Austrian Post AG (Österreichische Post AG) Mail service provider

The Austrian Post AG had generated profiles of a large number of Austrians. These generated profiles contained information about various personal data including in particular their possible party affinities, personal prefences and habits, which were later sold to political parties and companies. The provider had claimed that the profiles were merely statistical predictions and had no personal reference. The DPA rejected this allegation and determined that this was in breach of the GDPR. Further violations of the data protection law were also found in connection to data on parcel deliveries and data on the frequency of movement of persons used for direct marketing. In connection with this case, a civil court judgement has already been handed down on claims for damages in the amount of 800 €. The data subject whos party affinitiy was processed, had not given a consent to the processing and was not informed about the data processing by the controller (LG Feldkirch, Urteil v. 07.08.2019 - Az.: 57 Cg 30/19b). The decision is not yet final and the provider has appealed the decision. Authority: Austrian Data Protection Authority (Österreichische Datenschutzbehörde "DSB")