- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
unknown data subject (complainant before the DSB) – Court Ruling (Austria, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that a credit reference agency must erase a debt record that had been settled over nine years ago. This decision highlights the importance of keeping personal data relevant and up-to-date. It shows that companies can't hold onto old data if it's no longer necessary for assessing a person's creditworthiness.
What happened
A court ordered a credit reference agency to erase a record of a settled debt from its database.
Who was affected
The person who had previously settled debts and requested the erasure of their data was affected.
What the authority found
The court decided that the credit reference agency had no valid reason to keep the data, violating GDPR's requirement for data relevance.
Why this matters
This ruling emphasizes that companies must regularly review the data they hold and ensure it is necessary for its intended purpose. Businesses should be proactive in managing personal data to avoid potential legal issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 20 March 2026.
Processing notes: articles corrected, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In June 2018 the data subject sent a request under Article 17 GDPR to the credit reference agency, requesting the erasure of all processed data on previously unsettled debts. The data subject stated that all debts have been settled in 2013 in the course of fulfilling a payment plan resulting from insolvency proceedings. After the credit reference agency refused the erasure, the data subject filed a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB) in July 2018. The credit reference agency argued before the DSB that the data were still relevant for correctly assessing the data subject's creditworthiness under Article 5(1)(d) GDPR. Deleting the data would lead to incorrect results. In addition, the credit reference agency's interests under Article 6(1)(f) GDPR would outweigh those of the data subject. Furthermore, the credit reference agency demanded that the DSB would not deviate from Austrian case law prior to the applicability of the GDPR, according to which payment experience data could be stored for up to 7 years after the respective debt has been settled. The DSB partially upheld the complaint, ordering the credit reference agency to erase the data on a €497 debt from their database as it had been settled in February 2013. Regarding data on a €481 debt which had been settled in April 2018, the DSB rejected the complaint, as it considered this data still necessary to assess the data subject's creditworthiness and agreed with the credit reference agency that the processing can be based on Article 6(1)(f) GDPR. The credit reference agency filed an appeal against the the DSB's order to erase the data on the €497 debt. The BVwG upheld the DSB's decision. It emphasized that at the point of the decision of the BVwG, the debt had been settled for more than 9 years. Consequently, it considered the data to be to no longer relevant for assessing the data subject's creditworthiness. The BVwG also mentioned that even under case law prior to
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (2)
Other cases involving unknown data subject (complainant before the DSB) in AT
Court Ruling
Details
Ruling Date
20 January 2022
Authority
Datenschutzbehörde
About this data
Cite as: Cookie Fines. unknown data subject (complainant before the DSB) - Austria (2022). Retrieved from cookiefines.eu
Last updated: