01
Factual background & dispute
- SCHUFA automatically calculated credit probability values based on personal data.
- Third parties, including banks, relied on these scores when establishing, executing, or terminating contracts.
02
Core issues & judicial focus
- When scoring activities constitute automated individual decision-making
- What explanations and rights safeguards must be provided to data subjects
03
Judicial finding & holding
- Automated scoring falls within GDPR Article 22(1) when a third party relies decisively on the score in making a contractual decision.
- It is prohibited in principle unless an Article 22(2) exception and safeguards apply, alongside other GDPR requirements; an Article 6 legal basis alone is insufficient.
- The referring court must apply the interpretation to the domestic dispute. The later German outcome was not reviewed.
04
Practical risk implications
01Enterprises must verify the actual weight assigned to model scores in final decisions.
02High-impact automated decisions require human intervention mechanisms, objection procedures, and explanatory documentation.
03Model inputs, outputs, thresholds, and human review records must remain traceable.