BVwG - W292 2301229-1
Data subject's right to erasure under GDPR upheld by DPA and court.
A data subject filed a complaint regarding the erasure of payment history data, which led to loan rejections due to an error in their credit score. The DPA applied CJEU case law to determine that processing payment history significantly interferes with privacy rights. The DPA ruled that the credit reporting agency violated the data subject's right to erasure under Article 17 GDPR by not deleting data related to out-of-court settlements.
AI summary of the linked source. Not reviewed by an editor. How this works
Run SCHUFA Holding?
Get an email when a new story names SCHUFA Holding, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA credit reporting agency failed to delete out-of-court settlement data upon a valid erasure request, leading to an incorrect credit score that caused the data subject to be denied loans. The Austrian Federal Administrative Court (BVwG) upheld the DPA's ruling that processing payment history constitutes a significant interference with privacy rights under CJEU case law. This case demonstrates that organizations handling sensitive financial data must have clear, legally compliant processes for responding to data subject rights requests. Failure to act on erasure obligations not only violates GDPR Article 17 but can cause direct, measurable harm to individuals — creating significant regulatory and reputational risk.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.