BVwG - W274 2240078-1

BVwG - W274 2240078-1
Court:	BVwG (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 5 GDPR Article 6(1)(f) GDPR Article 17 GDPR
Decided:	24.09.2021
Published:	09.12.2021
Parties:	Austrian Data Protection Authority (Datenschutzbehörde - DSB) unnkown data subject unnkown credit reference agency
National Case Number/Name:	W274 2240078-1
European Case Law Identifier:	ECLI:AT:BVWG:2021:W274.2240078.1.00
Appeal from:	DSB D124.1626 2020-0.708.870
Appeal to:	Unknown
Original Language(s):	German
Original Source:	Rechtsinformationssystem des Bundes (RIS) (in German)
Initial Contributor:	n/a

The Austrian Federal Administrative Court (Bundesverwaltungsgericht) ordered a credit reference agency to erase data on a €60 unpaid debt from 6 years ago from their database, but allowed it to retain data on several other small debts from 6 or 7 years ago.

English Summary

Facts

A credit reference agency had processed payment experience data on a total of over EUR 1,300 on a data subject. Some of the debts underlying these data had already been repaid, some were still unpaid.

In autumn 2019, the data subject requested erasure of all payment experience data under Article 17 GDPR. The credit reference agency refused, arguing a legitimate processing interest under Article 6(1)(f) GDPR. After the erasure request, the credit reference agency obtained further data on additional debts that the data subjects had failed to pay.

The data subject filed a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB), arguing that the payment experience entries are old and therefore not suitable for assessing their creditworthiness. The data subject further claimed that the data were inaccurate.

The DSB partially upheld the complaint and ordered the credit reference agency to erase the four oldest payment experience entries from their database. These entries concerned debts over EUR 66 (fully repaid in December 2014), EUR 60 (never repaid but collection ceased in August 2015), EUR 177 (fully repaid in October 2015) and EUR 84 (never repaid but collection ceased in December 2015).

The credit reference filed an appeal against this decision with the federal administrative court (Bundesverwaltungsgericht - BVwG)

Holding

The BVwG partially upheld the appeal. It held that the credit reference agency must indeed erase the database entry on the EUR 60 debt (never repaid but collection ceased in August 2015) but may continue to process the remaining entries. It referred to existing BVwG case law, according to which the CRR Regulation (which obliges banks to assess creditworthiness based on information that reaches at least back five years in the past) can be used as a tool of interpretation to assess the legitimate storage period for payment experience data. The BVwG held that this five year period is only to be seen as a "framework of orientation" but the actual lawfulness of further processing of payment experience data under Article 5 and 6 GDPR must be assessed on a case to case basis.

As the data subject had continuously failed to pay their debts in time in the past years and in light of the high total of unpaid debts and the fact that the data subject had just recently again failed to repay their debts, the legitimate interests of the credit reference agency outweigh the rights and freedoms of the data subject. Regarding the mentioned entry on the EUR 60 debt, the BVwG held that the credit reference agency had failed to prove that the debt was in fact accurate and therefore ordered its erasure.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

court
Federal Administrative Court


Decision date
09/24/2021


Business number
W274 2240078-1


Saying
W274 2240078-1 / 4E

IN THE NAME OF THE REPUBLIC!

The Federal Administrative Court recognizes through the judge Mag. LUGHOFER as chairman as well as the expert lay judges Prof. KR POLLIRER and Dr. GOGOLA as observer on the complaint of XXXX, represented by BAKER & McKENZIE DIWOK HERRMANN PETSCHE Rechtsanwälte LLP & Co KG, Schottenring 25, 1010 Vienna, against the decision of the data protection authority, Barichgasse 40 - 42, 1030 Vienna, from January 27th, 2021, GZ D124 .1626 2020-0.708.870, Participants XXXX, due to violation of the right to erasure, rightly in a closed meeting:
The complaint is partially followed and the verdict of the contested decision is changed so that it reads as a whole:
"1. The complaint is partially upheld and it is determined that the right to erasure of MB XXXX has been violated because the payment experience date relating to it, which was booked out on 08/27/2015 (origin “Mediafinanz AG”), has not yet been taken from the BF's creditworthiness database has been deleted.
2. The BF is instructed to respond to the MB's request for deletion regarding the date of payment experience on item 1 within a period of four weeks. comply and delete this data.
3. The complaint is otherwise dismissed. "
The revision is permissible according to Art. 133 Para. 4 B-VG.




text
REASONS FOR DECISION:
XXXX (hereinafter: Participants, MB) contacted the data protection authority (hereinafter: relevant authority) by e-mail dated October 29, 2019 and lodged a "complaint against company XXXX" (hereinafter: complainant, BF). She stated that after she submitted the request for immediate deletion of the data for the third time, she received a negative answer again.
Attached to the e-mail was correspondence between the MB and the BF, from which it follows that the MB, after receiving information from the BF, submitted an undated request for deletion in which it objects to the further processing of its personal data and the deletion of your Data from the warning list of the banks and the small credit register / consumer credit register according to Art. 17 GDPR desired. Your name and current address are expressly excluded from the objection and request for deletion. The data (recorded by the BF) are several years old and unsuitable for “exercising the information trade according to Section 152 of the Trade Regulations”. The MB also reserves the right to claim damages in accordance with Art. 82 GDPR and other provisions.
With an e-mail of October 25, 2019, the MB set the BF a deadline of October 28, 2019, 1 p.m., otherwise it should contact the data protection authority and consumer protection.
Among other things, with an e-mail from the BF dated October 29, 2019 to the MB, it processed the MB's data on the basis of the legitimate interests of its customers in accordance with Article 6 (1) (f) GDPR, as long as a legitimate purpose for the processing exist.
After an order to remedy the defect, the MB sent information from the BF in accordance with Art. 15 GDPR from October 17, 2019, transmitted after the MB's request for information from October 16, 2019. In addition to the payment history data transmitted in tabular form, this contains the handwritten notes of the MB on lines 3 - 11 "Done although data or claims were not correct!" And on lines 1 and 2 "already done" (for the content of the data information see below) .
In addition to a table on payment history data in the period from October 13, 2014 to November 20, 2018, the data information contains a further table in which it is stated which companies would have made inquiries about the identity and / or creditworthiness of the MB at BF.
The BF responded by email to the complaint submitted on November 29, 2019. After presenting its tasks according to § 152 GewO, the BF stated that it processed eleven (negative) payment experiences relating to the MB. These were opened between 2014 and 2018 and mostly closed between 2014 and 2016 (paid or booked out due to lack of collectibility), although not all claims had been closed at the time of the information and at the time of this statement. The claims against MB were therefore unadjusted for several months to more than a year. Two of the claims at issue - both from 2018 and amounting to EUR 77.96 and EUR 128.60 respectively - have not yet been closed and are still being processed. Concerning the handwritten note by MB, according to which two claims have already been settled, a request was made to the debt collection company that did not confirm this fact. These claims were also unadjusted and were stored in the database as "unprocessed". In total, the claims at issue, each amounting to between EUR 59.95 and EUR 214.65, amounted to EUR 1,369.66. The processing of the payment experience data in question is indispensable for the requirements of the credit agency regarding credit relationships. They are relevant to creditworthiness and are still necessary for the purpose for which they were collected.
In a (further) e-mail to the BF and the DSB on December 3rd, 2019, the MB stated that the data stored at that time had "unfortunately happened", which is no longer related to the financial situation of today (at that time not working, etc.) stand Because the outdated data are still there, the MB does not have some credit-related options available, but this is not a problem for "their income situation". The sum of the data listed under 3.4 did not match, excessive fees on the part of a debt collection agency could not be counted here, and the things were also settled. If the data is not deleted, the MB will consider further steps. She is also in contact with daily newspapers and will make the matter public.
In response to a request for a statement dated December 10, 2019 regarding two unclosed claims, the BF sent the e-mail dated December 20, 2019 to the authority concerned, with which additional correspondence was submitted and the specific question stated that the two claims were, on the one hand, about one of IDG Inkassodirekt GmbH (claim of Euro 128.60), which is fully defective, on the other hand one of Infoscore Austria GmbH of Euro 77.96, which is defective with Euro 16.64.
Extensive correspondence was submitted with this opinion.
In a letter from the authority concerned dated February 13, 2020, the MB was given the opportunity to make a supplementary statement. The MB did not make use of this.
With a “request” for a supplementary statement from December 11th, 2020, the authority in question sent the BF the submission of the MB from December 3rd, 2019 and requested an opinion on the correctness of the handwritten marked as “incorrect” by the MB in the submission of November 6th, 2019 Records on. Furthermore, it wants to be explained why the BF assumes the correctness of the stored payment history data. If necessary, suitable evidence should be presented to prove one's own submission and it should be made known which payment experience data about the MB is currently or still being processed by BF.
For this purpose, the BF submitted the supplementary statement dated December 2nd, 2020, which has now been signed by a lawyer, including enclosures ./1 - ./6. In addition, she stated that BF only received information about (negative) payment experience data almost without exception if there was a delay in payment, the first two reminders by the creditor had been unsuccessful, thus a qualified default in payment had occurred and the third reminder from a debt collection agency remained unsuccessful and therefore there is a continuing qualified default in payment. This process is ensured by the fact that the BF obliges the debt collection company to only make a report if the first reminder issued by the debt collection company has not been successful. This would result from the partner agreement that has now been submitted. As a result of this, the debt collection companies are also obliged to ensure the correctness of the reported payment experiences.
The database in question is one within the meaning of Section 7 (1) VKrG.
Regarding the payment history data complained about by MB as "incorrect":
The MB is to be accepted insofar as the disputed payment history data have been positively dealt with or booked out by the respective debt collection company. This was already evident in the information as the payment status. The fact that for most of the payment history data the payment status is "positively done", that is, that BF has paid these claims, serves as an indication that these amounts were correct in terms of reason and amount. Nevertheless, the BF contacted those debt collection companies who reported the payment experience data that was the subject of the proceedings to the BF. Correspondence in this regard would be presented. From this it would appear that the payment experience data reported by SportScheck GmbH, Infoscore Austria GmbH, OKO Inkasso-Auskunft GmbH & Co KG and Inkasso MERKUR GmbH are exclusively about capital claims of the customers of the debt collection company and that these are not "excessive fees on the part of any debt collection -Offices "included. With the in point 3.4. of the BF's statement of November 29, 2019, it is merely the lowest and the highest capital claim listed in the information of October 17, 2019 as well as the calculated total of all capital claims listed in this list. Regarding the payment experience data registered by Media Finanz AG, BF has already contacted us regarding the accuracy, but has not received any feedback to date despite the request.
The BF also submitted a list of the currently processed payment history data and argued that, compared to the information from October 17, 2019, the payment history of EUR 128.60 from 2018 had meanwhile been deleted from the BF system and there were two further payment histories over EUR 40 , 98 from 2019 and EUR 79.95 from 2020 were added. This means that 12 payment experiences are currently being processed. In particular, the short time that has elapsed since the end of the collection cases should be taken into account (two claims were still unjustifiably liable), the duration of the uncorrected liability and the amount of the claims (totaling EUR 1,331.99).
With the contested decision, the authority in question partially upheld the complaint and determined that MB's right to erasure had been violated by the fact that the payment experience data that had already been received on December 30, 2014 (origin: “Infoscore Austria GmbH”), August 27, 2015 (Origin “Mediafinanz AG”), 19.10.2015 (origin “Infoscore Austria GmbH”) or 11.12.2015 (origin: “Inkasso Merkur GmbH”) had not yet been deleted from the BF creditworthiness database. The BF is instructed to comply with the MB's request for deletion of the specified data within a period of four weeks and to delete this data. Otherwise, the complaint was rejected as unfounded.
The authority concerned made the following factual findings (party names were adapted):
“The BF operates a business according to § 152 GewO 1994 as a credit agency.
On October 17, 2019 (time of the provision of information), the BF processed the following payment history data for the MB in its creditworthiness database, which was not objectionable in terms of content, which totaled 1,369.66 at the time:
(Excerpt from the original):

With letters of October 18, 2019 and October 25, 2019, MB requested the deletion of this payment history data. In a letter dated October 29, 2019, the BF informed the MB that it would not comply with the request for deletion, as there was a legitimate interest in the processing of this data.
As of December 2, 2020, the BF processed the following payment history data, which were not objectionable in terms of content, via the MB (excerpt from the original):

The payment experience of EUR 128.60 from 2018, which was still processed on October 17, 2019 (IDG Inkasso Direkt GmbH), has now been deleted from the BF system. For this purpose, two new claims from 2019 and 2020, which have not yet been positively settled, are now being processed by the BF. Overall, the entered payment experience data as of December 2, 2020 result in a total of EUR 1,331.99.
From a legal point of view, the authority concerned initially presented Article 17 (1) (a) GDPR and Article 6 (1) (f) GDPR in more detail, as well as Article 5 (1) (b) GDPR. She also referred to her decision of December 7th, 2018 DSB-D123.193 / 0003-DSB / 2019 on the question of how long entries should be stored in the databases of credit agencies.
As a credit agency, BF was processing a total of twelve payment procedure data relating to MB at the time of the statement on December 2nd, 2020. Two of these data sets concern outstanding claims. At the time of the decision, four of these claims were already "closed" more than five years ago (ie "positively dealt with" or "fully booked").
The legitimate interests of BF are to be assessed and compared with the legitimate interests of MB and third parties. The MB believes that its right to erasure has been violated by the fact that the BF is processing (incorrect) “old data” on claims that have been “already settled” about them and that some “credit-related options” are therefore not open to them. The (unsubstantiated) claim that the stored payment history data are incorrect has been credibly refuted by extensive correspondence on the part of the BF with the debt collection agencies concerned. The submission of the MB, the sums mentioned by the BF in its statement of 29.11.2019 did not match, could not be understood. The sum of the stored claims at that time, as submitted by the BF, was EUR 1,369.66. With regard to the argument that it was "old data", the BF rightly replied that a past insolvency could also represent an essential basis for the creditworthiness assessment. The consideration of payment defaults in the recent past is therefore necessary in order to be able to provide complete information about the creditworthiness of a particular person. Based on past payment defaults, a conclusion can be drawn about future solvency.
With regard to the specific storage period for the payment history data, reference should first be made to the finding of the BVwG of October 30, 2019, GZ W258 2216873-1. Accordingly, as a guideline for how long creditworthiness data are suitable for assessing the creditworthiness of a potential debtor, observation or deletion periods in legal provisions that served to protect creditors or that specified the requirements for a suitable creditworthiness assessment could be used. In this regard, the EU's capital adequacy regulation should be linked, according to which a period of at least five years should be used as the historical observation period for at least one data source. The European legislator assumes that data on possible payment defaults over a period of at least five years are relevant for assessing the creditworthiness of a potential debtor or the risk of a claim. If credit institutions, as potential business partners, are legally obliged to evaluate their claims based on the default rates of at least the last five years and the BF's creditworthiness database is also intended to provide credit institutions with data that they need for their sometimes mandatory assessment, there is no violation the principle of data minimization or storage limitation applies if the BF processes payment history data of the MB, the positive completion of which was less than five years ago. This is the case here for eight of twelve post-processed payment history data.
With regard to the processing of data "that were closed over five years ago", the BF argues that payment history data outside the minimum period of five years should also continue to be stored in the specific case. The fact that, despite the existence of these older payment experiences, numerous new payment experiences were caused by MB, is also relevant for the future assessment of their creditworthiness. This is the only way to give a correct overall picture of the MB's creditworthiness. With regard to the low amount of some claims, it should be noted that even small amounts that could not be brought in or that could not be brought in after repeated reminders and the pursuit of the debt collection company played a decisive role in assessing a person's creditworthiness (especially unwillingness to pay). Particularly in the small-scale mass business, payment behavior contrary to the contract must also be taken into account with regard to relatively small amounts. In addition, numerous smaller amounts (like here) could accumulate into a larger sum.
That is not to be followed in the present case. The sum of the stored payment experience data totaling 1,331.99 euros can be classified as not inconsiderable and is made up of a large number (twelve in total) of relatively low claims. Of the fact that those four claims that were closed on December 30, 2014, August 27, 2015, October 19, 2015 and December 11, 2015 - at the time of the decision more than five years ago - continue to make a significant contribution to a correct overall picture about the creditworthiness of the MB was not to be assumed. Even on the basis of “only” the eight payment history data that are still within the five-year benchmark, BF and its customers should be able to get a sufficiently well-founded picture of MB's creditworthiness. The processing of this data is therefore inadmissible at the time of the decision or violates the MB's right to erasure in accordance with Art. 17 GDPR.
However, there is a legitimate interest of BF in the further processing of those eight payment history data that were closed less than five years ago. In this regard, the interest of the companies inquiring about creditworthiness in receiving a credit report for the purpose of protecting creditors or the interest of BF in exercising their business according to § 152 GewO should be given higher priority than MB's interest in keeping their personal payment history data confidential. With regard to the remaining four payment experience data, which were "closed" by the BF at the time of the decision more than five years ago, the interests of the MB should be given greater priority.
The BF's complaint (raised by a lawyer) due to incorrect findings of the facts and incorrect legal assessment is directed against the admissible points of the ruling with the request to reject the complaint (meaning in its entirety) as unfounded or to discontinue the proceedings.
The authority concerned submitted the complaint, including the electronic file, to the administrative court - received on 03.03.2021 - with reference to the notification with the request to reject the complaint.
The complaint was sent to those involved so that they could comment. A statement was not made in due time.
The complaint is partially justified:
The administrative court also bases its findings on the findings of the authority concerned and supplements them as follows:
In an e-mail dated November 19, 2020, BF asked Inkasso Merkur GmbH to confirm that these amounts were in relation to claims above EUR 214.65 (since August 27, 2015) and EUR 83.55 (since August 1, 2015) the original capital claims. Inkasso Merkur GmbH confirmed this with an e-mail dated November 23, 2020, submitting reminders from August 27, 2015 and September 1, 2015, whereby the amounts of EUR 83.55 and EUR 214.65 are the capital amounts to open invoices from the customer JAKO-O.
In a further letter dated November 19, 2020, BF requested Media Finanz AG to confirm a claim of EUR 59.95 dated June 12, 2015 that this was the original capital claim. Such a confirmation was not submitted to the BF by mediafinanz.de.
Evidence assessment:
The findings already made by the authority concerned are undisputed insofar as the relevant claims regarding opening, closure, capital claim, outstanding amount, claim status, payment status and origin of the information are partially known before the procedure before the authority concerned, but at least in the procedure of the MB were brought. In a letter dated February 13, 2020, MB was given the opportunity to comment on these circumstances within the framework of the hearing of the parties. A statement (and thus a substantiated denial) was not made. The authority in question asked the BF to provide more detailed explanations with regard to the initial general dispute of the correctness of the requirements of the information from October 17, 2019, whereby on the one hand it emerged that the claims of EUR 83.55 and EUR 214, 65 were capital claims. The reminders submitted by Merkur GmbH in this regard are harmless. On the other hand, there was no basis for the claim of EUR 59.95 on which the entry was based from Media Finanz AG. On the basis of the other letters submitted, Enclosures ./1 - ./4, it was to be assumed that the other claims listed in the information provided by BF are pure capital claims, without including collection charges.
Legally follows:
The current case law of the data protection authority as well as the Federal Administrative Court on the question of the storage authorization and storage duration of payment experience data from credit agencies authorized according to the trade regulations is primarily based on the finding W258 2216873, which - fundamentally presupposing this - was followed by further decisions (including W274 2232028 and W214 2216836). This knowledge is based on the fact that the processing of personal data according to Art. 5 GDPR is permissible according to the processing principles mentioned there. These include purpose limitation, data minimization, accuracy and storage limitation. Furthermore, the legality of the data processing according to Article 6 must be checked, whereby in the absence of other justification reasons according to lit.f, a weighing of interests between the interests of the authorized person responsible and those of the person concerned must be carried out. Since neither the GDPR nor the commercial regulations on the business of credit reporting agencies (Section 152 Trade Regulations) contain specific deadlines for the permissible storage period for historical payment defaults, the assessment of the permissible storage period depends on the individual case. The following criteria were named: Historical payment information for forecasting the future payment behavior of a potential debtor would have less informative value the longer it was in the past and the longer there were no further payment delays or defaults. The age of the claim or the point in time at which the final default of the claim was established, the point in time of any repayments and the debtor's good conduct since then are of decisive importance in the weighing up.
Regulation (EU) No. 646/2012 (Capital Adequacy Regulation) is used as a guideline, which obliges banks and others to evaluate their customers and assess various risks of their claims. To determine the probability of failure, a historical observation period for at least one data source, which can also be external, of at least five years must be used as a basis. The loss quota to be estimated in the event of a failure must generally refer to a period of at least five years. From this it was deduced that if credit institutions as potential business partners are legally obliged to evaluate their claims based on the default rates of at least the last five years, this could in principle also apply to the creditworthiness database of companies such as the BF, which, among other things, is supposed to provide credit institutions with data that they need for their partly mandatory assessment. In specific to W258 2216873 it was stated that with reference to it, it could not be recognized as a violation of the principle of data minimization or storage limitation if the BF there processed data on insolvency if the payment plan was only one and a half years ago or at the time of the request for deletion . at the time of the decision had only been fulfilled a little more than three years ago. This also applies to claims that were already in default more than five years ago, but were only finally repaid one and a half years or three years ago through the fulfillment of the payment plan. The specific amount of the default can only be determined if the payment plan has not been successfully fulfilled.
The authority concerned also based its decision on these legal principles and regarded the five-year period mentioned as a quasi rigid limit. It no longer considered there to be any storage interest for those claims that were closed (positively completed or booked out) more than five years ago from the time of the decision. It should not be assumed that these (here specifically four requirements) could make a significant contribution to a correct overall picture of the creditworthiness of the MB. A sufficiently well-founded picture of the creditworthiness of the MB would result solely from consideration of all the payment experience data that were within the five-year guide value.
BF countered this in its complaint on a legal level, in fact only two of the four disputed claims had already been settled, the others remained uncorrected (“booked out”). From the knowledge W258 2216873 it would emerge that “the good conduct of the debtor at the time is of decisive importance in the weighing up”. Such good conduct is not present here, especially since two of the four claims under the proceedings were still unadjusted, three other claims not pertaining to the proceedings were uncorrected and in five further cases a continued qualified default in payment was caused, the MB in the proceedings incorrect assertions regarding positively settled claims or incorrectness of the claims and this is currently in continued qualified default in payment, although she claimed in the proceedings that the payment experience data in the past was not related to her financial situation today.
In addition, the BF does not “make a picture” of the creditworthiness of a person concerned “in the sense of a manual qualitative assessment”, but calculates the creditworthiness automatically in the form of a score value, whereby the score value loses accuracy when data is added the basis of which it is calculated would be deleted. Incidentally, BF's customers did not have access to the payment history data.
Finally, the authority in question did not adequately take into account the criteria it fundamentally stated of the amount of the individual claims, their age, the number of claims collected by a debt collection company, the time that had passed since a claim was settled and the origin of the data, whereby the number of claims collected by a debt collection company is relatively high at ten.
To do this, the following is to be carried out:
In the proceedings, the MB vehemently demanded the "immediate deletion" of all data without going into more detail in the legal circumstances relating to the individual claims. The contest of the claims with a handwritten note on the information from October 17, 2019 as well as the assertion that the financial circumstances at that time were in no way related to the current ones were not followed by any further details or statements on the information from the BF that cast doubt on these circumstances .
Based on the findings of the authority concerned - partially supplemented in the current knowledge - the legal argumentation of the authority concerned is not tenable:
First of all, the BF is to be justified in saying that the wording of point 1. in relation to the payment experience data on August 27, 2015 and December 11, 2015 ("were settled") in view of the findings on p. 4 and 5 of the decision, according to which the corresponding claims " booked out ”, contrary to the records.
In the following, the data given in the tables on pages 4 and 5 of the notification must be used as the basis. This means that at the time of the application on October 17, 2019, eleven payment experience data relating to the MB were available, the oldest opened on October 13, 2014, the most recent opened on November 20, 2018. At the time of the end of the proceedings in December 2020, the BF processed twelve payment experience data, the oldest opened on October 13, 2014, the most recent on November 11, 2020. Looking at both points in time, negative payment experience data existed in the years 2014 to 2016 and consistently again from 2018. The payment histories contain individual receivables that were covered relatively quickly (opened on October 13, 2014, closed on December 30, 2014; opened on June 11, 2015, closed on August 27, 2014). 2015; opened on September 1, 2015, closed on December 11, 2015), as well as long-term unadjusted claims (October 24, 2014 to October 19, 2015; August 27, 2015 to February 5, 2016; March 2, 2015 to March 30, 2016; December 3, 2014 until June 14, 2016). The general denial of the correctness of the claims excluded from the information was not generally confirmed in the course of the surveys. Only the claim from Mediafinanz AG for EUR 59.95 from 06/11/2015 could not be certified with regard to its quality in the context of the surveys, so that it can be disregarded as a negative payment experience date.
Based on the legal situation described in detail at the beginning based on the Capital Adequacy Ordinance, the period of five years is not to be seen as a “rigid limit”, but as an orientation framework that can serve as an indication of the need to store negative payment experiences. In view of the fact that a larger number of negative payment experiences in the years 2014 to 2016, after a two-year "good conduct period" since 2018, are based on further similar payment experience data, whereby two uncorrected claims are currently outstanding (one - based on the time of the decision - already more than one Year), there are no apparent reasons why the claims of EUR 65.99, EUR 178.84 and EUR 83.55 closed on December 30, 2014, October 19, 2015 and December 11, 2015 by BF are not available more likely to be processed. The oldest of these demands, at six years of age at the time of the first instance decision, is by no means far outside of this timeframe. With regard to the total amount of the receivables, the age (in addition to older repaid receivables, there are still unredeemed younger receivables) and their number, it is not clear why the interests of the MB should be weighted over those of the BF in individual cases, with the MB in particular has not succeeded in showing why she has to face “many financial disadvantages” by storing the three older payment history data at hand. It can be assumed that, due to the disadvantages already resulting from the (unfavorable) credit situation due to the other payment experiences, there is no further impairment of BF due to the payment history data in question.
For the sake of completeness, however, the BF should be referred to the fact that the statements on S 9 of the complaint, points 1 and 2, according to which the BF calculates a score value, are - as far as can be seen - new submissions in this procedure, on which the determinations are not based. The relevant statements must therefore be disregarded in the context of the legal assessment.
The complaint was therefore partly to be followed and the verdict to be changed so that only a violation of the right to deletion regarding the payment experience date related to "Mediafinanz AG" is determined and a corresponding deletion is requested.
An oral hearing could be dispensed with. No such request was made. Essentially, the findings of the authority concerned, which were not disputed by the MB in the context of the hearing of the parties, were also used as the basis for this finding.
The ruling that the appeal is admissible is based on the fact that there has been no case law of the Administrative Court on the question of the permissible storage period for creditworthiness-related data.


European Case Law Identifier
ECLI: AT: BVWG: 2021: W274.2240078.1.00