Because of illegal data trading, Austrian Post has to pay an administrative fine of 13 million euros, but only 100,000 euros in administrative costs. The Austrian Administrative Court (VwGH) has legally recognized this. The Supreme Court had to deal with the same case for the third time; Now it has decided itself (Az. Ro 2025/04/0007).
Read more after the ad
Austrian Post is a data broker. From May 2018 to February 2019, it also sold the estimated, alleged affinity for political parties of 2.2 million Austrians. Because they did not agree to this, the data protection authority banned data processing in 2019 and imposed a fine on the post office: 18 million euros plus 1.8 million euros in procedural costs. The postal service took legal action against this.
First of all, the Federal Administrative Court responsible for this matter decided that political affinity is not only personal data, but also sensitive data that is particularly highly protected. This was subsequently confirmed by the Administrative Court of Justice (Az. Ro 2021/04/0007). But in the second part of the proceedings, the postal service celebrated a great success: the Federal Administrative Court overturned the data protection penalty due to a formal error. The data protection authority should have named the specific people who violated the law at the postal service in the penalty notice.
The authority complained against this to the VwGH. In the meantime, the European Court of Justice (ECJ) decided in another case that in the case of data protection violations by legal entities, the people specifically acting there do not have to be named. On this basis, the Administrative Court (Az. Ra 2020/04/0187) sent the case back to the Federal Administrative Court, which then imposed a penalty on the post office – but only 16 million euros due to mitigating reasons that had now arisen.
“Unjustifiable” legal opinion of the Post Office
But the post office didn’t give up and went to the Administrative Court again. There she argued that she had not acted culpably, which meant that a punishment would be inadmissible. The company operates a compliance system and both an internal assessment and the involvement of external experts have shown that statistically calculated probability values (affinities) are not personal data.
The Administrative Court cannot accept this, especially since the Post has assigned its estimates to specific people: “The legal opinion that the processing of marketing classifications for political advertising does not involve any risk for the person concerned turns out to be … unreasonable.” In addition, the Post has “significant resources to examine the legal question,” which is why it cannot be assumed that there was merely slight negligence. The fault should only be examined according to European law standards, without taking national ones into account Provisions that the postal service brought into the meeting.
The postal service also fought against the level of punishment, which had to be based on the crime-related turnover. The VwGH also contradicts this; He confirms that the group-wide annual turnover is to be taken into account. For the amount of the penalty, the highest court is based on the guidelines issued by the European Data Protection Board in 2022 and comes to 13 million euros.
Read more after the ad
However, according to the Administrative Court, the contribution to the costs of the administrative criminal proceedings must not lead to a disproportionate result in the case of particularly high fines. Instead of a ten percent surcharge on the fine, the postal service only has to transfer 100,000 euros to the data protection authority.
Austrian Post also received a Big Brother Award in 2019 for trading with the alleged political affinity of 2.2 million Austrians.
(ds)
