Austria: fine of EUR 18m against Austri­an Post

The Austri­an data pro­tec­tion aut­ho­ri­ty impo­sed a fine of EUR 18 mil­li­on on Öster­rei­chi­sche Post AG (ÖPAG) (Media release). The bus is not legal­ly bin­ding and ÖPAG has announ­ced that it will not accept the buses.

The back­ground to this is the coll­ec­tion and dis­se­mi­na­ti­on of data pro­files of appar­ent­ly 2.2 mil­li­on indi­vi­du­als. The­se pro­files have infor­ma­ti­on also on the Par­ty affi­ni­ty i.e., the pro­ba­bi­li­ty of voting for a cer­tain par­ty as asses­sed by ÖPAG. Accor­ding to the data pro­tec­tion aut­ho­ri­ty, the­se should be Spe­cial cate­go­ries of per­so­nal data within the mea­ning of Art. 9 GDPR, which would have requi­red expli­cit con­sent. The aut­ho­ri­ty also iden­ti­fi­ed other violations.

In the same case, the Feld­kirch Regio­nal Court award­ed imma­te­ri­al Dama­ges in the amount of EUR 800 award­ed (Judgment from August 7, 2019). The Regio­nal Court also came to the con­clu­si­on that ÖPAG had pro­ce­s­sed spe­cial cate­go­ries of per­so­nal data – wit­hout a legal basis.

In doing so, the district court did, after all, hold:

The GDPR does not spe­ci­fy a mate­ria­li­ty thres­hold for the com­pen­sa­ti­on of non-mate­ri­al dama­ge. Nevert­hel­ess, not all fee­lings of disp­lea­su­re asso­cia­ted with an inf­rin­ge­ment of rights are com­pensable, but rather the impair­ment of inte­rests must have a Weight to be givenbecau­se the austria Dama­ges law such a Mate­ria­li­ty thres­hold imma­nent is […].