Court case W254 2253351-1 – Court Ruling (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A credit information agency in Austria faced a complaint from a user who wanted more details about their personal data. The agency provided some information but was accused of not being fully transparent. This case highlights the importance of clear communication about personal data held by companies.
What happened
A user requested access to their personal data from a credit information agency, claiming the response was incomplete.
Who was affected
The user whose credit information was processed by the agency was directly affected by this situation.
What the authority found
The court ruled that the agency did not fully comply with the user's request for information under GDPR, indicating a lack of transparency.
Why this matters
This case underscores the obligation for companies to be clear and thorough when responding to data access requests. It serves as a reminder for businesses to improve their data handling practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 8 September 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject requested access under Article 15 GDPR from the controller (a credit information agency). The controller provided the personal data it held, including the data subject's name, date of birth, address and business role, as well as information about the sources of those data. The data subject considered the response incomplete and requested further information. The controller provided additional information, including the companies that had queried the data subject's creditworthiness between 2014 and 2021 and the credit scores disclosed to them. The data subject then lodged a complaint with the DPA. The data subject argued that the controller processed more personal data than it had disclosed, pointing in particular to the broader categories listed in the controller’s privacy notice and the absence of information about certain data sources. During the DPA proceedings, the controller provided another response, saying that the credit score could change based on statistical criteria linked to economic developments, which it considered non-personal. The data subject appealed the DPA's decision. During the court proceedings, the controller provided further information. It explained that the credit score was calculated using, among other things, payment history data, name, age, sex, address, and the first and last confirmation of the address. However, the controller still did not disclose the specific data covered by the statistical parameters linked to general economic developments that it had used when calculating the data subject’s credit score. First, the court rejected the argument that the controller must have processed additional personal data merely because its privacy notice listed broader categories of data. The privacy notice described data that the controller could theoretically process, but this did not establish that the controller actually processed those data in relation to the data subject. Second, the court examined whether the statistic
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W254 2253351-1 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W254 2253351-1 - Austria (2025). Retrieved from cookiefines.eu
Last updated: