The data subject requested access under Article 15 GDPR from the controller (a credit information agency)

Date of Decision November 14, 2025 Legal Provision B-VG Art. 133(4) GDPR Art. 15 GDPR Art. 4(1) B-VG Art. 133 (current version); B-VG Art. 133 effective from Jan. 1, 2019, to May 24, 2018, last amended by Federal Law Gazette I No. 138/2017 B-VG Art. 133 effective as of January 1, 2019, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 effective from May 25,May 2018 through December 31, 2018; last amended by Federal Law Gazette I No. 22/2018; B-VG Art. 133; effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164/2013, B-VG Art. 133, effective from Jan. 1, 2014, through July 31, 2014, last amended by Federal Law Gazette I No. 51/2012 Federal Constitutional Law (B-VG) Art. 133, effective from January 1, 2004, through December 31, 2013, last amended by Federal Law Gazette (BGBl.) I No. 100/2003 B-VG Art. 133 effective from January 1, 1975, through December 31, 2003, last amended by Federal Law Gazette No. 444/1974 B-VG Art. 133 valid from Dec. 25, 1946, through Dec. 31, 1974, last amended by Federal Law Gazette No. 211/1946 B-VG Art. 133 valid from Dec. 19,December 1945 through December 24, 1946; last amended by StGBl.

No. 4/1945; B-VG Art. 133; in effect from January 3, 1930, through June 30, 1934 Judgment , W254 2253351-1/26E IN THE NAME OF THE REPUBLIC! The Federal Administrative Court, presided over by Judge Dr. Tatjana CARDONA as Chair, and with lay judges Mag. Viktoria HAIDINGER and Mag. Thomas GSCHAAR as associate judges, rules on the complaint filed by XXXX, represented by Attorney Mag. Robert HAUPT, LL.M., against Point 3 of the decision of the Data Protection Authority dated January 3, 2022, Ref. No. D124.4440, 2021-0.632.437, (co-party: XXXX, represented by Baker & McKenzie Rechtsanwälte LLP & Co KG) concerning a data protection matter, after conducting an oral hearing, has rightly ruled as follows:The Federal Administrative Court, composed of Judge Dr. Tatjana CARDONA as presiding judge and the expert lay judges Mag. Viktoria HAIDINGER and Mag. Thomas GSCHAAR as associate judges, rules on the complaint filed by römisch 40, represented by Attorney Mag.

Robert HAUPT, LL.M., against Point 3 of the Data Protection Authority’s decision dated January 3, 2022, Ref. No. D124.4440, 2021-0.632.437, (co-party: römisch 40, with representation provided by Baker & McKenzie Rechtsanwälte LLP & Co KG) concerning a data protection matter, after conducting an oral hearing, has rightly ruled as follows: A) I. The complaint is partially upheld, and it is determined that XXXX violated XXXX’s right of access under Art. 15(1) of the GDPR by failing to provide him, until the conclusion of the present proceedings, with information regarding the statistical data it had collected about him for the purpose of calculating his credit score. Roman numeral I. The complaint is partially upheld, and it is determined that XXXX violated XXXX’s right of access under article 15, paragraph 1, GDPR by failing to provide him, until the conclusion of the present proceedings, with access to the statistical data it held regarding him for the calculation of his credit score.

II. XXXX is ordered to provide XXXX with information within the scope of ruling point I within four weeks, subject to enforcement otherwise. Roman numeral two. XXXX is ordered to provide XXXX with information within the scope of point I. within four weeks, subject to enforcement if it fails to do so. III. In all other respects, the complaint is dismissed as unfounded. Roman numeral three. In all other respects, the complaint is dismissed as unfounded. The appeal is not admissible pursuant to Article 133, paragraph 4, B-VG. The appeal is not admissible pursuant to Article 133, paragraph 4, B-VG. Text Reasons for the Decision: I. Course of Proceedings: I. Course of Proceedings: 1. In an email dated April 7, 2021, the appellant first requested information within the meaning of Article 15 of the GDPR regarding the information concerning the appellant that was stored by the co-party. The co-party subsequently provided the information in a letter dated April 12, 2021. 1.

In an email dated April 7, 2021, the complainant first requested information pursuant to Article 15 of the GDPR regarding the data concerning them that was stored by the co-party. The co-party subsequently provided the information in a letter dated April 12, 2021. 2. In an email dated May 19, 2021, the complainant objected to the incompleteness of this information and requested that it be supplemented. In response to this request, the other party provided the complainant with supplementary information in a letter dated May 27, 2021. 3. In a letter dated July 13, 2021, the complainant filed a data protection complaint with the Data Protection Authority. (hereinafter: the respondent authority), stating, with regard to the subject matter of the complaint, essentially that the information provided to the complainant—consisting of first and last name, date of birth, and address, was incomplete, since the data protection statement of the co-party listed far more categories of data that were being processed, and no corresponding negative entries could be found in the information provided.

Furthermore, the information regarding the origin of the processed personal data was incomplete. 4. In the course of the administrative proceedings, the co-party provided further supplementary information in a letter dated August 19, 2021. 5. The co-party submitted its comments by letter dated the same day, stating, with regard to the complaint, essentially that it processes the following personal data of the complainant: name, date of birth, address, business role, and determined credit ratings. The privacy policy lists all categories of data that the co-party could theoretically process. However, with regard to the complainant, the co-party does not perform any other types of data processing. Since no payment history data for the complainant was available, no such data would be processed. Furthermore, a change in the credit rating could result from additional, non-personal statistical criteria that would vary depending on economic developments. 6.

In the complainant’s statement dated September 9,2021, the complainant essentially objected, with regard to the subject matter of the complaint, to the incompleteness of the information provided by the co-party concerning the complainant’s processed personal data as well as the origin of the processed data. 7. By decision dated January 3, 2022 (served on January 12, 2022), the respondent authority partially upheld the complaint and found a violation of the right to information, as the co-respondent had not provided any information pursuant to Art. 15(1)(h) of the GDPR by the conclusion of the administrative proceedings (Point 1 of the ruling). The co-party was ordered to provide the co-party with information within the scope of Decision Point 1 (Decision Point 2). In all other respects, the complaint was dismissed (Decision Point 3). 7. By decision dated January 3, 2022 (served on January 12, 2022), the respondent authority partially upheld the complaint and found a violation of the right to access, as the co-party had not provided information pursuant to article 15, paragraph 1, subparagraph h, GDPR (Point 1 of the ruling).

The co-party was ordered to provide the complainant with information to the extent specified in Point 1 of the ruling (Point 2 of the ruling). The complaint was dismissed in all other respects (Point 3 of the ruling) In its reasoning regarding Point 3 of the ruling, the respondent authority essentially argued that the complainant had failed to provide evidence that the information provided under Article 15(1), first sentence, of the GDPR was incomplete. The co-party’s privacy policy, which is intended for the general public, cannot support this argument, and there is no evidence that the co-party processes any further personal data. By citing the sources for the complainant’s data records in its letter dated August 19, 2021, the co-respondent had complied with the request for information in this regard. In its reasoning regarding point 3 of the decision, the respondent authority essentially stated that the complainant had failed to provide evidence that the information provided was incomplete with respect to article 15, paragraph 1, sentence 1 of the GDPR.

The co-party’s privacy policy, which is intended for the general public, could not support this claim, and there were no indications that the co-party processed any further personal data. By citing the sources for the complainant’s data records in its letter dated August 19, 2021, the co-party had complied with the request for information in this regard. 8. The complainant filed a timely complaint against Point 3 of the decision issued by the respondent authority in a letter dated February 7, 2022. In that letter, it was essentially argued that the complainant had not merely raised a presumption but had substantiated, in the course of the administrative proceedings, that the information provided by the co-party was incomplete with respect to Article 15(1), first sentence, of the GDPR. Furthermore, the statistical criteria used by the co-party to calculate the credit rating would also constitute personal data, as they are linked to the complainant’s age and place of residence and are thus attributable to the complainant.

Accordingly, the statistical parameters would also be subject to the obligation to provide information under Article 15(1), first sentence, of the GDPR. 8. The complainant filed a timely complaint against point 3 of the decision issued by the respondent authority in a letter dated February 7, 2022. In that letter, it was essentially argued that the complainant had not merely raised a presumption but had substantiated, in the course of the administrative proceedings, that the information provided by the co-party regarding article 15, paragraph 1, sentence 1 of the GDPR was incomplete. Furthermore, the statistical criteria used by the co-party to calculate the credit rating would also constitute personal data, as they are linked to the complainant’s age and place of residence and are thus attributed to the complainant. Accordingly, the statistical parameters are also subject to the obligation to provide information under article 15(1), first sentence, of the GDPR. 9.

The complaint in question and the related administrative act were submitted by the respondent authority in a letter dated March 28, 2022, and were received by the Federal Administrative Court on March 29, 2022. In this letter, the respondent requested that the complaint in question be dismissed. In a letter dated October 20, 2023, the co-party informed the appellant of the creditworthiness score determined by the co-party and, in a statement dated the same day, requested that the proceedings be discontinued, as the appellant’s right to information had been satisfied. 11. In statements dated November 6, 2023, and November 18, 2023, the complainant again objected to the incompleteness of the information provided to date by the co-party regarding the complainant’s processed personal data, especially since the most recent information differed in form and content from previous disclosures. With regard to the statistical parameters, the statement essentially referred to the grounds of the complaint. 12.

By order of the Case Allocation Committee dated April 29, 2025, the case in question was removed from Court Division W287 and assigned to Court Division W254. 13. On September 17, 2025, a public oral hearing was held at the Federal Administrative Court, during which both an informed representative of the co-party and a witness were examined, and the parties were given the opportunity to ask questions of the persons examined, submit further evidence, and present their positions. 14. Both the petitioner and the co-party submitted written statements following the oral hearing, in which they, in particular, resubmitted in writing the exhibits already presented during the oral hearing. II. The Federal Administrative Court has considered: II. The Federal Administrative Court has considered: 1. Findings: 1.1. In an email dated April 7, 2021, the appellant requested information from the co-party pursuant to Article 15 of the GDPR.1.1.

In an email dated April 7, 2021, the appellant requested information from the co-respondent pursuant to article 15 of the GDPR. The co-party subsequently provided the complainant, in a letter dated April 12, 2021, with the stored personal data concerning the complainant from the past six months, namely name, date of birth, address, and business role, along with the source of this data, as well as the information that no partner company had requested the credit score during this period. In a letter dated May 27, 2021, the co-party provided the complainant with supplementary information, thereby completing the table with all partner companies that had queried the identity or creditworthiness of the co-party for the period from 2014 to 2021, along with the credit scores transmitted to them. In the course of the administrative proceedings, the co-respondent provided further supplementary information in a letter dated August 19, 2021, which is essentially the same as the information provided on May 27, 2021, but additionally specifies the specific source for the data records concerning the complainant’s name and address and, regarding the calculation of the credit rating, states that this rating may also change based on static criteria dependent on overall economic trends.

In a letter dated October 20, 2023, the co-party provided the complainant with additional information in tabular form regarding this stored personal data, as well as further details about the credit rating and its calculation. Accordingly, the credit score is calculated using the following personal data of the data subject: payment history data, name, age, gender, address, and the first and last confirmations of the address. 1.2. The co-party did not provide the complainant with information regarding the specific data captured by the statistical parameters—which depend on macroeconomic trends—and which were used by the co-party to calculate the credit score for the complainant. Otherwise, the information provided by the co-party regarding the complainant’s processed personal data and its origin is complete. 2. Assessment of the Evidence: 2.1. The findings set forth in Section II.1.1. are based on the indisputable and uncontested contents of the case file, the arguments of the parties, and the documents submitted by them. 2.1.

