Supreme Court: CRIF illegally collected data of millions in Austria. Way clear for class action!

The Austrian Supreme Court found that CRIF unlawfully repurposed personal data collected from address publishers for credit assessments — a clear violation of GDPR Article 5(1)(b), which mandates that data be collected for specified, explicit, and legitimate purposes and not processed in ways incompatible with those purposes. This case illustrates how organizations often treat data as a fungible asset, reusing it across business functions without proper legal basis. The ruling matters because it demonstrates that regulators and courts are willing to hold data brokers accountable for systemic misuse, not just technical breaches. With potential payouts of ~€500 per affected individual across millions of people, the financial and reputational consequences of ignoring purpose limitation can be catastrophic.