Law note · Austria
GDPR Article 82 and Datenschutzbehorde Enforcement in Austria
The Datenschutzbehorde (DSB) is Austria's supervisory authority, with General Data Protection Regulation (GDPR) Article 83 administrative fines of up to the greater of EUR 20 million or 4 percent of global turnover, plus DSG Article 4 criminal offenses for data secrecy violations.
Article 82 arms an individual with a direct private right of action for material or non-material damage, without a seriousness threshold, per the CJEU's first Article 82 ruling, C-300/21 UI v Osterreichische Post AG (4 May 2023), itself referred by the Austrian Supreme Court. Since 2 December 2024, noyb is a Qualified Entity under Austria's Qualifizierte-Einrichtungen-Gesetz, letting it bring collective Article 80(2) redress actions.
What it asks of an app
- Expect the Datenschutzbehorde to have jurisdiction and fining power, up to the higher of EUR 20,000,000 or 4 percent of global annual turnover, over your processing of personal data of a person in Austria.
- Expect any person who suffered material or non-material damage from an infringement to have a direct right to claim compensation from you as controller or processor, under General Data Protection Regulation (GDPR) Article 82, with no seriousness threshold.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions, processes_voice, processes_biometrics
Primary source: Official Journal text, EUR-Lex, Regulation (EU) 2016/679
CJEU C-300/21