DPA case 2026-0.690.562 – Violation Found (Austria, 2026)

An editor-in-chief at a media company (controller) reported on so-called SLAPP lawsuits (strategic litigation against public participation lawsuits) initiated by an attorney. As part of this reporting, he published posts on his personal social media profiles on three different platforms about a legal action that the attorney was pursuing against the data subject on the grounds of defamation and libel. The lawsuit was dismissed because the data subject was found not guilty of defamation and libel. In these posts, the controller published the court decision and failed to redact the data subject’s name on several occasions within the document. In the document, the position of the data subject as the accused was apparent. The post was publicly accessible for several days and was reposted several times by other users of the platforms. The controller published the post on his own initiative and was not instructed to do so by the media company he is employed at. After the DPA has been notified about the incident, the controller deleted the posts. Retrospectively, the data subject made a statement that he consented to the disclosure of his name in the controller’s posts. The DPA found a violation of the data minimisation principle pursuant to Article 5(1)(c) GDPR and issued a reprimand. It held that the data in question fell under Article 10 GDPR because it identified the data subject as an accused in a criminal law proceeding despite the fact that he was acquitted. Moreover, the DPA held that because the controller acted on his own initiative, he held the role of the controller. The media company did not assert any influence on the controller to publish the post. The DPA held that Article 85 GDPR in conjunction with national law on the processing of personal data for the purpose of journalistic reporting was applicable as legal basis because the post formed part of the controllers reporting on the “SLAPP” lawsuits of the attorney. However, since the national prov