Court case W211 2234354-1 – Court Ruling (Austria, 2021)

The data subject had requested access under Article 15 GDPR from the controller (a credit reference agency). The controller replied on the request but provided only very superficial information about the processing logic involved and the significance and the envisaged consequences for the data subject (Article 15(1)(h) GDPR). In particular, it remained unclear to the data subject as to how the controller had calculated certain credit scores. Consequently, the data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB). The DSB upheld the complaint and ordered the controller inter alia to provide the data subject with meaningful information about the logic involved in the creation of the credit scores, as well as the significance and the envisaged consequences of these scores for the data subject. The controller filed an appeal against this decision with the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG did not decide on the appeal but suspended the procedure. It held that of the main questions of the procedure was, whether the calculation and disclosure of a credit score by a credit reference agency as such qualifies as a "decision, which produces legal effects concerning the data subject or similarly significantly affects the data subject" within the meaning of Article 22 GDPR. As the Verwaltungsgericht Wiesbaden had already requested the CJEU's preliminary ruling under Article 267 on that matter, the BVwG decided to wait for the CJEU's ruling before further trying the case.