Österreichische Post AG – Court Ruling (Austria, 2019)

The Austrian postal service ("Österreichische Post AG", a private stock company, of which 52,9% is owned by the Republic of Austria) also sells data for direct marketing purposes ("list brokerage"). These lists include names and addresses and other factors that are largely generated using other public information and predictive models. The postal service also sold data that included a likeliness of the political affiliation (similar to: 45% social-democratic, 20% conservative, 5% Green Party). This was mainly intended for postal mailings by said political parties. The data was generated using public information about voting behavior in each voting district in Austria, aga and alike and was sold publicly. The postal service mainly relied on § 151 of the Austrian Business Code of 1994 ("Gewerbeordnung 1994", GewO) that regulates address brokers. The national law does not differentiate between different types of data, but limits the use solely to marketing purposes. The postal service took the view that predictions about the political affiliation of a data subject does not itself constitute "special categories of data" under Article 9 GDPR. A data subject (Dr. Christian Wirthensohn, a privacy lawyer) made an access request, receiving a copy of his alleged political affiliations (a percentage per political party). He sued the postal service for € 2.500 in emotional damages for a number of alleged violations (illegal processing of data, lack of data minimization, delayed access to data, lack of information). What is the relationship between national laws (like § 151 GewO) and GDPR? Is a prediction of a political affiliation a "special category of data" under Article 9(1) GDPR? How much are the damages under Article 82 GDPR in this case? The Court found a violation of the GDPR, as the data falls under Article 9 GDPR and awarded € 800 in emotional damages. The Austrian Business Code cannot override Article 9 GDPR. There are no rules on the calculation of damages in GDPR, so it is a matter of the Court's discretion to assess the amount. No violation of the principled of data minimization. There is no emotional damages in delayed access to data or a lack of information, therefore the additional € 1.700 were not granted.