BVwG - W252 2289522-1

Summary

An Austrian broadcaster has been found to have violated a data subject's right to confidentiality by recording service-line calls without a valid legal basis under GDPR. The Federal Administrative Court rejected the broadcaster's arguments that recordings were necessary for quality assurance or public interest, citing less intrusive alternatives and the lack of explicit consent.

Full text

Help BVwG - W252 2289522-1: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 07:20, 13 June 2026 view source Avalang (talk | contribs)78 edits Tag: submission [1.0] (No difference) Latest revision as of 07:20, 13 June 2026 BVwG - W252 2289522-1 Court: BVwG (Austria) Jurisdiction: Austria Relevant Law: Article 4(1) GDPR Article 4(7) GDPR Article 5 GDPR Article 6(1)(f) GDPR Article 6(1)(c) GDPR Article 6(1)(a) GDPR Article 6(1)(e) GDPR Article 7 GDPR Decided: 23.04.2026 Published: 02.06.2026 Parties: MP (Data subject) BF (controller) National Case Number/Name: W252 2289522-1 European Case Law Identifier: ECLI:AT:BVWG:2026:W252.2289522.1.00 Appeal from: DSB Appeal to: Not appealed Original Language(s): German Original Source: RIS (in German) Initial Contributor: Ava Lang A court held that a broadcaster violated the data subject's right to confidentiality by recording a service-line call without a valid legal basis under Article 6 GDPR. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts In December 2023, callers to a service telephone number operated by a broadcaster (the controller) heard an automated message stating that calls were recorded and could also be broadcast. Several times during December 2023, the data subject called the service number. The controller recorded the call. On 12 December 2023 and again on 18 December 2023, the data subject complained to the DPA that the controller recorded calls without obtaining consent. The controller argued that the recordings formed part of its statutory quality-assurance obligations. It relied on national legislation requiring it to maintain a quality-assurance system and submitted that the recordings supported that objective. During the proceedings, it also stated that it would adapt its system so that future callers could prevent or interrupt recordings. The DPA upheld the complaint and found that the recording violated the data subject's right to confidentiality. The controller appealed to the Federal Administrative Court. Holding First, the court held that the recording constituted processing of personal data and that the broadcaster acted as controller under Article 4(7) GDPR. Second, the court rejected the broadcaster's reliance on Article 6(1)(c) GDPR. Although national law required the broadcaster to operate a quality-assurance system, the court found that those provisions did not impose a sufficiently specific legal obligation to record callers. Recording service-line calls was not necessary to fulfil the statutory quality-assurance requirements, which could be achieved through other measures such as representative audience surveys, studies and audience consultations. Third, the court rejected using Article 6(1)(e) GDPR as a basis. While the broadcaster's quality-assurance activities served a task in the public interest, recording callers was not necessary for carrying out that task because less intrusive alternatives were available. Fourth, the court rejected Article 6(1)(f) GDPR. The court accepted that the broadcaster had a legitimate interest in maintaining and improving the quality of its public-service activities. However, it found that recording callers was not necessary for achieving that objective. Referring to the principle of data minimisation in Article 5(1)(c) GDPR, the court held that the same purpose could be achieved through less intrusive methods. Finally, the court rejected Article 6(1)(a) GDPR. The court noted that consent requires an active indication of agreement and that the controller must be able to demonstrate it under Article 7(1) GDPR. The fact that the data subject called the service number again after hearing the recording notice did not constitute valid consent. The broadcaster failed to prove that the data subject had actively agreed to the recording. The court therefore upheld the DPA's decision and held that the recording lacked a valid legal basis under Article 6 GDPR. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Decision Date April 23, 2026 Legal Norm Federal Constitutional Law (B-VG) Art. 133 para. 4 General Data Protection Regulation (GDPR) Art. 4 no. 1 General Data Protection Regulation (GDPR) Art. 4 no. 7 General Data Protection Regulation (GDPR) Art. 5 General Data Protection Regulation (GDPR) Art. 6 para. 1 lit. a General Data Protection Regulation (GDPR) Art. 6 para. 1 lit. c General Data Protection Regulation (GDPR) Art. 6 para. 1 lit. f General Data Protection Regulation (GDPR) Art. 7 Federal Constitutional Law (B-VG) Art. 133 currently in force; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019 to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017; Federal Constitutional Law (B-VG) Art. 133 valid from January 1, 2019, last amended by Federal Law Gazette I No. 22/2018; Federal Constitutional Law (B-VG) Art. 133 valid from May 25, 2018 to December 31, 2018, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 valid from 01.08.2014 to 24.05.2018, last amended by BGBl. I No. 164/2013; B-VG Art. 133 valid from 01.01.2014 to 31.07.2014, last amended by BGBl. I No. 51/2012; B-VG Art. 133 valid from 01.01.2004 to 31.12.2013, last amended by BGBl. I No. 100/2003; B-VG Art. 133 valid from 01.01.1975 to 31.12.2003, last amended by BGBl. No. 444/1974; B-VG Art. 133 valid from 25.12.1946 to December 31, 1974, last amended by Federal Law Gazette No. 211/1946. Federal Constitutional Law, Article 133, valid from December 19, 1945, to December 24, 1946, last amended by State Law Gazette No. 4/1945. Federal Constitutional Law, Article 133, valid from January 3, 1930, to June 30, 1934. Ruling W252 2289522-1/9E IN THE NAME OF THE REPUBLIC! The Federal Administrative Court, through Judge Elisabeth Schmut, LL.M., has ruled... The Federal Administrative Court, with Judge Elisabeth Schmut LL.M. presiding and lay judges Dr. Claudia Rosenmayr-Klemenz and Adriana Mandl, MA, as associate judges, has ruled in a non-public session on the appeal of [Name Redacted], represented by Schönherr Rechtsanwälte GmbH, against the decision of the Data Protection Authority dated March 4, 2024, file number [File Number Redacted], in a data protection matter, as follows: A) The appeal is dismissed. B) An appeal on points of law is not permitted. Text Reasons for the Decision: I. Procedural History: 1. By submission dated December 12, 2023, the now-participating party (hereinafter referred to as MP) filed a data protection complaint with the respondent authority, stating in summary that when it called a specific telephone number of the complaining party (hereinafter referred to as BF), a recorded message played informing it that the call was being recorded and could also be broadcast. 2. On December 13, 2023, the respondent authority issued MP with a request to rectify the deficiencies. 3. By letter dated December 18, 2023, MP explained that it had made a call on December 18, 2023, that this call had been recorded without consent and could be broadcast without consent, and that a corresponding message had played before the recording began. 4. By letter dated January 18, 2024, the BF submitted a statement. 5. By letter dated January 24, 2024, the MP also submitted a statement. 6. By decision dated March 4, 2024, the respondent authority upheld the data protection complaint and determined that the BF had violated the MP's right to confidentiality by calling the BF's service number at 4:35 p.m. on December 18, 2023, and the BF unlawfully recording the MP's telephone conversation. 5. The BF filed an appeal against this decision. 6. The respondent authority dismissed the appeal, attaching the administr

Entities