VwGH - VwGH Ro 2025/04/0007-7
Austrian court reduces GDPR fine for address publisher from €18M to €13M.
The Austrian Supreme Administrative Court (VwGH) reduced a GDPR fine imposed on an address publisher from €18,000,000 to €13,000,000. The court upheld the finding that the company had negligently processed sensitive political party affinity data for 2.2 million individuals without explicit consent. However, it determined that the failure to conduct a Data Protection Impact Assessment (DPIA) was subsumed by other violations, leading to the reduction.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Austrian DPA?
Get an email when a new story names Austrian DPA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn Austrian address publisher was fined €13,000,000 by the Supreme Administrative Court for negligently processing sensitive political party affinity data for 2.2 million individuals without obtaining explicit consent, violating GDPR Article 9. The case highlights that processing special-category data — such as political opinions — demands a significantly higher legal threshold than standard personal data, requiring unambiguous, informed consent. The company also failed to conduct a mandatory Data Protection Impact Assessment (DPIA), though this violation was absorbed into the broader penalty. This ruling reinforces that organisations handling sensitive data at scale face severe regulatory consequences and that ignorance or negligence is not a mitigating defence under GDPR.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.