BVwG - W274 2242363-1/4E
From GDPRhub
| BVwG - W274 2242363-1/4E | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 5 GDPR Article 6(1)(f) GDPR Article 17 GDPR § 152 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO) |
| Decided: | 26.08.2021 |
| Published: | 06.10.2021 |
| Parties: | 1) unknown data subject (complainant before the DSB) 2) unknown Austrian credit reference agency (respondent before the DSB) 3) DSB |
| National Case Number/Name: | W274 2242363-1/4E |
| European Case Law Identifier: | ECLI:AT:BVWG:2021:W274.2242363.1.00 |
| Appeal from: | DSB D124.3034 |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (RIS) (in German) |
| Initial Contributor: | n/a |
The Austrian Federal Administrative Court held that a credit reference agency cannot base the processing of negative payment experience data on a data subject on Article 6(1)(f) GDPR if the underlying debt is insignificant (in this case EUR 38,83).
English Summary
Facts
A data subject requested erasure of a negative database entry from the database of an Austrian credit reference agency under Article 17 GDPR. The debt underlying the entry was EUR 38,83 and had been paid back in full only 17 days after a debt collection agency started to collect it from the data subject. Nevertheless, the credit reference agency refused to erase the data and the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde - DSB).
The DSB upheld the data subject's complaint and ordered the credit reference agency to erase the data within two weeks. It held, that the data subject's interests outweigh those of the controller the in light of the insignificant amount of the debt and it's relatively quick payback.
The credit reference agency filed an appeal against the DSB's decision with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG).
Holding
The BVwG rejected the appeal and upheld the DSB's decision. In its reasoning it followed the DSB's assessment regarding legitimate interests. It further held, that the BVwG's case law on a five year storage period of payment experience data (in light of Regulation (EU) 575/2013) cannot be applied on the case at hand: these BVwG decisions dealt with data processing regarding significantly higher debt amounts and/or cases where there were multiple negative payment experience data in the credit reference agency's database.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
court
Federal Administrative Court
Decision date
08/26/2021
Business number
W274 2242363-1
Saying
W274 2242363-1 / 4E
IN THE NAME OF THE REPUBLIC!
The Federal Administrative Court recognizes through the judge Mag. Lughofer as chairman as well as the expert lay judges Prof. KommR POLLIRER and Dr. GOGOLA as observer on the complaint of XXXX against the decision of the data protection authority, Barichgasse 40-42, 1030 Vienna, from March 31, 2021, GZ D124.3034 2021-0.170.953, Participants XXXX, due to violation of the right to secrecy and the right to Deletion, rightly in a non-public session:
The complaint will not be followed.
The revision is permissible according to Art. 133 Para. 4 B-VG.
text
Reasons for the decision:
With a complaint using a form from the data protection authority (hereinafter referred to as the authority concerned) dated September 24, 2020, XXXX (hereinafter: co-participants, MB) turned to XXXX as the current complainant (hereinafter: BF) and considered its right to secrecy hurt. Despite the relevant announcement, the BF did not delete the data in the MB.
After an improvement order, the MB asserted a violation of the right to erasure and stated that positive payment experience data were more than seven years ago, an entry was only three years ago, but was also positively completed and it was an amount of only € 38, -.
Attached was, among other things, a letter from the BF dated September 22nd, 2020, which refers to a request for information from the MB on the same day and stated that there were no indications of any incorrect entries regarding the MB at the BF, so that no deletion or correction should be made have.
