Data protection organization noyb files injunction lawsuit against credit agency CRIF

Max Schrems, founder of noyb, spoke to journalists on Tuesday and announced that a class action would follow the injunction lawsuit in the second half of this year. Noyb assumes around 500 euros in damages for each person who has unlawfully ended up in the database, or been "scored." Registrations for the collective action have also been accepted since Tuesday.

To participate in the class action, those affected must be over 18 years of age, have no collection claims or insolvencies, and have lived in Austria for two years. noyb is financing the proceedings; participants pay 39 euros only in the event of success, or 19 euros in advance, and supporting members can join free of charge.

Data basis and methodology

Schrems explained that the credit score is based in 90 percent of cases only on general data such as a person's age, gender, and address. According to noyb, in the vast majority of cases CRIF has no more than a name, address, and date of birth. A request sent in May to cease unlawful data processing practices, addressed to CRIF, went unanswered according to noyb.

Among other sources, the group obtains its data from AZDirect, a Bertelsmann subsidiary, from address provider DPIT, and from the Compass Group for corporate data. The data is also said to originate largely from address brokers, to whom it was made available for marketing purposes. CRIF also draws on official registers such as the business information system GISA and the register of associations.

According to its own figures, CRIF holds 9.7 million data records, "essentially" individuals, although there are some duplicate entries for sole proprietors. The credit agency was founded in Italy in 1988 and is active in more than 40 countries. In Austria, it is, alongside KSV 1870, one of the leading providers of credit information on private individuals. The scores range from 250 to 700 points.

According to noyb, the calculation draws on no financial data of those affected, but rather on factors such as frequent moves, the number of email addresses and telephone numbers, and the length of time a person has been listed in the database. Schrems reported that in one case, a person's score rose by 150 points after moving from Vienna to Carinthia. In general, creditworthiness is rated lower in the city than in the countryside, and women are attributed a higher credit rating than men.

CRIF's arguments

As evidence of the rating's lack of meaningfulness, Schrems cited the late billionaire Dietrich Mateschitz, to whom CRIF had attributed a slightly below-average credit rating of 540 points. Schrems said: "Ich und mein halbes Team bekommen keine Kreditkarte, da wir rausgelöscht wurden." Magenta had, however, not given CRIF any consent to use the inquiries, the activist criticized.

CRIF told the KURIER that the score does not make a statement about a person's creditworthiness, but rather calculates the probability of payment default. The interpretation of the data lies with the clients. CRIF also pointed out that consent for the use of data to calculate creditworthiness is neither planned nor required, and invoked a legitimate interest in "appropriately assessing credit-related risks."

Ingrid Francisco, Ingrid Francisco, rejected the allegations. Persons without negative financial reports always have a "positive middling score," so that they can "participate unhindered in economic life." Francisco described Schrems' claim that he had been deleted from the database as "sheer nonsense"; Schrems and his colleagues remain listed in the database. She said that a private organization apparently wanted to fundamentally call into question the business model of the entire credit agency industry.

Outlook on the legal dispute

Noyb was founded by Schrems in 2017 and has prevailed in data protection matters against tech groups including Meta. In 2015, Schrems brought down an EU data-sharing agreement with the USA. At noyb, it is convinced that the indiscriminate collection of data and the scoring of people for whom no credit-relevant data is available violates the General Data Protection Regulation.

Noyb expects a lengthy legal dispute. Schrems assumes that the question of the admissibility of the redress actions alone will go through several instances before the affected persons' claims for damages are even examined on their merits. noyb expects the proceedings to go through all instances up to the Supreme Court.