[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4cchOpeMjugfy3cLR31tqVHsXriPOaHY6WCZPnuU3tM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"b888b424-b4c7-4195-be7a-dc4e2bca24c4","austrian-court-upholds-13m-gdpr-fine-for-unlawful-processing-of-political-affinity-data","77737722-a4dc-43a8-91ca-aa52707e9121","Austrian Court Upholds €13M GDPR Fine for Unlawful Processing of Political Affinity Data","An Austrian address publisher was fined €13,000,000 by the Supreme Administrative Court for negligently processing sensitive political party affinity data for 2.2 million individuals without obtaining explicit consent, violating GDPR Article 9. The case highlights that processing special-category data — such as political opinions — demands a significantly higher legal threshold than standard personal data, requiring unambiguous, informed consent. The company also failed to conduct a mandatory Data Protection Impact Assessment (DPIA), though this violation was absorbed into the broader penalty. This ruling reinforces that organisations handling sensitive data at scale face severe regulatory consequences and that ignorance or negligence is not a mitigating defence under GDPR.","**Immediate actions:**\n- Audit all data processing activities to identify any special-category data (e.g., political opinions, health data) being processed without explicit consent.\n- Halt or suspend any data processing pipelines involving sensitive attributes until lawful basis is confirmed and documented.\n\n**Compliance & governance improvements:**\n- Conduct mandatory Data Protection Impact Assessments (DPIAs) for all high-risk processing activities involving large-scale sensitive data before processing begins.\n- Establish a consent management framework that captures, records, and periodically refreshes explicit consent for special-category data in line with GDPR Article 9.\n- Appoint or empower a qualified Data Protection Officer (DPO) to review data processing activities and flag non-compliant practices proactively.\n\n**Long-term structural measures:**\n- Implement a Records of Processing Activities (RoPA) register to maintain visibility of all data flows, legal bases, and data subject volumes.\n- Integrate privacy-by-design principles into product and data pipeline development to prevent non-compliant processing from being introduced at inception.\n- Conduct regular staff training focused on GDPR obligations for special-category data to reduce organisational negligence risk.",[12,13,14,15,16,17,18,19,20],"GDPR Article 9 – Processing of special categories of personal data","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 83(4)\u002F(5) – Administrative fines","NIST Privacy Framework PR.DS-P1 – Data Processing Policies","NIST SP 800-188 – De-Identifying Government Datasets","CIS Control 3 – Data Protection","ISO\u002FIEC 29101 – Privacy Architecture Framework","ITIL Service Design – Information Security Management",{},"published","2026-10-08T10:21:25.054497+00:00","2026-10-08T10:21:24.951+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=VwGH_-_VwGH_Ro_2025\u002F04\u002F0007-7&diff=53335&oldid=52576","vwgh-vwgh-ro-2025-04-0007-7-30880b","VwGH - VwGH Ro 2025\u002F04\u002F0007-7",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[44],{"slug":45,"name":46,"problem":47},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]