Court case W176 2250812-1 – Court Ruling (Austria, 2025)

A data subject was employed by the controller for several years. In 2010 the controller and the data subject signed also a loan agreement. Before concluding the loan agreement, the controller carried out a credit check which resulted in a classification of the data subject’s creditworthiness, nevertheless, a further processing of data of the data subject for the purposes of automated decision-making including profiling did not take place. The controller terminated the employment on 2018. On 2020, the data subject filed a complaint against the controller for allegedly failing to provide complete information and to comply with the request of the data subject for the transfer of the data under Article 15 and 20 GDPR. At a later stage in the proceedings, the data subject withdrew the complaint relating to the exercise of rights under Article 20 GDPR. Although the controller provided several sets of documents between 2018 and 2020, the data subject claimed these were incomplete according to Article 15 GDPR, that the controller’s responses were insufficient and the legal basis for data processing was not clearly explained. The data subject also claimed that its loan-related information was only partially provided and the automated processing of its personal data for credit analysis constituted profiling under Article 4(4) and 22 GDPR. The controller stated that it had provided extensive data in paper and electronic form in a comprehensive and structured manner, that some data were unavailable or withheld to protect third-party rights and that information on the systematic analysis of credit risk was a trade secret. On 19 October 2021, the DPA partially upheld the data subject’s complaint, finding that the controller had violated the data subject’s right to information, because there was no reference to the processing purposes within the meaning of Article 5(1)(b) GDPR and the legal basis was not clear , and also the controller could not rely solely on business or trade se