In September 2018, the Austrian Data Protection Authority
imposed one of the first penalties for unlawfully operating video
surveillance based on the GDPR in Europe. In its decision, the Data
Protection Authority concluded that a betting shop that used video
surveillance was not only filming the direct entrance to the
business premises of the shop but also the public parking and
traffic areas in front of it, thus going far beyond the area where
filming was necessary to achieve the video's purpose (i.e.
protection of property). In addition, the Data Protection Authority
claimed that the video surveillance was not suitably disclosed, the
statutory maximum storage period of 72 hours for video recordings
was not observed and no protocols were kept of the processing
operations, leading to a total fine of EUR 4,800 imposed by the
Data Protection Authority on the company.
