Court case W254 2253351-1 – Court Ruling (Austria, 2025)

The data subject requested access under Article 15 GDPR from the controller (a credit information agency). The controller provided the personal data it held, including the data subject's name, date of birth, address and business role, as well as information about the sources of those data. The data subject considered the response incomplete and requested further information. The controller provided additional information, including the companies that had queried the data subject's creditworthiness between 2014 and 2021 and the credit scores disclosed to them. The data subject then lodged a complaint with the DPA. The data subject argued that the controller processed more personal data than it had disclosed, pointing in particular to the broader categories listed in the controller’s privacy notice and the absence of information about certain data sources. During the DPA proceedings, the controller provided another response, saying that the credit score could change based on statistical criteria linked to economic developments, which it considered non-personal. The data subject appealed the DPA's decision. During the court proceedings, the controller provided further information. It explained that the credit score was calculated using, among other things, payment history data, name, age, sex, address, and the first and last confirmation of the address. However, the controller still did not disclose the specific data covered by the statistical parameters linked to general economic developments that it had used when calculating the data subject’s credit score. First, the court rejected the argument that the controller must have processed additional personal data merely because its privacy notice listed broader categories of data. The privacy notice described data that the controller could theoretically process, but this did not establish that the controller actually processed those data in relation to the data subject. Second, the court examined whether the statistical parameters used in calculating the credit score constituted personal data under Article 4(1) GDPR. It relied on the broad definition of personal data and the principle that information becomes information “about” a person when its content, purpose or effect links it to that person. The court also referred to existing case law recognising that statistical probability statements can constitute personal data when they provide an assessment relating to an identified or identifiable person. It applied that reasoning to the credit-scoring process. Although the statistical parameters relating to general economic developments did not themselves relate to the data subject, the controller fed them into the algorithm used to calculate that particular person's credit score. By doing so, the controller linked the parameters to the data subject and used them to make an assessment of that person's creditworthiness. The parameters therefore became personal data within the meaning of Article 4(1) GDPR. As a result, Article 15(1) GDPR also covered those statistical parameters. Finally, the court partly upheld the appeal and held that the controller had violated the data subject’s right of access under Article 15(1) GDPR by failing to disclose the statistical data relating to the data subject that it had used to calculate the credit score. It otherwise upheld the DPA's assessment that the controller had provided complete information about the other personal data it processed and their sources and rejected the remainder of the appeal.