Can any profile be requested to be deleted? On the limitation of the right to forget from the Austrian court judgment

Can an individual who has been declared bankrupt and experienced a debt reorganization claim the right to forget from the credit scoring agency, asking the credit scoring agency to delete past bankruptcy records or related financial information?

The Austrian court gave the answer, no.

Personal data subjects claim the right of forgetting to the Austrian Personal Data Authority (DSB) in accordance with Article 17 GDPR, requesting the credit scoring agency to delete past financial data. The Austrian personal information authority has determined that the credit scoring agency does not need to delete past financial data in the following order of judgment.

Violation of GDPR Article 5 Personal Information Collection Principles?

The court found that the credit scoring agency complied with the principles of personal data collection and processing stipulated in Article 5 of the GDPR, the clarity of the purpose, the minimum data collection and the correctness of the data, the timely update of personal-related information, and the data is for the future of the individual. Payment behavior provides the data necessary for prediction. In addition, regarding the time limit for storage, there is currently no clear upper limit for the storage time in the GDPR, nor in Austria’s domestic laws related to personal data. Therefore, it must be judged on a case-by-case basis whether it is necessary to go online for the storage time. However, the court has established some standards, 1. The longer the storage time, the less relevant the information will be to the purpose, 2. The storage time of the information needs to take into account the regulations applicable to the agency, such as credit scoring agencies will apply, EU Capital Requirements Directive Regulation (EU) No 575/2013 (Capital Requirements Regulation). According to this directive, credit institutions are obliged to carry out different risk assessment tests on their customers, and therefore require at least 5 years of information. The bankruptcy record and debt amount are of great importance to personal credit scores, and the incident occurred in 2016, so it is necessary to preserve it.

Legality of personal data processing in violation of Article 6 of the GDPR?

The court also found that the credit scoring agency complies with the provisions of Article 6(1)(f) of GDPR, and the interests of third parties (credit institutions and banks, etc.) are greater than the interests of individuals. Therefore, although individuals request deletion, they are still in the process of credit risk control. Although the interest in needing this capital outweighs the individual's will, this can be derived from the norms of the EU Capital Requirements Directive.

The court affirmed the claims of the credit scoring agency based on the above two reasons, and rejected the individual's claim to delete personal information. The whole case is currently on appeal. How the court will determine the storage time and how financial-related personal data should be stored is also worth watching.

Original link: Kai's Lawlawland