BVwG - W245 2239715-1: Difference between revisions
From GDPRhub
(Created page with "{{COURTdecisionBOX |Jurisdiction=Austria |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=BVwG |Court_Original_Name=Bundesverwaltungsgericht |Court_English_Nam...") |
(→Facts) |
||
| Line 68: | Line 68: | ||
}} | }} | ||
The Federal Administrative Court ordered a credit reference agency to erase data on a € 42,70 debt that had been settled in 2019, partially overturning a decision by the Austrian DPA. | |||
== English Summary == | == English Summary == | ||
=== Facts === | === Facts === | ||
In January 2020, the data subject requested access under [[Article 15 GDPR|Article 15 GDPR]] from an Austrian credit reference agency (controller). The controller replied that it processed (among other data) eleven | In January 2020, the data subject requested access under [[Article 15 GDPR|Article 15 GDPR]] from an Austrian credit reference agency (controller). The controller replied that it processed (among other data) eleven database entries on the data subject, concerning debts that had not been settled on time. The debts ranged between €42,70 and €186,84. At the time of the reply to the access request, all debts had been settled; some already in July 2014, others only in September 2019. Furthermore, the controller processed eight data sets on (former) addresses of the data subject. | ||
The data subject requested the controller to erase all data, arguing | The data subject requested the controller to erase all data, arguing that she had not been able to get a loan to buy furniture for her apartment due to a low credit score assigned by the controller as a consequence of the processed data on previous debts. The data subjected also stated to have been employed for over a year with a high income and that she had been able to settle all debts. Hence her creditworthiness should be considered restored. | ||
The controller erased a | The controller erased a database entry on a €72,95 debt from 2019, but refused to delete anything else, arguing that there was no reason for erasure under [[Article 17 GDPR|Article 17 GDPR]] as the processing was still necessary and lawful under [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. | ||
In June 2020, the data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB), arguing that further processing of the data was not necessary due to the low amount of the individual debts and the fact that all debts have already been settled. Hence, the interests of the data subject also outweighed those of the controller under [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. The controller contested these arguments but erased two further | In June 2020, the data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB), arguing that further processing of the data was not necessary due to the low amount of the individual debts and the fact that all debts have already been settled. Hence, the interests of the data subject also outweighed those of the controller under [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. The controller contested these arguments but erased two further database entries on previous debts (on a €37,70 debt and a €46,45 debt, both settled in 2014) and several old addresses. | ||
In September 2020, following a further exchange of submissions before the DSB, the controller deleted four more | In September 2020, following a further exchange of submissions before the DSB, the controller deleted four more database entries (on debts ranging from €85,40 to €186,84, all settled in 2014 and 2015) and another old address. | ||
In December 2020, the DSB issued a decision, holding that the controller violated the data subjects right to erasure under [[Article 17 GDPR|Article 17 GDPR]] by not deleting | In December 2020, the DSB issued a decision, holding that the controller violated the data subjects right to erasure under [[Article 17 GDPR|Article 17 GDPR]] by not deleting database entries on a €85,40 debt, a €102,69 debt (both settled in 2015), a €191,74 debt and a €186,84 debt (both settled in 2014) and ordered the controller to delete this data (overlooking that the controller had already erased the data on these debts - see below). Regarding the processing of a database entry on a €42,70 debt (settled in 2019) and the processing of old addresses, the DSB dismissed the complaint as it considered the controller's interests to outweigh those of the data subject. | ||
Both the controller and the data subject appealed the decision. | Both the controller and the data subject appealed the decision, mostly repeating their arguments so far. | ||
In April 2022, in the course of the procedure before the BVwG, the controller erased another three database entries concerning a €168,89 debt, a €170,61 and a €38 debt (all settled in 2016). Hence, the only a database entries remaining in the controllers database were a €42,70 debt settled in 2019 and the data subject's current address. | |||
=== Holding === | |||
The Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG) partially upheld both appeals. It held that the DSB had failed to notice that the database entries which the DSB ordered the controller to erase had already been erased by the time the DSB issued its decision. Hence, the alleged violation of [[Article 17 GDPR]] had already been remedied and the data subject had no legal interest in a decision on this violation. | |||
Concerning the €42,70 debt settled in 2019, the BVwG pointed out that the debt had been settled already two years and a eight months ago and within a relatively short time (two and a half months) after being reported to the controller. Furthermore, the debt as such was very low and was now the only remaining database entry, so there was no "cumulation of negative database entries". Lastly, the BVwG held that both the controller and the DSB had failed to take into account the data subject's improved financial situation (employment with a solid income) when assessing their creditworthiness. | |||
These circumstances led the BVwG to the conclusion that the database entry was no longer relevant for assessing the data subject's creditworthiness and that the data subject's interest outweighed those of the controller. Hence, it held that the controller had unlawfully processed data on the €42,70 debt and ordered the controller to erase it. | |||
Concerning the data subject's current address, the BVwG held that the controller's interest outweighed those of the data subject. | |||
== Comment == | == Comment == | ||
' | Since both the controller and the data subject appealed the DSB's decsion, the BVwG issued two identical decisions, see [https://www.ris.bka.gv.at/Dokument.wxe?ResultFunctionToken=cb59a64a-f54c-439d-95c0-f1ada319b895&Position=1&SkipToDocumentPage=True&Abfrage=Bvwg&Entscheidungsart=Undefined&SucheNachRechtssatz=True&SucheNachText=True&GZ=&VonDatum=01.01.2014&BisDatum=&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=EinerWoche&ResultPageSize=100&Suchworte=DSGVO&Dokumentnummer=BVWGT_20220629_W245_2239778_1_00 here] for the second decision. | ||
It is remarkable that the controller deleted 10 of 11 database entries on debts in the course of the procedures before the DSB and the BvWG. This creates the impression of a rearguard battle, where the controller tried to avoid a negative decision by gradually giving in to the data subject's request for erasure. In the end, the BVwG ordered the erasure of the 11<sup>th</sup> debt and the data subject succeeded in having her creditworthiness restored - <u>two and a half years</u> after encountering problems due to the low creditworthiness assigned by the controller. | |||
== Further Resources == | == Further Resources == | ||
Revision as of 12:47, 2 September 2022
| BVwG - W245 2239715-1 | |
|---|---|
 | |
| Court: | BVwG (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 6 GDPR Article 17 GDPR |
| Decided: | 29.06.2022 |
| Published: | 26.08.2022 |
| Parties: | unknown data subject (complainant before the DSB) unknown credit reference agency (respondent before the DSB) Austrian Data Protection Authority (DSB) |
| National Case Number/Name: | W245 2239715-1 |
| European Case Law Identifier: | ECLI:AT:BVWG:2022:W245.2239715.1.00 |
| Appeal from: | DSB 2020-0.779.574 (DSB-D124.2275) |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Rechtsinformationssystem des Bundes (in German) |
| Initial Contributor: | n/a |
The Federal Administrative Court ordered a credit reference agency to erase data on a € 42,70 debt that had been settled in 2019, partially overturning a decision by the Austrian DPA.
English Summary
Facts
In January 2020, the data subject requested access under Article 15 GDPR from an Austrian credit reference agency (controller). The controller replied that it processed (among other data) eleven database entries on the data subject, concerning debts that had not been settled on time. The debts ranged between €42,70 and €186,84. At the time of the reply to the access request, all debts had been settled; some already in July 2014, others only in September 2019. Furthermore, the controller processed eight data sets on (former) addresses of the data subject.
The data subject requested the controller to erase all data, arguing that she had not been able to get a loan to buy furniture for her apartment due to a low credit score assigned by the controller as a consequence of the processed data on previous debts. The data subjected also stated to have been employed for over a year with a high income and that she had been able to settle all debts. Hence her creditworthiness should be considered restored.
The controller erased a database entry on a €72,95 debt from 2019, but refused to delete anything else, arguing that there was no reason for erasure under Article 17 GDPR as the processing was still necessary and lawful under Article 6(1)(f) GDPR.
In June 2020, the data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB), arguing that further processing of the data was not necessary due to the low amount of the individual debts and the fact that all debts have already been settled. Hence, the interests of the data subject also outweighed those of the controller under Article 6(1)(f) GDPR. The controller contested these arguments but erased two further database entries on previous debts (on a €37,70 debt and a €46,45 debt, both settled in 2014) and several old addresses.
In September 2020, following a further exchange of submissions before the DSB, the controller deleted four more database entries (on debts ranging from €85,40 to €186,84, all settled in 2014 and 2015) and another old address.
In December 2020, the DSB issued a decision, holding that the controller violated the data subjects right to erasure under Article 17 GDPR by not deleting database entries on a €85,40 debt, a €102,69 debt (both settled in 2015), a €191,74 debt and a €186,84 debt (both settled in 2014) and ordered the controller to delete this data (overlooking that the controller had already erased the data on these debts - see below). Regarding the processing of a database entry on a €42,70 debt (settled in 2019) and the processing of old addresses, the DSB dismissed the complaint as it considered the controller's interests to outweigh those of the data subject.
Both the controller and the data subject appealed the decision, mostly repeating their arguments so far.
In April 2022, in the course of the procedure before the BVwG, the controller erased another three database entries concerning a €168,89 debt, a €170,61 and a €38 debt (all settled in 2016). Hence, the only a database entries remaining in the controllers database were a €42,70 debt settled in 2019 and the data subject's current address.
Holding
The Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG) partially upheld both appeals. It held that the DSB had failed to notice that the database entries which the DSB ordered the controller to erase had already been erased by the time the DSB issued its decision. Hence, the alleged violation of Article 17 GDPR had already been remedied and the data subject had no legal interest in a decision on this violation.
Concerning the €42,70 debt settled in 2019, the BVwG pointed out that the debt had been settled already two years and a eight months ago and within a relatively short time (two and a half months) after being reported to the controller. Furthermore, the debt as such was very low and was now the only remaining database entry, so there was no "cumulation of negative database entries". Lastly, the BVwG held that both the controller and the DSB had failed to take into account the data subject's improved financial situation (employment with a solid income) when assessing their creditworthiness.
These circumstances led the BVwG to the conclusion that the database entry was no longer relevant for assessing the data subject's creditworthiness and that the data subject's interest outweighed those of the controller. Hence, it held that the controller had unlawfully processed data on the €42,70 debt and ordered the controller to erase it.
Concerning the data subject's current address, the BVwG held that the controller's interest outweighed those of the data subject.
Comment
Since both the controller and the data subject appealed the DSB's decsion, the BVwG issued two identical decisions, see here for the second decision.
It is remarkable that the controller deleted 10 of 11 database entries on debts in the course of the procedures before the DSB and the BvWG. This creates the impression of a rearguard battle, where the controller tried to avoid a negative decision by gradually giving in to the data subject's request for erasure. In the end, the BVwG ordered the erasure of the 11th debt and the data subject succeeded in having her creditworthiness restored - two and a half years after encountering problems due to the low creditworthiness assigned by the controller.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
decision date
06/29/2022
standard
B-VG Art133 Para.4
GDPR Art17
GDPR Art6
VwGVG §28 para
VwGVG §31 para
saying
W245 2239715-1/22E
W245 2239778-1/17E
IN THE NAME OF THE REPUBLIC!
I. The Federal Administrative Court, judged by Mag. Bernhard SCHILDBERGER, LL.M. as chairman and Mag.a Viktoria HAIDINGER as expert lay judge and Mag. Thomas GSCHAAR as expert lay judge on the complaint of XXXX , born on XXXX , represented by URBAN, MEISSNER, LAHERSTORFER GesbR Rechtsanwälte, Linzer Straße 46a, 4810 Gmunden, against the decision of Data protection authority of December 21, 2020, Zl. 2020-0.779.574 (DSB-D124.2275), regarding the violation of the right to erasure in accordance with Art. 17 GDPR, rightly recognized or decided after an oral hearing:
a)
I. Points 1 and 2 of the contested decision will be remedied without replacement and the proceedings will be discontinued as irrelevant.
II. The appeal against point 3 of the contested decision is partially granted and it is determined that XXXX violated the complainant XXXX's right to deletion by XXXX positively settling the claim of €42.00 on September 11, 2019 .70 has not deleted. The XXXX is instructed to delete the data of the complainant XXXX to this extent within a period of four weeks, otherwise execution.
b)
The revision is permissible according to Art. 133 Para. 4 B-VG.
II. The Federal Administrative Court, judged by Mag. Bernhard SCHILDBERGER, LL.M. as chairman and Mag.a Viktoria HAIDINGER as expert lay judge and Mag. Thomas GSCHAAR as expert lay judge on the complaint by XXXX, represented by Baker McKenzie Rechtsanwälte LLP & Co KG, Schottenring 25, 1010 Vienna, against the decision of the data protection authority of December 21, 2020 , Zl. 2020-0.779.574 (DSB-D124.2275), regarding the violation of the right to erasure in accordance with Art. 17 GDPR, after an oral hearing, rightly decided:
A) Points 1 and 2 of the contested decision will be remedied without replacement and the proceedings will be discontinued as irrelevant.
B) The revision is inadmissible according to Art. 133 Para. 4 B-VG.
text
Reasons for decision:
I. Procedure:
I.1. Based on a request for information from complainant XXXX (hereinafter also "BF1") dated January 7th, 2020, complainant XXXX (hereinafter also "BF2") provided information in accordance with Art. 15 GDPR on January 8th, 2020 (VWA ./1, see point II.2).
As part of the provision of information, BF2 informed BF1 that they had stored the following payment experience and address data as well as data on corporate functions and powers of representation:
payment experiences
opened
Closed
capital claim
Open
claim status
payment status
origin of the information
06/28/2019
09/11/2019
€42.70
€0.00
out of court. operation
done positively
XXXX
06/11/2019
09/11/2019
€72.95
€0.00
out of court. operation
done positively
XXXX
08/25/2015
07.09.2016
€168.89
€0.00
out of court. operation
done positively
XXXX
08/25/2015
07.09.2016
€170.61
€0.00
out of court. operation
done positively
XXXX
12/10/2015
02/17/2016
€38.00
€0.00
out of court. operation
done positively
XXXX
09/25/2014
09/25/2014
€37.70
€0.00
out of court. operation
done positively
XXXX
03/10/2014
09/25/2014
€46.45
€0.00
out of court. operation
done positively
XXXX
02/06/2015
03/19/2015
€85.40
€0.00
out of court. operation
done positively
XXXX
05.01.2015
03/19/2015
€102.69
€0.00
out of court. operation
done positively
XXXX
02/24/2014
07/09/2014
€191.74
€0.00
out of court. operation
done positively
XXXX
02/24/2014
07/09/2014
€186.84
€0.00
out of court. operation
done positively
XXXX
names and addresses
Surname
Date of birth
Street
Postcode
location
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
Entrepreneurial functions and powers of representation
Of
until
relationship
address
amount
Portion
XXXX
owner
XXXX
I.2. On January 8th, 2020, BF1 applied to BF2 for the deletion of the entries. She justified the request for deletion by saying that she had been in an upright employment relationship for a year, had a high income and was therefore able to settle the outstanding claims (VWA ./2, see point II.2).
