Update Data Protection No. 161 - ECJ Rules On Schufa Scoring – Current Practices Not GDPR-compliant

In two decisions, the European Court of Justice ("ECJ") ruled on 7 December 2023 on SCHUFA scoring and the processing practices of SCHUFA Holding AG ("SCHUFA"). According to the ECJ, the SCHUFA scoring constitutes automated individual decision-making – which is generally not permitted – if SCHUFA customers attribute a determining role to scoring in the context of the granting of credit. The referring court must now examine whether the German Federal Data Protection Act (BDSG) provides an appropriate exception to this. The ECJ also ruled that private credit agencies should not store data relating to the discharge from remaining debts for longer than public insolvency registers.

Background