Austrian Court Rules GDPR Purpose Limitation Violated When Marketing Data Used for Credit Assessments
Written by AI from the linked story. Not reviewed by an editor. How this works
A company collected personal data under the lawful basis of direct marketing but then repurposed that data for identity verification and credit assessments — a classic violation of GDPR's purpose limitation principle under Article 5(1)(b). The Austrian Supreme Court (OGH) confirmed that even indirect use of data in credit-related decisions constitutes significant processing with real consequences for individuals, requiring its own distinct legal basis and appropriate safeguards. This case highlights that organisations cannot assume data collected for one purpose can freely migrate to another 'compatible' use, especially where the new purpose materially impacts data subjects' financial or legal standing. The ruling matters because it sets a binding precedent reinforcing that purpose limitation is not a technicality but a substantive right that courts will actively enforce.
Tactical Insight
Immediate actions
- Audit all existing data collections to document the original stated purpose and lawful basis under which personal data was gathered.
- Immediately cease any secondary processing activities that were not explicitly covered in the original privacy notice or consent agreement.
Policy & governance improvements
- Establish a formal Data Purpose Register that records the specific, explicit, and legitimate purpose for every data collection activity and requires sign-off before any secondary use.
- Conduct a compatibility assessment under Article 6(4) GDPR — evaluating context, nature, consequences, and safeguards — before repurposing any personal data for a new use case.
- Update privacy notices and data subject information to accurately reflect all intended processing purposes before data collection begins.
Long-term structural measures
- Implement Privacy by Design workflows so that any new product or process involving personal data triggers an automatic data protection impact assessment (DPIA) review.
- Train marketing, credit risk, and data analytics teams jointly on purpose limitation rules to prevent siloed decisions that inadvertently create cross-functional GDPR violations.
- Establish a Data Ethics Review Board or equivalent governance body to evaluate novel or extended uses of personal data before deployment.