The findings set forth in section II.1.1. are based on the indisputable and uncontested contents of the case file, the arguments of the parties, and the documents submitted by them. 2.2. In its letter dated August 19, 2021, the intervening party argued that the calculation of the complainant’s credit rating also incorporates statistical parameters that depend on economic developments and “other circumstances not related to the complainant” circumstances, on the basis of which the score of the data subject—i.e., the complainant—could change. The intervening party did not provide further details regarding which parameters these were (see section II.3.2. below regarding their legal relevance).2.2. In its letter dated August 19, 2021, the co-party stated that the calculation of the complainant’s credit rating also incorporates statistical parameters that depend on economic developments and “other circumstances unrelated to the complainant” circumstances, based on which the score of the data subject—i.e., the complainant—could change.

The co-party did not provide further details regarding which parameters these were (see section II.3.2. below regarding their legal relevance). The finding that the co-party, with the information provided on April 12, 2021, May 27, 2021, August 19, 2021, and October 20, 2023, otherwise —namely, apart from the data regarding the aforementioned statistical parameters—complied with the complainant’s request for information, and that the information regarding the complainant’s personal data processed by the co-party is therefore complete in this respect, first, it follows from the fact that the case file contains no indications that the co-party failed to provide complete information in this regard. It is therefore plausible that the co-party disclosed all personal data concerning the complainant in this respect. Second, during the course of the administrative proceedings, the complainant also failed to provide any compelling evidence or substantiated arguments that would suggest that the co-party—apart from the data regarding the aforementioned statistical parameters—processes any further personal data belonging to the complainant.

The complainant’s reference to the co-respondent’s general privacy policy and the categories of personal data listed therein, or categories of data that the co-party could theoretically process—is not sufficient to demonstrate that the co-party processes all, or at least additional, personal data pertaining to the complainant as set forth in that privacy policy. Furthermore, the wording chosen by the co-respondent in its statement of August 19, 2021 (para. 11), according to which it does not process “most” of the categories of data listed in the privacy policy with respect to the complainant, does not support the conclusion that the co-respondent failed to provide complete information in this regard. Contrary to the complainant’s view, the phrase “most” used by the co-respondent is also not inappropriate in this context. According to its general meaning, “most” refers to the largest part of a number or quantity.

The Privacy Policy contains a total of 26 different categories of data; the co-respondent provided information on four of them during the proceedings, namely: ● Identity data (first and last name, date of birth, gender, academic degree) ● Contact data (address) ● Business-related data (business role) ● Creditworthiness data (credit score) Since the co-respondent provided information on four out of 26 of the categories of data listed in the privacy policy—and processed and disclosed personal data pertaining to the complainant regarding four of these categories of data—it follows that it did not process and, consequently, did not disclose information regarding the majority, that is, the majority, of the categories of data listed in the privacy policy and, accordingly, did not process or provide information regarding them. The phrase “most” used by the co-involved party is therefore legitimate in this context and not objectionable.

The information contained in the co-party’s responses dated April 12, 2021, May 27,May 2021, and August 19, 2021, stating that the credit score is calculated based on statistical probability “in particular” on the basis of certain parameters, likewise does not imply that the co-party processes any further personal data of the complainant. Given that the co-respondent’s statement dated August 19, 2021 (paragraphs 32, 33) indicates that statistical parameters are also factored into the calculation of the creditworthiness score, the use of the phrase “in particular” is not objectionable either. The complainant’s argument, which is merely general in this respect, amounts—in accordance with the case law of the Administrative Court—to an inadmissible request for evidentiary investigation, which the Administrative Court is not obligated to consider (VwGH Sept. 17, 2019, Ra 2019/18/0332; VwGH July 19, 2021, Ra 2021/14/0231). 3.

Legal Assessment: Regarding A) Partial Grant of the Complaint: 3.1. Legal Basis: Art. 4(1)(1) GDPR – DefinitionsArticle 4, paragraph one, subparagraph one, GDPR – Definitions For the purposes of this Regulation, the following terms shall have the following meanings: 1. “personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”); (…) Art. 15 GDPR – Right of Access by the Data SubjectArticle 15, GDPR – Right of Access by the Data Subject (1) The data subject has the right to obtain from the controller confirmation as to whether personal data concerning him or her are being processed; if this is the case, he or she has the right to access such personal data and to receive the following information: a) the processing purposes; b) the categories of personal data being processed; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; d) if possible, the planned period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period; e) the existence of a right to rectification or erasure of the personal data concerning them, or a right to restriction of processing by the controller, or a right to object to such processing; f) the existence of a right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to the source of the data; h) the existence of automated decision-making, including profiling, pursuant to article 22 paragraphs 1 and 4, and—at least in such cases—meaningful information regarding the logic involved, as well as the scope and intended consequences of such processing for the data subject.

(2) Where personal data are transferred to a third country or to an international organisation, the data subject has the right to be informed of the appropriate safeguards pursuant to article 46 in connection with the transfer. (3) The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. If the data subject submits the request electronically, the information shall be provided in a commonly used electronic format, unless the data subject specifies otherwise. (4) The right to receive a copy pursuant to paragraph 1b shall not infringe upon the rights and freedoms of others. 3.2. On the Merits: In summary, the complaining party bases the present complaint, on the one hand, on the fact that the co-respondent must process additional data belonging to the data subject in addition to the personal data already disclosed, which is evident in particular from the more comprehensive privacy policy.

However, as the assessment of the evidence has already shown, there is no substantiated basis for this claim, which is why this part of the complaint could not be upheld even at the factual level. Second, the complainant considers the statistical parameters processed by the co-respondent—which depend on macroeconomic trends—to be personal data attributable to the complainant. The co-respondent, however, maintains that these parameters are not personally identifiable and therefore do not require disclosure. It must therefore be clarified from a legal perspective whether the macroeconomic statistical parameters used by the co-party to calculate the credit rating constitute personal data within the meaning of Article 4(1) of the GDPR.It must therefore be clarified from a legal perspective whether the macroeconomic, statistical parameters used by the co-respondent to calculate the credit rating constitute personal data within the meaning of article 4(1) of the GDPR.

Article 4(1) of the GDPR defines “personal data” as any information relating to an identified or identifiable natural person.Article 4(1) of the GDPR defines “personal data” as any information relating to an identified or identifiable natural person. The use of the term “any information” in connection with this definition indicates that the term is to be interpreted broadly. It is not limited to sensitive or private information but potentially encompasses all types of information, both objective and subjective in nature, in the form of statements or assessments, provided that the information relates “to” the person in question. The latter condition is met if the information is linked to a specific person by virtue of its content, purpose, or effects (CJEU Dec. 20, 2017, C-434/16, Nowak, para. 34 et seq.). Therefore, internal states such as opinions, motives, desires, convictions, and value judgments, as well as statistical statements of probability that do not merely represent prognostic or planning values but provide subjective and/or objective assessments regarding an identified or identifiable person, constitute personal data (Supreme Court of Austria, April 15, 2021, 6 Ob 35/21x, para. 20; similarly, VwGH Dec. 14, 2021, Ro 2021/04/0007, para. 27).

In the facts underlying these judicial decisions, the defendant (the appellant) collected information on the political party affiliations of the entire Austrian population through anonymous surveys and statistics in order to define “target group segments” based on sociodemographic characteristics using an algorithm. Individuals were then assigned to one or more marketing groups and marketing classifications based on their place of residence, age, gender, etc., and the data was ultimately sold. The Supreme Court (OGH), like the Administrative Court (VwGH), held that this information is subject to the GDPR, as it was directly attributable to the data subjects. According to the OGH and the VwGH, the fact that the data was calculated (merely) based on statistical probabilities does not alter the fact that it constitutes personal data. In the present case, the co-party stated in a letter dated August 19,2021, the co-party explained to the complainant that in calculating the credit rating, “additional non-personal statistical criteria are also taken into account, which change regularly and necessarily depending on economic developments and other circumstances unrelated to the complainant.”

These parameters could also affect the credit rating and cause it to change. The co-party thus incorporated this statistical data into the algorithm it used to calculate the complainant’s credit rating. Through this process, however, the co-respondent assigned this data to the specific individual—the complainant—whom it had identified, in order to make a direct statement about that individual—namely, an assessment of their creditworthiness. In other words, it related this data to the complainant as an individual. Contrary to the co-respondent’s view, the statistical parameters in question—which depend on macroeconomic trends and which the co-respondent attributed to the complainant—are therefore also personal data within the meaning of Art. 4(1) of the GDPR and are thus covered by the right of access under Art. 15(1) of the GDPR.The statistical parameters in question, which depend on macroeconomic trends and which it attributed to the complainant, are thus—contrary to the view of the other party—also personal data within the meaning of Article 4(1) of the GDPR and are therefore covered by the right of access under Article 15(1), paragraph 1, GDPR.

The complaint against point 3 of the contested decision of the Data Protection Authority was therefore to be granted in this respect, and it was to be determined that the co-party thereby violated the complainant’s right of access under Art. 15(1) of the GDPR by failing to provide the complainant with information regarding the statistical data relating to the complainant used to calculate the credit rating until the conclusion of the present proceedings. The co-party is accordingly ordered to provide the complainant with information to this extent within a period of four weeks, subject to enforcement if this requirement is not met.The complaint against point 3 of the contested decision of the Data Protection Authority was therefore upheld to this extent, and it was determined that the co-party violated the complainant’s right to access information pursuant to article 15, paragraph 1, GDPR by failing to provide the complainant with information regarding the statistical data relating to the complainant used to calculate the credit score until the conclusion of the present proceedings.

The co-party is accordingly ordered to provide the complainant with such information within a period of four weeks, subject to enforcement if it fails to do so. Re B) Inadmissibility of the appeal: The appeal is inadmissible pursuant to para 133(4) of the Federal Constitutional Law (B-VG) because the decision does not depend on the resolution of a legal issue of fundamental importance. Neither does the decision in question deviate from the Administrative Court’s previous case law, nor is there a lack of case law; furthermore, the Administrative Court’s existing case law cannot be deemed inconsistent. Nor are there any other indications that the legal issue at hand is of fundamental significance. The criteria for classifying statistical data as “personal data” within the meaning of the GDPR have already been clarified by the highest courts (see again CJEU, Dec. 20, 2017, C-434/16; Supreme Court, April 15, 2021, 6 Ob 35/21x; Administrative Court, December 14, 2021, Ro 2021/04/0007).An appeal is not admissible pursuant to article 133, paragraph 4, of the Federal Constitutional Law (B-VG), because the decision does not depend on the resolution of a legal issue of fundamental importance.

Neither does the decision at issue deviate from the Administrative Court’s previous case law, nor is there a lack of case law; furthermore, the Administrative Court’s existing case law cannot be deemed inconsistent. Nor are there any other indications that the legal issue to be resolved is of fundamental importance. The criteria for classifying statistical data as personal data within the meaning of the GDPR have already been clarified by the highest courts; see again CJEU, Dec. 20, 2017, C-434/16; Supreme Court, April 15, 2021, 6 Ob 35/21x; Administrative Court, December 14, 2021, Ro 2021/04/0007).