of the GDPR.
2. The co-participating party argued that the images could only have been taken by the complainant because the garage in which they were taken was not publicly accessible and other property owners would avoid the complainant.
As evidence, he submitted, among other things, various photographs allegedly taken by the complainant, which were said to show the co-participating party and her son. Furthermore, photographs allegedly showing the camera installed in the complainant's vehicle.
3. The complainant argued that he did not take any photos of the co-participating party with the camera installed in his vehicle. This was because the parties' garages were located next to each other, and the rear-facing camera, located on the parcel shelf of his vehicle, could not "shoot around the corner." The co-participating party also submitted color photos, while the camera installed in his car could only take black and white images. He had installed the camera to protect his cars from damage by another neighbor and to document any damage. However, due to faulty installation, it did not take any photos.
The photographs submitted by the co-participating party were sent to him anonymously so that – according to the anonymous sender – the complainant could see how "his neighbor was cheating on him with his lover and also her ex-partner." He therefore also sent the photos to the co-participating party's former partner.
As evidence, the complainant submitted photographs that purported to show his friend getting into the co-participating party's vehicle hidden behind an umbrella. He no longer has any of the anonymously sent photographs.
4. By decision of October 12, 2021, the respondent authority granted the appeal and found that the complainant had violated the co-participating party's right to confidentiality by unlawfully taking images of the co-participating party using at least one camera installed in the garage at address XXXX, at least between June 24, 2020, and June 26, 2020, and unlawfully transmitting these images to a third party. 4. By decision of October 12, 2021, the respondent authority granted the appeal and found that the complainant had violated the co-participating party's right to confidentiality by unlawfully taking images of the co-participating party using at least one camera installed in the garage at address Roman 40, at least between June 24, 2020, and June 26, 2020, and unlawfully transmitting these images to a third party.
The respondent authority argued that the General Data Protection Regulation (GDPR) was applicable because the data processing interfered with the sphere of third parties and served to protect their property, which is why it was not carried out exclusively for personal or family activities and therefore the household exception in Article 2 (2) (c) GDPR did not apply.
The recording of the co-participating party's garage and the transmission of image data to the co-participating party's former partner are unlawful because they are not necessary for monitoring the co-participating party's own car for the purpose of self-protection and are excessive for any possible monitoring of the co-participating party's social contacts – although the complainant has not argued that the images are intended to be used as evidence in any specific proceedings.
5. The authority in question did not rule on the alleged violation of the right to confidentiality by the camera allegedly installed in the complainant's car.
6. The complainant's present appeal of April 14, 2021, is directed against this decision. In it, he essentially argued that his conflict with the co-participating party stems from a dispute over his former boyfriend, who is now in a relationship with the co-participating party. He did not photograph the co-participating party or their family. The only camera he had installed was a wildlife camera that only took black-and-white photos. He said the photos he submitted were taken from a video recording on a DVD that he had anonymously found in his mailbox.
7. The respondent authority submitted the appeal, attaching the administrative act, in a written submission dated April 19, 2021, received on May 5, 2021, and requested that the appeal be dismissed with further reasons.
8. The appeal against the administrative decision was heard orally on June 2, 2021.
Evidence was taken by examining the administrative act, the WhatsApp conversation between a neighbor of the co-participating party and the co-participating party regarding the alleged espionage by the complainant (OZ 14; Exhibit ./2), two video recordings from a surveillance camera installed in the co-participating party's garage dated December 11, 2020 (OZ 14; Exhibit ./2), and the examination of the complainant and the co-participating party, each as a party (OZ 14).
II. The Federal Administrative Court considered: Roman II. The Federal Administrative Court considered:
1. Findings:
1.1. Regarding the applications initiating the proceedings and the decision in the administrative procedure:
1.1.1. The co-party sent the following email to the relevant authority on June 27, 2020 (error in the original):
"[…] Police […] said I should contact you regarding my neighbor, Mr. XXXX, who installed a wildlife camera in his car to monitor me. His goal is to know who visits me and who doesn't. This camera was installed on June 24th and removed yesterday, June 26th."[…] Police […] said I should contact you regarding my neighbor, Mr. Römische 40, who installed a wildlife camera in his car to monitor me. His goal is to know who visits me and who doesn't. This camera was installed on June 24th and removed yesterday, June 26th.
The photos are attached.
I suspect Mr. XXXX has installed more cameras. As soon as I find them, I will take photos again."I suspect Mr. Römische 40 has installed more cameras. As soon as I find them, I will take photos again."
Attached to the email were three photographs showing a car in a garage with a camera on its parcel shelf.
1.1.2. On July 3, 2020, at 11:15 p.m. (OZ 4), the co-participating party sent another email with the following content to the authority concerned (error in the original):
"I sent you an email on June 27, 2020, that my neighbor, Mr. XXXX, was monitoring my garage entrance.
I sent you an email on June 27, 2020, that my neighbor, Mr. Roman, 40, was monitoring my garage entrance.
