# Operator of a public toilet: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Austrian Data Protection Authority (dsb)
- Date: 2022-08-23
- Original: https://www.enforcementtracker.com/ETid-1788
- Canonical: https://overview.legal/posts/47903
- Topics: Video Surveillance, Controllers, Monitoring, Processing, Personal Data, Data Controller, Processing Agreement, Supervisory Authorities, Law Enforcement

## Summary

The Austrian DPA has imposed a fine of EUR 25,000 on an operator of a public toilet. The controller had installed a video surveillance camera on the restrooms and secretly recorded people using the toilets. The DPA found that the controller had no legal basis for installing the cameras. In assessing the fine, the fact that the privacy of the data subjects had been significantly violated was taken into account as an aggravating factor.

## Full text

The Austrian DPA has imposed a fine of EUR 25,000 on an operator of a public toilet. The controller had installed a video surveillance camera on the restrooms and secretly recorded people using the toilets. The DPA found that the controller had no legal basis for installing the cameras. In assessing the fine, the fact that the privacy of the data subjects had been significantly violated was taken into account as an aggravating factor.

GDPR Articles: Art. 5 (1) a), b), c) GDPR, Art. 6 (1) f) GDPR, Art. 13 GDPR
Industry: Not assigned

---
Generated by overview.legal · https://overview.legal/posts/47903 · 2026-08-22