Noyb files complaint with Austrian DPA for automated credit check

Noyb has lodged a complaint with the Datenschutzbehörde against a credit check company and an energy supplier for subjecting new customers to a fully automated credit check without any other verification measures.

A customer wanted to strike a deal with the Austrian energy provider Unsere Wasserkraft. His request however was denied because of an ‘inadequate credit rating’. The prospect didn’t receive any details of his creditworthiness, but was simply referred to the creditors’ association KSV1870.

He decided to investigate what happened and found out that the energy supplier simply used an inaccurate calculated credit rating to reject him as a client. The decision making process was fully automated and there was no human being to address any issues, which is a violation of the General Data Protection Regulation (GDPR).

Article 22 of the GDPR stipulates that a “data subject shall have the right not to be subjected to a decision based solely on automated processing”. In other words, a company can’t reject a new customer by simply using the results of a credit check as a decisive factor for his rejection.

That’s why the customer asked Noyb for help. The privacy organization in turn filed a complaint against the credit rating agency and energy provider at the Dataschutzbehörde, the Austrian data protection authority (DPA).

According to Noyb, KSV1870 falsely claims that its calculated credit ratings have no significant influence on the decisions of companies that use this score. Unsere Wasserkraft relies solely on the credit rating agency’s credit assessment and lacks any form of manual review.

With their actions, the companies have violated articles 13, 14, 15 and 22 of the GDPR. Noyb is therefore asking the DPA to impose a processing ban on KSV1870 as long as its calculations of creditworthiness scores aren’t limited to the few authorized individual cases.

“The GDPR contains clear provisions to protect people from the unlawful use of algorithms. Despite clear case law from the European Court of Justice (ECJ), many companies continue to ignore these rules. In the event of a fully automated decision, consumers must have the opportunity to involve a real human being, present their own point of view and challenge the automated decision,” Martin Baumann, data protection lawyer at Noyb, explains in a statement.