Content type · 70 documents in this view · 3,811 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Country: Austria (20) Clear filter
Filter by Topic Supervisory Authorities 3587 Processing 2635 Personal Data 2394 Controllers 2017 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
€500,000 Unser Ö-Bonus Club GmbH: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 2,000,000 on Rewe affiliate Ö-Bonus Club GmbH. When signing up for the customer loyalty program jö Bonus Club, the controller is said to… AUSTRIA · ·Art. 6, 7, 12 Aug 2, 2021
€3,000 AUSTRIA DPA: Insufficient cooperation with supervisory authority The Austrian DPA has fined a company EUR 3,000 for failing to provide information requested by the DPA during an investigation. ·Art. 31 ·Insufficient cooperation with supervisory authority Feb 12, 2021
€700,000 Customer loyalty program: €700,000 fine According to the newspaper 'Der Standard', the Austrian DPA has imposed a fine of EUR 1.2 million on a customer loyalty program in 2021. Further information has not yet been… AUSTRIA · ·Unknown Jan 1, 2021
€600 Private individual: Non-compliance with general data processing principles The Austrian DPA imposed a fine of EUR 600 on a private individual. The individual had contacted a public institution to draw their attention to the fact that the statement of a… AUSTRIA · ·Art. 5, 9 Jan 1, 2021
Private individual: Non-compliance with general data processing principles The Austrian DPA has fined a private individual. The individual had installed a video surveillance system which, among other things, also recorded the public space and stored the… AUSTRIA · ·Art. 5 Jan 1, 2021
€4M Bank: Insufficient technical and organisational measures to ensure information security Original fine summary: The Austrian DPA has imposed a fine of EUR 4,000,000 on a credit institution. The controller had stored an Excel file containing personal data, such as… AUSTRIA · ·Art. 5, 32 Jan 1, 2021
DSB Austria: Restaurant contact-tracing data collected for COVID-19 qualifies as health The data subject (customer) filed a complaint against a Viennese restaurant claiming a violation of § 1 Austrian Data Protection Act (Datenschutzgesetz - DSG) and Article 6 GDPR:… 2020-0.743.659 ·Art. 4, 5, 6 +1 Nov 19, 2020
Austrian DSB: Controller's use of social security number for statutory financial aid was The controller shared the data subject's social security number with a financial service provider in order to provide financial aid, to which the data subject did not consent. On… 2020-0.714.215 ·Austria ·Art. 4, 9 Nov 5, 2020
€150 Private Individual: Insufficient legal basis for data processing The private individual recorded a female person while she was using one of the WC cabins by placing a cell phone (smartphone with camera function) under the WC cabin partition… AUSTRIA · ·Art. 5, 6 Oct 19, 2020
€600 Private Individual: Insufficient legal basis for data processing Between February and June 2020, a private individual published information about patients on his personal Facebook page. The information included health data in terms of Art. 4… AUSTRIA · ·Art. 5, 9 Oct 19, 2020
DSB: online article about former politician is journalistic processing under Art. 85 GDPR In June 2019, the complainant requested erasure of her personal data from the respondent's website, claiming that an article on that website contained wrong statements about her.… 2020-0.303.727 ·Austria ·Art. 17, 85 Sep 1, 2020
€100 Bank: Insufficient legal basis for data processing A bank employee made a copy of the identity card of a bank client who wanted to exchange EUR 100 in foreign currency and justified this with money laundering charges. However,… AUSTRIA · ·Art. 5, 6 Aug 5, 2020
The complainant belongs to a political party and is a member of the city council of an Austrian municipality In November, the municipality held a meeting on the "parking space concept", to which a certain group of addressees, including the complainant, was invited. The complainant did… DSB-D123.768/0004-DSB/201 ·Austria · Dec 18, 2019
€16M Austrian Post: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 16,000,000 on the Austrian Post. The controller had sold information regarding the political affinity to third parties without a… AUSTRIA · ·Art. 5, 6 Oct 29, 2019
€25,000 Company in the medical sector: Insufficient fulfilment of information obligations The (none-final) fine was imposed on a company in the medical sector for non-compliance with information obligations and for not appointing a data protection officer. Update: The… AUSTRIA · ·Art. 13, 35, 37 Aug 1, 2019
€11,000 Private person (soccer coach): Insufficient legal basis for data processing The fine was imposed on a soccer coach who had secretly filmed female players while they were naked in the shower cubicle for years. AUSTRIA · ·Art. 6 Jul 1, 2019
€2,200 Private person: Insufficient legal basis for data processing The fine was imposed against a private person who was using CCTV at his home. The video surveillance covered areas which are intended for the general use of the residents of the… AUSTRIA · ·Art. 5, 6, 13 Dec 20, 2018
€4,800 Betting place: Insufficient fulfilment of information obligations Video surveillance was not sufficiently marked and a large part of the sidewalk of the facility was recorded. Surveillance of the public space in this way, i.e. on a large scale… AUSTRIA · ·Art. 13 Dec 9, 2018
€300 Private car owner: Insufficient legal basis for data processing A Dashcam was unlawfully used. AUSTRIA · ·Art. 5, 6 Sep 27, 2018
€1,800 Kebab restaurant: Insufficient legal basis for data processing CCTV was unlawfully used. Sufficient information about the video surveillance was missing. In addition, the storage period of 14 days was too long and therefore against the… AUSTRIA · ·Art. 5, 13, 14 Jan 1, 2018