Change of purpose not permitted. The principle of purpose limitation (Article 5(1)(b) GDPR) generally prohibits companies from reusing data processed for one purpose for other purposes. For example, data intended for postal advertising (‘direct marketing’) may not simply be used for credit assessments.

Marco Blocher, data protection lawyer at noyb: “Marketing and credit assessments are entirely different purposes with completely different implications for data subjects. Nevertheless, address brokers have been selling the data of millions of data subjects to credit reference agencies for years – without facing any consequences.”

[…]

Austrian Supreme Court clear: data trade has always been illegal. The Austrian Supreme Court has now definitively settled the matter in several civil proceedings brought by the Viennese lawyer Robert Haupt, independently of noyb: credit reference agencies must not collect personal data from an address publisher that processes such data for marketing purposes.

Robert Haupt, lawyer in the successful OGH proceedings against CRIF: “Unfortunately, as a claimant in such proceedings, one must be prepared for a long haul. However, it’s now definitively established that data from address publishers must not be used for credit scoring.”

Rappel du jour (bonjour) : peu importe la manière dont on obtient des données à caractère personnel, on ne peut pas les réutiliser pour n'importe quelle finalité (= but / objectif), y compris quand elles sont publiques (voir ici ou là ou là-bas).