Secret scoring: Join the CRIF class action now!

A prominent data protection organization in Europe is launching legal action against CRIF, a major credit reference agency in Austria, over alleged violations of the General Data Protection Regulation (GDPR). The initiative highlights concerns regarding the collection and use of personal data for credit scoring purposes, particularly when based on insufficient financial information. This move underscores the EU's ongoing efforts to ensure robust data protection and consumer rights within the digital landscape. The core of the legal challenge revolves around CRIF's "shadow registry," which reportedly holds the personal details of nearly all adults in Austria, including names, dates of birth, and addresses. For a significant majority of individuals, their credit score is purportedly derived primarily from non-financial data such as address, gender, and age. This practice is questioned for its accuracy in assessing creditworthiness, as it may not reflect a person's actual ability or willingness to pay. The implications of this scoring system are far-reaching, potentially affecting an individual's access to essential services. CRIF's client list includes major mobile phone providers, electricity suppliers, banks, and online retailers, suggesting that these scores could influence contract approvals for a substantial portion of the Austrian population. The organization behind the legal action argues that this broad data collection and scoring method, especially without adequate financial data, constitutes a breach of GDPR.