BVwG - W298 2323263-1/11E

Summary

An Austrian court (BVwG) upheld a decision by the Austrian DPA that a company violated GDPR by recording client conversations without proper prior consent. The company's representative recorded audio during a meeting that captured personal data (names, email addresses, social media accounts, education details), but only informed the data subjects of the recording clause after the recording had already begun, via contractual documents presented during the meeting. The court rejected arguments based on consent (Article 6(1)(a) and Article 7 GDPR) and legitimate interest (Article 6(1)(f) GDPR), finding the company also breached information obligations under Article 13 GDPR and that secret audio recordings are generally unlawful except in exceptional circumstances.

Full text

Help BVwG - W298 2323263-1/11E: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 10:05, 5 May 2026 view sourceDs (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators12 edits Tag: submission [1.0] Latest revision as of 15:06, 5 May 2026 view source Ds (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators12 editsmTag: Visual edit Line 78: Line 78: During the meeting, the representative made an audio recording. The recording captured the conversation with the data subjects and also included information such as an email address, names, social media account names, information about education, and conversations involving other persons nearby. The meeting took place without physical separation from the rest of the office.During the meeting, the representative made an audio recording. The recording captured the conversation with the data subjects and also included information such as an email address, names, social media account names, information about education, and conversations involving other persons nearby. The meeting took place without physical separation from the rest of the office. The representative presented contractual documents during the meeting. These documents contained a clause stating that, for quality improvement purposes, the client consented to the recording of all conversations and to the taking of photographs when placing an order. The data subjects were informed about the recording clause only during the meeting. They stated that they had not been aware at the beginning that the ongoing conversation was being recorded.The representative presented contractual documents during the meeting and one of the data subjects signed the documents. These documents contained a clause stating that, for quality improvement purposes, the client consented to the recording of all conversations and to the taking of photographs when placing an order. The data subjects were informed about the recording clause only during the meeting. They stated that they had not been aware at the beginning that the ongoing conversation was being recorded. The data subjects filed a complaint with the Austrian DPA. The DPA first found that the controller had violated their right to confidentiality by recording the conversation without prior consent, nor overriding legitimate interest.The data subjects filed a complaint with the Austrian DPA. The DPA first found that the controller had violated their right to confidentiality by recording the conversation without prior consent, nor overriding legitimate interest. Line 93: Line 93: The court rejected the controller’s argument that the processing only began after the meeting because the data was stored only then. It noted that the controller’s representative had admitted that the recording had started before the conversation started and that more than five minutes had passed before any reference was made to the privacy policy.The court rejected the controller’s argument that the processing only began after the meeting because the data was stored only then. It noted that the controller’s representative had admitted that the recording had started before the conversation started and that more than five minutes had passed before any reference was made to the privacy policy. The court stated that the controller couldn’t rely on consent under [[Article 6 GDPR#1a|Article 6(1)(a) GDPR]] and [[Article 7 GDPR|Article 7 GDPR]]. The data subjects were not properly informed about the recording before it began. The reference to the recording clause in the contractual documents was made only during the conversation, after the recording had already started. The court also considered that the strict requirements for voluntary consent were not met, especially because the alleged consent was linked to contractual documents.The court stated that the controller couldn’t rely on consent under [[Article 6 GDPR#1a|Article 6(1)(a) GDPR]] and [[Article 7 GDPR]]. The data subjects were not properly informed about the recording before it began. The reference to the recording clause in the contractual documents was made only during the conversation, after the recording had already started. The court also considered that the strict requirements for voluntary consent were not met, especially because the alleged consent was linked to contractual documents. Moreover, the court held that the controller could not rely on legitimate interests under [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. The controller referred to quality improvement and the possible defence of legal claims. The court pointed out that the purpose of improving quality or supplementing transcripts was excessive and it wasn’t foreseeable that such legal claims would arise. Also, the controller didn’t show that recording the conversation was necessary for those purposes or that less intrusive means wouldn’t have been sufficient. The court also noted that secret audio recordings are generally unlawful and permissible only in exceptional circumstances, which weren’t present in this case. Moreover, the court held that the controller could not rely on legitimate interests under [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. The controller referred to quality improvement and the possible defence of legal claims. The court pointed out that the purpose of improving quality or supplementing transcripts was excessive and it wasn’t foreseeable that such legal claims would arise. Also, the controller didn’t show that recording the conversation was necessary for those purposes or that less intrusive means wouldn’t have been sufficient. The court also noted that secret audio recordings are generally unlawful and permissible only in exceptional circumstances, which weren’t present in this case. Τhe court additionally found that the controller hadn’t complied with its information obligations under [[Article 13 GDPR|Article 13 GDPR]]. The required information had to be provided at the time of data collection. Providing information only after a recorded conversation had already begun couldn’t retroactively cure the failure to inform the data subjects in time.Τhe court additionally found that the controller hadn’t complied with its information obligations under [[Article 13 GDPR]]. The required information had to be provided at the time of data collection. Providing information only after a recorded conversation had already begun couldn’t retroactively cure the failure to inform the data subjects in time. The court also upheld the assessment of fault. It considered that the controller, through its representative, recorded the conversation without a legal basis and without providing prior information. The court accepted the DPA’s view that the conduct was intentional or at least negligent.The court also upheld the assessment of fault. It considered that the controller, through its representative, recorded the conversation without a legal basis and without providing prior information. The court accepted the DPA’s view that the conduct was intentional or at least negligent. Latest revision as of 15:06, 5 May 2026 BVwG - W298 2323263-1/11E Court: BVwG (Austria) Jurisdiction: Austria Relevant Law: Article 4(1) GDPR Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 7 GDPR Article 13 GDPR Decided: 24.03.2026 Published: Parties: National Case Number/Name: W298 2323263-1/11E European Case Law Identifier: Appeal from: DSBD124.2010/24; 2025-0.165.616 Appeal to: Original Language(s): German Original Source: RIS (in German) Initial Contributor: ds A court upheld a €6,300 fine against an advertising company for secretly recording a business meeting without a valid legal basis and without informing the data subjects before the recording started. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The control

Entities