Austrian Supreme Court Rules GDPR Purpose Limitation Bars Repurposing Marketing Data for Credit Identity Checks
Written by AI from the linked story. Not reviewed by an editor. How this works
The Austrian Supreme Court found that personal data collected for marketing purposes was unlawfully repurposed for identity verification during credit assessments, violating GDPR's purpose limitation principle under Article 5(1)(b) and lacking a valid legal basis under Article 6(4). This matters because organizations frequently accumulate large datasets for one purpose and later attempt to reuse them for unrelated functions without reassessing compatibility or lawful basis. The ruling reinforces that the absence of a direct relationship between the controller and data subject — combined with no safeguards — makes such repurposing indefensible. Regulators and courts across the EU are increasingly scrutinizing secondary data uses, and this decision signals that compliance must be proactive, not reactive.
Tactical Insight
Immediate actions
- Audit all existing datasets to document their original collection purpose and identify any secondary uses that may conflict with that purpose.
- Halt any processing activities that reuse personal data for purposes not compatible with the original consent or lawful basis until a legal review is completed.
Policy & governance improvements
- Establish a formal Purpose Limitation Policy requiring a documented compatibility assessment (per GDPR Article 6(4) criteria) before any secondary use of personal data is approved.
- Implement Data Protection Impact Assessments (DPIAs) as a mandatory gate for any new use case involving pre-collected personal data.
- Define clear data retention and usage boundaries in privacy notices so data subjects are fully informed of all intended processing purposes at the point of collection.
Detection & accountability measures
- Deploy data cataloguing and tagging tools to track the provenance and permitted uses of all personal data assets across the organisation.
- Schedule quarterly reviews by the Data Protection Officer (DPO) to verify that active processing activities remain aligned with their documented lawful bases.