Data Subject versus Dun & Bradstreet Austria GmbH – Court Ruling (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The data subject submitted an access request under Article 15 GDPR to Dun & Bradstreet Austria GmbH, a credit information agency, requesting information about how her personal data was being processed. The data subject subsequently lodged a complaint, claiming that the right of access had been violated by the credit information agency for not providing complete or correct information in response to the access request and its subsequent updates. The DSB partially upheld the complaint for violation of the right of access under Article 15 GDPR by the credit information agency and found that it violated the data subject’s fundamental right to data protection : a) Regarding the categories of personal data processed, b) Concerning the credit environment data of the data subject, c) With respect to the weighting of influencing factors used in the automated decision-making, and d) As to the scope and intended effects of automated decision making. The credit information agency lodged an appeal to the Federal Administrative Court, which, partially upheld the appeal regarding points a, b, and d and dismissed the appeal as unfounded regarding point c, emphasizing that the credit information agency violated Article 15(1)(h) GDPR by not providing sufficient information about the logic of automated processing and weighting of factors. The credit information agency then filed an appeal to the Austrian Supreme Administrative Court (VwGH), arguing that it had not violated Article 15(1)(h) GDPR. The VwGH suspended the case, awaiting rulings from the CJEU in SCHUFA Holding (Germany) and Dun & Bradstreet Austria (Austria), which dealt with similar issues around credit scoring and automated processing under GDPR. The Austrian Supreme Administrative Court (BVwG) dismissed the appeal. Under Article 15(1)(h) GDPR, data subjects have the right to meaningful information about automated decision-making and to exercise this right, automated decision-making as defined in Article 22(1) GDPR mu
GDPR Articles Cited
The data subject submitted an access request under Article 15 GDPR to Dun & Bradstreet Austria GmbH, a credit information agency, requesting information about how her personal data was being processed. The data subject subsequently lodged a complaint, claiming that the right of access had been violated by the credit information agency for not providing complete or correct information in response to the access request and its subsequent updates. The DSB partially upheld the complaint for violation of the right of access under Article 15 GDPR by the credit information agency and found that it violated the data subject’s fundamental right to data protection : a) Regarding the categories of personal data processed, b) Concerning the credit environment data of the data subject, c) With respect to the weighting of influencing factors used in the automated decision-making, and d) As to the scope and intended effects of automated decision making. The credit information agency lodged an appeal to the Federal Administrative Court, which, partially upheld the appeal regarding points a, b, and d and dismissed the appeal as unfounded regarding point c, emphasizing that the credit information agency violated Article 15(1)(h) GDPR by not providing sufficient information about the logic of automated processing and weighting of factors. The credit information agency then filed an appeal to the Austrian Supreme Administrative Court (VwGH), arguing that it had not violated Article 15(1)(h) GDPR. The VwGH suspended the case, awaiting rulings from the CJEU in SCHUFA Holding (Germany) and Dun & Bradstreet Austria (Austria), which dealt with similar issues around credit scoring and automated processing under GDPR. The Austrian Supreme Administrative Court (BVwG) dismissed the appeal. Under Article 15(1)(h) GDPR, data subjects have the right to meaningful information about automated decision-making and to exercise this right, automated decision-making as defined in Article 22(1) GDPR mu
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Data Subject versus Dun & Bradstreet Austria GmbH in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Data Subject versus Dun & Bradstreet Austria GmbH - Austria (2025). Retrieved from cookiefines.eu
Last updated: