Video surveillance is widespread in everyday business. It often serves to protect against theft, vandalism, or unauthorized access. However, from a data protection perspective, video surveillance is particularly intrusive, especially when public areas or uninvolved individuals are recorded. Particularly when cameras extend into public spaces, a very careful legal review is required.
A local business owner was penalized by the Data Protection Authority for unlawfully recording both a sidewalk and a public parking lot with the video surveillance system installed in his establishment. Furthermore, he was accused of using the recordings for the targeted identification and categorization ("Financial Police" and "Gamblers") of individuals, storing the recordings for an unreasonably long period (18 days), and failing to properly indicate the presence of the video surveillance system. The Data Protection Authority imposed a fine of €3,000 on the business owner, who subsequently appealed to the Administrative Court, but without success. The business owner then appealed to the Administrative Court of Appeal.
The Administrative Court (VwGH) upheld the appeal only against the sentence, reducing the penalty to €1,500.00 due to the five-year duration of the proceedings. However, the VwGH dismissed the appeal against the convictions as unfounded: The specific operation of the video surveillance system violated the principles of lawfulness and data minimization, as no legitimate interests existed and public areas were recorded. The use of the recordings for identification purposes violated the principle of purpose limitation, the 18-day storage period was disproportionate, and the lack of labeling violated the information obligations of the establishment operator. Consequently, the video surveillance was not compliant with the GDPR.
In this ruling, the Austrian Administrative Court (VwGH) underscores the GDPR's strict requirements for video surveillance. While monitoring only private premises is generally considered unproblematic, public areas are prohibited unless legitimate interests outweigh the other considerations. Although the purpose of protecting property is legitimate, identifying authorities or customers without consent is not. Furthermore, appropriate notices must be posted. Consequently, particular caution is advised when positioning cameras: video surveillance is not merely a technical security issue. Anyone recording public areas or uninvolved individuals risks serious GDPR violations.
VwGH 30.04.2025, Ro 2021/04/0024