- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Court case Ro 2019/04/0232 – Court Ruling (Austria, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that a credit ranking agency did not violate a person's rights by completely deleting their data. This case illustrates the complexities of data rights and what constitutes excessive erasure.
What happened
A credit ranking agency deleted all data concerning a person after a request.
Who was affected
A person whose data was completely deleted by the credit ranking agency.
What the authority found
The court held that complete deletion of data did not violate the person's rights under GDPR.
Why this matters
This ruling clarifies that complete data deletion can be lawful and emphasizes the need for clear understanding of data rights.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 March 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject made an erasure and a rectification request to the controller – a credit ranking agency. The controller deleted all the data concerning the data subject. The data subject lodged a complaint with the Austrian DPA for excessive erasure and violation of the right to data rectification. The Austrian DPA upheld the complaint with regard to the excessive erasure and rejected the part concerning data rectification. In particular, rectification was no longer possible after the controller deleted all the data subject’s personal data. The data subject appealed the decision before the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The court rejected the appeal and overturned the DPA decision also in the part concerning the alleged excessive erasure. According to the court, the data subject’s claim that the erasure was excessive was based on the fact that the complete lack of information on the data subject in the databases of the controller could be interpreted by a third party as lack of creditworthiness. The court rejected this argument and stated that due to the complete lack of personal data following the erasure no processing could take place: mere assumptions by third parties that are based on non-existence of certain data do not constitute processing and are therefore not subject to the GDPR. Therefore, right to erasure pursuant to Article 17 GDPR was not violated. Again due to the lack of information after the deletion, the right to rectification pursuant to Article 16 GDPR did not come into play at all. The data subject appealed the decision before the Supreme Administrative Court. The Supreme Administrative Court dismissed the appeal. The court acknowledged that a data subject has in principle the right to a partial deletion pursuant to Article 17 GDPR. However, this does not entail that a complete deletion of data by the controller violates the right to erasure. As a matter of fact, the controller – at least in this case – was u
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case Ro 2019/04/0232 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
28 March 2023
Authority
DPA BVwG
About this data
Cite as: Cookie Fines. Court case Ro 2019/04/0232 - Austria (2023). Retrieved from cookiefines.eu
Last updated: