- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Address Broker – €500,000 Fine (Austria, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An address broker was fined EUR 500,000 for making it difficult for people to exercise their data rights. They required users to fill out a specific form and only responded to requests outside that form if users insisted. This decision shows that companies must allow users to access their rights in more than one way.
What happened
The address broker limited users' ability to exercise their data rights by only allowing a specific form.
Who was affected
Individuals whose data rights were restricted by the address broker's policy.
What the authority found
The authority ruled that the broker's practices violated GDPR by not allowing users to exercise their rights freely.
Why this matters
This ruling serves as a reminder that companies must provide flexible options for users to manage their data rights. Businesses should review their processes to ensure compliance.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 6 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Austrian DPA has imposed a fine of EUR 500,000 on an address broker. The controller provided a form for data subjects to exercise their rights. The controller regularly did not allow data subjects to exercise their rights in another way, always referring them to the form. Only when a data subject actively refused to use the form did the controller respond to requests to exercise data subjects rights which did not use the form. The DPA decided that this limited the exercise of data subjects' rights in a way that was not compatible with Art. 12 GDPR, and issued a fine of EUR 500,000. The controller appealed against the decision to the Austrian Federal Administrative Court, which dismissed the appeal.
Related Enforcement Actions (0)
No other enforcement actions found for Address Broker in AT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
28 September 2021
Authority
Datenschutzbehörde
Fine Amount
€500,000
Enforcement Tracker ID
ETid-2769
About this data
Cite as: Cookie Fines. Address Broker - Austria (2021). Retrieved from cookiefines.eu
Last updated: