- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Data Subject versus Dun & Bradstreet Austria GmbH – Court Ruling (Austria, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Austrian Supreme Administrative Court ruled in favor of a data subject who claimed Dun & Bradstreet Austria GmbH failed to provide complete information about how her data was processed. The court found that the company did not meet its obligations under GDPR regarding automated decision-making. This ruling reinforces the rights of individuals to understand how their data is used.
What happened
Dun & Bradstreet Austria GmbH did not provide sufficient information in response to a data access request.
Who was affected
A data subject who requested information about the processing of her personal data by Dun & Bradstreet Austria GmbH.
What the authority found
The court upheld that the company violated GDPR by not providing adequate information about automated decision-making.
Why this matters
This decision highlights the importance of transparency in automated data processing. Companies must ensure they provide clear information to individuals about how their data is used.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 22 March 2026.
Processing notes: articles corrected, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject submitted an access request under Article 15 GDPR to Dun & Bradstreet Austria GmbH, a credit information agency, requesting information about how her personal data was being processed. The data subject subsequently lodged a complaint, claiming that the right of access had been violated by the credit information agency for not providing complete or correct information in response to the access request and its subsequent updates. The DSB partially upheld the complaint for violation of the right of access under Article 15 GDPR by the credit information agency and found that it violated the data subject’s fundamental right to data protection : a) Regarding the categories of personal data processed, b) Concerning the credit environment data of the data subject, c) With respect to the weighting of influencing factors used in the automated decision-making, and d) As to the scope and intended effects of automated decision making. The credit information agency lodged an appeal to the Federal Administrative Court, which, partially upheld the appeal regarding points a, b, and d and dismissed the appeal as unfounded regarding point c, emphasizing that the credit information agency violated Article 15(1)(h) GDPR by not providing sufficient information about the logic of automated processing and weighting of factors. The credit information agency then filed an appeal to the Austrian Supreme Administrative Court (VwGH), arguing that it had not violated Article 15(1)(h) GDPR. The VwGH suspended the case, awaiting rulings from the CJEU in SCHUFA Holding (Germany) and Dun & Bradstreet Austria (Austria), which dealt with similar issues around credit scoring and automated processing under GDPR. The Austrian Supreme Administrative Court (BVwG) dismissed the appeal. Under Article 15(1)(h) GDPR, data subjects have the right to meaningful information about automated decision-making and to exercise this right, automated decision-making as defined in Article 22(1) GDPR mu
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Data Subject versus Dun & Bradstreet Austria GmbH in AT
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
20 August 2025
Authority
DPA BVwG
About this data
Cite as: Cookie Fines. Data Subject versus Dun & Bradstreet Austria GmbH - Austria (2025). Retrieved from cookiefines.eu
Last updated: