Österreichische Post AG – CJEU Judgment (Austria, 2023)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
Austria's Postal Service collected personal data about people's political preferences without their consent, leading to a court case. This ruling matters because it clarifies that just breaking privacy rules isn't enough for compensation; actual harm must be proven. It emphasizes the need for companies to handle personal data responsibly.
What happened
Österreichische Post AG collected information on individuals' political affinities without their consent.
Who was affected
Individuals whose political preferences were inferred and stored by the Austrian Postal Service.
What the authority found
The Court of Justice ruled that a person must show actual harm to claim compensation for privacy violations under GDPR.
Why this matters
This ruling sets a precedent that companies must not only follow privacy laws but also ensure that individuals are not harmed by their practices. Businesses should be cautious about how they collect and use personal data.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The Austrian Postal Service (Österreichische Post) (the controller) collected information on the political affinities of the Austrian population according to certain socio-demographic criteria. The controller generated statistics and had drawn a conclusion that a natural person (the claimant) had a high degree of affinity with a specific Austrian political party. The claimant had not consented to the processing, and felt offended by such attribution. The claimant said that the controller caused him great upset, a loss of confidence, and a feeling of exposure by storing data of such assumed political opinions of him. Therefore, the claimant brought an action for non-material damages before the Regional Court for Civil Law Matters in Vienna (Landesgericht für Zivilrechtssachen Wien) pursuant to Article 82 GDPR. The first-instance court rejected the claim for compensation. The Higher Regional Court of Vienna (Oberlandesgericht Wien), as the appeals court, upheld the judgment because it viewed a threshold was not reached as Austrian law requires damages to reach a certain ‘threshold of seriousnessness’. The decision was appealed to the Supreme Court in Austria (Oberster Gerichtshof), which referred to the CJEU for a preliminary ruling on the following matters: * 1) If the mere infringement of GDPR provisions in itself is sufficient for the right to receive compensation under Article 82 GDPR or is it required that an applicant must have suffered harm. * 2) If the assessment of the compensation depends on further EU law requirements in addition to the principles of effectiveness and equivalence. * 3) If a threshold exists for the damage caused by a GDPR infringement that goes beyond upset caused by the infringement to have a right to receive compensation under Article 82 GDPR. With regard to the first (1) question, it was established by the CJEU that Article 82 GDPR includes three cumulative conditions to give rise for the right to compensation. Those three conditions
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (4)
Other cases involving Österreichische Post AG in AT
CJEU Judgment
Details
About this data
Cite as: Cookie Fines. Österreichische Post AG - Austria (2023). Retrieved from cookiefines.eu
Last updated: