SCHUFA score: CJEU calls it an automated decision

The starting point was the case of a person whose loan application was refused by their bank. The person requested from SCHUFA access to their data and its erasure. The Wiesbaden Administrative Court (Verwaltungsgericht) referred to the CJEU (Court of Justice of the European Union) the question of whether the calculation of the score itself is already an automated individual decision under Art. 22 GDPR.

In its judgment of 7 December 2023 – C-634/21, the Court answered this in the affirmative, provided that a third party, such as a bank, draws strongly on the score to establish, implement or terminate a contractual relationship. SCHUFA had argued that it merely provided a basis and that the decision was only taken by the bank. The Court did not accept this argument.

From a legal point of view, this means: automated decisions that produce legal effects or significantly affect data subjects are in principle prohibited under Art. 22(1) GDPR unless an exception under Art. 22(2) GDPR applies. In addition, data subjects are entitled to meaningful information about the logic involved.

However, the decision has not led to scoring being prohibited everywhere. Whether there is an infringement in an individual case depends on how strongly the bank actually relies on the score. German courts have so far assessed this inconsistently. Anyone who has been refused because of a score can, however, request information about how it was calculated and should do so in writing.

Affected by a SCHUFA entry? Take the SCHUFA check and instruct me directly.