noyb files complaint against Austria’s Creditors’ association for profiting from GDPR trights
Austrian privacy organization, noyb, has recently filed a complaint and report against the creditors’ association KSV1870 with the Austrian data protection authority. The complaint revolves around KSV1870’s alleged violation of Article 15 of the GDPR, which guarantees individuals the right to access their personal data free of charge. It is claimed that KSV1870 is making significant profits by misleading people into purchasing their high-priced “InfoPass” instead of providing them with a free copy of their data. This misleading tactic appears to particularly target foreigners, as KSV data is required by the Department of Immigration in Vienna as proof of solvency. The potential financial harm caused by this scheme is believed to be extensive.
The complaint highlights a machine-translated document, which sheds light on the issue. According to this document, individuals who wish to apply for an Austrian visa or extend their residence permit must prove their financial solvency to the immigration authorities. The Department of Immigration relies on data from organizations like KSV1870 to assess applicants’ financial standing. However, obtaining this data has become a lucrative business, often at the expense of unsuspecting individuals.
One major concern highlighted in the complaint is that KSV1870 misleads people into believing that they must purchase an “InfoPass” priced at €43 instead of accessing their information for free. Although the Vienna Department of Immigration accepts cost-free information in accordance with Article 15 of the GDPR, KSV1870 intentionally conceals this fact and promotes their paid product instead. This misleading tactic has significant financial implications, considering the large number of annual applications received by the Vienna Department of Immigration.
The complaint further accuses KSV1870 of failing to comply with its obligations under the GDPR. The company does not provide easily accessible information to data subjects, as required by the regulation. Instead, KSV1870 deliberately hides the option for individuals to request their information free of charge, placing it at the bottom of their website and using manipulative designs that make it difficult for people to exercise their basic rights. Additionally, the waiting time for a “normal” access request according to the GDPR is stated as 25-30 days, while paying customers receive their requested information within three days. This disproportionate waiting time is seen as a violation of Article 15 of the GDPR.
In response to KSV1870’s misleading practices, the City of Vienna Court of Audit banned the Department of Immigration from referring to KSV’s paid product and explicitly directed them to link to cost-free information in accordance with the GDPR. However, KSV1870 has responded by making their website even more confusing, advertising their paid InfoPass on the page used to request free information. The company’s disregard for the instructions from the Vienna City Court of Audit undermines the improvements made by the Department of Immigration.
As a result of these alleged violations, noyb has filed a complaint and report against KSV1870 with the Austrian data protection authority. The complaint argues that KSV1870’s systematic concealment and delay of free information constitute a violation of the GDPR. The organization believes that KSV1870 is exploiting people’s lack of awareness and enticing them to purchase InfoPasses instead of providing them with their data for free.
Source: Creditors’ association earns millions with (actually) cost-free GDPR rights
