VwGH - Ro 2020/04/0031-9
From GDPRhub
| VwGH - Ro 2020/04/0031-9 | |
|---|---|
 | |
| Court: | VwGH (Austria) |
| Jurisdiction: | Austria |
| Relevant Law: | Article 6(1)(f) GDPR Article 17 GDPR Article 7 CFR Article 8 CFR |
| Decided: | 01.02.2024 |
| Published: | |
| Parties: | Austrian Data Protection Authority K GmbH |
| National Case Number/Name: | Ro 2020/04/0031-9 |
| European Case Law Identifier: | ECLI:AT:VWGH:2024:RO2020040031.J00 |
| Appeal from: | BvWG W211 2225136-1/6E |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | RIS (in German) |
| Initial Contributor: | ec |
The Supreme Administrative Court found that a credit ranking agency cannot store data originally collected from an insolvency registry after a judicial decision ordered the erasure of the data from the latter.
English Summary
Facts
In 2010, debt settlement proceedings were issued against the data subject. The data subject settled the payments of their debts in March 2018. After settling the debts, the civil court ordered to make the personal data of the data subject unavailable to the public in the public insolvency register.
The controller, a credit ranking agency, continued to process and store personal data of the data subject that related to his debt settlement procedure that the controller obtained from the public insolvency register. The purpose of the procesing was to assess the creditworthiness of the data subject and his company. The data subject was the company's sole shareholder.
The data subject requested the erasure of his personal data on 4 May 2018, after fulfilling his debt payment plan. The controller did not reply. On 24 October 2018, the data subject lodged a complaint at the Austrian DPA against the controller for the infringement of the right to erasure under Article 17 GDPR.
The controller informed the DPA by letter the same day that it would not comply with this request.
The DPA dismissed the data protection complaint. The decision does not give detail on why the complaint was dismissed.
The data subject appealed this decision at the Federal Administrative Court (Bundesverwaltungsgericht, BVwG).
The court dismissed the appeal. The court found that the controller’s processing the personal data in question was necessary, as the purpose of the processing was for making a forecast about the future payment behaviour of the data subject. The court found that the interests of the controller and its third parties outweighed the interests of the data subject The court concluded that the processing of data on historical insolvencies and payment defaults of the data subject was necessary and lawful and that the objections raised by the data subject could not justify his request for erasure.
The data subject appealed to the decision before the Austrian Supreme Administrative Court (Verwaltungsgerichtshof, VWGH).
The Austrian Supreme Administrative Court held off its judgement until the CJEU issued its decision on C-26/22 and C-64/22 – Schufa.
Holding
The Supreme Administrative Court ruled on two questions. Firstly, it examined the legality of the storage of data collected from the insolvency registry by the controller.
Previous Austrian jurisprudence stated that credit agencies could collect and process personal data collected through the public insolvency register up to 5 years after deletion of the data concerned in the registry. However, the recent CJEU C-26/22 and C-64/22 – Schufa case stated that the lawfulness of the processing by the controller must be assessed solely in light of Article 6(1)(f) GDPR. In particular, the CJEU also ruled that credit agencies cannot process data they collected from the insolvency register once that data has been deleted from the registry itself (see CJEU C-26/22 and C-64/22 – Schufa para 99). The CJEU noted that in Germany the data in the insolvency register is only kept for up to 6 months and therefore, after the expiry of a six-month period, the rights and interests of the data subject take precedence over those of the public to have access to that information.
In light of the CJEU C-26/22 and C-64/22 – Schufa case, the Supreme Administrative Court found that the processing of this data, including the storage, analysis and disclosure of this data to a third party by the controller, constitutes a serious interference with the fundamental rights of the data subject under Article 7 CFR and Article 8 CFR. The processing of such data can significantly harm the interests of the data subject because the disclosure is likely to make it considerably more difficult for him to exercise his freedoms. The Court stated that the objective of a payment plan is the economic recovery of the data subject. The request to erasure of personal data due to fulfilling the payment plan is intended to prevent the data subject from being impaired in business dealings by the public announcement of earlier insolvency proceedings. Therefore, the data subject’s economic recovery is jeopardised if a credit agency, thus the controller in this case, stores data on the data subject’s insolvency proceedings in order to assess the data subject’s creditworthiness, as this data is always used as a negative factor in the assessment. In light of this, the legitimate interests of the controller to process data regarding the insolvency proceedings of the data subject can no longer justify the processing of these personal data after this data in the insolvency register is made unavailable for the public .
The storage of this data by the controller after the decision of the insolvency court to remove the data from the public register can therefore not be based on Article 6(1)(f) GDPR. Thus, it is unlawful for the controller to store and process data relating to the insolvency proceedings of the data subject from the public insolvency register once the data is not available anymore in the register, contrary to the decision of the DPA and the administrative court.
Secondly, the Court examined the request for erasure in accordance with Article 17 GDPR. The Court ruled that due to the absence of lawful processing of the data subject’s data from the insolvency proceedings, the controller is obliged to erase the data concerned immediately under Article 17(1)(d) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Ro 2020/04/0031-9
February 1, 2024
I M N A M E N D E R R E P U B L I K!
The Administrative Court has through the presiding Senate President
Dr. Kleiser, Councilor Dr. Mayr, court councilor Mag. Hainz-Sator and the court councilors
Dr. Pürgy and Mag. Brandl as judges, with the participation of the secretary
Löffler, LL.M., on the revision of the A G in W, represented by the
Brand Rechtsanwälte GmbH in 1020 Vienna, Schüttelstraße 55, Carré Rotunde,
against the decision of the Federal Administrative Court of July 28, 2020,
Zl. W211 2225136-1/6E, concerning a data protection matter
(authority concerned before the administrative court: data protection authority;
Co-involved party: K GmbH, represented by BLS Rechtsanwälte GmbH
in 1010 Vienna, Kärntner Straße 10; other party: Federal Minister of Justice),
rightly recognized:
The contested finding is due to illegality of the content
lifted.
The federal government has incurred expenses of €1,346.40 for the appeal applicant
to be replaced within two weeks if otherwise executed. The additional request
is rejected.
Reasons for the decision:
1 The appellant's assets were reported in 2010
Debt settlement proceedings before District Court D (Insolvency Court)
opened and the repayment rate set in 2012 in mid-March 2018
Fulfills. The insolvency court approved this procedure
Resolution of May 4, 2018, the “deletion” requested by the appeal applicant
the entries from the insolvency file” in accordance with Section 256 Paragraph 3 IO due to the
Proof of fulfillment of the payment plan by the appeal applicant.
2 The participating party operates, among other things, the business of
Credit information agency in accordance with Section 152 of the 1994 Trade Code (GewO 1994) and
stored, among other things, the following excerpts from the data
Applicant in relation to his debt settlement procedure
in the personal credit profile of the audit applicant, as well as in the
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
2 of 26
Credit profile of XY GmbH, whose sole shareholder is
The applicant for appeal is, under the heading “Insolvency”:
“Current status of the proceedings since 2018-04-01”; “Procedural status: payment plan
was settled directly by the debtor”, “Liabilities according to the insolvency application
[EUR] 167,596.54”.
3 On October 24, 2018, the applicant filed an appeal against the party involved
data protection complaint filed by the party as the respondent
Violation of the right to deletion in accordance with
Art. 17 General Data Protection Regulation (GDPR), after writing
of May 23, 2018 the deletion of the entry concerning him about his
Bankruptcy both in his “personal profile” and in the profile of the
XY GmbH desires the database of the party involved and the
co-involved party had informed this party in a letter dated the same day
Not complying with desires.
4 In a decision dated September 20, 2019, the data protection authority (appealed
Authority) rejects the data protection complaint as unfounded.
5 The complaint lodged by the appellant against this rejected this
Federal Administrative Court (Administrative Court) with the contested
The finding of July 28, 2020 was unfounded and stated that the
Revision is permissible.
6 In summary, the administrative court stated that:
The participating party processes the data in the course of operating the business
Credit information agency in accordance with Section 152 GewO 1994 historical information about
Payment defaults and insolvency proceedings of the appeal applicant
(potential) creditors in order to determine the risk of any
to provide payment defaults.
This is a purpose recognized by the legal system.
The data on the insolvency proceedings are correct, complete and fundamental
necessary and suitable to make a forecast about the future
payment behavior of the appeal applicant.
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
3 of 26
Neither the GDPR nor the regulations on the credit reporting agency business
(§ 152 GewO 1994) contained concrete deadlines “for the permissible storage period
historical insolvency proceedings and payment defaults”. The permissible one
Storage duration depends on the individual case.
Historical payment information is essential for the future
Payment behavior of (potential) debtors
to be able to predict. However, they would have less informative value
longer they would be in the past and the longer there would be no further delays in payments
and payment defaults. The age of the claim or the
The time when the final default of the claim is determined
The timing of any repayments and the “good behavior” since then would be included
the weighing up is of crucial importance.
As a guideline, how long payment history data is used to assess creditworthiness
(potential) debtors are suitable, observation or
Deletion periods in the provisions serving to protect creditors
are used that meet the requirements of a suitable one
Creditworthiness assessment should be specified in more detail, such as the provisions of the
Regulation (EU) No 575/2013 of the European Parliament and of the Council
of June 26, 2013 on supervisory requirements for credit institutions and
Investment firms and amending Regulation (EU) No 646/2012
(Capital Adequacy Ordinance). These obliged credit institutions under
among other things, for customer assessment and risk assessment of their claims. For
credit or retail claims against natural persons
Credit institutions that calculate their risk-weighted position amounts based on a
based on internal assessments
(Art. 143 Para. 1), in accordance with Art. 151 Para. 6 in conjunction with Art. 180 Para. 2 lit. a
and e Capital Adequacy Ordinance the probability of default
Requirement based, among other things, on the long-term averages of the annual
Estimate the failure rate. This is a historical observation period for
at least one data source, which could also be external, from at least
to be taken as a basis for five years. Also the estimate to be carried out
The loss rate in the event of a default is in accordance with Article 151 paragraph 7
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
4 out of 26
In conjunction with Article 181 Paragraph 2 Letter c of the Capital Adequacy Ordinance, it is generally based on one
for a period of at least five years.
The EU regulator therefore assumes that for the assessment of the
Creditworthiness of (potential) debtors and the risk
a claim data on any payment defaults over a period of
be relevant for at least five years.
If credit institutions are potential business partners of the party involved
are legally obliged to report their claims based on default rates
at least for the last five years, and the credit rating database
The party involved should also serve to provide data to credit institutions,
that they would need for their mandatory assessment violates the
Processing the insolvency data of the appeal applicant does not violate the principle
data minimization or storage limitation if the payment plan for
The time of the deletion request on May 23, 2018 was less than
three months, or at the time of the administrative court's decision
was fulfilled a little over two years ago. This also applies to
Receivables that were already defaulted more than five years ago
only, as in the present case, a little more than two years ago through the fulfillment of the
The payment plan was finally paid off because only with the successful payment
The specific amount of the default can be determined when the payment plan is fulfilled
could.
As part of the balancing of interests in accordance with Article 6 Paragraph 1 Letter f of the GDPR
on the one hand, the interests of the person responsible and of third parties (possible
business partners of the party involved) and, on the other hand, the interests,
The rights and expectations of the data subject must be taken into account.
The party involved and their customers would have a comprehensible one
Interested in assessing credit risk. The processing of data
about insolvencies and payment defaults to protect potential successes
Contractual partner of the data subject, the third party within the meaning of Art. 6
Paragraph 1 lit. f GDPR. This data processing also serves
Support of credit institutions, the regulations of the
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
5 out of 26
to comply with the capital adequacy regulation. For assessing credit risk
by the party involved is the observation of the historical
Payment behavior of potential debtors is essential and the
Processing data about a little over two years ago
Fulfillment of a payment plan finally concluded insolvency proceedings
necessary.
This interest of the party involved and their business partners outweighs this
the interest of the appeal applicant, not from economic disadvantages
Data processing to be affected because the amount of liabilities of the
Insolvency proceedings amounted to approximately €215,000. Furthermore, the person involved
Only one party has this payment experience data of the appeal applicant
limited public who has an interest to be taken into account
Credit check is available.
In contrast to the credit rating database of the party involved, the
data protection law admissibility of maintaining the insolvency file
§ 256 Insolvency Code (IO), a legal obligation within the meaning of Art. 6
Paragraph 1 lit. c GDPR. It cannot be deduced from Section 256 IO that
Insolvency data (at all) also based on other permitted circumstances
Art. 6 GDPR may no longer be processed if they come from the
Insolvency file had been deleted. Such a restriction would
at least with regard to the present relevant permit
Art. 6 Para. 1 lit. f GDPR contradicts EU secondary law.
