EU, Court of Justice of the EU, 7 December 2023, Case C-634/21, Schufa Holding

Case Summary

On the 7th of December 2023, the Court of Justice delivered two landmark judgments for the protection of the right to data protection against automated credit scoring (Case C-634/21 and Joined  Cases C-26/22 and C-64/22). Both cases concerned the compatibility of data processing by a German credit agency, with the GDPR and the rights to privacy and data protection. In the first case on Article 22 GDPR, the Court of Justice held that credit scoring is an automated decision as it has a determining role in granting credit. According to the referring Court and the Advocate General (AG), the agency’s credit scoring qualifies under Article 22 of the GDPR, as it ‘tends to predetermine the latter’s decision as to whether to grant or refuse credit to the person concerned, so that it must be considered that that position is of a purely formal nature in the context of the process’ (AG Opinion, point 47).

The Court of Justice followed the AG Opinion and held that Article 22 GDPR: “Must be interpreted as meaning that the automated establishment, by a credit information agency, of a probability value based on personal data relating to a person and concerning his or her ability to meet payment  commitments in the future constitutes ‘automated individual decision-making’ within the meaning of that provision, where a third party, to which that probability value is transmitted, draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person”. According to the Court, since the automated crediting scoring – calculated by a credit information  agency and communicated to a bank – plays a determining role in credit granting, establishing that value qualifies as a decision under Article 22 GDPR (C-634/21, para 50). Therefore, it is prohibited unless one of the exceptions set out in Article 22(2) of the GDPR is applicable and the specific requirements provided for in Article 22(3) and (4) of the GDPR are complied with (C-634/21, para 64).

Author of the case note

Francesca Palmiotto