Austrian OGH: Marketing Data Not Permitted for Credit Assessments

Sept 10, 2026 Benn-Ibler Rechtsanwälte

In the decision at issue, the Austrian Supreme Court (Oberster Gerichtshof, hereinafter OGH) was required, among other issues, to consider whether personal address data originally collected for the purposes of an address-publishing and direct-marketing undertaking may subsequently be used for credit assessment purposes.

Address info for marketing purposes

In the case under consideration, a credit reporting agency had obtained personal data from an address publisher, including the data subjects’ names, dates of birth, and addresses. The information had initially been collected for address publication and direct-marketing purposes.

The defendant subsequently used the data in conducting credit assessments, particularly to establish and verify the identity of the person subject to the inquiry. The plaintiffs argued that this use constituted an impermissible change of purpose.

Infringement of the purpose limitation principle

The OGH initially determined that using address data collected for marketing purposes in credit assessments constitutes *processing for a changed purpose*. The relevant consideration is not limited to whether the data is incorporated directly into the credit-scoring algorithm. In the OGH’s view, identity verification conducted during a credit assessment, including verification of a change of address, forms part of the credit-scoring process. Consequently, a change of purpose occurs even where the purchased address data does not directly contribute to the calculation of the credit score.

No statutory basis under the Austrian GewO

In the OGH’s view, sections 151 and 152 of the 1994 Austrian Trade, Commerce and Industry Regulation Act (Gewerbeordnung, hereinafter GewO 1994) cannot justify such further processing.

Section 151 of the GewO 1994 regulates the collection and use of data by address publishers and direct-marketing enterprises for marketing purposes. By contrast, Section 152 governs the activities of credit reference agencies but does not establish a statutory mandate to collect or process address data obtained from third parties for the purpose of assessing creditworthiness.

Accordingly, transfer of the data by an address publisher does not automatically mean that the data may subsequently be used for a different purpose, in particular for the assessment of creditworthiness.

Change of purpose and balancing of interests

The OGH thereby emphasised the importance of the purpose limitation principle under the GDPR. As a general rule, individuals who provide their address details for the purposes of address publishing or direct marketing should not have to expect that those data will subsequently be used for a credit assessment.

Such further processing may also have significant consequences for the data subject, since a poor credit score may, for example, make it more difficult to obtain credit or enter into other transactions.

Credit score permissible without payment history data

This must be distinguished from the question of whether a credit reference agency may calculate a credit score even if no specific payment history data is available.

In the OGH’s view, this is not, in itself, impermissible. The processing of personal data for the purpose of calculating a credit score may, in principle, be based on a legitimate interest under Article 6(1)(f) GDPR. It is essential to ensure compliance with all applicable statutory and data-protection requirements and to give due consideration to the data subject’s interests when conducting the requisite balancing exercise.

Claim for injunctive relief in the event of unlawful processing

Finally, the OGH confirmed that processing personal data in violation of the purpose-limitation principle may give rise to a claim for injunctive relief under Austrian law. The right to data protection is recognised as a personality right. Accordingly, where that right has been infringed or is at risk of infringement, an action for injunctive relief may be brought subject to the conditions set out in section 20(1) of the Austrian General Civil Code (Allgemeines bürgerliches Gesetzbuch, ABGB).

OGH 6Ob147/25y (12 August 2026)