The amount of a administrative fine for a violation of the General Data Protection Regulation (“GDPR”) does not depend solely on the severity of the infringement committed. When determining the amount of the fine, the circumstances of the specific case are also taken into account, including the duration of the infringement, the conduct of the controller, the measures taken, and the economic size of the company.
How these criteria are applied in practice is demonstrated by a Decision of the Austrian Federal Administrative Court (Bundesverwaltungsgericht) of 3 September 2026, by which a administrative fine imposed on a company for unlawfully recording telephone conversations was reduced from EUR 25,500 to EUR 22,000.
Unlawful Recording of Conversations with Job Applicants
A company engaged in digital marketing and recruiting candidates for other employers recorded telephone conversations with job applicants for the purpose of internal employee training. The recording was carried out on the instructions of a superior, and the candidates were not informed about it in a timely manner. Furthermore, the recordings were stored without a specified retention period.
The Austrian Data Protection Authority established that the company had violated several provisions of the GDPR, including the rules on the lawfulness of processing, data minimisation, storage limitation, and the obligation to inform the individuals whose data were being processed.
The company did not dispute the unlawfulness of the processing, but only the amount of the administrative fine imposed.
Which Circumstances Influenced the Court’s Decision?
The court confirmed that the infringement was of medium severity. The unlawful processing lasted almost four months, covered all conversations with candidates conducted during that period, and involved several types of personal data, such as names, education, and professional experience.
The fact that the recordings were used exclusively for internal training, without being disclosed to third parties, was not sufficient to classify the infringement as insignificant.
Nevertheless, when determining the amount of the administrative fine, the court also took into account circumstances that were favourable to the company:
The court also considered the company’s previous conduct in the field of data protection. However, the existence of internal policies, training, and other standard compliance measures did not, in itself, constitute grounds for a further reduction of the administrative fine.
Furthermore, the court did not accept the argument that the administrative fine should be reduced because no specific material damage had been proven. It pointed out that the loss of control over personal data may also constitute non-material damage.
What Does This Decision Mean for Companies?
The Decision confirms that administrative fines under the GDPR are not determined automatically, but on the basis of all relevant circumstances of the specific case. Under the GDPR, administrative fines must be effective, proportionate, and dissuasive, and their amount must correspond to the severity of the infringement and the circumstances in which it occurred.
For companies, it is particularly important that measures taken after an infringement is discovered may be relevant when determining the amount of the administrative fine, but they do not eliminate liability for an infringement that has already occurred. At the same time, the mere fact that a company has an established data protection system does not mean that its fine will automatically be reduced.
The case is also significant from the perspective of the lawfulness of recording business conversations. Even when recordings are used exclusively for internal purposes, such as employee training, it is necessary to establish an appropriate legal basis in advance, ensure that individuals are informed in a timely manner, and determine an appropriate retention period for the recordings.
The Decision is also relevant for companies in Serbia, given that the domestic Law on Personal Data Protection contains criteria for determining administrative fines for misdemeanours that are, to a significant extent, based on the GDPR. Although European case law is not binding on domestic authorities, it may serve as a useful point of reference for interpreting certain criteria and assessing the severity of an infringement.
Author:
Borinka Dobrnjac Senior Associate at PR Legal
borinka.dobrnjac@prlegal.rs