VwGH - Ro 2020/04/0031-9

VwGH - Ro 2020/04/0031-9
Court:	VwGH (Austria)
Jurisdiction:	Austria
Relevant Law:	Article 6(1)(f) GDPR Article 17 GDPR Article 7 CFR Article 8 CFR
Decided:	01.02.2024
Published:
Parties:	Austrian Data Protection Authority K GmbH
National Case Number/Name:	Ro 2020/04/0031-9
European Case Law Identifier:	ECLI:AT:VWGH:2024:RO2020040031.J00
Appeal from:	BvWG W211 2225136-1/6E
Appeal to:	Unknown
Original Language(s):	German
Original Source:	RIS (in German)
Initial Contributor:	ec

The Austrian Supreme Administrative Court found that the storing and processing of personal data from the public insolvency register by a credit agency after the date that the data is made unavailable to the public is unlawful.

English Summary

Facts

In 2010, debt settlement proceedings were issued against the data subject. The data subject settled the payments of their debts in March 2018.

The controller, a credit ranking agency, processed and stored personal data of the data subject that related to his debt settlement procedure. The purpose of the procesing was to assess the creditworthiness of the data subject and his company. The data subject was the company's sole shareholder.

The data subject requested the erasure of his personal data on 4 May 2018, after fulfilling his debt payment plan. On 24 October 2018, the data subject lodged a complaint at the Austrian DPA against the controller for the infringement of the right to erasure under Article 17 GDPR.

The controller informed the DPA by letter the same day that it would not comply with this request.

The DPA dismissed the data protection complaint.

The data subject appealed this decision at the Federal Administrative Court (Bundesverwaltungsgericht, BVwG).

The court dismissed the appeal. The court found that the controller’s purpose for processing the personal data in question was necessary, as the data is necessary for making a forecast about the future payment behaviour of the data subject. The court found that the interests of the controller and its third parties outweighed the interests of the data subject The court concluded that the processing of data on historical insolvencies and payment defaults of the data subject was necessary and lawful and that the objections raised by the data subject could not justify his request for erasure.

The data subject appealed to the decision before the Verwaltungsgerichtshof (Austrian Supreme Administrative Court).

The Austrian Supreme Administrative Court held off its judgement until the CJEU issued its decision on C-26/22 and C-64/22 – Schufa.

Holding

The Supreme Administrative Court ruled on two questions. Firstly, it examined the legality of the storage of data collected from the insolvency registry by the controller.

Previous Austrian jurisprudence stated that credit agencies could collect and process personal data collected through the public insolvency register up to 5 years after deletion of the data concerned in the registry. However, the recent CJEU C-26/22 and C-64/22 – Schufa case stated that the lawfulness of the processing by the controller must be assessed solely in light of Article 6(1)(f) GDPR. In particular, the CJEU also ruled that credit agencies cannot process data they collected from the insolvency register once that data has been deleted from the registry itself (see CJEU C-26/22 and C-64/22 – Schufa para 99). The CJEU explained noted that in Austria the data in the insolvency register is only kept for up to 6 months and therefore, after the expiry of a six-month period, the rights and interests of the data subject take precedence over those of the public to have access to that information.

The controller argued it had a legitimate interest in the processing of the creditworthiness data of the data subject due to national law. The Federal Administrative Court also ruled that the processing also served to protect the legitimate interests of the controller’s contractual partners. In light of the CJEU C-26/22 and C-64/22 – Schufa case, the Supreme Administrative Court found the processing of this data, including the storage, analysis and disclosure of this data to a third party by the controller, constitutes a serious interference with the fundamental rights of the data subject under Article 7 CFR and Article 8 CFR. The processing of such data can significantly harm the interests of the data subject because the disclosure is likely to make it considerably more difficult for him to exercise his freedoms, especially when it comes to meeting basic needs.

The Court stated that the objective of a payment plan is the economic recovery of the data subject. The request to erasure of personal data due to fulfilling the payment plan is intended to prevent the data subject from being impaired in business dealings by the public announcement of earlier insolvency proceedings. Therefore, the data subject’s economic recovery is jeopardised if a credit agency, thus the controller in this case, stores data on the data subject’s insolvency proceedings in order to assess the data subject’s creditworthiness, as this data is always used as a negative factor in the assessment. In light of this, the legitimate interests of the controller to process data regarding the insolvency proceedings of the data subject, which ended with the fulfilment of the legally confirmed payment plan, can no longer justify the processing of these personal data, which were previously publicly accessible in the insolvency register.

The storage of this data by the controller after the decision of the insolvency court to remove the data from the public register can therefore not be based on Article 6(1)(f) GDPR. Thus, it is unlawful for the controller to store and process data relating to the insolvency proceedings of the data subject from the public insolvency register once the data is not available anymore in the register, contrary to the decision of the DPA and the administrative court.

Secondly, the Court examined the request for erasure in accordance with Article 17 GDPR. The Court ruled that due to the absence of lawful processing of the data subject’s data from the insolvency proceedings, the controller is obliged to erase the data concerned immediately under Article 17(1)(d) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Ro 2020/04/0031-9
                                                                February 1, 2024






        I M N A M E N D E R R E P U B L I K!

        The Administrative Court has through the presiding Senate President

        Dr. Kleiser, Councilor Dr. Mayr, court councilor Mag. Hainz-Sator and the court councilors

        Dr. Pürgy and Mag. Brandl as judges, with the participation of the secretary
        Löffler, LL.M., on the revision of the A G in W, represented by the

        Brand Rechtsanwälte GmbH in 1020 Vienna, Schüttelstraße 55, Carré Rotunde,
        against the decision of the Federal Administrative Court of July 28, 2020,

        Zl. W211 2225136-1/6E, concerning a data protection matter
        (authority concerned before the administrative court: data protection authority;

        Co-involved party: K GmbH, represented by BLS Rechtsanwälte GmbH

        in 1010 Vienna, Kärntner Straße 10; other party: Federal Minister of Justice),
        rightly recognized:

        The contested finding is due to illegality of the content

        lifted.

        The federal government has incurred expenses of €1,346.40 for the appeal applicant

        to be replaced within two weeks if otherwise executed. The additional request
        is rejected.


        Reasons for the decision:

1 The appellant's assets were reported in 2010

        Debt settlement proceedings before District Court D (Insolvency Court)
        opened and the repayment rate set in 2012 in mid-March 2018

        Fulfills. The insolvency court approved this procedure
        Resolution of May 4, 2018, the “deletion” requested by the appeal applicant

        the entries from the insolvency file” in accordance with Section 256 Paragraph 3 IO due to the
        Proof of fulfillment of the payment plan by the appeal applicant.


2 The participating party operates, among other things, the business of
        Credit information agency in accordance with Section 152 of the 1994 Trade Code (GewO 1994) and

        stored, among other things, the following excerpts from the data

        Applicant in relation to his debt settlement procedure
        in the personal credit profile of the audit applicant, as well as in the




        Administrative Court
        Judenplatz 11, 1010 Vienna
        www.vwgh.gv.at Ro 2020/04/0031-9
                                                                February 1, 2024

                                                                2 of 26




        Credit profile of XY GmbH, whose sole shareholder is

        The applicant for appeal is, under the heading “Insolvency”:
        “Current status of the proceedings since 2018-04-01”; “Procedural status: payment plan

        was settled directly by the debtor”, “Liabilities according to the insolvency application

        [EUR] 167,596.54”.

3 On October 24, 2018, the applicant filed an appeal against the party involved

        data protection complaint filed by the party as the respondent
        Violation of the right to deletion in accordance with

        Art. 17 General Data Protection Regulation (GDPR), after writing
        of May 23, 2018 the deletion of the entry concerning him about his

        Bankruptcy both in his “personal profile” and in the profile of the
        XY GmbH desires the database of the party involved and the

        co-involved party had informed this party in a letter dated the same day

        Not complying with desires.

4 In a decision dated September 20, 2019, the data protection authority (appealed

        Authority) rejects the data protection complaint as unfounded.

5 The complaint lodged by the appellant against this rejected this

        Federal Administrative Court (Administrative Court) with the contested
        The finding of July 28, 2020 was unfounded and stated that the

        Revision is permissible.

6 In summary, the administrative court stated that:

        The participating party processes the data in the course of operating the business
        Credit information agency in accordance with Section 152 GewO 1994 historical information about

        Payment defaults and insolvency proceedings of the appeal applicant
        (potential) creditors in order to determine the risk of any

        to provide payment defaults.

        This is a purpose recognized by the legal system.

        The data on the insolvency proceedings are correct, complete and fundamental

        necessary and suitable to make a forecast about the future
        payment behavior of the appeal applicant.




        Administrative Court

        Judenplatz 11, 1010 Vienna
        www.vwgh.gv.at Ro 2020/04/0031-9
                                                        February 1, 2024
                                                        3 of 26





Neither the GDPR nor the regulations on the credit reporting agency business
(§ 152 GewO 1994) contained concrete deadlines “for the permissible storage period

historical insolvency proceedings and payment defaults”. The permissible one

Storage duration depends on the individual case.

Historical payment information is essential for the future
Payment behavior of (potential) debtors

to be able to predict. However, they would have less informative value
longer they would be in the past and the longer there would be no further delays in payments

and payment defaults. The age of the claim or the

The time when the final default of the claim is determined
The timing of any repayments and the “good behavior” since then would be included

the weighing up is of crucial importance.

As a guideline, how long payment history data is used to assess creditworthiness
(potential) debtors are suitable, observation or

Deletion periods in the provisions serving to protect creditors

are used that meet the requirements of a suitable one
Creditworthiness assessment should be specified in more detail, such as the provisions of the

Regulation (EU) No 575/2013 of the European Parliament and of the Council
of June 26, 2013 on supervisory requirements for credit institutions and

Investment firms and amending Regulation (EU) No 646/2012
(Capital Adequacy Ordinance). These obliged credit institutions under

among other things, for customer assessment and risk assessment of their claims. For
credit or retail claims against natural persons

Credit institutions that calculate their risk-weighted position amounts based on a
based on internal assessments

(Art. 143 Para. 1), in accordance with Art. 151 Para. 6 in conjunction with Art. 180 Para. 2 lit. a
and e Capital Adequacy Ordinance the probability of default

Requirement based, among other things, on the long-term averages of the annual

Estimate the failure rate. This is a historical observation period for
at least one data source, which could also be external, from at least

to be taken as a basis for five years. Also the estimate to be carried out
The loss rate in the event of a default is in accordance with Article 151 paragraph 7




Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
                                                         February 1, 2024
                                                         4 out of 26





In conjunction with Article 181 Paragraph 2 Letter c of the Capital Adequacy Ordinance, it is generally based on one
for a period of at least five years.


The EU regulator therefore assumes that for the assessment of the
Creditworthiness of (potential) debtors and the risk

a claim data on any payment defaults over a period of
be relevant for at least five years.


If credit institutions are potential business partners of the party involved
are legally obliged to report their claims based on default rates

at least for the last five years, and the credit rating database
The party involved should also serve to provide data to credit institutions,

that they would need for their mandatory assessment violates the
Processing the insolvency data of the appeal applicant does not violate the principle

data minimization or storage limitation if the payment plan for
The time of the deletion request on May 23, 2018 was less than

three months, or at the time of the administrative court's decision

was fulfilled a little over two years ago. This also applies to
Receivables that were already defaulted more than five years ago

only, as in the present case, a little more than two years ago through the fulfillment of the
The payment plan was finally paid off because only with the successful payment

The specific amount of the default can be determined when the payment plan is fulfilled
could.


As part of the balancing of interests in accordance with Article 6 Paragraph 1 Letter f of the GDPR
on the one hand, the interests of the person responsible and of third parties (possible

business partners of the party involved) and, on the other hand, the interests,
The rights and expectations of the data subject must be taken into account.

The party involved and their customers would have a comprehensible one

Interested in assessing credit risk. The processing of data

about insolvencies and payment defaults to protect potential successes
Contractual partner of the data subject, the third party within the meaning of Art. 6

Paragraph 1 lit. f GDPR. This data processing also serves
Support of credit institutions, the regulations of the




Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
                                                         February 1, 2024
                                                         5 out of 26





to comply with the capital adequacy regulation. For assessing credit risk
by the party involved is the observation of the historical

Payment behavior of potential debtors is essential and the

Processing data about a little over two years ago
Fulfillment of a payment plan finally concluded insolvency proceedings

necessary.

This interest of the party involved and their business partners outweighs this
the interest of the appeal applicant, not from economic disadvantages

Data processing to be affected because the amount of liabilities of the

Insolvency proceedings amounted to approximately €215,000. Furthermore, the person involved
Only one party has this payment experience data of the appeal applicant

limited public who has an interest to be taken into account
Credit check is available.

In contrast to the credit rating database of the party involved, the

data protection law admissibility of maintaining the insolvency file

§ 256 Insolvency Code (IO), a legal obligation within the meaning of Art. 6
Paragraph 1 lit. c GDPR. It cannot be deduced from Section 256 IO that

Insolvency data (at all) also based on other permitted circumstances
Art. 6 GDPR may no longer be processed if they come from the

Insolvency file had been deleted. Such a restriction would
at least with regard to the present relevant permit

Art. 6 Para. 1 lit. f GDPR contradicts EU secondary law.

As far as the appeal applicant in his letter of request dated

May 29, 2018 to object to the use of your data
21 GDPR, he did not explain to what extent the

Data processing based on Article 6 Paragraph 1 Letter f of the GDPR
is nevertheless not permissible in a special situation. The contradiction is

therefore inadmissible.

By claiming that the stored data is old and incomplete because

the appeal applicant has been successfully active again in business since 2016 and
This data is only suitable for his economic advancement




Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
                                                                 February 1, 2024

                                                                 6 of 26




         The appeal applicant is doing something to hinder and cause damage

         Violation of the general processing principles of the
         Data minimization and data economy according to Art. 5 GDPR and one

         inadequate balancing of interests within the framework of Article 6 GDPR, but none

         reasons arising from a special situation affecting him
         would result.


         The “processing of data on historical bankruptcies and
         “Payment defaults” by the appeal applicant by the co-involved party are therefore

         necessary and lawful. The objection raised by the appeal applicant
         could not justify his request for deletion.


 7 The administrative court based its decision on admissibility on the grounds that it was missing
         Jurisprudence of the Administrative Court on the question of which principles

         a balancing of interests in accordance with Article 6 Paragraph 1 Letter f of the GDPR must be sufficient;
         in particular, whether and under what conditions the regulations of the

         Capital Adequacy Ordinance as a guideline for determining the permissible

         Storage period of creditworthiness data can be used.

 8 The present ordinary revision is directed against this with the application

         Repeal of the contested finding against reimbursement of expenses.

 9 The authority concerned requested this in its response to the appeal

         Dismissal of the appeal against reimbursement of expenses. The participating party
         did not submit an appeal response.

10 By resolution of December 23, 2021, 6 K 441/21.WI, and resolution of

         January 31, 2022, 6 K 1052/21.WI, was ruled by the Wiesbaden Administrative Court

         (Germany) asked, among other things, the following questions to the ECJ (there
         pending C-26/22 and C-64/22) for a preliminary ruling:

         “...

         2. Is data storage at a private credit reporting agency
         personal data from a public register, such as the 'national
         Databases' within the meaning of Article 79 Paragraphs 4 and 5 of the

         Regulation (EU) 2015/848 [Regulation of the European Parliament and the
         Council of May 20, 2015 on insolvency proceedings], without any specific reason



         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2020/04/0031-9
                                                                  February 1, 2024

                                                                  7 out of 26




         stored in order to provide information in the event of an inquiry
         can, with Articles 7 and 8 of the Charter of Fundamental Rights of the European Union
         compatible?

         3. a) Are private parallel databases (especially databases of a
             Credit agencies) that are set up alongside the state databases and
             in which the data from the state databases (here
             Insolvency notices) are stored longer than in the narrow one

             Framework of Regulation 2015/848 in conjunction with the national one
             Regulated by law, generally permissible?

           b) If question 3 a) is answered in the affirmative, this results in the right to be forgotten
             in accordance with Art. 17 Paragraph 1 Letter d) GDPR, this data must be deleted,
             if the processing time envisaged for the public register
             has expired?

         4. Insofar as Article 6 Paragraph 1 Subparagraph 1 letter f) GDPR as the sole one
         Legal basis for data storage for private individuals
         Credit reporting agencies also appear in public registers
         Stored data comes into consideration is a legitimate interest

         Credit reporting agency is to be affirmed if this credit reporting agency has the data
         from the public directory without any specific reason
         Is this data then available when a request is made?

         ..."

11 By resolution of June 10, 2023, Ro 2020/04/0031, the
         Administrative Court continues the appeal process until the

         Decision of the ECJ in the above two

         Request for a preliminary ruling from the Wiesbaden Administrative Court is pending
         Proceedings suspended because answering these questions is also for the

         treatment of the present revision is important.

12 With judgment of December 7, 2023, C-26/22 and C-64/22, SCHUFA Holding

         (discharge of residual debt), the ECJ has decided on the request for a preliminary ruling from
         Wiesbaden Administrative Court decided.

         The Administrative Court considered:


         admissibility

13 The appeal turns out to be in line with the separate admissibility submissions made by the

         Revision clarified the legal question as to whether EU regulations, such as the one in this case




         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2020/04/0031-9
                                                                  February 1, 2024
                                                                  8 out of 26





         Capital Adequacy Ordinance applicable to credit institutions and investment firms
         are addressed and contain regulations for internal credit checks, as

         Guideline for determining the permissible storage period of not for

         internal use of certain creditworthiness data by credit reporting agencies
         can be used as permissible. She is also entitled.

         Relevant legal situation


         Union law

14 The relevant recitals and provisions of the

         Regulation (EU) 2016/679 of the European Parliament and of the Council of
         April 27, 2016 on the protection of natural persons during processing

         personal data, the free movement of data and the abolition of the
         Directive 95/46/EC (General Data Protection Regulation; GDPR), OJ L 119

         dated May 4, 2016, excerpts read:

         “Article 6
         Lawfulness of processing

         (1) Processing is only lawful if at least one of the
         the following conditions are met:

         ...

         f) the processing is to protect the legitimate interests of the
              responsible person or a third party, unless the
              interests or fundamental rights and freedoms of the person concerned,
              which require the protection of personal data, predominate
              especially if the person concerned is a child

              acts.
              Subparagraph 1(f) does not apply to those carried out by public authorities
              processing carried out in their tasks.

         ...

         Article 17
         Right to deletion (“right to be forgotten”)

         (1) The data subject has the right to obtain information from the person responsible
         request that personal data concerning you be deleted immediately

         and the person responsible is obliged to provide personal data
         deleted immediately if one of the following reasons applies:



         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2020/04/0031-9
                                                                   February 1, 2024
                                                                   9 out of 26





          a) The personal data are for the purposes for which they were collected
              or processed in any other way is no longer necessary.
          ...

          c) The data subject objects in accordance with Article 21(1).
              processing and there are no overriding legitimate reasons
              for processing, or the data subject submits in accordance with Article 21

              Paragraph 2 objection to the processing.
          d) The personal data was processed unlawfully.

          ..."

15 The relevant recitals and provisions of the

          Directive 2008/48/EC of the European Parliament and of the Council of
          April 23, 2008 on consumer credit agreements and the cancellation of the

          Council Directive 87/102/EEC, OJ L 133 of 22.5.2008
          excerpts:

          “(26) ... Particularly in the expanding credit market, it is important that
          Lenders do not act irresponsibly in granting loans or

          Granting loans without prior assessment of creditworthiness, and the
          Member States should carry out the necessary checks to prevent such
          Behaviors should be stopped and they should be the necessary ones
          Determine sanctions for those lenders who behave in this way.
          Without prejudice to the provisions of Directive 2006/48/EC of the European
          Parliament and of the Council of 14 June 2006 on the inclusion and

          The activities of credit institutions should be controlled by credit risk
          Lenders are responsible for evaluating the loan in each individual case
          Check the consumer's creditworthiness. ...

          ...
          (28) To assess the consumer's credit situation, the creditor should:

          also consult the relevant databases; due to legal and
          Factual circumstances may require such
          Consultations vary in scope. So that the competition between
          Lenders should not be distorted, lenders should choose from others
          Member States access to private or public databases
          concerning consumers in a Member State in which they are not established

          are granted under non-discriminatory conditions
          the creditors of that Member State.

          ...





          Administrative Court
          Judenplatz 11, 1010 Vienna
          www.vwgh.gv.at Ro 2020/04/0031-9
                                                                   February 1, 2024
                                                                   10 out of 26





         Article 8
         Obligation to assess the consumer's creditworthiness

         (1) Member States shall ensure that before the credit agreement is concluded
         the lender assesses the consumer's creditworthiness based on sufficient creditworthiness
         evaluates information that he may collect from the consumer and
         if necessary, based on information from the relevant company

         Database. Those Member States that require lenders to do so by law
         oblige to check your creditworthiness based on a corresponding query
         database can maintain this requirement.”

16 The relevant recitals and provisions of the

         Directive 2014/17/EU of the European Parliament and of the Council of
         February 4, 2014 on residential real estate credit agreements for consumers and for

         Amendments to Directives 2008/48/EC and 2013/36/EU and the
         Regulation (EU) No. 1093/2010, OJ L 60 of February 28, 2014

         excerpts:

         “(55) Before concluding a credit agreement, it is essential to have the ability and
         Evaluate and evaluate the consumer's propensity to repay the loan
         check. During this credit check, everyone should
         necessary and relevant factors are taken into account that determine the capability
         of a consumer to repayments due over the term of the loan

         could achieve, influence. ...
         ...

         (59) Querying a credit database is a useful element in the
         Credit check. ...

         ...

         Article 18
         Obligation to check the consumer's creditworthiness

         1. Member States shall ensure that the creditor before concluding a
         Credit agreement requires a thorough check of the consumer's creditworthiness
         carries out. When checking your creditworthiness, the factors that determine the...

         Examination of the prospects that are relevant to the consumer
         fulfills obligations under the loan agreement in an appropriate manner
         taken into account.

         ...






         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2020/04/0031-9
                                                                 February 1, 2024
                                                                 11 of 26





         Article 21
         Access to databases

         (1) Each Member State shall ensure that all creditors from all
         Member States have access to the assessment within their territory
         the consumer's creditworthiness databases used
         Use should only be monitored to what extent consumers

         fulfill their loan obligations during the term of a loan agreement.
         Access must be granted without discrimination.

         (2) Paragraph 1 applies to both private credit bureaus and credit reporting agencies
         operated databases as well as for public registers.
         ..."

17 The relevant recitals and provisions of the

         Regulation (EU) No 575/2013 of the European Parliament and of the Council

         of June 26, 2013 on supervisory requirements for credit institutions and
         Investment firms and amending Regulation (EU) No 646/2012

         (Capital Adequacy Regulation), OJ L 176 of June 27, 2013
         excerpts:

         “(42) It is essential to take into account the diversity of institutions in the Union
         is, should be used when calculating the own funds requirements for the
         There are different approaches to credit risk with varying degrees of severity

         Risk sensitivity and sophistication should be provided. Through the
         Use of external credit assessments and those from the institutions themselves
         The estimates made of individual credit risk parameters win
         Credit risk provisions significantly increase risk sensitivity and
         regulatory soundness. Institutes should switch to approaches

         with higher risk sensitivity. If institutes are to
         Apply the investigation approaches provided for in this Regulation
         They should provide the estimates needed to assess credit risk if they submit their procedures
         for credit risk measurement and credit risk management, so that for the
         Determination of regulatory capital requirements methods for
         are available that match the type, scope and complexity of the

         take into account the procedures of the individual institutes. In this regard, the
         Data processing in connection with procurement and administration
         of loans to customers also the development and validation of systems
         for credit risk management and credit risk measurement. This
         not only serves the legitimate interests of institutions, but also the goal

         this regulation, better methods for risk measurement and management
         apply and these methods also with regard to the prescribed ones
         to use own resources. Regardless, higher-level approaches require



         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2020/04/0031-9
                                                         February 1, 2024
                                                         12 of 26





Risk sensitivity significant expertise and resources as well as qualitative
high-quality and sufficient data. ...
...

Article 135

Use of ECAI credit ratings

(1) An external credit assessment may only be used to determine the
risk weight of a claim according to this chapter can be used,
if it comes from an ECAI or from an ECAI in accordance with the
Regulation (EC) No. 1060/2009 was confirmed.

...
Article 171

Assignment to rating levels or risk pools

...

(2) When assigning debtors and facilities to a rating level
or a risk pool, an institution carries all relevant information
Invoice. The information is up-to-date and enables the institute to
Forecast of the future development of the risk position. The less
The more information an institution has available, the more conservative it is
The procedure for assigning risk positions to debtor

or facility rating levels or risk pools. Does an institute support the
Determination of an internal assessment mainly to an external one
Credit rating, it ensures that other relevant ones are also relevant
information is taken into account.

...

Article 180
Special requirements for PD estimates

(1) When quantifying the risk parameters for certain creditworthiness levels
or pools are used by the institutions when estimating PD for receivables
Companies, institutions, central governments and central banks as well as for
Investment positions for which they apply the PD/LGD approach in accordance with Article 155

Apply paragraph 3, the following specific requirements:
...

f) to the extent that an institution compares its internal creditworthiness levels with the creditworthiness scale of a
    ECAI or comparable institutions linked or one of such
    scale and then the external creditworthiness levels

    assigns default rates recorded by the organization to its internal levels,
    This assignment is made based on a comparison between the internal ones



Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
                                                                   1. February 2024

                                                                   13 of 26




              Assessment criteria and the criteria of the external organization and
              a comparison between internal and external assessments of any
              joint debtor. Distortions or inconsistencies in
              Assignment procedures or the underlying data are included

              avoided. The criteria of the external organization that is responsible for the
              The data used for quantification are based
              exclusively focused on the risk of default and do not reflect any
              transaction characteristics. ..."

         National law


18 Section 7 Paragraph 1 of the Consumer Credit Act (VKrG), Federal Law Gazette I No. 28/2010 as amended
         Federal Law Gazette I No. 135/2015 reads:

         “Checking the consumer’s creditworthiness

         § 7. (1) Before concluding the loan agreement, the lender has the
         The consumer's creditworthiness based on sufficient information
         check that he - if necessary - requests from the consumer;
         If necessary, he also has information from one available

         database.”

