Administrative criminal proceedings of the Austrian data protection authority against Österreichische Post AG (Austrian Postal Service)

23 October 2019

The Austrian data protection authority (DPA) imposed an administrative fine of 18 million euros on Österreichische Post AG (ÖPAG) after conducting administrative fine proceedings.

After carrying out an oral hearing, the Austrian DPA considered it established on the basis of the evidence that ÖPAG had violated the GDPR by processing personal data on the alleged political affinity of affected data subjects.

In addition, another violation was determined due to the further processing of data on package frequency and the frequency of relocations for the purpose of direct marketing, as this is not covered by the GDPR.

These violations of the GDPR were committed unlawfully and culpably, which is why the above-mentioned administrative fine is appropriate to prevent other or similar violations.

The penalty is not final, as it can be challenged before the Federal Administrative Court within four weeks after the delivery of the penalty notice.

The press release published here does not constitute official EDPB communication, nor an EDPB endorsement. This press release was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. As the press release is represented here as it appeared on the SA's website or other channels of communication, the news item is only available in English or in the Member State's official language with a short introduction in English. Any questions regarding this press release should be directed to the supervisory authority concerned.