Facts
SCHUFA Holding is a private German credit reference agency that supplies information on creditworthiness to clients, mainly banks. It uses mathematical and statistical methods to turn the likelihood that a person will meet future payment obligations into a score. After SCHUFA passed negative information about the applicant, OQ, to a bank, the bank refused the loan. The competent data protection authority declined to take action against SCHUFA, and OQ challenged that refusal before the Administrative Court of Wiesbaden. That court asked the Court of Justice of the EU (CJEU) how the General Data Protection Regulation (GDPR) applies to such scoring.
Question
The question was whether generating a probability score can, on its own and apart from the bank's later decision, be an 'automated individual decision' within Article 22(1) GDPR. On a narrow reading, generating the score would be no more than a preparatory act, with the decision on the contract taken by the bank. The referring court was concerned that, on that reading, the protection offered by Article 22 could be circumvented. If scoring did fall within Article 22, it would also matter whether the German Federal Data Protection Act provision relied on for it met the conditions for an exception under the Regulation.
Decision
The Court held that establishing a probability value concerning a person's ability to meet payment commitments is an automated individual decision within Article 22(1) where a third party to which it is transmitted, such as a bank, draws strongly on it in deciding whether to establish, implement or terminate a contract. According to the referring court, that was the case here. Such scoring is therefore prohibited in principle unless an exception applies. It is for the Wiesbaden court to determine whether the German Federal Data Protection Act contains a valid exception and, if so, whether the GDPR's general conditions for processing are met.
Why it matters
The judgment extends Article 22 upstream to the entity that produces the score. A credit agency or profiling service cannot stay outside Article 22 simply because its client formally takes the final decision. Where the score in practice determines the outcome, the provider must be able to rely on one of the exceptions in Article 22(2). Where that exception rests on national law, that law must provide suitable safeguards, including the right to obtain human intervention.
Related stages
On the same day, in Joined Cases C-26/22 and C-64/22, the Court held that private credit agencies may not keep information on a discharge from remaining debts for longer than the six months for which it stays on the public insolvency register. On 19 November 2025 the referring court, the Administrative Court of Wiesbaden, ordered the Hessian data protection authority (HBDI) to take action against SCHUFA, because the information given about the score was inadequate under Article 15(1)(h) GDPR (6 K 788/20.WI). That judgment is not final: the court granted leave both for an appeal (Berufung) and for a leapfrog appeal on points of law (Sprungrevision).