EU Court of Justice rules credit scores can be automated decisions restricted by GDPR
See how this story connectsIn case C-634/21 SCHUFA Holding (Scoring), decided on 7 December 2023 on a reference from the Administrative Court of Wiesbaden, the Court of Justice held that a credit agency’s score is an automated individual decision under Article 22 GDPR when lenders give it a determining role in granting credit. Such decisions are prohibited in principle unless a valid exception applies.
Why it matters
Credit bureaus and lenders across the EU that rely on automated scores must meet GDPR’s automated-decision rules, including the right to human review, even when the scorer does not make the final decision.
- When
- 7 Dec 2023
- ID
WTA-N-2023-0169- Where
- European Union, Germany
- Who
- Court of Justice of the European Union, SCHUFA
- Authority
- Court of Justice of the European Union
- Target
- SCHUFA (credit scoring)
- Action
- ruling: scoring is an automated decision
- Status
- decided · Enforcement ledger
Summary by wheresthe.ai, from Court of Justice of the European Union and the reporting credited above. Checked against the source on 9 Oct 2026.
Source copy: download the page text as saved on 18 Oct 2026 (PDF). Also held by the Internet Archive.
Cite this story
WTA-N-2023-0169: “EU Court of Justice rules credit scores can be automated decisions restricted by GDPR.” wheresthe.ai, 7 Dec 2023. https://wheresthe.ai/d/eu-cjeu-schufa-scoring-article-22-2023-12/ (source: Court of Justice of the European Union).
Spotted an error? Email [email protected].