The controller runs an address publishing business as well as a credit information agency

The plaintiff’s petition for review is granted in part. The contested judgement, which otherwise remains unchanged, is amended to the effect that the decision regarding point 1(2) of the first-instance court’s ruling shall read as follows: “The defendant is ordered to refrain, effective immediately, from granting third parties further access to the ‘Identity and Creditworthiness Database’ with respect to the plaintiff’s data, as long as the plaintiff’s data is being unlawfully processed by the defendant’s data providers, who continue to transmit to the defendant at least the name, address, and date of birth (of the plaintiff), which they originally collected for the purposes of address listing and direct marketing, to the defendant, who subsequently processes this data for credit assessment purposes pursuant to § 152 GewO 1994.”“The defendant is ordered to refrain, effective immediately, from granting third parties further access to the ‘Identity and Creditworthiness Database’ with respect to the plaintiff’s data, as long as the plaintiff’s data is being unlawfully processed by the defendant’s data suppliers, who transmit at least the name, address, and date of birth (of the plaintiff), which they originally collected for the purposes of address publishing and direct marketing, to the defendant, who subsequently processes this data for credit assessment purposes pursuant to Section 152 of the GewO 1994.” 4.

The rulings on costs issued by the lower courts are set aside. The Court of Appeals is directed to render a decision on the costs of the first- and second-instance proceedings. The defendant is ordered to reimburse the plaintiff for the costs of the appeal proceedings, set at 381 EUR (out-of-pocket expenses only), within 14 days. Text Reasons for the Decision: [1] The defendant operates a business as an address directory publisher pursuant to § 151 GewO 1994 and as a credit reporting agency pursuant to § 152 GewO 1994. A* GmbH (hereinafter: “data provider”) operates as an address directory publisher and direct marketing company pursuant to § 151 of the Austrian Trade Regulation Act (GewO) of 1994. The defendant purchased data from the data provider (including, among other things) regarding the plaintiff, namely the plaintiff’s name, address, and date of birth. The defendant operates an address directory business pursuant to § 151 of the GewO 1994 and a credit reporting agency pursuant to § 152 of the GewO 1994.

A* GmbH (hereinafter: “data supplier”) operates as an address publisher and direct marketing company pursuant to Section 151 of the Austrian Trade Regulation Act (GewO) of 1994. The defendant purchased data from the data provider (including, among other things) the plaintiff’s name, address, and date of birth. The defendant uses the purchased address data to identify the person in question by cross-referencing its address database with its customers’ credit inquiries to ensure that records for the person in question actually exist. The address data serves to verify the identity of the person in question in order to check whether exactly this first and last name, in combination with the street and ZIP code, exists at that location. However, for the calculation of a specific person’s credit score—which is performed in the next step after identification is complete—the address used is the one provided to the defendant by the defendant’s client (i.e., the person making the credit inquiry) as the person’s address.

In addition, among other sources—where available—data from debt collection agencies, which can provide records of negative payment history for approximately 10% of Austrians, as well as statistical data, are used. [3] Regarding data transfer, the defendant entered into an agreement with its data provider with the following content (excerpt): “… [The defendant] has a limited right of use with respect to this address data transmitted by [the data supplier] for its own purposes of data matching, address identification, address search, address correction, and address supplementation on its own systems and in its own interpretation applications, whether in-house or out-of-house. The use of this data for other activities, as well as the transfers or disclosures of this data to third parties, whether for a fee or pro-bono, is prohibited. [The Defendant] is entitled to transmit addresses as a result of individual queries in the context of a specific creditworthiness or identity check.

If such a transfer occurs, [the Defendant] shall contractually ensure that the recipient of the transfer may neither pass these addresses on to third parties nor use them itself for marketing purposes. [...]” [4] In an addendum to this agreement, the following (among other things) was agreed upon: “[...] 2. Subject Matter of the Agreement 2.1 Subject Matter of the Processing Under the Main Agreement Provision by [the data supplier] of limited access to certain data attributes of specific individuals from its database [name of the database] for a specified period of time for the following purposes: 1. [The Defendant’s] marketing purposes for a marketing campaign and marketing campaigns that [the Defendant] carries out or prepares for third parties. 2. Reference and validation purposes, namely to determine better reachability and deliverability, for the purpose of correcting and/or supplementing the data sets of [the Defendant] or its customers, including the use of such data to improve [the Defendant’s] analyzed data sets. 3.

Other purposes for which [the data provider] and/or [the defendant] are authorized to process the data pursuant to statutory provisions. [...]” [5] The defendant’s credit reports issued regarding the plaintiff were not based on payment history data; that is, the defendant determined the plaintiff’s credit score solely on the basis of general data such as address, age, and gender, without any specific data regarding past missed payments being available. The defendant includes an explicit text notice in its reports to customers when no payment history data has been processed. [6] The plaintiff ultimately sought to prohibit the defendant from granting third parties further access to the “identity and creditworthiness database” with respect to the plaintiff’s data as long as the plaintiff’s data is being processed unlawfully, because, in particular, (1) the creditworthiness score is calculated without payment history data, without the defendant adequately informing its customers of this fact; or (2) the defendant’s data providers transmitted to the defendant at least the name, address, and date of birth (of the plaintiff)—which they had originally collected for the purposes of address listing and direct marketing—to the defendant, who subsequently processed this data for credit assessment purposes pursuant to § 152 GewO 1994; or(2) the defendant’s data suppliers transmitted to the defendant at least the name, address, and date of birth (of the plaintiff)—which they had originally collected for the purposes of maintaining an address directory and direct marketing—to the defendant, who subsequently processed this data for creditworthiness assessment purposes pursuant to Section 152 of the GewO 1994; or (3) by calculating the creditworthiness score based solely on the plaintiff’s age and place of residence, the defendant directly or indirectly discriminated against him on statistical grounds, because the calculation was not based on any payment history data. [7] The plaintiff argued—insofar as still relevant in the appeal proceedings—that the defendant had violated the principle of purpose limitation pursuant to Article 5(1)(b) of the GDPR and had therefore unlawfully processed the plaintiff’s data in violation of Article 6(1) in conjunction with Article 6(4) of the GDPR by subsequently using at least the plaintiff’s name, address, and date of birth—which the data provider had originally collected for the purposes of address publishing and direct marketing—subsequently processed them for creditworthiness assessment purposes under § 152 of the 1994 Trade Regulation Act (GewO).

The plaintiff did not give his consent for this. There is also no legal basis for such processing, nor is the intended secondary purpose compatible with the purpose for which the data was originally collected. Furthermore, the defendant has no legitimate interest in processing the data without payment history data. The plaintiff argued—insofar as still relevant in the appeal proceedings—that the defendant had violated the principle of purpose limitation under Article 5(1)(b) of the GDPR and had therefore unlawfully processed the plaintiff’s data in violation of Article 6(1) in conjunction with Article 6(4) of the GDPR by subsequently processing at least the plaintiff’s name, address, and date of birth—which the data provider had originally collected for the purposes of address publishing and direct marketing—for creditworthiness assessment purposes under Section 152 of the Trade Regulation Act (GewO) 1994.

The plaintiff did not give his consent for this. Furthermore, there is no legal basis for such processing, nor is the intended secondary purpose compatible with the purpose for which the data was originally collected. Nor does the defendant have a legitimate interest in the processing without payment history data. [8] The defendant countered that, for the purpose of § 152 of the GewO 1994, the plaintiff’s name was processed, date of birth, and address of the plaintiff, as well as his creditworthiness score—determined on the basis of the parameters listed in the information provided, for which the plaintiff’s age and place of residence were used—for the purposes of § 152 GewO 1994. The transfer of address data from the data provider to the defendant was permissible, as this data was obtained without any analytical activity and was not subject to the purpose limitation under § 151(6) of the 1994 Trade Regulation Act (GewO).

It is inherent in the lawful activity of an address publisher that the address publisher performs transfers of data to its customers for the purpose of conducting its business. This purpose is multifaceted and not limited to marketing purposes. Furthermore, the activity of an address publisher in general—and the transfers of address data in particular—is based on a legal provision of the Union or the Member States within the meaning of Article 6(4) of the GDPR, namely the provision of § 151 of the GewO 1994. Thus, a transfer by an address publisher to its customers is, pursuant to Article 6(4) of the GDPR, ex lege compatible with the principle of purpose limitation. The purpose limitation inherently relates to the purpose determined by the controller itself. The collection of address data by the defendant is an essential part of the core business of a credit reporting agency and is based on § 152 of the 1994 Trade Regulation Act (GewO).

Before a credit check can be conducted, a credit reporting agency must perform an identity verification, which means 1. verify whether the person in question actually exists and 2. verify whether the person in question matches any individuals for whom payment history data is available in the credit reporting agency’s database. For both purposes, the processing of address data that had been used in the past by individuals with the same name in business transactions is indispensable. In any case, the data processing is compatible with the purpose. In this context, the Art of the personal data is of particular importance, especially since the address data constitutes low-threshold data. Furthermore, the consequences of further processing are predominantly in the interest of the data subject, because the inability to identify individuals typically has a negative impact on the credit score. Credit reporting agencies also constitute an essential institution of the Austrian economy and, according to reasonable expectations, would at least have address data for all participants in economic life.

The defendant’s data collection and processing could be based on an overriding legitimate interest within the meaning of Article 6(1)(f) of the GDPR, because the collection of address data by the defendant is an essential part of the core activity of a credit reporting agency, it takes place within the scope of the defendant’s business license and for the purposes transparently defined by it, which are of high societal value recognized by the legislature, the processing generally has positive consequences for the data subject and corresponds to the reasonable expectations of a person who values the legally protected interests; furthermore, it contributes to ensuring economic stability through improved assessment of credit risks and promotes consumer protection in the area of consumer credit law. The defendant countered that, for the purpose of Section 152 of the Trade Regulation Act (GewO) of 1994, the plaintiff’s name, date of birth, and address were processed, as well as his creditworthiness score—determined based on the parameters listed in the information provided—for which the plaintiff’s age and place of residence were used.

The transfer of address data from the data provider to the defendant was permissible, as this data was obtained without any analysis and was not subject to the purpose limitation under paragraph 151(6) of the Trade Regulation Act (GewO) of 1994. It is inherent in the lawful activity of an address publisher that the address publisher performs transfers of data to its customers for the purpose of conducting its business. This purpose is multifaceted and not limited to marketing purposes. Furthermore, the activity of an address publisher in general—and the transmission of address data in particular—is based on a legal provision of the Union or the Member States within the meaning of article 6(4) of the GDPR, namely the provision of paragraph 151 of the GewO 1994. Consequently, the transfer of data by an address publisher to its customers is, pursuant to article 6(4) of the GDPR, ex lege compatible with the principle of purpose limitation.

The purpose limitation necessarily relates to the determination of the purpose by the controller itself. The collection of address data by the defendant is an essential part of the core business of a credit reporting agency and is based on Section 152 of the Trade Regulation Act (GewO) of 1994. Before a credit check can be conducted, a credit reporting agency must perform an identity verification, which means 1. verify whether the person in question actually exists and 2. verify whether the person in question matches any individuals for whom payment history data is available in the credit reporting agency’s database. For both purposes, the processing of address data previously used in business transactions by individuals with the same name is indispensable. In any case, the data processing is compatible with the purpose. The nature of the personal data is of particular importance here, especially since the address data constitutes low-threshold data.

Furthermore, the consequences of further processing are predominantly in the interest of the data subject, because the inability to identify individuals typically has a negative impact on the credit score. Credit reporting agencies also constitute an essential institution of the Austrian economy and, in accordance with reasonable expectations, possess at least the address data of all participants in economic life. The defendant’s data collection and processing can be based on an overriding legitimate interest within the meaning of article 6, paragraph 1, (f) of the GDPR, because the defendant’s collection of address data is intrinsically necessary to the core activities of a credit reporting agency, it takes place within the scope of the defendant’s business license and for the purposes transparently defined by the defendant, which are of high societal value recognized by the legislature, the processing generally has positive consequences for the data subject, and the processing corresponds to the reasonable expectations of a person attached to legally protected values and contributes to ensuring economic stability through a better assessment of credit risks, as well as promotes consumer protection in the area of consumer credit law. [9] The court of first instance dismissed the injunctive relief claims.

Point (1) of the injunctive relief requests sought to prohibit the defendant from processing data to the extent that the credit score is calculated without payment history data, without the defendant adequately informing its customers of this fact. However, according to the findings that the defendant now includes explicit text notes in its reports stating that the calculation is not based on payment history data, this is not the case. [10] Regarding point (2) of the injunctive relief requests, the court of first instance stated that the defendant processes the data within the scope of the purpose defined in the contract with the data provider, such that the processing complies with the principle of purpose limitation within the meaning of Art. 5(1)(b) of the GDPR. Notwithstanding this, the data processing was also compatible and thus permissible within the meaning of Article 6(4) of the GDPR.

Regarding point (2) of the injunctive relief claims, the trial court stated that the defendant processes the data within the scope of the purpose defined in the contract with the data provider, such that the processing complies with the principle of purpose limitation within the meaning of Article 5(1)(b) of the GDPR. Notwithstanding this, the data processing is also compatible and thus permissible within the meaning of Article 6(4) of the GDPR. [11] Regarding point (3) of the requests for injunctive relief, the trial court stated that the processing of personal data for the purpose of issuing credit reports and the storage of such data constituted the core of the defendant’s business activities and took place in the course of conducting business under § 152 of the 1994 Trade Regulation Act (GewO), i.e., in pursuit of a legally sanctioned and legitimate purpose. The calculation of a credit score, even without payment history data, generally constitutes a legitimate interest, since it enables the defendant to provide its customers (ultimately, creditors) with—even in such a scenario, given that only about 10% of Austrians have (negative) payment history data—to make economic decisions (such as regarding payment terms like prepayment) based on a sufficient data foundation.

In this context, it should also be taken into account that, particularly in the context of e-commerce (online retail), attempts at fraud may occur, which could be prevented or reduced by the defendant’s service (and the associated data processing). Regarding point (3) of the injunctive relief claims, the trial court stated that the processing of personal data for the purpose of providing credit reports and the storage of such data constitute the core of the defendant’s business activities and are carried out in the course of the business as defined in Section 152, of the Trade Regulation Act (GewO) of 1994, i.e., for a legally sanctioned and legitimate purpose. The calculation of a credit score even without payment history data generally constitutes a legitimate interest, since it enables the defendant to provide its customers (ultimately, creditors) even in such a scenario—after all, only about 10% of Austrians have (negative) payment history data—to make economic decisions (such as regarding payment terms like prepayment) based on a sufficient data foundation.

In this context, it should also be taken into account that, particularly in the context of e-commerce (online retail), fraud attempts may occur, which could be prevented or reduced by the defendant’s service (and the associated data processing). [12] The appellate court, to which the appeal was filed solely against the dismissal of the injunctive relief sought in points (2) and (3), upheld the lower court’s decisions dismissing the claims. Although the principle of purpose limitation binds a controller other than the original one to the original purpose when data is further processed, such that the collected data is, in principle, subject to the same legal restrictions in any further processing (including by another controller) as those that applied to its collection, Sections 151 or 152 of the 1994 Trade Regulation Act (GewO) do not constitute legal provisions within the meaning of Article 6(4) of the GDPR.

There is neither identity of purpose nor compatibility of purpose within the meaning of Article 6(4) of the GDPR between the processing purposes of an address directory publisher under § 151 of the GewO 1994 and those of a credit reporting agency under § 152 of the GewO 1994. A person who provides their address data for the purposes of an address directory or for marketing purposes would not reasonably expect that this data would be used for credit assessment purposes without their consent; furthermore, the determination of a (poor) credit rating could have adverse effects on the plaintiff in a lawsuit. However, the use of address data collected for the purpose of an address directory for the sole purpose of personal identification—without this data being incorporated into the actual credit assessment process—is to be regarded as covered by § 151 of the GewO 1994, so that, in this respect, there would be no processing of data for a different purpose.

The Court of Appeals, to which the appeal was filed solely against the dismissal of the injunctive relief claims raised under points (2) and (3), upheld the lower court’s decisions dismissing the claims. Although the principle of purpose limitation binds another controller—when processing data further—to the original purpose for which the data was collected, such that the collected data is, in principle, subject to the same legal limitations in any further processing (including by another controller) as those that applied to its collection, Sections 151 or 152 of the 1994 Trade Regulation Act (GewO) do not constitute legal provisions within the meaning of article 6(4) of the GDPR. There is neither identity of processing purpose nor compatibility of processing purpose within the meaning of Article 6(4) of the GDPR. A person who provides their address data for the purposes of an address directory or for marketing purposes would not reasonably expect that this data would be used for creditworthiness assessment purposes without their consent; furthermore, the determination of a (poor) credit rating could have adverse effects on the plaintiff in the lawsuit.

However, the use of address data collected for the purpose of an address directory for the sole purpose of identifying individuals—without this data being incorporated into the actual creditworthiness assessment process—is to be considered covered by Section 151, of the GewO 1994, so that, in this respect, there would be no change in the purpose of data processing. [13] With regard to the request for an injunction raised under point (3), the appellate court concurred with the legal opinion of the trial court, according to which calculating a creditworthiness score based solely on age and place of residence—and without the availability of payment history data—is not per se impermissible, but rather reflects a legitimate interest worthy of protection under § § 152 GewO 1994. Since payment history data is available for only a small portion of the population, the credit reporting business would otherwise not be feasible.

It cannot therefore be assumed that the activities of credit reporting agencies are limited to the credit rating of individuals for whom negative payment history data is already available. The processing of data to calculate creditworthiness scores, even without payment history data, thus constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR, which —provided that the principle of purpose limitation is observed and the credit report clearly states that the credit score contained therein was determined without payment history data—is not opposed by any overriding interests or fundamental rights and freedoms of the data subject within the meaning of that provision. With regard to the request for an injunction raised in point (3), the appellate court concurred with the legal opinion of the trial court, according to which calculating a credit score based solely on age and place of residence—and without payment history data—is not per se impermissible, but rather that Section 152 of the Trade Regulation Act (GewO) of 1994 establishes a legitimate interest worthy of protection in this regard.

Since payment history data is available for only a small portion of the population, the credit reporting business would otherwise appear unfeasible. A restriction of credit reporting agencies’ activities to the creditworthiness assessment of individuals for whom negative payment history data is already available is therefore not to be assumed. The processing of data to calculate creditworthiness scores—even without payment history data—therefore constitutes a legitimate interest within the meaning of Article 6, paragraph 1, subparagraph f, GDPR, which—provided the principle of purpose limitation is observed and the credit report clearly states that the credit score contained therein was determined without payment history data—is not precluded by any overriding interests or fundamental rights and freedoms of the data subject within the meaning of that provision. [14] The Court of Appeals ruled that the ordinary appeal was admissible because there was no Supreme Court case law on whether the processing and storage of data to calculate a “credit score” solely on the basis of the data subject’s age and place of residence, even without payment history data, constitutes lawful data processing within the meaning of Article 6(1)(f) of the GDPR; nor on the question of whether, when processing address data (name, date of birth, address) collected for the purposes of address directory publication and direct marketing pursuant to § 151 GewO 1994, there is purpose compatibility within the meaning of Art. 152 of the Austrian Trade Regulation Act (GewO) of 1994, there is purpose compatibility within the meaning of Art. 6 para. 4 of the GDPR, nor on whether the mere processing of purchased address data for the purpose of identifying individuals is to be regarded as part of the creditworthiness assessment—and thus as a change of purpose.

The Court of Appeals ruled that the ordinary appeal was admissible because there was no case law from the highest court on whether the processing and storage of data to calculate a “creditworthiness score” solely based on the age and place of residence of the data subjects, even without payment history data, constitutes lawful data processing within the meaning of article 6(1)(f) of the GDPR; nor was there any such case law regarding the question of whether the processing of address data collected for the purposes of address directories and direct marketing pursuant to Section 151 of the Trade Regulation Act (GewO) of 1994 (name, date of birth, address) for the purposes of a creditworthiness assessment pursuant to Section 152 of the GewO 1994 constitutes “compatibility of purposes” within the meaning of Article 6(4) GDPR, nor does it address whether the mere processing of purchased address data for the purpose of identifying individuals—as part of the creditworthiness assessment—should be regarded as a change of purpose.

Legal Assessment [15] The plaintiff’s appeal against this decision is admissible because the appellate court’s assessment regarding the issue of data processing involving a change in purpose requires correction, as does the assessment of whether the determination and disclosure of a “creditworthiness score” without payment history data constitutes unlawful data processing within the meaning of Article 6(1)(f) of the GDPR; there is no Supreme Court case law on this matter; the appeal is also partially justified. The plaintiff’s appeal against this decision is admissible because the appellate court’s assessment regarding the issue of data processing for a different purpose requires correction, and because there is no Supreme Court case law on the question of whether the determination and disclosure of a “creditworthiness score” without payment history data constitutes unlawful data processing within the meaning of article 6(1)(f) of the GDPR; there is no supreme court case law on this matter; this argument is also partially justified.

In its judgement in Case C-655/23 (IP v. Quirin Privatbank AG), the CJEU answered questions 1 through 3, which had been referred to it by the Federal Court of Justice (Germany) in a request for a preliminary ruling dated September 26, 2023 regarding VI ZR 97/22—questions 1 through 3, which were also decisive for the outcome of the present proceedings (see 6 Ob 217/23i [stay order])—as follows: “The provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data, on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that, in favor of the data subject affected by the unlawful processing of personal data—in the event that such a person does not request the erasure of their data— do not provide for a judicial remedy enabling that person to obtain, as a preventive measure, an order requiring the controller to refrain from further unlawful processing in the future.

Roman numeral two.2.1. The right to data protection is a personal right (6 Ob 236/23h, Reasoning 4.2. = RS0134717; 6 Ob 210/23k ErwGr Roman numeral 3.3.). Since January 1, 2021, Section 20, paragraph 1, of the ABGB (Austrian Civil Code), as amended by the HiNBG (Federal Law on the Implementation of the General Data Protection Regulation, BGBl I 2020/148), has expressly established a right to injunctive relief in cases of violations of personality rights. Accordingly, anyone whose personal rights have been infringed or who has reason to fear such an infringement may (among other things) file a lawsuit for injunctive relief; see generally RS0009003 regarding claims for injunctive relief derived from personal rights as absolute rights [T2, T11]). [21] II.2.2. Accordingly, the specialized senate has already held that a controller who processes personal data unlawfully within the meaning of Art. 5(1)(a) in conjunction with Art. 6(1) of the GDPR is subject to a substantive legal duty to cease and desist toward the data subject, which —where there is a risk of a first-time or repeat violation—may give rise to a claim for injunctive relief under national law (6 Ob 189/24y, Reasoning A.5.3. et seq.; see Griebler, “Claims for Injunction in the Event of a GDPR Violation?”, Zak 2026, 204 [205]).

This also applies to the processing of personal data that does not comply with the principle of purpose limitation under Article 5(1)(b) in conjunction with Article 6(4) of the GDPR. Roman numeral 2.2.2. Accordingly, the specialized chamber has already held that a controller who processes personal data unlawfully within the meaning of Article 5(1)(a) in conjunction with Article 6(1) GDPR, are subject to a substantive legal obligation to refrain from such processing vis-à-vis the data subject, which—where there is a risk of a first-time or repeat violation—may give rise to a claim for injunctive relief under national law (6 Ob 189/24y, Reasoning A.5.3. et seq.; cf. Griebler, “Claims for Injunction in the Event of a Violation of the GDPR”, Zak 2026, 204 [205]). This also applies to the processing of personal data that does not comply with the purpose limitation principle set forth in Article 5(1)(b) in conjunction with Article 6(4) of the GDPR. [22] II.3.1.

The scope of an injunction must always be based on the specific violation (RS0037645). A defendant cannot therefore be ordered in general terms to act in a lawful manner (RS0119807 [T3]); if an unlawful act were simply prohibited, such a judgment would enable the plaintiff to seek enforcement against any act that violates the applicable provision (see RS0037581). Roman numeral 2.3.1. The scope of an injunction must always be based on the specific violation (RS0037645). A defendant cannot therefore be ordered in general terms to act in a lawful manner (RS0119807 [T3]); if an unlawful act were prohibited outright, such a judgment would enable the plaintiff to seek enforcement for any act that violates the relevant provision (see RS0037581). [23] II.3.2. It is permissible to specify the specific infringing act and extend the prohibition to similar infringements, or to describe the impermissible conduct in general terms and clarify it through individual prohibitions listed “in particular.”

These must therefore be assessed as separate claims in each case, which is why the judgment granting the claim had to be reworded without using the phrase “in particular” as stated in the statement of claim; see 4 Ob 20/22b, Reasoning 6.1 et seq.; in this sense, see also 4 Ob 104/20b, Considerations 1.1.; 6 Ob 149/21m, Considerations 1.1.). [28] Whether the processing at issue of the plaintiffs’ personal data should (also) be prohibited due to other acts of infringement is therefore not to be assessed in the present case. The claim could no longer be expanded in the appeal proceedings (Sections 483(4), 504(2) ZPO; RS0039377 [T2, T13]). Whether the processing of the plaintiffs’ personal data at issue should (also) be prohibited due to other infringing acts is therefore not to be assessed in the present case. The scope of the claim could no longer be expanded in the appellate proceedings (Paragraph 483(4) and paragraph 504(2) of the German Code of Civil Procedure (ZPO); RS0039377 [T2, T13]).

On data processing for a different purpose: Roman numeral three. On data processing for a different purpose: [29] III.1. According to the principle of purpose limitation (Art. 5(1)(b) GDPR), personal data may be collected (only) for specified, explicit, and legitimate purposes and may not be further processed in a manner incompatible with those purposes. Pursuant to Art. 6(4) GDPR, if the processing is carried out for a purpose other than that for which the personal data were collected, and is not based on the data subject’s consent or on a provision of Union or Member State law that constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives set forth in Article 23(1) of the GDPR, make a balancing assessment based on the criteria listed (by way of example) in Article 6(4)(a)–(e) of the GDPR to determine whether processing for a purpose other than that for which the personal data were originally collected is compatible with that purpose.

Roman numeral III.1. According to the principle of purpose limitation (Article 5, paragraph 1, subparagraph (b) of the GDPR), personal data may be collected (only) for specified, explicit, and legitimate purposes and may not be further processed in a manner incompatible with those purposes. Pursuant to Article 6(4) of the GDPR, if the processing is carried out for a purpose other than that for which the personal data was collected, and is not based on the data subject’s consent or on a legal provision of the Union or of the Member States that constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives set forth in Article 23, paragraph 1, GDPR, the controller must make a balancing test in accordance with the criteria listed in article 6(4), (exemplified) to determine whether the processing for a purpose other than that for which the personal data was originally collected is compatible with that purpose. [30] III.2.

Even a mere processor acting as a controller is subject to the principle of purpose limitation under Art. 5(1)(b) and Art. 6(4) of the GDPR (see CJEU C-268/21, Norra Stockholm Bygg AB, para. 28 et seq.; Hötzendorfer/Kastelitz/Tschohl in Knyrim, DatKomm [Vol. 85, December 2025], Art. 5 GDPR, para. 28). As the Court of Appeals correctly stated, the defendant is therefore bound by the original purpose of the data collection by the data provider. Roman numeral III.2. Even a mere subprocessor acting as a controller is subject to the principle of purpose limitation under article 5(1)(b) and article 6(4) of the GDPR; see CJEU case C-268/21, Norra Stockholm Bygg AB, para. 28 et seq.; Hötzendorfer/Kastelitz/Tschohl in Knyrim, DatKomm [Vol. 85, December 2025], article 5, GDPR, para. 28). As the Court of Appeals correctly stated, the defendant is therefore bound by the original purpose of the data collection by the data provider.

The defendant’s use of the plaintiff’s data resulted in a change of purpose: III.3. The defendant’s use of the plaintiff’s data resulted in a change of purpose: [31] III.3.1. The defendant’s data provider had originally collected the plaintiff’s data pursuant to the statutory authorization under § 151(3) of the Trade Regulation Act (GewO) of 1994. Roman numeral III.3.1. The defendant’s data provider had originally collected the plaintiff’s data within the scope of the statutory authorization under paragraph 151(3) of the GewO 1994. [32] § 151 of the GewO 1994 allows address publishers and direct marketing companies, within certain limits, to collect and use certain personal data for marketing purposes without the consent of the data subjects (Knyrim, “On the Admissibility of Address Trading by Österreichische Post AG,” ecolex 2019, 715 [715]; Scheichenbauer/Wirthensohn, “Austrian Address Trading in the Age of the GDPR—A Critical Analysis of § 151 of the GewO,” jusIT 2020/5, 12 [13]).

The term “marketing” generally encompasses all modern advertising, sales, and communication measures (Gruber/Paliege-Barfuß, GewO7 [as of Sept. 22, 2018, rdb.at] § 151, Note 5). Section 151 of the GewO 1994 allows address publishers and direct marketing companies, within certain limits, to collect and use specific personal data for marketing purposes without the consent of the data subjects (Knyrim, “On the Lawfulness of Address Trading by Österreichische Post AG,” ecolex 2019, 715 [715]; Scheichenbauer/Wirthensohn, “The Austrian Address Trade in the Age of the GDPR—A Critical Analysis of Section 151 of the GewO,” jusIT 2020/5, 12 [13]). The term “marketing” generally encompasses all modern advertising, sales, and communication measures (Gruber/Paliege-Barfuß, GewO7 [as of Sept. 22, 2018, rdb.at], Section 151, Note 5). [33] III.3.2. According to the findings, the defendant uses the purchased address data to identify the person in question by cross-referencing its customers’ credit inquiries with its address database to ensure that the data records for the person in question actually exist.

Roman numeral three.3.2. According to the findings, the defendant uses the purchased address data to identify the person in question by cross-referencing its address database when processing credit inquiries from its customers, in order to ensure that the data records for the person in question actually exist. [34] III.3.3. This alone shows that the defendant does not process this data for marketing purposes, but rather in the context of credit checks based on inquiries from its customers. This is particularly evident from the distinction made in the “Supplemental Agreement” between the defendant and the data provider between “marketing purposes” on the one hand and “referencing and validation purposes” on the other. The “identity check” performed during the credit assessment is to be regarded as part of the credit scoring process, even if the purchased address data is not directly incorporated into the calculation algorithm used by the defendant.

Roman numeral three.3.3. This alone shows that the defendant does not process this data for marketing purposes, but rather as part of the credit assessment in response to requests from its customers. This is particularly evident from the distinction made in the “Supplemental Agreement” between the defendant and the data provider between “marketing purposes” on the one hand and “referencing and validation purposes” on the other. The “identity check” conducted as part of the creditworthiness assessment is to be regarded as part of the credit scoring process, even if the purchased address data is not directly incorporated into the calculation algorithm used by the defendant. [35] It should be noted, merely as a supplement, that according to the defendant’s own submissions, it also uses the purchased addresses to detect when a data subject attempts to evade identification, for example by constantly changing the addresses the data subject uses in business transactions; this, too, must be regarded as part of the creditworthiness scoring (see 6 Ob 147/25y, Reasoning III.3.3.).

It should be noted, merely by way of supplement, that according to the defendant’s own submissions, the purchased addresses are also used to detect when a data subject attempts to evade identification, for example by using constantly changing addresses in business transactions; this, too, must be regarded as part of the creditworthiness scoring (see 6 Ob 147/25y, Rationale Roman numeral three.3.3.). [36] III.3.4. Thus, the defendant is engaging in further processing that changes the purpose of data initially collected for a different purpose. Roman numeral III.3.4. Thus, the defendant is engaging in further processing that changes the purpose of data initially collected for a different purpose. [37] III.3.5. It should be noted that—based on the defendant’s arguments set forth above in section III.3.3, as well as those corresponding to the facts discussed in section III.3.2—the appellate court’s assessment is not open to objection, according to which the findings regarding the calculation of the credit score using the address provided to the defendant by its customers are supported both by the parties’ submissions and by the defendant’s objections, and thus cannot be regarded as “excessive” (see RS0037972 [esp.

Sections 151 and 152 of the GewO 1994 contain no provisions regarding the processing of address data collected from third parties for the purpose of credit checks: [39] III.4.1. Section 151 of the GewO 1994 governs—as already explained (Section III.3.1.)—the collection and use of data by address publishers and direct marketing companies for marketing purposes. Section 152(1) of the GewO 1994 merely prohibits the disclosure of information regarding private circumstances that are unrelated to creditworthiness; under no circumstances may this provision be construed as a statutory mandate for data collection (RS0124264). Roman numeral 3.4.1. Section 151 of the GewO 1994 governs—as already explained (point Roman numeral 3.3.1.)—the collection and use of data by address publishers and direct marketing companies for marketing purposes. Section 152, paragraph one, of the GewO 1994 provides only for a prohibition on disclosing information about private circumstances that are unrelated to creditworthiness; under no circumstances may this provision be interpreted as a statutory mandate to collect data (RS0124264). [40] However, these provisions do not contain any regulations regarding the processing of address data collected by third parties for the purpose of creditworthiness assessments. [41] III.4.2.

