What happened
noyb, a state‑approved qualified entity, filed an injunction against CRIF to stop its alleged unlawful collection and scoring of personal data under the GDPR. The filing also suspends the limitation period and prepares a subsequent class action for damages. The case targets a secret "shadow registry" that influences contracts with telecom, energy and banking providers.
Why it matters for trust and compliance
- Its status is filed. The case is still open; the outcome may change what it means.
- The injunction could halt a large‑scale secret credit scoring system and set a precedent for collective GDPR enforcement in the EU.
- It relates to GDPR. The regulations library explains what that law requires.
Who is affected
financial services telecommunications energy retail media technology advertising controller processor data broker CRIF GmbH noyb Schibsted Norwegian Consumer Council
Recommended actions
- Review consent, cookie and tracking practices against the requirement.
- Check that privacy notices describe the practices this addresses.
- Revisit retention schedules and data minimisation for the data involved.
- Inventory where this data is shared or sold and whether opt-outs are honoured.
- Inventory AI or automated decision systems in scope and their assessments.