What Credit Agencies May and May Not Do

Buying goods on invoice, signing a mobile-phone contract or applying for a consumer loan can all trigger a credit check. But where may credit agencies get the data behind those assessments, and how may they use it?

Three decisions published by Austria’s Supreme Court at the end of August address those questions. The cases involved complaints against credit scores produced by CRIF, and the court found the plaintiffs at least partly right. CRIF had violated the GDPR’s purpose-limitation principle, at least at the time covered by the proceedings.

The dispute centered on data that CRIF bought from an address-publishing company for its identity and credit database. Under Austria’s trade rules, address publishers and direct-marketing firms may collect address data for marketing purposes. Using that information to verify identities as part of credit scoring has nothing to do with marketing, the court held. That amounted to an unlawful change of purpose. The data could have been used for that additional purpose only with the individuals’ consent.

The ruling could reach beyond the three cases. Privacy organization noyb, founded by Max Schrems, is considering a collective redress action. The group told APA that successful claims could result in €500 in damages for each person who was unlawfully scored. The cases concern data practices from years ago, however. CRIF told Die Presse that it no longer creates scores in the same way.

The Supreme Court also rejected a broader challenge to the business model. It said credit agencies may, and in some cases need to, assess people even when they have no previous negative payment records. The claimants had argued that scores were calculated only from age and place of residence, amounting to discrimination, but the court said that allegation was not confirmed.