European Union: Issued CJEU decision for scoring under the General Data Protection Regulation (SCHUFA Holding v Administrative Court of Wiesbaden (Germany))

On 7 December 2023, the Court of Justice of the European Union (CJEU) issued the decision for scoring under the General Data Protection Regulation (GDPR) in the case SCHUFA Holding v Administrative Court of Wiesbaden (Germany). Scoring is a mathematical-statistical method used to predict behaviours such as the repayment of a loan. The CJEU states that scoring has to be seen as an "automated individual decision" under the GDPR. According to the CJEU's interpretation of Article 22(1) of the GDPR, an "automated individual decision" occurs when a credit bureau automatically creates a score based on personal data about an individual's ability to meet future payment obligations. This is particularly the case where that score has a significant impact on whether a third party receiving the score decides to enter into, maintain, or terminate a contractual relationship with that individual. The court ruled that the scoring is allowed, provided that the federal court assesses that the exception is valid under federal law. However, the court must check whether the general conditions of the GDPR are met.