[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnN7tzGrV7wpJ7NNGm3aFNoB2fou045GvCkSgOAkI54k":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"69ac2a7e-761d-4665-b42a-c492de859e03","austrian-supreme-court-rules-gdpr-purpose-limitation-bars-repurposing-marketing-data-for-credit-iden","f94bbabb-0a4d-4e59-91d6-6296322c6fbb","Austrian Supreme Court Rules GDPR Purpose Limitation Bars Repurposing Marketing Data for Credit Identity Checks","The Austrian Supreme Court found that personal data collected for marketing purposes was unlawfully repurposed for identity verification during credit assessments, violating GDPR's purpose limitation principle under Article 5(1)(b) and lacking a valid legal basis under Article 6(4). This matters because organizations frequently accumulate large datasets for one purpose and later attempt to reuse them for unrelated functions without reassessing compatibility or lawful basis. The ruling reinforces that the absence of a direct relationship between the controller and data subject — combined with no safeguards — makes such repurposing indefensible. Regulators and courts across the EU are increasingly scrutinizing secondary data uses, and this decision signals that compliance must be proactive, not reactive.","**Immediate actions:**\n- Audit all existing datasets to document their original collection purpose and identify any secondary uses that may conflict with that purpose.\n- Halt any processing activities that reuse personal data for purposes not compatible with the original consent or lawful basis until a legal review is completed.\n\n**Policy & governance improvements:**\n- Establish a formal Purpose Limitation Policy requiring a documented compatibility assessment (per GDPR Article 6(4) criteria) before any secondary use of personal data is approved.\n- Implement Data Protection Impact Assessments (DPIAs) as a mandatory gate for any new use case involving pre-collected personal data.\n- Define clear data retention and usage boundaries in privacy notices so data subjects are fully informed of all intended processing purposes at the point of collection.\n\n**Detection & accountability measures:**\n- Deploy data cataloguing and tagging tools to track the provenance and permitted uses of all personal data assets across the organisation.\n- Schedule quarterly reviews by the Data Protection Officer (DPO) to verify that active processing activities remain aligned with their documented lawful bases.",[12,13,14,15,16,17,18,19,20],"GDPR Article 5(1)(b) – Purpose Limitation","GDPR Article 6(4) – Compatibility Assessment for Secondary Processing","GDPR Article 13\u002F14 – Transparency and Information Obligations","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.PO-P1 – Policies for data processing purpose","NIST SP 800-53 PT-2 – Purpose Specification","NIST SP 800-53 PT-3 – Personally Identifiable Information Processing Purposes","CIS Control 3 – Data Protection (Data Classification and Handling)","ISO\u002FIEC 27701:2019 – Privacy Information Management (Clause 7.2.1 – Identify and document purpose)",{},"published","2026-09-14T08:20:20.809959+00:00","2026-09-14T08:20:20.504+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=OGH_-_6Ob148\u002F25w&diff=53002&oldid=52996","ogh-6ob148-25w-8fb001","OGH - 6Ob148\u002F25w",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]