Secret scoring: Join the CRIF class action now!
Skip to main content
en
de
bg
cs
el
es
fi
fr
hu
it
nl
pl
sk
Secret scoring: Join the CRIF class action now!
Credit Scoring
09 June 2026
CRIF is one of the largest credit reference agencies in Austria. It has built up a largely unknown "shadow registry" containing the names, dates of birth and addresses of almost all adults in Austria. CRIF uses this data to assign people a score. For 90% of those affected, this score is based primarily on address, gender and age. Although this data does not allow for any real conclusions to be drawn about a person’s creditworthiness, the CRIF score often determines whether someone is granted a contract with mobile phone providers, electricity suppliers or banks. We are convinced that this unwarranted data collection and the scoring of people for whom no credit-relevant data is available violates the GDPR. noyb is therefore bringing an injunction and a class action for damages.
Join the class action now!
Sign up for the class action here: crif.noyb.eu<br>Background: How does data flow within the CRIF network?<br>List of data providers in the CRIF network<br>List of companies that purchase data from CRIF<br>Frequently asked questions and answers about the CRIF project (FAQs)<br>Information on noyb’s state recognition as a Qualified Entity<br>What is CRIF? Hardly anyone has heard of “CRIF GmbH” before. Yet this credit reference agency holds the personal data of millions of people in Austria. Extensive research by noyb confirms that its database contains details such as names, dates of birth and home addresses. CRIF uses this information to assign people a score between 250 and 700 upon request. However, CRIF has no financial information at all for a good 90% of the people in its database. For these individuals, the score is based solely on age, gender and addresses. It therefore has little to do with a person’s actual creditworthiness – that is, their ability and willingness to pay.<br>In practice, however, the score often determines whether consumers are granted a contract. CRIF’s largest clients include mobile phone operators such as Magenta and Drei, banks such as Erste Bank and Santander, energy suppliers such as Verbund, online retailers such as Zalando, and the payment service provider Klarna.<br>Ultimately, CRIF has established a kind of secret, private "registry" and credit scoring system that has the potential to have a massive impact on millions of people – mostly without any reliable data on the individual’s actual financial situation.<br>Max Schrems, Chair of noyb: “CRIF has compiled data on almost everyone in Austria – and assigns questionable 'scores'. We are convinced that neither the collection of data nor the scoring is legal in this form and on this scale.”<br>Multiple breaches of the law. noyb believes that this unwarranted and covert collection of personal data is illegal, for several reasons: a large part of the CRIF data was originally collected for entirely different purposes. It comes, for example, from the address broker AZ Direct (part of the Bertelsmann Group), Compass Verlag and DPIT (another address broker). However, according to Austrian Trade Regulations and several court rulings, these address brokers are only permitted to sell addresses for marketing purposes – not for credit assessments. Furthermore, CRIF would be required to inform all data subjects about the data processing. However, this only happens in exceptional cases. Almost no one has ever heard of CRIF – or of the fact that the company collects data and scores people. CRIF claims that it would be too cumbersome to actively inform people.<br>Furthermore, almost none of the millions of people affected in Austria have consented to being stored in CRIF’s database or being assessed by them. CRIF claims it has a ‘legitimate interest’ in building a database with every person in Austria and argues that this interest takes precedence over the fundamental right to data protection of millions of people. CRIF also claims that the scoring is not “decisive” for companies’ decisions and therefore does not require consent. noyb takes a fundamentally different position: a private “shadow registry” that companies can simply help themselves to and rely on questionable scores for contractual decisions is completely disproportionate.<br>Max Schrems: “How does a company get the idea to secretly build up an extensive private 'registry' and assign a 'score' to assess the creditworthiness of millions of individuals without ever asking them?”<br>noyb has therefore taken action to protect those affected by these practices:<br>Step 1: We have filed an injunction today. In its capacity as a state-approved qualified entity, noyb has today filed an injunction against CRIF to put a stop to this breach of the law for all those affected in future. This action also suspends the limitation period and ensures that consumers’ further claims against CRIF remain enforceable.<br>Christian...