Thus, Sections 151 and 152 of the GewO 1994 do not constitute domestic legal provisions within the meaning of Article 6(4) of the GDPR that would authorize the defendant to process the plaintiff’s purchased data for the purpose of credit checks. Whether the defendant’s or the data supplier’s business license generally covers such an activity—in compliance with the GDPR (see in this regard the notice from the Federal Ministry of Labor and Economy dated November 29, 2022)—is not a decision in this regard. Roman numeral 3.4.2. Thus, Sections 151 and 152 of the GewO 1994 do not constitute domestic legal provisions within the meaning of Article 6, paragraph 4, GDPR that would authorize the defendant to process the plaintiff’s purchased data for the purpose of a credit check. Whether the defendant’s or the data supplier’s business license covers such an activity—in compliance with the GDPR (see, in this regard, the notice from the Federal Ministry of Labor and Economy dated November 29, 2022)—is not a decision in this regard. [42] III.5.

The processing of the plaintiff’s personal data for the purpose of a credit check is incompatible with the original marketing purposes: Roman numeral three.5. The processing of the plaintiff’s personal data for the purpose of a credit check is incompatible with the original marketing purposes: [43] III.5.1. If—as in this case—there is no consent from the data subject or no legal provision legitimizing the change in purpose, a “compatibility test” must be conducted based on the criteria set forth in Article 6(4) of the GDPR. Accordingly, the following factors, among others, must be taken into account: 1. Any connection between the purpose of collection and the purposes of the intended further processing; 2. the context in which the personal data were collected, particularly with regard to the relationship between the data subjects and the controller; 3. the nature of the personal data, particularly whether data are being processed in accordance with Article 9 or Article 10 of the GDPR; 4. the potential consequences of the intended further processing for the data subjects; and 5. the existence of appropriate safeguards, which may include encryption or pseudonymisation.

The national Court must assess, based on these criteria and all the circumstances of the individual case, whether the further processing of the data is compatible with the purposes of the original collection (CJEU C-77/21, Digi Távközlési és Szolgáltató Kft., para. 38). Roman numeral 3.5.1. If—as in this case—there is no consent from the data subject or no legal provision legitimizing the change in purpose, a “compatibility test” must be conducted based on the criteria set forth in article 6(4) of the GDPR. Accordingly, the following factors, among others, must be taken into account: 1. Any connection between the purpose of collection and the purposes of the intended further processing; 2. the context in which the personal data was collected, in particular with regard to the relationship between the data subjects and the controller; 3. the nature of the personal data, in particular whether data is being processed in accordance with Article 9 or Article 10 of the GDPR; 4. the potential consequences of the intended further processing for the data subjects; and 5. the existence of appropriate safeguards, which may include encryption or pseudonymisation.

The national Court must assess, on the basis of these criteria and all the circumstances of the individual case, whether the further processing of the data is compatible with the purposes of the original collection (CJEU C-77/21, Digi Távközlési és Szolgáltató Kft., para. 38). [44] III.5.2. The starting point for the compatibility assessment is the purpose of the data collection by the defendant’s data provider, which in this case is marketing purposes (see above, Section III.3.1.). Roman numeral three.5.2. The starting point for the compatibility assessment is the purpose of the data collection by the defendant’s data provider, in this case marketing purposes (see section Roman numeral three.3.1. above). [45] III.5.3. There is no relevant close connection (Art. 6(4)(a) GDPR) between the marketing purposes of third parties within the meaning of § 151 GewO 1994 and credit assessment purposes within the meaning of § 152 GewO 1994.

It is not apparent why such a close connection should arise from any review cited by the defendant regarding whether promotional material can be sent to a specific address for a particular person to be advertised. Roman numeral 3.5.3. A relevant close connection (Article 6, paragraph 4, subparagraph a, GDPR) between third party marketing purposes within the meaning of Section 151 of the GewO 1994 and credit assessment purposes within the meaning of Section 152 of the GewO 1994 does not exist. It is not apparent why such a close connection should arise from any review—as asserted by the defendant—of whether promotional material can be sent to a specific address for a specific person to be targeted by advertising. [46] III.5.4. In the absence of any business or other relationship between the plaintiff and the defendant, a context for data collection within the meaning of Article 6(4)(b) of the GDPR cannot be considered in favor of the defendant either.

Roman numeral three.5.4. In the absence of any business or other relationship between the plaintiff and the defendant, a context of collection within the meaning of Article 6(4)(b) of the GDPR cannot be taken into account in favor of the defendant. [47] III.5.5. Although no sensitive or criminal data was (further) processed in this case (see Article 6(4)(c) of the GDPR). However, the credit assessment may have adverse—and in some cases serious—consequences for the plaintiff, such as the denial of future contracts or loans (see, regarding the potential impairment of the data subject’s interests due to negative factors in the credit assessment, CJEU Cases C-26/22 and C-64/22, UF and SA v. State of Hesse, para. 94). 3.5.5. Although no sensitive or criminal data was (further) processed in the present case (see Article 6(4)(c) of the GDPR), the credit assessment may nevertheless have – sometimes serious – adverse consequences for the plaintiff, such as the denial of future contracts or loans (see, regarding the potential infringement of the data subject’s interests by negative factors in a credit assessment, CJEU C-26/22 and C-64/22, UF and Committee Report v. State of Hesse, para. 94). [48] III.5.6.

The defendant neither claimed that safeguards within the meaning of Article 6(4)(e) of the GDPR had been implemented, nor were any such safeguards found. Roman numeral three.5.6. The defendant neither asserted nor were any safeguards within the meaning of Article 6(4)(e) of the GDPR found to have been implemented. [49] III.5.7. The data subject whose data was collected for marketing purposes also does not reasonably expect (see Recital 50 of the GDPR; CJEU C-77/21, Digi Távközlési és Szolgáltató Kft., para. 44) that the data collected for this purpose will be (further) processed for credit assessment purposes. The defendant fails to provide a comprehensible explanation as to why all such data subjects should be aware that “all major credit bureaus collect address data from all major address publishers in Austria”—as the defendant asserts in its response to the appeal. Roman numeral three.5.7.

