The GDPR has been inadequately enforced for years. Despite 3,813 complaints, there were only 62 fines in Austria in 2024. However, the situation could become even worse: in its latest newsletter, the Data Protection Authority (DSB) announced further restrictions of its activities. The reason for this is significant budget cuts despite an increasing workload due to a constantly growing range of tasks. Meanwhile, GDPR penalties could generate significant revenue for Austria. The data protection organisations epicenter.works and noyb urgently warn of the devastating consequences of such a restriction on the fundamental right to data protection for all Austrians. The two NGOs will therefore file a complaint against the Republic of Austria with the European Commission.
DSB: Saving money instead of enforcing the law? The Austrian federal government appears to be simply cutting the independent data protection authority (DSB) to pieces in order to save money. This is evident from a newsletter published by the DSB, in which it announced a restriction of its activities. The DSB is already extremely underfunded compared to other EU countries. Germany, for example, spends about twice as much per capita on its data protection authorities as Austria. However, according to Article 52(4) of the GDPR, Austria is obliged to provide sufficient funding for the DSB. This obligation under EU law is clearly being violated.
Interns to uphold fundamental rights? Since the DSB had already been unable to secure enough permanent positions for civil servants, it made do with around 20 administrative interns. Legally, these are considered ‘material expenses’ that must be let go after 12 months. This results in a constant loss of expertise and enormous ongoing training costs.
Fewer staff for more work. So far, the DSB has had to enforce the data protection rights of 9 million people with only 53 employees and 19 administrative interns (as of 2024). That was already pretty much impossible. However, the DSB recently announced that its budget for 2026 has been cut again, despite rising costs and a growing workload. As a result, the data protection authority will not be able to replace most of its approximately 20 administrative interns, causing its already precarious staffing levels to shrink rapidly. At the same time, the DSB is facing an increasing number of mammoth tasks due to the Freedom of Information Act, artificial intelligence, targeting in political advertising and the directive on improving working conditions in platform work.
Fewer proceedings, fewer opinions. It is particularly serious that in future , the DSB will only issue opinions on planned draft legislation in exceptional cases. However, in view of advancing digitalisation, more and more legislative proposals have a clear connection to data protection. Without the competent voice of the authority, key impetus for legislation that complies with fundamental rights will be lacking. In addition, the DSB has made it clear that it will only initiate ex officio proceedings if an external submission ‘indicates a sufficiently concrete suspicion of a serious violation of the GDPR or the DSG.’ In other words, the DSB will no longer investigate companies on its own initiative.
Sebastian Kneidinger from Epicenter.works emphasises: ‘Data protection is everywhere. Almost every law touches on fundamental digital rights and must therefore be properly written in terms of quality. The government should actually know this. Cutting corners on data protection means losing direction for the future. This will result in poorer laws in the country and leave the field open to multinational corporations.’
Even longer proceedings and loss of legal certainty. The DSB intends to focus on the handling of complaints, as this is an obligation. But even here, the authority expects further delays, despite the fact that proceedings already take significantly longer than the statutory period of six months in most cases. Many cases drag on for years – and then remain with the equally overburdened Federal Administrative Court (BVwG) for years. In order for the BVwG to actually process a case, it is almost always necessary to first appeal to the Supreme Administrative Court.
Max Schrems from noyb warns: "Fundamental rights are worthless if they only exist on paper. We now have an authority operating in emergency mode and courts that regularly leave cases unresolved without specific instructions from the highest court. The situation is completely unworthy of a constitutional state. If the DSB imposed proper fines, it would be a cash cow for Austria. A fine against Google alone would cover Austria's share of the Brenner Base Tunnel, which amounts to 6 billion."
epicenter.works and noyb file complaint with EU Commission. In light of this, noyb and epicenter.works will file a complaint with the European Commission. The EU Commission then has the option of initiating infringement proceedings against Austria.
