Skip to content

Austrian Court Finds CRIF Bürgel in GDPR Breach Over Lack of Transparency in Automated Decision-Making

The court's decision, influenced by a recent CJEU ruling, impacts companies using automated scoring for various purposes. CRIF Bürgel has four weeks to comply or face execution proceedings.

In this picture we can see a close view of the identity card. In the front we can see american flag...
In this picture we can see a close view of the identity card. In the front we can see american flag and "Critical Licence" written.

Austrian Court Finds CRIF Bürgel in GDPR Breach Over Lack of Transparency in Automated Decision-Making

The Austrian Federal Administrative Court has ruled that a major credit information agency, CRIF Bürgel GmbH, has violated GDPR transparency requirements. The decision comes amidst increased scrutiny of automated decision-making across Europe, following a recent modernization of the UK's data protection framework.

The court found that the agency, previously known as CRIF GmbH before a merger in 2021, failed to provide adequate information about its processing purposes and automated decision-making logic. This breach occurred despite the agency processing data from multiple sources.

The court's decision, made on May 28, 2025, was influenced by a February 2025 CJEU ruling (C-203/22) which established that automated creditworthiness scoring falls under Article 22 GDPR. The Austrian court emphasized that data subjects must be able to understand which personal data was used and how it influenced outcomes. The ruling impacts companies using automated scoring for advertising personalization, customer segmentation, or conversion optimization, requiring them to provide meaningful explanations when requested.

The agency was ordered to provide compliant information within four weeks to avoid execution proceedings. This includes sufficiently specific details about processing purposes and meaningful information about automated decision-making logic.

CRIF Bürgel GmbH has been given four weeks to comply with the court's order, providing clear and specific information about its data processing purposes and automated decision-making processes. Failure to do so may result in execution proceedings. This ruling serves as a reminder to all companies using automated scoring to ensure transparency and compliance with GDPR requirements.

Read also:

Latest