19 § 9 Mortgage and Real Estate Loan Act - HIKrG, Federal Law Gazette I No. 135/2015,
         reads in part:

         “Checking the consumer’s creditworthiness

         § 9. (1) Before concluding a credit agreement, the lender has a
         carry out a thorough check of the consumer's creditworthiness. At
         The creditworthiness check are the factors that are used to check the

         Prospects are relevant that the consumer fulfills his obligations
         the credit agreement must be taken into account in an appropriate manner.
         (2) The creditworthiness check is based on necessary,

         sufficient and appropriate information on income, expenses
         and other financial and economic circumstances of the consumer
         to be carried out. The lender has the information from relevant
         internal or external sources, including the consumer.
         ..."












         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2020/04/0031-9
                                                                  February 1, 2024

                                                                  14 of 26




20 § 256 Insolvency Code (IO), Federal Law Gazette No. 337/1914 as amended by Federal Law Gazette I No. 122/2017,

         reads in part:

         “Bankruptcy file
         § 256. (1) Data must be included in the edict file according to this

         Federal law must be made public (insolvency file).
         (2) Access to the insolvency file is no longer permitted if a
         year has passed since

         ...

         4. Expiry of the payment period provided for in the payment plan or

         ...
         (3) At the debtor's request, the insolvency file can already be viewed

         will no longer be granted if the restructuring plan has been legally confirmed
         or payment plan has been fulfilled. The debtor has fulfillment
         to be documented. The court can examine compliance
         Hire an expert to cover the costs of the debtor
         are. The court will make a decision on the inspection that cannot be postponed

         Decision.
         ..."

         Legality of storing data from the insolvency file

         Credit reporting agencies

21 In the present case, the applicant for appeal is requesting the deletion of an entry in the

         With regard to his insolvency proceedings in the database of those involved
         Credit reporting agency after the bankruptcy court in its

         Debt settlement procedure involves the “deletion of entries from the
         Insolvency file” in accordance with Section 256 Paragraph 3 IO. It is therefore necessary to check

         Permissibility of storing this data by the participating party also

         still in the period after the decision of the insolvency court approved it
         Failure to grant access to the insolvency file in accordance with Section 256 Paragraph 3 IO.

22 The ECJ in its judgment of December 7, 2023, C-26/22 and C-64/22,

         SCHUFA Holding (remaining debt discharge), the key questions at hand

         the request for a preliminary ruling from the Wiesbaden Administrative Court
         answered that Art. 5 Para. 1 lit. a GDPR in conjunction with Art. 6 Para. 1 lit. f GDPR

         should be interpreted as belonging to the practice of “private credit reporting agencies”.



         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2020/04/0031-9
                                                         February 1, 2024

                                                         15 of 26





which consists in having one in their own databases
information about the granting of a certificate from the public register

Discharge of residual debt in favor of natural persons for the purpose of delivery
of information about the creditworthiness of these people for a period of time

to store the duration of the data storage in the public register
goes out. He essentially justified this as follows:

“...

74 In the present case, it is clear that the lawfulness of the processing
personal data that is at issue in the main proceedings, solely in
Light of Article 6 paragraph 1 subparagraph. 1 letter f GDPR is to be assessed. After
This provision is for the processing of personal data only

lawful if the processing is carried out to protect legitimate interests
of the person responsible or a third party is necessary, unless the
interests or fundamental rights and freedoms of the data subject
require the protection of personal data, in particular
if the person concerned is a child.

75 The processing of personal data is therefore subject to this
Determination lawful under three cumulative conditions: First
must be from the controller or a third party
a legitimate interest must be perceived; secondly, the

Processing of personal data to achieve this
legitimate interest may be necessary, and thirdly, the interests or
Fundamental rights and freedoms of the person whose data is protected
should not outweigh (judgment of July 4, 2023, Meta Platforms et al.
[General conditions of use of a social network], C-252/21,
EU:C:2023:537, paragraph 106 and the case law cited there).

76 Firstly, what is the requirement for safeguarding a 'legitimate interest'?
concerns, is in the absence of a definition of this term by the GDPR
highlighted, as the Advocate General did in point 61 of his Opinion

has stated that a wide range of interests are fundamentally considered
can be considered justified.
77 Secondly, what is the requirement that the processing is necessary?

personal data to realize the perceived
As far as legitimate interest is concerned, this requires the referring court to do so
check whether the legitimate interest in processing the data is not in
can reasonably be achieved just as effectively by other means,
which have less impact on the fundamental rights and freedoms of those affected
Persons, in particular those guaranteed by Articles 7 and 8 of the Charter

Rights to respect for private life and protection of personal data,



Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
                                                        February 1, 2024

                                                        16 of 26




intervene (judgment of July 4, 2023, Meta Platforms et al. [General

Terms of use of a social network], C-252/21, EU:C:2023:537,
108 and the case law cited there).
78 In this context it should also be noted that the

Requirement of the necessity of data processing together with the
The so-called principle of 'data minimization' must be examined, which is set out in Article 5
Paragraph 1 letter c GDPR is anchored and requires that personal data
Data 'adequate and relevant to the purpose and relevant to the purposes
processing is limited to the extent necessary (judgment of July 4, 2023,
Meta Platforms et al. [General terms and conditions of use of a social

Network], C-252/21, EU:C:2023:537, paragraph 109 and the one cited there
case law).
79 Thirdly, as regards the requirement that the interests or

Fundamental freedoms and rights of the person whose data is protected
should, against the legitimate interest of the person responsible or one
third parties do not predominate, the Court has already decided that these
The prerequisite is a balancing of the respective conflicting factors
Rights and interests that fundamentally depend on the specific
circumstances of the individual case and that it is therefore a matter for the submitter

The court is to weigh this up taking this specific into account
circumstances (judgment of July 4, 2023, Meta Platforms et al.
[General conditions of use of a social network], C-252/21,
EU:C:2023:537, paragraph 110 and the case law cited there).

80 Furthermore, as can be seen from recital 47 of the GDPR
results, the interests and fundamental rights of the data subject are in the interest of the
Those responsible predominate, especially when personal data are involved
Data is processed in situations where a data subject
cannot reasonably expect such processing (judgment of
July 4, 2023, Meta Platforms et al. [General Terms and Conditions of Use a

social network], C-252/21, EU:C:2023:537, paragraph 112).
81 Ultimately, it is for the referring court to decide whether
with regard to the processing of personal data involved in the

The main proceedings concern the three referred to in paragraph 75 of this judgment
requirements are met; the Court may order the national court to do so
however, its request for a preliminary ruling provides relevant information for
give this test (see in this sense judgment of October 20, 2022, Digi,
C-77/21, EU:C:2022:805, paragraph 39 and the case law cited there).

82 In the present case, SCHUFA does one thing with regard to the prosecution
legitimate interest applies that the credit reporting agencies data
processed to assess the creditworthiness of people or companies
are necessary to provide this information to their contractual partners




Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
                                                         February 1, 2024

                                                         17 of 26




to be able to provide. This activity not only protects them

economic interests of the companies that have credit-related contracts
wanted to enter into the determination of creditworthiness and the granting of credit
Credit reports also form a foundation of the credit system and the
functionality of the economy. The activities of credit reporting agencies help
also, the business wishes of those interested in credit-relevant transactions
realize this, as the information allows for a quick and unbureaucratic check

made business possible.
83 In this respect, the processing of personal data serves as that in the
The main proceedings in question do indeed represent the economic interests of the

SCHUFA, but this processing also serves to protect the legitimate interests
Interest of SCHUFA's contractual partners who have credit-relevant contracts
people want to take part in assessing their creditworthiness
people and thus the socio-economic interests of the credit sector.

84 With regard to consumer credit agreements, Article 8 of the
Directive 2008/48, in the light of its 28th recital, highlights that
The lender is obliged to do so before the loan agreement is concluded
creditworthiness of the consumer based on sufficient information,
if necessary, also based on public and private information

Databases to evaluate.
85 Furthermore, in relation to consumer residential property credit agreements
Article 18(1) and Article 21(1) of Directive 2014/17 in conjunction with

Recitals 55 and 59 of this Directive indicate that:
Lenders carry out a thorough check of the consumer's creditworthiness
has to make and has access to credit databases, whereby the query
such databases is a useful element in this examination.

86 It should be added that the obligation to evaluate the
Consumer creditworthiness as defined in Directives 2008/48 and
2014/17 is intended not only to protect the loan applicant, but also
also, as highlighted in recital 26 of Directive 2008/48,
to ensure the smooth functioning of the entire credit system.

87 However, data processing must also be carried out to achieve the
legitimate interests of the controller or a third party
and the interests or fundamental rights and freedoms of those affected
person must not outweigh this interest. At the

appropriate balancing of the respective conflicting rights
and interests, i.e. H. that of the person responsible and those involved
Third parties on the one hand and the data subject on the other hand, as in paragraph 80
of the present judgment, in particular the reasonable expectations
the data subject and the scope of the processing in question and
to take into account their effects on this person (cf. judgment of




Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
                                                        February 1, 2024

                                                        18 of 26




July 4, 2023, Meta Platforms et al. [General Terms and Conditions of Use a

social network], C-252/21, EU:C:2023:537, paragraph 116).
88 Regarding Article 6 Paragraph 1 Subparagraph The Court of Justice has 1 letter f of the GDPR
decided that this provision should be interpreted as meaning that a

Processing only if it is necessary to protect the legitimate interests of the
responsible party or a third party required within the meaning of this regulation
can be considered if this processing is within the limits
what is done to realize this legitimate interest
is absolutely necessary and if it results from a consideration of each other
conflicting interests, taking into account all relevant circumstances

shows that the interests or fundamental rights and freedoms of the
Processing of data subjects against the legitimate interest of the data subject
those responsible or a third party do not prevail (cf. in this sense
Judgments of May 4, 2017, Rīgas satiksme, C-13/16, EU:C:2017:336, paragraph 30,
and dated July 4, 2023, Meta Platforms et al. [Terms and conditions
a social network], C-252/21, EU:C:2023:537, paragraph 126).

89 In this context, the referring court points out
two aspects of the processing at issue in the main proceedings
personal data. Firstly, this processing implies a

diverse storage of data, i.e. H. not just in a public one
Register, but also in the databases of the credit reporting agencies
these companies do not carry out this storage for a specific reason,
but in the event that their contractual partners requested information from them.
Second, these companies stored this data for three years
Basis of rules of conduct within the meaning of Art. 40 GDPR, while the
National legislation for the public register requires a storage period

of just six months.
...

92 With regard to the duration of data storage, it can be assumed that
The examination of the second and third is in paragraph 75 of the present judgment
the above-mentioned requirement overlaps in that the assessment of the
Question whether in the present case the legitimate interests that are related to the

processing of personal data at issue in the main proceedings
cannot reasonably be perceived by a shorter duration of the
Storage of data can be achieved by balancing each other
conflicting rights and interests.

93 When weighing up the legitimate interests pursued, it should be noted that
the analysis of a credit reporting agency insofar as it provides an objective and
reliable assessment of the creditworthiness of potential customers
Contractual partner of the credit reporting agency enables





Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
                                                         February 1, 2024

                                                         19 of 26




Compensate for information differences and thus fraud risks and others

can reduce uncertainties.
94 However, as far as the rights and interests of the data subject are concerned,
represents the processing of data regarding the granting of a discharge of residual debt,

such as storing, analyzing and sharing this data with you
Third parties, through a credit reporting agency, a serious interference in the
Articles 7 and 8 of the Charter represent the fundamental rights of the data subject.
Such data serves as a negative factor when assessing the
Creditworthiness of the person concerned and are therefore sensitive
information about her private life (cf. in this sense judgment of

13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 98).
Their processing may significantly jeopardize the interests of the data subject
harm, as this disclosure is likely to interfere with the exercise of their freedoms
significantly more difficult, especially when it comes to basic needs
cover up.

95 Furthermore, as the Commission has pointed out, the consequences for the
The interests and private life of the person concerned are even greater
Requirements regarding the lawfulness of storing this information
the higher the longer the data in question has been kept by credit reporting agencies

get saved.
96 It should also be noted that the aim of a public
Insolvency register, as can be seen from recital 76 of the

Regulation 2015/848 is to provide better information
affected creditors and courts. In this
In this context, Article 79 (5) of this regulation simply provides that
Member States inform data subjects for what period of time their
personal data stored in insolvency registers are accessible,
without specifying a storage period for this data. On the other hand, it follows from
Article 79(4) of this Regulation states that Member States may, in accordance with this

Article is responsible for collecting data and storing it in national databases.
The period for storing this data must therefore take this into account
regulation to be established.

97 In the present case, the German legislature provides that
Information about the granting of a discharge of residual debts in the insolvency register
is only stored for six months. He therefore assumes that after
After a period of six months, the rights and interests of the
affected person to those of the public about this information
have, predominate.

98 Furthermore, as the Advocate General stated in point 75 of his Opinion
has stated that the granted exemption from residual debts enables the beneficiary to
to participate in economic life again, and therefore has for this person




Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
                                                                  February 1, 2024
                                                                  20 out of 26





         generally existential meaning. The realization of this goal would be
         However, it is at risk if credit reporting agencies are used to assess the
         economic situation of a person, data about a discharge of residual debt
         store and could use such data after it has been removed from the
         public insolvency register has been deleted because this data is with the
         Assessing the creditworthiness of such a person is always a negative factor

         be used.
         99 Under these circumstances, the interests of the credit sector, over

         There is no information regarding a discharge of residual debt
         Processing of personal data such as that in legal disputes
         The main proceedings in question after the expiry of the storage period
         Data in the public insolvency register justify storage
         of this data by a credit reporting agency in relation to the period
         the deletion of this data from a public insolvency register does not apply

         Article 6 paragraph 1 subparagraph 1 letter f GDPR can be supported.
         ...

