FDPIC · decision ·
Credit reference agency: creditworthiness data are not for marketing
By Advisorn · guidance, not advice
In brief
The FDPIC has prohibited a credit reference agency from using data in its creditworthiness database for marketing and from using data obtained through access requests for anything but answering them. It must examine every erasure request, even one without reasons. The decision has been appealed.
What happened
Credit reference agencies process information on the business activity, creditworthiness and solvency of companies and individuals. According to the FDPIC, this agency processed and passed on for marketing the data it obtained for credit reports, breaching the principle of purpose limitation without any justification.
The agency also used the data of people who asked it for access to add to its database. The FDPIC prohibited this and ordered it to delete all data so obtained within six months of the decision becoming final.
Finally, it must examine erasure requests even when they give no reason, grant them unconditionally where there is no justification and, where there is one for keeping the data, explain it to the person in an understandable way. The agency has appealed to the Federal Administrative Court.
What it means for an SME
Before using data for a new purpose (marketing, for example), ask whether the person can expect it from your privacy notice and the circumstances of collection; otherwise you need a justification, usually consent.
What a person tells you to exercise their rights is for answering them, not for adding to your records. And do not turn down an erasure request just because it gives no reason.
Source: FDPIC communication of 29 October 2026. General information summarised from the source, not advice on your case: for your case, the text of the decision or the law is what counts.