[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-mm-VVlShgH6kbChhNCczC3-3zfiEq-DzVGBXIMU6tA":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":66},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"77737722-a4dc-43a8-91ca-aa52707e9121","VwGH - VwGH Ro 2025\u002F04\u002F0007-7","vwgh-vwgh-ro-2025-04-0007-7-30880b","Fixed link ← Older revision Revision as of 08:03, 8 October 2026 Line 94: Line 94: |Appeal_From_Body=Bundesverwaltungsgericht - BVwG |Appeal_From_Body=BVwG (Austria) |Appeal_From_Case_Number_Name=W258 2227269-1\u002F39E |Appeal_From_Case_Number_Name=W258 2227269-1\u002F39E |Appeal_From_Status= |Appeal_From_Status=","The Austrian Supreme Administrative Court (VwGH) reduced a GDPR fine imposed on an address publisher from €18,000,000 to €13,000,000. The court upheld the finding that the company had negligently processed sensitive political party affinity data for 2.2 million individuals without explicit consent. However, it determined that the failure to conduct a Data Protection Impact Assessment (DPIA) was subsumed by other violations, leading to the reduction.","Austrian court reduces GDPR fine for address publisher from €18M to €13M.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=VwGH_-_VwGH_Ro_2025\u002F04\u002F0007-7&diff=53335&oldid=52576","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-10-08T08:03:00+00:00","2026-10-08T10:00:15.999949+00:00",7,[17,20],{"name":18,"type":19},"Data Protection Impact Assessment","product",{"name":21,"type":22},"Austrian DPA","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[21,18],{"controls":47,"vendors":65},[48],{"slug":49,"name":50,"problem":51,"products":52},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[53,59],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":54,"product_name":55,"url":57,"description":58},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":60,"product_name":61,"url":63,"description":64},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":67,"title":68,"body":69,"framework_refs":70,"framework_notes":80},"austrian-court-upholds-13m-gdpr-fine-for-unlawful-processing-of-political-affinity-data","Austrian Court Upholds €13M GDPR Fine for Unlawful Processing of Political Affinity Data","An Austrian address publisher was fined €13,000,000 by the Supreme Administrative Court for negligently processing sensitive political party affinity data for 2.2 million individuals without obtaining explicit consent, violating GDPR Article 9. The case highlights that processing special-category data — such as political opinions — demands a significantly higher legal threshold than standard personal data, requiring unambiguous, informed consent. The company also failed to conduct a mandatory Data Protection Impact Assessment (DPIA), though this violation was absorbed into the broader penalty. This ruling reinforces that organisations handling sensitive data at scale face severe regulatory consequences and that ignorance or negligence is not a mitigating defence under GDPR.",[71,72,73,74,75,76,77,78,79],"GDPR Article 9 – Processing of special categories of personal data","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 83(4)\u002F(5) – Administrative fines","NIST Privacy Framework PR.DS-P1 – Data Processing Policies","NIST SP 800-188 – De-Identifying Government Datasets","CIS Control 3 – Data Protection","ISO\u002FIEC 29101 – Privacy Architecture Framework","ITIL Service Design – Information Security Management",{}]