         106 Finally, the referring court essentially asks which
         Obligations to a credit reporting agency in accordance with Art. 17 GDPR.

         ...

         108 Should the referring court, after its assessment of legality
         the processing at issue in the main proceedings
         personal data comes to the conclusion that this processing
         is therefore not lawful, according to the clear wording of this provision
         the person responsible, in this case SCHUFA, is obliged to do so
         delete the relevant data immediately. This would be as in paragraph 99 of

         found in this judgment when processing the data in question
         personal data that is received after the expiry of the six-month period for the
         The data is stored in the public insolvency register.

         ..."

23 Based on this case law of the ECJ, the legality of the
         Processing of personal data from the insolvency file by the

         co-involved party solely in the light of Article 6 Paragraph 1 Letter f GDPR
         judge. According to this provision, the processing is personal

         Data is lawful under three cumulative conditions: firstly, from
         the controller or a third party

         legitimate interest must be exercised; secondly, the processing must be carried out

         personal data to achieve legitimate interest




         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2020/04/0031-9
                                                                  February 1, 2024

                                                                  21 of 26




         be necessary, and thirdly, the interests and fundamental rights and

         Basic freedoms of the person whose data is to be protected are not
         predominate (ECJ December 7, 2023, C-26/22 and C-64/22, SCHUFA Holding

         [Discharge of residual debt], paragraphs 74 and 75, mwN; see also VwGH October 31, 2023,
         Ro 2020/04/0024, 0025, Rn. 22, mwN).


24 In this case, the party involved makes a claim regarding the prosecution
         legitimate interest claims that they are based on the exercise of the business

         the credit reporting agency has a legitimate interest in the credit information agency in accordance with Section 152 GewO 1994
         Processing of the creditworthiness data of the appeal applicant, in particular

         Information about his past insolvency for the purpose of assessment

         his creditworthiness. This data processing therefore serves
         the economic interests of the party involved. The

         In this context, however, the administrative court also pointed out that
         that the processing of data about insolvencies and payment defaults

         Protection of potential contractual partners of the appeal applicant is achieved. The
         The processing of the insolvency data of the appeal applicant therefore also serves the purpose

         Safeguarding the legitimate interests of the contractual partners involved
         Party that concludes credit-relevant contracts with the appeal applicant

         want to estimate the associated credit risk.

25 The ECJ (C-26/22 and C-64/22, paras. 83 to 86) goes in this

         Connection also depends on the existence of a socio-economic interest
         the credit sector in the processing of creditworthiness data, especially from

         Insolvency data. On the one hand, he refers to Article 8 of the directive

         2008/48/EC, which in the light of recital 28 of this Directive
         With regard to consumer credit agreements, the lender's obligation is clear,

         before concluding the credit agreement, the consumer's creditworthiness
         on the basis of sufficient information, if necessary also on the basis of

         Evaluate information from public and private databases (dem
         corresponds domestically to Section 7 Paragraph 1 of the Consumer Credit Act (VKrG), which means

         Article 8 of Directive 2008/48/EC on consumer credit agreements implemented

         became). On the other hand, the lender has regarding
         Residential real estate loan agreements for consumers in accordance with Article 18, paragraph 1 and




         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2020/04/0031-9
                                                                  February 1, 2024

                                                                  22 of 26




         Article 21(1) of Directive 2014/17 in conjunction with recitals 55 and 59

         This guideline carries out a thorough check of the creditworthiness of the
         Consumer to carry out the query of credit databases

         which the lender has access to, is a useful element in this review
         is (this corresponds domestically to Section 9 Paragraphs 1 and 2 Mortgage and

         Real Estate Loan Act - HIKrG, which means Article 18 Paragraph 1 of the
         Directive 2014/17/EU was implemented). Furthermore, the obligation to

         Assess consumers' creditworthiness as outlined in the guidelines

         2008/48/EC and 2014/17/EU is provided not only for the loan applicant
         but also, as in recital 26 of the directive

         2008/48/EC emphasizes the smooth functioning of the entire system
         Guarantee credit system.


26 The administrative court refers (specifically on the question of storage duration)
         in particular to Regulation (EU) No. 575/2013 of the European Union

         Parliament and of the Council of 26 June 2013 on prudential requirements
         Credit institutions and investment firms and to change the

         Regulation (EU) No. 646/2012 (Capital Adequacy Regulation). This
         The regulation is based on Art. 135 Para. 1, Art. 171 Para. 2 and Art. 180 Para. 1 lit. f

         in conjunction with recital 42, the use of external

         Credit assessments, for example for the assignment of rating levels and
         Risk pools or for estimating the probability of default

         (“PD estimate”), thus for credit risk assessment. It
         It therefore also follows from the Capital Adequacy Ordinance that

         Processing of insolvency data from (potential) borrowers
         socio-economic interest of the credit sector in evaluating the

         Creditworthiness of the contractual partners of the party involved with the
         Applicants for an audit want to conclude credit-relevant contracts.


27 Finally, the analysis of a credit reporting agency, such as the one involved
         party, insofar as it provides an objective and reliable assessment of the

         creditworthiness of potential customers of their contractual partners,

         Compensate for information differences and thus fraud risks and others
         Reduce uncertainties (cf. ECJ C-26/22 and C-64/22, para. 93).




         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2020/04/0031-9
                                                                   February 1, 2024

                                                                   23 of 26




28 In this respect, there is a legitimate interest within the meaning of Art. 6 Para. 1 lit. f GDPR

          the processing of the appeal applicant's data
          Debt settlement procedures.


29 In contrast, the processing of this data, in particular with regard to
          the fulfillment of the legally confirmed payment plan, such as

          Storage, analysis and transfer of this data to a third party by the

          The party involved is a serious encroachment on the rights set out in Articles 7 and 8 GRC
          enshrined fundamental rights of the appeal applicant. Since such data as

          negative factor in assessing the creditworthiness of the
          To serve the appeal applicant, they provide sensitive information about it

          Private life. Your processing may be in the interests of the appeal applicant
          considerable harm because the disclosure is likely to jeopardize the exercise of his rights

          to make freedoms considerably more difficult, especially when it comes to

          to cover basic needs. The consequences for interests and private life
          of the appeal applicant are even greater and the requirements placed on them

          The lawfulness of storing this information therefore increases, the higher
          longer this data is stored by the participating party

          (see ECJ C-26/22 and C-64/22, paras. 94, 95).