Today, my ex-boyfriend, XXXX, received these photos. Mr. XXXX once again placed a hidden camera in my garage and sent the photos to third parties. [...]Today, my ex-boyfriend, Roman, 40, received these photos. Mr. Roman, 40, once again placed a hidden camera in my garage and sent the photos to third parties. [...]
Hope you can help me!"
The email included various photographs showing a car and several people, as well as a screenshot of a WhatsApp conversation.
1.1.3. By order of July 15, 2020, the respondent authority requested the co-participating party to supplement the application of June 27, 2020, with the right deemed to have been violated, the name and postal address of the respondent, and a request to establish the alleged violation.
1.1.4. By email dated August 4, 2020, the participating party sent the respondent authority a "Complaint to the Data Protection Authority" form, which states, among other things (formatting partially adjusted):
"[…] Responsible party (respondent):
Name: XXXX Name: Roman 40
Address: XXXX Address: Roman 40
XXXX Roman 40
[…] I hereby lodge a complaint […] due to a violation of my fundamental right to confidentiality pursuant to Section 1 (1) of the Data Protection Act:[…] I hereby lodge a complaint […] due to a violation of my fundamental right to confidentiality pursuant to Paragraph 1, Section 1, of the Data Protection Act:
The respondent has […] 2.1. violated the principles for the processing of personal data pursuant to Art. 5 GDPR when processing my personal data. […] The respondent has […] 2.1. violated the principles for the processing of personal data pursuant to Art. 5 GDPR when processing my personal data. personal data in accordance with Article 5 of the GDPR. […]
Regarding the alleged violation, I hereby provide the following information:
My neighbor is already known to the police and has been having repeated problems since February 2020.
Because he set up a camera in his car and sent the photos (of me and my children) to my ex-partner, I would like to report Mr. XXXX due to data protection regulations. […]Because he set up a camera in his car and sent the photos (of me and my children) to my ex-partner, I would like to report Mr. Römische 40 due to data protection regulations. […]
The violation occurred on the following date, or rather, I learned about it at this time:
Camera set up on June 24, 2020 and removed on June 27, 2020. Mr. XXXX had set up the camera in the back of his car. established.
In support of my own submission, I enclose [...]:
I already sent photos of these by email on June 27, 2020.
I therefore request that the Data Protection Authority determine a violation of my rights."
1.1.5. With the contested decision, the authority in question carried out the actions described in the procedure under I.4.1.1.5. With the contested decision, the authority in question carried out the actions described in the procedure under Roman I.4.
In addition, she stated during the proceedings (formatting in the original):
"[...] the complainant [claimed], in summary, that the respondent had violated her right to confidentiality due to impermissible image processing. On June 24, 2020, the respondent had installed a camera in the complainant's garage and used it to take pictures of her and her children. The camera was removed again on June 26, 2020. A bundle of photographs was enclosed with the complaint.
2. The respondent stated [...] that he had only installed a wildlife camera for black-and-white photos in his car in the garage, which was aimed at the entrance and exit. This had been installed for the purpose of proving damage to the respondent's vehicle by a neighbor. [...]
3. the [...] complainant [countered] that the respondent not only had a camera on the parcel shelf in his car, but also one in the complainant's garage compartment. installed. The respondent's claim that the camera was installed in the vehicle for the purpose of protecting property is incorrect, as this was a false accusation. [...]"
Regarding the subject matter of the complaint, she stated (formatting in the original):
"B. Subject matter of the complaint:
Based on the complainant's submissions, it emerges that the subject matter of the complaint is the question whether the respondent violated the complainant's right to confidentiality by unlawfully processing the complainant's personal data and unlawfully transmitting it to third parties at least between June 24 and 26, 2020, using at least one camera installed in the garage at address XXXX."Based on the complainant's submissions, it emerges that the subject matter of the complaint is the question whether the respondent violated the complainant's right to confidentiality by unlawfully processing the complainant's personal data and unlawfully transmitting it to third parties at least between June 24 and 26, 2020, using at least one camera installed in the garage at address Roman 40. June 26, 2020, unlawfully processed the complainant's personal data and unlawfully transmitted it to third parties."
Regarding the photographs, she states (p. 3 of the decision): Regarding the photographs, she states (session 3 of the decision):
"The respondent took several pictures of the complainant and her children using at least one camera installed in the complainant's garage at least between June 24 and 26, 2020."
And (dislocated in the legal assessment on p. 7 of the decision): And (dislocated in the legal assessment on session 7 of the decision):
"According to the respondent, the data processing relevant here [was] also intended, among other things, to protect property rights [...]"
1.2. Regarding the alleged violation of the right to confidentiality:
1.2.1. At least in 2020, the complainant lived at the address XXXX and the co-participating party lived at the address XXXX. Both properties are part of a terraced house complex that has a communal underground car park with several garages. 1.2.1. At least in 2020, the complainant lived at the address Römische 40 and the co-participating party lived at the address Römische 40. Both properties are part of a terraced house complex that has a communal underground car park with several garages.
1.2.2. Each of the properties is assigned one of the garages with two parking spaces, which may be used by the authorized users of the respective property.
1.2.3. The co-participating party told the complainant in November 2019 that she was considering separating from her boyfriend, XXXX. The complainant then suspected that the co-participating party was attempting to force their way into his relationship with XXXX.1.2.3. The co-participating party told the complainant in November 2019 that she was considering separating from her boyfriend, Roman 40. The complainant then suspected that the co-participating party was attempting to force their way into his relationship with Roman 40.
1.2.4. To confirm his suspicions, the complainant entered the co-participating party's garage between September 24, 2020, and July 3, 2020 (the exact time cannot be determined), without the consent of the co-participating party or any other authorized person, concealed a camera there, and took several photographs (OZ 1, page 63 ff). The co-participating party is depicted in two photographs.
1.2.5. The complainant subsequently sent the photographs to the former partner of the co-participating party using the short message service "WhatsApp." The complainant did this to inform the former partner of the co-participating party that, in his opinion, the co-participating party had entered into a new relationship, thereby provoking a conflict between the co-participating party and their former partner.
2. Assessment of Evidence:
2.1. The findings regarding the administrative procedure (point 1.1 of the findings) are based on the unobjectionable administrative act.
2.2. Regarding the further findings:
2.2.1 The findings regarding the residential addresses of the complainant and the co-participating party are based, geographically, on their identical and undisputed statements in the administrative and administrative court proceedings, and, chronologically, on the complainant's testimony ("I brokered the house to Ms. XXXX about two to three years ago, which must have been in 2019. We are neighbors."; minutes of the hearing dated June 2, 2021, OZ 1, p. 3), which do not contradict the statements of the co-participating party. The findings regarding the terraced house display and the garage are based on the statements of the co-participating party dated November 12, 2020 (OZ 1, p. 120) and January 18, 2021 (OZ 1, p. 236 et seq.) and the interrogation of the complainant (minutes of the hearing dated June 2, 2021, OZ 14, p. 6). 2.2.1 The findings regarding the residential addresses of the complainant and the co-participating party are based, geographically, on their identical and undisputed statements in the administrative and administrative court proceedings, and, chronologically, on the interrogations of the complainant ("I brokered the house to Ms. Römische 40 about two to three years ago, that must have been 2019. We are neighbors."; minutes of the hearing dated June 2, 2021, OZ 1, p. 3), which do not contradict the statements of the co-participating party. The findings regarding the terraced house layout and the garage are based on the statements of the co-participating party dated November 12, 2020 (OZ 1, p. 120) and January 18, 2021 (OZ 1, p. 236 et seq.) and the hearing of the complainant (minutes of the hearing dated June 2, 2021, OZ 14, p. 6).
2.2.2. The findings regarding the allocation of the garage spaces and the right of use are based on the statement of the co-participating party dated November 12, 2020 (OZ 1, p. 120) ("the underground garage in which the parking spaces for the adjacent property owners are located") and the hearing of the complainant. Hearing minutes of June 2, 2021, OZ 14, p. 6 ("There are two garage spaces under each house, i.e., two parking spaces or one garage for two cars"). The complainant's statement that he has access to the co-participating party's garage (hearing minutes of June 2, 2021, OZ 14, p. 5) is not detrimental because it refers to factual, not legal, access.
2.2.3. The findings that the co-participating party informed the complainant about a possible separation from her then-boyfriend and that he then suspected her of forcing herself into his relationship are based on the co-participating party’s consistent statements (minutes of the hearing dated 2 June 2021, OZ 14, p. 7) in conjunction with the complainant’s statements that “XXXX […] has been forcing himself into the relationship between my boyfriend XXXX and me since November 2019.” (Email from the complainant to the authority concerned dated 15 October 2020; OZ 1 p. 91)2.2.3. The findings that the co-participating party informed the complainant about a possible breakup with her then-boyfriend, and that he subsequently suspected her of forcing herself into his relationship, are based on the co-participating party's consistent statements (record of the hearing dated June 2, 2021, OZ 14, p. 7) in conjunction with the complainant's statements that "Roman 40 [...] has been forcing himself into the relationship between my boyfriend Roman 40 and me since November 2019." (Email from the complainant to the respondent authority dated October 15, 2020; OZ 1 p. 91)
2.2.4. Regarding the findings regarding the taking of the photographs:
2.2.4.1. The complainant denies having hidden a camera in the co-participating party's garage and thus having photographed the co-participating party. Rather, he found a DVD with anonymous letters in his mailbox. He created the photographs by playing the video on the DVD, which featured the co-participating party, and photographing the screen. This could not be accepted:
On the one hand, his statement is contradictory:
First, he suggests to the respondent authority that the photos could have come from the co-participating party's former partner ("Regarding the color photos you sent, please ask XXXX's ex-partner!!! He probably wanted to prove to his ex XXXX that she had entered into a sexual relationship with a young man." (Email from the complainant to the respondent authority dated September 17, 2020, OZ 1, p. 46)). Despite the opportunity, he does not mention that the photos were sent to him anonymously. First, he suggests to the prosecuting authority that the photos could have come from the former partner of the co-involved party ("Regarding the color photos you sent, please ask the ex-partner of Roman 40!!! He probably wanted to prove to his ex Roman 40 that she had entered into a sexual relationship with a young man." (Email from the complainant to the prosecuting authority dated September 17, 2020, OZ 1, p. 46)). Despite the opportunity, he does not mention that the photos were sent to him anonymously.
