[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcRTX0DE3dM9OjPrUCqVJjITM8vnSSJuDdevqAMco4ic":3},{"article":4,"iocs":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":26,"category":27,"article_tags":31},"8e7c180e-92e0-4ce5-ab7d-3e85961f60ef","VwGH - Ro 2020\u002F04\u002F0031-9","vwgh-ro-2020-04-0031-9-a921f1","EU LAW CLEANUP ← Older revision Revision as of 14:18, 9 July 2026 (One intermediate revision by the same user not shown) Line 35: Line 35: |EU_Law_Name_1=Article 7 CFR |EU_Law_Name_1=Article 7 CFR |EU_Law_Link_1=https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=celex%253A12012P%252FTXT |EU_Law_Link_1=https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:12012P\u002FTXT |EU_Law_Name_2=Article 8 CFR |EU_Law_Name_2=Article 8 CFR |EU_Law_Link_2=https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=celex%253A12012P%252FTXT |EU_Law_Link_2=https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:12012P\u002FTXT |EU_Law_Name_3= |EU_Law_Name_3= |EU_Law_Link_3= |EU_Law_Link_3= Line 79: Line 79: The controller, a credit ranking agency, continued to process and store personal data of the data subject that related to his debt settlement procedure that the controller obtained from the public insolvency register. The purpose of the procesing was to assess the creditworthiness of the data subject and his company. The data subject was the company's sole shareholder. The controller, a credit ranking agency, continued to process and store personal data of the data subject that related to his debt settlement procedure that the controller obtained from the public insolvency register. The purpose of the procesing was to assess the creditworthiness of the data subject and his company. The data subject was the company's sole shareholder. The data subject requested the erasure of his personal data on 4 May 2018, after fulfilling his debt payment plan. The controller did not reply. On 24 October 2018, the data subject lodged a complaint at the Austrian DPA against the controller for the infringement of the right to erasure under [[Article 17 GDPR|Article 17 GDPR]]. The data subject requested the erasure of his personal data on 4 May 2018, after fulfilling his debt payment plan. The controller did not reply. On 24 October 2018, the data subject lodged a complaint at the Austrian DPA against the controller for the infringement of the right to erasure under [[Article 17 GDPR]]. The controller informed the DPA by letter the same day that it would not comply with this request. The controller informed the DPA by letter the same day that it would not comply with this request. Line 98: Line 98: Previous Austrian jurisprudence stated that credit agencies could collect and process personal data collected through the public insolvency register up to 5 years after deletion of the data concerned in the registry. However, the recent [https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_Joined_Cases_C%E2%80%9126\u002F22_and_C%E2%80%9164\u002F22_-_SCHUFA CJEU C-26\u002F22 and C-64\u002F22 – Schufa] case stated that the lawfulness of the processing by the controller must be assessed solely in light of [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. In particular, the CJEU also ruled that credit agencies cannot process data they collected from the insolvency register once that data has been deleted from the registry itself (see [https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=CELEX:62022CJ0026 CJEU C-26\u002F22 and C-64\u002F22 – Schufa] para 99). The CJEU noted that in Germany the data in the insolvency register is only kept for up to 6 months and therefore, after the expiry of a six-month period, the rights and interests of the data subject take precedence over those of the public to have access to that information. Previous Austrian jurisprudence stated that credit agencies could collect and process personal data collected through the public insolvency register up to 5 years after deletion of the data concerned in the registry. However, the recent [https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_Joined_Cases_C%E2%80%9126\u002F22_and_C%E2%80%9164\u002F22_-_SCHUFA CJEU C-26\u002F22 and C-64\u002F22 – Schufa] case stated that the lawfulness of the processing by the controller must be assessed solely in light of [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. In particular, the CJEU also ruled that credit agencies cannot process data they collected from the insolvency register once that data has been deleted from the registry itself (see [https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=CELEX:62022CJ0026 CJEU C-26\u002F22 and C-64\u002F22 – Schufa] para 99). The CJEU noted that in Germany the data in the insolvency register is only kept for up to 6 months and therefore, after the expiry of a six-month period, the rights and interests of the data subject take precedence over those of the public to have access to that information. In light of the [https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_Joined_Cases_C%E2%80%9126\u002F22_and_C%E2%80%9164\u002F22_-_SCHUFA CJEU C-26\u002F22 and C-64\u002F22 – Schufa] case, the Supreme Administrative Court found that the processing of this data, including the storage, analysis and disclosure of this data to a third party by the controller, constitutes a serious interference with the fundamental rights of the data subject under [http:\u002F\u002Ffra.europa.eu\u002Fen\u002Feu-charter\u002Farticle\u002F7-respect-private-and-family-life Article 7 CFR] and [http:\u002F\u002Ffra.europa.eu\u002Fen\u002Feu-charter\u002Farticle\u002F8-protection-personal-data Article 8 CFR]. The processing of such data can significantly harm the interests of the data subject because the disclosure is likely to make it considerably more difficult for him to exercise his freedoms. The Court stated that the objective of a payment plan is the economic recovery of the data subject. The request to erasure of personal data due to fulfilling the payment plan is intended to prevent the data subject from being impaired in business dealings by the public announcement of earlier insolvency proceedings. Therefore, the data subject’s economic recovery is jeopardised if a credit agency, thus the controller in this case, stores data on the data subject’s insolvency proceedings in order to assess the data subject’s creditworthiness, as this data is always used as a negative factor in the assessment. In light of this, the legitimate interests of the controller to process data regarding the insolvency proceedings of the data subject can no longer justify the processing of these personal data after this data in the insolvency register is made unavailable for the public . In light of the [https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_Joined_Cases_C%E2%80%9126\u002F22_and_C%E2%80%9164\u002F22_-_SCHUFA CJEU C-26\u002F22 and C-64\u002F22 – Schufa] case, the Supreme Administrative Court found that the processing of this data, including the storage, analysis and disclosure of this data to a third party by the controller, constitutes a serious interference with the fundamental rights of the data subject under [https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:12012P\u002FTXT Article 7 CFR] and [https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:12012P\u002FTXT Article 8 CFR]. The processing of such data can significantly harm the interests of the data subject because the disclosure is likely to make it considerably more difficult for him to exercise his freedoms. The Court stated that the objective of a payment plan is the economic recovery of the data subject. The request to erasure of personal data due to fulfilling the payment plan is intended to prevent the data subject from being impaired in business dealings by the public announcement of earlier insolvency proceedings. Therefore, the data subject’s economic recovery is jeopardised if a credit agency, thus the controller in this case, stores data on the data subject’s insolvency proceedings in order to assess the data subject’s creditworthiness, as this data is always used as a negative factor in the assessment. In light of this, the legitimate interests of the controller to process data regarding the insolvency proceedings of the data subject can no longer justify the processing of these personal data after this data in the insolvency register is made unavailable for the public . The storage of this data by the controller after the decision of the insolvency court to remove the data from the public register can therefore not be based on [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. Thus, it is unlawful for the controller to store and process data relating to the insolvency proceedings of the data subject from the public insolvency register once the data is not available anymore in the register, contrary to the decision of the DPA and the administrative court. The storage of this data by the controller after the decision of the insolvency court to remove the data from the public register can therefore not be based on [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. Thus, it is unlawful for the controller to store and process data relating to the insolvency proceedings of the data subject from the public insolvency register once the data is not available anymore in the register, contrary to the decision of the DPA and the administrative court. Secondly, the Court examined the request for erasure in accordance with [[Article 17 GDPR|Article 17 GDPR]]. The Court ruled that due to the absence of lawful processing of the data subject’s data from the insolvency proceedings, the controller is obliged to erase the data concerned immediately under [[Article 17 GDPR#1d|Article 17(1)(d) GDPR]]. Secondly, the Court examined the request for erasure in accordance with [[Article 17 GDPR]]. The Court ruled that due to the absence of lawful processing of the data subject’s data from the insolvency proceedings, the controller is obliged to erase the data concerned immediately under [[Article 17 GDPR#1d|Article 17(1)(d) GDPR]]. == Comment == == Comment ==","The Austrian Supreme Administrative Court ruled that credit agencies must erase personal data obtained from public insolvency registers once that data is removed from the register. This decision aligns with recent CJEU rulings and emphasizes that continued processing, even for creditworthiness assessment, is unlawful if the data is no longer publicly available. The court also affirmed the data subject's right to erasure under GDPR Article 17.","Austrian court rules credit agencies must erase insolvency data post-registry deletion.","Help VwGH - Ro 2020\u002F04\u002F0031-9: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 14:49, 27 March 2024 view sourceIm (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators321 editsm← Older edit Latest revision as of 14:18, 9 July 2026 view source Ds (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators158 editsm Tag: Visual edit (One intermediate revision by the same user not shown)Line 35: Line 35: |EU_Law_Name_1=Article 7 CFR|EU_Law_Name_1=Article 7 CFR |EU_Law_Link_1=https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=celex%253A12012P%252FTXT|EU_Law_Link_1=https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:12012P\u002FTXT |EU_Law_Name_2=Article 8 CFR|EU_Law_Name_2=Article 8 CFR |EU_Law_Link_2=https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=celex%253A12012P%252FTXT|EU_Law_Link_2=https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:12012P\u002FTXT |EU_Law_Name_3=|EU_Law_Name_3= |EU_Law_Link_3=|EU_Law_Link_3= Line 79: Line 79: The controller, a credit ranking agency, continued to process and store personal data of the data subject that related to his debt settlement procedure that the controller obtained from the public insolvency register. The purpose of the procesing was to assess the creditworthiness of the data subject and his company. The data subject was the company's sole shareholder.The controller, a credit ranking agency, continued to process and store personal data of the data subject that related to his debt settlement procedure that the controller obtained from the public insolvency register. The purpose of the procesing was to assess the creditworthiness of the data subject and his company. The data subject was the company's sole shareholder. The data subject requested the erasure of his personal data on 4 May 2018, after fulfilling his debt payment plan. The controller did not reply. On 24 October 2018, the data subject lodged a complaint at the Austrian DPA against the controller for the infringement of the right to erasure under [[Article 17 GDPR|Article 17 GDPR]]. The data subject requested the erasure of his personal data on 4 May 2018, after fulfilling his debt payment plan. The controller did not reply. On 24 October 2018, the data subject lodged a complaint at the Austrian DPA against the controller for the infringement of the right to erasure under [[Article 17 GDPR]]. The controller informed the DPA by letter the same day that it would not comply with this request.The controller informed the DPA by letter the same day that it would not comply with this request. Line 98: Line 98: Previous Austrian jurisprudence stated that credit agencies could collect and process personal data collected through the public insolvency register up to 5 years after deletion of the data concerned in the registry. However, the recent [https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_Joined_Cases_C%E2%80%9126\u002F22_and_C%E2%80%9164\u002F22_-_SCHUFA CJEU C-26\u002F22 and C-64\u002F22 – Schufa] case stated that the lawfulness of the processing by the controller must be assessed solely in light of [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. In particular, the CJEU also ruled that credit agencies cannot process data they collected from the insolvency register once that data has been deleted from the registry itself (see [https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=CELEX:62022CJ0026 CJEU C-26\u002F22 and C-64\u002F22 – Schufa] para 99). The CJEU noted that in Germany the data in the insolvency register is only kept for up to 6 months and therefore, after the expiry of a six-month period, the rights and interests of the data subject take precedence over those of the public to have access to that information.Previous Austrian jurisprudence stated that credit agencies could collect and process personal data collected through the public insolvency register up to 5 years after deletion of the data concerned in the registry. However, the recent [https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_Joined_Cases_C%E2%80%9126\u002F22_and_C%E2%80%9164\u002F22_-_SCHUFA CJEU C-26\u002F22 and C-64\u002F22 – Schufa] case stated that the lawfulness of the processing by the controller must be assessed solely in light of [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. In particular, the CJEU also ruled that credit agencies cannot process data they collected from the insolvency register once that data has been deleted from the registry itself (see [https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=CELEX:62022CJ0026 CJEU C-26\u002F22 and C-64\u002F22 – Schufa] para 99). The CJEU noted that in Germany the data in the insolvency register is only kept for up to 6 months and therefore, after the expiry of a six-month period, the rights and interests of the data subject take precedence over those of the public to have access to that information. In light of the [https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_Joined_Cases_C%E2%80%9126\u002F22_and_C%E2%80%9164\u002F22_-_SCHUFA CJEU C-26\u002F22 and C-64\u002F22 – Schufa] case, the Supreme Administrative Court found that the processing of this data, including the storage, analysis and disclosure of this data to a third party by the controller, constitutes a serious interference with the fundamental rights of the data subject under [http:\u002F\u002Ffra.europa.eu\u002Fen\u002Feu-charter\u002Farticle\u002F7-respect-private-and-family-life Article 7 CFR] and [http:\u002F\u002Ffra.europa.eu\u002Fen\u002Feu-charter\u002Farticle\u002F8-protection-personal-data Article 8 CFR]. The processing of such data can significantly harm the interests of the data subject because the disclosure is likely to make it considerably more difficult for him to exercise his freedoms. The Court stated that the objective of a payment plan is the economic recovery of the data subject. The request to erasure of personal data due to fulfilling the payment plan is intended to prevent the data subject from being impaired in business dealings by the public announcement of earlier insolvency proceedings. Therefore, the data subject’s economic recovery is jeopardised if a credit agency, thus the controller in this case, stores data on the data subject’s insolvency proceedings in order to assess the data subject’s creditworthiness, as this data is always used as a negative factor in the assessment. In light of this, the legitimate interests of the controller to process data regarding the insolvency proceedings of the data subject can no longer justify the processing of these personal data after this data in the insolvency register is made unavailable for the public . In light of the [https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_Joined_Cases_C%E2%80%9126\u002F22_and_C%E2%80%9164\u002F22_-_SCHUFA CJEU C-26\u002F22 and C-64\u002F22 – Schufa] case, the Supreme Administrative Court found that the processing of this data, including the storage, analysis and disclosure of this data to a third party by the controller, constitutes a serious interference with the fundamental rights of the data subject under [https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:12012P\u002FTXT Article 7 CFR] and [https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:12012P\u002FTXT Article 8 CFR]. The processing of such data can significantly harm the interests of the data subject because the disclosure is likely to make it considerably more difficult for him to exercise his freedoms. The Court stated that the objective of a payment plan is the economic recovery of the data subject. The request to erasure of personal data due to fulfilling the payment plan is intended to prevent the data subject from being impaired in business dealings by the public announcement of earlier insolvency proceedings. Therefore, the data subject’s economic recovery is jeopardised if a credit agency, thus the controller in this case, stores data on the data subject’s insolvency proceedings in order to assess the data subject’s creditworthiness, as this data is always used as a negative factor in the assessment. In light of this, the ","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=VwGH_-_Ro_2020\u002F04\u002F0031-9&diff=52174&oldid=40601","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-07-09T14:18:09+00:00","2026-07-09T16:00:20.31025+00:00",7,[18,21,24],{"name":19,"type":20},"GDPR","product",{"name":22,"type":23},"CJEU","vendor",{"name":25,"type":20},"CFR","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":26,"icon":28,"name":29,"slug":30},null,"Policy","policy",[32,36,41],{"category":33},{"id":34,"icon":28,"name":19,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":37},{"id":38,"icon":28,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":43,"icon":28,"name":44,"slug":45},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[]]