Austrian Supreme Court Rules GDPR Purpose Limitation Violated in Credit Scoring Case

The Austrian Supreme Court found that processing personal data originally collected for direct marketing and repurposing it for credit assessment violates GDPR Article 6(4)'s purpose limitation principle. This case highlights that organizations cannot freely repurpose personal data just because a new use seems beneficial or operationally convenient. The ruling matters because it reinforces that each processing purpose must have its own lawful basis and must be compatible with the original collection purpose. Failure to respect purpose limitation exposes organizations to legal liability, enforcement actions, and loss of consumer trust.

Tactical Insight

Immediate actions

Audit all current data processing activities to identify any data being repurposed beyond its original collection purpose.
Document a clear and explicit lawful basis under GDPR Article 6 for each distinct processing purpose before initiating that processing.

Policy & Governance improvements

Establish a formal Purpose Limitation Policy that requires a documented compatibility assessment before any secondary use of personal data.
Implement data classification and tagging mechanisms so that data collected for one purpose is technically restricted from being fed into incompatible workflows.
Require Data Protection Impact Assessments (DPIAs) whenever data is considered for repurposing or shared across business functions.

Training & Monitoring measures

Train data stewards and product teams on GDPR purpose limitation and the legal distinction between compatible and incompatible secondary uses.
Continuously monitor data flows using a data lineage tool to detect unauthorized or undocumented repurposing of personal data.