[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f08ja8V1gmiF_AYZgC4j8_A1llDetiKsn6Diu_V2Le04":3},{"article":4,"iocs":44},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":26},"2b787dd6-3a25-47a8-b6b2-09f7baf6328f","BVwG - W252 2289522-1","bvwg-w252-2289522-1-2e7823","← Older revision Revision as of 07:44, 17 June 2026 (One intermediate revision by the same user not shown) Line 78: Line 78: }} }} A court held that a broadcaster violated the data subject's right to confidentiality by recording a service-line call without a valid legal basis under [[Article 6 GDPR|Article 6 GDPR]]. A court held that a public broadcaster violated a caller's right to confidentiality by recording a service-line call without a valid legal basis under [[Article 6 GDPR]]. == English Summary == == English Summary == === Facts === === Facts === In December 2023, callers to a service telephone number operated by a broadcaster (the controller) heard an automated message stating that calls were recorded and could also be broadcast. In December 2023, callers to a service telephone number operated by a public broadcaster (the controller) heard an automated message stating that calls were recorded and could also be broadcast. Several times during December 2023, the data subject called the service number. The controller recorded the call. Several times during December 2023, the data subject called the service number. The controller recorded the call. Line 104: Line 104: Finally, the court rejected [[Article 6 GDPR#1a|Article 6(1)(a) GDPR]]. The court noted that consent requires an active indication of agreement and that the controller must be able to demonstrate it under [[Article 7 GDPR#1|Article 7(1) GDPR]]. The fact that the data subject called the service number again after hearing the recording notice did not constitute valid consent. The broadcaster failed to prove that the data subject had actively agreed to the recording. Finally, the court rejected [[Article 6 GDPR#1a|Article 6(1)(a) GDPR]]. The court noted that consent requires an active indication of agreement and that the controller must be able to demonstrate it under [[Article 7 GDPR#1|Article 7(1) GDPR]]. The fact that the data subject called the service number again after hearing the recording notice did not constitute valid consent. The broadcaster failed to prove that the data subject had actively agreed to the recording. The court therefore upheld the DPA's decision and held that the recording lacked a valid legal basis under [[Article 6 GDPR|Article 6 GDPR]]. The court therefore upheld the DPA's decision and held that the recording lacked a valid legal basis under [[Article 6 GDPR]]. == Comment == == Comment ==","An Austrian court ruled that a public broadcaster violated a caller's right to confidentiality by recording a service-line call. The court found that the automated message stating calls were recorded did not constitute valid consent under Article 6 GDPR, as consent requires an active indication of agreement. The broadcaster failed to prove the data subject had actively agreed to the recording, thus lacking a legal basis.","Court rules broadcaster violated privacy by recording service calls without valid consent.","Help BVwG - W252 2289522-1: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 07:20, 13 June 2026 view sourceAvalang (talk | contribs)81 edits Tag: submission [1.0] Latest revision as of 07:44, 17 June 2026 view source Ds (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators94 editsmTag: Visual edit (One intermediate revision by the same user not shown)Line 78: Line 78: }}}} A court held that a broadcaster violated the data subject's right to confidentiality by recording a service-line call without a valid legal basis under [[Article 6 GDPR|Article 6 GDPR]].A court held that a public broadcaster violated a caller's right to confidentiality by recording a service-line call without a valid legal basis under [[Article 6 GDPR]]. == English Summary ==== English Summary == === Facts ====== Facts === In December 2023, callers to a service telephone number operated by a broadcaster (the controller) heard an automated message stating that calls were recorded and could also be broadcast.In December 2023, callers to a service telephone number operated by a public broadcaster (the controller) heard an automated message stating that calls were recorded and could also be broadcast. Several times during December 2023, the data subject called the service number. The controller recorded the call.Several times during December 2023, the data subject called the service number. The controller recorded the call. Line 104: Line 104: Finally, the court rejected [[Article 6 GDPR#1a|Article 6(1)(a) GDPR]]. The court noted that consent requires an active indication of agreement and that the controller must be able to demonstrate it under [[Article 7 GDPR#1|Article 7(1) GDPR]]. The fact that the data subject called the service number again after hearing the recording notice did not constitute valid consent. The broadcaster failed to prove that the data subject had actively agreed to the recording.Finally, the court rejected [[Article 6 GDPR#1a|Article 6(1)(a) GDPR]]. The court noted that consent requires an active indication of agreement and that the controller must be able to demonstrate it under [[Article 7 GDPR#1|Article 7(1) GDPR]]. The fact that the data subject called the service number again after hearing the recording notice did not constitute valid consent. The broadcaster failed to prove that the data subject had actively agreed to the recording. The court therefore upheld the DPA's decision and held that the recording lacked a valid legal basis under [[Article 6 GDPR|Article 6 GDPR]].The court therefore upheld the DPA's decision