GDPR Alert: Landmark EU Ruling Declares Automated Scoring Systems Using Personal Data Unlawful

In a recent landmark ruling, the Court of Justice of the EU (CJEU) decisively pronounced that decision-making through scoring systems utilising personal data is now deemed unlawful. This historic judgment, the first of its kind under the EU GDPR, holds considerable implications for a wide spectrum of sectors, particularly impacting social security and credit agencies. Gabriela Zanfir-Fortuna, Vice President for Global Privacy at the Future of Privacy Forum, highlighted the significance of the CJEU's decision, clarifying that the EU GDPR inherently prohibits subjecting individuals to automated decision-making with substantial impacts on their lives.

The CJEU's ruling stems from a case involving SCHUFA, Germany's largest private credit agency, which assigns creditworthiness scores to individuals. According to the judgment, SCHUFA's scoring practices violate the EU GDPR if its customers, such as banks, attribute a "decisive" role to it in their contractual decisions.