I.3. In a letter dated January 14, 2020, BF2 stated that there is only a right to erasure if the processing of the data is unlawful, there is no longer a processing purpose or legitimate grounds for objection under Article 21 GDPR can be proven. The GDPR does not provide for a right to erasure without giving reasons (VWA ./3, see point II.2).
I.4. On February 18, 2020, BF2 again provided information in accordance with Art. 15 GDPR. This was sent to the Chamber of Labor XXXX (VWA ./4, see point II.2).
As part of the provision of information, BF2 stated that it had saved the following payment experience and address data as well as data on corporate functions and powers of representation for BF1:
payment experiences
opened
Closed
capital claim
Open
claim status
payment status
origin of the information
06/28/2019
09/11/2019
€42.70
€0.00
out of court. operation
done positively
XXXX
08/25/2015
07.09.2016
€168.89
€0.00
out of court. operation
done positively
XXXX
08/25/2015
07.09.2016
€170.61
€0.00
out of court. operation
done positively
XXXX
12/10/2015
02/17/2016
€38.00
€0.00
out of court. operation
done positively
XXXX
09/25/2014
09/25/2014
€37.70
€0.00
out of court. operation
done positively
XXXX
03/10/2014
09/25/2014
€46.45
€0.00
out of court. operation
done positively
XXXX
02/06/2015
03/19/2015
€85.40
€0.00
out of court. operation
done positively
XXXX
05.01.2015
03/19/2015
€102.69
€0.00
out of court. operation
done positively
XXXX
02/24/2014
07/09/2014
€191.74
€0.00
out of court. operation
done positively
XXXX
02/24/2014
07/09/2014
€186.84
€0.00
out of court. operation
done positively
XXXX
names and addresses
Surname
Date of birth
Street
Postcode
location
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
Entrepreneurial functions and powers of representation
Of
until
relationship
address
amount
Portion
XXXX
owner
XXXX
In a separate letter, BF2 informed the Chamber of Labor XXXX and BF1 on February 18th, 2020 that a right to deletion only exists if the processing of the data is unlawful, there is no longer a processing purpose or legitimate grounds for objection according to Art. 21 DSGVO can be proven. A right to erasure without giving reasons is not provided for in the GDPR (VWA ./5, see point II.2).
I.5. In a letter dated April 20, 2020, BF1, through its legal representative URBAN, MEISSNER, LAHERSTORFER GesbR Rechtsanwälte, requested BF2 to delete all personal data of BF1 in accordance with Section 45 Paragraph 1 Z. 1 DSG, as this, for the purposes for which they were collected or otherwise processed are no longer necessary (VWA ./6, see point II.2). In an e-mail dated April 21, 2020, BF2 replied that the objected data records could not be deleted because processing to assess the creditworthiness was still necessary (VWA ./7, see point II.2).
I.6. On June 2, 2020, BF1 lodged a complaint (application to initiate proceedings) with the Austrian data protection authority (responsible authority, hereinafter also "bB") and essentially stated that further processing was no longer necessary due to the small amount and the repayment that had already taken place be. There is also no overriding legitimate interest with regard to the storage of address data. Due to the fact that the deletion did not take place, the creditworthiness of BF1 was distorted. It is therefore sought to determine the violation of the right to erasure (VWA ./8, see point II.2).
I.7. On June 9th, 2020, the BF1 made a request to the BA (VWA ./9, see point II.2). In a letter dated June 16, 2020, the BA asked BF2 to comment (VWA ./9, see point II.2). On July 24th, 2020, the BA informed the BF1 about the current status of the procedure (VWA ./11, see point II.2).
I.8. In the statement of August 25th, 2020 (VWA ./12, see point II.2), the BF2 explained that within the scope of their business licenses according to § 152 of the Trade Code 1994 (GewO) they receive information related to the creditworthiness (creditworthiness). would, process.
The legal basis under data protection law for the processing of personal data relevant to creditworthiness in the BF2 database would be legitimate interests under Article 6 (1) (f) GDPR. The payment experiences that are still stored for BF1 date from the years 2014 to 2019 and were paid between 2014 and 2019. The payment experience data processed by BF2 for BF1 are still relevant to creditworthiness and storage in the BF2 database is therefore still necessary.
If the request for the deletion of BF1 were fully complied with, this would paint a distorted and incorrect picture of the creditworthiness of BF1. The interest of contractual partners of BF1 who make advance payments to receive information about their defaulting payment behavior outweighs BF1's interest in secrecy. Furthermore, it can also be inferred from the legally prescribed review of solvency before a loan transaction (§ 7 Para. 1 VKrG and § 9 Para. 1 HIKrG) that BF2 or third parties have an overriding legitimate interest. The number of claims collected by a collection agency is also a key factor in determining whether a claim can remain in the BF2 database. Due to the accumulation of numerous payment histories, even claims would have to remain in the database, which otherwise - considered in isolation - would no longer be relevant for the creditworthiness of BF1 due to their amount or age, since the synopsis of the claims processed would reveal a significant Statement about the creditworthiness or the payment history of BF1 would result. For the assessment of the creditworthiness of a (potential) debtor or the risk of a claim, data on any payment defaults over a period of at least five years is relevant (with reference to the BVwG decision of October 30, 2019, W258 2216873-1/7E). The remaining claims that are the subject of the proceedings, which were only settled less than five years ago, are therefore still necessary for the assessment of the creditworthiness of BF1. The remaining claims that were repaid outside of an observation period of five years continue to be relevant to creditworthiness, since a significant statement about the creditworthiness and payment behavior of BF1 can only be made by looking at the number and amount of the claims made. All payment experiences that would be processed for BF2 are necessary for this overview. There is therefore no reason for deletion under Art. 17 GDPR.
Furthermore, with a statement dated August 25, 2020, information was again issued in accordance with Art. 15 GDPR (VWA ./13, see point II.2). In this regard, BF2 stated that two stored payment experiences were no longer applicable/relevant due to a request from XXXX. That's why BF2 deleted these payment experiences.
As part of the provision of information, BF2 stated that it had saved the following payment experience and address data as well as data on corporate functions and powers of representation for BF1:
payment experiences
opened
Closed
capital claim
Open
claim status
payment status
origin of the information
06/28/2019
09/11/2019
€42.70
€0.00
out of court. operation
done positively
XXXX
08/25/2015
07.09.2016
€168.89
€0.00
out of court. operation
done positively
XXXX
08/25/2015
07.09.2016
€170.61
€0.00
out of court. operation
done positively
XXXX
12/10/2015
02/17/2016
€38.00
€0.00
out of court. operation
done positively
XXXX
02/06/2015
03/19/2015
€85.40
€0.00
out of court. operation
done positively
XXXX
05.01.2015
03/19/2015
€102.69
€0.00
out of court. operation
done positively
XXXX
02/24/2014
07/09/2014
€191.74
€0.00
out of court. operation
done positively
XXXX
02/24/2014
07/09/2014
€186.84
€0.00
out of court. operation
done positively
XXXX
names and addresses
Surname
Date of birth
Street
Postcode
location
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
Entrepreneurial functions and powers of representation
Of
until
relationship
address
amount
Portion
XXXX
owner
XXXX
With regard to stored addresses, BF2 stated that it had stored all addresses, with the exception of BF1's current address and the address of BF1, which was used in connection with its business. In this context, an excerpt from the Austrian Trade Information System was enclosed with the statement (VWA ./14, see point II.2).
I.9. On August 27, 2020, the BA asked the BF1 to comment (VWA ./15, see point II.2). In the statement of August 31, 2020 (VWA ./16, see point II.2), BF1 explained through its legal representation that it was not correct that the payment experience data it continued to process was relevant to creditworthiness. The argument that the complete deletion of all data would result in a distorted and incorrect picture of their creditworthiness is countered by the fact that the storage of the data itself would convey a distorted picture. This data would come from a time when BF1 was in financial difficulties. She now has a permanent job and a fixed income. This would give business people the impression that BF1's creditworthiness was bad, even though it had an income. This procedure would hinder BF1 from doing business. The deletion would not create the false impression of better creditworthiness, as suggested by BF2, but only their actual creditworthiness would be shown. In addition, the storage of the available data gave the wrong impression of a poorer credit rating for BF1.
The assertion that the creditors suffered enormous financial damage as a result of the payment difficulties is also incomprehensible, especially since the amounts involved were only small and these had already been settled.
Furthermore, the BVwG decision of October 30, 2019, GZ W258 2216873-1/7E cited by BF2 is not comparable with the present case, since it is about the fulfillment of a payment plan, which means that there is a completely different risk for business people. In addition, it is stated in this decision that a weighing of interests must always be carried out on a case-by-case basis. In doing so, the legitimate interests of the person responsible or a third party for the processing, the interests or fundamental rights and freedoms of the person concerned, who demand the protection of personal data, are to be compared. In addition, the present decision related to liabilities in the amount of EUR 181,000. This is not comparable to the present complaint. The same standards should therefore not be applied.
With regard to the stored addresses, there is absolutely no interest in storing them. The storage of registration addresses is intended to protect potential landlords in order to point out possible rental nomads. The storage does not pursue any other purpose. The registered registration data does not contain any indication that BF1 is a rental nomad.
I.10. In a letter dated September 8th, 2020, the BA asked BF2 to comment. The request was sent by email on September 12, 2020 (VWA ./17, see point II.2).
I.11. Based on a request for information from BF1 on June 30, 2020, information was provided by BF2 on September 23, 2020 in accordance with Art. 15 GDPR (VWA ./18, see point II.2). This information was sent to the BA in the course of the statement by BF1 on September 29, 2020 (see point I.12 below).
As part of the provision of information, BF2 stated that it had saved the following payment experience and address data as well as data on corporate functions and powers of representation for BF1:
payment experiences
opened
Closed
capital claim
Open
claim status
payment status
origin of the information
06/28/2019
09/11/2019
€42.70
€0.00
out of court. operation
done positively
XXXX
08/25/2015
07.09.2016
€168.89
€0.00
out of court. operation
done positively
XXXX
08/25/2015
07.09.2016
€170.61
€0.00
out of court. operation
done positively
XXXX
12/10/2015
02/17/2016
€38.00
€0.00
out of court. operation
done positively
XXXX
names and addresses
Surname
Date of birth
Street
Postcode
location
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
Entrepreneurial functions and powers of representation
Of
until
relationship
address
amount
Portion
XXXX
owner
XXXX
I.12. In a supplementary statement in a letter dated September 29, 2020 (VWA ./19, see point II.2), the BF1 explained that it was simply wrong that the BVwG and the DSB considered storage of at least five years for small amounts to be proportionate would deem. In this context, reference is made to the notification of the BA of September 20, 2019, DSB-D123.319/002-DSB/2019. In this decision, the bB stated unequivocally that the duration of the storage of payment experience data varies according to previous decisions and previous case law. In the case of fully paid debts, they are deleted after five years at the latest. An assessment must always be made on a case-by-case basis. The amount, the age, the number of claims, the origin of the data and the time that has elapsed since the settlement should be taken into account. For this reason, it could not be in the overriding interest of BF2 that three amounts between €38 and €170.61, which originate from 2015 and were paid more than four years ago, would be saved. Likewise, BF2 has no overriding interest in storing an amount of €42.70, which was paid more than a year ago due to the duration of the proceedings in question.
With regard to the stored addresses, it should be noted that this storage is also not in the overriding interest of BF2. Reference is made to the previous submissions of BF1. Even the blanket reference by BF2 to the case law of the BVwG and the decision of the DSB cannot change anything.
I.13. With a decision dated December 21, 2020 (VWA ./20, see point II.2), the BA partially upheld the complaint and found that BF2 had violated BF1 in its right to deletion by responding to the request for deletion by The procedure in question was not complied with and the claims of €85.40 and €102.69 positively settled on March 19, 2015, and the claims of €191.74 and €186.84 positively settled on July 9, 2014 ( point 1.). The BF2 is instructed to delete this data of the BF1 within a period of 4 weeks, otherwise execution (paragraph 2). Otherwise, the complaint was dismissed as unfounded (paragraph 3).
The decision of the BA contains the following findings:
Payment experiences:
opened
Closed
capital claim
Open
claim status
payment status
origin of the information
06/28/2019
09/11/2019
€42.70
€0.00
out of court. operation
done positively
XXXX
08/25/2015
07.09.2016
€168.89
€0.00
out of court. operation
done positively
XXXX
08/25/2015
07.09.2016
€170.61
€0.00
out of court. operation
done positively
XXXX
12/10/2015
02/17/2016
€38.00
€0.00
out of court. operation
done positively
XXXX
02/06/2015
03/19/2015
€85.40
€0.00
out of court. operation
done positively
XXXX
05.01.2015
03/19/2015
€102.69
€0.00
out of court. operation
done positively
XXXX
02/24/2014
07/09/2014
€191.74
€0.00
out of court. operation
done positively
XXXX
02/24/2014
07/09/2014
€186.84
€0.00
out of court. operation
done positively
XXXX
names and addresses
Surname
Date of birth
Street
Postcode
location
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
Entrepreneurial functions and powers of representation
Of
until
relationship
address
amount
Portion
XXXX
owner
XXXX
In this regard, the BA explained the following in legal terms: From the BF2 database it can be inferred that eight claims are currently being stored. However, it can be seen that four claims had already been settled more than five years ago. Specifically, these are the claims of €85.40 and €102.69 positively settled on March 19, 2015 and the claims of €191.74 and €186.84 positively settled on July 9, 2014. Contrary to the opinion of the BF1, not only the current income and solvency should be taken into account when assessing the creditworthiness, but also past claims should be used. The bB has already stated that past insolvency can also represent an essential basis for a credit check, since past payment defaults can be used to draw a conclusion about future solvency (cf. the decision of the DSB of 20.05.2019, GZ DSB-D123 .828/0001-DSB/2019). In the present case, the bB does not see any indications that would give reason in this individual case to deviate from the above-mentioned judicature of the BVwG with regard to the permissible storage period of creditworthiness data for a period of five years.
With regard to the arguments of BF1 regarding the processing of address data, it should be pointed out that the Federal Administrative Court, in its decision of October 30, 2019, W258 2216873-1, considered the processing of (historical) address data by credit agencies to be permissible for a period of five years, which is why the appeal was dismissed on this point.
The contested decision was sent by letter to BF1 on December 29, 2020 and allegedly delivered on December 31, 2020. The decision was sent to BF2 by email on December 29, 2020 (VWA ./24, see point II.2).
I.14. The complaint of the BF1 (VWA ./21, see point II.2), which was raised on January 25, 2021, was directed against the decision of the BA. In the complaint, BF1 essentially repeated its previous submissions (see points I.9 and I.12) and requested that its rights be declared infringed and all data stored by BF2 to be deleted. A wage slip from BF1 (VWA ./22, see point II.2) and the information from BF2 to BF1 in accordance with Art. 15 GDPR dated September 23, 2020 (VWA ./18, see point I.11 above) were enclosed with the complaint .
I.15. The complaint raised by BF2 in due time on January 26, 2021 by legal representative Baker McKenzie (VWA ./23, see point II.2) was directed against the decision of the bB against points 1 and 2. In the complaint, BF2 led in addition that the storage period for payment experience data is at least five years and that processing of the payment experience data at issue in the proceedings is permissible for a period of seven years.
I.16. The complaints in question and the related administrative act (including the were submitted to the Federal Administrative Court (hereinafter also "BVwG") by letter dated February 17, 2021 by the bB (VWA ./24, see point II.2). In the statement in the course of the file submission, the BA referred in full to the contested decision and requested that the complaints be dismissed.
The file was received by the BVwG on February 19, 2021 (OZ 1 to W245 2239715-1).
I.17. In a letter dated February 26, 2021, the BVwG requested the bB to comment and submit documents (OZ 3 to W245 2239715-1). The request was answered by the bB with a letter dated March 5th, 2021 (OZ 4 to W245 2239715-1). In its statement of March 5, 2021, the BA explained that the statement of BF2 of September 25, 2020 mentioned by the complainants in the complaints about the decision and the information provided by BF2 in accordance with Art. 15 GDPR were not available at the time the decision was issued.
I.18. At the request of the BVwG, BF1 (OZ 7 to W245 2239715-1) and BF2 (OZ 8 to W245 2239715-1) submitted a statement. Both the BF1 and the BF2 have sent the BVwG the opinion of the BF2 of September 25th, 2020. Contrary to the statements of the BA (see I.17), the BF2 demonstrated that it sent its statement of September 25, 2020 and its information in accordance with Art. 15 GDPR of September 23, 2020 (VWA ./18) to the BA on September 25, 2020 by mail delivered.
I.19. On March 19, 2021, a complaint hearing was scheduled for April 9, 2021 (OZ 10 to W245 2239715-1). BF2 issued a statement on April 6th, 2021. The statement was accompanied by information in accordance with Art. 15 GDPR dated April 6th, 2021 (OZ 12 to W245 2239715-1).
I.20. The BVwG conducted a complaint hearing on April 9th, 2021. BF1 and BF2 did not appear and were represented in the complaint hearing by their legal representatives (OZ 15 to W245 2239715-1).
I.21. On April 5, 2022, BF2 announced that the following payment experiences had been deleted (OZ 16 to W245 2239715-1):
opened
Closed
capital claim
Open
claim status
payment status
origin of the information
08/25/2015
07.09.2016
€168.89
€0.00
out of court. operation
done positively
XXXX
08/25/2015
07.09.2016
€170.61
€0.00
out of court. operation
done positively
XXXX
12/10/2015
02/17/2016
€38.00
€0.00
out of court. operation
done positively
XXXX
During the hearing of the parties, no statement was submitted by the BA and the BF1 (OZ 17 to W245 2239715-1).
II. The Federal Administrative Court considered:
II.1. Findings:
The facts relevant to the decision are clear.
II.1.1. About the procedure:
The course of the procedure described under point I is determined and used as a basis for the decision.
II.1.2. Regarding the personal data processed by complainant XXXX about complainant XXXX:
II.1.2.1. About the payment experience:
opened
Closed
capital claim
Open
claim status
payment status
origin of the information
06/28/2019
09/11/2019
€42.70
€0.00
out of court. operation
done positively
XXXX
II.1.2.2. For names and addresses:
Surname
Date of birth
Street
Postcode
location
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
XXXX
II.1.2.3. Regarding corporate functions and powers of representation:
Of
until
relationship
address
amount
Portion
XXXX
XXXX
XXXX
II.1.3. On the lawfulness of the processing by complainant XXXX:
The BF2 bases its lawfulness of the processing only on Art. 6 Para. 1 lit. f GDPR.
II.1.4. Regarding complainant XXXX's restricted access to economic life:
Due to the entries (payment experiences), it was not possible for BF1 to apply for a loan to get the essential inventory for their apartment.
II.1.5. Regarding the improved creditworthiness of complainant XXXX:
BF1 has been employed at XXXX as a worker since April 2019 and has a fixed income.
Before April 2019, BF1 was irregularly employed by different employers, sometimes only marginally.
II.1.6. Regarding the payment experiences that had already been deleted at the time the disputed decision was issued:
On September 23, 2020, BF2 provided information to BF1 in accordance with Art. 15 GDPR. This information was provided to the BA on September 25th, 2020. The processing of the following payment experiences was reported in this disclosure:
opened
Closed
capital claim
Open
claim status
payment status
origin of the information
06/28/2019
09/11/2019
€42.70
€0.00
out of court. operation
done positively
XXXX
08/25/2015
07.09.2016
€168.89
€0.00
out of court. operation
done positively
XXXX
08/25/2015
07.09.2016
€170.61
€0.00
out of court. operation
done positively
XXXX
12/10/2015
02/17/2016
€38.00
€0.00
out of court. operation
done positively
XXXX
In the disputed decision, the bB discussed the following payment experiences, although it was aware of the notification from BF2 on September 25, 2020 that these were no longer processed by BF2:
opened
Closed
capital claim
Open
claim status
payment status
origin of the information
02/06/2015
03/19/2015
€85.40
€0.00
out of court. operation
done positively
XXXX
05.01.2015
03/19/2015
€102.69
€0.00
out of court. operation
done positively
XXXX
02/24/2014
07/09/2014
€191.74
€0.00
out of court. operation
done positively
XXXX
02/24/2014
07/09/2014
€186.84
€0.00
out of court. operation
done positively
XXXX
II.2. Evidence assessment:
Evidence was collected by inspecting the administrative file of the bB [hereinafter referred to as "VWA" with the components ./1 - information from BF2 to BF1 in accordance with Art. 15 GDPR from January 8th, 2020 (see point I.1), ./2 - Application from BF1 to BF2 to delete the entries from January 8th, 2020 (see point I.2), ./3 - Notification from BF2 to BF1 from January 14th, 2020 (see point I.3), ./4 - information the BF2 to the Chamber of Labor XXXX (BF1) according to Art. 15 GDPR from February 18th, 2020 (see point I.4), ./5 - Letter from the BF2 to the Chamber of Labor XXXX (BF1) from February 18th, 2020 (see point I.4 ), ./6 - Letter of request from BF1 by way of its legal representative for the deletion of personal data dated April 20, 2020 (see point I.5), ./7 - Rejection by BF2 regarding the deletion of personal data of BF1 from April 21, 2020 (see point I.5), ./8 - Complaint (application to initiate proceedings) from BF1 to the BA with letter dated May 27th, 2020, received on June 2nd, 2020 (see point I.6), ./9 - Request from BF1 to the BA dated 09.06.2020 (see point I.7), ./10 - Request from the bB to BF2 for a statement by letter dated June 16, 2020, sent by email on June 30, 2020 (see point I.7), ./11 - Notification of bB to the BF1 about the current status of the procedure from July 24th, 2020 (see point I.7), ./12 - Statement from the BF2 from August 25th, 2020 (see point I.8), ./13 - Statement from the BF2 from August 25th, 2020 - Enclosed information from BF2 to BF1 according to Art. 15 GDPR from August 25th, 2020 (see point I.8), ./14 - Statement from BF2 from August 25th, 2020 - Enclosure GISA regarding BF1 (see point I.8), ./ 15 - Request from the bB to BF1 for a statement in a letter dated August 27th, 2020 (see point I.9), ./16 - Statement by the BF1 in a letter dated August 31st, 2020, sent by e-mail on September 4th, 2020 (see point I .9), ./17 - Request from the BA to BF2 for additional comments in a letter dated September 8th, 2020, sent by email on September 12th, 2020 (see point I.10), ./18 - Information from BF2 to BF1 according to Art. 15 GDPR from September 23, 2020 (see item t I.11), ./19 - Supplementary statement by the BF1 of September 29, 2020, retransmitted on November 24, 2020 (see point I.12), ./20 - Notification of the bB of December 21, 2020 (see point I.13 ), ./21 - Complaint by BF1 of 01/25/2021 (see point I.14), ./22 - Complaint by BF1 of 01/25/2021 - Attachment of wage slips of BF1 (see point I.14), ./23 - Complaint the BF2 of January 26th, 2021 (see point I.15) and ./24 - file submission by bB with letter of February 17th, 2021 (see point I.16)] as well as in the court file of the BVwG (file components are with ordinal number, in short "OZ marked).
II.2.1. About the procedure:
The above procedure results from the unobjectionable and indubitable file content of the submitted administrative file of the bB and the court file of the BVwG.
II.2.2. Regarding the personal data processed by complainant XXXX about complainant XXXX:
The findings regarding payment experiences, names and addresses and entrepreneurial functions and powers of representation result without a doubt from the minutes of the complaint hearing (OZ 15 to W245 2239715-1, page 4 f) taking into account the input of BF2 (OZ 16 to W245 2239715-1). These were not substantially refuted by the parties to the proceedings. Appropriate determinations had to be made.
II.2.3. On the lawfulness of the processing by complainant XXXX:
This finding is based on the information provided by BF2 (cf. for example VWA ./7, ./12). Other aspects that could justify the lawfulness of the processing, such as consent from BF1, fulfillment of a contract, etc. (cf. Art. 6 Para. 1 lit. a-e GDPR) did not emerge in the process or were not addressed by BF2 either claims.
II.2.4. Regarding complainant XXXX's restricted access to economic life:
The statement to that effect results without a doubt from the information provided by BF1 (VWA ./2), which was not disputed by the parties.
II.2.5. Regarding the improved creditworthiness of complainant XXXX:
The relevant findings result from the information from the BF1 (VWA ./2, ./8, ./16 and ./22), which were verified by a service provider information ( XXXX ) from the BVwG (OZ 23 to W245 2239715-1). Since the information from the BF1 corresponded to the content of the social security extract, the corresponding findings had to be made.
II.2.6. Regarding the payment experiences that had already been deleted at the time the disputed decision was issued:
Based on the information provided in accordance with Art. 15 GDPR from September 23, 2020, the following payment experiences were reported:
opened
Closed
capital claim
Open
claim status
payment status
origin of the information
06/28/2019
09/11/2019
€42.70
€0.00
out of court. operation
done positively
XXXX
08/25/2015
07.09.2016
€168.89
€0.00
out of court. operation
done positively
XXXX
08/25/2015
07.09.2016
€170.61
€0.00
out of court. operation
done positively
XXXX
12/10/2015
02/17/2016
€38.00
€0.00
out of court. operation
done positively
XXXX
The BA was informed of this by email on September 25, 2020 (OZ 8 to W245 2239715-1). Taking into account the information provided by BF2 in accordance with Art. 15 GDPR of August 23, 2020 (VWA ./13, see also point I.8), the following payment experiences had already been deleted at the time the decision was issued on December 21, 2020:
opened
Closed
capital claim
Open
claim status
payment status
origin of the information
02/06/2015
03/19/2015
€85.40
€0.00
out of court. operation
done positively
XXXX
05.01.2015
03/19/2015
€102.69
€0.00
out of court. operation
done positively
XXXX
02/24/2014
07/09/2014
€191.74
€0.00
out of court. operation
done positively
XXXX
02/24/2014
07/09/2014
€186.84
€0.00
out of court. operation
done positively
XXXX
Sohin this was to be determined.
II.3. Legal assessment:
II.3.1. Regarding jurisdiction:
According to § 6 BVwGG, the Federal Administrative Court decides through a single judge, unless federal or state laws provide for the decision to be made by senates.
The contested decision is based on a decision by the bB in accordance with Art. 17 GDPR. This matter is covered by Senate decisions in accordance with § 27 DSG.
The procedure of the administrative courts, with the exception of the Federal Finance Court, is regulated by the VwGVG, Federal Law Gazette I No. 33/2013 (§ 1 leg.cit.). Pursuant to Section 58 (2) VwGVG, conflicting provisions that were already promulgated at the time this federal law came into force remain in force.
According to § 17 VwGVG, unless otherwise specified in this federal law, the provisions of the AVG with the exception of §§ 1 to 5 and Part IV, the provisions, apply to the procedure for complaints pursuant to Art. 130 Para. 1 B-VG the Federal Fiscal Code - BAO, Federal Law Gazette No. 194/1961, the Agricultural Procedures Act - AgrVG, Federal Law Gazette No. 173/1950, and the Service Law Procedures Act 1984 - DVG, Federal Law Gazette No. 29/1984, and otherwise those procedural provisions in federal or state laws that the authority applied or should have applied in the proceedings preceding the proceedings before the administrative court.
Pursuant to Section 28 (1) VwGVG, the administrative courts have to settle the legal matter by finding it unless the complaint is to be dismissed or the proceedings are to be discontinued. According to para. 2 leg.cit. the administrative court has to decide on complaints according to Art. 130 Para. 1 Z 1 B-VG itself if
1. the relevant facts have been established or
2. the determination of the relevant facts by the administrative court itself is in the interest of speed or is associated with significant cost savings.
As already explained above, the relevant facts in the matter are certain on the basis of the file situation. The Federal Administrative Court must therefore decide on the matter itself.
II.3.2. Re points I.A) I. and II.A) – Elimination of points 1 and 2 of the contested decision without replacement:
In the contested notice, the bB stated in point 1 on December 21, 2020 that BF2 had violated BF1 in its right to deletion by partially failing to comply with the request for deletion by the end of the procedure in question and on March 19. 2015 positively settled claims in the amount of € 85.40 and € 102.69, as well as the positively settled claims in the amount of € 191.74 and € 186.84 on July 9th, 2014. In point 2, the BA has instructed BF2 to delete this data from BF1 within a period of 4 weeks, otherwise execution.
In this context, however, it should be noted that the BA was already aware by notification of September 25, 2020 (OZ 8) that the following payment experiences were no longer processed by BF2:
opened
Closed
capital claim
Open
claim status
payment status
origin of the information
02/06/2015
03/19/2015
€85.40
€0.00
out of court. operation
done positively
XXXX
05.01.2015
03/19/2015
€102.69
€0.00
out of court. operation
done positively
XXXX
02/24/2014
07/09/2014
€191.74
€0.00
out of court. operation
done positively
XXXX
02/24/2014
07/09/2014
€186.84
€0.00
out of court. operation
done positively
XXXX
As a result, the bB found in the notification of December 21, 2020 in sentence 1 a violation of rights that no longer existed because BF2 had already deleted the relevant payment experiences. A decision was therefore made on a matter which no longer existed at the time of the decision. Against this background, points 1 and 2 had to be resolved without replacement.
There is also no legal interest in a factual decision to this extent, since the relevant payment history has already been deleted. However, the setting cannot be informal, but must be made with a decision (VwGH February 27th, 2019, Ro 2017/10/0032).
Sohin had to be decided accordingly.
II.3.3. Re point I.A) II. - Partial approval of the complaint:
II.3.3.1. Regarding the legal situation in the present complaints procedure:
Art. 6 GDPR – lawfulness of processing – reads (excerpts):
(1) The processing is only lawful if at least one of the following conditions is met:
[…]
f) processing is necessary to safeguard the legitimate interests of the person responsible or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data prevail, in particular if the data subject is a child acts.
Art. 17 GDPR – right to erasure (“right to be forgotten”) – reads (excerpts):
(1) The data subject has the right to demand that the person responsible delete personal data concerning them immediately, and the person responsible is obliged to delete personal data immediately if one of the following reasons applies:
[…]
e) The personal data have been unlawfully processed.
[...]
II.3.3.2. Against this background, the following results for the complaint:
BF2 bases the lawfulness of its processing on Art. 6 (1) lit. f GDPR throughout. Other reasons (Art. 6 Para. 1 lit. a-e GDPR) were not shown by BF2 in the procedure.
Art. 6 (1) (f) GDPR enables the processing of personal data in equal relationships among private individuals if it is necessary to protect the legitimate interests of a person responsible or a third party. These legitimate interests do not constitute sufficient justification for the lawfulness of the processing if the interests or fundamental rights and fundamental freedoms of the person concerned, which require the protection of personal data, prevail (Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Art 6 DSGVO margin no. 49 ; cf. on the determination of legitimate interests also Opinion 06/2014 of the Article 29 Data Protection Working Party, 30 ff); however, merely affecting the rights of the data subject does not make data processing inadmissible (Schulz in Gola, DS-GVO2 [2018] Art. 6 para. 58). It is also prohibited to generally allow the weighing up of the processing in case of doubt (Reimer in Sydow, European General Data Protection Regulation2 [2018] Art 6 Rz 63).
The balancing of interests follows a three-part scheme: 1. Presence of a legitimate interest, 2. Necessity of processing the personal data to realize the legitimate interest and 3. No overriding of the fundamental rights and fundamental freedoms of the data subject (see only Kastelitz/Hötzendorfer/Tschohl in Knyrim, DatKomm Art 6 GDPR margin no. 51). First of all, the interest of the person responsible must be determined on the basis of the intended purpose. Legal, economic or non-material interests come into consideration. This interest is to be understood broadly, which is indicated in particular in Recital 47 S 2, 6, 7 (Frenzel in Paal/Pauly, DS-GVO BDSG3 [2021] Art. 6 Rz 26). Once the interest has been determined, it must then be determined normatively whether this interest violates the legal order of the Union, the respective Member State or data protection principles, including the principle of necessity and the requirement of good faith (Schulz in Gola, DS-GVO2 [2018 ] Art. 6 margin no. 57). In a final step, it must be checked whether the need for protection of the data subject prevails. An indication that the interests, fundamental rights and fundamental freedoms of the data subject outweigh the processing interests of the data controller can be seen in particular in the fact that the data processing takes place in a context in which a data subject does not reasonably have to expect processing (Spindler/Dalby in Spindler /Schuster, Art. 6 GDPR margin no. 19).
In order to assess the lawfulness of the data processing, the interests affected in the individual case must be weighed up from an objective point of view (Schulz in Gola, DS-GVO2 [2018] Art. 6 Rz 67). The decision depends exclusively on the outcome of the weighing up of the conflicting interests in the specific case (OGH June 23, 2021, 6Ob87/21v, para. 33).
In this context, the bB (DSB 20.02.2019, DSB-D123.319/0002-DSB/2019) and the BVwG (BVwG 30.10.2019, W258 2218465-1; 30.10.2019, W258 2216873-1; BVwG 29.04. 2020, W274 2224945-1; 21.10.2020, W274 2232028-1; 26.02.2021, W258 2224155-1; 24.03.2021, W214 2216836-1; 21.04.2021, W214 2216836-1; 04.21.2021, W214 2228166) in particular the following aspects in the individual case assessment: The amount of the individual claims, the "age" of the claims (thus the date of entry in the database), the number of claims collected by a collection agency, the time that has elapsed since a claim was settled, the origin of the data and any storage periods applicable there, the debtor's good conduct since then, the period between the opening and closing of the insolvency and the possible consideration of an increased creditworthiness of the debtor at the time of the decision (see also Haidinger in Knyrim, DatKomm Art. 17 DSGVO, marginal number 49/1 (as of 1.12 .2021).
With regard to the weighing of interests, the BF2 stated that in particular the eight negative payment history data with a total amount of €986.87, the termination of the last collection case one and a half years ago, the waiver of uncorrected claims for six months and the accumulation of negative payment history data should be taken into account be (VWA ./23, page 8 f).
In this context, it should be noted that these aspects were already partially inaccurate at the time the DA made its decision. At this point in time, the parties could already see that BF2 was no longer processing eight payment experience data from BF1, but only four, with a total of €420.20 (see VWA ./18 and point I.11). In this regard, it is incomprehensible that BF2 points out in its complaint that eight payment history data must be taken into account when weighing up interests (see above and VWA ./23, page 8 f).
At the present time it should be noted that BF2 is only processing one payment experience from BF1. This is due to a further deletion of three payment experience data (see point I.21 or OZ 16 to W245 223975-1) by BF2. The remaining payment history was closed 2 years and 8 months ago, related to a capital claim of €42.70 and was outstanding for around 2 ½ months (see point II.1.2.1).
Although, for the assessment of the question of the legality of the processing of the payment history (see point II.1.2.1), the already deleted payment history has no justification value, it is noteworthy that the BF2 with letter dated April 5th, 2022 (OZ 16 to W245 2239715-1) announced that it has deleted three out of four payment records processed so far. Even if these now deleted payment records were closed more than five years ago, it should be noted that two of these payment records were outstanding for more than a year (from 08/25/2015 to 09/07/2016) and the respective capital claim was around four times higher (€ 168.89 or € 170.61) than the payment history still processed (see point II.1.2.1). Despite the significantly higher capital claim and the (very) long uncorrected claim, BF2 deleted this payment history, which it can no longer or does not want to use to assess the creditworthiness of BF1. In contrast, BF2 would like to continue to use the remaining payment experience, with a significantly low capital claim and with a comparatively short duration of an uncorrected claim, to assess the creditworthiness.
The other relevant aspects of BF2 (see above and VWA ./23, page 8 ff) are also relevant against the background of the changed situation (in particular due to the deletion of payment experience data by BF2, see point I.11 and I.21 or VWA ./18 and OZ 16 to W245 2239715-1): Only a single payment history with a capital claim of €42.70 is processed and no longer eight negative payment history data with a total amount of €986.87 (see VWA . 23, page 8). With the payment experience date that was still processed, the claim was only outstanding for around 2 ½ months and not for more than half a year (see VWA ./23, page 8). It should also be noted that the last collection case ended – now – two years and eight months ago and not less than one and a half years ago (VWA ./23, page 8). Finally, there is no longer any cumulation of negative payment experience data (VWA ./23, page 9) because the deletion of BF2 means that there is only one. In this context, the BF2 itself explained in the proceedings that the number of claims collected by way of a debt collection agency was a decisive factor in determining whether a claim could remain in the BF2 database (VWA ./12, page 4). Based on the information provided by BF2, it can be concluded that the processing of a payment experience is only of minor or no creditworthiness-related importance. In the absence of two or more processed payment experiences, the statistical considerations of BF2 in its complaint (see VWA ./23, point 3.1.1.5) have no justification value.
In addition, in the present case, the fact that the payment experience that is the subject of the proceedings was positively settled is also of importance. BF2 explained that a payment experience that was positively settled reduces the negative impact on a credit rating. A claim that is still outstanding has a greater negative effect on the credit rating than one that has already been settled (VWA ./12, page 2).
Insofar as BF2 stated in its complaint that the origin of the data was also important (VWA ./23, page 9), it should be noted that it was not able to explain the basis on which the claim (payment experience ) existed (OZ 15 to W245 2239715-1, page 5).
Based on the circumstances at hand - a payment experience with a small amount (€ 40.70), no further processed payment experience data, termination of the payment experience two years and eight months ago, positively completed payment experience and lack of knowledge about the basis of the payment experience - it can be assumed that from the existing payment experience (see point II.1.2.1) no statement relevant to creditworthiness can (any longer) be derived. In this regard, reference is also made to a statement by BF2, where they themselves stated that the longer a payment history entry (e.g. debt collection case) was in the past, the lower the amount and the less payment history data there is for a person, the more likely it is to be assumed was that no statements relevant to creditworthiness could (any longer) be derived from the specific entry (VWA ./7). Even against the background of BF2's own statements in the procedure, the processing of the payment experience that is the subject of the procedure is (no longer) relevant to creditworthiness. Overall, taking into account BF2's own information and the (now) existing circumstances, it can be assumed that BF2 no longer has a significant interest in processing the payment history determined.
It should also be noted that both the BA and the BF2 did not take into account the increased creditworthiness of the BF1 in the administrative procedure as part of the balancing of interests (see also Haidinger in Knyrim, DatKomm Art. 17 DSGVO, Rn 49/1 (As of December 1st, 2021). The changed financial circumstances - regular employment and fixed income (see II.1.5 above) - must be taken into account, otherwise a distorted picture of the creditworthiness of the BF1 will be conveyed. As early as January 8th, 2020, the BF1 announced that that she was in an ongoing employment relationship and had a high income (VWA ./2). The BF1 subsequently pointed out this fact several times and also documented this with a wage slip for the year 2020 (VWA ./22). Also taking this into account the increased creditworthiness of BF1 is no longer relevant to further processing of the payment history (see point II.1.2.1), also against the background of the fact that only one payment experience with a small amount (€ 40.70) is processed by BF2, this was positively concluded by BF1 two years and eight months ago and no further processed payment experience data is available.
Due to the weighing of interests at hand, further processing of the payment history (see point II.1.2.1) is unlawful. Sohin had to be decided accordingly.
A weighing of interests must also be carried out in connection with the assessment of the storage period. It must be weighed up how severely the storage period affects the sphere of the person concerned and how essential the data is for the person responsible (OGH 23.06.2021, 6Ob87/21v, Rn 22). Due to the balancing of interests made (see above), further storage of the data would seriously interfere with the sphere of BF1. Since BF2 only processes one payment experience (see point II.1.2.1) with a small amount and this was positively completed by BF1 two years and eight months ago and no further processed payment experience data is available, this can no longer be assumed that the processing of the payment experience that is the subject of the proceedings is still essential for BF2.
Insofar as BF1's complaint is directed against the processing of addresses (VWA ./21, page 6), it fails to recognize that BF2 only has the actual residential address of BF1 ("XXXX") and the location of a business license ("XXXX"). processed (see point II.1.2.2). The location of a trade license was documented by the BF2 (VWA ./14) by submitting an excerpt from the trade information system Austria. Addresses processed beyond this were deleted by BF2 (see statement by BF2 of 08/25/2020, page 5, cf. also points I.1 and I.4). Overall, the processing of these addresses does not indicate a violation of Art. 5 and 6 GDPR. This was also not conclusively justified by the BF1. In particular, she did not show any specific interests that would speak against processing the address data.
In addition, the correctness of the processed address data was not questioned by BF1. Since only the current addresses of the BF1 are processed, a violation of the principles of "data minimization and memory limitation" cannot be identified. Furthermore, there is also a - fundamental - legitimate interest of the BF2, since a statistical connection can be established between the ability to pay and the (historical) registration addresses (cf. also Schantz in Simitis, Hornung, Spiecker, data protection law, Art 6 Para. 1 Rz 137, or .also W258 2216873-1). From the available addresses (residential address and location of a business license), however, no conclusions can be drawn as to a limited creditworthiness of the BF1. There is therefore no discernible interest on the part of BF1 which could conflict with BF2's interest in the processing of this data. Thus, a deletion of this data according to Art. 17 DSGVO is ruled out.
These considerations can also be applied to the processing of data relating to corporate functions and powers of representation (see point II.1.2.3).
II.3.4. On the (in)admissibility of the revision:
Pursuant to § 25a Para. 1 VwGG, the administrative court has to pronounce in its ruling or decision whether the revision is admissible according to Art. 133 Para. 4 B-VG. The statement must be briefly justified.
II.3.4.1. Re point I.B) - admissibility of the revision:
The revision is admissible because legal issues had to be resolved within the scope of the present complaints procedure of the BF1, which are of fundamental importance within the meaning of Art. 133 Para. 4 B-VG. It is true that the question of how long data may be used in compliance with the processing principles of Article 5 GDPR and with a weighing of interests in accordance with Article 6 Paragraph 1 lit. f GDPR is a fundamentally irreversible individual decision. However, there is a lack of case law by the Administrative Court on the question of which principles such a balancing of interests must satisfy.
II.3.4.2. Re point II.B) - inadmissibility of the revision:
According to Art. 133 Para. 4 B-VG, the revision is not permissible because in the context of the present complaints procedure of the BF2 the decision does not depend on the solution of a legal question that is of fundamental importance. The present decision neither deviates from the previous case law of the Administrative Court, nor is there any case law; Furthermore, the case law of the Administrative Court is not to be judged as inconsistent. There are also no other indications of a fundamental importance of the legal question to be solved.
It was therefore to be decided accordingly.
