# Austrian credit scoring data privacy litigation

> Live situation record from CLSTR: https://clstr.news/situations/austrian-credit-scoring-data-privacy-litigation
> Updated: 2026-09-11T07:46:33.000Z. Sources: 4. Developments: 2.

The Austrian Supreme Court ruled that credit reporting agency CRIF violated GDPR principles by repurposing data for credit scoring. The court found that data purchased from address publishers, which is legally restricted to marketing purposes, cannot be used for identity or credit checks without explicit consent from individuals.

Following these rulings, the privacy organization noyb has initiated a class-action lawsuit against CRIF. Legal experts suggest that for approximately 90 percent of the millions of people in Austria whose data was collected, credit scores were based on demographic factors—such as age, gender, and address—rather than actual financial information. Affected individuals may be eligible to seek damages of approximately 500 euros.

## Timeline

### 2026-09-11: CRIF faces class action lawsuit over credit scoring data practices

Consumers in Austria can join a class action lawsuit against CRIF after courts ruled that marketing data cannot be used for credit scoring, potentially allowing for damages of 500 euros per person.

2 sources. https://clstr.news/cluster/crif-faces-class-action-lawsuit-over-credit-scoring-data-practices

### 2026-09-01: Austrian Supreme Court rules credit agencies violated GDPR

Austria's Supreme Court ruled that credit agencies like CRIF violated GDPR by using marketing data from address publishers for credit scoring without explicit consent.

2 sources. https://clstr.news/cluster/austrian-supreme-court-rules-credit-agencies-violated-gdpr

---
Cite as: Austrian credit scoring data privacy litigation. CLSTR, https://clstr.news/situations/austrian-credit-scoring-data-privacy-litigation