Austria Data Protection & Privacy Regulation

Controller/Processor Duties

The same VwGH judgment that resolved the Article 9(1) special-category question (Ro 2025/04/0007, 24 June 2026) also narrowed how documentation-based aggravating factors should be assessed under Austrian GDPR enforcement practice. The lower court had treated certain DPIA (data protection impact assessment) and ROPA (records-of-processing-activities) documentation deficiencies as an aggravating factor in setting the original €16,000,000 fine against Österreichische Post AG. The VwGH found that these particular documentation deficiencies were themselves derivative of — that is, a downstream consequence of — an earlier legal mis-classification of the processing activity, rather than independent, freestanding compliance failures. On that basis, the court discontinued the separate aggravating-factor findings tied to those documentation deficiencies and recalculated the fine down to €13,000,000 plus €100,000 costs. This is a confirmed-confidence finding sourced to the Datenschutzbehörde's own notice, a Tier-1 source.

The practical significance of this holding for controller/processor accountability obligations in Austria is that a DPIA or ROPA deficiency which traces back to a single upstream classification error should not necessarily be double-counted as an additional, independent aggravating factor in fine calculation. Where a controller mis-classifies a processing activity at the outset — for example, failing to recognise that an activity involves special-category data — the documentation gaps that follow from that mis-classification (an incomplete DPIA that did not address the special-category dimension, for instance) are treated by the VwGH as a consequence of the root error rather than as separately punishable accountability failures layered on top of it.

This narrowing does not relax the underlying substantive obligation to conduct an adequate DPIA or maintain an adequate ROPA; it addresses only how documentation gaps traceable to a single upstream classification error should be weighted in fine calculation, as distinct from documentation gaps that are genuinely independent of any classification question.

Outlook

Austrian controllers facing DSB or VwGH scrutiny of multiple compliance failings arising from a single root-cause classification error now have a binding precedent for arguing against double-counting of derivative documentation deficiencies as independent aggravating factors. Future cases will likely test the boundary of this holding — specifically, how clearly a documentation deficiency must trace back to an upstream classification error before a court will treat it as derivative rather than independent.

Controller/Processor Duties

The DSB's controller/processor scrutiny this cycle is understood to centre on decision D135.027, which examines cookie-banner design and transparency practices alongside Microsoft 365 Education deployments in Austrian schools, including the third-country data-flow dimensions of those deployments. This is a Probable finding sourced from a T3 enforcement-tracker publication, and it is presented here as an active regulatory examination rather than a concluded, binding decision - the underlying claim carries is_binding: false, meaning it should be read as scrutiny in progress rather than a settled finding against a named controller.

The examination's dual focus - cookie-banner transparency on the one hand, education-sector cloud deployments on the other - illustrates the DSB's current controller/processor priorities: consent-interface adequacy for commercial websites, and third-country data-flow exposure for institutional deployments of major cloud-service providers. Both threads sit within the DSB's ordinary Article 51 GDPR supervisory remit; neither has been confirmed this cycle as having produced a final sanction or corrective order.

No further controller/processor developments - security-measure enforcement actions, DPIA-adequacy findings, or processor-agreement disputes - were located for Austria this cycle beyond the D135.027 examination.

Outlook

Whether the D135.027 examination concludes with a binding corrective order, and if so what it requires of cookie-banner design or of Microsoft 365 Education deployments specifically, is the concrete item to watch. Given the DSB's broader enforcement-capacity constraints reported elsewhere this cycle, the pace at which this examination resolves is itself a signal worth tracking.

Sectoral Watch

Austria's data protection authority is reported to have found that KSV1870's fully automated credit-scoring process, which formed the basis for a credit decision taken by energy supplier Unsere Wasserkraft, constituted an impermissible automated individual decision under Article 22 of the General Data Protection Regulation. Both KSV1870 and Unsere Wasserkraft are reported to have also fallen short of their transparency obligations to the individual affected. This account is drawn from a secondary legal-guide summary rather than the authority's own published decision, so the exact date of the finding, and whether it is final or being appealed, are not yet established.

Outlook

Confirmation through the authority's own published decision would clarify both the date and procedural status of this finding. If confirmed, it would stand as a concrete application of the Article 22 automated-decision-making prohibition to a commercial credit-scoring arrangement in Austria, relevant to any business using automated scoring as a basis for decisions that produce legal or similarly significant effects for individuals.

Sectoral Watch

The EU Data Act, Regulation (EU) 2023/2854, became directly applicable in Austria on 12 September 2025. As a directly applicable EU regulation, it required no national transposition act to take legal effect, in contrast to a directive. Despite that direct applicability, no Austria-specific national measure formally designating the competent authority or data coordinator responsible for Data Act enforcement has been located as of this cycle. Commentary reviewed this cycle responds to that gap by directing businesses to monitor Austria's official legal-information portal, RIS, and the Datenschutzbehörde in the interim, which suggests that, pending formal designation, the DSB may be the default point of contact for Data Act matters in practice even without a formal competent-authority designation having been enacted.

This is a meaningful institutional gap. The Data Act establishes obligations around data access and sharing, including rights for users of connected products to access data those products generate and obligations on data holders to make such data available under specified conditions. Enforcement of these obligations ordinarily depends on a functioning national competent-authority structure with investigative and sanctioning powers. Without a formally designated authority, the practical enforceability of Data Act obligations in Austria rests on an unclear institutional foundation, even though the underlying substantive obligations are already in force by virtue of the regulation's direct applicability.

The gap also raises a practical question for in-scope businesses, data holders and data recipients subject to the Data Act's access and sharing obligations: absent a clearly designated enforcement body, it is not established on the evidence available this cycle where a complaint about non-compliance with Data Act obligations in Austria would currently be lodged, beyond the general direction toward the DSB offered by secondary commentary. This uncertainty sits in some tension with the broader trajectory of Austria's data-protection and digital-regulation architecture, which elsewhere this cycle (in enforcement and in AI-governance matters) shows active institutional movement, whereas the Data Act competent-authority question appears comparatively dormant.

No information located this cycle indicates whether a legislative process to designate a Data Act competent authority is underway in Austria, whether such a process has been announced, or what timetable might apply. The absence of a located designation does not establish that no process exists; it establishes only that none was identified in the sources reviewed this cycle.

Outlook

The central open question for Austria's sectoral data-regulation watch is whether and when a national competent authority or data coordinator will be formally designated for EU Data Act enforcement purposes. Until that designation occurs, businesses operating in Austria that are subject to Data Act obligations should expect to rely on general guidance directing them toward RIS and the Datenschutzbehörde, rather than a clearly empowered sector-specific enforcement body. Developments on this question would represent a material change to Austria's sectoral-watch posture and should be monitored closely in subsequent cycles.

AdTech & Commercial Privacy

The DSB is understood to hold a strict interpretive position on analytics cookies: that they cannot in any case be considered technically necessary for the operation of a website, meaning opt-in consent is required for their use regardless of the specific analytics purpose claimed. This is an Uncertain-confidence finding, sourced from a single T4 vendor commentary this cycle, and it has not been independently corroborated against a DSB decision or guidance document with a specific citation.

This Austrian position stands in some tension with the European Commission's proposed Digital Omnibus. Reports suggest that if the Digital Omnibus is adopted as a directly-applicable EU Regulation, it would create an EU-level cookie-consent exemption that would override Austria's stricter national position without requiring national transposition - a structurally significant possibility given the direct-applicability mechanism involved. However, adoption of the Digital Omnibus in this form is considered unlikely before mid-2027, meaning any such override remains a multi-year prospect rather than a near-term one.

The practical consequence for Austrian-facing commercial websites and adtech operators today is that the DSB's strict opt-in position remains the operative standard; no relaxation has occurred and none is imminent this cycle.

Outlook

The Digital Omnibus's legislative progress - and specifically whether it retains the cookie-consent exemption in a form that would apply directly to Austria without transposition - is the structural item to watch over the coming one to two years, with adoption considered unlikely before mid-2027. In the interim, the DSB's strict opt-in position for analytics cookies remains the binding practical standard for Austrian-facing operators.

Algorithmic, Biometric & Surveillance Governance

The European Data Protection Board adopted Statement 1/2026 on the data protection challenges of smart glasses on 13 October 2026. The statement sets out the Board's preliminary thinking on a question that sits at the intersection of biometric data processing, surveillance governance, and AI-linked device functionality: smart glasses, by their nature, can capture images, video, and potentially biometric data about bystanders who are not the device wearer and who have not consented to being recorded. The statement considers how GDPR responsibility for this bystander data may be allocated among the device manufacturer, the provider of a linked artificial-intelligence or application service that processes the captured data, and the wearer who operates the device in a given context, with the appropriate allocation depending on the specific use case and the respective roles each party plays in determining the purposes and means of processing.

It is important to characterise the statement accurately: it is preliminary, non-binding guidance from the EDPB. It has no formal public consultation process attached, and it names no specific company, product, or device model. This distinguishes it from a binding regulatory instrument, a draft legislative proposal, or a guidance document that has gone through the EDPB's standard consultation procedures; at this stage, it functions as an articulation of the Board's thinking on an emerging technology category rather than as settled or enforceable guidance.

For Austria, the statement's relevance runs through the Datenschutzbehörde's (DSB) membership of the EDPB rather than through any separate Austrian instrument. The statement was referenced on the DSB's own public announcement feed by 15 October 2026, confirming that the Austrian authority is tracking the development, but the DSB has not, within the window checked this cycle, issued its own national-level guidance, opened an inquiry, or otherwise responded to the statement with a distinct Austrian regulatory action. The DSB's own bekanntmachungen feed, checked directly for the period from 11 to 18 October 2026, shows no new Austria-specific decision, fine, or instrument dated in that window beyond notices of this kind referencing bilateral meetings or EU-level developments.

The significance of this development for Austria is accordingly structural rather than immediate: it signals that a question relevant to a growing category of consumer AI-linked wearable devices is now on the EDPB's active agenda, which, given the DSB's membership and participation in EDPB processes, is likely to inform how the DSB itself approaches any future Austria-specific smart-glasses or similar wearable-device matter that may arise, without yet constituting a binding standard the DSB or any other Austrian body is applying today.

Outlook

Whether the DSB will move beyond tracking the EDPB statement to open a national-level inquiry or issue its own guidance addressing smart glasses or comparable AI-linked wearable devices in the Austrian market is not stated in the sources reached this cycle. The EDPB statement's current non-binding, pre-consultation status means its practical effect on Austrian controllers and processors remains prospective rather than immediate; the clearest signal to watch for in subsequent cycles is whether the EDPB moves the statement toward a formal consultation process, or whether the DSB issues any national-level follow-up referencing the statement directly.

Algorithmic, Biometric & Surveillance Governance

Austria's institutional architecture for AI Act implementation remains unsettled on a key structural point this cycle. Austria has not completed designation of its Article 70 national competent authority under the EU AI Act, having missed the 2 August 2025 deadline for doing so. In the interim, the Austrian Regulatory Authority for Broadcasting and Telecommunications' KI-Servicestelle operates as an advisory body rather than as the formally designated competent authority. This is a probable-confidence finding, and the sources reviewed this cycle disagree on whether a formal designation has since occurred — that disagreement is recorded as genuinely unresolved rather than settled by preferring one source's characterisation over another's.

Separately, reports attribute to the Datenschutzbehörde (DSB) a claimed market-surveillance competence over high-risk AI systems used for biometric identification in the law-enforcement context, a category falling under the AI Act's Annex III point 1 high-risk classification. This is an uncertain-confidence finding: no DSB primary statement was located and directly cited this cycle confirming the DSB's own position on this point, and the characterisation rests on a third-party aggregator source rather than the regulator's own publication.

Taken together, these two findings describe an institutional landscape still in formation: the overarching Article 70 competent-authority question remains open, while at the same time a specific sectoral competence claim — DSB market surveillance over law-enforcement biometric AI — is being reported even though the broader designation question it would logically sit within has not been definitively confirmed as resolved. This is the kind of institutional-architecture gap where the practical allocation of regulatory competence on the ground may be outpacing, or operating independently of, the formal designation process.

Outlook

Resolving whether Austria has completed Article 70 designation beyond the KI-Servicestelle's current advisory status is the clearest open item, and doing so will require identifying a primary Austrian government or RTR source rather than relying on the conflicting secondary characterisations available this cycle. Equally, confirming the DSB's own stated position on its market-surveillance competence over law-enforcement biometric AI systems, directly from the DSB rather than through an aggregator's characterisation, would meaningfully strengthen confidence in that specific finding.

Algorithmic, Biometric & Surveillance Governance

Austria is understood to have missed the 2 August 2025 deadline under Article 70 of the EU AI Act to designate a national competent authority responsible for implementing and enforcing the Act's obligations. As of mid-2026, the only body in existence addressing this function is the KI-Servicestelle, an advisory body housed at RTR-GmbH (the Austrian regulatory authority for broadcasting and telecommunications). No enacted timetable for converting the KI-Servicestelle into a fully empowered national competent authority with investigative and sanctioning powers has been identified in the sources reviewed this cycle.

The significance of this gap is structural rather than merely administrative. The AI Act's substantive obligations, including requirements around risk assessment for high-risk AI systems, are already enforceable in Austria by virtue of the Act's own commencement timetable, independent of whether Austria has completed its own national competent-authority designation. This creates an asymmetry: obligated parties operating AI systems in Austria face in-force substantive requirements without a clearly empowered national body positioned to enforce them, investigate non-compliance, or provide authoritative guidance on contested questions of application. This is a live governance gap, not a resolved or stable baseline, and it is reported as an escalating rather than static concern, reflecting that time has continued to pass since the missed August 2025 deadline without resolution.

The KI-Servicestelle's advisory-only status means that, for now, affected businesses and individuals seeking authoritative rulings on AI Act compliance questions in Austria lack an empowered venue for doing so at the national level. Whether complaints or compliance questions are in practice being routed to the Datenschutzbehörde, to sectoral regulators, or are simply unresolved at the national level is not established on the evidence available this cycle.

This gap should be read alongside Austria's otherwise active enforcement posture in adjacent governance domains this cycle, including the confirmed Austrian Postal Service fine for unlawful profiling. That contrast underscores that Austria's institutional gap in AI Act governance is not a function of general regulatory inactivity, but appears specific to the AI Act competent-authority designation process itself.

No information located this cycle indicates when, or whether, Austria intends to formally empower the KI-Servicestelle or designate an alternative body as the national competent authority under Article 70. The absence of a located timetable does not establish that none exists internally within Austrian government planning; it establishes only that none was identified in the sources reviewed this cycle.

Outlook

The central open question for Austria's algorithmic and surveillance-governance posture is whether and when the KI-Servicestelle will be converted into, or replaced by, a fully empowered AI Act national competent authority. Until that occurs, the enforcement gap between the AI Act's already-binding substantive obligations and Austria's incomplete institutional architecture for enforcing them will persist. This is a governance question to monitor closely, since any enacted timetable for NCA conversion, or any indication that enforcement activity is nonetheless occurring through an alternative institutional route, would represent a material development.

Enforcement & Redress

The standing position on penalty powers is unchanged: the Datenschutzbehörde may impose GDPR administrative fines of up to EUR 20 million or 4% of worldwide annual turnover, alongside separate national fines of up to EUR 50,000 under Austrian law, according to secondary legal commentary reviewed. What has moved is the resourcing behind that power. Reporting places the authority's 2026 budget at approximately EUR 5.9 million, a reduction from around EUR 6.1 million in 2025, with roughly 53 permanent staff in post. The same reporting states this reduction has coincided with a reported shift away from proactive, authority-initiated investigations toward a complaint-driven enforcement model, a shift framed against a reported 769% increase in complaint volume since 2017. Taken together, the picture is one of a widening mismatch between caseload and capacity rather than any change to the legal basis for enforcement itself.

An aggregator figure puts 2026-to-date enforcement activity at around 17 actions totalling approximately EUR 6,000 in fines, a markedly lower pace than the authority's cumulative record since inception of roughly 201 actions and approximately EUR 42.5 million. That contrast is consistent with a capacity-driven slowdown, but the figure comes from a secondary aggregator rather than the regulator's own annual activity report, and has not been independently confirmed against primary documentation. The same caution applies to two adjacent items noted only in passing: reports describing a Datenschutzbehörde finding against a major social-media tracking pixel under the reasoning line previously applied to analytics tools, and a separate reported finding against a facial-recognition database operator for scraping Austrian residents' images. Both rest on secondary reporting only, with no primary decision text reviewed, and are noted here solely as part of the authority's reported enforcement record rather than as confirmed new rulings.

Outlook

The material question going forward is whether the reported budget contraction and the reported move toward complaint-driven casework persist or deepen. If the secondary reporting proves accurate, the practical effect of Austria's enforcement framework in 2027 could diverge materially from its nominal statutory strength, with fewer authority-initiated inquiries even as complaint volumes continue to climb. Confirmation of the current-year enforcement tally and the exact budget figure against the Datenschutzbehörde's own primary reporting would sharpen this picture considerably; until that is available, the capacity constraint should be treated as a reported trend to monitor rather than a settled fact.

Enforcement & Redress

The Datenschutzbehörde's 2025 activity report states that the number of its decisions published in the federal legal information system (RIS) rose from nineteen in 2024 to sixty-seven in 2025. The authority attributes this increase to the entry into force of the Informationsfreiheitsgesetz, Austria's freedom-of-information law. This is drawn directly from the authority's own annual report.

The increase is a change in the visibility of the authority's decision-making rather than a change in its substantive enforcement standards or the underlying obligations that apply to controllers and processors in Austria. More than tripling the volume of published decisions nonetheless materially improves the ability of practitioners and affected individuals to observe how the authority is applying the law in practice.

Outlook

If the pace of publication continues at or near the 2025 level, Austria's enforcement record will become substantially more transparent and easier to track over time than it has historically been, which should make emerging patterns in the Datenschutzbehörde's decision-making more visible going forward.

Enforcement & Redress

The VwGH's final judgment in Ro 2025/04/0007, issued 24 June 2026, is the defining enforcement development of this cycle. The court confirmed Österreichische Post AG's unlawful processing, under Article 9(1) GDPR, of statistically-derived "party-affinity" data for approximately 2.2 million individuals, and fixed a combined fine of €13,000,000 plus €100,000 costs. This is now Austria's largest confirmed GDPR fine, confirmed-confidence and sourced to both the Datenschutzbehörde's own notice and the VwGH's own media release.

The judgment's path to finality is itself notable for enforcement and redress purposes: the fine was reduced from the lower court's €16,000,000 after the VwGH found that certain documentation-deficiency findings treated as aggravating factors below were in fact derivative of an earlier legal mis-classification of the processing activity (addressed in detail under Controller/Processor Duties), and discontinued those separate findings. The case therefore illustrates the full Austrian appellate pathway for a major GDPR enforcement action — from DSB investigation and initial penalty, through lower-court review, to a final VwGH determination that both substantively confirmed the core unlawfulness finding and recalibrated the penalty calculation on a narrower legal basis.

For context on enforcement capacity more broadly, the Datenschutzbehörde operated in 2026 with a budget of approximately €5.9 million, down from €6.1 million in 2025, and approximately 58 staff as of end-2025, serving a population of approximately 9 million. This is a probable-confidence finding from a single secondary source, included here as relevant background to the DSB's enforcement capacity even though it was not independently re-verified against a primary DSB budget disclosure this cycle.

Outlook

The Österreichische Post judgment, now final, establishes Austria's highest-value confirmed GDPR fine and a significant precedent on both the scope of Article 9(1) and the treatment of derivative documentation deficiencies in fine calculation. Future Austrian enforcement actions involving profiling or scoring activity with a plausible special-category dimension are likely to be assessed against this precedent, and the DSB's resourcing level — essentially flat to slightly declining in nominal terms year-on-year — is a relevant structural factor in assessing the regulator's capacity to pursue further large-scale investigations of comparable complexity.

Enforcement & Redress

Austria's most significant GDPR enforcement precedent reached a point of substantial closure this cycle. The Verwaltungsgerichtshof, Austria's highest ordinary administrative court, confirmed in a decision reported in July 2026 a EUR 16 million GDPR fine against the Austrian Postal Service. The confirmed fine concerns two distinct categories of unlawful processing: the unlawful creation and commercial use of inferred political-preference profiles, and the unlawful processing of parcel-frequency data for marketing purposes. The case traces back to the Datenschutzbehörde's original fine of EUR 18 million imposed in October 2019, meaning the confirmed figure represents a reduction from the original penalty over the course of litigation, and the confirmation now closes nearly seven years of legal process.

The significance of this confirmation extends beyond the specific penalty amount. It is reported as Austria's largest and most significant GDPR enforcement case, and its confirmation by the country's highest ordinary administrative court removes a substantial layer of legal uncertainty that had persisted since the DSB's original 2019 decision. For other controllers in Austria engaged in similar profiling or inferred-characteristic processing for marketing purposes, the confirmed decision now stands as binding precedent on the lawfulness of such practices, at the level of Austria's highest ordinary administrative court.

That said, the case may not be fully and finally closed. Some secondary sources reviewed this cycle report that a complaint to the Verfassungsgerichtshof, Austria's constitutional court, remains pending. If accurate, this would mean the Verwaltungsgerichtshof's confirmation, while authoritative at the ordinary-administrative-court level, is not necessarily the final word on the case; a successful constitutional complaint could in principle still alter the outcome. This qualification is reported with lower certainty than the confirmation itself, and whether the Verfassungsgerichtshof complaint is in fact still active, and on what grounds, is not established on the evidence available this cycle.

The nearly seven-year duration of this litigation, from the DSB's October 2019 original decision to the Verwaltungsgerichtshof's confirmation reported in July 2026, illustrates the extended timelines that can attach to large GDPR enforcement actions that are contested through Austria's full administrative court hierarchy. This has implications for how other pending or future large enforcement actions in Austria might be expected to proceed if challenged: controllers facing substantial DSB fines may pursue multi-year litigation paths before a final, uncontested resolution is reached.

Outlook

The principal open question for Austria's enforcement and redress posture is whether the reported pending Verfassungsgerichtshof complaint against the Austrian Postal Service decision is genuinely still active, and if so, what outcome it might produce. Until that question is resolved, or until it becomes clear no such complaint remains pending, the Verwaltungsgerichtshof's July 2026 confirmation should be treated as the current but not necessarily final state of Austria's largest GDPR enforcement case. Any further development in this litigation, whether confirming finality or reopening the matter, would be a material development for Austria's enforcement and redress record.

Enforcement & Redress

Austria's enforcement-and-redress picture this cycle combines a documented low conversion rate from complaint to sanction with a contracting regulatory budget. The DSB is understood to have conducted 4,030 proceedings in 2023 - comprising 2,389 national proceedings, 876 cross-border proceedings, and 765 proceedings initiated ex officio - of which only 55 resulted in fines, a 1.36 percent rate that noyb founder Max Schrems has publicly criticised. This is a Probable finding sourced from noyb, a T2 source, and it is the clearest quantitative enforcement-capacity signal available for Austria this cycle.

That enforcement-rate finding sits alongside the DSB's 2026 budget of approximately EUR 5.9 million, down from EUR 6.1 million in 2025 - a real-terms contraction for the sole national supervisory authority under Article 51 GDPR, which operates with approximately 70 staff. One 2026 commentary, sourced from a single uncorroborated T4 source, reports that this budget constraint has forced the DSB to stop proactive investigations entirely; this claim is presented here as reported rather than confirmed, given its single-source, lower-tier basis.

The DSB's enforcement powers themselves remain broad on paper: it may order cessation of unlawful processing and impose GDPR fines of up to EUR 20 million or 4 percent of global turnover, plus DSG-specific fines of up to EUR 50,000 for CCTV and data-secrecy violations. Separately, noyb has held status as a Qualified Entity under the EU Representative Actions Directive since December 2024, enabling it to bring EU-wide representative proceedings on behalf of data subjects - a redress channel operating independently of DSB capacity constraints. Most individual complaints reach the DSB via the Article 77 GDPR direct-complaint mechanism, which is reported to drive the majority of the authority's enforcement activity.

The ongoing Österreichische Post fine litigation illustrates both the DSB's enforcement reach and the current uncertainty in its outcomes: the Constitutional Court declined the underlying complaint on 9 December 2025, but the settled fine quantum remains disputed, with one account citing a 24 June 2026 Administrative High Court figure of EUR 13 million plus EUR 100,000 in costs, against an earlier, still-cited Federal Administrative Court figure of EUR 16 million from December 2024.

Outlook

Whether the DSB's budget trajectory stabilises, and whether the reported halt to proactive investigations is confirmed by further reporting, are the structural enforcement-capacity items to track. On the specific Österreichische Post matter, resolution of the disputed quantum figure is the concrete item outstanding. Separately, Regulation (EU) 2025/2518, introducing additional procedural rules for cross-border GDPR enforcement cooperation, is reported to become applicable around April 2027, which may affect how DSB's cross-border caseload (876 proceedings in 2023) is processed going forward.