BERLIN- Companies are not allowed to decide whether to conclude contracts with customers solely based on an automated assessment of their creditworthiness by Germany’s Schufa credit agency.
Schufa is a German private credit bureau supported by creditors which was set up to protect its clients from credit risks. It also offers protection from insolvency to borrowers.
The European Court of Justice (ECJ) ruled in Luxembourg on Thursday that the so-called Schufa score should be regarded as a fundamentally prohibited “automated decision in individual cases” if Schufa’s customers give it a decisive role in the granting of credit.
Banks, telecommunications services or energy suppliers usually enquire about a person’s creditworthiness with private credit agencies such as Schufa.
The agency then provides an assessment, or a score value, which is intended to show how well the person concerned fulfils their payment obligations.
The background to the proceedings before the ECJ is a German case involving a person who had been refused a loan and asked Schufa to delete an entry and grant them access to the data.
Schufa provided the individual with their score value and general information on the calculation, but not the exact calculation method.
A German administrative court referred the case to the ECJ to clarify the relationship with the European General Data Protection Regulation (GDPR).
The GDPR stipulates that decisions that have a legal effect on people may not be made solely through the automated processing of data.
The judges in Luxembourg have now ruled that scoring is only permitted under certain conditions.
Schufa customers are therefore not allowed to give the score a decisive role in the granting of credit.
The credit agency welcomed the judgment, saying that it provides clarity on how scores may be used in companies’ decision-making processes in accordance with the GDPR.