A data subject whose data was collected for marketing purposes also does not reasonably expect—see Recital 50 of the GDPR; CJEU C-77/21, Digi Távközlési és Szolgáltató Kft., para. 44), that the data collected for this purpose will be (further) processed for credit assessment purposes. The defendant fails to provide a comprehensible explanation as to why all data subjects should be aware that “all major credit bureaus collect address data from all major address publishers in Austria”—as the defendant asserts in its response to the appeal. [50] III.5.8. Overall, it follows from these considerations that, according to the criteria set forth in Article 6(4) of the GDPR, the processing of the plaintiff’s personal data for the purpose of a credit assessment is incompatible with the original marketing purposes (see also BVwG W605 2271598-1 et al.; Blocher, Credit Scoring under the GDPR, VbR 2021/110, 200 [204]).

Roman numeral III.5.8. Overall, it follows from these considerations that, according to the criteria set forth in article 6, paragraph 4, GDPR, the processing of the plaintiff’s personal data for the purpose of a credit check is not compatible with the original marketing purposes (see also BVwG W605 2271598-1 et al.; Blocher, Credit Scoring Under the GDPR, VbR 2021/110, 200 [204]). [51] III.5.9. While it is recognized in case law that, for the business of credit reporting agencies pursuant to § § 152 of the 1994 Trade Regulation Act (GewO), it is indispensable to ensure objective, transparent, and, above all, truthful information regarding the solvency and payment difficulties of debtors (6 Ob 87/21v, Reasoning 3.3.; see also CJEU C-26/22 and C-64/22, UF/SA v. State of Hesse, para. 93). Insofar as the defendant refers to the fact that the processing of the plaintiff’s address data is necessary for the—legitimate —purposes of creditworthiness assessment, it must be noted, however, that in the present case, the court must make a decision solely on the admissibility of the change in purpose at issue, and not on any alternatives the defendant might have for obtaining address data (such as without a change in purpose).

The appeal is therefore well-founded in this respect. The request for an injunction in this regard must be granted. Roman numeral three.7. The appeal is therefore well-founded in this respect. The request for an injunction in this regard must be granted. IV. Regarding the calculation and disclosure of a “credit score” without payment history data: Roman numeral four. Regarding the calculation and disclosure of a “credit score” without payment history data: [55] IV.1. The defendant relies on Article 6(1)(f) of the GDPR to justify the creation of a credit score without payment history data. According to this provision, the processing of personal data is permissible under three cumulative conditions. First, the controller or a third party must have a legitimate interest; second, the processing of personal data must be necessary to achieve the legitimate interest; and third, the interests or fundamental rights and freedoms of the data subject must not override those interests (CJEU C-26/22 and C-64/22, UF/SA v. State of Hesse, para. 75; RS0133919; see also RS0133890).

The controller’s legal, economic, or non-material interests may be considered; its “interest” is, in principle, to be understood broadly. Once the interest has been identified, it must be determined from a normative perspective whether this interest conflicts with the legal order of the Union, the respective Member State, or with data protection principles, including the principle of necessity and the requirement of good faith. As a final step, it must be examined whether the data subject’s right to protection outweighs the controller’s interest. An indication that the data subject’s interests, the fundamental rights and freedoms of the data subject over the controller’s interest in processing may be recognized, in particular, by the fact that the data processing takes place in a context in which a data subject would not reasonably expect such processing to occur (6 Ob 87/21v, Reasoning 4.3.).

Roman numeral IV.1. The defendant relies on article 6(1)(f) of the GDPR to justify the creation of a credit score without payment history data. According to this provision, the processing of personal data is permissible under three cumulative conditions. First, the controller or a third party must have a legitimate interest; second, the processing of personal data must be necessary to fulfill that legitimate interest; and third, the interests or fundamental rights and freedoms of the data subject must not override those interests (CJEU C-26/22 and C-64/22, UF/SA v. State of Hesse, para. 75; RS0133919; see also RS0133890). The controller’s legal, economic, or non-material interests may be taken into account; its “interest” is, in principle, to be interpreted broadly. Once the interest has been identified, it must be determined, based on legal standards, whether this interest conflicts with the legal order of the Union, the respective Member State, or with data protection principles, including the principle of necessity and the requirement of good faith.

As a final step, it must be examined whether the data subject’s right to protection outweighs the controller’s interest. An indication that the data subject’s interests— fundamental rights and freedoms of the data subject outweigh the controller’s interest in processing may be found, in particular, in the fact that the data processing takes place in a context in which a data subject would not reasonably expect such processing (6 Ob 87/21v, Reasoning 4.3.). [56] IV.2.1. In its decision of December 7, 2023, in Cases C-26/22 and C-64/22, UF/SA v. State of Hesse (para. 83), the CJEU and explained that the processing of personal data to assess a person’s creditworthiness (“credit check”) serves not only the economic interests of enterprises in the credit reporting sector but also the protection of the legitimate interests of these enterprises’ contractual partners, who wish to enter into credit-related contracts with individuals, in assessing the creditworthiness of those individuals and, thereby, the overall socioeconomic interests of the credit sector (see Schulz in Gola/Heckmann/Rost, GDPR BDSG4 [2026] Art. 6 GDPR, para. 100 et seq.).

An analysis by a credit reporting agency that enables an objective and reliable assessment of the creditworthiness of the potential customers of the agency’s contractual partners can balance out information asymmetries and thereby reduce the risk of fraud and other uncertainties (CJEU C-26/22 and C-64/22, UF/SA v. State of Hesse, para. 93). These considerations also apply to the plaintiff’s data processed by the defendant as part of its credit reporting business to determine the plaintiff’s creditworthiness. Roman numeral IV.2.1. In its decision of December 7, 2023, in Cases C-26/22 and C-64/22, UF/SA v. State of Hesse (para. 83), the CJEU that the processing of personal data to assess a person’s creditworthiness (“credit check”) serves not only the economic interests of enterprises in the credit reporting sector but also the protection of the legitimate interests of these enterprises’ contractual partners, who wish to enter into credit-related contracts with individuals, in assessing the creditworthiness of those individuals and, thereby, the overall socioeconomic interests of the credit sector; see Schulz in Gola/Heckmann/Rost, GDPR BDSG4 [2026] Article 6, GDPR Marginal Note 100 et seq.).

In the present case, it was neither alleged nor established that such data existed regarding the plaintiff. Roman numeral IV.2.2. The assessment of creditworthiness without payment history data is also “necessary” within the meaning of article 6(1)(f) of the GDPR. According to the factual basis on which the lower courts based their decisions, (negative) payment history data is available for only a very small percentage of Austrians. If payment history data were required for the admissibility of a credit report, credit reports could not be issued to a large proportion of consumers. In the present case, it was neither alleged nor established that such data regarding the plaintiff was available. Whether, in a specific case, the interests or fundamental rights and freedoms of the person whose data is to be protected prevail must be determined by balancing the interests of the parties involved and the specific circumstances (CJEU C-26/22 and C-64/22, UF/SA v. State of Hesse, para. 79; 6 Ob 87/21v, Reasoning 4.4.).

In weighing the respective conflicting rights and interests, that is, those of the controller and the third parties involved on the one hand, and the data subject on the other hand, particular consideration must be given to the data subject’s legitimate expectations, as well as the scope of the processing in question and its impact on that person (CJEU C-26/22 and C-64/22, UF/SA v. State of Hesse, para. 87). Roman numeral four.2.3. Whether, in a specific case, the interests or fundamental rights and freedoms of the individual whose data is to be protected prevail must be determined by balancing the interests of the parties involved and the specific circumstances (CJEU C-26/22 and C-64/22, UF/SA v. State of Hesse, para. 79; 6 Ob 87/21v, Reasoning 4.4.). In weighing the respective conflicting rights and interests, that is, those of the controller and the third parties involved, on the one hand, and the data subject, on the other hand, particular consideration must be given to the data subject’s reasonable expectations, as well as the scope of the processing in question and its effects on that person (CJEU C-26/22 and C-64/22, UF/SA v. State of Hesse, para. 87). [59] IV.2.4.

The processing of creditworthiness data—including its analysis and disclosure by a credit reporting agency—constitutes, in principle, an interference with the claimant’s fundamental rights enshrined in Articles 7 and 8 of the CFR. In this context, it must be taken into account that a “poor” credit score can have a detrimental effect on creditworthiness and cause considerable harm to the interests of the data subject, since the use of such a score is likely to significantly impede the exercise of civil liberties, particularly when it comes to meeting basic needs (see Krämer in Wolff/Brink/v. Ungern-Sternberg, BeckOK DatenschutzR [56th ed., May 1, 2026], § 31 BDSG, para. 13; CJEU C-26/22 and C-64/22, UF/SA v. State of Hesse, para. 94). Roman numeral four.2.4. The processing of creditworthiness information—including its analysis and disclosure by a credit reporting agency—generally constitutes an interference with the plaintiff’s fundamental rights enshrined in articles 7 and 8 of the CFR.

In this context, it must be taken into account that a “poor” credit score can have a detrimental effect on creditworthiness and cause considerable harm to the interests of the data subject, since the use of such a score is likely to significantly impede the exercise of fundamental freedoms, particularly when it comes to meeting basic needs; see Krämer in Wolff/Brink/v. Ungern-Sternberg, BeckOK DatenschutzR [56th ed., May 1, 2026], § 31, BDSG, para. 13; CJEU C-26/22 and C-64/22, UF/SA v. State of Hesse, para. 94). [60] However, the plaintiff’s interests do not generally outweigh the interests of the defendant credit reporting agency, as set forth above, in the context of its activities to assist inquiring customers in connection with the conclusion of contracts for the protection of creditors (see 6 Ob 87/21v, Reasoning 4.10; Krämer in Wolff/Brink/v. Ungern-Sternberg, BeckOK DatenschutzR [56th ed., May 1, 2026], § 31 BDSG, para. 22 et seq.; Schulz in Gola/Heckmann/Rost, GDPR BDSG4 [2026] Art. 6 GDPR, para. 106 et seq.).

However, these interests of the plaintiff do not generally outweigh the interests of the defendant credit reporting agency, as set forth, in the context of its activities to assist inquiring customers in connection with the conclusion of contracts for the protection of creditors—see 6 Ob 87/21v, reasoning 4.10; Krämer in Wolff/Brink/v. Ungern-Sternberg, BeckOK DatenschutzR [56th ed., May 1, 2026], § 31, BDSG, para. 22 et seq.; Schulz in Gola/Heckmann/Rost, GDPR BDSG4 [2026], article 6, GDPR, para. 106 et seq.). [61] Given the large number of contracts in which enterprises make advance payments, reasonable data subjects can expect that, in many industries, this will involve an assessment of creditworthiness, even if no specific payment history data is available. [62] No further reasons why the plaintiff’s interests should outweigh those of the defendant—in particular, specific adverse consequences of the contested data processing for the plaintiff—have been established or are apparent. [63] IV.2.5.

The appeal fails to provide a comprehensible justification as to why the credit reporting agency should, in principle, have no legitimate interest in processing names, dates of birth, and addresses for the purpose of determining (among other things) creditworthiness assessments (see, regarding the admissibility of the transfer/use of “positive data,” the recent decision of the Federal Court of Justice (BGH) VI ZR 431/24, para. 50 and para. 52 et seq. [fraud prevention]). An individual creditworthiness assessment would be virtually impossible without processing this data. The appellate brief’s arguments regarding the “covert” collection of this data from the defendant’s data provider and the change in purpose (see Point II of this judgement) are irrelevant to the assessment of the present claim for injunctive relief, given that the defendant also obtained this data from its customers—that is, the enterprises that submitted the credit check requests.

Roman numeral four.2.5. The appeal fails to provide a comprehensible justification as to why the credit reporting agency should, in principle, have no legitimate interest in processing names, dates of birth, and addresses to determine (among other things) creditworthiness assessments; see, regarding the admissibility of the transmission/use of “positive data,” see most recently BGH VI ZR 431/24, para. 50 and para. 52 et seq. [fraud prevention]). An individual creditworthiness assessment would be virtually impossible without processing this data. The appeal’s arguments regarding the “covert” collection of this data from the defendant’s data provider and the change in purpose (see Roman numeral 2 of this judgement) are irrelevant to the assessment of the present claim for injunctive relief, given that the defendant also received this data from its customers—that is, the enterprises that submitted the credit check requests. [64] The mere calculation of a creditworthiness score without payment history data —which is the target of the injunction sought here in the sense of a “per se prohibition”—no violation of the principle of lawfulness under Article 5(1)(a) in conjunction with Article 6(1)(f) of the GDPR can be inferred.

A more detailed assessment of the requirements that must be met in this context for the calculation of credit scores without payment history data (see, for example, Krämer in Wolff/Brink/v. Ungern-Sternberg, BeckOK DatenschutzR [56th ed., May 1, 2026], § 31 BDSG, para. 42 et seq.), may be left open in the present case. The mere calculation of a credit score without payment history data—which is the target of the present injunction request in the sense of a “per se prohibition”—cannot be construed as a violation of the principle of lawfulness under Article 5, paragraph 1, subparagraph (a), in conjunction with article 6(1)(f) of the GDPR. For a more detailed assessment of the requirements that must be met in this context when determining credit scores without payment history data, see, for example, Krämer in Wolff/Brink/v. Ungern-Sternberg, BeckOK DatenschutzR [56th ed., May 1, 2026], paragraph 31, BDSG margin note 42 et seq.)—may be left open in the present case. [65] According to the findings, the defendant did not calculate the credit score solely on the basis of the plaintiff’s age and place of residence.