[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7a9Ll3BJoSL3d0KJqBklW7iRCjkU3lpWhL8mO1gYwUs":3},{"article":4,"iocs":49},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":26,"category":27,"article_tags":31},"3a1e1288-ea43-423b-ac0d-2a81d1444d8c","BVwG - W254 2253353-1","bvwg-w254-2253353-1-73b755","Links added ← Older revision Revision as of 05:27, 13 July 2026 Line 83: Line 83: === Facts === === Facts === On 07.04.2021, the data subject requested access to their data under [[Article 15 GDPR|Article 15 GDPR]]. The controller replied on 12.04.2021 and provided further information on 27.05.2021 after the data subject made a further enquiry. On 07.04.2021, the data subject requested access to their data under [[Article 15 GDPR]]. The controller replied on 12.04.2021 and provided further information on 27.05.2021 after the data subject made a further enquiry. As the controller's privacy policy listed significantly more data being collected, the data subject lodged a complaint with the Austrian DPA (DSB) on 13.07.2021. They argued that the data provided and its sources were incomplete. As the controller's privacy policy listed significantly more data being collected, the data subject lodged a complaint with the Austrian DPA (DSB) on 13.07.2021. They argued that the data provided and its sources were incomplete. Line 91: Line 91: On 09.02.2022, the controller appealed, stating that its calculations were not based on automated processing and that providing further information would reveal trade secrets. On 09.02.2022, the controller appealed, stating that its calculations were not based on automated processing and that providing further information would reveal trade secrets. The proceedings were stayed until the CJEU's preliminary ruling in 'Dun & Bradstreet Austria' (C‑203\u002F22) ECLI:EU:C:2025:117. By letter of 15.05.2025, the court resumed the case. The proceedings were stayed until the CJEU's preliminary ruling in [https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fdocument\u002FC\u002F2022\u002FC-0203-22-00000000RP-01-P-01\u002FARRET\u002F295841-EN-1-html 'Dun & Bradstreet Austria' (C‑203\u002F22) ECLI:EU:C:2025:117]. By letter of 15.05.2025, the court resumed the case. During the entire proceedings, the controller gradually provided further information on the personal data being processed and the calculation of the credit score. During the entire proceedings, the controller gradually provided further information on the personal data being processed and the calculation of the credit score. Line 98: Line 98: === Holding === === Holding === First the court ruled that the controller had an obligation to provide information under [[Article 15 GDPR#1h|Article 15(1)(h) GDPR]], as all three cumulative requirements pursuant to [[Article 22 GDPR|Article 22 GDPR]] were stated to be met: First the court ruled that the controller had an obligation to provide information under [[Article 15 GDPR#1h|Article 15(1)(h) GDPR]], as all three cumulative requirements pursuant to [[Article 22 GDPR]] were stated to be met: A credit score was calculated ('decision'), which predicts various aspects of the data subject, including their economic situation, for example. This constitutes profiling within the meaning of [[Article 4 GDPR#4|Article 4(4) GDPR]] ('based solely on automated processing, including profiling'), impacting the decision-making of third parties regarding contractual relationships with the data subject ('produces legal effects [...] or [...] similarly significantly affects' concerning the data subject) . A credit score was calculated ('decision'), which predicts various aspects of the data subject, including their economic situation, for example. This constitutes profiling within the meaning of [[Article 4 GDPR#4|Article 4(4) GDPR]] ('based solely on automated processing, including profiling'), impacting the decision-making of third parties regarding contractual relationships with the data subject ('produces legal effects [...] or [...] similarly significantly affects' concerning the data subject) . Line 110: Line 110: The court based their ruling, among others, in accordance with the following CJEU's judgments: The court based their ruling, among others, in accordance with the following CJEU's judgments: In 'SCHUFA' (C‑634\u002F21) ECLI:EU:C:2023:957, the court ruled that the concept of 'automated individual decision-making' under [[Article 22 GDPR#1|Article 22(1) GDPR]] encompasses the provision of a probability value regarding a data subject's 'ability to meet payment commitments', on which a third party heavily relies to decide whether 'to establish, implement or terminate' a contract with that data subject. In [https:\u002F\u002Fjuris.curia.europa.eu\u002Fjuris\u002Fdocument\u002Fdocument.jsf?text=&docid=280426&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=1505002 'SCHUFA' (C‑634\u002F21) ECLI:EU:C:2023:957], the court ruled that the concept of 'automated individual decision-making' under [[Article 22 GDPR#1|Article 22(1) GDPR]] encompasses the provision of a probability value regarding a data subject's 'ability to meet payment commitments', on which a third party heavily relies to decide whether 'to establish, implement or terminate' a contract with that data subject. In 'Dun & Bradstreet Austria' (C-203\u002F22) ECLI:EU:C:2025:117, the court stated that the wording of [[Article 15 GDPR#1h|Article 15(1)(h) GDPR]] must be understood as meaning that the controller must provide clear, transparent and understandable information about the methods and principles used to produce the data subject's credit score. If the controller claims that sharing this information would disclose trade secrets or data of third parties, the competent DPA or court must balance the competing rights and interests to determine the extent of the disclosure. In [https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fdocument\u002FC\u002F2022\u002FC-0203-22-00000000RP-01-P-01\u002FARRET\u002F295841-EN-1-html 'Dun & Bradstreet Austria' (C-203\u002F22) ECLI:EU:C:2025:117], the court stated that the wording of [[Article 15 GDPR#1h|Article 15(1)(h) GDPR]] must be understood as meaning that the controller must provide clear, transparent and understandable information about the methods and principles used to produce the data subject's credit score. If the controller claims that sharing this information would disclose trade secrets or data of third parties, the competent DPA or court must balance the competing rights and interests to determine the extent of the disclosure. == Comment == == Comment == The controller lodged an extraordinary appeal with the Austrian Supreme Administrative Court. The controller lodged an extraordinary appeal with the Austrian Supreme Administrative Court. On 11.06.2026, the court quashed the decision due to an error of law. The BVwG failed to make any findings regarding the existence of an automated decision and its effects on the data subject (VwGH 11.06.2026, Ra 2026\u002F04\u002F0002). On 11.06.2026, the court quashed the decision due to an error of law. The BVwG failed to make any findings regarding the existence of an automated decision and its effects on the data subject ([https:\u002F\u002Fwww.ris.bka.gv.at\u002FDokument.wxe?ResultFunctionToken=a5fb5bfc-070a-42e6-8412-d859f555feef&Position=1&SkipToDocumentPage=True&Abfrage=Vwgh&Entscheidungsart=Undefined&Sammlungsnummer=&Index=&SucheNachRechtssatz=True&SucheNachText=True&GZ=Ra+2026%2f04%2f0002&VonDatum=&BisDatum=13.07.2026&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Dokumentnummer=JWT_2026040002_20260611L00 VwGH 11.06.2026, Ra 2026\u002F04\u002F0002]). == Further Resources == == Further Resources ==","An Austrian court quashed a decision regarding a credit score calculation, finding that the lower court (BVwG) failed to properly assess the existence and effects of automated decision-making. The case involved a data subject's request for access to their data under GDPR Article 15, and a complaint that the provided information was incomplete. The ruling highlights the importance of transparency in automated profiling and the need for courts to thoroughly examine the application of GDPR Article 22.","Austrian court quashes credit score ruling over automated decision-making.","Help BVwG - W254 2253353-1: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 05:22, 13 July 2026 view sourceMarcm (talk | contribs)14 edits Tag: submission [1.0] Revision as of 05:27, 13 July 2026 view source Marcm (talk | contribs)14 editsm Tag: Visual editNewer edit → Line 83: Line 83: === Facts ====== Facts === On 07.04.2021, the data subject requested access to their data under [[Article 15 GDPR|Article 15 GDPR]]. The controller replied on 12.04.2021 and provided further information on 27.05.2021 after the data subject made a further enquiry. On 07.04.2021, the data subject requested access to their data under [[Article 15 GDPR]]. The controller replied on 12.04.2021 and provided further information on 27.05.2021 after the data subject made a further enquiry. As the controller's privacy policy listed significantly more data being collected, the data subject lodged a complaint with the Austrian DPA (DSB) on 13.07.2021. They argued that the data provided and its sources were incomplete. As the controller's privacy policy listed significantly more data being collected, the data subject lodged a complaint with the Austrian DPA (DSB) on 13.07.2021. They argued that the data provided and its sources were incomplete. Line 91: Line 91: On 09.02.2022, the controller appealed, stating that its calculations were not based on automated processing and that providing further information would reveal trade secrets.On 09.02.2022, the controller appealed, stating that its calculations were not based on automated processing and that providing further information would reveal trade secrets. The proceedings were stayed until the CJEU's preliminary ruling in 'Dun & Bradstreet Austria' (C‑203\u002F22) ECLI:EU:C:2025:117. By letter of 15.05.2025, the court resumed the case. The proceedings were stayed until the CJEU's preliminary ruling in [https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fdocument\u002FC\u002F2022\u002FC-0203-22-00000000RP-01-P-01\u002FARRET\u002F295841-EN-1-html 'Dun & Bradstreet Austria' (C‑203\u002F22) ECLI:EU:C:2025:117]. By letter of 15.05.2025, the court resumed the case. During the entire proceedings, the controller gradually provided further information on the personal data being processed and the calculation of the credit score.During the entire proceedings, the controller gradually provided further information on the personal data being processed and the calculation of the credit score. Line 98: Line 98: === Holding ====== Holding === First the court ruled that the controller had an obligation to provide information under [[Article 15 GDPR#1h|Article 15(1)(h) GDPR]], as all three cumulative requirements pursuant to [[Article 22 GDPR|Article 22 GDPR]] were stated to be met: First the court ruled that the controller had an obligation to provide information under [[Article 15 GDPR#1h|Article 15(1)(h) GDPR]], as all three cumulative requirements pursuant to [[Article 22 GDPR]] were stated to be met: A credit score was calculated ('decision'), which predicts various aspects of the data subject, including their economic situation, for example. This constitutes profiling within the meaning of [[Article 4 GDPR#4|Article 4(4) GDPR]] ('based solely on automated processing, including profiling'), impacting the decision-making of third parties regarding contractual relationships with the data subject ('produces legal effects [...] or [...] similarly significantly affects' concerning the data subject) .A credit score was calculated ('decision'), which predicts various aspects of the data subject, including their economic situation, for example. This constitutes profiling within the meaning of [[Article 4 GDPR#4|Article 4(4) GDPR]] ('based solely on automated processing, including profiling'), impacting the decision-making of third parties regarding contractual relationships with the data subject ('produces legal effects [...] or [...] similarly significantly affects' concerning the data subject) . Line 110: Line 110: The court based their ruling, among others, in accordance with the following CJEU's judgments:The court based their ruling, among others, in accordance with the following CJEU's judgments: In 'SCHUFA' (C‑634\u002F21) ECLI:EU:C:2023:957, the court ruled that the concept of 'automated individual decision-making' under [[Article 22 GDPR#1|Article 22(1) GDPR]] encompasses the provision of a probability value regarding a data subject's 'ability to meet payment commitments', on which a third party heavily relies to decide whether 'to establish, implement or terminate' a contract with that data subject. In [https:\u002F\u002Fjuris.curia.europa.eu\u002Fjuris\u002Fdocument\u002Fdocument.jsf?text=&docid=280426&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=1505002 'SCHUFA' (C‑634\u002F21) ECLI:EU:C:2023:957], the court ruled that the concept of 'automated individual decision-making' under [[Article 22 GDPR#1|Article 22(1) GDPR]] encompasses the provision of a probability value regarding a data subject's 'ability to meet payment commitments', on which a third party heavily relies to decide whether 'to establish, implement or terminate' a contract with that data subject. In 'Dun & Bradstreet Austria' (C-203\u002F22) ECLI:EU:C:2025:117, the court stated that the wording of [[Article 15 GDPR#1h|Article 15(1)(h) GDPR]] must be understood as meaning that the controller must provide clear, transparent and understandable information about the methods and principles used to produce the data subject's credit score. If the controller claims that sharing this information would disclose trade secrets or data of third parties, the competent DPA or court must balance the competing rights and interests to determine the extent of the disclosure.In [https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fdocument\u002FC\u002F2022\u002FC-0203-22-00000000RP-01-P-01\u002FARRET\u002F295841-EN-1-html 'Dun & Bradstreet Austria' (C-203\u002F22) ECLI:EU:C:2025:117], the court stated that the wording of [[Article 15 GDPR#1h|Article 15(1)(h) GDPR]] must be understood as meaning that the controller must provide clear, transparent and understandable information about the methods and principles used to produce the data subject's credit score. If the controller claims that sharing this information would disclose trade secrets or data of third parties, the competent DPA or court must balance the competing rights and interests to determine the extent of the disclosure. == Comment ==== Comment == The controller lodged an extraordinary appeal with the Austrian Supreme Administrative Court.The controller lodged an extraordinary appeal with the Austrian Supreme Administrative Court. On 11.06.2026, the court quashed the decision due to an error of law. The BVwG failed to make any findings regarding the existence of an automated decision and its effects on the data subject (VwGH 11.06.2026, Ra 2026\u002F04\u002F0002).On 11.06.2026, the court quashed the decision due to an error of law. The BVwG failed to make any findings regarding the existence of an automated decision and its effects on the data subject ([https:\u002F\u002Fwww.ris.bka.gv.at\u002FDokument.wxe?ResultFunctionToken=a5fb5bfc-070a-42e6-8412-d859f555feef&Position=1&SkipToDocumentPage=True&Abfrage=Vwgh&Entscheidungsart=Undefined&Sammlungsnummer=&Index=&SucheNachRechtssatz=True&SucheNachText=True&GZ=Ra+2026%2f04%2f0002&VonDatum=&BisDatum=13.07.2026&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Dokumentnummer=JWT_2026040002_20260611L00 VwGH 11.06.2026, Ra 2026\u002F04\u002F0002]). == Further Resources ==== Further Resources == Revision as of 05:27, 13 July 2026 BVwG - W254 2253353-1 Court: BVwG (Austria) Jurisdiction: Austria Relevant Law: Article 4(1) GDPR Article 4(4) GDPR Article 12 GDPR Article 14 GDPR Article 15 GDPR Article 22(1) GDPR Article 133(4) B-VG Decided: 17.11.2025 Published: 04.02.2026 Parties: complainant (controller) interested party (data subject) DSB (DPA) National Case Number\u002FName: W254 2253353-1 European Case Law Identifier: ECLI:AT:BVWG:2025:W254.225335","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=BVwG_-_W254_2253353-1&diff=52185&oldid=52184","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-07-13T05:27:08+00:00","2026-07-13T06:00:16.221135+00:00",7,[18,21,24],{"name":19,"type":20},"credit score","product",{"name":22,"type":23},"automated decision-making","technology",{"name":25,"type":23},"profiling","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":26,"icon":28,"name":29,"slug":30},null,"Policy","policy",[32,37,42,47],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":48},{"id":26,"icon":28,"name":29,"slug":30},[]]