In his email to the relevant authority dated October 15, 2020, he then stated that the photos had been sent to him anonymously with the note that an affair between the co-involved party and XXXX could be seen in the photos ("These color photos were sent to me anonymously with the note: "XXXX, in these photos you should see how your neighbor is cheating on you with your lover and also her ex-partner. > You see how your boyfriend sneaks out of her house hidden under a blue umbrella so that he won't be seen." (OZ 1 p. 107)). In his email dated December 3, 2020, he again speaks of "color photos" that had been delivered to his mailbox ("These color photos were delivered to my mailbox with the note that her ex-partner and I should find out what XXXX is doing with my Afghan lover." (OZ 1 p. 180)). In his email In his email to the relevant authority dated October 15, 2020, he then stated that the photos had been sent to him anonymously with the note that an affair between the co-involved party and roman 40 could be seen in the photos ("These color photos were sent to me anonymously with the note: "roman 40, in these photos you should see how your neighbor is cheating on you with your lover and also her ex-partner. > You see your boyfriend sneaking out of her house hidden under a blue umbrella so he won't be seen." (OZ 1 S 107)). In his email dated December 3, 2020, he again speaks of "color photos" that had been delivered to his mailbox ("These color photos were delivered to my mailbox with the note that her ex-partner and I should find out what roman 40 was doing with my Afghan lover." (OZ 1 S 180)).
In the appeal, he amends his argument to the effect that a DVD containing a film from which he took the photographs was now delivered to his mailbox (OZ 1 p. 307).
His justification at the oral hearing, according to which he always spoke of a DVD or – after being re-examined with his statements – of having spoken of a DVD in other proceedings before the respondent authority (record of the hearing dated June 2, 2021, p. 4), is not convincing because he did indeed speak of photographs in the emails on file (see the previous quotes) and no further proceedings against him were pending before the respondent authority before and at the time of his oral examination (record of the hearing dated June 2, 2021, p. 4).
It can also be ruled out that the complainant, in his original reference to "photos," merely provided an abbreviated account of the facts, perhaps because he considered the process of photographing the slides from the film on the DVD to be unimportant. He also provides information about the attached anonymous letter, which also allegedly referred to "photos." Had it actually been a DVD, however, it would be expected that the letter referred to a "DVD" or a "film."
Furthermore, the behavior described by the complainant is implausible. He claims to have discarded the evidence that could support his statement, namely the DVD and the cover letter, after taking the slides (record of the hearing dated June 2, 2021, p. 5) and no longer has possession of the slides he took (record of the hearing dated June 2, 2021, p. 6 et seq.). It is unlikely that he would have thrown away the DVD and letter because he didn't expect administrative or legal proceedings. Thus, one would expect that if the recordings were considered so important that photographs were taken from them and forwarded to a third party, the source of the photographs would also be retained. This could be to prove the source to the third party, to possibly take additional photos from the video, or to locate the anonymous sender. It would also be expected that the complainant would still have stored the photographs, especially since they were the subject of administrative proceedings and could be considered as evidence.
The complainant had a motive and the opportunity to take the photographs. He suspected that his partner was cheating on him with the co-involved party (see section 2.2.3.). It is therefore understandable that the complainant—in the absence of a confession from his partner and the co-involved party—sought ways to substantiate his suspicions. Taking photographs is a suitable means for this purpose. Since the garage boxes are freely accessible to all residents of the terraced house complex (examination of the complainant, minutes of the hearing of June 2, 2021, OZ 14, p. 5 and examination of the co-participating party, minutes of the hearing of June 2, 2021, OZ 14, p. 8) and the co-participating party's garage box was also used as a storage area (photograph of the co-participating party's garage box, minutes of the hearing of June 2, 2021, Annex ./1), the complainant also had the opportunity to enter the co-participating party's garage box and find a hiding place for a camera there. According to his statements, at the time of the recordings, the complainant, as he "thinks," also had an iPad, which – as is generally known – has a built-in camera (record of the hearing dated June 2, 2021, p. 7).
Finally, the complainant apparently hid cameras in the shared garage at another time. For example, a neighbor saw him allegedly retrieving an iPad from a third party's garage at another time (screenshot of a WhatsApp conversation between a neighbor of the co-participating party and the co-participating party, according to which the complainant allegedly retrieved an iPad from the garage, record of the hearing dated June 2, 2021, Exhibit ./2). On the other hand, a video from the surveillance camera of the co-participating party shows a man whose head is not visible, but who – as perceived by the Senate during the oral hearing – has the same stature and clothing style as the complainant, dropping something off opposite the co-participating party's garage at 9:46 p.m. on December 11, 2020, and picking it up again at 11:47 p.m. (record of the hearing dated June 2, 2021, Exhibit ./2, IMG_7645.MOV and IMG_7646.MOV).
Admittedly, the photographs submitted by the complainant in the administrative proceedings, which show his former partner (OZ 1, pp. 92 ff.), were apparently photographed from a screen, as is evident from the light reflection visible in the images – which indicates glass – and the frame visible around the photographs (OZ 1, pp. 94 ff.). Since these photos apparently show the same scene as the photographs in question here (the older son of the co-participating party is wearing the same clothing, namely trousers, T-shirt and umbrella cap, as well as the same backpack, XXXX is wearing the same striking T-shirt, and the same blue umbrella is visible in both sets of images, which is apparently being used as a screen) (OZ 1, pp. 92 ff and 21 f), this appears to support the complainant's statements that he claimed to have photographed the photographs from his computer. In fact, the frame and the folds visible to the right of it (OZ 1, p. 94 et seq.) rather indicate that an iPad placed on a soft surface, such as a couch, was photographed. Admittedly, the photographs submitted by the complainant in the administrative proceedings, which show his former partner (OZ 1, p. 92 et seq.), were apparently photographed from a screen, which is evident from the light reflection visible in the images – which indicates glass – and the frame visible around the photographs (OZ 1, p. 94 et seq.). Since these photos apparently depict the same scene as the photographs in question here (the co-participating party's older son is wearing the same clothing, namely trousers, T-shirt, and cap, as well as the same backpack; Roman 40 is wearing the same striking T-shirt; the same blue umbrella, apparently used as a privacy screen, is visible in both sets of images) (OZ 1, pp. 92 ff. and 21 f.), this seems to support the complainant's statement that he claimed to have photographed the photographs from his computer. In fact, the frame and the folds visible to the right of it (OZ 1, pp. 94 f.) rather indicate that an iPad placed on a soft surface, such as a couch, was photographed.
Against this background, the complainant's statements that the photos could have been taken by a neighbor stalking XXXX (trial record, p. 7; OZ 1, 4 et seq.) or by an outside third party (trial record, p. 7; OZ 1, 3) are to be considered a defensive claim. Against this background, the complainant's statements that the photos could have been taken by a neighbor stalking Roman 40 (trial record, p. 7; OZ 1, 4 et seq.) or by an outside third party (trial record, p. 7; OZ 1, 3) are to be considered a defensive claim.
In summary, it can therefore be assumed that the complainant filmed the co-participating party using an iPad hidden in her garage, played the video after retrieving the iPad, and created individual images from it by taking screenshots with the iPad or photographing the video with his mobile phone.
That he did so to confirm his suspicion that the co-participating party was having an affair with his former partner is clear from the considerations made in 2.2.4. "The complainant had a motive and the opportunity."
That the camera was set up covertly is clear from the fact that an openly set up camera would have been seen and removed by the co-participating party.
The lack of consent from the co-participating party and any other authorized persons is already clear from the data protection complaint and the co-participating party's submissions.
That the co-participating party is depicted in the photographs is clear from an examination of the photographs submitted in the administrative proceedings (administrative act, OZ 1, pp. 64 and 66). The person depicted was identified by the Senate as the co-participating party during the oral hearing.
2.2.4.2. Regarding the period of the recordings:
Since the photographs could not have been taken with the wildlife camera that the complainant placed on the parcel shelf of his vehicle, and thus cannot capture the rear right side door of the garage belonging to the co-participating party, which is visible in the photographs (photograph of the co-participating party's garage, minutes of the hearing dated June 2, 2021, Exhibit ./2), the period of their recording is independent of the period of installation of the wildlife camera.
The earliest possible time of recording the photographs therefore arises from the fact that the surveillance cameras located in the residential complex were destroyed during the night of September 26, 2020, to September 27, 2020 (statement of the co-participating party dated November 12, 2020; OZ 1 S 120). Prior to that, it would have been possible to prove the installation of a camera in the co-participating party's garage by examining the video recordings of the surveillance cameras. Since such evidence was not provided, the installation cannot have occurred before that time.
The latest possible date for the photographs being taken is determined by the fact that photographs can only be forwarded after they have been taken, and the complainant forwarded them to the co-participating party's former partner on July 3, 2020 (examination of the co-participating party, minutes of the hearing dated June 2, 2021, OZ 14, p. 7 et seq., in conjunction with the fact that the co-participating party forwarded the photographs to the respondent authority on July 3, 2020 (email from the co-participating party to the respondent authority; OZ 1, p. 17 et seq.)).
A more precise time cannot be determined because the photograph files submitted to the respondent authority do not contain any metadata (email from the co-participating party to the respondent authority dated July 3, 2020, 10:59 PM; OZ 1), the complainant denies responsibility, and no longer wishes to have access to the photographs (record of the hearing dated June 2, 2021, OZ 14, p. 6 et seq.).
2.2.5. The fact that the complainant forwarded the photographs to the co-participating party's former partner is evident from the screenshot of the "WhatsApp" app submitted by the co-participating party in the administrative proceedings (OZ 1, p. 62 et seq.) and the complainant's recorded interrogation (record of the hearing dated June 2, 2021, OZ 14, p. 6). The motives for forwarding the information are based on the statements of the co-participating party, according to which the complainant had always "whispered" to her former partner and had brought him to the point where he had physically attacked her (minutes of the hearing dated 2 June 2021, OZ 14, p. 9), in conjunction with a message from the complainant to the co-participating party in which he recommended that the co-participating party's former partner break open the co-participating party's front door and enter her bedroom in order to catch her with XXXX (email from the co-participating party to the authority concerned dated 8 October 2020, OZ 1, p. 86). A recommendation to enter the bedroom of the co-participating party goes far beyond what is necessary to inform the co-participating party's former partner about an affair of the co-participating party, as the complainant claims (record of the hearing of June 2, 2021, OZ 14, p. 6). Rather, it only allows the conclusion that the complainant's intention in providing this information was to inflame the conflict between the co-participating party and their former partner. 2.2.5. The fact that the complainant forwarded the photographs to the co-participating party's former partner is evident from the screenshot of the "WhatsApp" app submitted by the co-participating party in the administrative proceedings (OZ 1 p. 62 ff.) and the complainant's recorded interrogation (record of the hearing of June 2, 2021, OZ 14, p. 6). The motives for forwarding the information are based on the statements of the co-participating party, according to which the complainant had always "whispered" to her former partner and had brought him to the point where he had physically attacked her (minutes of the hearing of 2 June 2021, OZ 14, p. 9), in conjunction with a message from the complainant to the co-participating party in which he recommended that the co-participating party's former partner break down the co-participating party's front door and enter her bedroom in order to catch her with the Roman numeral 40 (email from the co-participating party to the respondent authority of 8 October 2020, OZ 1, p. 86). A recommendation to enter the bedroom of the co-involved party goes far beyond what is necessary to inform the co-involved party's former partner about an affair of the co-involved party, as the complainant claims (minutes of the hearing of June 2, 2021, OZ 14, p. 6). Rather, it only allows the conclusion that the complainant's intention in providing this information was to inflame the conflict between the co-involved party and their former partner.
3. Legal Assessment:
Regarding A)
The admissible complaint is unfounded.
3.1. On the applicability of the GDPR:
Video recordings of natural persons, insofar as they enable the identification of the data subject, constitute processing of personal data, which in principle falls within the material scope of the GDPR (ECJ 20 October 2022 C-306/21, Koalitsia "Demokratichna Bulgaria - Obedinenie", para. 32). The same must also apply to parts of video recordings and thus also to photographs.
However, according to Article 2 (2) (c) GDPR, the Regulation does not apply to the processing of personal data by natural persons for the exercise of exclusively personal or household activities. This exception to the scope of the GDPR must generally be interpreted narrowly (ECJ 16 July 2020, C-311/18, Facebook Ireland, para. 84). However, according to Article 2(2)(c) GDPR, the Regulation does not apply to the processing of personal data by natural persons for the exercise of exclusively personal or household activities. This exception to the scope of the GDPR must generally be interpreted narrowly (ECJ 16 July 2020, C-311/18, Facebook Ireland, para. 84).
3.1.1. Regarding the household exception with regard to the taking of photographs:
To the extent that video surveillance extends even partially to public space and is thus directed at an area outside the private sphere of the person processing the data in this way, it cannot be considered an exclusively "personal or household" activity (see the judgments of the ECJ of 10 July 2018, C-25/17, Jehovan todistajat, 42, and of 11 December 2014, C-212/13, Ryneš, para. 33, which, although issued on the "household exception" provided for in Article 3(2), second indent, of Directive 95/46/EEC ("Data Protection Directive"), can be transferred to Article 2(2)(c) GDPR due to their identical wording). To the extent that video surveillance extends even partially to public space and is thus directed at an area outside the private sphere of the person processing the data in this way, If the data is processed in this way, it cannot be considered an exclusively "personal or household" activity (see the ECJ judgments of July 10, 2018, C-25/17, Jehovan todistajat, 42, and December 11, 2014, C-212/13, Ryneš, para. 33, which, although issued on the "household exception" stipulated in Article 3, paragraph 2, second indent of Directive 95/46/EC ("Data Protection Directive"), can be transferred to Article 2, paragraph 2, letter c, GDPR due to the identical wording).
If the private sphere of the person processing the data is left when video surveillance extends into public space, it must be left even more so when the video surveillance covers the private space of a third party without their consent.
