European Data Protection Board

Administrative criminal proceedings of the Austrian data protection authority against Österreichische Post AG (Austrian Postal Service)

Wednesday, 23 October, 2019

The Austrian data protection authority (DPA) imposed an administrative fine of 18 million euros on Österreichische Post AG (ÖPAG) after conducting administrative fine proceedings.

After carrying out an oral hearing, the Austrian DPA considered it established on the basis of the evidence that ÖPAG had violated the GDPR by processing personal data on the alleged political affinity of affected data subjects.

In addition, another violation was determined due to the further processing of data on package frequency and the frequency of relocations for the purpose of direct marketing, as this is not covered by the GDPR.

These violations of the GDPR were committed unlawfully and culpably, which is why the above-mentioned administrative fine is appropriate to prevent other or similar violations.

The penalty is not final, as it can be challenged before the Federal Administrative Court within four weeks after the delivery of the penalty notice.