30 Aim of a public insolvency register, such as the insolvency file

          § 256 IO is to ensure better information for those affected

          Creditors and courts (cf. ECJ C-26/22 and C-64/22, para. 96, as well
          domestically the explanations for

          Insolvency Law Amendment Act 1997 - IRÄG 1997 in RV 734 BlgNR
          20 GP, 34, 63).


31 According to Section 256 Paragraph 2 Item 4 IO, the insolvency file can no longer be viewed
          grant if since the expiry of the period provided for in the payment plan

          One year has passed for the payment deadline. Inspection is possible at the request of the debtor
          in the insolvency file can no longer be granted if the

          legally confirmed payment plan has been fulfilled (Section 256 Para. 3 IO).

          The latter option serves to avoid disadvantages for the debtor
          Business transactions (see the explanations for




          Administrative Court

          Judenplatz 11, 1010 Vienna
          www.vwgh.gv.at Ro 2020/04/0031-9
                                                                  February 1, 2024

                                                                  24 out of 26




         Insolvency Law Amendment Act 2010 -IRÄG 2010 RV 612 BlgNR 24. GP 3,

         35).

32 The legislature therefore assumes that with the fulfillment of the

         legally confirmed payment plan, but at the latest upon expiry of a deadline
         of one year since the expiry of the payment period provided for in the payment plan

         the rights and interests of the data subject, as in this case
         The appeal applicant, those of the public, have access to this information

         have, predominate (cf. RV 734 BlgNR 20. GP, 63). After all, that's the goal
         of the payment plan, the economic recovery of the debtor

         (cf. OGH August 18, 2010, 8 Ob 146/09t). In this sense, a “deletion” should occur

         the insolvency file is impaired as a result of fulfilling the payment plan
         of the debtor in business transactions through public announcement of a

         Avoid previous insolvency proceedings (see explanations in
         RV 612 BlgNR 24. GP, 3, 35).


33 However, the realization of this goal would be jeopardized if those involved
         Party as a credit reporting agency to assess the economic situation of the

         Store the appeal applicant's data about his insolvency proceedings and such
         Data could be used after viewing the insolvency file

         § 256 paragraph 2 and paragraph 3 IO can no longer be granted because this data is included
         the assessment of the creditworthiness of the audit applicant is always negative

         factor can be used. Under these circumstances, those entitled to
         Interests of the credit sector, about information regarding the fulfillment

         the legally confirmed payment plan ended the insolvency proceedings

         of the appeal applicant to order the processing of this previously in the
         Personal data can no longer be publicly viewed in the insolvency file

         justify. The storage of this data by the participating party
         Reference to the period after the decision of the

         Insolvency court about the “deletion of the entries from the
         Insolvency file” in accordance with Section 256 Paragraph 3 IO cannot therefore be based on Art. 6

         Paragraph 1 lit. f GDPR is supported. The storage of the

         data relating to the debt settlement procedure of the appeal applicant
         the insolvency file by the party involved about the time of




         Administrative Court
         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2020/04/0031-9
                                                                 February 1, 2024

                                                                 25 out of 26




         The decision of the insolvency court has legal force in accordance with Section 256 (3) IO

         This proves to be contrary to the legal opinion of the authority concerned and the
         Administrative court - as not legal (cf. again ECJ C-26/22 and

         C-64/22, paragraphs 98 and 99).

         Request for deletion according to Art. 17 GDPR


34 Due to the lack of lawfulness of the processing from the insolvency file
         deleted data of the appeal applicant regarding his insolvency proceedings

         The party involved is obliged to provide the relevant data immediately

         to be deleted in accordance with Art. 17 Para. 1 lit. d GDPR (cf. again ECJ C-26/22
         and C-64/22, paragraph 108).

35 In contrast to this, in the VwGH decision May 9, 2023, Ro 2020/04/0037,

         that asserted by the appeal applicant against a credit institution

         Right to deletion in accordance with Art. 17 GDPR in relation to you
         relevant entry of payment experience data in a jointly with

         database operated by other credit institutions (bank warning list).
         This entry did not concern the processing of personal data

         Applicant from the insolvency file. Rather, they were in the

         Payment history data of the audit applicant stored on the bank warning list
         by the credit institution in connection with the existing one

         Current account details of the appeal applicant are collected
         (see VwGH Ro 2020/04/0037, paragraph 57, last sentence). So much for this one

         Knowledge taking into account the Capital Adequacy Ordinance
         Storage period of at least five years in relation to the storage of

         Payment experience data in the bank warning list is generally considered legitimate

         was considered, it should be noted that the Capital Adequacy Ordinance
         in accordance with Article 1, the general supervisory requirements for

         Credit institutions regulate specific areas and are therefore not applicable
         Credit reporting agencies, such as the party involved in this case, apply.


         Result

36 In this respect, the administrative court is of the legality of storing the data

         Insolvency data relating to the appeal applicant is provided by the co-participant


         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at Ro 2020/04/0031-9
                                                                 February 1, 2024

                                                                 26 of 26




         Credit reporting agency in accordance with Article 6 Paragraph 1 Letter f of the GDPR and that from

         If the right to deletion asserted by the appeal applicant is denied, it has that
         contested finding is burdened with illegality of the content. The

         The contested finding therefore had to be repealed in accordance with Section 42 Paragraph 2 Z 1 VwGG.

37 From the conduct of the requested hearing before

         The Administrative Court was able to distance itself in accordance with Section 39 Para. 2 Z 6 VwGG

         be taken because the present case does not involve questions of
         assessment of evidence or disputed findings of fact, but in the

         Revision legal questions were raised that were not complex in nature
         have, especially since the central legal question already refers to the case law of the ECJ

         could be referred (see VwGH August 3, 2023, Ro 2020/04/0035,
         Rn. 35, mwN), and to solve them in the sense of the judicature of the ECHR

         an oral hearing is not required (cf. VwGH May 9, 2023,

         Ro 2020/04/0037, Rn. 81, mwN).

38 The decision on reimbursement of expenses is based on Sections 47 ff VwGG

         in particular Section 1 Paragraph 1 Letter a VwGH Expense Reimbursement Ordinance, according to which
         the flat rate amount for the filing costs for the submission of the

         Revision contrary to the recorded flat rate of € 2,180.-- only
         € 1,106.40. Sales tax is not separate according to Section 47 Paragraph 1 VwGG

         to be awarded because this is already included in the flat-rate written expenses

         is included (see on the latter VwGH April 10, 2020, Ra 2018/04/0154 to 0155,
         34).

         Vienna, February 1, 2024

















         Administrative Court

         Judenplatz 11, 1010 Vienna
         www.vwgh.gv.at