[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUzhK2SiGGjVt66KqK95YglZKyMH3wyYpbporowFl2aM":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"54ab6706-02d8-462d-acba-e6f809b47cef","OGH - 6Ob148\u002F25w","ogh-6ob148-25w-72fd5f","← Older revision Revision as of 13:14, 16 September 2026 Line 105: Line 105: The controller bought personal data about a data subject (name, address, date of birth) from a company (B) that operates in the address publishing and direct marketing industry. The contract provided that this data may only be used for identity verification. The controller bought personal data about a data subject (name, address, date of birth) from a company (B) that operates in the address publishing and direct marketing industry. The contract provided that this data may only be used for identity verification. While the data subject’s data was initially collected by company B for the purpose of direct marketing, the controller used the personal data in question exclusively for existence verification. While the data subject’s data was initially collected by company B for the purpose of direct marketing, the controller used the personal data in question exclusively for identity verification. At a customer's request, the controller issued a credit assessment of the data subject. The assessment was based on the name, gender and address of the data subject because there was no available data on possible payment defaults of the data subject. At a customer's request, the controller issued a credit assessment of the data subject. The assessment was based on the name, gender and address of the data subject because there was no available data on possible payment defaults of the data subject. Line 127: Line 127: Purpose limitation Purpose limitation The court considered that processing data for an existence check in the context of credit assessments must be regarded as processing data for the purpose of credit assessments. This is true even where the data was not used for calculating the credit score itself. In this case, the controller processed the personal data for a different purpose than the marketing purpose that justified the initial collection. The court considered that processing data for an identity check in the context of credit assessments must be regarded as processing data for the purpose of credit assessments. This is true even where the data was not used for calculating the credit score itself. In this case, the controller processed the personal data for a different purpose than the marketing purpose that justified the initial collection. The further processing had significant consequences for the data subject and was not subject to appropriate safeguards pursuant to [[Article 6 GDPR|Article 6(4)(e) GDPR]], in violation of [[Article 6 GDPR|Article 6(4) GDPR]]. The further processing had significant consequences for the data subject and was not subject to appropriate safeguards pursuant to [[Article 6 GDPR|Article 6(4)(e) GDPR]], in violation of [[Article 6 GDPR|Article 6(4) GDPR]].","The Austrian Supreme Court (OGH) ruled that a company's use of personal data, initially collected for direct marketing, for identity verification and credit assessments violated GDPR's purpose limitation principle. The court found that further processing for credit assessments, even without direct score calculation, had significant consequences for the data subject and lacked appropriate safeguards, thus infringing Article 6(4) GDPR.","Austrian court rules data processing for credit assessments violated GDPR purpose limitation.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=OGH_-_6Ob148\u002F25w&diff=53109&oldid=53108","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-09-16T13:14:34+00:00","2026-09-16T14:00:11.014183+00:00",7,[17],{"name":18,"type":19},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,30,35,37],{"category":27},{"id":28,"icon":22,"name":18,"slug":29},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":31},{"id":32,"icon":22,"name":33,"slug":34},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":36},{"id":20,"icon":22,"name":23,"slug":24},{"category":38},{"id":39,"icon":22,"name":40,"slug":41},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":45,"vendors":46},[],[],{"slug":48,"title":49,"body":50,"framework_refs":51,"framework_notes":61},"austrian-court-rules-gdpr-purpose-limitation-violated-when-marketing-data-used-for-credit-assessment","Austrian Court Rules GDPR Purpose Limitation Violated When Marketing Data Used for Credit Assessments","A company collected personal data under the lawful basis of direct marketing but then repurposed that data for identity verification and credit assessments — a classic violation of GDPR's purpose limitation principle under Article 5(1)(b). The Austrian Supreme Court (OGH) confirmed that even indirect use of data in credit-related decisions constitutes significant processing with real consequences for individuals, requiring its own distinct legal basis and appropriate safeguards. This case highlights that organisations cannot assume data collected for one purpose can freely migrate to another 'compatible' use, especially where the new purpose materially impacts data subjects' financial or legal standing. The ruling matters because it sets a binding precedent reinforcing that purpose limitation is not a technicality but a substantive right that courts will actively enforce.",[52,53,54,55,56,57,58,59,60],"GDPR Article 5(1)(b) — Purpose Limitation Principle","GDPR Article 6(4) — Compatibility Assessment for Further Processing","GDPR Article 13\u002F14 — Transparency and Information Obligations","GDPR Article 35 — Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.PP-P4 — Data Processing Policies","NIST SP 800-53 IP-1 — Consent \u002F IP-2 — Individual Access","CIS Control 3 — Data Protection (Data Classification and Handling)","ISO\u002FIEC 29101 — Privacy Architecture Framework","ITIL Service Design — Information Security and Privacy Management",{}]