Austrian Postal Service (Plaintiff) – Court Ruling (Austria, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Austrian Postal Service was found to have sold people's political party preferences without their consent. This is important because it shows that companies must have a legal basis to process sensitive personal data. Businesses should ensure they get explicit consent before handling such information.
What happened
The Austrian Postal Service sold data on individuals' political party preferences without consent.
Who was affected
Individuals whose political party preferences were sold by the Austrian Postal Service.
What the authority found
The Austrian Data Protection Authority ruled that the Postal Service processed sensitive data without a legal basis, requiring them to stop and erase the data.
Why this matters
This ruling highlights the strict requirements for handling sensitive data like political preferences. Companies must ensure they have explicit consent to avoid legal issues.
GDPR Articles Cited
National Law Articles
= The Austrian Postal Service (Österreichische Post AG) had been selling data on natural person's party "affinity for a political party" to their customers. In light of broad media coverage on this topic the Austrian Data Protection Authority (Datenschutzbehörde - DSB) started an ex-officio investigation against the Austrian Postal Service. The DSB investigated i.a the records of processing activities and the data protection impact assessment of the Austrian Postal Service. Further, it investigated records that must be maintained under § 151 Trade Regulations Act (Gewerbeordnung 1994 - GewO). = With its decision dated 22.01.2019, the DSB #held that the Austrian Postal Service had processed personal data on the "affinity for a political party" without a legal basis, as these data qualify as special categories of personal data under Article 9(1) GDPR. Their processing would require the data subjects' explicit consent under Article 9(2)(a) GDPR and § 151(4) GewO, #ordered the Austrian Postal Service to stop the processing of these data effective immediately and to erase such data within a period of two weeks (unless a derogation under Article 17(3) GDPR was applicable), #held that the Austrian Postal Service had failed to carry out a data protection impact assessment prior to 25.05.2018, #held that this data protection impact assessment was incorrect because it did not take into account that data on the "affinity for a political party" qualify as special categories of personal data, #held that the records of processing activities maintained by the Austrian Postal Service was incorrect, because it did not take into account that data on the"affinity for a political party" qualify as special categories of personal data #ordered the Austrian Postal Service to carry out a new, correct data protection impact assessment regarding the processing on data on the "affinity for a political party". = On 11.03.2019 the Austrian Postal Service filed an appeal against the DSB's d
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Austrian Postal Service (Plaintiff) in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Austrian Postal Service (Plaintiff) - Austria (2020). Retrieved from cookiefines.eu
Last updated: