On 29 October 2019 the Austrian national postal service (Post AG) published a press release titled “Milestones and outlook for 2019 and 2020”, wherein amidst the overall positive expectations for 2019 an accrual amounting to EUR 18,000,000 for a fine imposed by the Austrian Data Protection Authority (“Datenschutzbehörde“, or “DSB“) was mentioned. The fine was imposed due to an ongoing affair in Austria concerning the Post’s use of customer data to extrapolate “political affinity” (or presumed voting behavior), which was then further used to offer specific marketing options to political parties or even sold to political parties for targeted advertising.
The Post’s practice came to light at the beginning of the year and led to a public outcry, especially due to the fact that the Post’s customer data pertains to a large amount of Austrian households. News outlets reported 2.2 million of those data sets included the criticized information about “political affinity”. Post CEO Pölzl promptly announced the data would be deleted. Amidst the public outrage that left Post to deal with numerous access requests, the DSB initiated an investigation, which after formal administrative proceedings, including a hearing, resulted in the fine which has now become public.
In a statement issued by the DSB further data protection issues were apparently also the subject of the proceedings. Namely, the processing of data relating to the frequency of packages delivered to a specific address and the frequency of customers moving to a new address, which were both allegedly deemed to be in violation of data protection law as they lack basis under the GDPR.
In a comment made by Post’s attorney about the not yet publicly released decision, the DSB did, however, grant the Austrian Post to generally be within their rights to collect and process data without the consent of data subjects as a direct marketing company (“Direktmarketingunternehmen“) and address publisher (“Adressverlag“) according to section 151 Austrian Trade Act (“Gewerbeordnung“).
As the Post’s attorney has announced to file an appeal with the Federal Administrative Court, the fine is not yet legally binding. If the fine is upheld it will be the largest fine ever imposed for a data protection violation in Austria.