Case Summary
The Regional Court Traunstein (LG Traunstein) ruled that Article 22 GDPR does not apply to the calculation of credit scores by credit rating agencies when the decision-maker in the loan approval process uses additional information. The court specified that if the data subject filing a complaint against credit scoring cannot specifically name a single decision by a potential contractual partner regarding the conclusion, execution and termination of a contractual relationship in which the score value was significantly taken into account, a violation of Article 22 GDPR by the defendant has not been established.
In the case, the plaintiff argued that the credit scoring system employed by the defendant, a private company providing creditworthiness information to the lending industry in Germany, negatively affected her ability to secure contracts. The defendant is a private company that supports the lending industry in Germany by providing information on the creditworthiness of potential or existing customers. The controller maintains an extensive database and calculates a score value based on this data, which predicts the likelihood of a person fulfilling credit-related contracts. However, it only shares this information with its partners with a legitimate interest, such as in the case of a credit application.
The plaintiff claimed this system violated Article 22(1) GDPR, which prohibits decisions based solely on automated processing that significantly affect individuals. The plaintiff sought to have her credit score increased and claimed damages for alleged unlawful data processing. Specifically, she requested that the court determine the creation of her credit score to be unlawful, mandate the defendant to adjust her scores, and restrict the communication of scores below specified values. Additionally, she demanded detailed information about the scoring calculation methods and compensation for legal costs.
The court clarified that Article 22(1) GDPR is applicable only if a decision based solely on automated processing produces legal effects or similarly significant impacts on an individual. For instance, this would apply if a contract rejection were based solely on an automated credit score. However, if a human decision-maker uses additional information beyond the automated score, Article 22 does not apply.
The court referenced the European Court of Justice ruling in case C-634/21 (SCHUFA case), which stated that a decision is automated if it solely relies on automated processing without human intervention. The court interpreted the case law and emphasized that based on the ECJ’s ruling in the SCHUFA case, for Article 22 GDPR to apply in scoring cases, the score must be decisive for the lender’s decision. The mere creation of the score does not violate Article 22 GDPR if other information is used by the lender in the credit decision process.
The court found that the plaintiff failed to provide evidence of any specific contract being rejected solely due to the credit score. The defendant demonstrated that the plaintiff had successfully concluded several credit-relevant contracts. During the hearing, the plaintiff could not identify any specific adverse decisions influenced predominantly by the credit score. The court held that the burden of proof lies with the plaintiff to demonstrate the applicability of Article 22(1) GDPR, and she did not meet this burden. The plaintiff’s representative could not substantiate claims of specific rejections due to the credit score, and generalized statements without specific evidence were insufficient.
Additionally, the court found that the controller fulfilled the plaintiff’s right to access her data under Article 15 GDPR by providing a copy of the stored data. The plaintiff’s request for detailed information on the scoring algorithm was rejected as it fell under the controller’s right to protect trade secrets. The court ruled that the right to information under Article 15(1)(h) GDPR does not extend to the specific calculation method used for scoring, as the plaintiff was not subject to an exclusively automated decision-making process with legal or significant effects. The court also noted that the controller had not used prohibited data categories in calculating the score, and there was no risk of repetition necessary for injunctive relief.
The court concluded that the plaintiff’s claims were unsubstantiated and that the controller’s data processing did not violate the GDPR. The plaintiff’s generalized statements and lack of specific evidence failed to meet the burden of proof required to demonstrate a violation of Article 22(1) GDPR.
Access to the full judgment
Further notes on contested technology
- → Partly Automated-Decision
- → The technology is deployed
Additional resources
The case is particularly noteworthy as it marks one of the first publicly known applications of the ECJ ruling in case 634/21 (the SCHUFA case) by a national court. In case 634/21, the ECJ determined that the automated generation of a probability value by a credit information agency—based on personal data concerning an individual’s ability to fulfil future payment obligations—constitutes ‘automated individual decision-making’ under Article 22 of the GDPR when a third party (the decision maker), receiving the probability value, draws strongly on it to establish, implement, or terminate a contractual relationship with the individual. The Regional Court Traunstein appears to interpret the term “drawing strongly” narrowly.
Author: Mateusz Kupiec
Author of the case note
