Austrian Supreme Court finds CRIF violated GDPR purpose limitation

What happened

• The court confirmed that reusing data collected for direct‑marketing for credit assessments is illegal under Article 5(1)(b) GDPR.
• The decision follows earlier injunctions and complaints filed by privacy group noyb and lawyer Robert Haupt.
• The ruling removes a key legal obstacle for the class action that noyb is preparing against CRIF.
• The judgment applies to all credit reference agencies that source data from address publishers in Austria.

Why it matters

Other credit bureaus that obtain marketing data from address publishers must cease that practice or face similar legal challenges, and should review data‑source contracts for GDPR compliance.

Business impact

Companies will need to audit data‑acquisition pipelines and may have to renegotiate contracts with address publishers, potentially increasing compliance costs and delaying credit‑scoring projects.

What to check

1. 1

   audit data sourcesHigh priority

   Verify that any personal data obtained from address publishers is not used for credit scoring unless a specific GDPR‑compliant purpose is documented.

2. 2

   revise contractsMedium priority

   Amend agreements with address publishers to prohibit reuse of marketing data for credit‑assessment purposes.