CJEU Delivers Important Decision On Automated Decision-making Under The GDPR

The European Court of Justice ("CJEU") recently delivered an important decision concerning what constitutes "automated individual decision-making" under Article 22 GDPR. The CJEU ruled in the SCHUFA case (case C-634/21) that a German credit reference agency engages in solely "automated individual decision-making" within the meaning of Article 22 GDPR, when it creates credit repayment probability scores ("credit scores") as a result of automated processing, in circumstances where third party lenders "draw strongly" on these scores to determine whether to establish, implement or terminate contracts with individuals.

The decision shows that the obligation to comply with Article 22 GDPR falls on a credit reference agency, rather than just on the third party lender who makes the ultimate decision about the loan application, in circumstances where the latter relies strongly on such automated credit scores. This reflects a broad interpretation of Article 22 GDPR.