OGH - 6Ob148/25w

Summary

An Austrian court ruled that a credit information agency unlawfully processed personal data. The data, initially collected for marketing, was used for identity checks in credit assessments, violating GDPR's purpose limitation principle. However, the court found the calculation of credit scores based on statistics, address, and name to be lawful, even without payment default data.

Full text

Help OGH - 6Ob148/25w: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 07:19, 14 September 2026 view sourceLh (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators44 editsTag: Visual edit← Older edit Latest revision as of 09:58, 15 September 2026 view source Ls (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators406 editsTag: Visual edit Line 96: Line 96: }}}} The court held that the further processing of personal data initially collected for the purpose of marketing is incompatible under [[Article 6 GDPR|Article 6(4) GDPR]] with the processing for the purpose of an identity check in the context of credit assessments.The processing of data initially collected for marketing purpose is incompatible with a credit assessment purpose, in violation of [[Article 6 GDPR|Article 6(4) GDPR]]. Score calculation based on statistics, address and name of the data subject is however lawful. == English Summary ==== English Summary == === Facts ====== Facts === The controller runs an address publishing business as well as a credit information agency. They bought personal data about a data subject (name, address, date of birth) from a company that operates in the address publishing and direct marketing industry. The data subject’s data was collected by the company for the purpose of direct marketing.The controller runs an address publishing business as well as a credit information agency. As part of its credit assessment activity, it (i) verifies the existence of individuals whose credit score is requested with data like their name and address and (ii) issues credit scores based on data provided by debt collection agencies and on statistics, as payment default data is available on approximately 10% of Austrians. The controller uses the personal data in question exclusively for identity checks in the context of credit assessments: When a customer of the controller asks for a credit assessment of a person, the controller verifies with their data base whether a person with that name and address exists. That personal data is not included in the credit assessment itself. The credit assessment is calculated with the personal data provided by the customer who requests the service of credit assessment from the controller, as well as data acquired from debt collection agencies. The controller bought personal data about a data subject (name, address, date of birth) from a company (B) that operates in the address publishing and direct marketing industry. The contract provided that this data may only be used for <u>identity checks</u>. <u>A supplementary agreement specifies that data may be used for marketing purposes.</u> The contractual agreement between the controller and the company that sold the data subject’s data says that the controller may use the data that is subject to the contract only for identity checks and no other purposes. A supplementary agreement specific data may be used for marketing purposes. While the data subject’s data was <u>initially</u> collected by company B for the purpose of direct marketing, the controller <u>claimed to</u> use the personal data in question exclusively for existence verification. The controller made a credit assessment of the data subject. In that credit assessment, the controller relied on general data such as the name, gender and address of the data subject because there was no available data on possible payment defaults of the data subject. However, the score was not solely based on age and address. The controller indicated to the customers who request the data subject’s credit assessment that the assessment is based not on payment default data.At a customer's request, the controller issued a credit assessment of the data subject. The assessment was based on the name, gender and address of the data subject because there was no available data on possible payment defaults of the data subject. There is payment default data available on approximately 10% of Austrians. The data subject brought an injunction against the controller. The main discussions regarded (i) a violation of the <u>purpose limitation principle</u>: the data was initially collected for direct marketing purposes and later used for credit assessment; (ii) the calculation of the score, which relied solely on statistical data and not on data actually concerning the payment history of the data subject. The data subject brought an injunction against the controller with respect to the change of purpose of processing because the data in question was initially collected for direct marketing purposes and not for the purpose of credit assessment. Moreover, the injunction concerned the credit assessment that relied solely on statistical data and not on data concerning the payment history of the data subject. The court of first instance and second instance rejected the injunction. The court of first instance held that the controller processed the data according to the contract with company B. Moreover, the processing for the original purpose was compatible with the further processing. The court of first instance and second instance rejected the injunction. The court of first instance held that the controller processed the data according to the contract with the company they bought the data from. Moreover, the processing for the original purpose was compatible with the further processing. The court of second instance concluded that the further processing was not compatible with the original purpose but that the controller could rely on national law as legal basis.The court of second instance however held that the further processing was not compatible with the original purpose but that the controller could rely on national law as legal basis. As far as the method of credit assessment was concerned, both courts held that the processing fell under [[Article 6 GDPR|Article 6(1)(f) GDPR]] because the processing was necessary for operating a credit information agency.As far as the method of credit assessment was concerned, both courts held that the processing fell under [[Article 6 GDPR|Article 6(1)(f) GDPR]] because the processing was necessary for operating a credit information agency. === Holding ====== Holding === The court partly upheld the decision of the court of second instance.The court partly upheld the decision of the court of second instance. 1.Pre-emptive injunctions<u>Pre-emptive injunctions</u> Firstly, the court referred to the case law of the CJEU that provides for the possibility of pre-emptive injunctions under national law. The scope of the subject matter of the injunction under Austrian national law is reduced to the specific violating actions the data subject claims. Therefore, as far as the data subject requests the controller to desist from unlawfully processing their personal data in general, the injunction is inadmissible because the data subject failed to name a specific violation.Firstly, the court referred to the case law of the CJEU that provides for the possibility of pre-emptive injunctions under national law. The scope of the subject matter of the injunction under Austrian national law is reduced to the specific violating actions the data subject claims. Therefore, as far as the data subject requests the controller to desist from unlawfully processing their personal data in general, the injunction is inadmissible because the data subject failed to name a specific violation. 2.Further processing<u>Purpose limitation</u> The court held that the controller processed the data for a further purpose than the initial collection of the data, which was the purpose of marketing. National law provides for a legal basis to collect data for the purpose of marketing. However, the court held, that processing personal data in order to conduct an identity check for a credit assessment where the data was initially collected for

Entities