Austrian Court Upholds €13M GDPR Fine for Unlawful Processing of Political Affinity Data
An Austrian address publisher was fined €13,000,000 by the Supreme Administrative Court for negligently processing sensitive political party affinity data for 2.2 million individuals without obtaining explicit consent, violating GDPR Article 9. The case highlights that processing special-category data — such as political opinions — demands a significantly higher legal threshold than standard personal data, requiring unambiguous, informed consent. The company also failed to conduct a mandatory Data Protection Impact Assessment (DPIA), though this violation was absorbed into the broader penalty. This ruling reinforces that organisations handling sensitive data at scale face severe regulatory consequences and that ignorance or negligence is not a mitigating defence under GDPR.
Tactical Insight
Immediate actions
- Audit all data processing activities to identify any special-category data (e.g., political opinions, health data) being processed without explicit consent.
- Halt or suspend any data processing pipelines involving sensitive attributes until lawful basis is confirmed and documented.
Compliance & governance improvements
- Conduct mandatory Data Protection Impact Assessments (DPIAs) for all high-risk processing activities involving large-scale sensitive data before processing begins.
- Establish a consent management framework that captures, records, and periodically refreshes explicit consent for special-category data in line with GDPR Article 9.
- Appoint or empower a qualified Data Protection Officer (DPO) to review data processing activities and flag non-compliant practices proactively.
Long-term structural measures
- Implement a Records of Processing Activities (RoPA) register to maintain visibility of all data flows, legal bases, and data subject volumes.
- Integrate privacy-by-design principles into product and data pipeline development to prevent non-compliant processing from being introduced at inception.
- Conduct regular staff training focused on GDPR obligations for special-category data to reduce organisational negligence risk.