On January 26th, 2021, the BF stated that it had the trade license according to Section 152 of the Trade Regulations as a credit agency. The legal basis of data protection law for processing personal data relevant to creditworthiness in the XXXX database is said to be legitimate interests according to Art. 6 Para. 1 lit. f GDPR. The legal interests exist on the part of third parties, since the purpose of data processing by BF is to enable access to the data for those companies that took on a credit risk in the course of their economic activity, for example when delivering their goods or services. In particular for companies that make advance payments to their contractual partners, it is essential to be able to assess the payment behavior of their potential contractual partners. Queries in the BF database are an essential means of obtaining this information. The lawfulness of the processing therefore does not depend on the consent of a data subject. BF receives information about negative payment experiences if there is a delay in payment, the first two reminders by the creditor and also the third reminder from a debt collection agency are unsuccessful and there is therefore a persistent, qualified payment delay. Claims that have already been settled (positively settled) represent creditworthiness-relevant data. The fact that a claim is only settled after a qualified reminder or debt collection agency or lawyer means an at least temporary payment default and thus results in a credit risk with regard to future legal transactions.
With reference to several findings of the Federal Administrative Court, the BF stated that the processing of the payment experiences in question within a five-year minimum storage period from the settlement of the claim was necessary and sensible. Although the amount of the older payment experience in question is to be regarded as high, the MB's application is complied with in view of the length of time it has now passed, the low number of payment experiences and, in particular, the fact that no further entries have been made since their expiry and the older payment experience is deleted according to the information from January 21, 2021. The remaining recent payment experience lies within the five-year minimum observation period, so that it has to remain in the BF database.
Information from January 21, 2021 was submitted from which the following payment experience data result:
"Opened: May 30th, 2017
Closed: June 16, 2017
Capital claim € 38.83
open: 0 €
Claim status: out-of-court enforcement
Payment status: positively done
Origin of the information: T-Mobile Austria GmbH "
The MB was brought to the attention of the MB by way of the hearing of the parties, so that it could comment. No further statement was made.
With the decision contested only with regard to its admissible (point 2) part, the authority in question rejected the complaint with regard to the alleged breach of the right to secrecy (ruling point 1.), granted it with regard to the alleged breach of the right to deletion and stated that the respondent there violated the complainant's right to cancellation by failing to delete the claim of € 38.83 already settled on 16.06.2017 from her creditworthiness database (ruling point 2.) and instructed the respondent at the time to delete the specified data within two weeks (point 3 of the ruling).
The authority concerned established the following facts:
“According to § 152 GewO 1994, the respondent operates a business as a credit agency.
The complainant turned to the respondent on September 22, 2020 with a request for deletion.
The Respondent informed the Complainant in a letter dated September 23, 2020 that it would not comply with the request for deletion.
The complainant then lodged a complaint with the data protection authority on September 24, 2020, alleging that the respondent had violated her right to secrecy and her right to erasure.
As of January 21, 2021, the Respondent processes the following payment experience date as well as the following address data on the Complainant:
Opened
Closed
Capital claim
Open minded
Claim status
Payment status
Origin of the information
05/30/2017
06/16/2017
€ 38.83
0.00 €
out of court.
Operation
positively done
T-Mobile Austria GmbH
Surname
Date of birth
Street
Postcode
location
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
Legally, the authority in question concluded that the processing of creditworthiness-relevant data by a business or credit information agency is covered by Section 152 of the Trade Regulations. As before, the Data Protection Commission and the Supreme Court also recognize the data protection authority that the activities of business and credit information agencies can in principle be based on Article 6 (1) (f) GDPR. In the absence of specific data protection regulations, the general principles of the GDPR should be applied (Art. 5 Para. 1 lit. b and lit. e GDPR). Since the BF is fundamentally entitled to process the MB's data, the complaint based on Section 24 (5) DSG should be rejected. With regard to the also asserted right to erasure, the question arises of how long payment experience data can be stored after the claim has been settled before it is no longer necessary for the purposes of processing and creditor protection. In accordance with its own case law, the data protection authority undertakes and assessed a case-by-case examination, taking into account the amount of the individual claims, the age of the claims, the number of claims collected by a debt collection company, the time that has passed since a claim was settled and the origin of the data based on this, the admissibility of the processing. Since only a positive payment experience date in the amount of EUR 38.83, which was opened on May 30, 2017 and closed on June 16, 2017, the interests of MB outweigh the very low amount and the age of the claim.
