In a recent decision rendered on 26.11.2020,1 the
Austrian Federal Administrative Court
(Bundesverwaltungsgericht, BVwG) overturned a fine of EUR
18 million that had been imposed on the Austrian Postal Service
(APS) by the Austrian data protection authority (DPA). The case
centres on the same facts considered by the BVwG in a separate
decision.2 Therein the Court upheld the DPA's
administrative penalty against the APS, which had been accused of
unlawfully processing and selling personal data of customers, such
as private addresses and assumed political allegiances, to third
parties for marketing purposes.
In the decision at hand, the BVwG acknowledged the unlawful
nature of APS's conduct, yet overturned the DPA's penalty,
based on its omission to establish that both legal and natural
persons, acting on behalf of APS, had been responsible for the
culpability in question.
