Court case 6Ob148/25w – Court Ruling (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court ruled that a company misused personal data by using it for credit assessments instead of its original purpose of direct marketing. This matters because it emphasizes the importance of using data only for its intended purpose. Businesses must be careful about how they use personal data to avoid legal issues.
What happened
The court found that a company used personal data collected for direct marketing for credit assessment purposes, violating data protection rules.
Who was affected
Individuals whose credit scores were assessed based on data originally collected for marketing were affected.
What the authority found
The court held that the company violated the purpose limitation principle by using personal data for a different purpose than it was collected for.
Why this matters
This ruling serves as a reminder for businesses to adhere strictly to the purposes for which they collect personal data. Companies should review their data usage policies to ensure compliance.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The controller runs an address publishing business as well as a credit information agency. As part of its credit assessment activity, it (i) checks that individuals whose credit score is requested exist with data like their name and address and (ii) issues credit scores based on data provided by debt collection agencies and on statistics, as payment default data is available on approximately 10% of Austrians. The controller bought personal data about a data subject (name, address, date of birth) from a company (B) that operates in the address publishing and direct marketing industry. The contract provided that this data may only be used to check whether the individual with that name under that address exists. While the data subject’s data was initially collected by company B for the purpose of direct marketing, the controller used the personal data in question exclusively to check the individual with that name under that address exists. At a customer's request, the controller issued a credit assessment of the data subject. The assessment was based on the name, gender and address of the data subject because there was no available data on possible payment defaults of the data subject. The data subject brought an injunction against the controller. The main discussions regarded (i) a violation of the purpose limitation principle: the data was initially collected for direct marketing purposes and later used for credit assessment; (ii) the calculation of the score, which relied solely on statistical data and not on data actually concerning the payment history of the data subject. The court of first instance and second instance rejected the injunction. The court of first instance held that the controller processed the data according to the contract with company B. Moreover, the processing for the original purpose was compatible with the further processing. The court of second instance however held that the further processing was not compatible with the original purpos
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 6Ob148/25w in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 6Ob148/25w - Austria (2026). Retrieved from cookiefines.eu
Last updated: