BVwG - W258 2227269-1/39E

Summary

Austria's Data Protection Authority (DSB) fined the Austrian Postal Service €18M in 2019 for unlawfully processing political party affinity data on 2.2 million people without explicit consent under GDPR Article 9. After multiple appeals, Austria's Supreme Administrative Court (VwGH) reduced the fine to €13M on 1 February 2024, confirming the gross negligence but finding that the lack of a Data Protection Impact Assessment (DPIA) was subsumed by other violations. The case illustrates GDPR enforcement on sensitive data processing and the limits of national derogations.

Full text

Help BVwG - W258 2227269-1/39E: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 08:19, 20 February 2025 view sourceAo (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators477 editsmTag: Visual edit← Older edit Latest revision as of 09:27, 29 July 2026 view source Ds (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators240 editsmTag: Visual edit (2 intermediate revisions by the same user not shown)Line 57: Line 57: |Appeal_From_Status=|Appeal_From_Status= |Appeal_From_Link=https://gdprhub.eu/index.php?title=DSB_(Austria)_-_Austrian_Postal_Service|Appeal_From_Link=https://gdprhub.eu/index.php?title=DSB_(Austria)_-_Austrian_Postal_Service |Appeal_To_Body=|Appeal_To_Body=Verwaltungsgerichtshof - VwGH |Appeal_To_Case_Number_Name=|Appeal_To_Case_Number_Name=Ro 2025/04/0007-7 |Appeal_To_Status=|Appeal_To_Status=Appeal - Partly Confirmed |Appeal_To_Link=|Appeal_To_Link=https://gdprhub.eu/index.php?title=VwGH_-_VwGH_Ro_2025/04/0007-7 |Initial_Contributor=ao|Initial_Contributor=ao Line 77: Line 77: One of these affinities was concluded through an affinity score concerning the main political parties in Austria. For example, data subjects would be assessed with either a “very low”, “low”, “high” or “very high” affinity towards the SPÖ (the Socialist Party of Austria), the ÖVP (the Conservative Party of Austria) or any other major political party. The controller calculated this score through combing anonymous survey results, socio-demographic data (e.g., age or level of income and education) and voting results of particular region. One of these affinities was concluded through an affinity score concerning the main political parties in Austria. For example, data subjects would be assessed with either a “very low”, “low”, “high” or “very high” affinity towards the SPÖ (the Socialist Party of Austria), the ÖVP (the Conservative Party of Austria) or any other major political party. The controller calculated this score through combing anonymous survey results, socio-demographic data (e.g., age or level of income and education) and voting results of particular region. On the 20 Febuary 2019, the DSB alleged that the controller had unlawfully processed sensitive data under [[Article 9 GDPR|Article 9 GDPR]]. The DSB found that the controller could not rely on a legal basis for the processing of this data and that the controller had sold the data to third parties. The DSB issued a fine of fine of €18,000,000 for the processing of sensitive data and other violations. The full details can be found [[BVwG - W258 2217446-1|here]]. On the 20 Febuary 2019, the DSB alleged that the controller had unlawfully processed sensitive data under [[Article 9 GDPR]]. The DSB found that the controller could not rely on a legal basis for the processing of this data and that the controller had sold the data to third parties. The DSB issued a fine of fine of €18,000,000 for the processing of sensitive data and other violations. The full details can be found [[BVwG - W258 2217446-1|here]]. On the 25 November 2019, the controller appealed the decision of the DSB to the Austrian Federal Administrative Court (''[[:Category:BVwG (Austria)|Bundesverwaltungsgericht – BVwG]]'') and alleged that the DSB had inadequately assessed the situation. On the 26 November, the BVwG annulled the decision of the DSB stating that the DSB had failed to name a natural person to whom the actions of the controller could be attributed to. Based on an Austrian provision, namely paragraph [https://www.ris.bka.gv.at/eli/bgbl/1950/172/P45/NOR12058375 45(1)(3) of the Administrative Penal Code] (''Verwaltungsstrafgesetz - VStG''), in order to fine a legal person for a violation of the GDPR all necessary requirements for the penalization of a natural person must be fulfilled. On the 25 November 2019, the controller appealed the decision of the DSB to the Austrian Federal Administrative Court (''[[:Category:BVwG (Austria)|Bundesverwaltungsgericht – BVwG]]'') and alleged that the DSB had inadequately assessed the situation. On the 26 November, the BVwG annulled the decision of the DSB stating that the DSB had failed to name a natural person to whom the actions of the controller could be attributed to. Based on an Austrian provision, namely paragraph [https://www.ris.bka.gv.at/eli/bgbl/1950/172/P45/NOR12058375 45(1)(3) of the Administrative Penal Code] (''Verwaltungsstrafgesetz - VStG''), in order to fine a legal person for a violation of the GDPR all necessary requirements for the penalization of a natural person must be fulfilled. This finding was however annulled by the Supreme Administrative Court (''[[:Category:VwGH (Austria)|Verwaltungsgerichtshof – VwGH]]'') on the 1 February 2024. The VwGH explained that although the BVwG correctly applied the national provision, the CJEU case [[BlnBDI (Berlin) - C-807/21 - Deutsche Wohnen|C-807/21]] ''Deutsche Wohnen'' showed that [[Article 58 GDPR#2i|Article 58(2)(i) GDPR]] and [[Article 83 GDPR|Article 83 GDPR]] are excluded from national derogations. Therefore, the BVwG should not have applied the national provision. The case was therefore reverted back to the BVwG.This finding was however annulled by the Supreme Administrative Court (''[[:Category:VwGH (Austria)|Verwaltungsgerichtshof – VwGH]]'') on the 1 February 2024. The VwGH explained that although the BVwG correctly applied the national provision, the CJEU case [[BlnBDI (Berlin) - C-807/21 - Deutsche Wohnen|C-807/21]] ''Deutsche Wohnen'' showed that [[Article 58 GDPR#2i|Article 58(2)(i) GDPR]] and [[Article 83 GDPR]] are excluded from national derogations. Therefore, the BVwG should not have applied the national provision. The case was therefore reverted back to the BVwG. === Holding ====== Holding === Line 113: Line 113: == Comment ==== Comment == ''Share your comments here!''''Following the controller's appeal before the Supreme Administrative Court, it reduced the fine to €13,000,000. The Supreme Administrative Court upheld the finding that the controller had grossly negligently processed political party affinity data of 2,200,000 people without explicit consent but held that the failure to perform a DPIA was consumed by other violations. Check the decision [https://gdprhub.eu/index.php?title=VwGH_-_VwGH_Ro_2025/04/0007-7 here].'' == Further Resources ==== Further Resources == Latest revision as of 09:27, 29 July 2026 BVwG - W258 2227269-1/39E Court: BVwG (Austria) Jurisdiction: Austria Relevant Law: Article 5(1)(a) GDPR Article 6(4) GDPR Article 9 GDPR Article 35 GDPR Article 30(1)(c) GDPR Decided: 27.12.2024 Published: 14.02.2025 Parties: National Case Number/Name: W258 2227269-1/39E European Case Law Identifier: ECLI:AT:BVWG:2024:W258.2227269.1.01 Appeal from: DSB (Austria)D550.148/0017-DSB/2019 Appeal to: Appeal - Partly ConfirmedVerwaltungsgerichtshof - VwGHRo 2025/04/0007-7 Original Language(s): German Original Source: RIS (in German) Initial Contributor: ao A court partially upheld a decision by the DPA on the unlawful processing of data subjects’ estimated political affiliation by the Austrian postal service. The court reduced the fine from €18 million to €16 million. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts On the 8 January 2019, the Austrian DPA (Datenschutzbehörde – DSB) launched an investigation into the actions of the Austrian postal service as it also had a business license for address publishing and direct marketing. Media reports had claimed that the postal service (the controller) sold data concerning the political affinities of data subjects to third parties. The controller ran a platform entitled “Adress Shop” on which it sold personal data to legal entities. The datasets included names and addresses but more importantly it included data subjects’ affinities to

Entities