VwGH - Ro 2020/04/0031-9
VwGH - Ro 2020/04/0031-9 | |
---|---|
Court: | VwGH (Austria) |
Jurisdiction: | Austria |
Relevant Law: | Article 6(1)(f) GDPR Article 17 GDPR Article 7 CFR Article 8 CFR |
Decided: | 01.02.2024 |
Published: | |
Parties: | Austrian Data Protection Authority K GmbH |
National Case Number/Name: | Ro 2020/04/0031-9 |
European Case Law Identifier: | ECLI:AT:VWGH:2024:RO2020040031.J00 |
Appeal from: | BVwG (Austria) W211 2225136-1/6E |
Appeal to: | Unknown |
Original Language(s): | German |
Original Source: | RIS (in German) |
Initial Contributor: | ec |
The Supreme Administrative Court found that a credit ranking agency cannot store data originally collected from an insolvency registry after a judicial decision ordered the erasure of the data from the latter.
English Summary
Facts
In 2010, debt settlement proceedings were issued against the data subject. The data subject settled the payments of their debts in March 2018. After settling the debts, the civil court ordered to make the personal data of the data subject unavailable to the public in the public insolvency register.
The controller, a credit ranking agency, continued to process and store personal data of the data subject that related to his debt settlement procedure that the controller obtained from the public insolvency register. The purpose of the procesing was to assess the creditworthiness of the data subject and his company. The data subject was the company's sole shareholder.
The data subject requested the erasure of his personal data on 4 May 2018, after fulfilling his debt payment plan. The controller did not reply. On 24 October 2018, the data subject lodged a complaint at the Austrian DPA against the controller for the infringement of the right to erasure under Article 17 GDPR.
The controller informed the DPA by letter the same day that it would not comply with this request.
The DPA dismissed the data protection complaint. The decision does not give detail on why the complaint was dismissed.
The data subject appealed this decision at the Federal Administrative Court (Bundesverwaltungsgericht, BVwG).
The court dismissed the appeal. The court found that the controller’s processing the personal data in question was necessary, as the purpose of the processing was for making a forecast about the future payment behaviour of the data subject. The court found that the interests of the controller and its third parties outweighed the interests of the data subject The court concluded that the processing of data on historical insolvencies and payment defaults of the data subject was necessary and lawful and that the objections raised by the data subject could not justify his request for erasure.
The data subject appealed to the decision before the Austrian Supreme Administrative Court (Verwaltungsgerichtshof, VWGH).
The Austrian Supreme Administrative Court held off its judgement until the CJEU issued its decision on C-26/22 and C-64/22 – Schufa.
Holding
The Supreme Administrative Court ruled on two questions. Firstly, it examined the legality of the storage of data collected from the insolvency registry by the controller.
Previous Austrian jurisprudence stated that credit agencies could collect and process personal data collected through the public insolvency register up to 5 years after deletion of the data concerned in the registry. However, the recent CJEU C-26/22 and C-64/22 – Schufa case stated that the lawfulness of the processing by the controller must be assessed solely in light of Article 6(1)(f) GDPR. In particular, the CJEU also ruled that credit agencies cannot process data they collected from the insolvency register once that data has been deleted from the registry itself (see CJEU C-26/22 and C-64/22 – Schufa para 99). The CJEU noted that in Germany the data in the insolvency register is only kept for up to 6 months and therefore, after the expiry of a six-month period, the rights and interests of the data subject take precedence over those of the public to have access to that information.
In light of the CJEU C-26/22 and C-64/22 – Schufa case, the Supreme Administrative Court found that the processing of this data, including the storage, analysis and disclosure of this data to a third party by the controller, constitutes a serious interference with the fundamental rights of the data subject under Article 7 CFR and Article 8 CFR. The processing of such data can significantly harm the interests of the data subject because the disclosure is likely to make it considerably more difficult for him to exercise his freedoms. The Court stated that the objective of a payment plan is the economic recovery of the data subject. The request to erasure of personal data due to fulfilling the payment plan is intended to prevent the data subject from being impaired in business dealings by the public announcement of earlier insolvency proceedings. Therefore, the data subject’s economic recovery is jeopardised if a credit agency, thus the controller in this case, stores data on the data subject’s insolvency proceedings in order to assess the data subject’s creditworthiness, as this data is always used as a negative factor in the assessment. In light of this, the legitimate interests of the controller to process data regarding the insolvency proceedings of the data subject can no longer justify the processing of these personal data after this data in the insolvency register is made unavailable for the public .
The storage of this data by the controller after the decision of the insolvency court to remove the data from the public register can therefore not be based on Article 6(1)(f) GDPR. Thus, it is unlawful for the controller to store and process data relating to the insolvency proceedings of the data subject from the public insolvency register once the data is not available anymore in the register, contrary to the decision of the DPA and the administrative court.
Secondly, the Court examined the request for erasure in accordance with Article 17 GDPR. The Court ruled that due to the absence of lawful processing of the data subject’s data from the insolvency proceedings, the controller is obliged to erase the data concerned immediately under Article 17(1)(d) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Ro 2020/04/0031-9 February 1, 2024 I M N A M E N D E R R E P U B L I K! The Administrative Court has through the presiding Senate President Dr. Kleiser, Councilor Dr. Mayr, court councilor Mag. Hainz-Sator and the court councilors Dr. Pürgy and Mag. Brandl as judges, with the participation of the secretary Löffler, LL.M., on the revision of the A G in W, represented by the Brand Rechtsanwälte GmbH in 1020 Vienna, Schüttelstraße 55, Carré Rotunde, against the decision of the Federal Administrative Court of July 28, 2020, Zl. W211 2225136-1/6E, concerning a data protection matter (authority concerned before the administrative court: data protection authority; Co-involved party: K GmbH, represented by BLS Rechtsanwälte GmbH in 1010 Vienna, Kärntner Straße 10; other party: Federal Minister of Justice), rightly recognized: The contested finding is due to illegality of the content lifted. The federal government has incurred expenses of €1,346.40 for the appeal applicant to be replaced within two weeks if otherwise executed. The additional request is rejected. Reasons for the decision: 1 The appellant's assets were reported in 2010 Debt settlement proceedings before District Court D (Insolvency Court) opened and the repayment rate set in 2012 in mid-March 2018 Fulfills. The insolvency court approved this procedure Resolution of May 4, 2018, the “deletion” requested by the appeal applicant the entries from the insolvency file” in accordance with Section 256 Paragraph 3 IO due to the Proof of fulfillment of the payment plan by the appeal applicant. 2 The participating party operates, among other things, the business of Credit information agency in accordance with Section 152 of the 1994 Trade Code (GewO 1994) and stored, among other things, the following excerpts from the data Applicant in relation to his debt settlement procedure in the personal credit profile of the audit applicant, as well as in the Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 2 of 26 Credit profile of XY GmbH, whose sole shareholder is The applicant for appeal is, under the heading “Insolvency”: “Current status of the proceedings since 2018-04-01”; “Procedural status: payment plan was settled directly by the debtor”, “Liabilities according to the insolvency application [EUR] 167,596.54”. 3 On October 24, 2018, the applicant filed an appeal against the party involved data protection complaint filed by the party as the respondent Violation of the right to deletion in accordance with Art. 17 General Data Protection Regulation (GDPR), after writing of May 23, 2018 the deletion of the entry concerning him about his Bankruptcy both in his “personal profile” and in the profile of the XY GmbH desires the database of the party involved and the co-involved party had informed this party in a letter dated the same day Not complying with desires. 4 In a decision dated September 20, 2019, the data protection authority (appealed Authority) rejects the data protection complaint as unfounded. 5 The complaint lodged by the appellant against this rejected this Federal Administrative Court (Administrative Court) with the contested The finding of July 28, 2020 was unfounded and stated that the Revision is permissible. 6 In summary, the administrative court stated that: The participating party processes the data in the course of operating the business Credit information agency in accordance with Section 152 GewO 1994 historical information about Payment defaults and insolvency proceedings of the appeal applicant (potential) creditors in order to determine the risk of any to provide payment defaults. This is a purpose recognized by the legal system. The data on the insolvency proceedings are correct, complete and fundamental necessary and suitable to make a forecast about the future payment behavior of the appeal applicant. Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 3 of 26 Neither the GDPR nor the regulations on the credit reporting agency business (§ 152 GewO 1994) contained concrete deadlines “for the permissible storage period historical insolvency proceedings and payment defaults”. The permissible one Storage duration depends on the individual case. Historical payment information is essential for the future Payment behavior of (potential) debtors to be able to predict. However, they would have less informative value longer they would be in the past and the longer there would be no further delays in payments and payment defaults. The age of the claim or the The time when the final default of the claim is determined The timing of any repayments and the “good behavior” since then would be included the weighing up is of crucial importance. As a guideline, how long payment history data is used to assess creditworthiness (potential) debtors are suitable, observation or Deletion periods in the provisions serving to protect creditors are used that meet the requirements of a suitable one Creditworthiness assessment should be specified in more detail, such as the provisions of the Regulation (EU) No 575/2013 of the European Parliament and of the Council of June 26, 2013 on supervisory requirements for credit institutions and Investment firms and amending Regulation (EU) No 646/2012 (Capital Adequacy Ordinance). These obliged credit institutions under among other things, for customer assessment and risk assessment of their claims. For credit or retail claims against natural persons Credit institutions that calculate their risk-weighted position amounts based on a based on internal assessments (Art. 143 Para. 1), in accordance with Art. 151 Para. 6 in conjunction with Art. 180 Para. 2 lit. a and e Capital Adequacy Ordinance the probability of default Requirement based, among other things, on the long-term averages of the annual Estimate the failure rate. This is a historical observation period for at least one data source, which could also be external, from at least to be taken as a basis for five years. Also the estimate to be carried out The loss rate in the event of a default is in accordance with Article 151 paragraph 7 Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 4 out of 26 In conjunction with Article 181 Paragraph 2 Letter c of the Capital Adequacy Ordinance, it is generally based on one for a period of at least five years. The EU regulator therefore assumes that for the assessment of the Creditworthiness of (potential) debtors and the risk a claim data on any payment defaults over a period of be relevant for at least five years. If credit institutions are potential business partners of the party involved are legally obliged to report their claims based on default rates at least for the last five years, and the credit rating database The party involved should also serve to provide data to credit institutions, that they would need for their mandatory assessment violates the Processing the insolvency data of the appeal applicant does not violate the principle data minimization or storage limitation if the payment plan for The time of the deletion request on May 23, 2018 was less than three months, or at the time of the administrative court's decision was fulfilled a little over two years ago. This also applies to Receivables that were already defaulted more than five years ago only, as in the present case, a little more than two years ago through the fulfillment of the The payment plan was finally paid off because only with the successful payment The specific amount of the default can be determined when the payment plan is fulfilled could. As part of the balancing of interests in accordance with Article 6 Paragraph 1 Letter f of the GDPR on the one hand, the interests of the person responsible and of third parties (possible business partners of the party involved) and, on