CJEU - C-40/25 - CRIF
After a referral by an Austrian court the CJEU will decide regarding the alternative possibility of injunctive relief under Article 17 GDPR when the data subject has an interest withstanding deletion.
| CJEU - C-40/25 CRIF | |
|---|---|
 | |
| Court: | CJEU |
| Jurisdiction: | European Union |
| Relevant Law: | Article 17 GDPR |
| Decided: | 27.12.2024 |
| Parties: | CRIF GmbH |
| Case Number/Name: | C-40/25 CRIF |
| European Case Law Identifier: | |
| Reference from: | OLG Wien (Austria) 5 R 164/24k |
| Language: | 24 EU Languages |
| Original Source: | Judgement |
| Initial Contributor: | tjk |
English Summary
Facts
The controller CRIF GmbH operates a credit agency and processes personal data of the data subject in question for this purpose. The credit rating information about the data subject is not based on any payment history but only on general data such as address, age and gender.
The controller purchased data on the data subject's first and last name, address and date of birth from X. X operates an address publishing and direct marketing company. The data subject did not consent to the processing of that data. The data subject cannot successfully run its business without appearing in the controller's database, because just that fact of not appearing reduces creditworthiness. Therefore the data subject did not pursue deletion but only the termination of processing by the controller of data from X.
The court of first instance held, that the controller had wrongfully processed the data subject's personal data and ordered an injunction. It held, that the controller had inappropriately used data for the purpose of assessing creditworthiness, which had originally been collected for the purposes of address publishing and direct marketing by X. The controller therefore should have informed the data subject in accordance with Article 14 GDPR that it collects data from third parties. The court stated that § 151 Trade Regulation (Gewerbeordnung - GewO) - privileging data collected by address publisher and direct marketing companies - does not constitute a legal basis for the (further) processing of data because it is not a legal provision within the meaning of Article 6(1) in conjunction with Article 6(4)(h) GDPR, but only a standard under commercial law . The court did not find a connection between the original purpose of the address publisher - and the new purpose of credit assessment. The court found it irrelevant, that the controller only uses this data for the purpose of identifying the data subjects as identification is an essential part of the credit assessment.
In the appeals process the Higher Regional Court of Vienna (Oberlandesgericht Wien - OLG Wien) requested a preliminary ruling on the interpretation of Article 17 GDPR asking, whether an injunction of processing can be ordered, when a deletion is against the interest of the data subject. The court requested the CJEU to supplement the referral of the German Federal Court of Justice in CJEU Case C-655/23 according to Article 267 TFEU on the following further question:
Is Article 17 GDPR to be interpreted as meaning that the data subject whose personal data have been unlawfully disclosed by the controller by means of onward transmission has a right against the controller to refrain from further unlawful disclosure of this data if the data subject does not request the controller to erase the data because the data subject cannot then be found in the controller's database, which may complicate or even prevent the conclusion of a contract if the customers of the controller base their business decisions on a successful search of the data subject in the controller's database? The court suspended the proceedings until the preliminary ruling of the CJEU.
The Court considered the answer to these questions precedent for the outcome of the proceedings, because in these cases, too the injunction against the renewed unlawful disclosure of the data subject's personal data without demanding the deletion of the data. The court is of the opinion that should the CJEU answer the questions submitted by the German Federal Court of Justice to the effect that the injunctive relief does not exist and that there us no recourse to national law, this would also remove the legal basis for the court's current case.
Holding
TBD
Comment
You can find the OLG Wien's decision for referral here.
Further Resources
Share blogs or news articles here!
