Court of Justice of the European Union — SCHUFA Holding AG (automated credit scoring)

Decided by

Court of Justice of the European Union

Parties

OQ v. Land Hessen

Decision date

December 7, 2023

Remedy

The Court of Justice of the European Union held that Article 22(1) of the GDPR must be interpreted as meaning that the automated establishment of a probability value concerning a person's creditworthiness constitutes automated individual decision-making where a third party draws strongly on that value to make contractual decisions.

Appeal

Appeal status not stated

Key holdings

1. Automated establishment of a probability score by a credit information agency constitutes automated individual decision-making when strongly relied upon by a third party.

   “the automated establishment, by a credit information agency, of a probability value based on personal data relating to a person” — paragraph 73

2. Excluding automated scoring from Article 22 when third parties draw strongly on it would create a lacuna in legal protection and risk circumventing GDPR protections.

   “there would be a risk of circumventing Article 22 of the GDPR and, consequently, a lacuna in legal protection if a restrictive interpretation of that provision was retained” — paragraph 61

3. National regulations authorizing automated decision-making under Article 22(2)(b) cannot bypass the general requirements of Articles 5 and 6 of the GDPR.

   “Member States cannot adopt, under Article 22(2)(b) of the GDPR, regulations which authorise profiling in disregard of the requirements laid down by those Articles 5 and 6” — paragraph 68

In plain English

An individual designated as OQ was denied a loan by a third-party bank after SCHUFA Holding AG generated a negative credit score using automated probability values based on personal data. OQ requested access to personal data and the erasure of allegedly incorrect data from SCHUFA. SCHUFA provided the score and broad calculation methods but refused to disclose detailed weighting and algorithms, citing trade secrecy, and argued that third-party partners make the final decisions. OQ filed a complaint with the Data Protection and Freedom of Information Commissioner for the Federal State of Hesse. The commissioner rejected the complaint, finding SCHUFA complied with German federal data protection rules. OQ challenged this refusal before the Administrative Court Wiesbaden, which referred questions on the interpretation of Article 22 of the General Data Protection Regulation to the Court of Justice of the European Union. The Court of Justice of the European Union held that the automated generation of a probability value concerning a person's future payment capability constitutes automated individual decision-making under Article 22(1) of the General Data Protection Regulation when a third party draws strongly on that value to make contractual decisions. The Court reasoned that if third-party reliance on credit scores was excluded from automated decision-making rules, data subjects would face a gap in legal protection and would be unable to obtain meaningful information about the automated logic. Consequently, automated scoring by credit agencies is prohibited unless an exception under Article 22(2) applies and safeguards under Articles 5 and 6 are met.