the other hand, the interests, The rights and expectations of the data subject must be taken into account. The party involved and their customers would have a comprehensible one Interested in assessing credit risk. The processing of data about insolvencies and payment defaults to protect potential successes Contractual partner of the data subject, the third party within the meaning of Art. 6 Paragraph 1 lit. f GDPR. This data processing also serves Support of credit institutions, the regulations of the Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 5 out of 26 to comply with the capital adequacy regulation. For assessing credit risk by the party involved is the observation of the historical Payment behavior of potential debtors is essential and the Processing data about a little over two years ago Fulfillment of a payment plan finally concluded insolvency proceedings necessary. This interest of the party involved and their business partners outweighs this the interest of the appeal applicant, not from economic disadvantages Data processing to be affected because the amount of liabilities of the Insolvency proceedings amounted to approximately €215,000. Furthermore, the person involved Only one party has this payment experience data of the appeal applicant limited public who has an interest to be taken into account Credit check is available. In contrast to the credit rating database of the party involved, the data protection law admissibility of maintaining the insolvency file § 256 Insolvency Code (IO), a legal obligation within the meaning of Art. 6 Paragraph 1 lit. c GDPR. It cannot be deduced from Section 256 IO that Insolvency data (at all) also based on other permitted circumstances Art. 6 GDPR may no longer be processed if they come from the Insolvency file had been deleted. Such a restriction would at least with regard to the present relevant permit Art. 6 Para. 1 lit. f GDPR contradicts EU secondary law. As far as the appeal applicant in his letter of request dated May 29, 2018 to object to the use of your data 21 GDPR, he did not explain to what extent the Data processing based on Article 6 Paragraph 1 Letter f of the GDPR is nevertheless not permissible in a special situation. The contradiction is therefore inadmissible. By claiming that the stored data is old and incomplete because the appeal applicant has been successfully active again in business since 2016 and This data is only suitable for his economic advancement Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 6 of 26 The appeal applicant is doing something to hinder and cause damage Violation of the general processing principles of the Data minimization and data economy according to Art. 5 GDPR and one inadequate balancing of interests within the framework of Article 6 GDPR, but none reasons arising from a special situation affecting him would result. The “processing of data on historical bankruptcies and “Payment defaults” by the appeal applicant by the co-involved party are therefore necessary and lawful. The objection raised by the appeal applicant could not justify his request for deletion. 7 The administrative court based its decision on admissibility on the grounds that it was missing Jurisprudence of the Administrative Court on the question of which principles a balancing of interests in accordance with Article 6 Paragraph 1 Letter f of the GDPR must be sufficient; in particular, whether and under what conditions the regulations of the Capital Adequacy Ordinance as a guideline for determining the permissible Storage period of creditworthiness data can be used. 8 The present ordinary revision is directed against this with the application Repeal of the contested finding against reimbursement of expenses. 9 The authority concerned requested this in its response to the appeal Dismissal of the appeal against reimbursement of expenses. The participating party did not submit an appeal response. 10 By resolution of December 23, 2021, 6 K 441/21.WI, and resolution of January 31, 2022, 6 K 1052/21.WI, was ruled by the Wiesbaden Administrative Court (Germany) asked, among other things, the following questions to the ECJ (there pending C-26/22 and C-64/22) for a preliminary ruling: “... 2. Is data storage at a private credit reporting agency personal data from a public register, such as the 'national Databases' within the meaning of Article 79 Paragraphs 4 and 5 of the Regulation (EU) 2015/848 [Regulation of the European Parliament and the Council of May 20, 2015 on insolvency proceedings], without any specific reason Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 7 out of 26 stored in order to provide information in the event of an inquiry can, with Articles 7 and 8 of the Charter of Fundamental Rights of the European Union compatible? 3. a) Are private parallel databases (especially databases of a Credit agencies) that are set up alongside the state databases and in which the data from the state databases (here Insolvency notices) are stored longer than in the narrow one Framework of Regulation 2015/848 in conjunction with the national one Regulated by law, generally permissible? b) If question 3 a) is answered in the affirmative, this results in the right to be forgotten in accordance with Art. 17 Paragraph 1 Letter d) GDPR, this data must be deleted, if the processing time envisaged for the public register has expired? 4. Insofar as Article 6 Paragraph 1 Subparagraph 1 letter f) GDPR as the sole one Legal basis for data storage for private individuals Credit reporting agencies also appear in public registers Stored data comes into consideration is a legitimate interest Credit reporting agency is to be affirmed if this credit reporting agency has the data from the public directory without any specific reason Is this data then available when a request is made? ..." 11 By resolution of June 10, 2023, Ro 2020/04/0031, the Administrative Court continues the appeal process until the Decision of the ECJ in the above two Request for a preliminary ruling from the Wiesbaden Administrative Court is pending Proceedings suspended because answering these questions is also for the treatment of the present revision is important. 12 With judgment of December 7, 2023, C-26/22 and C-64/22, SCHUFA Holding (discharge of residual debt), the ECJ has decided on the request for a preliminary ruling from Wiesbaden Administrative Court decided. The Administrative Court considered: admissibility 13 The appeal turns out to be in line with the separate admissibility submissions made by the Revision clarified the legal question as to whether EU regulations, such as the one in this case Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 8 out of 26 Capital Adequacy Ordinance applicable to credit institutions and investment firms are addressed and contain regulations for internal credit checks, as Guideline for determining the permissible storage period of not for internal use of certain creditworthiness data by credit reporting agencies can be used as permissible. She is also entitled. Relevant legal situation Union law 14 The relevant recitals and provisions of the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons during processing personal data, the free movement of data and the abolition of the Directive 95/46/EC (General Data Protection Regulation; GDPR), OJ L 119 dated May 4, 2016, excerpts read: “Article 6 Lawfulness of processing (1) Processing is only lawful if at least one of the the following conditions are met: ... f) the processing is to protect the legitimate interests of the responsible person or a third party, unless the interests or fundamental rights and freedoms of the person concerned, which require the protection of personal data, predominate especially if the person concerned is a child acts. Subparagraph 1(f) does not apply to those carried out by public authorities processing carried out in their tasks. ... Article 17 Right to deletion (“right to be forgotten”) (1) The data subject has the right to obtain information from the person responsible request that personal data concerning you be deleted immediately and the person responsible is obliged to provide personal data deleted immediately if one of the following reasons applies: Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 9 out of 26 a) The personal data are for the purposes for which they were collected or processed in any other way is no longer necessary. ... c) The data subject objects in accordance with Article 21(1). processing and there are no overriding legitimate reasons for processing, or the data subject submits in accordance with Article 21 Paragraph 2 objection to the processing. d) The personal data was processed unlawfully. ..." 15 The relevant recitals and provisions of the Directive 2008/48/EC of the European Parliament and of the Council of April 23, 2008 on consumer credit agreements and the cancellation of the Council Directive 87/102/EEC, OJ L 133 of 22.5.2008 excerpts: “(26) ... Particularly in the expanding credit market, it is important that Lenders do not act irresponsibly in granting loans or Granting loans without prior assessment of creditworthiness, and the Member States should carry out the necessary checks to prevent such Behaviors should be stopped and they should be the necessary ones Determine sanctions for those lenders who behave in this way. Without prejudice to the provisions of Directive 2006/48/EC of the European Parliament and of the Council of 14 June 2006 on the inclusion and The activities of credit institutions should be controlled by credit risk Lenders are responsible for evaluating the loan in each individual case Check the consumer's creditworthiness. ... ... (28) To assess the consumer's credit situation, the creditor should: also consult the relevant databases; due to legal and Factual circumstances may require such Consultations vary in scope. So that the competition between Lenders should not be distorted, lenders should choose from others Member States access to private or public databases concerning consumers in a Member State in which they are not established are granted under non-discriminatory conditions the creditors of that Member State. ... Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 10 out of 26 Article 8 Obligation to assess the consumer's creditworthiness (1) Member States shall ensure that before the credit agreement is concluded the lender assesses the consumer's creditworthiness based on sufficient creditworthiness evaluates information that he may collect from the consumer and if necessary, based on information from the relevant company Database. Those Member States that require lenders to do so by law oblige to check your creditworthiness based on a corresponding query database can maintain this requirement.” 16 The relevant recitals and provisions of the Directive 2014/17/EU of the European Parliament and of the Council of February 4, 2014 on residential real estate credit agreements for consumers and for Amendments to Directives 2008/48/EC and 2013/36/EU and the Regulation (EU) No. 1093/2010, OJ L 60 of February 28, 2014 excerpts: “(55) Before concluding a credit agreement, it is essential to have the ability and Evaluate and evaluate the consumer's propensity to repay the loan check. During this credit check, everyone should necessary and relevant factors are taken into account that determine the capability of a consumer to repayments due over the term of the loan could achieve, influence. ... ... (59) Querying a credit database is a useful element in the Credit check. ... ... Article 18 Obligation to check the consumer's creditworthiness 1. Member States shall ensure that the creditor before concluding a Credit agreement requires a thorough check of the consumer's creditworthiness carries out. When checking your creditworthiness, the factors that determine the... Examination of the prospects that are relevant to the consumer fulfills obligations under the loan agreement in an appropriate manner taken into account. ... Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 11 of 26 Article 21 Access to databases (1) Each Member State shall ensure that all creditors from all Member States have access to the assessment within their territory the consumer's creditworthiness databases used Use should only be monitored to what extent consumers fulfill their loan obligations during the term of a loan agreement. Access must be granted without discrimination. (2) Paragraph 1 applies to both private credit bureaus and credit reporting agencies operated databases as well as for public registers. ..." 17 The relevant recitals and provisions of the Regulation (EU) No 575/2013 of the European Parliament and of the Council of June 26, 2013 on supervisory requirements for credit institutions and Investment firms and amending Regulation (EU) No 646/2012 (Capital Adequacy Regulation), OJ L 176 of June 27, 2013 excerpts: “(42) It is essential to take into account the diversity of institutions in the Union is, should be used when calculating the own funds requirements for the There are different approaches to credit risk with varying degrees of severity Risk sensitivity and sophistication should be provided. Through the Use of external credit assessments and those from the institutions themselves The estimates made of individual credit risk parameters win Credit risk provisions significantly increase risk sensitivity and regulatory soundness. Institutes should switch to approaches with higher risk sensitivity. If institutes are to Apply the investigation approaches provided for in this Regulation They should provide the estimates needed to assess credit risk if they submit their procedures for credit risk measurement and credit risk management, so that for the Determination of regulatory capital requirements methods for are available that match the type, scope and complexity of the take into account the procedures of the individual institutes. In this regard, the Data processing in connection with procurement and administration of loans to customers also the development and validation of systems for credit risk management and credit risk measurement. This not only serves the legitimate interests of institutions, but also the goal this regulation, better methods for risk measurement and management apply and these methods also with regard to the prescribed ones to use own resources. Regardless, higher-level approaches require Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 12 of 26 Risk sensitivity significant expertise and resources as well as qualitative high-quality and sufficient data. ... ... Article 135 Use of ECAI credit ratings (1) An external credit assessment may only be used to determine the risk weight of a claim according to this chapter can be used, if it comes from an ECAI or from an ECAI in accordance with the Regulation (EC) No. 1060/2009 was confirmed. ... Article 171 Assignment to rating levels or risk pools ... (2) When assigning debtors and facilities to a rating level or a risk pool, an institution carries all relevant information Invoice. The information is up-to-date and enables the institute to Forecast of the future development of the risk position. The less The more information an institution has available, the more conservative it is The procedure for assigning risk positions to debtor or facility rating levels or risk pools. Does an institute support the Determination of an internal assessment mainly to an external one Credit rating, it ensures that other relevant ones are also relevant information is taken into account. ... Article 180 Special requirements for PD estimates (1) When quantifying the risk parameters for certain creditworthiness levels or pools are used by the institutions when estimating PD for receivables Companies, institutions, central governments and central banks as well as for Investment positions for which they apply the PD/LGD approach in accordance with Article 155 Apply paragraph 3, the following specific requirements: ... f) to the extent that an institution compares its internal creditworthiness levels with the creditworthiness scale of a ECAI or comparable institutions linked or one of such scale and then the external creditworthiness levels assigns default rates recorded by the organization to its internal levels, This assignment is made based on a comparison between the internal ones Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 1. February 2024 13 of 26 Assessment criteria and the criteria of the external organization and a comparison between internal and external assessments of any joint debtor. Distortions or inconsistencies in Assignment procedures or the underlying data are included avoided. The criteria of the external organization that is responsible for the The data used for quantification are based exclusively focused on the risk of default and do not reflect any transaction characteristics. ..." National law 18 Section 7 Paragraph 1 of the Consumer Credit Act (VKrG), Federal Law Gazette I No. 28/2010 as amended Federal Law Gazette I No. 135/2015 reads: “Checking the consumer’s creditworthiness § 7. (1) Before concluding the loan agreement, the lender has the The consumer's creditworthiness based on sufficient information check that he - if necessary - requests from the consumer; If necessary, he also has information from one available database.” 