- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
unknown data subject (complainant before the DSB) – Court Ruling (Austria, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Austrian credit reference agency was challenged for not deleting old debt records after they were settled. The court ruled that the agency should have erased unnecessary data, highlighting the importance of data accuracy and timely updates. This case shows how individuals can assert their rights regarding personal data.
What happened
The court ruled that the credit reference agency failed to delete settled debt records when requested.
Who was affected
An individual who requested the deletion of her settled debts from the credit reference agency.
What the authority found
The court found that the agency did not have a valid reason to keep the outdated debt records, violating GDPR's requirements.
Why this matters
This case emphasizes the importance of keeping personal data accurate and up-to-date. Businesses should regularly review their data retention policies to ensure compliance with GDPR.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 21 March 2026.
Processing notes: articles corrected, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In January 2020, the data subject requested access under Article 15 GDPR from an Austrian credit reference agency (controller). The controller replied that it processed (among other data) eleven database entries on the data subject, concerning debts that had not been settled on time. The debts ranged between €42,70 and €186,84. At the time of the reply to the access request, all debts had been settled; some already in July 2014, others only in September 2019. Furthermore, the controller processed eight data sets on (former) addresses of the data subject. The data subject requested the controller to erase all data, arguing that she had not been able to get a loan to buy furniture for her apartment due to a low credit score assigned by the controller as a consequence of the processed data on previous debts. The data subjected also stated to have been employed for over a year with a high income and that she had been able to settle all debts. Hence her creditworthiness should be considered restored. The controller erased a database entry on a €72,95 debt from 2019, but refused to delete anything else, arguing that there was no reason for erasure under Article 17 GDPR as the processing was still necessary and lawful under Article 6(1)(f) GDPR. In June 2020, the data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB), arguing that further processing of the data was not necessary due to the low amount of the individual debts and the fact that all debts have already been settled. Hence, the interests of the data subject also outweighed those of the controller under Article 6(1)(f) GDPR. The controller contested these arguments but erased two further database entries on previous debts (on a €37,70 debt and a €46,45 debt, both settled in 2014) and several old addresses. In September 2020, following a further exchange of submissions before the DSB, the controller deleted four more database entries (on debts ranging from €85,40 to
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (2)
Other cases involving unknown data subject (complainant before the DSB) in AT
Court Ruling
Details
Ruling Date
29 June 2022
Authority
Datenschutzbehörde
About this data
Cite as: Cookie Fines. unknown data subject (complainant before the DSB) - Austria (2022). Retrieved from cookiefines.eu
Last updated: