OGH - 6Ob148/25w
Austrian Supreme Court rules on GDPR compliance for data purpose changes.
The Austrian Supreme Court (OGH) ruled that further processing of personal data, initially collected for marketing, is incompatible with processing it for identity checks in credit assessments under Article 6(4) GDPR. The case involved a controller who purchased personal data for direct marketing but used it for identity verification in credit assessments. The court found this change of purpose to be unlawful, even if the data was not directly used in the credit score itself.
AI summary of the linked source. Not reviewed by an editor. How this works
Run credit assessment?
Get an email when a new story names credit assessment, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Austrian Supreme Court found that repurposing personal data collected for direct marketing to perform identity verification in credit assessments violates GDPR's purpose limitation principle under Article 5(1)(b) and Article 6(4). The controller failed to conduct a proper compatibility assessment before using the data for a fundamentally different purpose, exposing the organization to significant legal liability. This ruling underscores that purchasing data for one lawful purpose does not grant unlimited rights to use it for other processes — even seemingly related ones. Organizations must treat each distinct processing purpose as requiring its own legal basis and compatibility evaluation.