Federal Administrative Court · BVwG - W254 2342303-1

Date of Decision July 30, 2026 Legal Provision B-VG Art. 133, para. 4 GDPR Art. 32 GDPR Art. 5(1) GDPR Art. 6 GDPR Art. 83(1) GDPR Art. 83(2) GDPR Art. 83(5)(lita) VStG §10 VStG §19 VStG §5 VStG §64 VwGVG §52(8) B-VG Art. 133 (current version); B-VG Art. 133 effective from January 1, 2019, to May 24, 2018; last amended by BGBl. I No. 138/2017 B-VG Art. 133 effective as of January 1, 2019, last amended by BGBl. I No. 22/2018 B-VG Art. 133 effective from May 25,May 2018 through December 31, 2018; last amended by Federal Law Gazette I No. 22/2018; B-VG Art. 133; effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164/2013, B-VG Art. 133, effective from Jan. 1, 2014, through July 31, 2014, last amended by Federal Law Gazette I No. 51/2012 B-VG Art. 133 effective from Jan. 1, 2004, through Dec. 31, 2013, last amended by Federal Law Gazette I No. 100/2003 B-VG Art. 133 effective from January 1, 1975, through December 31, 2003, last amended by Federal Law Gazette No. 444/1974 B-VG Art. 133 valid from Dec. 25, 1946, through Dec. 31, 1974, last amended by Federal Law Gazette No. 211/1946 B-VG Art. 133 valid from Dec. 19,December 1945 through December 24, 1946; last amended by State Law Gazette No. 4/1945; B-VG Art. 133; in effect from January 3, 1930, through June 30, 1934 VStG § 10 (currently VStG § 10), effective as of Jan. 1, 2008, last amended by Federal Law Gazette I No. 5/2008 VStG § 10 in effect from February 1, 1991, through December 31, 2007 VStG § 19 (currently VStG § 19), effective as of July 1, 2013, last amended by Federal Law Gazette I No. 33/2013; VStG § 19, effective from January 1,January 2012 through June 30, 2013; last amended by Federal Law Gazette I No. 100/2011; VStG § 19 valid from February 1, 1991, through December 31, 2011 VStG § 5 (currently VStG § 5), effective as of January 1, 2019, last amended by Federal Law Gazette I No. 57/2018 VStG § 5 valid from February 1, 1991, through December 31, 2018 VStG § 64 (current) VStG § 64 effective as of January 1, 2019, last amended by Federal Law Gazette I No. 57/2018 VStG § 64 effective from August 15,2018 through December 31, 2018; last amended by Federal Law Gazette I No. 57/2018 VStG § 64 valid from January 1, 2014, through August 14, 2018; last amended by Federal Law Gazette I No. 33/2013 VStG § 64, effective from July 1, 2013, through December 31, 2013, last amended by Federal Law Gazette I No. 33/2013 VStG § 64 effective from March 1, 2013, through June 30, 2013, last amended by Federal Law Gazette (BGBl.) I No. 33/2013 VStG § 64 effective from JanuaryJanuary 2002 through February 28, 2013; last amended by Federal Law Gazette I No. 137/2001; VStG § 64 valid from February 1, 1991, through December 31, 2001 VwGVG § 52 (now VwGVG § 52), effective as of September 1, 2018, last amended by Federal Law Gazette I No. 57/2018; VwGVG § 52 in effect from January 1, 2014, through August 31, 2018 Judgment , W254 2342303 – 1/4E IN THE NAME OF THE REPUBLIC! The Federal Administrative Court, composed of Judge Dr. Tatjana CARDONA as presiding judge and the expert lay judges Mag. Viktoria HAIDINGER, LL.M., and Mag. Thomas GSCHAAR, has, in a closed session, justly ruled on the complaint filed by XXXX, represented by Attorney MMag. Michael KRENN, 1070 Vienna, against the decision of the Data Protection Authority dated March 17, 2026, Ref. No.: XXXX, and has rightly ruled in a closed session:The Federal Administrative Court, presided over by Judge Dr. Tatjana CARDONA and comprising the expert lay judges Mag. Viktoria HAIDINGER, LL.M., and Mag. Thomas GSCHAAR, has lawfully ruled in a closed session on the complaint filed by Roman numeral 40, represented by Attorney MMag. Michael KRENN, 1070 Vienna, against the decision of the Data Protection Authority dated March 17, 2026, Ref. No.: Roman 40, in a closed session: A) I. The complaint is granted with respect to the ruling on the penalty imposed, and the fine imposed is reduced to a total of EUR 12,000; correspondingly, the contribution toward the costs of the penalty proceedings before the responding authority pursuant to § 64 VStG is reduced to EUR 1,200. The complaint is granted with respect to the ruling on the penalty imposed, and the fine imposed is reduced to a total of EUR 12,000; Accordingly, the contribution toward the costs of the administrative penalty proceedings before the prosecuting authority pursuant to Section 64 of the VStG is reduced to EUR 1,200. II. Pursuant to § 52(8) VwGVG, the appellant is not required to bear any costs of the administrative court proceedings. Roman numeral two. Pursuant to § 52(8) VwGVG, the appellant is not required to bear any costs of the administrative court proceedings. B) The appeal is not admissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG). The appeal is not admissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG). Text Reasons for the Decision: I. Course of Proceedings: Roman numeral one. Course of Proceedings: 1. In the decision at issue, the Data Protection Authority (hereinafter “the authority in question”) issued a penalty notice against the complainant (hereinafter “BF”) on the grounds that, from at least May 25, 2018, through January 12,2026, the complainant had stored invoices from at least 75 customers—which contained, among other things, first and last names, addresses, customer numbers, and ordered articles—on a web server in an unprotected and publicly accessible manner, thereby allowing the invoices to be indexed by the Google search engine. As a result, the invoices were accessible to the data subjects via a simple Google search. In addition, during the relevant period, an Excel spreadsheet containing the first and last names as well as email addresses of approximately 580 customers was publicly accessible. 1. In the decision at issue, the Data Protection Authority (hereinafter referred to as the “authority in question”) issued a penalty notice against the complainant (hereinafter referred to as “BF”), as she had stored, at least from May 25, 2018, through January 12,2026, had stored invoices from at least 75 customers—which included, among other things, first and last names, addresses, customer numbers, and ordered articles—on a web server in an unprotected and publicly accessible manner, thereby allowing the invoices to be indexed by the Google search engine. As a result, the invoices were accessible to the data subjects via a simple Google search. In addition, during the period in question, an Excel spreadsheet containing the first and last names as well as email addresses of approximately 580 customers was publicly accessible. The authority in question imposed a fine of EUR 16,800 and set a contribution toward the costs of the proceedings pursuant to § 64 VStG in the amount of EUR 1,680, thereby requiring BF to pay a total amount of EUR 18,480. The authority in question imposed a fine of EUR 16,800 and set a contribution toward the costs of the proceedings pursuant to Section 64, VStG in the amount of EUR 1,680, thereby requiring BF to pay a total amount of EUR 18,480. In support of its decision, the respondent authority stated that the BF had violated the principles of integrity and confidentiality within the meaning of Art. 5(1)(f) of the GDPR and—due to the accessibility of invoices for which no legal basis for processing within the meaning of Article 6 of the GDPR—had violated the principles of lawfulness under Article 5(1)(a) of the GDPR, the purpose limitation principle under Article 5(1)(b) of the GDPR, and the storage limitation principle under Article 5(1)(e) of the GDPR. In its reasoning, the respondent authority stated that the BF had violated the principle of integrity and confidentiality within the meaning of Article 5(1)(f) of the GDPR and—due to the accessibility of invoices for which there was no longer a legal basis for processing within the meaning of Article 6, GDPR—had violated the principles of lawfulness under Article 5(1)(a) of the GDPR, purpose limitation under Article 5(1)(b) of the GDPR, and the storage limitation under Article 5(1)(e) of the GDPR. Since the respondent relied exclusively on external IT enterprises with regard to the server structure and, at the outset of the proceedings, accepted the situation regarding the (potential) data breach without immediately taking measures to secure the data, the responding authority also considers the subjective element of the offense to be fulfilled through negligence or conditional intent. 