The Austrian Data Protection Authority found that CRIF GmbH illegally processed addresses, dates of birth, names and other personal data of millions of Austrians obtained from AZ Direkt without consent or legal basis, ordering the deletion of the records. The decision results from a test case filed by privacy NGO noyb.
Why it matters: The ruling marks a significant GDPR enforcement action against a credit bureau for unlawful mass profiling.
Summary generated from the sources below. Check the primary source before relying on it; this is not legal advice.
