Austrian ministry could face GDPR penalty after publishing personal data online