unknown data subject (complainant before the DSB) – Court Ruling (Austria, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian credit reference agency was told to delete some of a person's old debt records after they requested it. This ruling is significant because it shows that companies must consider people's current situations when handling their data.
What happened
The Austrian Data Protection Authority ruled that the credit reference agency must delete certain old debt records after the person requested erasure.
Who was affected
A person whose past debts were affecting their credit score and ability to get loans.
What the authority found
The authority found that the agency's continued processing of the person's old debts was not necessary, violating GDPR's rules on data erasure.
Why this matters
This case sets a precedent for how companies should handle old debt information. It reminds businesses to regularly review data and consider individuals' current circumstances when processing their information.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
In January 2020, the data subject requested access under Article 15 GDPR from an Austrian credit reference agency (controller). The controller replied that it processed (among other data) eleven database entries on the data subject, concerning debts that had not been settled on time. The debts ranged between €42,70 and €186,84. At the time of the reply to the access request, all debts had been settled; some already in July 2014, others only in September 2019. Furthermore, the controller processed eight data sets on (former) addresses of the data subject. The data subject requested the controller to erase all data, arguing that she had not been able to get a loan to buy furniture for her apartment due to a low credit score assigned by the controller as a consequence of the processed data on previous debts. The data subjected also stated to have been employed for over a year with a high income and that she had been able to settle all debts. Hence her creditworthiness should be considered restored. The controller erased a database entry on a €72,95 debt from 2019, but refused to delete anything else, arguing that there was no reason for erasure under Article 17 GDPR as the processing was still necessary and lawful under Article 6(1)(f) GDPR. In June 2020, the data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB), arguing that further processing of the data was not necessary due to the low amount of the individual debts and the fact that all debts have already been settled. Hence, the interests of the data subject also outweighed those of the controller under Article 6(1)(f) GDPR. The controller contested these arguments but erased two further database entries on previous debts (on a €37,70 debt and a €46,45 debt, both settled in 2014) and several old addresses. In September 2020, following a further exchange of submissions before the DSB, the controller deleted four more database entries (on debts ranging from €85,40 to
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (3)
Other cases involving unknown data subject (complainant before the DSB) in AT
Court Ruling
Details
About this data
Cite as: Cookie Fines. unknown data subject (complainant before the DSB) - Austria (2022). Retrieved from cookiefines.eu
Last updated: