Court case W292 2247063-1/18E – Court Ruling (Austria, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that a credit rating agency kept information about a person's past insolvency for too long. This decision is important because it highlights the need for companies to respect people's privacy rights and not hold onto data longer than necessary.
What happened
A court found that a credit rating agency stored a person's insolvency data for an excessive period after the proceedings ended.
Who was affected
The person affected was an individual whose past insolvency information was improperly stored by the credit rating agency.
What the authority found
The court decided that the credit rating agency violated the person's right to privacy by not meeting the legal requirements for storing such information.
Why this matters
This ruling emphasizes that companies must have valid reasons for holding onto personal data. It serves as a reminder for businesses to regularly review their data retention practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Review needed — 12 April 2026.
Processing notes: articles corrected, national law identified, date discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On the 16 December 2019, the data subject filed a complaint against the controller, a credit rating agency with the Austrian DPA (Datenschutzbehoerde – DSB). The data subject alleged that the controller stored data regarding a previous insolvency for an excessive period of time after the termination of the insolvency or restructuring proceedings. Making available data on the insolvency led to the data subject suffering damages as bank loans were made unavailable to him. In the particular circumstances of the data subject, the insolvency was caused due to guaranty commitments rather than his own actions. Any debt and guaranties were settled through the restructuring proceedings and all outstanding payments were made within a month. The controller had violated the data subject’s right to privacy under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597 Article 1(1) of the Austrian Data Protection Act] (Datenschutzgesetz - DSG) as none of the requirements of Article 6(1)(f) GDPR were met for the publication of credit-limiting information. The data subject later added that his right to rectification under Article 16 GDPR, his right to erasure under Article 17 GDPR and his right to restriction under Article 18 GDPR had been violated. He further added that he is exercising his right to object under Article 21 GDPR due to violations of Article 6(1)(e) & (f) GDPR. The data subject detailed that the credit rating agency stored and made available "negative entries" for seven years after the insolvency procedure had been wrapped up. The DSB rejected the complaint on 16 August 2021 stating that the consideration of non-payments in the near past is necessary in order to disseminate a complete profile of credit worthiness. The erasure from the insolvency register does not mean that this data must automatically be removed by credit rating agencies. The data subject appealed the decision to the Federal Administrative Court of Austria
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W292 2247063-1/18E in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W292 2247063-1/18E - Austria (2024). Retrieved from cookiefines.eu
Last updated: