OGH - 6Ob148/25w
Austrian court rules data collected for marketing cannot be used for credit identity checks.
The Austrian Supreme Court (OGH) ruled that personal data collected for marketing purposes cannot be used for identity checks in credit assessments. The court found this processing incompatible with the original purpose and lacking a legal basis under Article 6(4) GDPR, as there was no direct link or relationship between the controller and data subject, and no safeguards were in place. This decision highlights the importance of purpose limitation and data subject rights under GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GDPR?
Get an email when a new story names GDPR, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Austrian Supreme Court found that personal data collected for marketing purposes was unlawfully repurposed for identity verification during credit assessments, violating GDPR's purpose limitation principle under Article 5(1)(b) and lacking a valid legal basis under Article 6(4). This matters because organizations frequently accumulate large datasets for one purpose and later attempt to reuse them for unrelated functions without reassessing compatibility or lawful basis. The ruling reinforces that the absence of a direct relationship between the controller and data subject — combined with no safeguards — makes such repurposing indefensible. Regulators and courts across the EU are increasingly scrutinizing secondary data uses, and this decision signals that compliance must be proactive, not reactive.