The complainant took photographs of the co-participating party by installing a camera in a garage without the consent of the co-participating party or another authorized person. The camera was intended to be used by the co-participating party but not by the complainant. He thereby captured the co-participating party's private space and thus directed the data processing to an area outside of his private sphere.
Taking the photographs cannot therefore be considered an exclusively "personal or family" activity, which is why the household exception does not apply.
3.1.2. Regarding the household exception regarding the disclosure of the photographs to the co-participating party's former partner:
The complainant also forwarded at least some of the photographs to the co-participating party's former boyfriend in order to instigate a conflict between the co-participating party and his former boyfriend. Since neither of them belongs to the complainant's household, this activity also falls outside the complainant's private sphere and therefore cannot be regarded as an exclusively "personal or family" activity (see the ECJ ruling of July 10, 2018, C-25/17, Jehovan todistajat, para. 44, in which the ECJ considered preaching activities of a religious community, which essentially have the purpose of spreading the faith of that community among persons who do not belong to the household of the preaching members, to lie outside the private sphere of the preachers). Furthermore, the complainant forwarded at least some of the photographs to the former friend of the co-participating party in order to stir up a conflict between the co-participating party and his former friend. Since neither of them belongs to the complainant's household, this activity also falls outside the complainant's private sphere and therefore cannot be considered an exclusively "personal or family" activity (see the ECJ ruling of July 10, 2018, C-25/17, Jehovah's Witnesses, para. 44, in which the ECJ considered the preaching activities of a religious community, which essentially have the purpose of spreading the faith of that community among persons who do not belong to the household of the preaching members, to lie outside the private sphere of the preachers).
The household exception is therefore also not applicable to the distribution of the photographs.
3.2. On the admissibility of the creation and distribution of the photographs:
Processing of personal data is inadmissible if the principles of data processing set out in Article 5(1) GDPR are not observed. According to point (a) of the cited provision, personal data must, among other things, be processed fairly and fairly (second case) and in a manner that is transparent to the data subject (third case) (principles of "fairness" and "transparency"; cf. ECJ 4 May 2023, C-60/22, paras. 57, 52 with further references and VwGH 17 May 2023, Ro 2021/13/0023 para. 39). Processing of personal data is inadmissible if the principles of data processing set out in Article 5, paragraph 1, GDPR are not observed. According to letter a of the cited provision, personal data must, among other things, be processed fairly and fairly (second case) and in a manner that is transparent to the data subject (third case) (principles of "fair processing" and "transparency"; see ECJ 4 May 2023, C-60/22, paras. 57, 52 with further references and Administrative Court of Justice 17 May 2023, Ro 2021/13/0023 para. 39).
Fair processing must be within the bounds of what the data subject must expect in light of the entire legal system and be structured in a manner that the controller presents to the outside world (Administrative Court of Justice 17 May 2023, Ro 2021/13/0023 para. 39).
Transparent processing of personal data for the data subject requires that the data subject is aware that data concerning them is being processed, the extent to which it is being processed, and the extent to which it will continue to be processed in the future (GDPR Recital 39).
Applied to the facts of the case, this means:
The complainant took photographs of the co-involved party by entering a garage space allocated to the co-involved party without the consent of the co-involved party or any other authorized person and concealing a camera there. He then passed the photographs on to a third party.
Neither the collection of data by concealing a camera without authorization nor the disclosure of such data constitutes what the data subject must expect in light of the entire legal system. Furthermore, because the recording was secret, it is not in the manner the controller claims. The collection and sharing of data therefore violates "good faith" according to Article 5 (1), second case, GDPR. Neither the collection of data by secretly placing a camera without authorization nor the sharing of data collected in this way constitutes what the data subject must expect in light of the entire legal system. Furthermore, because the recording was secret, it is not designed as the controller presents it to the outside world. The collection and sharing of data therefore violates "good faith" according to Article 5 (1), second case, GDPR.
Due to the covert recording of image data, the participating party was also unaware that and to what extent personal data concerning them was being processed. The data collection and sharing therefore also violates the "principle of transparency" according to Article 5 (1), third case, GDPR. Due to the covert recording of image data, the participating party was also unaware that and to what extent personal data concerning them was being processed. The data collection and sharing therefore also violates the "principle of transparency" under Article 5, paragraph 1, letter a, third case, GDPR.
The creation and sharing of the photographs is therefore unlawful.
3.3. Regarding the confirmation of the requirements:
In the ruling of the contested decision, the authority in question limited the period for the creation of the photographs to "at least" between June 24, 2020, and June 26, 2020. In fact, the photographs could also have been taken outside of this period, namely between June 24, 2020, and July 3, 2020. The question therefore arises as to whether the court exceeds its decision-making authority by extending the period in question.
3.5.1. Regarding the substance of the appeal proceedings and the decision-making authority of the adjudicating court:
The "subject matter" of the appeal proceedings is the matter that formed the basis of the ruling of the authority being appealed (VwGH 01.04.2025, Ro 2024/04/0005 point 6.).
