VwGH - VwGH Ro 2025/04/0007-7

Summary

An Austrian data protection authority initially fined a company €18 million for unlawful processing of personal data and other GDPR violations. The fine was annulled by a lower court, which found insufficient evidence of culpable conduct by natural persons. Following a preliminary ruling from the CJEU clarifying that fines can be imposed on legal persons without direct attribution to individuals, the Austrian Supreme Administrative Court annulled the lower court's decision. A subsequent ruling reduced the fine to €16 million.

Full text

Help VwGH - VwGH Ro 2025/04/0007-7: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 08:07, 29 July 2026 view sourceDs (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators240 editsm Tag: Visual edit← Older edit Latest revision as of 09:19, 29 July 2026 view source Ds (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators240 editsm Tag: Visual edit (One intermediate revision by the same user not shown)Line 94: Line 94: |Appeal_From_Body=|Appeal_From_Body=Bundesverwaltungsgericht - BVwG |Appeal_From_Case_Number_Name=|Appeal_From_Case_Number_Name=W258 2227269-1/39E |Appeal_From_Status=|Appeal_From_Status= |Appeal_From_Link=|Appeal_From_Link=https://gdprhub.eu/index.php?title=BVwG_-_W258_2227269-1/39E |Appeal_To_Body=|Appeal_To_Body= Line 115: Line 115: The controller was an address publisher and direct advertising company that operated a data application to provide advertisers with personal data for targeted marketing measures.The controller was an address publisher and direct advertising company that operated a data application to provide advertisers with personal data for targeted marketing measures. In 2019, following media reports concerning the alleged sale of personal data, particularly information about natural persons’ political party affinity, the Austrian DPA (DSB) initiated an ex officio investigation against the controller. Based on its investigation, the DPA found that the controller had unlawfully processed political party affinity data and unlawfully further processed parcel-frequency data, and had infringed its obligations concerning the DPIA and record of processing activities. It consequently imposed a fine of €18,000,000. In 2019, following media reports concerning the alleged sale of personal data, particularly information about natural persons’ political party affinity, the Austrian DPA (DSB) initiated an ex officio investigation against the controller. Based on its investigation, the DPA found that the controller had unlawfully processed political party affinity data and unlawfully further processed parcel-frequency data, and had infringed its obligations concerning the DPIA and record of processing activities. It consequently [https://gdprhub.eu/index.php?title=DSB_(Austria)_-_Austrian_Postal_Service imposed a fine] of €18,000,000. The controller appealed to the Federal Administrative Court (BVwG), arguing that the commission of an infringement by a legal person was not, in itself, sufficient for a fine to be imposed under the GDPR. It claimed that since a legal person could not act on its own, the culpable conduct of a natural person had to be identified and attributed to it. The controller argued that the DPA had failed to establish such attribution. The court agreed and, on 26 November 2020, annulled the fine. It found that the DPA had failed to establish that natural persons acting on behalf of the controller had engaged in culpable conduct.The controller appealed to the Federal Administrative Court (BVwG), arguing that the commission of an infringement by a legal person was not, in itself, sufficient for a fine to be imposed under the GDPR. It claimed that since a legal person could not act on its own, the culpable conduct of a natural person had to be identified and attributed to it. The controller argued that the DPA had failed to establish such attribution. The court agreed and, on 26 November 2020, [https://gdprhub.eu/index.php?title=BVwG_-_W258_2227269-1/14E annulled the fine]. It found that the DPA had failed to establish that natural persons acting on behalf of the controller had engaged in culpable conduct. The DPA filed an extraordinary official appeal against this judgment with the Austrian Supreme Administrative Court (VwGH). The court stayed the proceedings pending the CJEU’s preliminary ruling in [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62021CJ0807 Case C-807/21 (Deutsche Wohnen SE)], as the questions referred in that case were also relevant to the appeal proceedings. The CJEU published its judgement on this matter on 5 December 2023. The DPA filed an extraordinary official appeal against this judgment with the Austrian Supreme Administrative Court (VwGH). The court [https://gdprhub.eu/index.php?title=VwGH_-_Ra_2020/04/0187 stayed the proceedings] pending the CJEU’s preliminary ruling in [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62021CJ0807 Case C-807/21 (Deutsche Wohnen SE)], as the questions referred in that case were also relevant to the appeal proceedings. The CJEU published its judgement on this matter on 5 December 2023. The CJEU held that a fine under [[Article 83 GDPR|Article 83(4) GDPR]], [[Article 83 GDPR|Article 83(5) GDPR]] and Article 83(6) GDPR may be imposed on anyone who qualifies as a controller where it is established that the controller committed the relevant infringement intentionally or negligently. A controller may be sanctioned where it could not have been unaware of the infringing nature of its conduct, regardless of whether it knew that its conduct infringed the GDPR. The CJEU further clarified that, where the controller is a legal person, the application of [[Article 83 GDPR]] does not require any action or knowledge on the part of its governing body. Member States may not impose additional substantive requirements for the imposition of fines beyond those laid down in [[Article 83 GDPR]]. For the determination of the fine, the controller may also constitute an undertaking within the meaning of EU competition law, with the turnover of the relevant economic unit being taken into account.The CJEU held that a fine under [[Article 83 GDPR|Article 83(4) GDPR]], [[Article 83 GDPR|Article 83(5) GDPR]] and Article 83(6) GDPR may be imposed on anyone who qualifies as a controller where it is established that the controller committed the relevant infringement intentionally or negligently. A controller may be sanctioned where it could not have been unaware of the infringing nature of its conduct, regardless of whether it knew that its conduct infringed the GDPR. The CJEU further clarified that, where the controller is a legal person, the application of [[Article 83 GDPR]] does not require any action or knowledge on the part of its governing body. Member States may not impose additional substantive requirements for the imposition of fines beyond those laid down in [[Article 83 GDPR]]. For the determination of the fine, the controller may also constitute an undertaking within the meaning of EU competition law, with the turnover of the relevant economic unit being taken into account. Following the CJEU judgment, the Supreme Administrative Court annulled the Federal Administrative Court’s judgment on 1 February 2024. The Federal Administrative Court issued a new judgment on 27 December 2024, largely upholding the infringements but reducing the fine to €16,000,000. The controller appealed this decision before the Supreme Administrative Court.Following the CJEU judgment, the Supreme Administrative Court annulled the Federal Administrative Court’s judgment on 1 February 2024. The Federal Administrative Court [https://gdprhub.eu/index.php?title=BVwG_-_W258_2227269-1/39E issued a new judgment] on 27 December 2024, largely upholding the infringements but reducing the fine to €16,000,000. The controller appealed this decision before the Supreme Administrative Court. Latest revision as of 09:19, 29 July 2026 VwGH - VwGH Ro 2025/04/0007-7 Court: VwGH (Austria) Jurisdiction: Austria Relevant Law: Article 83(4) GDPR Article 83(5) GDPR Article 83(6) GDPR Article 5(1)(a) GDPR Article 9(1) GDPR Article 30 GDPR Article 35 GDPR Decided: 24.06.2026 Published: 22.07.2026 Parties: National Case Number/Name: VwGH Ro 2025/04/0007-7 European Case Law Identifier: ECLI:AT:VWGH:2026:RO2025040007.J00 Appeal from: Bundesverwaltungsgericht - BVwGW258 222726

Entities