and held that the recording lacked a valid legal basis under [[Article 6 GDPR]]. == Comment ==== Comment == Latest revision as of 07:44, 17 June 2026 BVwG - W252 2289522-1 Court: BVwG (Austria) Jurisdiction: Austria Relevant Law: Article 4(1) GDPR Article 4(7) GDPR Article 5 GDPR Article 6(1)(f) GDPR Article 6(1)(c) GDPR Article 6(1)(a) GDPR Article 6(1)(e) GDPR Article 7 GDPR Decided: 23.04.2026 Published: 02.06.2026 Parties: MP (Data subject) BF (controller) National Case Number\u002FName: W252 2289522-1 European Case Law Identifier: ECLI:AT:BVWG:2026:W252.2289522.1.00 Appeal from: DSB Appeal to: Not appealed Original Language(s): German Original Source: RIS (in German) Initial Contributor: Ava Lang A court held that a public broadcaster violated a caller's right to confidentiality by recording a service-line call without a valid legal basis under Article 6 GDPR. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts In December 2023, callers to a service telephone number operated by a public broadcaster (the controller) heard an automated message stating that calls were recorded and could also be broadcast. Several times during December 2023, the data subject called the service number. The controller recorded the call. On 12 December 2023 and again on 18 December 2023, the data subject complained to the DPA that the controller recorded calls without obtaining consent. The controller argued that the recordings formed part of its statutory quality-assurance obligations. It relied on national legislation requiring it to maintain a quality-assurance system and submitted that the recordings supported that objective. During the proceedings, it also stated that it would adapt its system so that future callers could prevent or interrupt recordings. The DPA upheld the complaint and found that the recording violated the data subject's right to confidentiality. The controller appealed to the Federal Administrative Court. Holding First, the court held that the recording constituted processing of personal data and that the broadcaster acted as controller under Article 4(7) GDPR. Second, the court rejected the broadcaster's reliance on Article 6(1)(c) GDPR. Although national law required the broadcaster to operate a quality-assurance system, the court found that those provisions did not impose a sufficiently specific legal obligation to record callers. Recording service-line calls was not necessary to fulfil the statutory quality-assurance requirements, which could be achieved through other measures such as representative audience surveys, studies and audience consultations. Third, the court rejected using Article 6(1)(e) GDPR as a basis. While the broadcaster's quality-assurance activities served a task in the public interest, recording callers was not necessary for carrying out that task because less intrusive alternatives were available. Fourth, the court rejected Article 6(1)(f) GDPR. The court accepted that the broadcaster had a legitimate interest in maintaining and improving the quality of its public-service activities. However, it found that recording callers was not necessary for achieving that objective. Referring to the principle of data minimisation in Article 5(1)(c) GDPR, the court held that the same purpose could be achieved through less intrusive methods. Finally, the court rejected Article 6(1)(a) GDPR. The court noted that consent requires an active indication of agreement and that the controller must be able to demonstrate it under Article 7(1) GDPR. The fact that the data subject called the service number again after hearing the recording notice did not constitute valid consent. The broadcaster failed to prove that the data subject had actively agreed to the recording. The court therefore upheld the DPA's decision and held that the recording lacked a valid legal basis under Article 6 GDPR. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Decision Date April 23, 2026 Legal Norm Federal Constitutional Law (B-VG) Art. 133 para. 4 General Data Protection Regulation (GDPR) Art. 4 no. 1 General Data Protection Regulation (GDPR) Art. 4 no. 7 General Data Protection Regulation (GDPR) Art. 5 General Data Protection Regulation (GDPR) Art. 6 para. 1 lit. a General Data Protection Regulation (GDPR) Art. 6 para. 1 lit. c General Data Protection Regulation (GDPR) Art. 6 para. 1 lit. f General Data Protection Regulation (GDPR) Art. 7 Federal Constitutional Law (B-VG) Art. 133 currently in force; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019 to May 24, 2018, last amended by Federal Law Gazette I No. 138\u002F2017; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019, last amended by Federal Law Gazette I No. 22\u002F2018; Federal Constitutional Law (B-VG) Art. 133 valid from May 25, 2018 to December 31, 2018, last amended by Federal Law Gazette I No. 22\u002F2018 B-VG Art. 133 valid from 01.08.2014 to 24.05.2018, last amended by BGBl. I No. 164\u002F2013; B-VG Art. 133 valid from 01.01.2014 to 31.07.2014, last amended by BGBl. I No. 51\u002F2012; B-VG Art. 133","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=BVwG_-_W252_2289522-1&diff=51893&oldid=51870","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-06-17T07:44:29+00:00","2026-06-17T08:00:25.385094+00:00",7,[18],{"name":19,"type":20},"public broadcaster","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":21,"icon":23,"name":24,"slug":25},null,"Policy","policy",[27,32,37,39],{"category":28},{"id":29,"icon":23,"name":30,"slug":31},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":33},{"id":34,"icon":23,"name":35,"slug":36},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":38},{"id":21,"icon":23,"name":24,"slug":25},{"category":40},{"id":41,"icon":23,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]