ECJ Says No In SCHUFA Case: New Decision On Automated Decision Making

In a significant ruling, the European Court of Justice (ECJ) has determined that the practices of SCHUFA Holding AG, a prominent German provider of consumer credit ratings, might contravene the European Union's General Data Protection Regulation (GDPR).

In this case (Case C‑634/21), the ECJ examined the practices of SCHUFA Holding AG, in the context of GDPR compliance, particularly focusing on automated decision-making processes. This case originated from a dispute where an individual, OQ, was denied credit based on a score determined by SCHUFA. OQ applied for SCHUFA to send her information on the personal data registered and to erase some of the data which was allegedly incorrect. In response to that request, SCHUFA informed OQ of her score and outlined, in broad terms, the methods for calculating the scores. However, referring to trade secrecy, it refused to disclose the various elements taken into account for the purposes of that calculation and their weighting.