# Bakery Chain: Non-compliance with general data processing principles

- Type: Enforcement
- Source: Austrian Data Protection Authority (dsb)
- Date: 2025-09-05
- Original: https://www.enforcementtracker.com/ETid-2976
- Canonical: https://overview.legal/posts/49091
- Topics: Video Surveillance, Monitoring, Retention Period, IP Address, Controllers, Processing Agreement, Processing, Supervisory Authorities, Data Controller, Law Enforcement

## Summary

The Austrian DPA has imposed a fine of EUR 33,500 on a bakery chain. The controller used video surveillance which affected both public areas and areas intended solely for employees. The cameras were installed and operated in a way that did not comply with the principle of data minimisation and was not based on a sufficient legal basis. Additionally, CCTV footage was distributed via a messaging service.

## Full text

The Austrian DPA has imposed a fine of EUR 33,500 on a bakery chain. The controller used video surveillance which affected both public areas and areas intended solely for employees. The cameras were installed and operated in a way that did not comply with the principle of data minimisation and was not based on a sufficient legal basis. Additionally, CCTV footage was distributed via a messaging service.

GDPR Articles: Art. 5 (1) a), c) GDPR, Art. 6 (1), (4) GDPR
Industry: Industry and Commerce

---
Generated by overview.legal · https://overview.legal/posts/49091 · 2026-08-22