Court case 6Ob87/21v – Court Ruling (Austria, 2021)

The credit reference agency (the defendant) collected past payment data on the data subject (the plaintiff) in order to provide other parties with a credit score reflecting their risk of non-payment. In this regard, the defendant stored data on the plaintiff regarding several unpaid online shopping invoices from 2017 and 2018. While the plaintiff caught up with the payments later on, the data on such invoices are to remain stored as “positively settled” for a ten years’ period in the defendant’s system. The plaintiff requested the defendant to delete all the payment data relating to them. They argued that there was no further necessity to process such data since all entries have been positively settled. Moreover, the invoices amounts were insignificant and the plaintiff’s financial situation has improved considerably. The plaintiff argued therefore, that the incomplete and outdated data would unreasonably hinder their participation in economic life. According to the plaintiff, such impairments cannot be based on data that is up to ten years old. The defendant argued that the processing the data was legitimate. The purpose of the data processing is to grant other companies access to such data, given their need to assess the payment behaviour of potential customers when entering into a credit risk. Deleting such data would distort the accurate representation of the plaintiff's creditworthiness. The interests of the defendant and related third parties would outweigh the plaintiff's interest in deletion. The Austrian Supreme Court (Oberster Gerichtshof - OGH) decided, that the plaintiff's claim for erasure cannot be based on the ten-year storage period, since as part of an individual assessment, it may only examine the storage period in the particular case. Beginning with the first entry on unpaid invoices in 2017, therefore only an period of storage of approximately 3 years can be considered. In this regard, the OGH found that the plaintiff failed to provide convincing arguments against the legal opinion of the preceding lower courts' judgements. Accordingly, it is precisely necessary to record payment experience data over a longer period of time in order determine trends and avoid mere "snapshots". It is essential to ensure an objective, transparent and truthful information about customers’ ability and difficulty to pay, to minimize risks of third-party lenders. The OGH upheld the opinion by the lower courts, that the overall effect of the stored information does not ultimately cut off the plaintiff’s participation in economic life. In fact, the data is still relevant for their creditworthiness and thereby still relevant to the credit scoring agency and related third parties. Accordingly, the OGH rejected the erasure request of the plaintiff, given that it found no violation of Article 5(1)(c)(e) GDPR and a prevailing legitimate interest of the defendant according to Article 6(f) GDPR.