Court case W292 2247063-1/18E – Court Ruling (Austria, 2024)

On the 16 December 2019, the data subject filed a complaint against the controller, a credit rating agency with the Austrian DPA (Datenschutzbehoerde – DSB). The data subject alleged that the controller stored data regarding a previous insolvency for an excessive period of time after the termination of the insolvency or restructuring proceedings. Making available data on the insolvency led to the data subject suffering damages as bank loans were made unavailable to him. In the particular circumstances of the data subject, the insolvency was caused due to guaranty commitments rather than his own actions. Any debt and guaranties were settled through the restructuring proceedings and all outstanding payments were made within a month. The controller had violated the data subject’s right to privacy under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597 Article 1(1) of the Austrian Data Protection Act] (Datenschutzgesetz - DSG) as none of the requirements of Article 6(1)(f) GDPR were met for the publication of credit-limiting information. The data subject later added that his right to rectification under Article 16 GDPR, his right to erasure under Article 17 GDPR and his right to restriction under Article 18 GDPR had been violated. He further added that he is exercising his right to object under Article 21 GDPR due to violations of Article 6(1)(e) & (f) GDPR. The data subject detailed that the credit rating agency stored and made available "negative entries" for seven years after the insolvency procedure had been wrapped up. The DSB rejected the complaint on 16 August 2021 stating that the consideration of non-payments in the near past is necessary in order to disseminate a complete profile of credit worthiness. The erasure from the insolvency register does not mean that this data must automatically be removed by credit rating agencies. The data subject appealed the decision to the Federal Administrative Court of Austria (Bundesverwaltungsgericht - BVwG) which also rejected their claim on the 28 September 2022. The data subject appealed the decision of the court to the Supreme Administrative Court (Verwaltungsgerichtshof -VwGH). The VwGH repealed the decision of the BVwG with reference to the joined CJEU judgments C-26/22 and C-64/22 and referred the case to a different department of the BVwG. The BVwG explained that it had to determine whether the processing was lawful in two separate time periods. (1) The processing of data while this information was still publicly available through the insolvency database With reference to the CJEU judgment C‑131/12, the BVwG reiterated the finding in this case which showed that courts must individually assess whether the processing of data by credit rating agencies while this data is available in a public register is necessary. In the present case, the BVwG concluded that the interest of the controller outweighed the interest of the data subject as it would not be feasible for other companies to make individual inquiries with the public insolvency database. The controller was fulfilling an important task which supports the effective functioning of the economy by compiling the information. (2) The processing of data after the data had been deleted from the public insolvency database Article 6(1)(f) GDPR sets out three requirements: 1 The legitimate interest of the controller, 2 The processing of personal data must be necessary to realise this legitimate interest and 3 the rights and freedoms of the data subject cannot outweigh this interest. The BVwG pointed to CJEU C-26/22 and C-64/22 and reiterated that these cases showed that credit rating agencies cannot store information about an insolvency longer than they are available in a public register if this is the source of the information. Further, the Attorney General had highlighted that it is vital to enable data subjects to re-enter the economy after data has been deleted from the insolvency register and this would be jeopardised if the credit rating agency were to store insolvency data for an extensive period of time. Therefore, the controller could not rely on Article 6(1)(f) GDPR after the data had been deleted from the insolvency register. The BVwG concluded, that the controller should have deleted the data.