VwGH - Ro 2020/04/0031-9
Austrian court rules credit agencies must erase insolvency data post-registry deletion.
The Austrian Supreme Administrative Court ruled that credit agencies must erase personal data obtained from public insolvency registers once that data is removed from the register. This decision aligns with recent CJEU rulings and emphasizes that continued processing, even for creditworthiness assessment, is unlawful if the data is no longer publicly available. The court also affirmed the data subject's right to erasure under GDPR Article 17.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CJEU?
Get an email when a new story names CJEU, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Austrian Supreme Administrative Court confirmed that credit agencies cannot indefinitely retain personal insolvency data sourced from public registers once that data has been officially removed. Continued processing of such data for creditworthiness assessments lacks a lawful basis under GDPR, as the original public-interest justification ceases to exist when the register entry is deleted. This ruling reinforces that data minimisation and storage limitation principles are not optional — organisations must actively review and purge data whose legal basis has expired. Failure to comply exposes organisations to enforcement actions, fines, and reputational damage. The decision aligns with CJEU precedent, signalling a stricter pan-European standard for how derived or secondary data sources must be managed.