DSB (Austria) - 2025-0.861.933
From GDPRhub
| DSB - 2025-0.861.933 | |
|---|---|
 | |
| Authority: | DSB (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 2 GDPR Article 3 GDPR Article 4(1) GDPR Article 4(2) GDPR Article 5(1)(b) GDPR Article 5(1)(f) GDPR Article 57(4) GDPR § 1 DSG |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | 01.10.2025 |
| Decided: | 28.10.2026 |
| Published: | 06.03.2026 |
| Fine: | n/a |
| Parties: | Peter A. (data subject) N. GmbH (controller) |
| National Case Number/Name: | 2025-0.861.933 |
| European Case Law Identifier: | ECLI:AT:DSB:2025:2025.0.861.933 |
| Appeal: | Unknown |
| Original Language(s): | German |
| Original Source: | RIS (in DE) |
| Initial Contributor: | avalang |
The DPA held that the operator of a retail store lawfully operated a CCTV system and reviewed a recording after a data subject accused the store’s staff of coercion.
English Summary
Facts
The data subject visited a retail store operated by the controller on 24 June 2025. At the checkout, staff refused card payment at a staffed checkout counter and directed the data subject to a self-service checkout. The data subject fist insisted on paying by card but ultimately paid in cash.
Following the incident, the data subject contacted the controller and alleged that the staff’s conduct amounted to coercion.
The controller operated a CCTV system at the store for the purpose of protecting property and preventing criminal offences. After receiving the allegations, the controller reviewed relevant footage on 26 June 2025 to assess the situation. The controller did not agree with the claim that coercion took place, deleted the footage and informed the data subject of the review.
On 22 September 2025, the data subject filed a complaint with the DPA, arguing that the controller had unlawfully evaluated CCTV footage and violated the right to confidentiality.
Holding
First, the DPA found the complaint admissible under Article 77(1) GDPR. Although the dispute mainly concerned a customer complaint unrelated to data protection, the review of CCTV footage introduced a data protection element requiring assessment.
Second, the DPA confirmed that the CCTV processing fell within the scope of the GDPR under Articles 2, 3 and 4 GDPR, as it involved identifiable personal data processed by automated means.
Third, the DPA noted that the controller relied on Article 6(1)(f) GDPR, as the CCTV system served the legitimate interest of preventing criminal offences. It considered this purpose valid.
Fourth, the DPA held that the evaluation of the footage complied with the purpose limitation principle under Article 5 GDPR. The data subject had explicitly alleged a criminal offence (coercion). Therefore, the controller was entitled to review the footage to verify this allegation. The DPA emphasised that such evaluation remained within the defined purpose of preventing and investigating potential criminal conduct.
Fifth, the DPA considered that the controller limited the processing to what was necessary. The controller reviewed only relevant footage, deleted it afterwards, and informed the data subject.
Finally, the DPA concluded that the controller lawfully processed the data under Article 6(1)(f) GDPR and did not violate the data subject’s right to confidentiality. The DPA therefore rejected the complaint.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Text File No.: 2025-0.861.933 of October 28, 2025 (Case No.: DSB-D124.3382/25) [Note from Editor: Names and companies, legal forms and product names, addresses (including URLs, IP and email addresses), file numbers (and the like), statistical data, etc., as well as their initials and abbreviations, may have been abbreviated and/or altered for pseudonymization purposes. Obvious spelling, grammar, and punctuation errors have been corrected.] DECISION RULING The Data Protection Authority decides on the data protection complaint of Mr. Peter A*** (complainant) of September 22, 2025, against N*** GmbH (respondent) for violation of the right to confidentiality as follows: - The complaint is dismissed as unfounded. Legal basis: Articles 5, 6, 51(1), 57(1)(f) and 77(1) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of 4.5.2016, p. 1; Sections 1, 18(1), and 24(1) and (5) of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999 as amended. Legal basis: Articles 5, 6, 51(1), 57(1), letter f, and 77(1) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), Official Journal No. L 119 of 4 May 2016, Session 1; Sections 1, 18(1), and 24(1) and (5) of the Data Protection Act (DSG), Federal Law Gazette Part 1, No. 165 of 1999 as amended. ] GROUNDS A. Submissions of the Parties and Procedural History 1. In his appeal, as amended by his submission of October 1, 2025, and in his submissions during the hearing of October 22, 2025, the appellant alleges a violation of his right to confidentiality as a result of the respondent's unlawful use of video surveillance footage. 2. The respondent responded to this in a letter dated October 21, 2025. B. Subject Matter of the Appeal The subject matter of the appeal is whether the respondent violated the appellant's right to confidentiality by unlawfully using video surveillance footage from the branch located at **** Ä***dorf, L***platz *7, which had been used to process recordings of the appellant. C. Findings of Fact 1. On June 24, 2026, the appellant made a purchase at the respondent's branch in **** Ä***dorf, L***platz *7, intending to pay with his credit card at a staffed checkout. This was refused on the grounds that card payments were only possible at a self-service checkout. The appellant subsequently attempted to pay with his credit card at the staffed checkout, but this was again refused. He ultimately paid for the purchase in cash at the staffed checkout. In the ensuing correspondence, he informed the respondent that he felt coerced by this procedure. Evaluation of Evidence: This is evident from the initial appeal and the correspondence between the appellant and the respondent, which is attached to the statement of October 22, 2025. 2. The respondent operates a video surveillance system at its location in **** Ä***dorf, L***platz *7, for the purpose of protecting property (or for the purpose of preventing criminal offenses), with evaluation limited to the specific incident defined in the purpose description. Evaluation of evidence: This is evident from the respondent's statement of October 21, 2025, and is confirmed by the notification submitted at that time by M*** GmbH (on behalf of the respondent) to the former Data Processing Register of the Data Protection Commission under DVR No. DVR: *7*3*1, which is on file with the Data Protection Authority. 3. Following complaints from the complainant and because the complainant raised suspicions of coercion, the respondent evaluated the relevant video surveillance recordings on June 26, 2025, and subsequently deleted them, as the suspicion of coercion was not substantiated. The complainant was subsequently informed of this. Evaluation of evidence: As above under point 1. This is further supported by the respondent's statement of October 21, 2025. D. From a legal perspective, this means: 1. Admissibility of the complaint Pursuant to Article 57(4) GDPR, the data protection authority may, in the case of manifestly unfounded or excessive requests, particularly in cases of frequent repetition, charge a reasonable fee based on administrative costs or refuse to act on the request. Pursuant to Article 57(4) GDPR, the data protection authority may, in the case of manifestly unfounded or excessive requests, particularly in cases of frequent repetition, charge a reasonable fee based on administrative costs or refuse to act on the request. In its judgment of January 9, 2025, C-416/23, the CJEU clarified that the term "request" also includes a complaint within the meaning of Article 77 of the GDPR. Furthermore, the CJEU clarified that a mere accumulation of complaints is not sufficient to establish the existence of the purpose limitation requirement; rather, the requesting party must also demonstrate an intent to abuse the data, which the supervisory authority must prove. Furthermore, the CJEU clarified that a mere accumulation of complaints is insufficient to establish the existence of the purpose limitation requirement, but that the requesting party must also have an intent to abuse the data, which the supervisory authority must prove. An intent to abuse the system is particularly likely to be assumed if the complaining party raises the complaints to achieve a purpose not protected by data protection regulations (such as publicity, hostility, or sensationalism) (see Austrian Administrative Court [VwGH] 29.01.2025, Ro 2023/04/0018, para. 17). An intent to abuse the system is particularly likely to be assumed if the complaining party raises the complaints to achieve a purpose not protected by data protection regulations (such as publicity, hostility, or sensationalism) (see Austrian Administrative Court [VwGH] 29.01.2025, Ro 2023/04/0018, para. 17). A complaint can be deemed manifestly unfounded if it has no connection whatsoever to data protection issues or violations; in other words, if the complaint, in conjunction with the relief sought, pursues a (legal protection) interest that is not subject to data protection regulations from the outset (Austrian Administrative Court [VwGH] 29 January 2025, Ra 2020/04/0084). As can be seen from the case file, the complaint is primarily based on the fact that the complainant was refused payment by credit card at a staffed checkout against his will and was directed to a self-service checkout. At its core, therefore, the matter—a customer complaint—has no inherent connection to data protection law. Since the video surveillance system containing recordings of the complainant was also reviewed during the correspondence following the incident, the complainant's data protection rights are affected insofar as the question of the lawful evaluation of the footage is at issue. The complaint is therefore just barely admissible, which is why the data protection authority is obligated to review and decide on it. 2. On the merits As stated above, the respondent operates a video surveillance system at its branch in **** Ä***dorf, which recorded the complainant during the payment process. Since the complainant was indisputably and clearly identified, and the data processing was also automated, the GDPR is applicable both materially and territorially (Articles 2, 3, and 4, paragraphs 1 and 2, GDPR). The purpose of the aforementioned video surveillance system is—also undisputed—among other things, the prevention of criminal offenses. According to the established case law of the Data Protection Authority, video surveillance can be based on legitimate interests within the meaning of Article 6(1)(f) GDPR for the prevention of criminal offenses (decision of May 19, 2025, file number 2025-0.327.266, RIS with further references). The admissibility of evaluating video surveillance footage containing personal data is determined and limited by the purpose of the data processing. Accordingly, evaluation is only permissible to the extent and for as long as it is covered by the purpose of the data processing. ``` `````````````````````````````````````````````````````````````````` ... In the present case, the complainant unequivocally stated to the respondent that he felt coerced by the behavior of the staff at the checkout (see, for example, "I will absolutely not be COERCED into using a payment method by YOUR company!!!"; letter to the respondent dated September 19, 2025; "The employee explicitly pointed out several times that card payment was ONLY possible at the self-service checkout. Thus, I was forced to use it if I wanted to. To avoid this, I paid in CASH. This is just as much COERCION!!!"; letter to the respondent dated September 22, 2025; all as in the original). In the present case, the complainant unequivocally stated to the respondent that he felt coerced by the behavior of the staff at the checkout (see, for example, "I will absolutely not be COERCED into using a payment method by YOUR company!!!"); Letter to the respondent dated September 19, 2025: “The employee explicitly pointed out several times that card payment was ONLY possible at the self-service checkout. Therefore, I was forced to use this option if I wanted to. To avoid this, I paid in CASH. This is also COERCION!!!”; Letter to the respondent dated September 22, 2025 (everything as in the original). In light of the correspondence between the appellant and the respondent contained in the case file, there can be no question of any possible slip of the tongue. Since there was thus a suspicion of a criminal offense (coercion within the meaning of Section 105 of the Austrian Criminal Code) on the part of the respondent's employees, the evaluation of the relevant image material is justified – contrary to the appellant's assertions – as it was covered by the purpose of the data processing. Such an evaluation could be carried out even without the complainant's consent. Since the suspicion of a criminal offense (coercion within the meaning of Section 105 of the German Criminal Code) on the part of the respondent's employees existed, the evaluation of the relevant image material is justified—contrary to the complainant's assertions—as it was covered by the purpose of the data processing. Such an evaluation could also be carried out without the complainant's consent. Furthermore, the evaluation was conducted to the extent absolutely necessary, and the images were deleted after the evaluation. The complaint is therefore unfounded.
