[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcOWMyT7t6PJ7_oAcSeB0ROPpGMPq5oo-7oPyo0AA3cU":3},{"article":4,"iocs":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":25,"category":26,"article_tags":30},"0677161f-e79f-487d-ab56-4c1bc91ce8a6","OGH - 6Ob148\u002F25w","ogh-6ob148-25w-5d576b","Created page with \"{{COURTdecisionBOX |Jurisdiction=Austria |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=OGH |Court_Original_Name=Oberster Gerichtshof |Court_English_Name=Austrian Supreme Court (for Civil and Criminal Matters) |Court_With_Country=OGH (Austria) |Case_Number_Name=6Ob148\u002F25w |ECLI=ECLI:AT:OGH0002:2026:0060OB00148.25W.0812.000 |Original_Source_Name_1=RIS |Original_Source_Link_1=https:\u002F\u002Fwww.ris.bka.gv.at\u002FDokument.wxe?ResultFunctionToken=f189970d-7952-451f...\" Show changes","The Austrian Supreme Court (OGH) ruled that further processing of personal data, initially collected for marketing, is incompatible with processing it for identity checks in credit assessments under Article 6(4) GDPR. The case involved a controller who purchased personal data for direct marketing but used it for identity verification in credit assessments. The court found this change of purpose to be unlawful, even if the data was not directly used in the credit score itself.","Austrian Supreme Court rules on GDPR compliance for data purpose changes.","Help OGH - 6Ob148\u002F25w: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 14:04, 10 September 2026 view source Lh (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators40 edits Tag: Decisions [1.0]Newer edit → (No difference) Revision as of 14:04, 10 September 2026 OGH - 6Ob148\u002F25w Court: OGH (Austria) Jurisdiction: Austria Relevant Law: Article 6(1)(f) GDPR Article 6(4) GDPR Article 7 CFRArticle 8 CFR Decided: 12.08.2026 Published: Parties: National Case Number\u002FName: 6Ob148\u002F25w European Case Law Identifier: ECLI:AT:OGH0002:2026:0060OB00148.25W.0812.000 Appeal from: Appeal to: Original Language(s): German Original Source: RIS (in German) Initial Contributor: lh The court held that the further processing of personal data initially collected for the purpose of marketing is incompatible under Article 6(4) GDPR with the processing for the purpose of an identity check in the context of credit assessments. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The controller runs an address publishing business as well as a credit information agency. They bought personal data about a data subject (name, address, date of birth) from a company that operates in the address publishing and direct marketing industry. The data subject’s data was collected by the company for the purpose of direct marketing. The controller uses the personal data in question exclusively for identity checks in the context of credit assessments: When a customer of the controller asks for a credit assessment of a person, the controller verifies with their data base whether a person with that name and address exists. That personal data is not included in the credit assessment itself. The credit assessment is calculated with the personal data provided by the customer who requests the service of credit assessment from the controller, as well as data acquired from debt collection agencies. The contractual agreement between the controller and the company that sold the data subject’s data says that the controller may use the data that is subject to the contract only for identity checks and no other purposes. A supplementary agreement specific data may be used for marketing purposes. The controller made a credit assessment of the data subject. In that credit assessment, the controller relied on general data such as the name, gender and address of the data subject because there was no available data on possible payment defaults of the data subject. However, the score was not solely based on age and address. The controller indicated to the customers who request the data subject’s credit assessment that the assessment is based not on payment default data. There is payment default data available on approximately 10 % of Austrians. The data subject brought an injunction against the controller with respect to the change of purpose of processing because the data in question was initially collected for direct marketing purposes and not for the purpose of credit assessment. Moreover, the injunction concerned the credit assessment that relied solely on statistical data and not on data concerning the payment history of the data subject. The court of first instance and second instance rejected the injunction. The court of first instance held that the controller processed the data according to the contract with the company they bought the data from. Moreover, the processing for the original purpose was compatible with the further processing. The court of second instance concluded that the further processing was not compatible with the original purpose but that the controller could rely on national law as legal basis. As far as the method of credit assessment was concerned, both courts held that the processing fell under Article 6(1)(f) GDPR because the processing was necessary for operating a credit information agency. Holding The court partly upheld the decision of the court of second instance. 1. Pre-emptive injunctions Firstly, the court referred to the case law of the CJEU that provides for the possibility of pre-emptive injunctions under national law. The scope of the subject matter of the injunction under Austrian national law is reduced to the specific violating actions the data subject claims. Therefore, as far as the data subject requests the controller to desist from unlawfully processing their personal data in general, the injunction is inadmissible because the data subject failed to name a specific violation. 2. Further processing The court held that the controller processed the data for a further purpose than the initial collection of the data, which was the purpose of marketing. National law provides for a legal basis to collect data for the purpose of marketing. However, the court held, that processing personal data in order to conduct an identity check for a credit assessment does not fall under the purpose of marketing. Processing data for an identity check in the context of credit assessments must be regarded as processing data for the purpose of credit assessments. This is true even where the data was not used for calculating the credit score itself. The national provisions that allow for the processing of personal data for the purpose of marketing does not constitute a legal basis pursuant to Article 6(4) GDPR. Therefore, the controller processed the personal data for a different purpose. The court held that the purpose of the initial collection of data (marketing) was incompatible with the further processing (credit assessment). There is no direct link between the purposes pursuant to Article 6(4)(a) GDPR. Neither was there any relationship between the controller and the data subject within the meaning of Article 6(4)(b) GDPR. On the other hand, the credit score can have significant consequences for the data subject in the form of rejections of granting of credits or entering into contracts. No safeguards pursuant to Article 6(4)(e) GDPR were in place. A data subject must not reasonably expect their data that was collected for marketing purposes to be processed for the purpose of credit assessment. In conclusion, the further processing violated Article 6(4) GDPR and was therefore unlawful. 3. Assessment of credit score The assessment of a credit score on the basis of general data in the absence of data on possible payment defaults was held lawful under Article 6(1)(f) GDPR. The court held that processing personal data for the purpose of credit assessments was legitimate. It serves the economic interests of the credit information agency as well as the interests of the customers of the agencies that request the credit score, and the socio-economic interests of the credit sector. According to the court, this method of calculating the score is necessary because there is available data on payment defaults on only 10 % of Austrians, meaning that credit assessments of the majority of the population would otherwise not be possible. The court took into account that the credit assessment affects the data subject’s rights under Article 7 CFR and Article 8 CFR in the case of a negative score. However, the data subject can reasonably expect that companies that regularly have to go provide their goods and services upfront require a credit assessment, also in the absence of payment default information. The court could not find any negative consequences for the data subject resulting from the credit score. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Heading The Supreme Court, acting as the court of appeal, with Senate President Dr. Hofer-Zeni-Rennhofer presiding and Justices Hon.-Prof. Dr. Faber, Mag. Pertma","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=OGH_-_6Ob148\u002F25w&diff=52995&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-09-10T14:04:08+00:00","2026-09-10T16:00:43.216968+00:00",7,[18,21,23],{"name":19,"type":20},"credit assessment","product",{"name":22,"type":20},"identity check",{"name":24,"type":20},"direct marketing","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":25,"icon":27,"name":28,"slug":29},null,"GDPR","gdpr",[31,33,38,43],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[]]