The article analyses a recent Austrian Supreme Court (OGH) ruling holding that credit reference agencies may not process address data purchased from list brokers for subsequent credit scoring, as this constitutes an incompatible change of purpose under Art 6(4) GDPR. The authors stress that, contrary to some media reports, the judgment neither prohibits the purchase of address data as such nor bars address verification. They note that the Court also accepted credit scores calculated without specific payment history and recognised the protective function of credit reference agencies. The article concludes that uncertainty persists after the CJEU's SCHUFA judgment and calls on the legislature to clarify the scope of permissible credit assessments.