European Union: Issued opinion by the Advocate-General of the EU Court of Justice

On 16 March 2023, the Advocate-General (AG) of the Court of Justice of the European Union (CJEU) released an Opinion on Case C-634/21 on whether automated credit rating is allowed under the EU General Data Protection Regulation (GDPR). Specifically, Article 22 of the GDPR states that data subjects have the right to refuse "a decision based solely on automated processing, including profiling". Case C-634/21 involves a German individual who requested credit-rating company SCHUFA Holding to erase her personal data from their system and provide her access to the data they used to calculate her creditworthiness score, which was used as the basis for a bank to refuse her a loan. SCHUFA refused to provide the specific data used in the calculation, citing that it was "commercially sensitive". Following a ruling by the Hessian Data Protection Authority, which ruled in line with SCHUFA's decision, the individual appealed against the case to the Wiesbaden Administrative Court, which submitted a request for a preliminary ruling to the CJEU on 15 October 2021. In the AG's opinion, the GDPR establishes a right for individuals not to be subject to a decision based solely on automated processing, including profiling. The citizen's right to access personal data must include a detailed explanation of the method used to calculate the score and the reasons for a certain result.