Today, noyb filed a complaint and report against the creditors’ association KSV1870 with the Austrian data protection authority. Although Article 15 GDPR stipulates that the right of access must be free of charge, KSV is making huge profits from it. They use misleading website designs to urge people to purchase a high-priced "InfoPass" instead of getting a free copy of their data. The main target of this scheme appears to be foreigners. For example, the Department of Immigration (MA35) in Vienna requires KSV data as proof of solvency. The damage to unknowing victims is likely to run into the millions.
- Machine-translation of the Complaint and report against KSV1870 (EN)
- Report by the City of Vienna Court of Audit
Proof of financial solvency. Anyone wishing to apply for an Austrian visa or to extend their residence permit must be able to prove to the immigration authorities that they can support themselves without state assistance. For this purpose, the MA35 in Vienna, for example, checks whether the person has any outstanding loans, unpaid debts or even insolvency. The MA35 does not have this data itself though. Residence applicants must therefore request the necessary data from a creditors’ organization such as KSV. This has become a lucrative business, often at the expense of unsuspecting people.
“InfoPass” for €43 instead of free information. The MA35 explicitly accepts cost-free information in accordance with Article 15 GDPR. Despite this, KSV1870 is misleading uninformed people into believing that only a so-called “InfoPass” (that currently costs €43) can be presented to the authorities. What is being concealed and deliberately disguised: In the EU, data subjects are legally entitled to receive this information free of charge and without delay. With more than 114,000 annual applications to the Vienna MA35 alone, this amounts to millions over the years - which are taken out of the pockets of uninformed people.
Marco Blocher, data protection lawyer at noyb: ”KSV makes it almost impossible for those affected to make use of their right of access. Instead, the company tries to trick people into buying their own data by any means necessary. The main victim of this practice are people who often have few resources anyway and do not yet speak German.”
Concealment instead of simplification. According to the GDPR, companies must ensure that data subjects can exercise their legal right to information and provide the requested information in an easily accessible form. KSV is not complying with these obligations. On the contrary, the company is desperately trying to hide the fact that there’s an option to request the information free of charge. On its website, KSV is hiding it at the bottom of the page and behind manipulative designs that make it difficult to exercise your basic rights. Online searches using common search engines always lead to the paid product. KSV also falsely claims that only its paid products are suitable for presentation to third parties.
Disproportionately long waiting time. KSV1870 states on its website that the delivery period is 3 days, but only for paying customers. For a “normal” access request according to the GDPR it states a waiting period of 25-30 days. KSV1870 is therefore also in violation of the legal obligation to provide requested information to data subjects “without delay” as described in Article 15 GDPR. The company cannot claim that there are technical or organizational hurdles: The paid InfoPasses are actually delivered within a few days without any problems.
KSV1870 bypasses MA35. What makes the matter particularly perfidious is that MA35 has already been banned from referring to KSV’s paid product. Since then, the authority has explicitly linked to cost-free information in accordance with Article 15 GDPR. This change is the response to an official reprimand from the Vienna City Court of Audit. As a result, KSV1870 has made its website even more confusing: The company now even advertises the paid InfoPass on the page where you can request the cost-free information. You will only find the information to file a request in accordance with the GDPR when you scroll down. KSV1870 is thus disregarding the instructions of the Vienna Citiy Court of Audit and is making a mockery of the improvements made by MA35.
Marco Blocher, data protection lawyer at noyb: “The MA35 has changed course and now links to the free information on the KSV1870 website. KSV1870 in now even undermining MA35 and is trying to advertise the expensive “InfoPass” on on the page used to request free information in accordance with GDPR.”
Complaint and report against KSV1870. noyb has now filed a complaint against KSV with the Austrian data protection authority (DPA). The systematic concealment and delay of free information constitutes a violation of the GDPR. noyb is also filing a report with the DPA, as the company is systematically circumventing the legal requirement for free information and is exploiting people's lack of awareness in order to entice them to buy InfoPasses.
