The Austrian Supreme Administrative Court has confirmed the sanction by the data protection authority for the unlawful processing of data relating to the "political affinities" of 2.2 million people, classified as special categories of data, and has set the final fine at 13 million euros.

Facts and Context

The Austrian Data Protection Authority (DSB) published a communication regarding the decision of the Supreme Administrative Court of 24 June 2026, which confirms a sanction against a company (including the imposition of a fine of €13,000,000) for the unlawful processing of data relating to political opinions.

The case originates from a sanction decision by the Austrian authority dated 23 October 2019, following the finding of processing data relating to the "political affinities" of 2.2 million people.

Reasons for the Decision

After several appeals and judicial referrals, the Supreme Administrative Court confirmed the following breaches:

• Obligation not to process special categories of data (Article 9 of the GDPR): The company processed data concerning the "political affinities" of 2.2 million people, which correspond to a statistically calculated probability of their interest in electoral advertising of certain parties. The Court confirmed that this data constitutes special categories of personal data. This processing, which included storage and partial sale to third parties, was carried out without the consent of the data subjects or any other legal basis provided for in Article 9(2) of the GDPR, and was deemed gross negligence.
• Obligation of lawfulness of processing: The decision also upheld the unlawfulness of the subsequent processing of data concerning the frequency of parcel receipt for marketing purposes, this processing lacking an appropriate legal basis.

Authority's Decision

Consequently, the Supreme Administrative Court imposed a fine of €13,000,000 on the company.

Furthermore, the Court ordered the company to pay a contribution to the costs of the administrative procedure amounting to €100,000.

Lessons Learned

This decision confirms and clarifies that:

• Data that do not directly reveal a political opinion, but are the result of a statistical probability calculation (such as "political affinities"), must be classified as special categories of personal data within the meaning of Article 9 of the GDPR.
• For calculating the amount of a fine, the total global annual turnover to be taken into account is that of the entire group of companies, not a turnover limited to the activity related to the infringement.
• The assessment of fault (intent or negligence) of a controller must be based exclusively on the criteria of Union law and the case law of the Court of Justice of the European Union, without the possibility of applying national law provisions in this matter.
• Guidelines of the European Data Protection Board (EDPB), such as those on the calculation of administrative fines (04/2022), constitute a relevant interpretative tool for national courts in applying the GDPR, notably to assess the degree of fault.
• The contribution to the costs of the administrative procedure imposed in addition to a fine must remain proportionate, even in the case of a very high fine, and may be capped by the judge.