€13M GDPR Fine for Misclassifying Political Affinity Scores as Non-Personal Data
An Austrian address publisher was fined €13,000,000 after grossly negligently processing political party affinity data for 2.2 million individuals without explicit consent, having incorrectly classified these scores as non-personal data. The Austrian Supreme Administrative Court, guided by a CJEU preliminary ruling, confirmed that gross negligence — defined as being unable to claim unawareness of the infringing nature of conduct — is sufficient grounds for GDPR sanctions, even absent direct knowledge of the violation. This case underscores that self-serving or poorly reasoned legal interpretations of what constitutes personal or special-category data do not provide a shield against regulatory liability. Organizations that process inferred or derived data about individuals, particularly relating to political opinions, must apply heightened scrutiny given GDPR Article 9 protections for special-category data.
Tactical Insight
Immediate actions
- Conduct an urgent audit of all data attributes processed by your organization to identify any that may qualify as special-category data under GDPR Article 9, including inferred or derived scores.
- Engage qualified legal counsel or a Data Protection Officer (DPO) to formally review and document the legal basis for processing any politically or ideologically sensitive data.
Long-term improvements
- Establish a structured Data Classification Framework that explicitly covers derived, inferred, and aggregated data fields, not just raw personal identifiers.
- Embed mandatory GDPR impact assessments (DPIAs) into the product and data pipeline development lifecycle for any profiling or scoring activities.
- Create a cross-functional data governance committee to review and challenge assumptions about data categorization on a recurring basis.
Regulatory & Awareness measures
- Train data stewards and product teams on the broad CJEU/GDPR interpretation of special-category data, including how inferred attributes (e.g., affinity scores) can trigger Article 9 obligations.
- Monitor CJEU and national supervisory authority rulings regularly to update internal compliance positions before they become enforcement liabilities.