The Austrian non-profit organisation NOYB (None of Your Business), chaired by Max Schrems, has announced the imminent launch of a class action aimed at scrutinising the criteria used by CRIF to assign credit scores. The allegation is that the processing of personal data for the purpose of determining such scores is carried out in an excessively superficial manner and in breach of the General Data Protection Regulation (GDPR), resulting in inaccurate credit scores and potentially detrimental consequences for the individuals concerned.
What Are the Allegations Raised by NOYB?
According to NOYB, and its chairman Max Schrems, the company operating the leading credit information system—also highly active in Austria—has created a database containing information relating to approximately 90% of the Austrian population. Individuals are assigned scores that determine whether they can enter into various types of contracts, including those relating to energy supply and mobile telecommunications services.
The principal concern is that these scores are allegedly calculated solely based on factors such as age, gender and residential address, thereby undermining both their objectivity and their intended purpose. According to Schrems, it is even possible for the same individual to receive significantly different scores depending on the delivery address provided for an order, a circumstance that should not, in any way, affect that person’s solvency or creditworthiness.
Why Does NOYB Consider CRIF’s Practices Unlawful?
CRIF maintains that the data contained within its databases cover only 10% of Austrian citizens. According to research conducted by NOYB, however, the actual figure would be substantially higher, reaching as much as 90% of the population.
For the remaining individuals, NOYB alleges that CRIF generates scores based solely on the information contained in each request, effectively “inventing” credit ratings that are then transmitted to major market operators to enable them to approve or reject applications for services.
The organisation reports having identified numerous cases in which individuals were assigned scores based on highly questionable reasoning. Among the examples cited by Schrems is that of a nineteen-year-old performing civil service who was considered “highly” creditworthy, whereas well-paid university employees received significantly lower assessments.
The CRIF database allegedly also contained information relating to deceased individuals, as well as outdated addresses, raising concerns regarding the quality and accuracy of the underlying data. In many instances, affected individuals are reportedly unaware that their personal data are being collected and processed by CRIF. According to NOYB, this would mean that the information has been collected unlawfully.
For example, a substantial portion of the information used for credit scoring purposes is said to originate from the Austrian company AZ Direct, which, under applicable Austrian legislation, may disclose such data exclusively for marketing purposes.
The matter is also connected to separate ongoing litigation seeking to establish the alleged unlawfulness of CRIF’s activities aimed at expanding its databases. According to NOYB, CRIF’s data processing activities would additionally be unlawful due to its reliance on the legal basis of legitimate interests, which is allegedly not adequately substantiated, as well as a lack of transparency regarding data retention periods.
Schrems’ initiative has attracted considerable public attention, not least because CRIF’s clients reportedly include some of Austria’s leading mobile telecommunications operators and electricity suppliers, as well as Zalando and the payment service provider Klarna.
What If the Class Action Is Filed?
Should the proceedings be formally commenced and ultimately succeed, NOYB estimates that compensation of approximately EUR 500 per affected individual could be awarded. Such proceedings would also represent one of the largest class actions ever brought in terms of the number of individuals involved.