In June 2026, noyb brought an injunction against the unlawful data collection practices of the Austrian credit reference agency CRIF. In several unrelated cases, the Supreme Court (OGH) has now ruled in favour of noyb: CRIF’s current practice of collecting data from address publishers violates the GDPR principle of ‘purpose limitation’. This means that a key allegation in noyb’s injunction has been confirmed by the highest court even before the first hearing. As a result, the prospects of success for our class action against CRIF have further improved.
Change of purpose not permitted. The principle of purpose limitation (Article 5(1)(b) GDPR) generally prohibits companies from reusing data processed for one purpose for other purposes. For example, data intended for postal advertising (‘direct marketing’) may not simply be used for credit assessments.
Marco Blocher, data protection lawyer at noyb: “Marketing and credit assessments are entirely different purposes with completely different implications for data subjects. Nevertheless, address brokers have been selling the data of millions of data subjects to credit reference agencies for years – without facing any consequences.”
A legal dispute lasting several years. noyb had therefore already lodged a complaint with the Data Protection Authority (DPA) against the address publisher AZ Direct and against CRIF in March 2021, in order to put a stop to the data trading between the companies.
In doing so, noyb has won its case before both the Data Protection Authority and the Federal Administrative Court. However, CRIF and AZ Direct have refused to comply with the decisions regarding the restriction of data use and have already faced a civil lawsuit from noyb in the past. CRIF also decided to proceed with the aforementioned injunction proceedings in the collective interest of consumers, even though the outlook for the credit reference agency was already extremely bleak at that point.
Austrian Supreme Court clear: data trade has always been illegal. The Austrian Supreme Court has now definitively settled the matter in several civil proceedings brought by the Viennese lawyer Robert Haupt, independently of noyb: credit reference agencies must not collect personal data from an address publisher that processes such data for marketing purposes.
Robert Haupt, lawyer in the successful OGH proceedings against CRIF: “Unfortunately, as a claimant in such proceedings, one must be prepared for a long haul. However, it’s now definitively established that data from address publishers must not be used for credit scoring.”
noyb class action strengthened. These judgements improve the prospects of success for noyb’s planned class action, as the illegality of CRIF’s actions has now been confirmed by the highest court on a key point. Those affected can now register for the class action. If the case is successful, we expect compensation of around €500 per person who was unlawfully included in the database or ‘scored’.
