noyb has filed a lawsuit against the credit reference agency CRIF GmbH and the address trader AZ Direct. The companies secretly trade the address data of almost every adult in Austria. By doing so, CRIF obtains information that was actually collected for advertising purposes - in order to calculate credit ratings. As the Austrian data protection authority confirmed in two decisions, this violates the GDPR. noyb is now suing for injunctive relief and damages, among other things.
Data protection violations as a business model. The address trader AZ Direct (part of the Bertelsmann Group) regularly provides personal information such as name, address, date of birth and gender of Austrians to the credit reference agency CRIF. This is illegal, as address publishers are only allowed to share this data for advertising purposes. In reality, however, CRIF uses the data to calculate people's (supposed) creditworthiness. This can have far-reaching consequences, such as the rejection of contracts or poorer conditions when granting loans.
Unlawful data trading simply continued. The Austrian data protection authority (DSB) has confirmed in two decisions (following a noyb complaint) that this practice is unlawful: the secret data trading is not compatible with the data protection principle of purpose limitation and takes place without a suitable legal basis in accordance with the GDPR. Despite this clear position, the authority has not yet taken any measures to stop the illegal data processing. noyb has therefore filed a lawsuit with the Vienna Regional Court for Civil Matters on behalf of seven affected persons.
Max Schrems, Chairman of noyb: "AZ Direct and CRIF continue to illegally profit from the data of millions of people in Austria - and the data protection authority has so far done nothing to put a permanent stop to this illegal data trading. We therefore see no other option than to turn to the civil courts."
Injunction, damages and restitution of the enrichment demanded. The aim of the lawsuit is to obtain an injunction. CRIF and AZ Direct should be prohibited from continuing with the illegal data processing. In addition, noyb is demanding non-material damages for the data subjects whose data has been processed secretly and unlawfully for years. Last but not least, the two companies have unlawfully enriched themselves through the data processing. CRIF and AZ Direct must therefore explain how much money they have earned per data subject and then hand over this money.
Max Schrems: "CRIF and AZ Direct are trading millions of data records behind the backs of the data subjects without obtaining the necessary consent. We are convinced that appropriate compensation will have to be awarded here."
Just the first step. The lawsuit with seven affected individuals is just the beginning. CRIF holds the data of millions of people in Austria, most of which originates from address publishers such as AZ Direct. In most cases, the people affected know nothing about this, as neither AZ Direct nor CRIF fulfil their obligations to provide information under data protection law.
Max Schrems: "From the proceedings before the supervisory authority, we know that AZ Direct has shared the data of more than 7 million people in Austria with CRIF. All of these people have the opportunity to take legal action against the unlawful processing. We are currently examining the possibilities of asserting such claims in class action proceedings."
Exercise your rights! You too can find out whether CRIF has improperly collected your data from an address publisher such as AZ Direct. To do so, submit a request for information in accordance with Article 15 GDPR to CRIF (auskunft@crif.com) and ask in particular about the origin of the processed data. Please note: CRIF systematically withholds certain consumer data; it may be necessary to follow up on this. More information can be found here. CRIF is obliged to provide you with all information within one month at the latest.
