Skip to main content
Praxikon

Ruling

SCHUFA: a credit score on which third parties draw strongly is automated decision-making

Date
Status
final
Body
Hof van Justitie van de EU (Eerste kamer), OQ tegen Land Hessen, met SCHUFA Holding AG als interveniënt
Reference
C-634/21, ECLI:EU:C:2023:957

What it is about

Question: is the automated calculation of a credit score by a credit reference agency already an automated individual decision under Article 22, even though a bank or shop takes the actual decision? Ruling: yes, where the third party receiving the score draws strongly on it to establish, implement or terminate a contract. The score is then itself the decision with legal or similarly significant effects, and the prohibition in Article 22(1) applies unless an exception in Article 22(2) is met.

What this means in practice

If you supply scores, risk indicators or rankings that customers adopt almost automatically, you yourself must meet the requirements of Article 22: a valid exception (law, contract or explicit consent), suitable safeguards, human intervention and information on the logic used. Recipients of such scores must check whether their decision process in fact relies on the score and adjust their information and objection processes accordingly. This also affects AI models that compute risk scores about people.

The GDPR articles concerned

Source: EUR-Lex, arrest C-634/21checked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

Case law

Guidelines

Legislation in motion6 of 7