2. In an appeal against the decision dated April 15, 2026, received on April 24, 2026, the respondent, represented by legal counsel, challenged the amount of the fine imposed in the decision at issue and argued, in summary, that the severity of the violation should have been considered only minor when determining the fine and that an incorrect percentage calculation had been applied based on the determined base amount. II. The Federal Administrative Court considered: Roman numeral two. The Federal Administrative Court considered: 1. Findings: 1.1. The penalty notice was served on the complainant on March 19, 2026. The complaint was mailed on June 16, 2026. 1.2. BF is a limited liability company with commercial register number XXXX, headquartered in Austria and operating in the glazing industry. It processes third party data in connection with, among other things, product orders and the resulting invoicing, as well as to comply with tax regulations. 1.2. BF is a limited liability company with commercial register number Roman numeral 40, headquartered in Austria and operating in the glazing industry. It processes third party data in connection with, among other things, product orders and the resulting invoicing, as well as to comply with tax regulations. BF generated a net income of EUR 401,516.23 during the fiscal year April 1, 2024 – March 31, 2025. In an email dated July 16, 2025, a former customer of BF contacted the company and requested the erasure of personal data that was publicly accessible on the Internet. After BF referred the customer to Google as the responsible contact, the customer initiated a complaint procedure with the authority in question, during which the facts of the case now at issue were subsequently determined. 1.2. Objective Elements of the Offense: 1.2.1. In 2015, a third-party provider—which no longer exists—developed and set up BF’s online store, XXXX, through which various glass products could be ordered. In this context, the third-party provider was responsible for setting up the server infrastructure and performing essential technical configurations of the system. 1.2.1. In 2015, a third-party provider—which no longer exists—developed and set up the online store for BF Roman 40, through which various glass products could be ordered. In this context, the third-party provider was responsible for setting up the server infrastructure and performing essential technical configurations of the system. BF commissioned an external IT enterprise to perform ongoing maintenance on the online store and relied on it to carry out the work professionally. The online store (which was unavailable at the time of the decision) was based on a proprietary content management system for managing orders and invoices. Over the past few years, security measures were implemented on a regular basis. BF is the owner of the web server with the IP address XXXX; since 2016, it has stored various invoices for in-store purchases on this server, as well as orders from the online store or through third-party providers.BF is the owner of the web server with the IP address Roman numeral 40; since 2016, it has stored various invoices for in-store purchases on this server, as well as orders from the online store or through third-party providers. 1.2.2. For a period of time that cannot be precisely determined, but in any case from May 25, 2018, through January 12, 2026 (the period of the offense), invoices from at least 75 customers of the accused (hereinafter “affected individuals”)—which included, among other things, first and last names, addresses, customer numbers, and ordered articles, and some of which dated back to 2016—were stored publicly and unsecured on the web server, allowing the Google search engine to index the corresponding invoices. As a result, the invoices were directly accessible via a simple Google search for a data subject, or all invoices were directly accessible to anyone via the Google search command XXXX and were thus visible to an unlimited number of people. 1.2.2. For a period of time that cannot be precisely determined, but in any case from May 25, 2018, through January 12, 2026 (period of the offense), invoices from at least 75 customers of the accused (hereinafter referred to as “affected individuals”)—which contained, among other things, first and last names, address, customer number, and ordered articles—and some of which date back to 2016—were stored publicly and unsecured on the web server, allowing the Google search engine to index the corresponding invoices. As a result, the invoices were directly accessible via a simple Google search for a specific data subject, or—using the Google search command “Roman 40”—all invoices were directly accessible to anyone and thus visible to an unlimited number of people. In addition, during the period in question, an Excel spreadsheet containing the first and last names as well as email addresses of approximately 580 affected individuals was publicly accessible without protection via the link XXXX.Furthermore, during the relevant period, an Excel spreadsheet containing the first and last names as well as email addresses of approximately 580 affected individuals was publicly accessible without protection via the link “Roman 40.” 1.2.3. In a submission dated January 12, 2026, the BF informed the responding authority that it had corrected the configuration error and that further access of this kind was now technically prevented. Subsequently, the complaint proceedings initiated by the affected customer were dismissed by a decision dated February 16, 2026, Ref. No.: XXXX. 1.2.3. In a submission dated January 12, 2026, the BF informed the respondent authority that it had corrected the configuration error and that further access of this kind was now technically impossible. Subsequently, the complaint proceedings initiated by the affected customer were closed by a notice of closure dated February 16, 2026, Ref. No.: Roman numeral 40. 1.3. Subjective Element of the Offense 1.3.1. The complainant—despite the fact that its online store was continuously managed, maintained, and updated by an IT enterprise—was confronted, at the latest upon the affected customer’s intervention on July 16, 2025 (see Section II.1.1.) was confronted with the allegation that it had unlawfully processed personal data and made it publicly accessible online. 1.3.1. Despite the fact that its online store was continuously managed, maintained, and updated by an IT enterprise, BF was confronted—at the latest when the affected customer intervened on July 16, 2025 (see section II.1.1.) was confronted with the allegation that it had unlawfully processed personal data and made it publicly accessible online. In a letter from the same customer dated September 4, 2025, the alleged unlawful data processing was again brought to attention, and legal action was threatened. In a letter dated September 5, 2025, the customer was referred to Google “after consultation with the IT company,” as access to the data had been made from there and only the affected customer herself could obtain erasure from Google. BF communicated the same to the authority in question in a letter dated November 5, 2025, as part of the complaint proceedings. It was reiterated that BF had no influence over the publication or removal of the content at issue in the proceedings. The public display of content in Google Search was not within the BF’s “technical or legal control.” Only after the affected customer submitted repeated statements in the administrative proceedings on November 25, 2025—in which she also provided screenshots of her communications with Google—did the BF explain in a letter dated December 10, 2025, that attempts to remove the URL in question had been unsuccessful and that an external enterprise had already been commissioned to analyze the situation professionally in order to take appropriate measures. In a letter dated December 12, 2025, the respondent authority stated that the BF’s server appeared to be incorrectly configured; the BF subsequently submitted proposals for corrective action and was granted a three-week deadline to remedy the deficiencies. Finally, the respondent authority was informed by letter dated January 12, 2026, that the sources of the errors had been corrected. 1.3.2. From the time the problem was first reported (July 16, 2025) until the letter confirming the final resolution of the sources of error (January 12, 2026), just under half a year had passed. 1.3.3. The BF did not investigate the alleged data breach; it was only after several months—and following the initiation of proceedings by the authority in question—that an external IT enterprise was commissioned to identify the source of the data protection violations. The BF simply assumed (at least initially) that the problem must lie with Google, that it had no control over the matter, and took no measures to investigate or put an end to the data protection violations. BF did not enter into any investigation into the extent of the unnoticed publication of internal (invoice) documents. BF negligently tolerated the violation of the data protection interests of the affected individuals due to a faulty server structure and, despite compelling evidence, failed to take immediate and concrete steps to stop the unintended publication of personal data in the form of invoices and address information. The BF thus acted negligently until the former customer contacted them and, from that point on, with conditional intent. 2. Assessment of the Evidence: 2.1. The findings regarding Point II.1.1. are based on the return receipt included in the administrative file and the postmark on the envelope containing the complaint. 2.1. The findings regarding point II.1.1 are based on the return receipt included in the administrative file and the postmark on the envelope containing the complaint. The findings regarding Point II.1.2 are based on the administrative file before the Court, which includes relevant documents such as an extract from the commercial register, annual financial statements, and documents regarding the course of the administrative proceedings. Although the authority states in the decision that it had to estimate the actual revenue because the BF provided only unrealistic information and the (total) revenue of the taxpayer could not be directly derived from the annual financial statements; however, the determined amount (retained earnings) is correct, and the resulting classification of the taxpayer into the group of enterprises with revenue of up to EUR 2 million appears reasonable. The findings regarding Roman numeral 2.1.2 are based on the administrative record before the Court, which includes relevant documents such as an extract from the commercial register, the annual financial statements, and documents regarding the course of the administrative proceedings. Although the authority states in the decision that it had to estimate the actual revenue because BF provided only unrealistic information and the BF’s (total) revenue could not be directly derived from the annual financial statements, the determined amount (retained earnings) is correct, and the resulting classification of the BF into the group of enterprises with revenue of up to EUR 2 million appears reasonable. 2.2. The findings regarding the objective elements of the offense (Section II.1.3.) are, in turn, based on the course of the proceedings before the authority as presented to the Court. This includes the BF’s statements both in the underlying complaint proceedings and in the present administrative penalty proceedings. The establishment of the online store by third-party providers, its maintenance by an external IT enterprise, and the engagement of an external enterprise to identify the source of the error that triggered the proceedings were asserted by BF, appropriately assessed and established by the prosecuting authority, and are also undisputed. Nor were any new facts presented in the course of the appeal against the decision that would alter the findings made. 2.2. The findings regarding the objective elements of the offense (Roman numeral 2.1.3.) are, in turn, based on the course of the proceedings before the administrative authority as presented to the Court. This record includes the BF’s statements both in the underlying appeal proceedings and in the present administrative penalty proceedings. The BF alleged that the online store was set up by a third-party provider, that it was maintained by an external IT enterprise, and that an external enterprise was commissioned to locate the source of the error that triggered the proceedings; these allegations were duly considered and established by the authority in question and are also undisputed. Nor were any new facts presented in the course of the appeal against the decision that would alter the findings made. The fact that the BF is responsible for the identified IP address, the time period during which the offense occurred, the number of affected individuals, and that both individual invoices of affected individuals and a list containing the contact information of approximately 580 affected individuals were accessible online is once again evident from the —which the BF has not further contested—official proceedings and the findings consequently made by the authority in charge of the case. 2.3. Likewise, the finding regarding the resolution of the problem is evident from the present case file, which includes the relevant statement. 2.4. The findings regarding the subjective elements of the offense (Section II.1.4.) are based on the BF’s correspondence with the authority in question and the affected customer who initiated the complaint proceedings. This correspondence is part of the administrative record and was reviewed by the Court. This also establishes, in particular, the time period from the customer’s initial contact with BF to the eventual resolution of the problem by an external IT enterprise (Section II.1.3.2.).2.4. The findings regarding the subjective element of the offense (Roman numeral two.1.4.) are based on the correspondence between BF and the authority in question, as well as the affected customer who initiated the complaint proceedings. This correspondence is part of the administrative record and was reviewed by the Court. This also establishes, in particular, the time period from the customer’s initial contact with BF to the eventual resolution of the problem by an external IT enterprise (Section II.1.3.2.). The fact that BF did not investigate the alleged data breach, assumed that the problem was to be resolved by Google as the search engine service provider, and did not conduct any investigations into whether a data protection issue existed is evident from the—again, uncontested – contents of the file. These documents show the repeated contacts made by the affected customer as well as the referral to Google. It is evident from BF’s statements to the investigating authority that, at least until December 2025, no substantial efforts were made to properly analyze and resolve the data issue. The fact that the unintended publication of the invoices and the Excel spreadsheet containing contact information was ultimately resolved through a server restructuring carried out by a contracted IT enterprise further supports, in the Court’s view, the conclusion that the problem was not taken seriously—at least initially—and was effectively tolerated. Finally, with regard to the subjective element of the offense, it should also be noted that the penalty notice was contested only as to the amount, but not as to the merits. The BF is thus clearly aware of the violation of the data protection interests of the affected individuals and does not dispute this. 2.6. The fact that BF acted negligently with regard to the faulty server structure is evident not only, but particularly, from the extremely long period during which the invoices were publicly accessible. The Court does not fail to recognize that BF itself lacks IT expertise and relies on external enterprises in this regard; however, it is incomprehensible that such errors could go unnoticed. Even if the server structure is maintained by external IT enterprises, in the opinion of this Court, a minimum level of attention —particularly in the area of data protection, which is not solely within the core competence of the external IT enterprise—to comply with the minimum data protection requirements within the meaning of Articles 5 and 6 of the GDPR. The due diligence required for operating an online store was disregarded, even though such diligence could reasonably have been expected of the defendant (see Wessely in Raschauer/Wessely, VStG3 § 5 margin note 3 (as of Jan. 1, 2023, rdb.at)). 2.6. The fact that the BF acted negligently with regard to the faulty server structure is evident not only, but in particular, from the extremely long period during which the invoices were publicly accessible. The Court does not overlook the fact that the defendant itself lacks IT expertise and relies on external enterprises in this regard; however, it is incomprehensible that such errors would go unnoticed. Even if the server structure is maintained by external IT enterprises, the Court finds that a minimum level of attention —particularly in the area of data protection, which is not solely within the core competence of the external IT enterprise—to comply with the minimum data protection requirements within the meaning of Articles 5 and 6 of the GDPR. The due diligence required to operate an online store was disregarded, even though such diligence could reasonably be expected of the defendant; see Wessely in Raschauer/Wessely, VStG3 § 5, margin note 3 (as of Jan. 1, 2023, rdb.at)). The finding of conditional intent on the part of the BF is based on the fact that she was first specifically confronted with the faulty server structure when the former customer contacted her, but refused to implement immediate defensive measures or to thoroughly investigate the allegations, instead generally referring the former customer to Google as the point of contact. Thus, the knowledge component required for conditional intent is present, and BF simply resigned itself to the possibility of a (far-reaching) data protection breach (see Wessely in Raschauer/Wessely, VStG3 § 5, margin note 18 [as of Jan. 1, 2023, rdb.at]). The finding of conditional intent on the part of BF is based on the fact that it was first specifically confronted with the faulty server structure when the former customer contacted it, but refused to implement immediate remedial measures or to thoroughly investigate the allegations, instead generally referring the former customer to Google as the point of contact. Thus, the knowledge component required for acting with conditional intent is present, and the BF simply resigned itself to the possibility of a (far-reaching) data protection violation; see Wessely in Raschauer/Wessely, VStG3 Section 5, margin note 18 [as of Jan. 1, 2023, rdb.at]). 3. Legal Assessment: 3.1. The subject matter of the proceedings was a penalty notice ordering the BF to pay a sum of EUR 16,800 plus a contribution toward the costs of the administrative proceedings in the amount of EUR 1,680. This was justified primarily by the unintentional but negligently permitted publication of customer data on the Internet. The BF’s appeal against this decision is directed exclusively against the amount of the penalty. It argues that, if the EDPB guidelines on the imposition of fines had been correctly applied, the infringement should have been classified as only minor in severity, and that the percentage calculation based on the established base amount was incorrect. Pursuant to Article 83(1) of the GDPR, each supervisory authority shall ensure that the imposition of administrative fines under this article for infringements of the GDPR, in accordance with paragraphs 5 and 6, is effective, proportionate, and dissuasive in each individual case. Administrative fines are imposed, depending on the circumstances of the individual case, in addition to or in lieu of measures under Article 58(2)(a)–(h) and (i) of the GDPR. When imposing administrative fines—to the extent relevant to the proceedings—the supervisory authority shall take into account, in particular, the nature, gravity, and duration of the infringement; whether it was intentional or negligent; the measures taken; the extent of cooperation with the supervisory authority; the categories of personal data affected, and the manner in which the infringement came to the attention of the supervisory authority (see Art. 83(2) of the GDPR). 3.2. Pursuant to Article 83(1) of the GDPR, each supervisory authority shall ensure that the imposition of administrative fines pursuant to this article for infringements of the GDPR, in accordance with paragraphs 5 and 6, is effective, proportionate, and dissuasive in each individual case. Administrative fines are imposed, depending on the circumstances of the individual case, in addition to or in lieu of measures under article 58(2)(a) through (h) and (i) of the GDPR. When imposing administrative fines—to the extent relevant to the proceedings—the supervisory authority shall take into account, in particular, the nature, gravity, and duration of the infringement; whether it was intentional or negligent; the measures taken; the extent of cooperation with the supervisory authority; the categories of personal data affected, and the manner in which the infringement came to the attention of the supervisory authority (see article 83(2) of the GDPR). For violations of the principles governing processing pursuant to Articles 5, 6, 7, and 9 of the GDPR, administrative fines of up to EUR 20,000.000 or, in the case of an enterprise, up to 4% of its total worldwide annual turnover in the preceding fiscal year, whichever is higher (see Article 83(5)(a) of the GDPR).For violations of the principles governing processing pursuant to articles 5, 6, 7, and 9 of the GDPR, administrative fines of up to EUR 20,000.000 or, in the case of an enterprise, up to 4% of its total worldwide annual turnover for the preceding fiscal year, whichever is higher (see article 83(5)(a) of the GDPR). 3.3. Pursuant to § 5(1) of the Administrative Offenses Act (VStG), negligent conduct is sufficient to constitute an offense unless an administrative regulation provides otherwise regarding culpability. Pursuant to para 1 of § 10 of the VStG, the type and severity of the penalty are determined in accordance with administrative regulations, unless otherwise specified in the VStG. The basis for determining the penalty is the significance of the legally protected interest and the severity of its impairment by the offense. In ordinary proceedings (Sections 40 through 46), the aggravating and mitigating factors relevant to the purpose of the penalty—insofar as they do not already determine the penalty—must also be weighed against one another. Particular attention must be paid to the degree of culpability. Taking into account the specific nature of administrative criminal law, §§ 32 through 35 of the Criminal Code shall apply mutatis mutandis. The accused’s income and financial circumstances, as well as any dependents, must be taken into account when determining fines. (see § 19 VStG) 3.3. Pursuant to Section 5, paragraph 1, of the VStG, negligent conduct is sufficient to constitute a punishable offense unless an administrative regulation provides otherwise regarding culpability. Pursuant to Section 10, paragraph 1, of the Administrative Offenses Act (VStG), the type and severity of the penalty are determined in accordance with the administrative regulations, unless otherwise specified in the VStG. The basis for determining the penalty is the significance of the legally protected interest and the extent to which it was impaired by the offense. In ordinary proceedings (Sections 40 through 46), the aggravating and mitigating factors relevant to the purpose of the penalty—insofar as they do not already determine the penalty—must also be weighed against one another. Particular attention must be paid to the degree of culpability. Taking into account the specific nature of administrative criminal law, Sections 32 through 35 of the Criminal Code are to be applied mutatis mutandis. The accused’s income and financial circumstances, as well as any family responsibilities, must be taken into account when determining monetary penalties. (See Section 19, VStG) 3.4. On the Determination of the Penalty: 3.4.1. The penalty at issue in these proceedings was imposed for an administrative offense under Article 5(1)(a), (b), (e), and (f), as well as Articles 6 and 32 in conjunction with Article 83(5)(a) of the GDPR. 3.4.1. The penalty at issue in these proceedings was imposed for an administrative offense under Article 5, paragraph 1, subparagraphs a, b, e, and f, as well as Article 6 and Article 32, in conjunction with Article 83, paragraph 5, subparagraph a, of the GDPR. In determining an appropriate administrative fine, the authority in question classified BF into the category “Enterprises with revenue of up to 2 million EUR,” taking into account the Art, severity, and duration of the violation, as well as the number of data subjects affected; it assumed that the BF’s conduct was partly intentional (albeit with mitigating circumstances) and partly negligent, and ultimately concluded that the violation was of medium severity. 