Austria’s Supreme Court Rules CRIF’s Credit Data Collection Unlawful

Austria’s Supreme Court has ruled that data collected for marketing cannot be repurposed for credit scoring, dealing a legal setback to credit agency CRIF.

The court found in several civil proceedings that CRIF breached the GDPR principle of purpose limitation. Data obtained from address publishers may be used for advertising mailings, but not for assessing a person’s creditworthiness, according to the decisions cited by privacy organization noyb.

The cases proceeded independently of noyb and took years to resolve. Robert Haupt, a lawyer who represented clients in proceedings against AZ Direct and CRIF, said, “It shows unfortunately time and again that plaintiffs in such proceedings need staying power.” He added, “It is now definitively established: data from address publishers may not be used for credit scoring.”

“

It shows unfortunately time and again that plaintiffs in such proceedings need staying power.

Noyb, founded by Austrian privacy activist Max Schrems, has criticized CRIF’s scoring practices for years. The organization says some assessments have relied on factors such as residential address, age and gender, while distinguishing those practices from scores based on actual payment defaults.

Noyb filed complaints against AZ Direct and CRIF with the data protection authority in March 2021 and said it won before both the authority and the Federal Administrative Court. It later filed an injunction action after the companies allegedly failed to implement the decisions. Noyb now plans a collective redress case against CRIF, seeking compensation of about 500 euros for each person whose data was unlawfully entered into the database or scored.

“

It is now definitively established: data from address publishers may not be used for credit scoring.