Austria

Austrian Post

16,000,000 €

GDPR enforcement action by Austrian Data Protection Authority (dsb) on 2019-10-29.

Rank · Sector

of 165 in Transportation and Energy

Rank · Austria

of 38

Rank · All fines

#36

of 3,042

Case details

Authority: Austrian Data Protection Authority (dsb)
Date: 2019-10-29
Controller / Processor: Austrian Post
Sector: Transportation and Energy
Quoted Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Austrian DPA has imposed a fine of EUR 16,000,000 on the Austrian Post. The controller had sold information regarding the political affinity to third parties without a sufficient legal basis.

Update: After the Austrian Federal Administrative Court canceld the fine with ruling from 2020-11-26, it again decided in the case and upheld the fine regarding the legal issue, but reduced the total amount from EUR 18,000,000 to EUR 16,000,000.

Open original source Links to the regulator's original publication or another source.