[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fL4j2bt0IGl5kk4opH5AhEKGg25k4ZuSuzt04xO9xEe8":3},{"article":4,"iocs":53},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":30,"category":31,"article_tags":35},"1f3dd3cd-1ab0-4cf0-8b6f-bdac13c08b8a","VwGH - VwGH Ro 2025\u002F04\u002F0007-7","vwgh-vwgh-ro-2025-04-0007-7-cb4a46","Created page with \"{{COURTdecisionBOX |Jurisdiction=Austria |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=VwGH |Court_Original_Name=Verwaltungsgerichtshof |Court_English_Name=Austrian Administrative Supreme Court |Court_With_Country=VwGH (Austria) |Case_Number_Name=VwGH Ro 2025\u002F04\u002F0007-7 |ECLI=ECLI:AT:VWGH:2026:RO2025040007.J00 |Original_Source_Name_1=RIS |Original_Source_Link_1=https:\u002F\u002Fwww.ris.bka.gv.at\u002FDokumente\u002FVwgh\u002FJWT_2025040007_20260624J00\u002FJWT_2025040007_2026062...\" Show changes","The Austrian Supreme Administrative Court (VwGH) reduced a GDPR fine from €18 million to €13 million against an address publisher and direct advertising company. The company was found to have grossly negligently processed political party affinity data of 2.2 million individuals without explicit consent, violating GDPR provisions.","Austrian court reduces GDPR fine for data publisher to €13M.","Help VwGH - VwGH Ro 2025\u002F04\u002F0007-7: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 11:12, 27 July 2026 view source Ds (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators224 edits Tag: Decisions [1.0] (No difference) Latest revision as of 11:12, 27 July 2026 VwGH - VwGH Ro 2025\u002F04\u002F0007-7 Court: VwGH (Austria) Jurisdiction: Austria Relevant Law: Article 83(4) GDPR Article 83(5) GDPR Article 83(6) GDPR Article 5(1)(a) GDPR Article 9(1) GDPR Article 30 GDPR Article 35 GDPR Decided: 24.06.2026 Published: 22.07.2026 Parties: National Case Number\u002FName: VwGH Ro 2025\u002F04\u002F0007-7 European Case Law Identifier: ECLI:AT:VWGH:2026:RO2025040007.J00 Appeal from: Appeal to: Not appealed Original Language(s): German Original Source: RIS (in German) Initial Contributor: ds The Supreme Administrative Court reduced a fine against an address publisher and direct advertising company to €13,000,000. It upheld the finding that the company had grossly negligently processed political party affinity data of 2.2 million people without explicit consent. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The controller was an address publisher and direct advertising company that operated a data application to provide advertisers with personal data for targeted marketing measures. In 2019, following media reports concerning the alleged sale of personal data, particularly information about natural persons’ political party affinity, the Austrian DPA (DSB) initiated an ex officio investigation against the controller. Based on its investigation, the DPA found that the controller had unlawfully processed political party affinity data and unlawfully further processed parcel-frequency data, and had infringed its obligations concerning the DPIA and record of processing activities. It consequently imposed a fine of €18,000,000. The controller appealed to the Federal Administrative Court (BVwG), arguing that the commission of an infringement by a legal person was not, in itself, sufficient for a fine to be imposed under the GDPR. It claimed that since a legal person could not act on its own, the culpable conduct of a natural person had to be identified and attributed to it. The controller argued that the DPA had failed to establish such attribution. The court agreed and, on 26 November 2020, annulled the fine. It found that the DPA had failed to establish that natural persons acting on behalf of the controller had engaged in culpable conduct. The DPA filed an extraordinary official appeal against this judgment with the Austrian Supreme Administrative Court (VwGH). The court stayed the proceedings pending the CJEU’s preliminary ruling in Case C-807\u002F21 (Deutsche Wohnen SE), as the questions referred in that case were also relevant to the appeal proceedings. The CJEU published its judgement on this matter on 5 December 2023. The CJEU held that a fine under Article 83(4) GDPR, Article 83(5) GDPR and Article 83 (6) GDPR may be imposed on anyone who qualifies as a controller where it is established that the controller committed the relevant infringement intentionally or negligently. A controller may be sanctioned where it could not have been unaware of the infringing nature of its conduct, regardless of whether it knew that its conduct infringed the GDPR. The CJEU further clarified that, where the controller is a legal person, the application of Article 83 GDPR does not require any action or knowledge on the part of its governing body. Member States may not impose additional substantive requirements for the imposition of fines beyond those laid down in Article 83 GDPR. For the determination of the fine, the controller may also constitute an undertaking within the meaning of EU competition law, with the turnover of the relevant economic unit being taken into account. Following the CJEU judgment, the Supreme Administrative Court annulled the Federal Administrative Court’s judgment on 1 February 2024. The Federal Administrative Court issued a new judgment on 27 December 2024, largely upholding the infringements but reducing the fine to €16,000,000. The controller appealed this decision before the Supreme Administrative Court. Holding The court found that the controller gathered information concerning the political party affinity of the Austrian population based on anonymous surveys conducted by commissioned polling institutes. These surveys included specific questions concerning interest in election advertising, together with sociodemographic information such as age, level of education and income, place of residence and interest in advertising from political parties. Marketing groups were subsequently formed based on the sociodemographic data and place of residence. For each group, calculations were made to determine the likelihood that an individual with particular sociodemographic characteristics and religious affiliation would be interested in advertising from the political parties concerned. By assigning an identifiable individual to a particular marketing group, the controller linked that person to the probability values calculated for the group and the resulting political party affinity. The court held that the controller did not obtain consent from the data subjects to whom these probability scores were assigned. In total, political party affinity was attributed to approximately 2.2 million individuals. The court reiterated that political party affinity scores attributed to identifiable individuals constituted personal data revealing political opinions within the meaning of Article 9(1) GDPR. It therefore upheld the finding that the controller had infringed Article 5(1)(a) GDPR in conjunction with Article 9(1) GDPR. In assessing the controller’s culpability, the court relied heavily on the CJEU’s judgment in Deutsche Wohnen SE. It held that the fact that the controller believed it had complied with the GDPR because it had established a quality-assured organisation was not decisive. It pointed out that under GDPR, a legal person’s fault does not require knowledge or awareness on the part of the management body. The establishment of a data protection compliance system, like the obtaining of legal advice, did not in itself exculpate the controller. It stated that the decisive question was whether the controller could have been aware of the unlawfulness of the processing of political party affinity data during the relevant period. The court ruled that the controller had incorrectly assessed that political party affinity scores did not constitute personal data and that it had consequently failed to examine whether they constituted special categories of personal data under Article 9 GDPR. The court rejected the controller’s argument that political party affinity was processed only in relation to groups rather than in relation to specific identifiable individuals. It also rejected the argument that marketing classifications used for political advertising posed no risk to data subjects. The court concluded that given the controller’s resources and its ability to examine the applicable legal position, that legal assessment amounted to gross negligence concerning the infringement of Article 5(1)(a) GDPR in conjunction with Article 9(1) GDPR. Furthermore, the court ruled that the controller’s incorrect assessment that political party affinity scores did not constitute personal data or special categories of personal data also led it to conclude in its Data Protection Impact Assessment (DPIA) that the processing did not pose a high risk and that the scope of Article 35(3)(a) GDPR was therefore not engaged. The court held that the DPIA-related infringement was therefore absorbed from the infringement of Article 5(1)(a) GDPR in conjunction with Article 9(1) GDPR. It found no separate element of wrongdoing. The court","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=VwGH_-_VwGH_Ro_2025\u002F04\u002F0007-7&diff=52506&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-07-27T11:12:10+00:00","2026-07-27T12:00:18.401141+00:00",7,[18,21,24,26,28],{"name":19,"type":20},"data application","product",{"name":22,"type":23},"Austrian DPA","vendor",{"name":25,"type":23},"Federal Administrative Court",{"name":27,"type":23},"Austrian Supreme Administrative Court",{"name":29,"type":23},"CJEU","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":30,"icon":32,"name":33,"slug":34},null,"Policy","policy",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]