3.5.2. Pursuant to Article 83(1) of the GDPR, each supervisory authority shall ensure that the imposition of administrative fines pursuant to this article for infringements of this Regulation, in accordance with paragraphs 5 and 6, is effective, proportionate, and dissuasive in each individual case.3.5.2. Pursuant to Article 83, paragraph 1, of the GDPR, each supervisory authority shall ensure that the imposition of administrative fines pursuant to this article for infringements of this Regulation, in accordance with paragraphs 5 and 6, is effective, proportionate, and dissuasive in each individual case. The determination of the penalty within a statutory penalty range is a discretionary decision that must be made in accordance with the criteria established by the legislature in § 19 VStG (VwGH 05.09.2013, 2013/09/0106).The determination of the penalty within a statutory penalty range is a discretionary decision that must be made in accordance with the criteria established by the legislature in Section 19 of the VStG (VwGH, September 5, 2013, 2013/09/0106). First, however, it should be noted that EU law is exclusively applicable to the substantive requirements that a supervisory authority must observe when imposing an administrative fine on a controller; these requirements are set forth in Article 83(1) through (6) of the GDPR (see CJEU, Dec. 5, 2023, C-807/21, paras. 45, 48, 52, and 65, and C-683/21, paras. 64–70). The principles of the VStG therefore apply only to the extent that they are not superseded by directly applicable Union law.First, however, it should be noted that Union law is exclusively decisive with regard to the substantive requirements that a supervisory authority must observe when imposing an administrative fine on a controller, whereby these requirements are set forth in article 83, paragraphs 1 through 6 of the GDPR—see CJEU, Dec. 5, 2023, C-807/21, paras. 45, 48, 52, and 65, as well as C-683/21, paragraphs 64 through 70). The principles of the VStG therefore apply only to the extent that they are not superseded by directly applicable Union law. 3.5.3. In accordance with the EDPB’s Guidelines on the calculation of administrative fines, a harmonized starting point should be determined for an adequate penalty, from which the further calculation of the penalty begins. This starting point consists of three elements: the classification of infringements under Article 83(4) through (6) of the GDPR, the gravity of the infringement, and the enterprise’s turnover as a relevant factor to be taken into account when imposing an effective, deterrent, and proportionate administrative fine pursuant to article 83(1) of the GDPR (see Guidelines 04/2022 of the European Data Protection Board on the calculation of administrative fines under the GDPR, May 24, 2023, para. 46 et seq.). 3.5.3. In accordance with the EDPB’s Guidelines on the calculation of administrative fines, a harmonized starting point should be determined for an adequate penalty, from which the further calculation of the penalty begins. This starting point consists of three elements: the classification of infringements under Article 83(4) through (6) of the GDPR, the gravity of the infringement, and the enterprise’s turnover as a relevant factor to be taken into account when imposing an effective, deterrent, and proportionate administrative fine pursuant to article 83(1) of the GDPR; see also Guidelines 04 of 2022 of the European Data Protection Board on the calculation of administrative fines under the GDPR, May 24, 2023, para. 46 et seq.). In the present case, the violations covered by the penalty notice fall under the sanction provision of Article 83(5)(a) of the GDPR, whose penalty range is a threatened administrative fine of EUR 20,000.000 or, in the case of an enterprise, up to 4% of its total worldwide annual turnover for the preceding fiscal year. After reviewing BF’s annual financial statements, the prosecuting authority assumed that BF had a net income of EUR 401,516.23, the same amount that was determined in the administrative court proceedings. Based on this established retained earnings, the upper limit of the administrative fine is EUR 20,000,000. In the present case, the violations covered by the penalty notice fall under the sanction provision of paragraph 83(5)(a) GDPR, whose penalty range is a threatened administrative fine of EUR 20,000,000 or, in the case of an enterprise, up to 4% of its total worldwide annual turnover for the preceding fiscal year. After reviewing BF’s annual financial statements, the authority in question assumed that BF had a net income of EUR 401,516.23, the same amount that was determined in the administrative court proceedings. Based on this established retained earnings, the upper limit of the administrative fine is EUR 20,000,000. With this distinction, the EU legislature has provided an initial indication of the severity of the violation in an abstract sense. The more serious the violation, the higher the administrative fine may be. The enterprise’s revenue is not listed in Article 83(2) of the GDPR as a criterion for determining the administrative fine. However, this does not mean that the enterprise’s revenue is irrelevant when determining the administrative fine. “On the one hand, for enterprises with high revenue, revenue determines the upper limit of the administrative fine and thereby establishes the framework within which the specific data protection violation must be classified and assessed. The fine range provides the necessary guidance for the specific determination of the administrative fine. On the other hand, administrative fines imposed on enterprises pursuant to Article 83(1) of the GDPR must be effective and dissuasive. This also depends on the respective enterprise’s sensitivity to penalties. The larger the enterprise, the lower its sensitivity to penalties generally is, and the higher the fine must typically be set so that it can have its specific preventive effect. The amount of revenue is a suitable indicator of the enterprise’s size and thus of its sensitivity to penalties; retained earnings and other key figures reflecting the enterprise’s economic performance may also be taken into account.” (See, in this regard, BVwG, March 27, 2024, W214 2243436-1/39E, with further references.) The EDPB’s guidelines on the calculation of administrative fines also assume (with reference to a binding EDPB Decision 1/2021 on this matter) that the size of the enterprise must be taken into account when calculating the administrative fine, which is why its revenue must be considered. (see EDPB 04/2022, para. 63 et seq.) The enterprise’s revenue is not mentioned in Article 83(2) of the GDPR as a criterion for determining the administrative fine. However, this does not mean that the enterprise’s revenue is irrelevant when determining the administrative fine. “On the one hand, for enterprises with high revenue, revenue determines the upper limit of the administrative fine and thereby establishes the framework within which the specific data protection violation must be classified and assessed. The fine range provides the necessary guidance for the specific determination of the administrative fine. On the other hand, administrative fines imposed on enterprises pursuant to article 83(1) of the GDPR must be effective and dissuasive. This also depends on the respective