1) unknown data subject (complainant before the DSB) – Court Ruling (Austria, 2022)

In February 2019, an insolvency procedure was opened in relation to the data subject and published in the national insolvency registry (Insolvenzdatei). After the data subject had learned, that a credit reference agency (controller) had collected that data on him and was storing it in its creditworthiness database, he sent an erasure request under Article 17 GDPR to the controller, which refused to erase the data, arguing that it was allowed to process the data under Article 6(1)(f) GDPR. Consequently, the data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB) against the controller. The DSB dismissed the complaint, holding that the controller has a legitimate interest under Article 6(1)(f) GDPR to collect and process data on insolvency procedures in order to assess the data subject's creditworthiness. The data subject filed an appeal against that decision with the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG dismissed the appeal and upheld the DSB's decision. It held that data on insolvency procedures are apt information to assess an individual's creditworthiness. The BVwG then referred to established BVwG case-law (see e.g. BVwG - W211 2225136-1, BVwG - W274 2232028-1/3E or BVwG - W214 2228164-1) according to which the rules of the Capital Requirements Regulation ([https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02013R0575-20210930 Regulation 575/2013]) should be taken into account when assessing the legitimate storage duration for data on payment defaults or insolvencies. As a result, the BVwG held that the controller is allowed to store data obtained from the Insolvenzdatei for a five-year period after the clearance of the underlying debts.