Austrian Post Fined €13M for Unlawful Political Data Profiling Under GDPR
The Austrian Postal Service unlawfully processed political party affinity data on 2.2 million individuals without obtaining explicit consent, violating GDPR Article 9 which requires a higher standard of protection for sensitive personal data including political opinions. The organization failed to conduct a Data Protection Impact Assessment (DPIA) before engaging in large-scale profiling activities, a critical safeguard required when processing is likely to result in high risk to individuals. This case demonstrates that gross negligence in handling sensitive data categories carries severe financial and reputational consequences, even when national derogations are invoked. It underscores that commercial data enrichment practices must be rigorously evaluated against GDPR's lawful basis requirements before deployment at scale.
Tactical Insight
Immediate actions
- Audit all current data processing activities to identify any sensitive data categories (e.g., political opinions, health data) processed without explicit consent or a valid GDPR Article 9 exemption.
- Suspend or remediate any profiling or data enrichment workflows that lack a documented lawful basis under GDPR Articles 6 and 9.
Long-term improvements
- Establish a mandatory DPIA process triggered whenever new data processing activities involve sensitive data categories, large-scale profiling, or automated decision-making.
- Embed a Privacy by Design framework into product and data pipeline development so consent and lawful basis requirements are evaluated before deployment, not after.
- Appoint or empower a Data Protection Officer (DPO) with sufficient authority to halt non-compliant data processing activities before they reach production.
Detection & governance measures
- Implement a data inventory and classification system to continuously track what sensitive personal data is collected, processed, and shared across the organization.
- Conduct annual third-party privacy audits to verify that processing activities remain aligned with documented consent records and legitimate purposes.