As far as the appeal applicant in his letter of request dated
May 29, 2018 to object to the use of your data
21 GDPR, he did not explain to what extent the
Data processing based on Article 6 Paragraph 1 Letter f of the GDPR
is nevertheless not permissible in a special situation. The contradiction is
therefore inadmissible.
By claiming that the stored data is old and incomplete because
the appeal applicant has been successfully active again in business since 2016 and
This data is only suitable for his economic advancement
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
6 of 26
The appeal applicant is doing something to hinder and cause damage
Violation of the general processing principles of the
Data minimization and data economy according to Art. 5 GDPR and one
inadequate balancing of interests within the framework of Article 6 GDPR, but none
reasons arising from a special situation affecting him
would result.
The “processing of data on historical bankruptcies and
“Payment defaults” by the appeal applicant by the co-involved party are therefore
necessary and lawful. The objection raised by the appeal applicant
could not justify his request for deletion.
7 The administrative court based its decision on admissibility on the grounds that it was missing
Jurisprudence of the Administrative Court on the question of which principles
a balancing of interests in accordance with Article 6 Paragraph 1 Letter f of the GDPR must be sufficient;
in particular, whether and under what conditions the regulations of the
Capital Adequacy Ordinance as a guideline for determining the permissible
Storage period of creditworthiness data can be used.
8 The present ordinary revision is directed against this with the application
Repeal of the contested finding against reimbursement of expenses.
9 The authority concerned requested this in its response to the appeal
Dismissal of the appeal against reimbursement of expenses. The participating party
did not submit an appeal response.
10 By resolution of December 23, 2021, 6 K 441/21.WI, and resolution of
January 31, 2022, 6 K 1052/21.WI, was ruled by the Wiesbaden Administrative Court
(Germany) asked, among other things, the following questions to the ECJ (there
pending C-26/22 and C-64/22) for a preliminary ruling:
“...
2. Is data storage at a private credit reporting agency
personal data from a public register, such as the 'national
Databases' within the meaning of Article 79 Paragraphs 4 and 5 of the
Regulation (EU) 2015/848 [Regulation of the European Parliament and the
Council of May 20, 2015 on insolvency proceedings], without any specific reason
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
7 out of 26
stored in order to provide information in the event of an inquiry
can, with Articles 7 and 8 of the Charter of Fundamental Rights of the European Union
compatible?
3. a) Are private parallel databases (especially databases of a
Credit agencies) that are set up alongside the state databases and
in which the data from the state databases (here
Insolvency notices) are stored longer than in the narrow one
Framework of Regulation 2015/848 in conjunction with the national one
Regulated by law, generally permissible?
b) If question 3 a) is answered in the affirmative, this results in the right to be forgotten
in accordance with Art. 17 Paragraph 1 Letter d) GDPR, this data must be deleted,
if the processing time envisaged for the public register
has expired?
4. Insofar as Article 6 Paragraph 1 Subparagraph 1 letter f) GDPR as the sole one
Legal basis for data storage for private individuals
Credit reporting agencies also appear in public registers
Stored data comes into consideration is a legitimate interest
Credit reporting agency is to be affirmed if this credit reporting agency has the data
from the public directory without any specific reason
Is this data then available when a request is made?
..."
11 By resolution of June 10, 2023, Ro 2020/04/0031, the
Administrative Court continues the appeal process until the
Decision of the ECJ in the above two
Request for a preliminary ruling from the Wiesbaden Administrative Court is pending
Proceedings suspended because answering these questions is also for the
treatment of the present revision is important.
12 With judgment of December 7, 2023, C-26/22 and C-64/22, SCHUFA Holding
(discharge of residual debt), the ECJ has decided on the request for a preliminary ruling from
Wiesbaden Administrative Court decided.
The Administrative Court considered:
admissibility
13 The appeal turns out to be in line with the separate admissibility submissions made by the
Revision clarified the legal question as to whether EU regulations, such as the one in this case
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
8 out of 26
Capital Adequacy Ordinance applicable to credit institutions and investment firms
are addressed and contain regulations for internal credit checks, as
Guideline for determining the permissible storage period of not for
internal use of certain creditworthiness data by credit reporting agencies
can be used as permissible. She is also entitled.
Relevant legal situation
Union law
14 The relevant recitals and provisions of the
Regulation (EU) 2016/679 of the European Parliament and of the Council of
April 27, 2016 on the protection of natural persons during processing
personal data, the free movement of data and the abolition of the
Directive 95/46/EC (General Data Protection Regulation; GDPR), OJ L 119
dated May 4, 2016, excerpts read:
“Article 6
Lawfulness of processing
(1) Processing is only lawful if at least one of the
the following conditions are met:
...
f) the processing is to protect the legitimate interests of the
responsible person or a third party, unless the
interests or fundamental rights and freedoms of the person concerned,
which require the protection of personal data, predominate
especially if the person concerned is a child
acts.
Subparagraph 1(f) does not apply to those carried out by public authorities
processing carried out in their tasks.
...
Article 17
Right to deletion (“right to be forgotten”)
(1) The data subject has the right to obtain information from the person responsible
request that personal data concerning you be deleted immediately
and the person responsible is obliged to provide personal data
deleted immediately if one of the following reasons applies:
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
9 out of 26
a) The personal data are for the purposes for which they were collected
or processed in any other way is no longer necessary.
...
c) The data subject objects in accordance with Article 21(1).
processing and there are no overriding legitimate reasons
for processing, or the data subject submits in accordance with Article 21
Paragraph 2 objection to the processing.
d) The personal data was processed unlawfully.
..."
15 The relevant recitals and provisions of the
Directive 2008/48/EC of the European Parliament and of the Council of
April 23, 2008 on consumer credit agreements and the cancellation of the
Council Directive 87/102/EEC, OJ L 133 of 22.5.2008
excerpts:
“(26) ... Particularly in the expanding credit market, it is important that
Lenders do not act irresponsibly in granting loans or
Granting loans without prior assessment of creditworthiness, and the
Member States should carry out the necessary checks to prevent such
Behaviors should be stopped and they should be the necessary ones
Determine sanctions for those lenders who behave in this way.
Without prejudice to the provisions of Directive 2006/48/EC of the European
Parliament and of the Council of 14 June 2006 on the inclusion and
The activities of credit institutions should be controlled by credit risk
Lenders are responsible for evaluating the loan in each individual case
Check the consumer's creditworthiness. ...
...
(28) To assess the consumer's credit situation, the creditor should:
also consult the relevant databases; due to legal and
Factual circumstances may require such
Consultations vary in scope. So that the competition between
Lenders should not be distorted, lenders should choose from others
Member States access to private or public databases
concerning consumers in a Member State in which they are not established
are granted under non-discriminatory conditions
the creditors of that Member State.
...
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
10 out of 26
Article 8
Obligation to assess the consumer's creditworthiness
(1) Member States shall ensure that before the credit agreement is concluded
the lender assesses the consumer's creditworthiness based on sufficient creditworthiness
evaluates information that he may collect from the consumer and
if necessary, based on information from the relevant company
Database. Those Member States that require lenders to do so by law
oblige to check your creditworthiness based on a corresponding query
database can maintain this requirement.”
16 The relevant recitals and provisions of the
Directive 2014/17/EU of the European Parliament and of the Council of
February 4, 2014 on residential real estate credit agreements for consumers and for
Amendments to Directives 2008/48/EC and 2013/36/EU and the
Regulation (EU) No. 1093/2010, OJ L 60 of February 28, 2014
excerpts:
“(55) Before concluding a credit agreement, it is essential to have the ability and
Evaluate and evaluate the consumer's propensity to repay the loan
check. During this credit check, everyone should
necessary and relevant factors are taken into account that determine the capability
of a consumer to repayments due over the term of the loan
could achieve, influence. ...
...
(59) Querying a credit database is a useful element in the
Credit check. ...
...
Article 18
Obligation to check the consumer's creditworthiness
1. Member States shall ensure that the creditor before concluding a
Credit agreement requires a thorough check of the consumer's creditworthiness
carries out. When checking your creditworthiness, the factors that determine the...
Examination of the prospects that are relevant to the consumer
fulfills obligations under the loan agreement in an appropriate manner
taken into account.
...
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
11 of 26
Article 21
Access to databases
(1) Each Member State shall ensure that all creditors from all
Member States have access to the assessment within their territory
the consumer's creditworthiness databases used
Use should only be monitored to what extent consumers
fulfill their loan obligations during the term of a loan agreement.
Access must be granted without discrimination.
(2) Paragraph 1 applies to both private credit bureaus and credit reporting agencies
operated databases as well as for public registers.
..."
17 The relevant recitals and provisions of the
Regulation (EU) No 575/2013 of the European Parliament and of the Council
of June 26, 2013 on supervisory requirements for credit institutions and
Investment firms and amending Regulation (EU) No 646/2012
(Capital Adequacy Regulation), OJ L 176 of June 27, 2013
excerpts:
“(42) It is essential to take into account the diversity of institutions in the Union
is, should be used when calculating the own funds requirements for the
There are different approaches to credit risk with varying degrees of severity
Risk sensitivity and sophistication should be provided. Through the
Use of external credit assessments and those from the institutions themselves
The estimates made of individual credit risk parameters win
Credit risk provisions significantly increase risk sensitivity and
regulatory soundness. Institutes should switch to approaches
with higher risk sensitivity. If institutes are to
Apply the investigation approaches provided for in this Regulation
They should provide the estimates needed to assess credit risk if they submit their procedures
for credit risk measurement and credit risk management, so that for the
Determination of regulatory capital requirements methods for
are available that match the type, scope and complexity of the
take into account the procedures of the individual institutes. In this regard, the
Data processing in connection with procurement and administration
of loans to customers also the development and validation of systems
for credit risk management and credit risk measurement. This
not only serves the legitimate interests of institutions, but also the goal
this regulation, better methods for risk measurement and management
apply and these methods also with regard to the prescribed ones
to use own resources. Regardless, higher-level approaches require
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
12 of 26
Risk sensitivity significant expertise and resources as well as qualitative
high-quality and sufficient data. ...
...
Article 135
Use of ECAI credit ratings
(1) An external credit assessment may only be used to determine the
risk weight of a claim according to this chapter can be used,
if it comes from an ECAI or from an ECAI in accordance with the
Regulation (EC) No. 1060/2009 was confirmed.
...
Article 171
Assignment to rating levels or risk pools
...
(2) When assigning debtors and facilities to a rating level
or a risk pool, an institution carries all relevant information
Invoice. The information is up-to-date and enables the institute to
Forecast of the future development of the risk position. The less
The more information an institution has available, the more conservative it is
The procedure for assigning risk positions to debtor
or facility rating levels or risk pools. Does an institute support the
Determination of an internal assessment mainly to an external one
Credit rating, it ensures that other relevant ones are also relevant
information is taken into account.
...
Article 180
Special requirements for PD estimates
(1) When quantifying the risk parameters for certain creditworthiness levels
or pools are used by the institutions when estimating PD for receivables
Companies, institutions, central governments and central banks as well as for
Investment positions for which they apply the PD/LGD approach in accordance with Article 155
Apply paragraph 3, the following specific requirements:
...
f) to the extent that an institution compares its internal creditworthiness levels with the creditworthiness scale of a
ECAI or comparable institutions linked or one of such
scale and then the external creditworthiness levels
assigns default rates recorded by the organization to its internal levels,
This assignment is made based on a comparison between the internal ones
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
1. February 2024
13 of 26
Assessment criteria and the criteria of the external organization and
a comparison between internal and external assessments of any
joint debtor. Distortions or inconsistencies in
Assignment procedures or the underlying data are included
avoided. The criteria of the external organization that is responsible for the
The data used for quantification are based
exclusively focused on the risk of default and do not reflect any
transaction characteristics. ..."
National law
18 Section 7 Paragraph 1 of the Consumer Credit Act (VKrG), Federal Law Gazette I No. 28/2010 as amended
Federal Law Gazette I No. 135/2015 reads:
“Checking the consumer’s creditworthiness
§ 7. (1) Before concluding the loan agreement, the lender has the
The consumer's creditworthiness based on sufficient information
check that he - if necessary - requests from the consumer;
If necessary, he also has information from one available
database.”
19 § 9 Mortgage and Real Estate Loan Act - HIKrG, Federal Law Gazette I No. 135/2015,
reads in part:
“Checking the consumer’s creditworthiness
§ 9. (1) Before concluding a credit agreement, the lender has a
carry out a thorough check of the consumer's creditworthiness. At
The creditworthiness check are the factors that are used to check the
Prospects are relevant that the consumer fulfills his obligations
the credit agreement must be taken into account in an appropriate manner.
(2) The creditworthiness check is based on necessary,
sufficient and appropriate information on income, expenses
and other financial and economic circumstances of the consumer
to be carried out. The lender has the information from relevant
internal or external sources, including the consumer.
..."
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
14 of 26
20 § 256 Insolvency Code (IO), Federal Law Gazette No. 337/1914 as amended by Federal Law Gazette I No. 122/2017,
reads in part:
“Bankruptcy file
§ 256. (1) Data must be included in the edict file according to this
Federal law must be made public (insolvency file).
(2) Access to the insolvency file is no longer permitted if a
year has passed since
...
4. Expiry of the payment period provided for in the payment plan or
...
(3) At the debtor's request, the insolvency file can already be viewed
will no longer be granted if the restructuring plan has been legally confirmed
or payment plan has been fulfilled. The debtor has fulfillment
to be documented. The court can examine compliance
Hire an expert to cover the costs of the debtor
are. The court will make a decision on the inspection that cannot be postponed
Decision.
..."
Legality of storing data from the insolvency file
Credit reporting agencies
21 In the present case, the applicant for appeal is requesting the deletion of an entry in the
With regard to his insolvency proceedings in the database of those involved
Credit reporting agency after the bankruptcy court in its
Debt settlement procedure involves the “deletion of entries from the
Insolvency file” in accordance with Section 256 Paragraph 3 IO. It is therefore necessary to check
Permissibility of storing this data by the participating party also
still in the period after the decision of the insolvency court approved it
Failure to grant access to the insolvency file in accordance with Section 256 Paragraph 3 IO.
22 The ECJ in its judgment of December 7, 2023, C-26/22 and C-64/22,
SCHUFA Holding (remaining debt discharge), the key questions at hand
the request for a preliminary ruling from the Wiesbaden Administrative Court
answered that Art. 5 Para. 1 lit. a GDPR in conjunction with Art. 6 Para. 1 lit. f GDPR
should be interpreted as belonging to the practice of “private credit reporting agencies”.
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
15 of 26
which consists in having one in their own databases
information about the granting of a certificate from the public register
Discharge of residual debt in favor of natural persons for the purpose of delivery
of information about the creditworthiness of these people for a period of time
to store the duration of the data storage in the public register
goes out. He essentially justified this as follows:
“...
74 In the present case, it is clear that the lawfulness of the processing
personal data that is at issue in the main proceedings, solely in
Light of Article 6 paragraph 1 subparagraph. 1 letter f GDPR is to be assessed. After
This provision is for the processing of personal data only
lawful if the processing is carried out to protect legitimate interests
of the person responsible or a third party is necessary, unless the
interests or fundamental rights and freedoms of the data subject
require the protection of personal data, in particular
if the person concerned is a child.
75 The processing of personal data is therefore subject to this
Determination lawful under three cumulative conditions: First
must be from the controller or a third party
a legitimate interest must be perceived; secondly, the
Processing of personal data to achieve this
legitimate interest may be necessary, and thirdly, the interests or
Fundamental rights and freedoms of the person whose data is protected
should not outweigh (judgment of July 4, 2023, Meta Platforms et al.
[General conditions of use of a social network], C-252/21,
EU:C:2023:537, paragraph 106 and the case law cited there).
76 Firstly, what is the requirement for safeguarding a 'legitimate interest'?
concerns, is in the absence of a definition of this term by the GDPR
highlighted, as the Advocate General did in point 61 of his Opinion
has stated that a wide range of interests are fundamentally considered
can be considered justified.
77 Secondly, what is the requirement that the processing is necessary?
personal data to realize the perceived
As far as legitimate interest is concerned, this requires the referring court to do so
check whether the legitimate interest in processing the data is not in
can reasonably be achieved just as effectively by other means,
which have less impact on the fundamental rights and freedoms of those affected
Persons, in particular those guaranteed by Articles 7 and 8 of the Charter
Rights to respect for private life and protection of personal data,
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
16 of 26
intervene (judgment of July 4, 2023, Meta Platforms et al. [General
Terms of use of a social network], C-252/21, EU:C:2023:537,
108 and the case law cited there).
78 In this context it should also be noted that the
Requirement of the necessity of data processing together with the
The so-called principle of 'data minimization' must be examined, which is set out in Article 5
Paragraph 1 letter c GDPR is anchored and requires that personal data
Data 'adequate and relevant to the purpose and relevant to the purposes
processing is limited to the extent necessary (judgment of July 4, 2023,
Meta Platforms et al. [General terms and conditions of use of a social
Network], C-252/21, EU:C:2023:537, paragraph 109 and the one cited there
case law).
79 Thirdly, as regards the requirement that the interests or
Fundamental freedoms and rights of the person whose data is protected
should, against the legitimate interest of the person responsible or one
third parties do not predominate, the Court has already decided that these
The prerequisite is a balancing of the respective conflicting factors
Rights and interests that fundamentally depend on the specific
circumstances of the individual case and that it is therefore a matter for the submitter
The court is to weigh this up taking this specific into account
circumstances (judgment of July 4, 2023, Meta Platforms et al.
[General conditions of use of a social network], C-252/21,
EU:C:2023:537, paragraph 110 and the case law cited there).
80 Furthermore, as can be seen from recital 47 of the GDPR
results, the interests and fundamental rights of the data subject are in the interest of the
Those responsible predominate, especially when personal data are involved
Data is processed in situations where a data subject
cannot reasonably expect such processing (judgment of
July 4, 2023, Meta Platforms et al. [General Terms and Conditions of Use a
social network], C-252/21, EU:C:2023:537, paragraph 112).
81 Ultimately, it is for the referring court to decide whether
with regard to the processing of personal data involved in the
The main proceedings concern the three referred to in paragraph 75 of this judgment
requirements are met; the Court may order the national court to do so
however, its request for a preliminary ruling provides relevant information for
give this test (see in this sense judgment of October 20, 2022, Digi,
C-77/21, EU:C:2022:805, paragraph 39 and the case law cited there).
82 In the present case, SCHUFA does one thing with regard to the prosecution
legitimate interest applies that the credit reporting agencies data
processed to assess the creditworthiness of people or companies
are necessary to provide this information to their contractual partners
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
17 of 26
to be able to provide. This activity not only protects them
economic interests of the companies that have credit-related contracts
wanted to enter into the determination of creditworthiness and the granting of credit
Credit reports also form a foundation of the credit system and the
functionality of the economy. The activities of credit reporting agencies help
also, the business wishes of those interested in credit-relevant transactions
realize this, as the information allows for a quick and unbureaucratic check
made business possible.
83 In this respect, the processing of personal data serves as that in the
The main proceedings in question do indeed represent the economic interests of the
SCHUFA, but this processing also serves to protect the legitimate interests
Interest of SCHUFA's contractual partners who have credit-relevant contracts
people want to take part in assessing their creditworthiness
people and thus the socio-economic interests of the credit sector.
84 With regard to consumer credit agreements, Article 8 of the
Directive 2008/48, in the light of its 28th recital, highlights that
The lender is obliged to do so before the loan agreement is concluded
creditworthiness of the consumer based on sufficient information,
if necessary, also based on public and private information
Databases to evaluate.
85 Furthermore, in relation to consumer residential property credit agreements
Article 18(1) and Article 21(1) of Directive 2014/17 in conjunction with
Recitals 55 and 59 of this Directive indicate that:
Lenders carry out a thorough check of the consumer's creditworthiness
has to make and has access to credit databases, whereby the query
such databases is a useful element in this examination.
86 It should be added that the obligation to evaluate the
Consumer creditworthiness as defined in Directives 2008/48 and
2014/17 is intended not only to protect the loan applicant, but also
also, as highlighted in recital 26 of Directive 2008/48,
to ensure the smooth functioning of the entire credit system.
87 However, data processing must also be carried out to achieve the
legitimate interests of the controller or a third party
and the interests or fundamental rights and freedoms of those affected
person must not outweigh this interest. At the
appropriate balancing of the respective conflicting rights
and interests, i.e. H. that of the person responsible and those involved
Third parties on the one hand and the data subject on the other hand, as in paragraph 80
of the present judgment, in particular the reasonable expectations
the data subject and the scope of the processing in question and
to take into account their effects on this person (cf. judgment of
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
18 of 26
July 4, 2023, Meta Platforms et al. [General Terms and Conditions of Use a
social network], C-252/21, EU:C:2023:537, paragraph 116).
88 Regarding Article 6 Paragraph 1 Subparagraph The Court of Justice has 1 letter f of the GDPR
decided that this provision should be interpreted as meaning that a
Processing only if it is necessary to protect the legitimate interests of the
responsible party or a third party required within the meaning of this regulation
can be considered if this processing is within the limits
what is done to realize this legitimate interest
is absolutely necessary and if it results from a consideration of each other
conflicting interests, taking into account all relevant circumstances
shows that the interests or fundamental rights and freedoms of the
Processing of data subjects against the legitimate interest of the data subject
those responsible or a third party do not prevail (cf. in this sense
Judgments of May 4, 2017, Rīgas satiksme, C-13/16, EU:C:2017:336, paragraph 30,
and dated July 4, 2023, Meta Platforms et al. [Terms and conditions
a social network], C-252/21, EU:C:2023:537, paragraph 126).
89 In this context, the referring court points out
two aspects of the processing at issue in the main proceedings
personal data. Firstly, this processing implies a
diverse storage of data, i.e. H. not just in a public one
Register, but also in the databases of the credit reporting agencies
these companies do not carry out this storage for a specific reason,
but in the event that their contractual partners requested information from them.
Second, these companies stored this data for three years
Basis of rules of conduct within the meaning of Art. 40 GDPR, while the
National legislation for the public register requires a storage period
of just six months.
...
92 With regard to the duration of data storage, it can be assumed that
The examination of the second and third is in paragraph 75 of the present judgment
the above-mentioned requirement overlaps in that the assessment of the
Question whether in the present case the legitimate interests that are related to the
processing of personal data at issue in the main proceedings
cannot reasonably be perceived by a shorter duration of the
Storage of data can be achieved by balancing each other
conflicting rights and interests.
93 When weighing up the legitimate interests pursued, it should be noted that
the analysis of a credit reporting agency insofar as it provides an objective and
reliable assessment of the creditworthiness of potential customers
Contractual partner of the credit reporting agency enables
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
19 of 26
Compensate for information differences and thus fraud risks and others
can reduce uncertainties.
94 However, as far as the rights and interests of the data subject are concerned,
represents the processing of data regarding the granting of a discharge of residual debt,
such as storing, analyzing and sharing this data with you
Third parties, through a credit reporting agency, a serious interference in the
Articles 7 and 8 of the Charter represent the fundamental rights of the data subject.
Such data serves as a negative factor when assessing the
Creditworthiness of the person concerned and are therefore sensitive
information about her private life (cf. in this sense judgment of
13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 98).
Their processing may significantly jeopardize the interests of the data subject
harm, as this disclosure is likely to interfere with the exercise of their freedoms
significantly more difficult, especially when it comes to basic needs
cover up.
95 Furthermore, as the Commission has pointed out, the consequences for the
The interests and private life of the person concerned are even greater
Requirements regarding the lawfulness of storing this information
the higher the longer the data in question has been kept by credit reporting agencies
get saved.
96 It should also be noted that the aim of a public
Insolvency register, as can be seen from recital 76 of the
Regulation 2015/848 is to provide better information
affected creditors and courts. In this
In this context, Article 79 (5) of this regulation simply provides that
Member States inform data subjects for what period of time their
personal data stored in insolvency registers are accessible,
without specifying a storage period for this data. On the other hand, it follows from
Article 79(4) of this Regulation states that Member States may, in accordance with this
Article is responsible for collecting data and storing it in national databases.
The period for storing this data must therefore take this into account
regulation to be established.
97 In the present case, the German legislature provides that
Information about the granting of a discharge of residual debts in the insolvency register
is only stored for six months. He therefore assumes that after
After a period of six months, the rights and interests of the
affected person to those of the public about this information
have, predominate.
98 Furthermore, as the Advocate General stated in point 75 of his Opinion
has stated that the granted exemption from residual debts enables the beneficiary to
to participate in economic life again, and therefore has for this person
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
20 out of 26
generally existential meaning. The realization of this goal would be
However, it is at risk if credit reporting agencies are used to assess the
economic situation of a person, data about a discharge of residual debt
store and could use such data after it has been removed from the
public insolvency register has been deleted because this data is with the
Assessing the creditworthiness of such a person is always a negative factor
be used.
99 Under these circumstances, the interests of the credit sector, over
There is no information regarding a discharge of residual debt
Processing of personal data such as that in legal disputes
The main proceedings in question after the expiry of the storage period
Data in the public insolvency register justify storage
of this data by a credit reporting agency in relation to the period
the deletion of this data from a public insolvency register does not apply
Article 6 paragraph 1 subparagraph 1 letter f GDPR can be supported.
...
106 Finally, the referring court essentially asks which
Obligations to a credit reporting agency in accordance with Art. 17 GDPR.
...
108 Should the referring court, after its assessment of legality
the processing at issue in the main proceedings
personal data comes to the conclusion that this processing
is therefore not lawful, according to the clear wording of this provision
the person responsible, in this case SCHUFA, is obliged to do so
delete the relevant data immediately. This would be as in paragraph 99 of
found in this judgment when processing the data in question
personal data that is received after the expiry of the six-month period for the
The data is stored in the public insolvency register.
..."
23 Based on this case law of the ECJ, the legality of the
Processing of personal data from the insolvency file by the
co-involved party solely in the light of Article 6 Paragraph 1 Letter f GDPR
judge. According to this provision, the processing is personal
Data is lawful under three cumulative conditions: firstly, from
the controller or a third party
legitimate interest must be exercised; secondly, the processing must be carried out
personal data to achieve legitimate interest
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
21 of 26
be necessary, and thirdly, the interests and fundamental rights and
Basic freedoms of the person whose data is to be protected are not
predominate (ECJ December 7, 2023, C-26/22 and C-64/22, SCHUFA Holding
[Discharge of residual debt], paragraphs 74 and 75, mwN; see also VwGH October 31, 2023,
Ro 2020/04/0024, 0025, Rn. 22, mwN).
24 In this case, the party involved makes a claim regarding the prosecution
legitimate interest claims that they are based on the exercise of the business
the credit reporting agency has a legitimate interest in the credit information agency in accordance with Section 152 GewO 1994
Processing of the creditworthiness data of the appeal applicant, in particular
Information about his past insolvency for the purpose of assessment
his creditworthiness. This data processing therefore serves
the economic interests of the party involved. The
In this context, however, the administrative court also pointed out that
that the processing of data about insolvencies and payment defaults
Protection of potential contractual partners of the appeal applicant is achieved. The
The processing of the insolvency data of the appeal applicant therefore also serves the purpose
Safeguarding the legitimate interests of the contractual partners involved
Party that concludes credit-relevant contracts with the appeal applicant
want to estimate the associated credit risk.
25 The ECJ (C-26/22 and C-64/22, paras. 83 to 86) goes in this
Connection also depends on the existence of a socio-economic interest
the credit sector in the processing of creditworthiness data, especially from
Insolvency data. On the one hand, he refers to Article 8 of the directive
2008/48/EC, which in the light of recital 28 of this Directive
With regard to consumer credit agreements, the lender's obligation is clear,
before concluding the credit agreement, the consumer's creditworthiness
on the basis of sufficient information, if necessary also on the basis of
Evaluate information from public and private databases (dem
corresponds domestically to Section 7 Paragraph 1 of the Consumer Credit Act (VKrG), which means
Article 8 of Directive 2008/48/EC on consumer credit agreements implemented
became). On the other hand, the lender has regarding
Residential real estate loan agreements for consumers in accordance with Article 18, paragraph 1 and
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
22 of 26
Article 21(1) of Directive 2014/17 in conjunction with recitals 55 and 59
This guideline carries out a thorough check of the creditworthiness of the
Consumer to carry out the query of credit databases
which the lender has access to, is a useful element in this review
is (this corresponds domestically to Section 9 Paragraphs 1 and 2 Mortgage and
Real Estate Loan Act - HIKrG, which means Article 18 Paragraph 1 of the
Directive 2014/17/EU was implemented). Furthermore, the obligation to
Assess consumers' creditworthiness as outlined in the guidelines
2008/48/EC and 2014/17/EU is provided not only for the loan applicant
but also, as in recital 26 of the directive
2008/48/EC emphasizes the smooth functioning of the entire system
Guarantee credit system.
26 The administrative court refers (specifically on the question of storage duration)
in particular to Regulation (EU) No. 575/2013 of the European Union
Parliament and of the Council of 26 June 2013 on prudential requirements
Credit institutions and investment firms and to change the
Regulation (EU) No. 646/2012 (Capital Adequacy Regulation). This
The regulation is based on Art. 135 Para. 1, Art. 171 Para. 2 and Art. 180 Para. 1 lit. f
in conjunction with recital 42, the use of external
Credit assessments, for example for the assignment of rating levels and
Risk pools or for estimating the probability of default
(“PD estimate”), thus for credit risk assessment. It
It therefore also follows from the Capital Adequacy Ordinance that
Processing of insolvency data from (potential) borrowers
socio-economic interest of the credit sector in evaluating the
Creditworthiness of the contractual partners of the party involved with the
Applicants for an audit want to conclude credit-relevant contracts.
27 Finally, the analysis of a credit reporting agency, such as the one involved
party, insofar as it provides an objective and reliable assessment of the
creditworthiness of potential customers of their contractual partners,
Compensate for information differences and thus fraud risks and others
Reduce uncertainties (cf. ECJ C-26/22 and C-64/22, para. 93).
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
23 of 26
28 In this respect, there is a legitimate interest within the meaning of Art. 6 Para. 1 lit. f GDPR
the processing of the appeal applicant's data
Debt settlement procedures.
29 In contrast, the processing of this data, in particular with regard to
the fulfillment of the legally confirmed payment plan, such as
Storage, analysis and transfer of this data to a third party by the
The party involved is a serious encroachment on the rights set out in Articles 7 and 8 GRC
enshrined fundamental rights of the appeal applicant. Since such data as
negative factor in assessing the creditworthiness of the
To serve the appeal applicant, they provide sensitive information about it
Private life. Your processing may be in the interests of the appeal applicant
considerable harm because the disclosure is likely to jeopardize the exercise of his rights
to make freedoms considerably more difficult, especially when it comes to
to cover basic needs. The consequences for interests and private life
of the appeal applicant are even greater and the requirements placed on them
The lawfulness of storing this information therefore increases, the higher
longer this data is stored by the participating party
(see ECJ C-26/22 and C-64/22, paras. 94, 95).
30 Aim of a public insolvency register, such as the insolvency file
§ 256 IO is to ensure better information for those affected
Creditors and courts (cf. ECJ C-26/22 and C-64/22, para. 96, as well
domestically the explanations for
Insolvency Law Amendment Act 1997 - IRÄG 1997 in RV 734 BlgNR
20 GP, 34, 63).
31 According to Section 256 Paragraph 2 Item 4 IO, the insolvency file can no longer be viewed
grant if since the expiry of the period provided for in the payment plan
One year has passed for the payment deadline. Inspection is possible at the request of the debtor
in the insolvency file can no longer be granted if the
legally confirmed payment plan has been fulfilled (Section 256 Para. 3 IO).
The latter option serves to avoid disadvantages for the debtor
Business transactions (see the explanations for
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
24 out of 26
Insolvency Law Amendment Act 2010 -IRÄG 2010 RV 612 BlgNR 24. GP 3,
35).
32 The legislature therefore assumes that with the fulfillment of the
legally confirmed payment plan, but at the latest upon expiry of a deadline
of one year since the expiry of the payment period provided for in the payment plan
the rights and interests of the data subject, as in this case
The appeal applicant, those of the public, have access to this information
have, predominate (cf. RV 734 BlgNR 20. GP, 63). After all, that's the goal
of the payment plan, the economic recovery of the debtor
(cf. OGH August 18, 2010, 8 Ob 146/09t). In this sense, a “deletion” should occur
the insolvency file is impaired as a result of fulfilling the payment plan
of the debtor in business transactions through public announcement of a
Avoid previous insolvency proceedings (see explanations in
RV 612 BlgNR 24. GP, 3, 35).
33 However, the realization of this goal would be jeopardized if those involved
Party as a credit reporting agency to assess the economic situation of the
Store the appeal applicant's data about his insolvency proceedings and such
Data could be used after viewing the insolvency file
§ 256 paragraph 2 and paragraph 3 IO can no longer be granted because this data is included
the assessment of the creditworthiness of the audit applicant is always negative
factor can be used. Under these circumstances, those entitled to
Interests of the credit sector, about information regarding the fulfillment
the legally confirmed payment plan ended the insolvency proceedings
of the appeal applicant to order the processing of this previously in the
Personal data can no longer be publicly viewed in the insolvency file
justify. The storage of this data by the participating party
Reference to the period after the decision of the
Insolvency court about the “deletion of the entries from the
Insolvency file” in accordance with Section 256 Paragraph 3 IO cannot therefore be based on Art. 6
Paragraph 1 lit. f GDPR is supported. The storage of the
data relating to the debt settlement procedure of the appeal applicant
the insolvency file by the party involved about the time of
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
25 out of 26
The decision of the insolvency court has legal force in accordance with Section 256 (3) IO
This proves to be contrary to the legal opinion of the authority concerned and the
Administrative court - as not legal (cf. again ECJ C-26/22 and
C-64/22, paragraphs 98 and 99).
Request for deletion according to Art. 17 GDPR
34 Due to the lack of lawfulness of the processing from the insolvency file
deleted data of the appeal applicant regarding his insolvency proceedings
The party involved is obliged to provide the relevant data immediately
to be deleted in accordance with Art. 17 Para. 1 lit. d GDPR (cf. again ECJ C-26/22
and C-64/22, paragraph 108).
35 In contrast to this, in the VwGH decision May 9, 2023, Ro 2020/04/0037,
that asserted by the appeal applicant against a credit institution
Right to deletion in accordance with Art. 17 GDPR in relation to you
relevant entry of payment experience data in a jointly with
database operated by other credit institutions (bank warning list).
This entry did not concern the processing of personal data
Applicant from the insolvency file. Rather, they were in the
Payment history data of the audit applicant stored on the bank warning list
by the credit institution in connection with the existing one
Current account details of the appeal applicant are collected
(see VwGH Ro 2020/04/0037, paragraph 57, last sentence). So much for this one
Knowledge taking into account the Capital Adequacy Ordinance
Storage period of at least five years in relation to the storage of
Payment experience data in the bank warning list is generally considered legitimate
was considered, it should be noted that the Capital Adequacy Ordinance
in accordance with Article 1, the general supervisory requirements for
Credit institutions regulate specific areas and are therefore not applicable
Credit reporting agencies, such as the party involved in this case, apply.
Result
36 In this respect, the administrative court is of the legality of storing the data
Insolvency data relating to the appeal applicant is provided by the co-participant
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at Ro 2020/04/0031-9
February 1, 2024
26 of 26
Credit reporting agency in accordance with Article 6 Paragraph 1 Letter f of the GDPR and that from
If the right to deletion asserted by the appeal applicant is denied, it has that
contested finding is burdened with illegality of the content. The
The contested finding therefore had to be repealed in accordance with Section 42 Paragraph 2 Z 1 VwGG.
37 From the conduct of the requested hearing before
The Administrative Court was able to distance itself in accordance with Section 39 Para. 2 Z 6 VwGG
be taken because the present case does not involve questions of
assessment of evidence or disputed findings of fact, but in the
Revision legal questions were raised that were not complex in nature
have, especially since the central legal question already refers to the case law of the ECJ
could be referred (see VwGH August 3, 2023, Ro 2020/04/0035,
Rn. 35, mwN), and to solve them in the sense of the judicature of the ECHR
an oral hearing is not required (cf. VwGH May 9, 2023,
Ro 2020/04/0037, Rn. 81, mwN).
38 The decision on reimbursement of expenses is based on Sections 47 ff VwGG
in particular Section 1 Paragraph 1 Letter a VwGH Expense Reimbursement Ordinance, according to which
the flat rate amount for the filing costs for the submission of the
Revision contrary to the recorded flat rate of € 2,180.-- only
€ 1,106.40. Sales tax is not separate according to Section 47 Paragraph 1 VwGG
to be awarded because this is already included in the flat-rate written expenses
is included (see on the latter VwGH April 10, 2020, Ra 2018/04/0154 to 0155,
34).
Vienna, February 1, 2024
Administrative Court
Judenplatz 11, 1010 Vienna
www.vwgh.gv.at
