Court case W176 2250812-1 – Court Ruling (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A data subject was employed by the controller for several years. In 2010 the controller and the data subject signed also a loan agreement. Before concluding the loan agreement, the controller carried out a credit check which resulted in a classification of the data subject’s creditworthiness, nevertheless, a further processing of data of the data subject for the purposes of automated decision-making including profiling did not take place. The controller terminated the employment on 2018. On 2020, the data subject filed a complaint against the controller for allegedly failing to provide complete information and to comply with the request of the data subject for the transfer of the data under Article 15 and 20 GDPR. At a later stage in the proceedings, the data subject withdrew the complaint relating to the exercise of rights under Article 20 GDPR. Although the controller provided several sets of documents between 2018 and 2020, the data subject claimed these were incomplete according to Article 15 GDPR, that the controller’s responses were insufficient and the legal basis for data processing was not clearly explained. The data subject also claimed that its loan-related information was only partially provided and the automated processing of its personal data for credit analysis constituted profiling under Article 4(4) and 22 GDPR. The controller stated that it had provided extensive data in paper and electronic form in a comprehensive and structured manner, that some data were unavailable or withheld to protect third-party rights and that information on the systematic analysis of credit risk was a trade secret. On 19 October 2021, the DPA partially upheld the data subject’s complaint, finding that the controller had violated the data subject’s right to information, because there was no reference to the processing purposes within the meaning of Article 5(1)(b) GDPR and the legal basis was not clear , and also the controller could not rely solely on business or trade se
GDPR Articles Cited
A data subject was employed by the controller for several years. In 2010 the controller and the data subject signed also a loan agreement. Before concluding the loan agreement, the controller carried out a credit check which resulted in a classification of the data subject’s creditworthiness, nevertheless, a further processing of data of the data subject for the purposes of automated decision-making including profiling did not take place. The controller terminated the employment on 2018. On 2020, the data subject filed a complaint against the controller for allegedly failing to provide complete information and to comply with the request of the data subject for the transfer of the data under Article 15 and 20 GDPR. At a later stage in the proceedings, the data subject withdrew the complaint relating to the exercise of rights under Article 20 GDPR. Although the controller provided several sets of documents between 2018 and 2020, the data subject claimed these were incomplete according to Article 15 GDPR, that the controller’s responses were insufficient and the legal basis for data processing was not clearly explained. The data subject also claimed that its loan-related information was only partially provided and the automated processing of its personal data for credit analysis constituted profiling under Article 4(4) and 22 GDPR. The controller stated that it had provided extensive data in paper and electronic form in a comprehensive and structured manner, that some data were unavailable or withheld to protect third-party rights and that information on the systematic analysis of credit risk was a trade secret. On 19 October 2021, the DPA partially upheld the data subject’s complaint, finding that the controller had violated the data subject’s right to information, because there was no reference to the processing purposes within the meaning of Article 5(1)(b) GDPR and the legal basis was not clear , and also the controller could not rely solely on business or trade se
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W176 2250812-1 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W176 2250812-1 - Austria (2025). Retrieved from cookiefines.eu
Last updated: