Art 83 et seq. of the Regulation (EU) No 2016/679 (hereinafter, the “General Data Protection Regulation” or “GDPR ] provides for severe administrative fines (up to 2% of the total word wide annual turnover) in case of infringement of laws on data protection.
Supplementary to the GDPR, Austrian legislation, however, introduced Art 11 of the Austrian Data Protection Act, which generally reduced the threat of punishment in case for ‘first-time infringements’. According to the Austrian law, ‘[t]he Data Protection Authority will apply the catalogue of [i.e. penalties] […] in a way as to ensure proportionality. Particularly in the case of first-time infringements, the data protection authority will make use of its remedial powers in accordance with Art. 58 GDPR, in particular by issuing warnings.’ It is questionable if this provision is compatible with the GDPR. Paragraph 148 of the GDPR’s preamble indicates that infringements of a natural person (i.e. not of a commercial entity) only may be sanctioned under certain conditions with issuance of a reprimand instead of a penalty, by stating that ‘[i]n a case of a minor infringement or if the fine likely to be imposed would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine. Due regard should however be given to the nature, gravity and duration of the infringement, the intentional character of the infringement, actions taken to mitigate the damage suffered, degree of responsibility or any relevant previous infringements, the manner in which the infringement became known to the supervisory authority, compliance with measures ordered against the controller or processor, adherence to a code of conduct and any other aggravating or mitigating factor.‘
If Art 11 of the Austrian Data Protection Law is not compatible with the GDPR, the EU Regulation will prevail over Austrian law (according to the case law of the European Court of Justice).