KSV1870 Information GmbH – Court Ruling (Austria, 2026)

An individual (the data subject) intended to conclude an energy supply contract online with Go Green Energy GmbH (the energy provider). After initially receiving an email accepting the data subject as a customer the data subject's contract was automatically rejected due to an insufficient credit score provided to the energy provider by KSV1870 Information GmbH (the credit information agency or "KSV"). Therefore, the credit information agency's credit score led to the automated rejection of the data subject's application for the energy supply contract. The data subject eventually submitted a request to the energy provider requesting information under GDPR, in particular regarding the data exchanged with KSV. Furthermore, he submitted an access request with KSV under Article 15 GDPR. The data subject considered KSV’s response to his access request to be incomplete and filed a lawsuit claiming damages from KSV as well as the energy provider. The data subject claimed that he never consented to automated decision-making, but that the two controllers subjected him to such decision-making unlawfully in violation of Article 22 GDPR. Moreover, the data subject claim that the controllers relied on inaccurate information to calculate his credit rating, thus breaching the principle of accuracy under Article 5(1)(d) GDPR. The data subject argued that the refusal caused him worry, annoyance and stress, thereby resulting in non-pecuniary damage. He claimed €1,500 from both controllers under Article 82 GDPR in court. KSV claimed that it processed personal data under Article 6(1)(f) GDPR (i.e. legitimate interest) and that all data subjects have the right to request correction of their personal data used for the purpose of credit rating. Moreover, KSV argued that it only provided the energy provider with a credit rating, which was not a sufficient reason for a refusal to enter into a contract, and that it had no control over the energy provider's reasons for refusal. Therefore,