- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
1) unknown data subject (complainant before the DSB) – Court Ruling (Austria, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Austrian court upheld a decision requiring a credit reference agency to erase a small debt entry from its database. The debt was paid back quickly, and the court found that keeping the entry was unnecessary. This case shows that companies must consider the relevance of the data they hold.
What happened
A credit reference agency refused to erase a paid debt entry, leading to a complaint.
Who was affected
A person who had a small debt entry in a credit reference agency's database.
What the authority found
The court upheld the data protection authority's decision that the credit reference agency must erase the data, as it was no longer relevant.
Why this matters
This ruling emphasizes that businesses should regularly review the data they hold and delete information that is no longer necessary. Companies must balance their interests with those of individuals.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 21 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject requested erasure of a negative database entry from the database of an Austrian credit reference agency under Article 17 GDPR. The debt underlying the entry was EUR 38,83 and had been paid back in full only 17 days after a debt collection agency started to collect it from the data subject. Nevertheless, the credit reference agency refused to erase the data and the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde - DSB). The DSB upheld the data subject's complaint and ordered the credit reference agency to erase the data within two weeks. It held, that the data subject's interests outweigh those of the controller the in light of the insignificant amount of the debt and it's relatively quick payback. The credit reference agency filed an appeal against the DSB's decision with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG rejected the appeal and upheld the DSB's decision. In its reasoning it followed the DSB's assessment regarding legitimate interests. It further held, that the BVwG's case law on a five year storage period of payment experience data (in light of Regulation (EU) 575/2013) cannot be applied on the case at hand: these BVwG decisions dealt with data processing regarding significantly higher debt amounts and/or cases where there were multiple negative payment experience data in the credit reference agency's database.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (1)
Other cases involving 1) unknown data subject (complainant before the DSB) in AT
Details
About this data
Cite as: Cookie Fines. 1) unknown data subject (complainant before the DSB) - Austria (2021). Retrieved from cookiefines.eu
Last updated: