CRIF – Court Ruling (Austria, 2021)

In 2018, the complainant requested access to their personal data from the CRIF (the ‘respondent’), a credit reference agency operating in Austria. After receiving the response of the agency, the complainant stated a violation of their right to access due to its insufficiency. According to the complainant, the agency failed to precisely name data sources, purposes and the storage period for the personal data. In this regard, the complainant has not been informed on new recipients of their personal data as well. Furthermore, the agency did not provide a full copy of the personal data processed on the complainant. Accordingly, it also breached the principles of data minimization and confidentiality, processing incorrect addresses and insufficiently encrypted data. The respondent indicated certain companies as their data sources and stated that the data is stored as long as there was an interest by the respondent. Moreover, the data made available by the agency presented all the data held on the complainant and a copy would not add any value. At the same time, providing more information would reveal business secrets which therefore cannot be made available. Consequently, there was no violation and therefore no right to appeal by the complainant. The Austrian DPA dismissed the complaint, arguing that the disclosure of data sources, recipients and as well as criteria for determining the storage period has fulfilled the access request of the complainant. The provided data was sufficient and a copy of the personal data does not include entire documents, exact copies or a facsimile of such, but it is in the choice of the controller on what and how exactly data is delivered. Moreover, Article 77 GDPR is standardized in administrative proceedings as part of the Austrian national law and therefore bound to its requirements. The Federal Administrative Court of Austria limited its judgement to the objections regarding the provision of information on the origin, storage period a