Austria

Address Broker

500,000 €

GDPR enforcement action by Austrian Data Protection Authority (dsb) on 2021-09-28.

Rank · Sector

#48

of 595 in Industry and Commerce

Rank · Austria

of 38

Rank · All fines

#244

of 3,042

Case details

Authority: Austrian Data Protection Authority (dsb)
Date: 2021-09-28
Controller / Processor: Address Broker
Sector: Industry and Commerce
Quoted Articles: Art. 12 GDPR
Type of violation: Insufficient fulfilment of data subjects rights

Summary

The Austrian DPA has imposed a fine of EUR 500,000 on an address broker. The controller provided a form for data subjects to exercise their rights. The controller regularly did not allow data subjects to exercise their rights in another way, always referring them to the form. Only when a data subject actively refused to use the form did the controller respond to requests to exercise data subjects rights which did not use the form. The DPA decided that this limited the exercise of data subjects' rights in a way that was not compatible with Art. 12 GDPR, and issued a fine of EUR 500,000. The controller appealed against the decision to the Austrian Federal Administrative Court, which dismissed the appeal.

Open original source Links to the regulator's original publication or another source.