[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-mm-VVlShgH6kbChhNCczC3-3zfiEq-DzVGBXIMU6tA":3},{"article":4,"iocs":45},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":24,"category":25,"article_tags":29},"77737722-a4dc-43a8-91ca-aa52707e9121","VwGH - VwGH Ro 2025\u002F04\u002F0007-7","vwgh-vwgh-ro-2025-04-0007-7-30880b","Fixed link ← Older revision Revision as of 08:03, 8 October 2026 Line 94: Line 94: |Appeal_From_Body=Bundesverwaltungsgericht - BVwG |Appeal_From_Body=BVwG (Austria) |Appeal_From_Case_Number_Name=W258 2227269-1\u002F39E |Appeal_From_Case_Number_Name=W258 2227269-1\u002F39E |Appeal_From_Status= |Appeal_From_Status=","The Austrian Supreme Administrative Court (VwGH) reduced a GDPR fine imposed on an address publisher from €18,000,000 to €13,000,000. The court upheld the finding that the company had negligently processed sensitive political party affinity data for 2.2 million individuals without explicit consent. However, it determined that the failure to conduct a Data Protection Impact Assessment (DPIA) was subsumed by other violations, leading to the reduction.","Austrian court reduces GDPR fine for address publisher from €18M to €13M.","Help VwGH - VwGH Ro 2025\u002F04\u002F0007-7: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 08:24, 3 August 2026 view sourceMba (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators991 editsm Tag: Visual edit← Older edit Latest revision as of 08:03, 8 October 2026 view source Sfl (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators620 editsm Tag: Visual edit Line 94: Line 94: |Appeal_From_Body=Bundesverwaltungsgericht - BVwG|Appeal_From_Body=BVwG (Austria) |Appeal_From_Case_Number_Name=W258 2227269-1\u002F39E|Appeal_From_Case_Number_Name=W258 2227269-1\u002F39E |Appeal_From_Status=|Appeal_From_Status= Latest revision as of 08:03, 8 October 2026 VwGH - VwGH Ro 2025\u002F04\u002F0007-7 Court: VwGH (Austria) Jurisdiction: Austria Relevant Law: Article 83(4) GDPR Article 83(5) GDPR Article 83(6) GDPR Article 5(1)(a) GDPR Article 9(1) GDPR Article 30 GDPR Article 35 GDPR Decided: 24.06.2026 Published: 22.07.2026 Parties: National Case Number\u002FName: VwGH Ro 2025\u002F04\u002F0007-7 European Case Law Identifier: ECLI:AT:VWGH:2026:RO2025040007.J00 Appeal from: BVwG (Austria)W258 2227269-1\u002F39E Appeal to: Not appealed Original Language(s): German Original Source: RIS (in German) Initial Contributor: ds The Supreme Administrative Court reduced a fine against an address publisher from initial €18,000,000 to €13,000,000. It upheld the finding that the company had grossly negligently processed political party affinity data of 2,200,000 people without explicit consent but held that the failure to perform a DPIA was consumed by other violations. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The controller was an address publisher and direct advertising company that operated a data application to provide advertisers with personal data for targeted marketing measures. In 2019, following media reports concerning the alleged sale of personal data, particularly information about natural persons’ political party affinity, the Austrian DPA (DSB) initiated an ex officio investigation against the controller. Based on its investigation, the DPA found that the controller had unlawfully processed political party affinity data and unlawfully further processed parcel-frequency data, and had infringed its obligations concerning the DPIA and record of processing activities. It consequently imposed a fine of €18,000,000. The controller appealed to the Federal Administrative Court (BVwG), arguing that the commission of an infringement by a legal person was not, in itself, sufficient for a fine to be imposed under the GDPR. It claimed that since a legal person could not act on its own, the culpable conduct of a natural person had to be identified and attributed to it. The controller argued that the DPA had failed to establish such attribution. The court agreed and, on 26 November 2020, annulled the fine. It found that the DPA had failed to establish that natural persons acting on behalf of the controller had engaged in culpable conduct. The DPA filed an extraordinary official appeal against this judgment with the Austrian Supreme Administrative Court (VwGH). The court stayed the proceedings pending the CJEU’s preliminary ruling in Case C-807\u002F21 (Deutsche Wohnen SE), as the questions referred in that case were also relevant to the appeal proceedings. The CJEU published its judgement on this matter on 5 December 2023. The CJEU held that a fine under Article 83(4) GDPR, Article 83(5) GDPR and Article 83(6) GDPR may be imposed on anyone who qualifies as a controller where it is established that the controller committed the relevant infringement intentionally or negligently. A controller may be sanctioned where it could not have been unaware of the infringing nature of its conduct, regardless of whether it knew that its conduct infringed the GDPR. The CJEU further clarified that, where the controller is a legal person, the application of Article 83 GDPR does not require any action or knowledge on the part of its governing body. Member States may not impose additional substantive requirements for the imposition of fines beyond those laid down in Article 83 GDPR. For the determination of the fine, the controller may also constitute an undertaking within the meaning of EU competition law, with the turnover of the relevant economic unit being taken into account. Following the CJEU judgment, the Supreme Administrative Court annulled the Federal Administrative Court’s judgment on 1 February 2024. The Federal Administrative Court issued a new judgment on 27 December 2024, largely upholding the infringements but reducing the fine to €16,000,000. The controller appealed this decision before the Supreme Administrative Court. Holding The court found that the controller gathered information concerning the political party affinity of the Austrian population based on anonymous surveys conducted by commissioned polling institutes. These surveys included specific questions concerning interest in election advertising, together with sociodemographic information such as age, level of education and income, place of residence and interest in advertising from political parties. Marketing groups were subsequently formed based on the sociodemographic data and place of residence. For each group, calculations were made to determine the likelihood that an individual with particular sociodemographic characteristics and religious affiliation would be interested in advertising from the political parties concerned. By assigning an identifiable individual to a particular marketing group, the controller linked that person to the probability values calculated for the group and the resulting political party affinity. The court held that the controller did not obtain consent from the data subjects to whom these probability scores were assigned. In total, political party affinity was attributed to approximately 2,200,000 individuals. The court reiterated that political party affinity scores attributed to identifiable individuals constituted personal data revealing political opinions within the meaning of Article 9(1) GDPR. It therefore upheld the finding that the controller had infringed Article 5(1)(a) GDPR in conjunction with Article 9(1) GDPR. In assessing the controller’s culpability, the court relied heavily on the CJEU’s judgment in Deutsche Wohnen SE. It held that the fact that the controller believed it had complied with the GDPR because it had established a quality-assured organisation was not decisive. It pointed out that under GDPR, a legal person’s fault does not require knowledge or awareness on the part of the management body. The establishment of a data protection compliance system, like the obtaining of legal advice, did not in itself exculpate the controller. It stated that the decisive question was whether the controller could have been aware of the unlawfulness of the processing of political party affinity data during the relevant period. The court ruled that the controller had incorrectly assessed that political party affinity scores did not constitute personal data and that it had consequently failed to examine whether they constituted special categories of personal data under Article 9 GDPR. The court rejected the controller’s argument that political party affinity was processed only in relation to groups rather than in relation to specific identifiable individuals. It also rejected the argument that marketing classifications used for political advertising posed no risk to data subjects. The court concluded that given the controller’s resources and its ability to examine the applicable legal position, that legal assessment amounted to gross negligence concerning the infringement of Article 5(1)(a) GDPR in conjunction with Article 9(1) GDPR. Furthermore, the court ruled that the controller’s incorrect a","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=VwGH_-_VwGH_Ro_2025\u002F04\u002F0007-7&diff=53335&oldid=52576","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-10-08T08:03:00+00:00","2026-10-08T10:00:15.999949+00:00",7,[18,21],{"name":19,"type":20},"Data Protection Impact Assessment","product",{"name":22,"type":23},"Austrian DPA","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":24,"icon":26,"name":27,"slug":28},null,"Policy","policy",[30,35,40],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":36},{"id":37,"icon":26,"name":38,"slug":39},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":41},{"id":42,"icon":26,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]