Data processing not unlawful if the duty to inform pursuant to Art. 14 of the GDPR is breached

Published 18/02/2021

On 21 October 2020, the Federal Administrative Court (BVwG) ruled on W274 2232028-1/3E in connection with a credit agency that may have violated the duty to inform pursuant to Art. 14 of the GDPR: doing so does not necessarily mean that the data processing itself was illegal. The BVwG therefore did not uphold the complaint.

Although the BVwG’s decision is to be welcomed from a business perspective, it contradicts previous data protection authority case law (30 November 2018, DSB-D122.954/0010-DSB/2018), in which the authority ruled in favour of deletion due to lack of information pursuant to Art. 14 GDPR. The Supreme Court (OGH) has also consistently ruled (albeit under the former Data Protection Act 2000) that registering a data subject in a credit risk database without notifying them is unlawful (6 Ob 275/05t, 6 Ob 247/08d).

Despite the recent BVwG ruling, companies should not neglect their duty to inform, as violations could result in severe penalties under the GDPR.