1) unknown data subject (complainant before the DSB) – Court Ruling (Austria, 2021)

A data subject requested erasure of a negative database entry from the database of an Austrian credit reference agency under Article 17 GDPR. The debt underlying the entry was EUR 38,83 and had been paid back in full only 17 days after a debt collection agency started to collect it from the data subject. Nevertheless, the credit reference agency refused to erase the data and the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde - DSB). The DSB upheld the data subject's complaint and ordered the credit reference agency to erase the data within two weeks. It held, that the data subject's interests outweigh those of the controller the in light of the insignificant amount of the debt and it's relatively quick payback. The credit reference agency filed an appeal against the DSB's decision with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG rejected the appeal and upheld the DSB's decision. In its reasoning it followed the DSB's assessment regarding legitimate interests. It further held, that the BVwG's case law on a five year storage period of payment experience data (in light of Regulation (EU) 575/2013) cannot be applied on the case at hand: these BVwG decisions dealt with data processing regarding significantly higher debt amounts and/or cases where there were multiple negative payment experience data in the credit reference agency's database.