It is therefore necessary to first clarify what the relevant authority has decided on.
Regarding the decision of the authority concerned:
1. The submissions of the co-participating party – viewed as a whole – show that they wish to object to the creation and disclosure of photographs that the complainant allegedly took, on the one hand, by a wildlife camera placed on the parcel shelf of the complainant's car (submissions of June 27, 2020 and August 4, 2020) and, on the other hand, by a camera hidden in their garage (submission of July 3, 2020). They seek a declaration of a violation of their right to confidentiality pursuant to Section 1 (1) of the Data Protection Act (DSG) for both incidents (explicitly for the wildlife camera in the submission of August 4, 2020, and implicitly for the hidden camera in the submission of July 3, 2020, in conjunction with the request in the submission of 04.08.2020).1. The co-participating party's submissions – viewed as a whole – indicate that it wishes to object to the creation and disclosure of photographs allegedly taken by the complainant, on the one hand, using a wildlife camera placed on the parcel shelf of the complainant's car (submissions of June 27, 2020, and August 4, 2020), and on the other hand, using a camera hidden in its garage (submission of July 3, 2020). It also seeks a declaration of a violation of its right to confidentiality pursuant to Section 1, Paragraph 1, of the Data Protection Act (DSG) for both incidents (explicitly for the wildlife camera in the submission of August 4, 2020, and implicitly for the hidden camera in the submission of July 3, 2020, in conjunction with the request in the submission of August 4, 2020 – which is also the only meaningful request for the submission of July 3, 2020).
2. The authority in question combined the allegations from both incidents – partly contrary to the records – but ultimately decided only on the creation and distribution of the photographs, which were allegedly taken by a camera hidden in the garage of the co-involved party.
This is clear from the ruling (“at least one camera which was installed in the garage box [of the co-participating party]”), the subject matter of the complaint stated by the authority in question (“at least one camera which was installed in the garage box [of the co-participating party]”) and the findings which expressly refer to photographs which are said to have been taken by at least one camera installed in the garage box of the co-participating party, the photograph cited as an example in the notice of findings which, according to the co-participating party, comes from a camera hidden in its garage box, the screenshot of the “WhatsApp” program shown in the notice of decision which is said to show the forwarding of the photos taken by the camera hidden in the garage box of the co-participating party. The phrase "using at least one camera" (author's underlining) in the ambiguous ruling of the decision in this regard cannot therefore be understood, taking into account the grounds for the decision that must be used to interpret it (VwGH 27.09.2022, Ra 2022/11/0069, para. 33, with further references), to mean that the authority also agreed on photographs taken by the game camera.
3. The “matter” of the appeal procedure is the matter which formed the content of the ruling of the authority concerned (VwGH 01.04.2025, Ro 2024/04/0005 point 6.) and thus the question whether the complainant violated the co-participating party’s right to confidentiality under Section 1 Paragraph 1 DSG by taking and forwarding the photographs of the co-participating party referred to in its submission of 03.07.2020 – i.e. photographs which show the co-participating party in its garage box.3. The "matter" of the appeal proceedings is the matter that formed the content of the ruling of the authority concerned (VwGH April 1, 2025, Ro 2024/04/0005, item 6), and thus the question of whether the appellant violated the co-participating party's right to confidentiality under paragraph 1, subsection 1 of the Data Protection Act by creating and forwarding the photographs of the co-participating party identified in its submission of July 3, 2020 – i.e., photographs showing the co-participating party in its garage.
4. Since the specific period of creation and the specific time of forwarding the photographs are irrelevant to their admissibility under data protection law, the period attached to the ruling by the authority concerned merely served to more closely identify the photographs in question in the specific case. The adjudicating court is therefore authorized to replace it with the established period without exceeding the scope of the appeal proceedings.
3.4. The decision was therefore in accordance with the ruling.
Regarding B) Inadmissibility of the appeal on points of law:
According to Section 25a, Paragraph 1 of the Administrative Court Act (VwGG), the administrative court must state in its judgment or decision whether the appeal on points of law is admissible pursuant to Article 133, Paragraph 4 of the Federal Constitutional Constitution Act (B-VG). This decision must be briefly justified.
The appeal on points of law is inadmissible because the decision does not depend on the resolution of a legal issue of fundamental importance. With regard to the assessment of video surveillance, the court could rely on the respective cited case law of the European Court of Justice (ECJ). Furthermore, the case-by-case balancing of interests regarding the legitimate interest under Article 6 (1) (f) GDPR, carried out within the framework of the principles established by the ECJ, is not subject to review. The appeal is inadmissible because the decision does not depend on the resolution of a legal issue of fundamental importance. With regard to the assessment of video surveillance, the court was able to rely on the respective cited ECJ case law. Furthermore, the case-by-case balancing of interests regarding the legitimate interest under Article 6 (1) (f) GDPR, carried out within the framework of the principles established by the ECJ, is not subject to review.
