BVwG - W214 2216836-1
| BVwG - W214 2216836-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 4(1) GDPR Article 4(2) GDPR Article 5 GDPR Article 6(1)(f) GDPR Article 17 GDPR § 152 GewO |
| Decided: | 24.03.2021 |
| Published: | |
| Parties: | |
| National Case Number/Name: | W214 2216836-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2021:W214.2216836.1.00 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (RIS) (in German) |
| Initial Contributor: | n/a |
The Austrian Federal Administrative Court (BVwG) stated that frequent change of address has a negative impact on creditworthiness and that credit scoring companies may therefore process data concerning a person's former addresses. The court reaffirmed established standards of processing data for credit scoring purposes in light of Article 6(f) of the GDPR.
English Summary
Facts
The controller is a credit scoring agency with a trade license according to § 152 of the Austrian Trade Regulation Act (GewO). It used, inter alia, two receivables against the data subject and various former addresses (8 moves in 11 years) in its file on the basis of which his creditworthiness was assessed.
The receivables amounted to mid-double-digit amounts. They arose between 2016 and 2017. The data subject was in a so-called continued qualified default of payment with regard to both receivables. This means that there was a delay in payment, the first two reminders by the creditor and also a third reminder by a collection agency had been unsuccessful. In 2018, the data subject paid the receivables. The controller then entered a "positively settled" note for each of the receivables in its data system.
The controller rejected the data subject’s request to delete the two receivables as well as all his former addresses. Subsequently, the data subject filed a complaint before the Austrian DPA (DSB). The DSB decided that the right to be forgotten was infringed since the controller did not follow the request.
The controller has filed an administrative appeal against this decision.
Holding
The Austrian Federal Administrative Court (BVwG) ruled that the data subject was not entitled to deletion. Such a right does not arise from Article 17(1)(a), (c) or (d) GDPR.
In particular, this was justified by the fact that the processing operations at issue were in compliance with the principles of Article 5 GDPR and that they could be based on the legal basis of Article 6(1)(f) GDPR.
Financial Defaults
Compliance with Article 5 GDPR
The BVwG ruled that the principle of process limitation was respected. The assessment of creditworthiness by credit agencies is a defined and clear purpose recognised by the legal system. This can be derived from § 152 GewO. The data were also accurate and complete because the controller entered a “positively settled” remark after the two claims have been paid. They were also fundamentally necessary and suitable in order to be able to make a prognosis about the future payment behaviour of the data subject.
The court focused on the issues “storage limitation” and “data minimization” and decided that those principles were followed as well. It ruled that data on financial defaults can be processed for up to 5 years according to existing case law. This was derived as follows:
There are no concrete deadlines in the GDPR or in § 152 GewO on the permissible duration of processing. A case-by-case decision is necessary. However, the court sets some standards. First of all, it clarifies that the respective data becomes less relevant the older it gets. The minimum period of five years is taken by the court in particular from Regulation (EU) No 575/2013 (Capital Requirements Regulation). According to this, credit institutions are obliged to carry out various risk assessments in relation to their clients. Thereby, they are obliged to refer to a period of at least five years. The court also took the seriousness of the infringement into account.
Lawfulness According to Article 6(f) GDPR
The court ruled that interests especially of the controller's customers as third parties within the meaning of Article 6(1)(f) outweigh the interests of the data subject. The controller and their customers have a legitimate interest in assessing the credit risk of credit-receiving contractual partner. In addition, compliance with the obligation of credit institutions under the Capital Requirements Regulation is supported.
The data subject has an interest in not suffering any economic disadvantages
The third party interests prevail in the specific case. The court considered the following aspects in its decision:
- Payment history is essential for credit risk assessment.
- The Capital Requirements Regulation shows that the EU legislator considers a minimum observation period of five years to be necessary to assess the risk of receivables.
- In addition to the time when the claim arose, an important factor is how long ago the claim was settled.
- The amount of the receivables.
- The qualification and the duration of the financial default.
In the specific case, the amount of the claim was relatively small, but the claims were settled only after a very long time, there was a continued qualified delay in payment and the payment was made only 2.5 years ago.
The court ultimately held that recourse to Article 6(f) GDPR was not barred because of § 256 of the Austrian Insolvency Code (InsO). The permissibility of maintaining the insolvency file under data protection law is based on § 256 InsO, a legal obligation within the meaning of Article 6 (1) (c) of the Regulation, whereas the permissibility of maintaining a creditworthiness database is based on overriding legitimate interests of the controller pursuant to Article 6(1)(f) GDPR. However, it cannot be derived from § 256 InsO that data on insolvencies may no longer be processed (at all), i.e. on the basis of other grounds for permission under Article 6 GDPR, if they have been deleted from the insolvency file or have not been entered at all. Such a restriction would contradict EU secondary law - at least with regard to the relevant authorisation under Article 6(1)(f) of the GDPR.
Appeal Admissible
The court allowed an appeal regarding the aforementioned aspect. In principle, a non-reversible individual decision had been made on the processing duration with regard to financial data. However, there was no case law from the highest court on the principles that such a weighing of interests must satisfy. It is also unclear whether the Capital Adequacy Regulation can be used as a guideline.
Former Data Protection Commission Notices are Invalid
The controller also referred to notices issued by the Austrian data protection commission competent before the GDPR became effective. In these notices, certain data applications, in particular for credit agencies, had been "approved" subject to certain deletion periods. The court clarified that these decisions had become invalid due to the GDPR. In particular, they were not authorisations within the meaning of recital 171 of the GDPR.
Duty to Retain is not an Aspect to be Considered
The controller had also pointed out that it had a duty to retain data for 7 years under Austrian trade law. The court stated that this was the case and that this authorised the data controller to store the data. However, the court made it clear that this did not necessarily mean that the data could be used to provide information to third parties for the purpose of credit reporting. Rather, a new weighing of interests is required in each individual case.
Former Residential Addresses
The court concluded by briefly stating that the processing of the old addresses is also lawful. In this regard, it referred primarily to the previous statements on Articles 5 and 6(1)(f) GDPR. In addition, it also determined that a statistical correlation exists between historical reporting addresses and a subject’s ability to pay. In this respect, a frequent change of residence is an indication of nomadic tenants. With 8 places of residence in 11 years, the court considered these conditions to be fulfilled.
Comment
It is exceedingly questionable that there is a provable correlation between the frequency of moves and creditworthiness. In any case, the court should not have simply asserted this, but should have obtained an expert opinion.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
