News · noyb - European Center for Digital Rights EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Supreme Court: CRIF illegally collected data of millions in Austria. Way clear for class action!

Credit Scoring In June 2026, noyb brought an injunction against the unlawful data collection practices of the Austrian credit reference agency CRIF.

Marketing GDPR Article 5 Principles of Processing Direct Marketing Purpose Limitation Training Data Requirements
Sep 1, 2026 Source

How it connects

Related across sources

Literature "From Cookies to Context: Adapting Marketing Strategies in a Cookieless Digital Environment" European Economic Letters (EEL) Guidance Guidelines 04/2022 on the calculation of administrative fines under the GDPR EDPB Guidance Guidelines 01/2022 on data subject rights - Right of access EDPB Guidance Guidelines 04/2021 on Codes of Conduct as tools for transfers EDPB Guidance Guidelines 01/2021 EDPB Guidance Guidelines 8/2020 on the targeting of social media users EDPB

Full text

Credit Scoring In June 2026, noyb brought an injunction against the unlawful data collection practices of the Austrian credit reference agency CRIF. In several unrelated cases, the Supreme Court (OGH) has now ruled in favour of noyb: CRIF’s current practice of collecting data from address publishers violates the GDPR principle of ‘purpose limitation’. This means that a key allegation in noyb’s injunction has been confirmed by the highest court even before the first hearing. As a result, the prospects of success for our class action against CRIF have further improved. Join the class action now! Austrian Supreme Court rulings: (1), (2), (3)Change of purpose not permitted. The principle of purpose limitation (Article 5(1)(b) GDPR) generally prohibits companies from reusing data processed for one purpose for other purposes. For example, data intended for postal advertising (‘direct marketing’) may not simply be used for credit assessments.Marco Blocher, data protection lawyer at noyb: “Mar

Original document at the source noyb.eu
Related documents