Illegal data exchange between address publisher and credit ranking agency

18 2021

Illegal data exchange between address publisher and credit ranking agency

View 2.0K

word 736 read time 3 minutes, 40 Seconds

noyb filed a GDPR complaint against the credit ranking agency CRIF GmbH and the address publisher AZ Direct on March 18, 2021. The companies exchange data which violates the GDPR, as well as Austrian law. Address publishers are only allowed to pass on data for advertising purposes, but not to credit agencies for credit rating.

Download: Complaint to the Austrian Data Protection Authority (PDF)

CRIF and AZ Direct: GDPR violation as a common business model. The complainant had submitted an access request under Article 15 GDPR to CRIF. CRIF stated that it had stored his name, date of birth and some (partly outdated) residential addresses. The only data source mentioned was the address publisher AZ Direct. However, address publishers are only allowed to pass on data for advertising purposes. In the case of CRIF, it was very apparent that they had calculated several creditworthiness scores on the basis of the data received from AZ Direct and sent them to various companies.

Secret data trading. Credit agencies can access publicly available data, like from different registers to collect identification data. However, only a fraction of the population can be found there. Most of the data apparently comes from a different source, namely address publishers which by law, are only allowed to pass on data for advertising purposes.

"The majority of the data credit ranking agencies have come from address publishers - without any legal basis and without ever asking the data subjects for consent or informing them. The complainant also did not know that his data was being collected until his access request, although the GDPR clearly states thathe should have been informed about this collection" Alan Dahi, data protection lawyer at

Purpose limitation as an alien concept. The principle of purpose limitation states that data may only be collected for " specified, explicit and legitimate purposes " and may not be further processed for other, incompatible purposes. However, according to the business register AZ Direct is solely an address publisher and is therefore only allowed to pass on data for direct marketing purposes. Nevertheless, CRIF had obviously used the data for credit assessment purposes - a serious violation of the principle of "purpose limitation" according to Article 5 DSGVO.

"Direct marketing and credit rating are two completely different and incompatible purposes. CRIF and AZ Direct are both violating the principle of purpose limitation. In addition, there are possible violations of Austrian trade law, which we are also examining. " Alan Dahi, Data Protection Lawyer at

Not an isolated case. CRIF makes no secret of its relationship with address publishers: address publishers are named in the data protection declaration as regular data suppliers. Moreover, CRIF declares on its website that it has no negative data (i.e. no data on unpaid debts) from more than 90% of the people stored. They therefore inevitably obtain most of the data from address publishers.

"The situation of the complainant is not an isolated case. noyb is aware of several similar cases. CRIF has apparently acquired millions of data records from address publishers such as AZ Direct over a period of years without informing a single person affected. If you have a residence in Austria, there is a high probability that you are also affected." Alan Dahi, privacy lawyer at

The authority’s turn. If the Austrian Data Protection Authority (DPA) follows our complaint, CRIF will have to refrain from such data collection in the future - and delete all the data collected in violation of the GDPR. Furthermore, the DPA can impose a fine of up to €20 million or 4% of the annual turnover on both CRIF and AZ Direct.

"The address trading and credit ranking industries have still not adapted their business practices to the requirements of the GDPR. It is high time that these industries also arrive in the present and respect data protection! " Alan Dahi, Data Protection Lawyer at

Exercise your rights! You can also find out whether CRIF has unlawfully collected your data from an address publisher such as AZ Direct. To do so, send an access request under Article 15 of the GDPR to CRIF ( and ask in particular about the origin of the data processed. More information is available here. CRIF is obliged to provide you with this information within one month. After that, you are welcome to contact us for further steps.

Source by NOYB

LSNN is an independent editor which relies on reader support. We disclose the reality of the facts, after careful observations of the contents rigorously taken from direct sources, we work in the direction of freedom of expression and for human rights , in an oppressed society that struggles more and more in differentiating. Collecting contributions allows us to continue giving reliable information that takes many hours of work. LSNN is in continuous development and offers its own platform, to give space to authors, who fully exploit its potential. Your help is also needed now more than ever!

In a world, where disinformation is the main strategy, adopted to be able to act sometimes to the detriment of human rights by increasingly reducing freedom of expression , You can make a difference by helping us to keep disclosure alive. This project was born in June 1999 and has become a real mission, which we carry out with dedication and always independently "this is a fact: we have never made use of funds or contributions of any kind, we have always self-financed every single operation and dissemination project ". Give your hard-earned cash to sites or channels that change flags every time the wind blows , LSNN is proof that you don't change flags you were born for! We have seen the birth of realities that die after a few months at most after two years. Those who continue in the nurturing reality of which there is no history, in some way contribute in taking more and more freedom of expression from people who, like You , have decided and want to live in a more ethical world, in which existing is not a right to be conquered, L or it is because you already exist and were born with these rights! The ability to distinguish and decide intelligently is a fact, which allows us to continue . An important fact is the time that «LSNN takes» and it is remarkable! Countless hours in source research and control, development, security, public relations, is the foundation of our basic and day-to-day tasks. We do not schedule releases and publications, everything happens spontaneously and at all hours of the day or night, in the instant in which the single author or whoever writes or curates the contents makes them public. LSNN has made this popular project pure love, in the direction of the right of expression and always on the side of human rights. Thanks, contribute now click here this is the wallet to contribute

Similar Articles / Illegal agency