Background: What is CRIF? CRIF is one of the two major credit agencies in Austria. The company collects vast amounts of personal data from millions of people to calculate a ‘creditworthiness score’. In other words, CRIF has built up a kind of national register in which almost everyone in Austria is listed, but very few people know about it. The score, which ranges from 250 to 700, often determines who gets contracts and who doesn’t. For most people, this score is calculated based solely on age, gender and address. Tests conducted so far suggest that the score depends primarily on the address. In our view, this makes the scientific value of the score questionable. CRIF has not yet published any data for the scientific validation of the score. For example, a luxury penthouse and an apartment with an old tenancy agreement could be located in the same building. It is also possible for the same person to receive extremely different scores depending on the delivery location of an order – which of course has nothing to do with the person’s objective ability to pay.
CRIF customers get delivered your data. CRIF sells the calculated creditworthiness score to a large number of companies. These include banks such as Volksbank Wien, Erste Bank, Raiffeisenbank and Oberbank, energy providers such as Verbund, mobile phone providers such as Magenta and Drei, and online shops such as Zalando. It is unclear to what extent CRIF’s customers are aware of how these scores are calculated. Customers usually use this score to decide whether to enter into a contract with a person or whether to allow them to order on invoice. Finding out to what extent the score is the sole or decisive factor is also part of our project. If the personal score is too low, mobile phone contracts or energy supply contracts have often been automatically rejected in the past. Sometimes, purchase on account is simply refused and you have to pay in advance. In theory, a poor score could also lead to higher costs for loans if a bank employee were to be influenced by the score when assessing risk.
Max Schrems, Chairman of noyb: “CRIF has built up a kind of private register containing the data of almost everyone in Austria. This data is then used to calculate what we consider to be a questionable “score” for each person, which is then sold to other companies.”
CRIF: Only payment data for 10%, but scores for everyone. CRIF itself states that it only has actual payment history data for around 10% of the population. This includes reports from debt collection agencies about payment problems. For the remaining 90% of the population, CRIF mostly calculates the score based solely on age, gender and address. However, CRIF goes even further: For individuals who cannot be found in the database at all, a score is still calculated – according to CRIF, based solely on the data in the request.
Max Schrems, Chairman of noyb: “There is a suspicion that CRIF is fabricating scores out of thin air – with very real consequences for those affected. CRIF could simply say ‘we have no information on this person’ – but it prefers to sell a score anyway. The biggest factor in all tests to date is the address. The score goes up slightly with age, and women are scored better than men.”
Potentially unlawful data sources. We have reason to believe that this practice is unlawful – and that CRIF has collected the data unlawfully. For example, a large proportion of the information used for credit scores comes from the address publisher AZ Direct, which, according to Section 151 of the Austrian Commercial Codemay only pass on this information for marketing purposes. The principle of purpose limitation is set out in Article 5 GDPR. Nevertheless, the data of millions of Austrians has been sold to CRIF for €120,000 per year for years and, in our view, has been misused. The Austrian data protection authority has already confirmed in an earlier noyb case that a large part of the CRIF database is not legally compliant. However, this decision is not yet final, as CRIF has lodged an appeal. A supreme court ruling is therefore still pending. For other reasons, too, noyb believes that the data processing is likely to be unlawful. For example, CRIF has not obtained the consent of the data subjects (except in exceptional cases) and invokes a ‘legitimate interest’ to accumulate data on almost everyone in Austria.
Incorrect scores can have massive consequences. We know of numerous individual cases in which people have been denied contracts due to incomprehensible scores that have nothing to do with their payment behaviour. Comparisons between known scores are also questionable. For example, a 19-year-old doing mandatory civil service was rated rather high, while well-paid university employees were rated rather poorly. The late Dietrich Mateschitz (formerly Austria’s richest man) was still alive in a test query of the database and had a score below the Austrian average. Finally, ‘Peter Pan’, ‘Jesus Christ’ and countless ‘Mustermänner’ can be found in the database. Also, addresses are often out of date – which raises questions about the quality of the data. The score for the same person can even vary by 150 points simply by using a different address when signing a contract. The effects can range from rejected mobile phone or energy contracts to theoretically higher interest rates on loans. Often, those affected are not even aware that a CRIF score is involved in the background.
Max Schrems, Chairman of noyb: ‘In some individual cases, it is clear that the score is objectively wrong – often with massive consequences for those affected. However, in order to scientifically verify whether the score is structurally correct or incorrect, we need data from thousands of affected individuals.’