The BF's complaint "because of illegality" is directed against only points 2 and 3, with the primary request to amend the decision in points 2 and 3 so that the complaint is rejected in its entirety. Alternatively, an application for annulment is made.
The authority in question submitted the complaint, including the electronic file, to the Federal Administrative Court on May 12, 2021.
The complaint is not justified:
The administrative court also bases its decision on the - undisputed - facts already established by the authority concerned.
From this it follows legally:
The only thing to be assessed is the legality of the storage of the single payment experience date relating to the MB.
For the first time, the BVwG dealt with the question of how long it can be lawful to store data on redeemed claims through a credit report, also taking into account the processing principles according to Art. "Data minimization", "correctness" and "memory limitation". It was initially based on the assumption that, in the absence of specific deadlines according to the GDPR or the GewO, the permissible storage period depends on the individual case, but such payment information for future payment behavior is less meaningful the longer it was back and the longer there were no further payment stoppages or Payment defaults had come ("age of the claim" and "good behavior since then"). In addition, the BVwG looked for observation and deletion periods as a guideline for the permissible storage period in legal provisions that served to protect creditors. As such a provision, the BVwG used the EU regulation “Capital Adequacy Regulation”, which obliges credit institutions to evaluate their customers and assess various risks of their claims. In doing so, credit institutions would have to use a historical observation period for at least one data source of at least five years for credit and retail receivables vis-à-vis natural persons. If, however, credit institutions, as potential business partners of the person concerned, are legally obliged to evaluate their claims based on the default rates of at least the last five years, then it is - according to the knowledge - not a violation of the principle of data minimization and storage limitation if data on claims that have temporarily or completely failed within this period, are processed by a credit bureau.
The aforementioned case law is therefore based on the processing principles of data minimization and storage limitation.
The findings of the BVwG since then also related to this finding, such as W274 2232028 of October 21, 2020 and W214 2216836 of March 24, 2021.
The BF also refers to the aforementioned judgments and apparently deduces from this that payment experience data relating to payment defaults are in any case relevant for a period of at least five years and thus justify data storage within the framework of the credit reporting agency. As a result, the BF believes that the authority in question misunderstands the aforementioned case law on the lawfulness of processing for at least five years. In addition, the decision does not reveal what the predominant interests of the MB are. From the recent finding W214 2216836 from March 24th, 2021 it would emerge that this relates to claims from the years 2016 and 2017, whereby the present claim also results from the year 2017.
To do this, the following is to be carried out:
In fact, the aforementioned knowledge was based on three claims, one from 2016 for € 34.20, positively completed in August 2018, one from June 2017 for € 47.47, positively completed in May 2018 and one from May 2019 for € 218.27, fully booked as uncollectible. In addition, it was established in the proceedings there that the person concerned had made a reported change of residence at least eight times since he came of age in 2008.
If the BF refers to the fact that it was stated in the above finding that even the relatively small amount of the receivables paid could not change anything in the fact that the observation of historical payment behavior was to be assessed on the basis of an observation period of at least five years, the BF withholds the further argument in the cited knowledge (there 3.2.2) that the interests of the persons concerned do not prevail if claims like here from 2016 and 2017 were only settled positively after a long period of time (2018) and there was even a continued qualified default in payment.
Based on the individual case assessment based on previous case law under the criteria "amount", "age" and "number" of claims as well as the time that has elapsed since settlement is an underlying individual claim for a small amount of € 38.83 over a period of a good two weeks compared to two, albeit minor, claims over a period of just under two years or just under a year, a significant difference with regard to the "good behavior" of the person concerned at the time. In addition, in the referenced procedure there is another, even more recent, uncollectible claim that was also taken into account in the weighing of interests (page 24 there). In this respect, nothing decisive can be gained from the reasoning with reference to W214 2216836 for the present procedure for the BF.
