On July 10, 2024, the Austrian data protection authority (DSB) published the Federal Administrative Court's (BVwG) judgment in Case BVwG to No. W137 2248575-1/31E of April 18, 2024, in which it partially upheld the decision of the DSB to impose a fine on the appellant for violating its facilitation obligations under the General Data Protection Regulation (GDPR). The BVwG while partially upholding the decision, reduced the fine to €500,000.

Background to the decision

The DSB had found the appellant in breach of Article 12(2) of the GDPR by implementing a mandatory contact form on its website for the assertion of data subject rights.

Findings of the Court

The BVwG confirmed the DSB's decision and stated that the appellant had an obligation to facilitate the exercise of data subject rights, and the appellant had made it more difficult for data subjects to exercise their rights, in violation of the GDPR. The BVwG took note that the appellant's negligence was minor and that the appellant had been cooperative and had already made improvements during the administrative penal proceedings. 

However, the BVwG determined that a fine was necessary due to general preventive considerations and the economic size of the appellant, as well as taking into account the appellant's inadequate preparation in a business area such as address publishing, that is particularly sensitive in terms of data protection law.

Outcomes

In light of the above, the BVwG dismissed the appeal and reduced the fine to €500,000.

You can read the decision, only available in German, here.