19 § 9 Mortgage and Real Estate Loan Act - HIKrG, Federal Law Gazette I No. 135/2015, reads in part: “Checking the consumer’s creditworthiness § 9. (1) Before concluding a credit agreement, the lender has a carry out a thorough check of the consumer's creditworthiness. At The creditworthiness check are the factors that are used to check the Prospects are relevant that the consumer fulfills his obligations the credit agreement must be taken into account in an appropriate manner. (2) The creditworthiness check is based on necessary, sufficient and appropriate information on income, expenses and other financial and economic circumstances of the consumer to be carried out. The lender has the information from relevant internal or external sources, including the consumer. ..." Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 14 of 26 20 § 256 Insolvency Code (IO), Federal Law Gazette No. 337/1914 as amended by Federal Law Gazette I No. 122/2017, reads in part: “Bankruptcy file § 256. (1) Data must be included in the edict file according to this Federal law must be made public (insolvency file). (2) Access to the insolvency file is no longer permitted if a year has passed since ... 4. Expiry of the payment period provided for in the payment plan or ... (3) At the debtor's request, the insolvency file can already be viewed will no longer be granted if the restructuring plan has been legally confirmed or payment plan has been fulfilled. The debtor has fulfillment to be documented. The court can examine compliance Hire an expert to cover the costs of the debtor are. The court will make a decision on the inspection that cannot be postponed Decision. ..." Legality of storing data from the insolvency file Credit reporting agencies 21 In the present case, the applicant for appeal is requesting the deletion of an entry in the With regard to his insolvency proceedings in the database of those involved Credit reporting agency after the bankruptcy court in its Debt settlement procedure involves the “deletion of entries from the Insolvency file” in accordance with Section 256 Paragraph 3 IO. It is therefore necessary to check Permissibility of storing this data by the participating party also still in the period after the decision of the insolvency court approved it Failure to grant access to the insolvency file in accordance with Section 256 Paragraph 3 IO. 22 The ECJ in its judgment of December 7, 2023, C-26/22 and C-64/22, SCHUFA Holding (remaining debt discharge), the key questions at hand the request for a preliminary ruling from the Wiesbaden Administrative Court answered that Art. 5 Para. 1 lit. a GDPR in conjunction with Art. 6 Para. 1 lit. f GDPR should be interpreted as belonging to the practice of “private credit reporting agencies”. Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 15 of 26 which consists in having one in their own databases information about the granting of a certificate from the public register Discharge of residual debt in favor of natural persons for the purpose of delivery of information about the creditworthiness of these people for a period of time to store the duration of the data storage in the public register goes out. He essentially justified this as follows: “... 74 In the present case, it is clear that the lawfulness of the processing personal data that is at issue in the main proceedings, solely in Light of Article 6 paragraph 1 subparagraph. 1 letter f GDPR is to be assessed. After This provision is for the processing of personal data only lawful if the processing is carried out to protect legitimate interests of the person responsible or a third party is necessary, unless the interests or fundamental rights and freedoms of the data subject require the protection of personal data, in particular if the person concerned is a child. 75 The processing of personal data is therefore subject to this Determination lawful under three cumulative conditions: First must be from the controller or a third party a legitimate interest must be perceived; secondly, the Processing of personal data to achieve this legitimate interest may be necessary, and thirdly, the interests or Fundamental rights and freedoms of the person whose data is protected should not outweigh (judgment of July 4, 2023, Meta Platforms et al. [General conditions of use of a social network], C-252/21, EU:C:2023:537, paragraph 106 and the case law cited there). 76 Firstly, what is the requirement for safeguarding a 'legitimate interest'? concerns, is in the absence of a definition of this term by the GDPR highlighted, as the Advocate General did in point 61 of his Opinion has stated that a wide range of interests are fundamentally considered can be considered justified. 77 Secondly, what is the requirement that the processing is necessary? personal data to realize the perceived As far as legitimate interest is concerned, this requires the referring court to do so check whether the legitimate interest in processing the data is not in can reasonably be achieved just as effectively by other means, which have less impact on the fundamental rights and freedoms of those affected Persons, in particular those guaranteed by Articles 7 and 8 of the Charter Rights to respect for private life and protection of personal data, Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 16 of 26 intervene (judgment of July 4, 2023, Meta Platforms et al. [General Terms of use of a social network], C-252/21, EU:C:2023:537, 108 and the case law cited there). 78 In this context it should also be noted that the Requirement of the necessity of data processing together with the The so-called principle of 'data minimization' must be examined, which is set out in Article 5 Paragraph 1 letter c GDPR is anchored and requires that personal data Data 'adequate and relevant to the purpose and relevant to the purposes processing is limited to the extent necessary (judgment of July 4, 2023, Meta Platforms et al. [General terms and conditions of use of a social Network], C-252/21, EU:C:2023:537, paragraph 109 and the one cited there case law). 79 Thirdly, as regards the requirement that the interests or Fundamental freedoms and rights of the person whose data is protected should, against the legitimate interest of the person responsible or one third parties do not predominate, the Court has already decided that these The prerequisite is a balancing of the respective conflicting factors Rights and interests that fundamentally depend on the specific circumstances of the individual case and that it is therefore a matter for the submitter The court is to weigh this up taking this specific into account circumstances (judgment of July 4, 2023, Meta Platforms et al. [General conditions of use of a social network], C-252/21, EU:C:2023:537, paragraph 110 and the case law cited there). 80 Furthermore, as can be seen from recital 47 of the GDPR results, the interests and fundamental rights of the data subject are in the interest of the Those responsible predominate, especially when personal data are involved Data is processed in situations where a data subject cannot reasonably expect such processing (judgment of July 4, 2023, Meta Platforms et al. [General Terms and Conditions of Use a social network], C-252/21, EU:C:2023:537, paragraph 112). 81 Ultimately, it is for the referring court to decide whether with regard to the processing of personal data involved in the The main proceedings concern the three referred to in paragraph 75 of this judgment requirements are met; the Court may order the national court to do so however, its request for a preliminary ruling provides relevant information for give this test (see in this sense judgment of October 20, 2022, Digi, C-77/21, EU:C:2022:805, paragraph 39 and the case law cited there). 82 In the present case, SCHUFA does one thing with regard to the prosecution legitimate interest applies that the credit reporting agencies data processed to assess the creditworthiness of people or companies are necessary to provide this information to their contractual partners Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 17 of 26 to be able to provide. This activity not only protects them economic interests of the companies that have credit-related contracts wanted to enter into the determination of creditworthiness and the granting of credit Credit reports also form a foundation of the credit system and the functionality of the economy. The activities of credit reporting agencies help also, the business wishes of those interested in credit-relevant transactions realize this, as the information allows for a quick and unbureaucratic check made business possible. 83 In this respect, the processing of personal data serves as that in the The main proceedings in question do indeed represent the economic interests of the SCHUFA, but this processing also serves to protect the legitimate interests Interest of SCHUFA's contractual partners who have credit-relevant contracts people want to take part in assessing their creditworthiness people and thus the socio-economic interests of the credit sector. 84 With regard to consumer credit agreements, Article 8 of the Directive 2008/48, in the light of its 28th recital, highlights that The lender is obliged to do so before the loan agreement is concluded creditworthiness of the consumer based on sufficient information, if necessary, also based on public and private information Databases to evaluate. 85 Furthermore, in relation to consumer residential property credit agreements Article 18(1) and Article 21(1) of Directive 2014/17 in conjunction with Recitals 55 and 59 of this Directive indicate that: Lenders carry out a thorough check of the consumer's creditworthiness has to make and has access to credit databases, whereby the query such databases is a useful element in this examination. 86 It should be added that the obligation to evaluate the Consumer creditworthiness as defined in Directives 2008/48 and 2014/17 is intended not only to protect the loan applicant, but also also, as highlighted in recital 26 of Directive 2008/48, to ensure the smooth functioning of the entire credit system. 87 However, data processing must also be carried out to achieve the legitimate interests of the controller or a third party and the interests or fundamental rights and freedoms of those affected person must not outweigh this interest. At the appropriate balancing of the respective conflicting rights and interests, i.e. H. that of the person responsible and those involved Third parties on the one hand and the data subject on the other hand, as in paragraph 80 of the present judgment, in particular the reasonable expectations the data subject and the scope of the processing in question and to take into account their effects on this person (cf. judgment of Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 18 of 26 July 4, 2023, Meta Platforms et al. [General Terms and Conditions of Use a social network], C-252/21, EU:C:2023:537, paragraph 116). 88 Regarding Article 6 Paragraph 1 Subparagraph The Court of Justice has 1 letter f of the GDPR decided that this provision should be interpreted as meaning that a Processing only if it is necessary to protect the legitimate interests of the responsible party or a third party required within the meaning of this regulation can be considered if this processing is within the limits what is done to realize this legitimate interest is absolutely necessary and if it results from a consideration of each other conflicting interests, taking into account all relevant circumstances shows that the interests or fundamental rights and freedoms of the Processing of data subjects against the legitimate interest of the data subject those responsible or a third party do not prevail (cf. in this sense Judgments of May 4, 2017, Rīgas satiksme, C-13/16, EU:C:2017:336, paragraph 30, and dated July 4, 2023, Meta Platforms et al. [Terms and conditions a social network], C-252/21, EU:C:2023:537, paragraph 126). 89 In this context, the referring court points out two aspects of the processing at issue in the main proceedings personal data. Firstly, this processing implies a diverse storage of data, i.e. H. not just in a public one Register, but also in the databases of the credit reporting agencies these companies do not carry out this storage for a specific reason, but in the event that their contractual partners requested information from them. Second, these companies stored this data for three years Basis of rules of conduct within the meaning of Art. 40 GDPR, while the National legislation for the public register requires a storage period of just six months. ... 92 With regard to the duration of data storage, it can be assumed that The examination of the second and third is in paragraph 75 of the present judgment the above-mentioned requirement overlaps in that the assessment of the Question whether in the present case the legitimate interests that are related to the processing of personal data at issue in the main proceedings cannot reasonably be perceived by a shorter duration of the Storage of data can be achieved by balancing each other conflicting rights and interests. 93 When weighing up the legitimate interests pursued, it should be noted that the analysis of a credit reporting agency insofar as it provides an objective and reliable assessment of the creditworthiness of potential customers Contractual partner of the credit reporting agency enables Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 19 of 26 Compensate for information differences and thus fraud risks and others can reduce uncertainties. 94 However, as far as the rights and interests of the data subject are concerned, represents the processing of data regarding the granting of a discharge of residual debt, such as storing, analyzing and sharing this data with you Third parties, through a credit reporting agency, a serious interference in the Articles 7 and 8 of the Charter represent the fundamental rights of the data subject. Such data serves as a negative factor when assessing the Creditworthiness of the person concerned and are therefore sensitive information about her private life (cf. in this sense judgment of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 98). Their processing may significantly jeopardize the interests of the data subject harm, as this disclosure is likely to interfere with the exercise of their freedoms significantly more difficult, especially when it comes to basic needs cover up. 95 Furthermore, as the Commission has pointed out, the consequences for the The interests and private life of the person concerned are even greater Requirements regarding the lawfulness of storing this information the higher the longer the data in question has been kept by credit reporting agencies get saved. 