enterprise’s sensitivity to penalties. The larger the enterprise, the lower its sensitivity to penalties generally is, and the higher the fine must typically be set so that it can have its specific preventive effect. The amount of revenue is a suitable indicator of the enterprise’s size and thus of its sensitivity to penalties; retained earnings and other key figures reflecting the enterprise’s economic performance may also be taken into account.” (See, in this regard, Federal Administrative Court [BVwG] decision of March 27, 2024, W214 2243436-1/39E, with further references.) The EDPB’s guidelines on the calculation of administrative fines also assume (with reference to a binding EDPB Decision 1 from 2021 on this matter) that the size of the enterprise must be taken into account when calculating the administrative fine, which is why its revenue must be considered. See EDPB 04 from 2022, para. 63 et seq.) 3.5.4. According to the EDPB guidelines, turnover is—alongside the classification of the violation pursuant to Art. 83(4)–(6) of the GDPR and the severity of the violation, merely one element to be used in determining the starting point for calculating the administrative fine (see again EDPB 04/2022, para. 48). In this regard, in light of the BF’s complaint—which specifically argues that the present case involves only a minor infringement—this point must be discussed in greater detail. 3.5.4. According to the EDPB guidelines, turnover is—alongside the classification of the violation under Article 83(4), paragraph 4, – 6 of the GDPR and the gravity of the violation, merely one element to be taken into account when determining the starting point for calculating the administrative fine (see again EDPB 04 from 2022, para. 48). In this regard, in light of the BF’s complaint—which specifically argues that the present case involves only a minor infringement—this point will need to be discussed in greater detail. Pursuant to the GDPR, the supervisory authority must, in particular, take the following into due account: the nature, gravity, and duration of the infringement, taking into account the nature, scope, or purpose of the processing in question, as well as the number of data subjects affected and the extent of the damage they have suffered (Art. 83(2)(a) GDPR); whether the infringement was intentional or negligent (Art. 83(2)(b) GDPR) and the categories of personal data affected by the infringement. (Art. 83(2)(g) GDPR) Under the GDPR, the supervisory authority must, in particular, take due account of the following: The nature, gravity, and duration of the breach, taking into account the Art, scope, or purpose of the processing in question, as well as the number of data subjects affected and the extent of the damage they have suffered (Article 83(2)(a) of the GDPR); Whether the breach was intentional or negligent (Article 83(2)(b) of the GDPR) and the categories of personal data affected by the breach (Article 83(2)(g) of the GDPR) Regarding the severity of the violation at issue: 3.5.4.1. In accordance with the decision of the Data Protection Authority, the Court also considers the Art of the violation to be of medium severity. The abstract classification under Article 83(5) of the GDPR already indicates that a violation of the rights set forth in Articles 5 and 6 of the GDPR involve a violation of a right that is, in substance, of a higher order than would be the case, for example, with a violation under para 83(4) of the GDPR. This is reflected not least in the higher penalty. 3.5.4.1. In accordance with the decision of the Data Protection Authority, the Court also considers the nature of the violation to be of medium severity. The abstract classification under Article 83(5), GDPR already indicates that a violation of the rights under Articles 5 and 6 of the GDPR constitutes a violation of a right that is, in essence, of a higher legal standing than would be the case, for example, with a violation under Article 83(4) of the GDPR. This is reflected not least in the higher potential penalty. The proceedings found a violation of the rights regarding processing under fairness, purpose limitation, storage limitation, as well as integrity and confidentiality (see above). This addresses the principles of data processing inherent in the GDPR. In addition, a lack of appropriate technical and organizational measures for proper data processing was identified. Given the Art of the violation, the assessment of the authority in question must therefore be upheld, as the cornerstones of secure data processing were violated. Undoubtedly, the interest of BF’s customers in the secure storage of their personal data—which corresponds to the principles of adequate data processing—must be considered extremely high, whereas no comprehensible interest on the part of BF in an insecure server structure can be identified. 3.5.4.2. In light of the aforementioned EDPB guidelines (see EDPB 04/2022, para. 53), it should be noted that the personal data was processed by BF for business purposes and that the processing of personal data does not fall within BF’s core activities but rather constitutes an organizational and legal necessity; the data itself is not in BF’s interest. Nor does the Art of the data processing indicate an imbalance between BF and the data subjects, and the Art of the processing does not, in principle, entail any exceptional risks. 3.5.4.2. In light of the aforementioned EDPB guidelines (see EDPB 04 from 2022, para. 53), it should be noted that the personal data was processed by the BF for business purposes and that the processing of personal data does not fall within the BF’s core activities, but rather constitutes an organizational and legal necessity; the data itself is not in the BF’s interest. Nor does the Art of the data processing indicate an imbalance between BF and the data subjects, and the Art of the processing does not, in principle, entail any exceptional risks. The scope of the data processing in question is directly proportional to the number of orders and, in light of the published Excel spreadsheet showing approximately 580 data subjects, is relatively extensive. The processing error does not pertain to just a few of the BF’s customers. The damage suffered by the BF—as the authority plausibly explained—is to be regarded as neutral. With regard to BF’s appeal of the decision, while it is true that the data in question consists solely of billing information and no material damage was incurred, a large number of data subjects were affected, and BF appears to ignore the publicly accessible Excel spreadsheet in its submissions. 3.5.4.3. Contrary to BF’s assertions, the duration of the violation cannot be regarded as “average,” since the personal invoices were available online for several years and thus accessible to anyone. Even after a complaint was filed by a former BF customer, the data in question remained available online for nearly half a year. 3.5.4.4. With regard to the question of liability—as the defendant authority correctly points out—negligence is to be assumed for the period of the violation up to the inquiry by the former BF customer, and conditional intent for the period thereafter until the unlawful situation was terminated in early 2026. The Court does not fail to recognize that BF is a relatively small enterprise in the glazing industry and must therefore inevitably rely on the expertise of external IT companies in certain matters. However, it is incomprehensible that such glaring errors in the company’s own server infrastructure could remain completely unnoticed for several years. Whether the controller had good reason to assume compliance with data protection regulations based on the establishment of a quality-assured organization (see VwGH June 23, 2021, Ro 2019/03/0020–0021, paras. 