Skip to content
News·noyb - European Center for Digital RightsEN
Export

CRIF case shows: Public registries are increasingly being misused

Full text

Credit Scoring An investigation into data flows at the Austrian credit agency CRIF has shed further light on the matter: most of the address data in the CRIF database comes from address brokers AZ Direct (Bertelsmann Group), Compass-Verlag and DPIT in Vienna. But where do these address traders get their data from? A new noyb evaluation involving more than 2,400 affected individuals shows that they access public registers such as the company and land registers, the register of associations and the Business Information System (GISA) which was introduced in 2015. Compass also lists the chamber of commerce (WKO) as a data source. However, it remains unclear where AZ Direct (CRIF’s largest data supplier) obtains its data. AZ Direct says it does not know where it got the data on 7 million people in Austria. Data extracted from public registers. The credit agency CRIF obtains most of its address data from the address brokers AZ Direct, Compass-Verlag and DPIT. Thanks to access requests made o

How it connects

€100,000 HDPA fines Teleperformance for failing to properly handle employee access request The DPA received a complaint from a former employee of the Service 800 Teleperformance Single Member S.A. (the controller), after the controller failed to comply with the data… Greece ·Art. 5, 12, 13 +3 Personal Data Right of Access Storage Limitation
C/16/608667 / HA RK 26-54 The data subject was involved in disputes with a school organisation ("controller") Those disputes concerned a communication ban, their membership in a participation council, and their internship. The data subject submitted an access request under Article 15… C/16/608667 / HA RK 26-54 ·Rb. Midden-Nederland Sep 22, 2026 Right of Access Personal Data Controllers
W101 2326836-1 40 natural persons submitted access requests to a mobile communications provider (controller) via an attorney Some of these persons were (former) customers of the controller, others have never been in a contractual relationship with the controller. In the access requests, the data… BVwG - W101 2326836-1 ·Federal Administrative Court Oct 2, 2026 Personal Data Right of Access Right to Restriction
Danish DPA finds employer unlawfully refused former employee's access request The DPA received a complaint from a former employee (data subject) of the controller concerning the refusal of an access request. More specifically, the data subject was dismissed… 2025-31-2078 ·Denmark ·Datatilsynet (DK) Sep 24, 2026 Right of Access Personal Data Supervisory Authorities
C/09/697386 / HA ZA 26-52 Den Haag District Court: 51 gamblers sue Unibet operator Risepoint over unanswered GDPR The District Court of The Hague (the Court) considered an action brought by 51 individuals who had participated in online gambling offered through the website Unibet before 1… Rb. Den Haag Sep 2, 2026 Right of Access Personal Data Data Portability
2984/2026 Bulgaria SAC: Controller must provide copies of loan documents under GDPR Art. 15 access The data subject requested that a Bulgarian non-banking financial institution specialized in providing online fast loans and installment loans (the controller) provide copies of… Oct 13, 2026 Controllers Right of Access Personal Data