.png)
4 hours ago
1
An Austrian judgment on unauthorized video surveillance contains clarifications on the permissibility of video surveillance in the retail sector and a restriction of the Austrian Data Protection Act. According to the judgment, filming PIN keypads at the checkout is completely prohibited. Public areas outside a shop may only be filmed, if at all, within narrow limits and only for authorized purposes.
In addition, organizational measures must be taken before the surveillance cameras are switched on: covering the areas not to be filmed (digital masking) and keeping proper logs. Infringements are subject to fines under the General Data Protection Regulation (GDPR), which are based on the group's turnover, not the turnover of the branch that has violated data protection. This is intended to ensure that companies cannot get off lightly by pointing to the misconduct of individuals in areas far away from the company headquarters.
The Austrian Data Protection Act does contain provisions (sections 12 and 13) that appear to authorize video surveillance in many cases. However, according to the judgment, these paragraphs violate the GDPR and are therefore not applicable.
The case in question
The reason for the recently published judgment by the Austrian Federal Administrative Court (case no. W258 2299744-1/28E) is grossly negligent unlawful video surveillance by Ikea in 2022 at its then new branch next to Vienna's Westbahnhof railway station. The recordings were stored for 72 hours. An anonymous complaint put the Austrian data protection authority on the trail, which then listed a total of 30 legal violations for nine cameras in the checkout and outdoor areas.
Among other things, it criticized three cameras which, according to the data protection authority, filmed the PIN entries of recognizable people at the Ikea checkouts. The authority fined Ikea a total of 1.5 million euros plus 150,000 euros in legal costs, which the furniture retailer appealed against. The theoretical maximum fine would have been almost 1.8 billion euros, or four percent of the group's turnover.
After four oral hearings, the Federal Administrative Court confirmed 28 of the 30 legal violations. Ikea could apply to the Administrative Court (VwGH) for an appeal, as there is still no supreme court judgment on the unapplied sections of the Data Protection Act and on one aspect of the assessment of the penalty.
PIN entries and many passersby filmed
According to the judgment, six cameras recorded certain areas without justification under the General Data Protection Regulation. Seven cameras had too large a field of view, which was not necessary in whole or in part to achieve the stated purpose (checking snow clearance or property protection).
However, only one camera actually filmed the PIN entries of recognizable customers; with the other two cameras, the customers' bodies generally obscured the input field. This realization was of little help to Ikea, as the court did not reduce the fine and contribution to costs. The partial success only saves the company the cost contribution for the appeal proceedings.
The reasoning shows that Ikea filmed a highly frequented public area: Vienna's Westbahnhof railway station attracts many people every day, including at its side gates. A tram station and the exit of an underground station were also recorded. Ikea put the surveillance system into live operation even before the data protection assessment was available.
Immediate measures neglected
In addition, the necessary digital masks for areas not to be filmed were missing, which Ikea failed to notice due to a lack of checks. In court, the furniture store suspected a dismissed employee of having removed the masks as revenge; however, this former employee would not have been able to delete any masks.
Even after the data protection authority requested a statement, the store manager commissioned a review of the video surveillance but did not initiate any immediate measures, such as masking areas that were not to be filmed. Although this would only have taken an hour thanks to remote maintenance, the masks were only installed almost eight weeks later.
The Federal Administrative Court found no material damage for those affected and that the non-material damage was minor. In particular, the filmed PINs were not misused. The cooperation of the furniture store, its integrity, the rectification of the offense, the deletion of the recordings, and the lack of financial benefits had a mitigating effect.
(ds)
