DPA case 2024-0.501.636 – Dismissed (Austria, 2025)

The data subject entered into a consumer loan agreement with a bank (the controller). Due to repayment defaults, the controller initiated judicial recovery proceedings, which resulted in a final and enforceable court decision issued by the competent Austrian court, confirming the outstanding debt. As the data subject failed to comply with the court judgment, the controller recorded the unpaid debt in a loan register and the associated alarm list maintained by a banking association for purposes of credit risk management and creditor protection. After obtaining a self-disclosure from the register, the data subject requested erasure of the entry pursuant to Article 17 GDPR and that the continued processing constituted unlawful use of personal data under GDPR. The controller refused erasure, stating that the judgment remained enforceable and the processing of data subject's personal data was lawful. The data subject then lodged a complaint with the Austrian Data Protection Authority (DSB). The Austrian Data Protection Authority dismissed the complaint as unfounded. It held that the controller was lawfully processing the personal data because the underlying claim had been confirmed by a final court judgment, remained enforceable, and had not been satisfied. The Authority further held that the personal data remained necessary for the purposes for which it was processed, namely the assessment of creditworthiness and creditor protection within the banking system. As a result, the requirements for erasure under Article 17(1)(a) GDPR were not met. The Authority also found that none of the other grounds for erasure under Article 17(1)(b)–(f) GDPR applied.