What did the BGH decide on SCHUFA scores?

On 21 October 2026, Germany's Federal Court of Justice (Bundesgerichtshof, BGH) set out when the credit reference agency SCHUFA must explain to consumers how their credit scores were calculated. In four judgments (I ZR 227/25 to I ZR 230/25), it held that a SCHUFA score is an automated decision under Article 22 GDPR only if a company's decision to enter into, carry out or end a contract with the person depends decisively on that score.

The key passage of this SCHUFA BGH ruling is about proof. According to the BGH's press release no. 198/2026, a consumer only has to show that SCHUFA sent a score to a company and that an adverse contract decision followed soon after. A presumption then arises that the score was decisive, and SCHUFA must rebut it.

The BGH set aside four judgments of the Dresden Higher Regional Court (Oberlandesgericht, OLG) of 7 October 2025 and sent the cases back. Readers in Türkiye and Korea know this set-up from Findeks and Korean credit bureau scores: one company scores, another decides.

What exactly did the court say?

The BGH tested SCHUFA's scoring against the three conditions of Article 22(1) GDPR and found that only the third, a significant effect on the person, was unproven. The published reasons in I ZR 227/25 explain each step.

  • There is a "decision". Calculating a probability value about a person's ability to pay is itself a decision. It exists from the moment of calculation, so SCHUFA's internal "base score" is a decision too.
  • It is solely automated profiling. SCHUFA assigns a person's data to statistical groups of people with similar data in the past. That is profiling under Article 4(4) GDPR.
  • The significant effect was not established. A third party's decision to conclude, perform or end a contract must depend decisively (maßgeblich) on the score sent to it. The Dresden court had not examined this. If, as SCHUFA says, the base score is never sent to anyone, this condition fails for that score.

Article 15(1)(h) GDPR is the part of the right of access that covers "meaningful information about the logic involved". The BGH held that it applies only when all three conditions of Article 22(1) are met; profiling alone is not enough. The consumer need not, however, show that the automated decision breached Article 22(2) to (4).

Who has to prove what?

The consumer bears the burden of proof, but under the EU principle of effectiveness (national procedure must not make EU rights practically impossible to use) the bar must be low.

It is enough to state that SCHUFA sent a score to a company and that, close in time, an adverse decision followed on a contract with that company or an affiliated company. Once this is shown, a factual presumption (tatsächliche Vermutung), an inference from ordinary experience, arises that the score was decisive. SCHUFA can try to rebut it. The BGH rejected as too demanding the stricter tests of six other higher regional courts, among them the Kammergericht in Berlin and the courts in Munich and Stuttgart.

Banks' own duty to assess creditworthiness under § 18a of the German Banking Act (KWG) does not defeat the presumption: in the BGH's words, it says nothing about the actual weight given to credit profiles.

How much must SCHUFA explain?

If the duty exists, SCHUFA's 2023 letters did not meet it. They listed the data types used, each with a risk symbol from "++" to "--". SCHUFA must also explain the criteria behind each rating, how the ratings were weighted against each other, and obvious inconsistencies between scores. A general trade-secret objection is not enough; the court must weigh the interests. SCHUFA does not have to hand over its algorithm (the Dresden court so held, and the BGH left that point standing), and Article 15 gives no right to information on the scores' scientific validity. The BGH saw no need to refer questions to the Court of Justice of the EU (CJEU).

How does the SCHUFA BGH ruling build on the CJEU's 2023 judgment?

The BGH applies the CJEU's SCHUFA judgment of 7 December 2023 and answers the question it left to national courts: how a consumer proves that a score was decisive.

In Case C-634/21 (OQ v Land Hessen), the CJEU held that an agency's automated creation of a score on a person's ability to pay is an automated individual decision under Article 22(1) GDPR where a third party draws strongly on it in deciding on a contract. Otherwise the agency would escape Article 22, and the lender could not explain logic it does not have (see our summary of the CJEU's SCHUFA judgment).

In Dun & Bradstreet Austria (C-203/22, 27 February 2025), the CJEU said what an explanation must contain: the procedure and principles actually applied, in understandable form, not a formula. Telling the person how a change in their data would have changed the result may be enough (see our Dun & Bradstreet Austria summary). What the BGH adds is the evidential bridge between the CJEU's test and facts only the lender can see.

Is a SCHUFA score an automated decision under Article 22 GDPR, and why does it matter?

A SCHUFA score is an automated decision whenever the recipient relies on it decisively, and the presumption means that will often be assumed. Three consequences reach beyond credit agencies.

The ruling concerns the right of access, not damages, and only the scores disclosed in SCHUFA's 2023 letters. According to LTO, SCHUFA's new score, used since 17 March 2026, was not part of the proceedings.

How do Türkiye and Korea compare?

Both countries have the same three-party structure, but neither has a rule identical to Article 22; Korea comes closer through a credit-specific right to an explanation.

Türkiye: Findeks and KVKK Article 11. The Findeks score comes from the Credit Bureau (Kredi Kayıt Bürosu, KKB), which nine banks founded in 1995 and which does the operational and technical work of the Risk Centre set up within the Banks Association of Türkiye under Banking Law No. 5411. Findeks says the score, from 1 to 1900, estimates the likelihood of repaying debts over the next twelve months. It publishes its factor weights, led by payment habits at 45%. Banks, it says, use the score as one of the main inputs alongside their own internal assessments.

The Personal Data Protection Law No. 6698 (KVKK) has no ban like Article 22 GDPR and no express right to information about the logic involved. Article 11(1)(g) gives a right to object to an adverse result of analysis "exclusively through automated systems". A bank will say Findeks was only one input; the BGH's point about actual weight answers that. Under Article 190 of the Turkish Code of Civil Procedure (HMK), the burden of proof lies with the party who derives rights from the alleged fact, but in my view Turkish courts could draw a similar inference from timing (fiilî karine). See also our KVKK AI governance guide.

Korea: two layers. Article 37-2 of the Personal Information Protection Act (PIPA), in force since 15 March 2024, lets a person refuse a fully automated decision, including by AI, that significantly affects their rights or obligations, unless it rests on consent, law or contract. A right to an explanation applies regardless. Our PIPA automated decisions guide has the details.

For credit, Article 36-2 of the Credit Information Use and Protection Act lets individuals ask credit bureaus, and other users designated by decree, whether they use automated evaluation and, if so, for the result, the main criteria and an overview of the data. People can also ask for corrections and a recalculation; failing to explain can bring an administrative fine of up to KRW 30 million (Article 52(3)). Unlike in Germany, the right does not depend on proving that a score was decisive. The Seoul Administrative Court's Kakao Pay judgment shows that the data flows behind risk scoring are also scrutinised.

What should organisations that build or use scores consider?

Where timing points to a score, organisations should expect to show that it was not decisive, and should be able to explain it at the level of criteria and weights.

  • Map the chain: who calculates, who decides and how much weight the score carries. Override rates say more than policies.
  • Keep evidence that a refusal rested on other grounds, such as income or collateral.
  • Prepare plain explanations: the criteria behind each rating, the weights, and how a change in the data would change the result.
  • Build the trade-secret case in advance. A general objection failed before the BGH.
  • Treat AI credit scoring as high-risk. Annex III, point 5(b), of the EU AI Act lists AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score, except those used to detect financial fraud. See our high-risk assessment guide.
  • In Türkiye, answer Article 11(1)(g) objections with real human review; in Korea, check the publication duty in PIPA Article 37-2(4).

What happens next in Germany?

The cases return to Dresden, and a new statutory scoring regime applies from 20 November 2026.

  • Remand. The consumers can reformulate claims the BGH found too vague; Dresden must then decide whether each score was decisive.
  • New § 37a of the Federal Data Protection Act (BDSG). The Act implementing the Consumer Credit Directive (EU) 2023/2225 (BGBl. 2026 I No. 139) permits scoring on conditions. Scores may not use special-category data, age, sex, name, social network data, bank-account transaction data or address data, or concern minors. On request, scorers must disclose the data and criteria used, the weighting of the most influential criteria, the score's meaningfulness, and the scores produced and their recipients. The BGH noted that this right will stand alongside Article 15(1)(h) GDPR.
  • Human review for consumer loans. The amended § 30 BDSG lets borrowers ask the lender for human intervention where the creditworthiness assessment for a general consumer loan involves automated processing.
  • The new SCHUFA score. According to LTO, it uses twelve criteria and a range of 100 to 999, and SCHUFA plans to retire old models by the end of 2028.

Frequently asked questions

What did the BGH rule on SCHUFA on 21 October 2026?

Germany's Federal Court of Justice held that SCHUFA must explain the logic of a credit score under Article 15(1)(h) GDPR only if the score is an automated decision under Article 22(1), meaning a company's contract decision depended decisively on it. A consumer can rely on a presumption if a score was sent and an adverse decision followed soon after.

Can I ask SCHUFA how my score was calculated?

Under the BGH's ruling, a consumer can ask for an understandable explanation of the criteria and weights behind a score that was decisive for a contract decision, though not necessarily the algorithm itself. From 20 November 2026, § 37a of the German Federal Data Protection Act adds a separate right to information on the data, the main criteria and the scores produced.

Does the BGH ruling apply to the Findeks score in Türkiye?

No. The BGH interprets the EU's GDPR, which does not bind Turkish courts. Findeks scores fall under Turkish law, including the Personal Data Protection Law (KVKK), whose Article 11(1)(g) gives a right to object to adverse results of exclusively automated analysis. The BGH's reasoning on actual reliance may still inform Turkish disputes.

What rights do people in Korea have over credit scores?

Under Article 36-2 of Korea's Credit Information Use and Protection Act, individuals can ask credit bureaus whether they use automated evaluation and, if so, for the result, the main criteria and the underlying data, and can request corrections and a recalculation. Article 37-2 of the Personal Information Protection Act adds rights to refuse and to an explanation.

Burhan Doğuş Ayparlar's View

In 2023 the CJEU decided that the score can be the decision. It could not decide how anyone outside a bank proves that. The BGH has given a practical answer, and I think the right one: a right that cannot be proved is not a right, and SCHUFA and its clients hold the evidence that could rebut the presumption.

The sentence I would underline for any lender is the one on § 18a KWG. A duty to assess independently does not show that anyone did. Wherever a model's output is formally only "input", courts will ask how often the human disagreed.

Findeks already publishes its factor weights, more than SCHUFA's 2023 letters gave. The gap in Türkiye is in the law: KVKK Article 11(1)(g) covers only "exclusively" automated results and gives no clear right to an explanation. Any future amendment of the KVKK would be a natural place to add one.

This article is for information only and does not constitute legal advice. It is based on BGH press release no. 198/2026 of 21 October 2026 and the published reasons in I ZR 227/25 and I ZR 228/25; BGBl. 2026 I No. 139; CJEU judgments C-634/21 and C-203/22; the EU AI Act (Regulation (EU) 2024/1689); Turkish Laws No. 6698, 5411 and 6100; Korea's Personal Information Protection Act and Credit Information Use and Protection Act; and information published by KKB and Findeks, all consulted on 25 October 2026. Details of SCHUFA's new score come from LTO (21 October 2026). Translations from German, and the analysis, are the author's own. How the Dresden court will apply the presumption is not yet known; specific cases require individual assessment.