Is it permitted to purchase personal data from address databases and use it for credit rating purposes?

1. Facts of the case

Three separate cases against the same credit reference agency were recently brought before the Supreme Court (6 Ob 147/25y, 6 Ob 148/25w and 6 Ob 151/25m). All had the same aim: to prohibit the credit reference agency from producing credit ratings (credit scores) based on personal data.

2. What exactly is the problem?

Personal data may only be processed in accordance with the principle of purpose limitation. This means that it may only be processed for the specific purpose for which it was collected. It must not be processed in a manner incompatible with that purpose (Article 5(1)(b) of the GDPR).

3. Legal assessment by the Supreme Court

The Supreme Court had to determine whether the credit reference agency was permitted to use the data for credit rating purposes. The claimants alleged that the credit reference agency had breached the principle of purpose limitation by using their data for credit rating purposes.

Originally, Adressverlag had collected the data in question for marketing purposes on the basis of a statutory authorisation. Section 151(3) of the Trade Regulation Act (GewO) allows direct marketing companies to collect personal data to a certain extent, irrespective of whether the data subjects have given their specific consent.

The credit reference agency used the data to identify and assess the creditworthiness of its clients’ potential business partners. This constituted a change of purpose in the processing of data that had originally been collected for a different purpose. Whilst this is not automatically prohibited, consent must be obtained from the individuals whose data is being processed. As the credit rating agency failed to do so, the Supreme Court ruled that the data processing was unlawful.

4. What do companies need to bear in mind?

The purpose for which the data is collected is decisive for its lawful use. Personal data may only be used for the purpose specified at the time of collection. This applies not only within the company, but also when data is obtained from a data supplier, such as a directory publisher. If processing is to be carried out nonetheless, the consent of the data subjects must be obtained beforehand.

About the author:

Ms Mag. Sylvia Unger has been a solicitor for over 25 years and founded her own law firm, ‘Unger Rechtsanwälte’, in 2011.

Her areas of expertise are employment law, company law, contract law and payment transactions law. She is the (co-)author of several specialist books, gives lectures on employment law, company law and payment transactions law, and advises companies across a wide range of sectors.