Court case W292 2301229-1 – Court Ruling (Austria, 2025)

In 2024, a data subject filed a complaint to the DPA regarding the right to erasure of stored payment history data. The controller, a credit reporting agency, updated the data subject’s credit score following an out of court proceedings in 2019. The data subject’s request for a loan was rejected on the basis that banks received the information “Score value 0 - no calculation possible” when requesting information about the data subject. This value was an error as a result of the controller not being able to correctly assign a numerical value to the out of court proceedings. The entries analysed by the DPA and Court were the ones on the completion of out of court settlement and “Score value 0: No calculation possible”. In its decision, the DPA applied the reasoning of CJEU case law (the SCHUFA case) to conclude that the processing of payment history also constitutes a serious interference with the fundamental right to privacy and data protection ([https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:12012P/TXT Article 7 CFR and Article 8 CFR]). The DPA then applied national law on time limits in processing of data related to insolvency procedures, arguing that the controller should have deleted the data relating to the out of court settlement. By not deleting this information the controller was violating the data subject's right to erasure under Article 17 GDPR. The controller disputed the DPA's reasoning and brought an appeal to the Federal Administrative Court. The controller argued that the SCHUFA case did not apply, because it related to publicly accessible data. It also claimed that the data processing was not a serious interference with the data subject's fundamental rights. The Court upheld the decision on the DPA regarding automated processing, but dismissed the reasoning on processing of payment history. The Court upheld the arguments of the controller, and stated that the facts of the current case differ in essential elements to SCHUFA. The Court concluded that the processing was valid under Article 6(1)(f) GDPR because the controller makes this information available to a limited number of lending insurance companies. The Court also considered that the effect of this processing was not detrimental to the data subject, because they were able to conclude two leasing agreements following the out of court proceedings. In its analysis of the zero-score value, the Court considered that it played a decisive role in the decision to grant a credit. This is supported by the fact that the bank refused the loan specifically because of the error message. Therefore, this would be considered a legal or similar effect in accordance with Article 22(1) GDPR. The Court also stated that the processing carried out by the controller falls under the scope of profiling based on SCHUFA and Article 4(4) GDPR. Furthermore, there was a risk of circumventing Article 22 and data subject rights if it were to be interpreted narrowly, and only apply to the third party making the decision. An example is right to request under Article 15(1)(h) GDPR because the third party making that decision would not be able to explain how the credit agency reached that conclusion. Finally, the Court analysed whether the exceptions allowing processing (Article 22(2) GDPR) apply. In this case, none of the exceptions apply. In addition, the Court stated that the controller had not processed the data lawfully, and did not act in good faith. It is important to note that according to the Court, the calculation of a credit score by a credit reporting agency is still allowed. However, it must have a supportive and not decisive role in determining creditworthiness as seen in SCHUFA. The Court ordered the controller to delete the error message entry in accordance with Article 17(1) GDPR.