[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLem_jqjy7L--PMPCzA_GNEVUbmcW6mpdbnCruYre4M0":3},{"article":4,"iocs":37,"watch_terms":38,"solutions":39,"lesson":42},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"f94bbabb-0a4d-4e59-91d6-6296322c6fbb","OGH - 6Ob148\u002F25w","ogh-6ob148-25w-8fb001","← Older revision Revision as of 07:19, 14 September 2026 (One intermediate revision by the same user not shown) Line 129: Line 129: 2.Further processing 2.Further processing The court held that the controller processed the data for a further purpose than the initial collection of the data, which was the purpose of marketing. National law provides for a legal basis to collect data for the purpose of marketing. However, the court held, that processing personal data in order to conduct an identity check for a credit assessment does not fall under the purpose of marketing. Processing data for an identity check in the context of credit assessments must be regarded as processing data for the purpose of credit assessments. This is true even where the data was not used for calculating the credit score itself. The court held that the controller processed the data for a further purpose than the initial collection of the data, which was the purpose of marketing. National law provides for a legal basis to collect data for the purpose of marketing. However, the court held, that processing personal data in order to conduct an identity check for a credit assessment where the data was initially collected for marketing purposes does not fall under the legal basis provided for by national law. Processing data for an identity check in the context of credit assessments must be regarded as processing data for the purpose of credit assessments. This is true even where the data was not used for calculating the credit score itself. Therefore, the controller processed the personal data for a different purpose. The national provisions that allow for the processing of personal data for the purpose of marketing does not constitute a legal basis pursuant to [[Article 6 GDPR|Article 6(4) GDPR]]. Therefore, the controller processed the personal data for a different purpose. The court held that the purpose of the initial collection of data (marketing) was incompatible with the further processing (credit assessment). There is no direct link between the purposes pursuant to [[Article 6 GDPR|Article 6(4)(a) GDPR]]. Neither was there any relationship between the controller and the data subject within the meaning of [[Article 6 GDPR|Article 6(4)(b) GDPR]]. On the other hand, the credit score can have significant consequences for the data subject in the form of rejections of granting of credits or entering into contracts. No safeguards pursuant to [[Article 6 GDPR|Article 6(4)(e) GDPR]] were in place. The court held that the purpose of the initial collection of data (marketing) was incompatible with the further processing (credit assessment). There is no direct link between the purposes pursuant to [[Article 6 GDPR|Article 6(4)(a) GDPR]]. Neither was there any relationship between the controller and the data subject within the meaning of [[Article 6 GDPR|Article 6(4)(b) GDPR]]. On the other hand, the credit score can have significant consequences for the data subject in the form of rejections of granting of credits or entering into contracts. No safeguards pursuant to [[Article 6 GDPR|Article 6(4)(e) GDPR]] were in place.","The Austrian Supreme Court (OGH) ruled that personal data collected for marketing purposes cannot be used for identity checks in credit assessments. The court found this processing incompatible with the original purpose and lacking a legal basis under Article 6(4) GDPR, as there was no direct link or relationship between the controller and data subject, and no safeguards were in place. This decision highlights the importance of purpose limitation and data subject rights under GDPR.","Austrian court rules data collected for marketing cannot be used for credit identity checks.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=OGH_-_6Ob148\u002F25w&diff=53002&oldid=52996","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-09-14T07:19:47+00:00","2026-09-14T08:00:22.300116+00:00",7,[17],{"name":18,"type":19},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,30,35],{"category":27},{"id":28,"icon":22,"name":18,"slug":29},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":31},{"id":32,"icon":22,"name":33,"slug":34},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":36},{"id":20,"icon":22,"name":23,"slug":24},[],[18],{"controls":40,"vendors":41},[],[],{"slug":43,"title":44,"body":45,"framework_refs":46,"framework_notes":56},"austrian-supreme-court-rules-gdpr-purpose-limitation-bars-repurposing-marketing-data-for-credit-iden","Austrian Supreme Court Rules GDPR Purpose Limitation Bars Repurposing Marketing Data for Credit Identity Checks","The Austrian Supreme Court found that personal data collected for marketing purposes was unlawfully repurposed for identity verification during credit assessments, violating GDPR's purpose limitation principle under Article 5(1)(b) and lacking a valid legal basis under Article 6(4). This matters because organizations frequently accumulate large datasets for one purpose and later attempt to reuse them for unrelated functions without reassessing compatibility or lawful basis. The ruling reinforces that the absence of a direct relationship between the controller and data subject — combined with no safeguards — makes such repurposing indefensible. Regulators and courts across the EU are increasingly scrutinizing secondary data uses, and this decision signals that compliance must be proactive, not reactive.",[47,48,49,50,51,52,53,54,55],"GDPR Article 5(1)(b) – Purpose Limitation","GDPR Article 6(4) – Compatibility Assessment for Secondary Processing","GDPR Article 13\u002F14 – Transparency and Information Obligations","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.PO-P1 – Policies for data processing purpose","NIST SP 800-53 PT-2 – Purpose Specification","NIST SP 800-53 PT-3 – Personally Identifiable Information Processing Purposes","CIS Control 3 – Data Protection (Data Classification and Handling)","ISO\u002FIEC 27701:2019 – Privacy Information Management (Clause 7.2.1 – Identify and document purpose)",{}]