Regarding W258 2216873, the Federal Administrative Court assumed that a payment plan had only been fulfilled at the time of the request for cancellation one and a half years ago or at the time of the decision about three years ago; this also applies to claims that were already in default more than five years ago but were only finally repaid by the fulfillment of the payment plan, as was the case there one and a half or three years ago. The state of affairs there is also not comparable with the actual state of affairs - in particular with regard to the period of good conduct.
The same applies to the finding W274 2232028, which was based on five entries relating to payment experience data for a total of € 3,147.52. The repayment periods there comprised five years, just under four years, two years, one year, two months and one month, respectively, whereby the most recently settled claim was only settled positively in March 2019. The situation there is therefore also not comparable with the one to be assessed here.
If the BF assumes that the "opening" of a claim and the notification of the same to the BF by a debt collection agency will only take place after the person concerned has received three unsuccessful reminders and therefore continued, qualified default in payment has occurred, so that the date of the opening of the claim is therefore for usually months after the due date of the claim, nothing can be gained from it for BF because it is undisputedly assumed by BF itself that a justification for the storage is only given in the event of continued qualified default in payment.
The BF also argues with reference to Art. 5 Paragraph 1 lit. The BF would thus withhold from its customers the payment experience that matters in the credit rating.
The BF is to be followed in this respect insofar as an inaccuracy with regard to the processing purposes could also result from an incompleteness of the data, in particular if, within the scope of the processing purpose, a decision with regard to the person concerned on the basis of the available data would turn out significantly different than including the missing information (Hötzendorfer / Kastelitz in Knyrim, DatKomm, Art. 5 GDPR margin no. 45). On the other hand, the verification of compliance with the principle of storage limitation (Art. 5 Para. 1 lit. e) is usually to be carried out on the basis of a case-by-case assessment, in which the necessity of storing data is assessed on the basis of the processing purposes. Those circumstances that have to be assessed for the assessment of the correctness of the data in terms of data completeness are therefore also relevant for the individual consideration of the storage limitation. The question of the storage duration of data from a credit agency is not determined by law. So far, the case law has been based on an observation period of at least five years with reference to the chain of arguments derived from the Capital Adequacy Ordinance, but by no means rigidly presupposes such a period.
As explained, this is based on only one claim (in the last 6 years), the amount being classified as a minor claim, which was also corrected within a period of a good two weeks. The risk of "enormous damage from potentially occurring payment defaults" with reference to the MB is by no means necessarily inferred from this, as the BF claims in the complaint. A consideration of individual cases, which could justify the admissibility of storage with regard to the principle of storage limitation, also presupposes that a decision by potential creditors with regard to the person concerned on the basis of this data would turn out significantly different than if the missing information was included. In the opinion of the court, this is to be denied in the negative with regard to the number of claims, the amount and the rapid repayment. The principle of the correctness of the data does not prevent deletion.
In this regard, due to comparable interests, reference can also be made to the regime of the Criminal Records Act and the Deletion Act, according to which, in accordance with Section 12 of the Criminal Records Act, the deleted conviction and data relating to the convicted must be deleted from the criminal register two years after the deletion has commenced. According to Section 3 (1) no.1 Repayment Act, the repayment period is three years for a single conviction, e.g. for juvenile offenses, and five years for a maximum imprisonment sentence of one year or a sentence of only one fine.
In this respect, even the criminal law regime accepts an "inaccuracy" in the sense of incompleteness of the criminal record information or criminal record certificate, as actual convictions no longer appear there after a certain period of time.
In view of the barely comparable scope of a one-time, qualified outstanding claim of € 38.00 for a good two weeks and a "conduct of business" period of almost three years since the complaint was filed, the complaint does not show that the deletion obligation accepted by the authority in question would have been wrongly done in individual cases. The complaint is therefore unsuccessful.
Due to the undisputed facts and the legal issues that had to be resolved alone, there was no reason to hold an oral hearing. No such request was made either.
The ruling that the appeal is admissible is based on the fact that there has been no case law of the Administrative Court on the question of the permissible storage duration of creditworthiness-relevant data.
European Case Law Identifier
ECLI: AT: BVWG: 2021: W274.2242363.1.00
