OGH - 6Ob148/25w
Austrian court rules data processing for credit assessments violated GDPR purpose limitation.
The Austrian Supreme Court (OGH) ruled that a company's use of personal data, initially collected for direct marketing, for identity verification and credit assessments violated GDPR's purpose limitation principle. The court found that further processing for credit assessments, even without direct score calculation, had significant consequences for the data subject and lacked appropriate safeguards, thus infringing Article 6(4) GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GDPR?
Get an email when a new story names GDPR, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA company collected personal data under the lawful basis of direct marketing but then repurposed that data for identity verification and credit assessments — a classic violation of GDPR's purpose limitation principle under Article 5(1)(b). The Austrian Supreme Court (OGH) confirmed that even indirect use of data in credit-related decisions constitutes significant processing with real consequences for individuals, requiring its own distinct legal basis and appropriate safeguards. This case highlights that organisations cannot assume data collected for one purpose can freely migrate to another 'compatible' use, especially where the new purpose materially impacts data subjects' financial or legal standing. The ruling matters because it sets a binding precedent reinforcing that purpose limitation is not a technicality but a substantive right that courts will actively enforce.