GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
The District Court of Overijssel ordered the Dutch municipality of Amelo to erase a 'youth assistance' file. This is the second instance in a short period of time that a lower court has ruled that the Dutch Youth Act does not authorize municipalities to keep files that are no longer needed. The court awarded the child and his mother €125 each in damages.
A data subject objected to US company WORLD COMPLIANCE INC processing and sharing their data. The data subject brought their claim against LEXISNEXIS RISK SOLUTIONS UK LTD which was designated by WorldCo’s as its representative in the UK according to Article 27 GDPR. The court ruled that the purpose of Article 27 GDPR is primarily to make it easier for data subjects and enforcement bodies to contact and communicate with an out-of-jurisdiction controller. Representatives mandated by controllers do not ‘step into the shoes’ of controllers to create the sort of ‘representative liability’ argued for by the data subject. The Claimant had given weight to the final sentence of GDPR Recital 80 which states: “The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor”. However, the court preferred the following guidance provided by the European Data Protection Board (EDPB): “The possibility to hold a representative directly liable is however limited to its direct obligations referred to in articles 30 and article 58(1) a of the GDPR.” In other words, a representative can only be held responsible for its own obligations, not for the actions of the controller or processor that appointed it.
After a contractual relationship with the music company who owned the Facebook fanpage of the musician (including their full name), the latter wanted to get back control of this page. The DPA issued an order to transfer the page (APD/GBA - 14/2020) on the basis of data portability, but this order was annulled by the Court of Appeal. The litigation chamber of the DPA then issued a second decision (APD/GBA - 02/2021) which imposed a fine of €10,000 on the music company for not transferring the fanpage of the musician to them, after they had exercised their right to data portability and right to object. The DPA imposed this second decision based on the lack of consent from the artist to use its name and the termination of the management agreement. The defendant has now appealed this decision. According to the defendant, the DPA was incorrect to find that the lawfulness of the processing of the complainant's personal data under Article 6(1)(b) stopped on 3 November 2019, when the management agreement between the artist and the defendant was terminated. The defendant argues that the termination of the management agreement has no effects on its rights to manage the Facebook page. Its right to maintain the Facebook page was not based on the management agreement. Instead, the intellectual property rights to the musical works of the artist are relevant. As the exclusive licensee of certain musical works of the artist, the defendant is entitled to use the name and image of the performing artist of these musical works for the purpose of marketing and commercialisation of the music. These rights derive from various agreements between the company and claimant (not including the management agreement) which also involve a third party music producer. The Court of Appeal annulled the DPA's decision. It held that, despite the termination of the management agreement, the music company still had a legitimate interest to manage the fanpage. This is because, according to an artist
A bailiff’s office dealing with debt recovery for parking tickets on behalf of the city requested the driver to fill in a form with personal data. The driver filed a complaint for violation of access right (Article 15), obligation to inform (Article 12), proportionality principle and illegal reuse of their data (Article 5 and 6), and minimisation principle. The Belgian Data Protection Authority considered that the form did not comply with the GDPR, and therefore issued a decision in which it reprimanded the bailiff’s office, ordered it to change its processes to comply with the GDPR and to pay a fine. The bailiff’s office, disagreeing with the decision, appealed it before the Court of Appeal. The Court confirmed its powers in accordance with Article 78 GPDR: the Court can annul and even adopt a new decision in so far as all facts and legal issues were already discussed in front of the APD. The Court can do so in case of a manifest factual or legal error by the APD. The Court confirmed the violations already noted by the Belgian DPA. However, the Court of Appeal annulled the fine (and only the fine) on the grounds that the Litigation Chamber abused its powers when inflicting an administrative fine. According to the Court, the Data Protection Authority should consider the full range of sanctions at its disposal before issuing a fine, and only impose a fine on organisations/people who do not comply with its injunctions. Inflicting an administrative fine as from the first offence was deemed contrary to the proportionality principle, which implies that the sanction must be proportionate to the infringement. In this regard, the Court noted that the DPA confirmed that the violation was not intentional and that the form with the requested personal data at stake was not sent back by the complainant. Therefore, the Court of Appeal annuls the fine, and considers that the DPA should have instead used other corrective powers. The remaining parts of the Belgian DPA 's dec
The claimant is an Austrian consumer protection institution (Verein für Konsumentinformation). It filed a Verbandsklage pursuant to § 28 of the Austrian Consumer Protection Act (KSchG) to stop the use of three (general terms and conditions) clauses with the Commercial Court of Vienna (HG Wien). A Verbandsklage is a form of popular action in which associations are granted standing not to assert the violation of their own rights, but of the rights of the general public. Clause 1: Pursuant to Sky's terms and conditions, consumers are obliged to immediately notify Sky of any changes to the data provided and notices sent to the last known address of consumers shall be deemed received. However, Sky customers received a letter with the Clause 1 informing them that their customer data should be passed on to Austrian Post for verification. If the data stored at the post office did not match the Sky data, the Sky data should be updated. Consent for the data comparison was not obtained from the customers. Sky rather invoked the legal basis of Article 6(1)(f) GDPR. If data subjects are against the verification, they should explicitly object to it. Clause 2: The second clause dealt with the transfer of data and with storage periods. Among other things, it was stated here that data may be transferred to third parties who have a contractual relationship with the subscriber (e.g. IPTV providers) and to service providers who provide services on behalf of Sky. It also stated that Sky stores the data within the statutory retention periods (in particular according to the Austrian Company Code (UGB) and the Austrian Federal Tax Code (BAO)). Clause 3: Finally, Sky's general terms and conditions stipulated that further framework data from the subscription contract may be processed for the purpose of direct advertising. The court ruled that all clauses violate the GDPR and are therefore invalid. = First, the court found that the VDI itself may assert the infringement. In particular,
On appeal, the Court of Appeal (the “Court”) examined the decision of the High Court of Justice, Queen Bench Division, concerning the validity of the so-called Immigration Exemption, contained in the Data Protection Act 2018 ("DPA 2018"). The case concerned a judicial review claim brought by two organizations (a digital rights organization, 'The Open Rights Group' and a grass-roots organization 'the3million') against the Secretaries of State for the Home Department and Digital, Culture, Media and Sport. The claimants sought a declaration that the Immigration Exemption was unlawful, on grounds that it was incompatible with the General Data Protection Regulation ("GDPR") and the Charter of Fundamental Rights of the European Union ("EU"). In its decision, the Court focused on the former claim, and found that it was unnecessary to address the latter. As a preliminary point, the Court examined whether the withdrawal of the United Kingdom (“UK”) from the EU affected the claim. Further, the Court examined whether the Immigration Exemption contained in DPA 2018 complied with the legal requirements as prescribed by Article 23 GDPR. In essence, the Immigration Exemption excluded the application of certain GDPR rights and principles (including transparency requirements, right to erasure, right to restriction of processing, right to objections to processing, and so forth) in the case of activities for the maintaining of effective immigration control. In that sense, the Court especially examined the claim advanced by the claimants that the High Court of Justice was wrong to approach the case based on the jurisprudence of the European Court of Human Rights (“ECHR”). On the preliminary point, the Court found that the UK's withdrawal from the EU has not materially affected the case. The reason is that the EU (Withdrawal) Act 2018 provides for certain aspects of EU law to remain in force, as part of English law, notwithstanding withdrawal. The GDPR falls into this category of t
De 'Regenboog Apotheek' (Rainbow pharmacy) is a pharmacy which provides its patients with so-called 'tapering strips'. These strips are used when patients stop taking certain kinds of antidepressants and ADHD-medication, as suddenly stopping can cause severe withdrawal symptoms. Tapering strips need to be made by hand for individual patients, and are therefore expensive. Health insurance company VGZ refuses to pay for these strips despite insistence of the pharmacy that they are legally obliged to do so. This dispute has led to the termination of the contract between the Regenboog pharmacy and VGZ. The pharmacy then placed an ad in a local newspaper, informing their patients that they might need to switch to a different health insurance company. In this ad, the names and work telephone numbers of two employees (who work at the purchasing department of VGZ) were included. In a separate letter to all patients using ADHD-medication, this information was repeated. Was the pharmacy allowed to publish the names of employees of the purchasing department of the health insurance company? The Court ordered the publication of the personal details of the employees unlawful, as a legal basis was missing. The Regenboog pharmacy was ordered to send a follow-up letter to all patients who had illegally received personal details, pointing them to the general customer service number of VGZ.
== Facts == The case concerns whether the refusal of the municipality of Langedijk to delete data on a minor contained in its youth assistance record was lawful. The request was made by the minor's mother, acting on behalf of her child. In the Netherlands, municipalities are responsible under the Youth Act (Jeugdwet) for providing what is known as youth assistance (Jeugdhulp). The municipalities must provide support for children under the age of 18 who, for example, have problems in the family, are struggling with mental health problems and similar. Anyone, citizen, or a public authority who is concerned about the wellbeing of a child can file a report of concern (zorgmelding) with the municipality. In this case, the municipality of Langedijk had received an unspecified number of reports of concern regarding the minor in recent years, which is why there is a file on the minor. The mother demanded that the municipality delete all the data it had on the minor in the file. Almost two months later, the municipality informed her that the request was complex and would take another two months to process. Less than 4 months after the original request, the municipality responded that it could not delete the requested data. The municipality took the position that it was legally required to retain the data, with the exception of two emails. As a result, the mother and the minor challenged the decision in court under Article 35(1) of the Dutch Act implementing the GDPR (UAVG).
An account on Instagram posted inappropriate, vulgar and sexual messages about staff at Salesian Secondary School in Limerick. For example, some messages ridiculed staff's personal appearance, weight, and sexuality. The photos accompanying the messages did not depict school staff but were sourced from the internet. The account also featured the school's address, crest, and name, and referred to its official website. The messages were deleted and the account taken down after the school's solicitor posted a request on the account. The school was also able to access the password via a student. The board of management of the school brought an application in the Irish Court seeking an order that Facebook Ireland, who owns Instagram, to disclose all data it holds which evidences the identity of the person(s) behind the account, including name(s), address, contact details, and IP address. The school authorities had previously contacted Facebook Ireland requesting information with a view to identifying the individuals. Facebook responded stating that they could not disclose user information to a private third party without a court order or request from law enforcement. The High Court judge, Mr. Justice Garrett Simons, considered it necessary to refer a number of questions in the case to the CJEU for a preliminary ruling, pursuant to Article 267 of the TFEU. In particular: * Do the rights of privacy, data protection, and freedom of expression conferred under the Charter of Fundamental Rights of the EU ('the Charter') imply a right, in principle, to post material anonymously on the internet (subject always to any countervailing objective of public interest)? If so, is this right qualified in the case of the students and staff of a secondary school? * What is the threshold to be met under the GDPR and/or the Charter before the provider of a social media platform can be compelled to disclose, to a third party, information whic
The complainant objected that when he searched for his name, search results concerning him were listed on Google. The search result linked to a news/consumer report where the complainant was interviewed in his role for a company he represented. The complainant filed a complaint with Datatilsynet, which rejected his complaint based on an assessment of the balancing of interests in Google's favour. The complainant then appealed the complaint to PVN. The PVN issued a split decision, where the majority agreed with Datatilsynet that the search result should not be delisted. In particular the following elements in the decision were emphasised: * None of the personal data concerned information covered by Article 9 or 10 GDPR. * The data subject was interviewed as part of his role in the business, and not as a private individual. * It had only been two years since the interview, and the data subject had the same role in the same company. * The interview gave a correct impression at the time it was published (though the company later won in court concerning the same case). Personvernnemda did not give the data subject's subjective feelings connected to the search result a decisive influence in the outcome.
A gas distribution company appealed the decision PS/00188/2019 of the Spanish DPA (AEPD) for considering that it was against the constitutional principle of non-retroactivity of the law, enshrined in Article 9(3) of the [https://www.boe.es/buscar/act.php?id=BOE-A-1978-31229 Spanish Constitution], as the the Spanish DPA fined the controller in accordance with the GDPR, and the alleged infringement had occurred in April 2018, before the GDPR came into effect. Therefore, GDPR should not had applied. The Spanish National High Court (AN) analysed Recital 171 GDPR and noted that the Regulation had entered into force 20 days after its publication in the Official Journal of the European Union, that is, on May 24, 2016, However, the Regulation only became directly applicable and mandatory in all its elements in each Member State as of May 25, 2018, therefore providing, the Member States and their respective Supervisory Authorities, of a period of 2 years for their preparation, application and interpretation of the different rights and obligations that it establishes. Therefore, both Directive 95/46 and the [https://www.boe.es/buscar/act.php?id=BOE-A-1999-23750 former Spanish Data Protection Act] were fully valid and applicable to the case at hand at the time of the infringement, while the AEPD applied the GDPR to the case. The AN held that the GDPR was not applicable when the alleged infringement happened, in April 2018, and that it had been retroactively applied by the AEPD, what goes against the constitutional principle of non-retroactivity of the law, enshrined in Article 9(3) of the [https://www.boe.es/buscar/act.php?id=BOE-A-1978-31229 Spanish Constitution]. The Court further clarified that the GDPR only could have been applicable if it had been more favourable to the infringer than the law that was in effect at the moment. Consequently, the AN upheld the appeal and annulled the sanction imposed by the AEPD on the controller, ordering the refund of the amount of t
On 20 August 2020, the Polish DPA [https://gdprhub.eu/index.php%3Ftitle=UODO_-_ZSO%C5%9AS.421.25.2019 imposed a fine] of approximately €11,000 on the Warsaw University of Life Sciences (SGGW) for failing to implement sufficient technical and organizational measures to prevent exposure of over 80000 records about study candidates. The data breach occurred as a result of a theft of a university employee's private laptop, on which the personal data of candidates for studies had been saved. The university argued that it had not been a controller of the data stored on the stolen device. Instead, it was the employee acting without knowledge of SGGW and in violation of internal procedures. The court fully upheld the DPA's decision and stated that the SGGW had violated the GDPR. The court disagreed with the argument that the SGGW had not been a data controller in the case. The university determined the purposes and means of the processing of personal data. Its employee was always acting on behalf of the university. Subsequently, the court agreed with the DPA that the university violated several provisions of the GDPR, including the principle of integrity and confidentiality and that the fine was correctly imposed.
On 24 August 2020, the Polish DPA fined the Chief National Surveyor (Główny Geodeta Kraju, GGK) 100,000 PLN for violating Article 5(1)(a) GDPR and Article 6(1) GDPR by publishing, on its website, numbers of land and mortgage registers without any legal basis. Users of the website, without any additional authorization, had direct access to the land and mortgage registers via hyperlinked numbers. Each register included, inter alia, names and surnames of property owners and their parents, PESEL numbers and real estate addresses. GGK appealed this decision, arguing that the legal basis for the publishing of register numbers on the website was confirmed by Chapter 6 of Annex II to the Directive 2007/2/EC of the European Parliament and of the Council of 14 March 2007 establishing an Infrastructure for Spatial Information in the European Community (INSPIRE). The Court dismissed the appeal and held that the unique numbers identifying land and mortgage registers are personal data. According to the Court, the publication of land and mortgage register numbers allows for easy, indirect identification of property owners. Thus, the land and mortgage register numbers constitute personal data. The Court also stated that GGK had no legal grounds to disclose these register numbers (as the INSPIRE Directive did not relate to the issue in question), and deliberately violated the provisions of the GDPR. It held that the € 22,150 (100,000 PLN) fine which the DPA imposed on GGK is therefore justified. The Court also found that the GGK violated Article 36(4)(16) of the Act of 6 July 1982 on land and mortgage registers. The court found that the argument of the GKK that the restrictions set out in this provision did not apply in this case was incorrect.
The Sociale Verzekerinsbank (Social Security bank, hereafter SVB) sends personal data of all newly born children in the Netherlands to the 'toeslagen' (welfare benefits) department of the tax office in a 'start-message'. The start-messages are shared on the basis of an agreement between the SVB and the tax office. Data includes the BSN-number (a state-issued identity number), date of birth and country of residence of the child. The SVB has this data as it is responsible for paying out the general child allowance, to which all parents/caretakers are entitled. The tax office is responsible for paying out the 'kindgebonden budget' (child-related budget), an extra allowance for relatively low-income families. The data in the start-messages is used to quickly decide on applications for the child-related budget. The claimant has a daughter born in 2016, whose personal data was shared by the SVB with the tax office in a start-message. The claimant's daughter does not qualify for the child-related budget. The court considered whether the child's personal data was legally shared with the tax office under the GDPR, and where it was not, whether the representative of the child have a right to monetary compensation. It held that whilst there was an infringement of the GDPR, the claimant is not entitled to compensation as damages could not be proven. The court considers that there is a proper legal basis in the law for sharing the data in the start-messages in the form of Article 38 of the Algemene wet inkomensafhankelijke regelingen (General law on income-related schemes) which requires state organs to share all relevant information with the tax office which they may need to fulfil their obligations. However, the data sharing through start-messages as required by the agreement between the SVB and the tax office is excessive. The court considers that data of all children is shared, whereas only about 42% of them qualify for the child-related budget. The agreement could therefo
The plaintiff planned the construction of a nursing home. For this purpose, he commissioned an expert office to prepare an expert opinion on the structural and functional condition of the neighbouring building with regard to existing damage. This building is owned by the data subject. The data subject requested the plaintiff to provide a copy of the expert report that did not contain the name but the address of the data subject. The plaintiff refused to do so. The data subject then requested the assistance of the competent DPA. The DPA decided that the plaintiff was obliged to provide a copy of the expert report under Article 15(3) GDPR. The present lawsuit is directed against this decision. The court ruled that the data subject had a claim against the plaintiff under Article 15(3) GDPR. = The Administrative Court of Schwerin (VG Schwerin) first finds that the expert opinion is personal data under Article 4(1) GDPR. For this purpose, it distinguishes between factual data and personal data. With reference to ECJ case law, the court explains that the delimitation is to be based on a context-related approach. Accordingly, the personal reference could result from an element of content, purpose or result, a combination of those elements or the realisation of all elements. The content element is realized when direct or indirect information about a person is given. Indirect reference to a person is assumed if statements are made about relationships, such as a statement about the value of a property. The purpose element is given if the information makes it possible to assess, treat or influence a person. This is particularly assumed when various pieces of information are linked, for example, to recognise patterns and to create corresponding analyses based on which the interaction with a person is taking place. The result element is realised if is the possibility that the information can affect the rights and interests of a specific person, for example in the case of info
On 9 July 2019, the data subject made a request to the Ministry of Justice and Security (the controller) to access his personal data pursuant to Article 15 GDPR. The controller decided to reject this request on 15 October 2019. During the hearing on 26 November 2019, the controller deemed the data subject's request to be formulated too generally. In response to this, the data subject specified it by requesting access to the personal data processed during the exchange of documents by the Dutch Immigration and Naturalization Service with the civil registry of the municipality and the Court of Appeal of Arnhem-Leeuwarden. The data subject specifically wanted to know which personal data had been processed in connection with the procedure before the Court of Appeal concerning an alleged sham paternity recognition of his daughter, and by which departments these data had been processed. In the contested decision from 19 December 2019, the controller considered the data subject’s objection to the decision as unfounded since his request did not concern personal data that had been processed by the Repatriation and Departure Service. Moreover, the data subject had initially failed to respond sufficiently to the request of the controller to provide additional information regarding his request to access. Consequently, there is no right to penalty payment due to the failing of a timely decision as the controller had the right to reject the data subject's application as unfounded. The data subject appealed this decision. First, the data subject was interested in the detailed documents and appendices in which his personal data had been processed. In the District Court’s opinion, the data subject had no right to this under Article 15 GDPR. This Article does not provide the right to physical or digital copies in which the personal data has been processed. This is further specified in Article 15(3) GDPR as it states that the data subject has the right to a copy of the personal da
The controller issues identity cards and passports. The data transmitted for this purpose are in any case stored for the duration of the validity of the identity documents. The data subject reported losing an identity card ("old ID"), which was subsequently blocked. He then applied for a new identity card ("new ID") using the same photograph, which was still valid at the time of the decision. The photograph relating to the new ID was still stored at the time of the decision. The same photograph was also stored in the data set of the old ID, even though it had been blocked for more than three years. In a complaint to the Austrian DPA (DSB), the data subject requested, among other things, the deletion of these photographs. The DSB did not follow the data subject in this respect. The data subject filed an appeal against this with the Austrian Federal Administrative Court (BVwG). The BVwG ruled, among other things, that the controller is obliged to delete the photograph relating to the old ID. However, during the period of validity of an identity document, photographs may be stored. = The court first dealt with the question of whether photographs are biometric data within the meaning of Article 4(14) GDPR. In this regard, it stated that photographs serve to uniquely identify the person to whom the identity document is issued. This does not change if queries from the identity document register are carried out according to other criteria. In the end, however, the court leaves the qualification as biometric data open, since their processing would in any case be lawful under Article 9(2)(g) GDPR. The processing of biometric data was provided for at the statutory level by the Austrian Passport Act 1992 (PassG) for reasons of substantial public interest. = The court stated that there was no obligation to delete the data concerning the new identity card. Such obligation cannot exist during the period of validity of the identity card. After the expiry of the validity, § 22
Whenever a consumer in the Netherlands obtains credit, the debt must be registered in a central register of the foundation Bureau Krediet Registratie (BKR). The case at hand involved a person with whom the bank, Rabobank, had made a special agreement. He was to pay part of a loan and was forgiven the repayment of a remaining part of the loan. After he had paid the amount agreed with the bank, Rabobank nevertheless reported him to the BKR register with a special code. This prevented him from taking out new loans, even though he was in a good financial situation. For this reason, he took the matter to court. The claimant had two mortgages on two homes with his ex-partner. Following the couple's divorce, they were forced to sell both houses. After the houses had been sold in 2015 and 2016, a residual debt of €119,979 remained. The partners were jointly responsible for the full repayment of the debt. Almost immediately after the sale of the first home, the applicant voluntarily started repaying the remaining debt at the rate of €500 per month. In November 2015, the applicant's 7 monthly repayments totalled €3500. In February 2017, Rabobank sent a letter to the applicant. The bank had calculated that the applicant could repay €1486 per month, but that this would not enable him to repay the entire debt within 5 years. The bank offered him alternative payment models; if he accepted the special arrangement, he would not have to repay the entire remaining debt. The applicant and the bank agreed that the applicant would pay €1388.89 per month for 36 months (€50,000 in total) and that the bank would pay €62,015.83. It was also agreed that the €3500 that the applicant had already paid would be deducted from the amount that the applicant owed. The applicant fully complied with the payment plan and repaid the debt between September 2017 and May 2020. On 29 May 2020, Rabobank registered the applicant in the BKR's Central Credit Information System with a special code of 3. This c
On the 17th July 2019, the claimant submitted a request to the defendant, the Board of the Municipality of Etten-Leur ('the Board'), demanding: * the erasure of his personal data, pursuant to Article 17 GDPR, which the Board had published on the Association of Dutch Municipalities ('VNG') forum - an online forum accessible to employees at other municipalities in the Netherlands. The claimant had learned that his personal data was published on the VNG forum via an access request submitted to the the Board. * damages on account of the fact that the Board had published his personal data on the forum, in accordance with Article 82 GDPR. The claimant considered €2,500 an appropriate amount. According to the claimant, the publication of his personal data on the VNG violated the principle of proportionality. Further, the claimant argued that the Board should not have shared his personal data in this way without his permission, and that it had no legal basis for such processing under Article 6 GDPR. The Board rejected the claimant's request for erasure. In particular, it argued that the claimant's request for erasure was fundamentally unfounded, as the publication of personal data on the VNG forum was not unlawful. It was therefore not obliged to erase the personal data in line with Article 17(d), nor was it obliged to provide the claimant damages. The claimant contested this decision. The Court declared the claimant's request for erasure unfounded, and rejected the request for damages. In particular, it referred to a [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RVS:2020:898 decision by the Administrative Law Division of the Council of State ('AbRS') of 1 April 2020]. This decision highlighted that a municipal Board can be requested to disclose private information about an administrative matter falling under the Dutch Government Information (Public Access) Act ('Wob'), since the implementation of the Wob is a public law task of a municipal Board, and
Insolvency proceedings were pending against the data subject due to claims in the amount of approximately €500,000. The proceedings were suspended in July 2016 because a reorganisation plan was filed in bankruptcy. The data subject paid the payment plan in August 2016. The controller is a credit scoring agency with a trade license according to § 152 of the Austrian Trade Regulation Act (GewO). It used the aforementioned financial data in its file on the basis of which his creditworthiness was assessed. The controller rejected the data subject’s request to delete the financial data. Subsequently, the data subject filed a complaint before the Austrian DPA (DSB). The DSB decided that the right to be forgotten was not infringed and rejected the complaint. The data subject has filed an administrative appeal against this decision. The Austrian Federal Administrative Court (BVwG) ruled that the data subject was not entitled to deletion. Such a right did not arise from Article 17(1)(a), (c) or (d) GDPR. In particular, this was justified by the fact that the processing operations at issue were in compliance with the principles of Article 5 GDPR and that they could be based on the legal basis of Article 6(1)(f) GDPR. = The BVwG ruled that the principle of process limitation was respected. The assessment of creditworthiness by credit agencies is a defined and clear purpose recognised by the legal system. This can be derived from § 152 GewO. The data were also accurate and complete because the controller noted in its database that the reorganization plan filed in bankruptcy was handled immediately by the complainant. They were also fundamentally necessary and suitable in order to be able to make a prognosis about the future payment behaviour of the data subject. The court focused on the issues “storage limitation” and “data minimization” and decided that those principles were followed as well. It ruled that data on financial defaults can be processed for up to 5