45 and 46, see also, in principle, VwGH March 20, 2018, Ra 2017/03/0092, with further references) is not relevant according to the case law of the CJEU in the Deutsche Wohnen SE case, because the fault of the controller—in the case of a legal entity—does not even require knowledge on the part of the governing body (see CJEU, Dec. 5, 2023, C-807/21, Deutsche Wohnen SE, para. 77; Administrative Court of Austria, June 24, 2026, Ro 2025/04/0007).The Court does not fail to recognize that BF is a relatively small enterprise in the glazing industry and must therefore inevitably rely on the expertise of external IT companies in certain matters. However, it is incomprehensible that such glaring errors in the company’s own server infrastructure could go completely unnoticed for several years. Whether the controller had good reason to assume compliance with data protection regulations based on the establishment of a quality-assured organization—see, for comparison, VwGH June 23, 2021, Ro 2019/03/0020–0021, paras. 45 and 46, see also, in principle, VwGH March 20, 2018, Ra 2017/03/0092, with further references) is not relevant according to the case law of the CJEU in the Deutsche Wohnen SE case, because the fault of the controller—in the case of a legal entity—does not even require knowledge on the part of the governing body; see CJEU, Dec. 5, 2023, C-807/21, Deutsche Wohnen SE, para. 77; Administrative Court of Austria, June 24, 2026, Ro 2025/04/0007). As already explained with regard to the assessment of evidence, data security requires a minimum level of attention from the BF itself even when IT operations are outsourced; therefore, it is inexplicable how the incorrectly configured servers could have gone unnoticed for so long. At the very latest after a former customer drew attention to the data protection issue, the BF should have investigated the incident more thoroughly; therefore, the authority in question correctly assumed conditional intent. At the same time, however, it should be noted that the BF—as the responding authority also pointed out—has a clean record under data protection law and actively participated in the administrative proceedings. Overall, the assessment of liability by the authority in question is not to be challenged. 3.5.4.5. Finally, it should be noted that the present case does not involve special categories of personal data within the meaning of Article 9 of the GDPR. 3.5.4.5. Finally, it should be noted that the present case does not involve special categories of personal data within the meaning of Article 9 of the GDPR. 3.5.5. In light of the factors just discussed, the authority’s argument that the BF committed a violation of moderate severity must be upheld. The combination of the duration of the violation, its scope, and the BF’s conduct does not allow—as the BF argues in its complaint—for the conclusion that the violation is merely of a minor degree. In accordance with the EDPB guidelines, for infringements of moderate severity, the supervisory authority must set a value between 10% and 20% of the applicable statutory maximum when calculating the starting amount. The authority in question set a starting amount of EUR 3,000,000—i.e., 15% of the statutory maximum amount—as the subject of the proceedings (see EDPB 04/2022, para. 59 et seq.).According to the EDPB guidelines, for violations of moderate severity, the supervisory authority must set a value between 10% and 20% of the applicable statutory maximum when calculating the base amount. The authority in question set a base amount of EUR 3,000,000—i.e., 15% of the statutory maximum amount—in the proceedings at issue (see EDPB 04 from 2022, para. 59 et seq.). 3.5.6. As explained in the introduction, the turnover of the enterprise in question is relevant for determining its size and thus for imposing an effective and deterrent sanction. The authority in question classified BF into the category of enterprises with annual revenue of up to 2 million euros. In light of BF’s annual financial statements included in the case file, this classification is not to be contested. Consequently, the base amount is adjusted to between 0.2% and 0.4%, with the authority deeming an adjustment to 0.4% of the base amount to be appropriate (see EDPB 04/2022, para. 65; p. 10 of the decision). It should be emphasized that BF failed to submit the enterprise’s actual worldwide annual revenue. It is within the discretion of the supervisory authority to utilize the entire range of administrative fines—from any amount up to the statutory maximum—to ensure that the administrative fine is tailored to the circumstances of the individual case, as required by the Court of Justice, when an abstract starting point is used (see EDPB Guidelines, para. 69). 3.5.6. As stated in the introduction, the turnover of the enterprise in question is relevant for determining its size and thus for imposing an effective and deterrent sanction. The authority in question classified BF into the category of enterprises with annual turnover of up to 2 million euros. In light of BF’s annual financial statements included in the case file, this classification is not to be contested. Consequently, the base amount is adjusted to between 0.2% and 0.4%, with the authority deeming an adjustment to 0.4% of the base amount to be appropriate (see EDPB 04 from 2022, para. 65; p. 10 of the decision). It should be emphasized that BF failed to submit the enterprise’s actual worldwide annual revenue. It is within the discretion of the supervisory authority to utilize the entire range of administrative fines, from any amount up to the statutory maximum, to ensure that the administrative fine is tailored to the circumstances of the individual case, as required by the Court of Justice when an abstract starting point is used (see EDPB Guidelines, para. 69). In the decision at issue, the respondent authority provides a comprehensive explanation of the factors it took into account in calculating the penalty, and there are no grounds to challenge these explanations. The authority weighed all circumstances relevant to the proceedings in accordance with the EDPB guidelines and reached a decision that is, in principle, not open to objection. However, it does not provide a clear explanation of how it arrived at a penalty amount of EUR 16,800 based on a starting amount of EUR 3,000,000 and an adjustment to 0.4%. For, as the BF correctly points out in its complaint, 0.4% of 3 million euros would be exactly EUR 12,000. The specified amount of EUR 16,800 is 0.56% of the initial amount, yet the authority does not specifically explain how this percentage increase was arrived at. Rather, it states that—apart from the parameters discussed above—no further aggravating factors apply, but that the BF’s clean record (under data protection law) and its cooperation in the proceedings were considered mitigating factors. In the opinion of this Court, the reasoning regarding this increase—which also results in the administrative fine falling outside the range of 0.2%–0.4% proposed by the EDPB—is inadequate. In the present case, the decision by the respondent authority is a discretionary one, and it is the Court’s task to review whether the exercise of discretion complies with the law, without the Administrative Court being authorized to review its own discretionary decision (see VwGH, Sept. 5, 2018, Ra 2017/12/0118). It is therefore not permissible in this case to overturn the decision of the respondent authority merely to make a Court discretionary decision. However, the authority’s decision at issue in this proceeding falls outside its margin of discretion due to the increase in the administrative fine from 0.4% of the base amount to 0.56%, which was not substantiated in detail. The reasoning provided was that precisely 0.4% of the base amount was appropriate; therefore, the increase in the percentage—which was not further substantiated—must be regarded as an abuse of discretion. Although the authority in question may exercise discretion, it must provide a comprehensible justification for the scope of discretion exercised, since even discretionary decisions must be justified in accordance with § 60 AVG in such a way so that the statement of reasons sets forth the circumstances and considerations relevant to the exercise of discretion to the extent necessary for legal review and for verifying that the discretionary act is consistent with the intent of the law (see VwGH, September 12, 2023, Ro 2023/20/0001).In the present case, the decision at issue is a discretionary decision by the respondent authority, and it is the Court’s task to review whether the exercise of discretion is in accordance with the law, without the Administrative Court (VwG) being authorized to review the respondent authority’s own discretionary decision (see VwGH, September 12,09.2018, Ra 2017/12/0118). It is therefore not permissible in the present case to overturn the decision of the respondent authority merely to make a Court discretionary decision. However, the authority’s decision at issue in this proceeding falls outside its margin of discretion due to the increase in the administrative fine from 0.4% of the base amount to 0.56%, which was not substantiated in detail. The reasoning provided was that precisely 0.4% of the base amount was appropriate; therefore, the increase in the percentage—which was not further substantiated—must be regarded as an abuse of discretion. Although the authority in question may exercise discretion, it must provide a comprehensible justification for the scope of discretion exercised, since even discretionary decisions must, pursuant to Section 60, of the AVG, be justified in such a way that the statement of reasons sets forth the circumstances and considerations relevant to the exercise of discretion to the extent to the extent necessary for legal recourse and for verifying that the discretionary act complies with the intent of the law (see VwGH, September 12, 2023, Ro 2023/20/0001). Finally, although the decision refers to specific and general preventive considerations, it uses these only to justify the imposition of a penalty in general terms, but does not explain why the penalty amount—which had already been adjusted to the respondent’s individual situation—is being increased once again. In the course of the submission of the case file to the Federal Administrative Court, the respondent authority commented on the matter and stated that the penalty imposed took into account both the size of the company and all aggravating and mitigating factors. The BF’s revenue had to be estimated due to unrealistic information provided by the BF during the proceedings. However, in its statement, the respondent authority explains that the BF’s enterprise is classified in the category “Enterprises with revenue of EUR 2 million to EUR 10 million,” but classified it in the category “enterprises with revenue of up to 2 million EUR” in the decision at issue (see decision, p. 9). In the course of submitting the case file to the Federal Administrative Court, the respondent authority commented on the matter and explained that the penalty imposed took into account both the size of the company and all aggravating and mitigating factors. BF’s revenue had to be estimated during the proceedings due to unrealistic information provided by BF. However, in its statement, the respondent authority explains that BF’s enterprise is classified in the category “Enterprises with revenue of 2 million EUR to 10 million EUR,” but classified it in the category “enterprises with revenue of up to 2 million EUR” in the decision at issue (see decision, p. 9). Insofar as the respondent authority refers to considerations of specific and general prevention in its statement, it should be noted that this does not further clarify the reasoning set forth in the decision. Despite these explanations, the decision set a penalty amount taking all relevant factors into account and ultimately increased it again without further explanation. In the opinion of this Court, the respondent authority has thereby exceeded the scope of its discretion, which is, in principle, irreversible. Taking the above considerations into account, the initial amount had to be adjusted accordingly, so that an administrative fine of EUR 12,000 appears proportionate to the offense and the circumstances. The complaint was therefore granted to the extent stated, and the administrative fine was reduced to EUR 12,000. 3.6. On the Waiver of an Oral Hearing Pursuant to § 44(1) of the Administrative Court Act (VwGVG), the Administrative Court must, as a general rule, conduct a public oral hearing in administrative penalty proceedings; however, pursuant to para 3(2) of the same section, refrain from doing so if the complaint is directed solely against the amount of the penalty and no party has requested a hearing. (See also VwGH 10/14/2024, Ra 2023/02/0132) Pursuant to Section 44(1) of the VwGVG, the Administrative Court must, as a general rule, conduct a public oral hearing in administrative penalty proceedings; however, pursuant to paragraph 3, item 2, of the aforementioned provision, refrain from doing so if the complaint is directed solely against the amount of the penalty and no party has requested a hearing. (See also VwGH 10/14/2024, Ra 2023/02/0132) In the present case—as explained above—the complaint is directed solely against the amount of the penalty, and neither the appellant, represented by a representative, nor the respondent authority requested a hearing. Given that the facts of the case have been clarified and only legal issues remain to be assessed, it was not necessary to hold a hearing. There are no indications in the respondent’s submissions or in the statement of the authority against whom the complaint was filed that would suggest a hearing is necessary. Further clarification of the facts would not be expected. 3.8. Regarding the Costs of the Administrative Penalty Proceedings and the Appeal Proceedings Pursuant to § 64(1) VStG, the penalty order must state that the penalized party is required to pay a contribution toward the costs of the penalty proceedings. Pursuant to § 64(2) VStG, this contribution for the first-instance proceedings is to be set at 10% of the penalty imposed, but not less than 10 euros. The contribution toward costs was to be reduced to EUR 1,200.00 based on the penalty now imposed. Pursuant to paragraph 64 of the VStG, the penalty notice must state that the person penalized is required to contribute toward the costs of the penalty proceedings. Pursuant to Section 64, paragraph 2, of the VStG, this contribution for the first-instance proceedings is to be calculated at 10% of the penalty imposed, but not less than 10 euros. The contribution toward costs was to be reduced to EUR 1,200.00 based on the penalty now imposed. Pursuant to Section 52(8) of the VwGVG, the costs of the appeal proceedings before the Federal Administrative Court were not to be imposed on the BF because its complaint was upheld.Pursuant to paragraph 52(8) of the VwGVG, the costs of the appeal proceedings before the Federal Administrative Court were not to be imposed on the BF because her complaint was upheld. 3.9. Payment Information The appellant must pay the total amount of EUR 13,200.00 (fine, costs of the administrative proceedings) within 2 weeks to the account of the Federal Administrative Court (BVwG) with the IBAN AT84 0100 0000 0501 0167 (BIC BUNDATWW), citing the case number, free of charge to the recipient, or to pay it in person at the Federal Administrative Court upon presentation of this decision. In the event of default, the amount will be collected by compulsory means following a formal notice of default. Re B) Inadmissibility of the Appeal: The appeal is inadmissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG) because the decision does not depend on the resolution of a legal issue of fundamental importance. Neither does the decision in question deviate from the Administrative Court’s previous case law, nor is there a lack of case law; furthermore, the Administrative Court’s existing case law cannot be deemed inconsistent. Nor are there any other indications that the legal issue to be resolved is of fundamental importance. The appeal is not admissible pursuant to article 133, paragraph 4, of the Federal Constitutional Law (B-VG) because the decision does not depend on the resolution of a legal issue of fundamental importance. Neither does the decision at hand deviate from the Administrative Court’s previous case law, nor is there a lack of case law; furthermore, the Administrative Court’s existing case law cannot be regarded as inconsistent. Nor are there any other indications that the legal issue at hand is of fundamental importance. In light of the established facts, no legal issues have arisen that would require the granting of a review. In reaching its decision, the Federal Administrative Court was able to rely on a wealth of Supreme Court case law.