96 It should also be noted that the aim of a public Insolvency register, as can be seen from recital 76 of the Regulation 2015/848 is to provide better information affected creditors and courts. In this In this context, Article 79 (5) of this regulation simply provides that Member States inform data subjects for what period of time their personal data stored in insolvency registers are accessible, without specifying a storage period for this data. On the other hand, it follows from Article 79(4) of this Regulation states that Member States may, in accordance with this Article is responsible for collecting data and storing it in national databases. The period for storing this data must therefore take this into account regulation to be established. 97 In the present case, the German legislature provides that Information about the granting of a discharge of residual debts in the insolvency register is only stored for six months. He therefore assumes that after After a period of six months, the rights and interests of the affected person to those of the public about this information have, predominate. 98 Furthermore, as the Advocate General stated in point 75 of his Opinion has stated that the granted exemption from residual debts enables the beneficiary to to participate in economic life again, and therefore has for this person Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 20 out of 26 generally existential meaning. The realization of this goal would be However, it is at risk if credit reporting agencies are used to assess the economic situation of a person, data about a discharge of residual debt store and could use such data after it has been removed from the public insolvency register has been deleted because this data is with the Assessing the creditworthiness of such a person is always a negative factor be used. 99 Under these circumstances, the interests of the credit sector, over There is no information regarding a discharge of residual debt Processing of personal data such as that in legal disputes The main proceedings in question after the expiry of the storage period Data in the public insolvency register justify storage of this data by a credit reporting agency in relation to the period the deletion of this data from a public insolvency register does not apply Article 6 paragraph 1 subparagraph 1 letter f GDPR can be supported. ... 106 Finally, the referring court essentially asks which Obligations to a credit reporting agency in accordance with Art. 17 GDPR. ... 108 Should the referring court, after its assessment of legality the processing at issue in the main proceedings personal data comes to the conclusion that this processing is therefore not lawful, according to the clear wording of this provision the person responsible, in this case SCHUFA, is obliged to do so delete the relevant data immediately. This would be as in paragraph 99 of found in this judgment when processing the data in question personal data that is received after the expiry of the six-month period for the The data is stored in the public insolvency register. ..." 23 Based on this case law of the ECJ, the legality of the Processing of personal data from the insolvency file by the co-involved party solely in the light of Article 6 Paragraph 1 Letter f GDPR judge. According to this provision, the processing is personal Data is lawful under three cumulative conditions: firstly, from the controller or a third party legitimate interest must be exercised; secondly, the processing must be carried out personal data to achieve legitimate interest Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 21 of 26 be necessary, and thirdly, the interests and fundamental rights and Basic freedoms of the person whose data is to be protected are not predominate (ECJ December 7, 2023, C-26/22 and C-64/22, SCHUFA Holding [Discharge of residual debt], paragraphs 74 and 75, mwN; see also VwGH October 31, 2023, Ro 2020/04/0024, 0025, Rn. 22, mwN). 24 In this case, the party involved makes a claim regarding the prosecution legitimate interest claims that they are based on the exercise of the business the credit reporting agency has a legitimate interest in the credit information agency in accordance with Section 152 GewO 1994 Processing of the creditworthiness data of the appeal applicant, in particular Information about his past insolvency for the purpose of assessment his creditworthiness. This data processing therefore serves the economic interests of the party involved. The In this context, however, the administrative court also pointed out that that the processing of data about insolvencies and payment defaults Protection of potential contractual partners of the appeal applicant is achieved. The The processing of the insolvency data of the appeal applicant therefore also serves the purpose Safeguarding the legitimate interests of the contractual partners involved Party that concludes credit-relevant contracts with the appeal applicant want to estimate the associated credit risk. 25 The ECJ (C-26/22 and C-64/22, paras. 83 to 86) goes in this Connection also depends on the existence of a socio-economic interest the credit sector in the processing of creditworthiness data, especially from Insolvency data. On the one hand, he refers to Article 8 of the directive 2008/48/EC, which in the light of recital 28 of this Directive With regard to consumer credit agreements, the lender's obligation is clear, before concluding the credit agreement, the consumer's creditworthiness on the basis of sufficient information, if necessary also on the basis of Evaluate information from public and private databases (dem corresponds domestically to Section 7 Paragraph 1 of the Consumer Credit Act (VKrG), which means Article 8 of Directive 2008/48/EC on consumer credit agreements implemented became). On the other hand, the lender has regarding Residential real estate loan agreements for consumers in accordance with Article 18, paragraph 1 and Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 22 of 26 Article 21(1) of Directive 2014/17 in conjunction with recitals 55 and 59 This guideline carries out a thorough check of the creditworthiness of the Consumer to carry out the query of credit databases which the lender has access to, is a useful element in this review is (this corresponds domestically to Section 9 Paragraphs 1 and 2 Mortgage and Real Estate Loan Act - HIKrG, which means Article 18 Paragraph 1 of the Directive 2014/17/EU was implemented). Furthermore, the obligation to Assess consumers' creditworthiness as outlined in the guidelines 2008/48/EC and 2014/17/EU is provided not only for the loan applicant but also, as in recital 26 of the directive 2008/48/EC emphasizes the smooth functioning of the entire system Guarantee credit system. 26 The administrative court refers (specifically on the question of storage duration) in particular to Regulation (EU) No. 575/2013 of the European Union Parliament and of the Council of 26 June 2013 on prudential requirements Credit institutions and investment firms and to change the Regulation (EU) No. 646/2012 (Capital Adequacy Regulation). This The regulation is based on Art. 135 Para. 1, Art. 171 Para. 2 and Art. 180 Para. 1 lit. f in conjunction with recital 42, the use of external Credit assessments, for example for the assignment of rating levels and Risk pools or for estimating the probability of default (“PD estimate”), thus for credit risk assessment. It It therefore also follows from the Capital Adequacy Ordinance that Processing of insolvency data from (potential) borrowers socio-economic interest of the credit sector in evaluating the Creditworthiness of the contractual partners of the party involved with the Applicants for an audit want to conclude credit-relevant contracts. 27 Finally, the analysis of a credit reporting agency, such as the one involved party, insofar as it provides an objective and reliable assessment of the creditworthiness of potential customers of their contractual partners, Compensate for information differences and thus fraud risks and others Reduce uncertainties (cf. ECJ C-26/22 and C-64/22, para. 93). Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 23 of 26 28 In this respect, there is a legitimate interest within the meaning of Art. 6 Para. 1 lit. f GDPR the processing of the appeal applicant's data Debt settlement procedures. 29 In contrast, the processing of this data, in particular with regard to the fulfillment of the legally confirmed payment plan, such as Storage, analysis and transfer of this data to a third party by the The party involved is a serious encroachment on the rights set out in Articles 7 and 8 GRC enshrined fundamental rights of the appeal applicant. Since such data as negative factor in assessing the creditworthiness of the To serve the appeal applicant, they provide sensitive information about it Private life. Your processing may be in the interests of the appeal applicant considerable harm because the disclosure is likely to jeopardize the exercise of his rights to make freedoms considerably more difficult, especially when it comes to to cover basic needs. The consequences for interests and private life of the appeal applicant are even greater and the requirements placed on them The lawfulness of storing this information therefore increases, the higher longer this data is stored by the participating party (see ECJ C-26/22 and C-64/22, paras. 94, 95). 30 Aim of a public insolvency register, such as the insolvency file § 256 IO is to ensure better information for those affected Creditors and courts (cf. ECJ C-26/22 and C-64/22, para. 96, as well domestically the explanations for Insolvency Law Amendment Act 1997 - IRÄG 1997 in RV 734 BlgNR 20 GP, 34, 63). 31 According to Section 256 Paragraph 2 Item 4 IO, the insolvency file can no longer be viewed grant if since the expiry of the period provided for in the payment plan One year has passed for the payment deadline. Inspection is possible at the request of the debtor in the insolvency file can no longer be granted if the legally confirmed payment plan has been fulfilled (Section 256 Para. 3 IO). The latter option serves to avoid disadvantages for the debtor Business transactions (see the explanations for Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 24 out of 26 Insolvency Law Amendment Act 2010 -IRÄG 2010 RV 612 BlgNR 24. GP 3, 35). 32 The legislature therefore assumes that with the fulfillment of the legally confirmed payment plan, but at the latest upon expiry of a deadline of one year since the expiry of the payment period provided for in the payment plan the rights and interests of the data subject, as in this case The appeal applicant, those of the public, have access to this information have, predominate (cf. RV 734 BlgNR 20. GP, 63). After all, that's the goal of the payment plan, the economic recovery of the debtor (cf. OGH August 18, 2010, 8 Ob 146/09t). In this sense, a “deletion” should occur the insolvency file is impaired as a result of fulfilling the payment plan of the debtor in business transactions through public announcement of a Avoid previous insolvency proceedings (see explanations in RV 612 BlgNR 24. GP, 3, 35). 33 However, the realization of this goal would be jeopardized if those involved Party as a credit reporting agency to assess the economic situation of the Store the appeal applicant's data about his insolvency proceedings and such Data could be used after viewing the insolvency file § 256 paragraph 2 and paragraph 3 IO can no longer be granted because this data is included the assessment of the creditworthiness of the audit applicant is always negative factor can be used. Under these circumstances, those entitled to Interests of the credit sector, about information regarding the fulfillment the legally confirmed payment plan ended the insolvency proceedings of the appeal applicant to order the processing of this previously in the Personal data can no longer be publicly viewed in the insolvency file justify. The storage of this data by the participating party Reference to the period after the decision of the Insolvency court about the “deletion of the entries from the Insolvency file” in accordance with Section 256 Paragraph 3 IO cannot therefore be based on Art. 6 Paragraph 1 lit. f GDPR is supported. The storage of the data relating to the debt settlement procedure of the appeal applicant the insolvency file by the party involved about the time of Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 25 out of 26 The decision of the insolvency court has legal force in accordance with Section 256 (3) IO This proves to be contrary to the legal opinion of the authority concerned and the Administrative court - as not legal (cf. again ECJ C-26/22 and C-64/22, paragraphs 98 and 99). Request for deletion according to Art. 17 GDPR 34 Due to the lack of lawfulness of the processing from the insolvency file deleted data of the appeal applicant regarding his insolvency proceedings The party involved is obliged to provide the relevant data immediately to be deleted in accordance with Art. 17 Para. 1 lit. d GDPR (cf. again ECJ C-26/22 and C-64/22, paragraph 108). 35 In contrast to this, in the VwGH decision May 9, 2023, Ro 2020/04/0037, that asserted by the appeal applicant against a credit institution Right to deletion in accordance with Art. 17 GDPR in relation to you relevant entry of payment experience data in a jointly with database operated by other credit institutions (bank warning list). This entry did not concern the processing of personal data Applicant from the insolvency file. Rather, they were in the Payment history data of the audit applicant stored on the bank warning list by the credit institution in connection with the existing one Current account details of the appeal applicant are collected (see VwGH Ro 2020/04/0037, paragraph 57, last sentence). So much for this one Knowledge taking into account the Capital Adequacy Ordinance Storage period of at least five years in relation to the storage of Payment experience data in the bank warning list is generally considered legitimate was considered, it should be noted that the Capital Adequacy Ordinance in accordance with Article 1, the general supervisory requirements for Credit institutions regulate specific areas and are therefore not applicable Credit reporting agencies, such as the party involved in this case, apply. Result 36 In this respect, the administrative court is of the legality of storing the data Insolvency data relating to the appeal applicant is provided by the co-participant Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at Ro 2020/04/0031-9 February 1, 2024 26 of 26 Credit reporting agency in accordance with Article 6 Paragraph 1 Letter f of the GDPR and that from If the right to deletion asserted by the appeal applicant is denied, it has that contested finding is burdened with illegality of the content. The The contested finding therefore had to be repealed in accordance with Section 42 Paragraph 2 Z 1 VwGG. 37 From the conduct of the requested hearing before The Administrative Court was able to distance itself in accordance with Section 39 Para. 2 Z 6 VwGG be taken because the present case does not involve questions of assessment of evidence or disputed findings of fact, but in the Revision legal questions were raised that were not complex in nature have, especially since the central legal question already refers to the case law of the ECJ could be referred (see VwGH August 3, 2023, Ro 2020/04/0035, Rn. 35, mwN), and to solve them in the sense of the judicature of the ECHR an oral hearing is not required (cf. VwGH May 9, 2023, Ro 2020/04/0037, Rn. 81, mwN). 38 The decision on reimbursement of expenses is based on Sections 47 ff VwGG in particular Section 1 Paragraph 1 Letter a VwGH Expense Reimbursement Ordinance, according to which the flat rate amount for the filing costs for the submission of the Revision contrary to the recorded flat rate of € 2,180.-- only € 1,106.40. Sales tax is not separate according to Section 47 Paragraph 1 VwGG to be awarded because this is already included in the flat-rate written expenses is included (see on the latter VwGH April 10, 2020, Ra 2018/04/0154 to 0155, 34). Vienna, February 1, 2024 Administrative Court Judenplatz 11, 1010 Vienna www.vwgh.gv.at