Österreichische Post AG – Fine (Austria, 2019)

The Austrian postal service ("Österreichische Post AG", a private stock company, of which 52,9% is owned by the Republic of Austria) also sells data for direct marketing purposes ("list brokerage"). These lists include names and addresses and other factors that are largely generated using other public information and predictive models. The postal service also sold data that included a likeliness of the political affiliation (similar to: 45% social-democratic, 20% conservative, 5% Green Party). This was mainly intended for postal mailings by said political parties. The data was generated using public information about voting behavior in each voting district in Austria, aga and alike and was sold publicly. The postal service mainly relied on § 151 of the Austrian Business Code of 1994 ("Gewerbeordnung 1994", GewO) that regulates address brokers. The national law does not differentiate between different types of data, but limits the use solely to marketing purposes. The postal service took the view that predictions about the political affiliation of a data subject does not itself constitute "special categories of data" under Article 9 GDPR. What is the relationship between national laws (like § 151 GewO) and GDPR? Is a prediction of a political affiliation a "special category of data" under Article 9(1) GDPR? The decision of the DSB is not published. So far there are only news reports on the case (see e.g. [https://wien.orf.at/stories/3019396/ ORF.at]) On 29. 10. 2019 the postal service issued a [https://www.post.at/en/footer_about_us_press.php/presse/details/id/1478760 warning] to its stock holders that it was fined with € 18 Mio by the DSB in this case. The postal service has announced that the fine will be appealed to the Austrian Federal Administrative Court (BVwG): "This does not include provisions totalling EUR 18m for an administrative fine imposed on Austrian Post by the Austrian Data Protection Authority on grounds of the alleged illegal use of marketing