The probability values (“scores”) calculated by Schufa regarding the creditworthiness of a consumer are not compatible with the General Data Protection Regulation (GDPR). This is what Priit Pikamäe, Advocate General at the European Court of Justice (ECJ), assumes. In his opinion on a relevant legal dispute published on Thursday, the EU lawyer explains that the GDPR enshrines a right of the data subject not to be subject to a decision based solely on automated processing – including profiling. The scoring procedure of the Schufa violates this clause.
The Advocate General is according to his conclusion believes that Schufa is creating a personal profile with its essentially secret score. Decisions based on this, for example about granting a loan or the successful placing of an online order, have legal effects on those affected or adversely affect them in a similar way. Pikamäe also assumes that the decision is “exclusively based on automated processing”. The relevant GDPR provisions are therefore applicable.
When renting an apartment, concluding a mobile phone contract or changing electricity providers, Schufa quickly comes into play. Companies often first ask credit agencies about their creditworthiness (creditworthiness). The Schufa then sends a score value in addition to relevant database entries. This should reflect the probability of whether the customer will meet his payment obligations or whether there is a risk of default. The credit bureaus point out that business partners should consider other data they have about an interested customer when making decisions
Plaintiff did not get credit
In case C-634/21 to be decided by the ECJ, a consumer first requested more information about the procedure from the credit agency after she had not been able to get a loan from her bank. The person concerned also asked Schufa to delete the relevant entry.
After an unsuccessful complaint, the applicant sued Schufa before the Administrative Court (VG) Wiesbaden. Among other things, the ECJ now wants to know whether the scoring, including the uncommented transfer to third parties, falls under Article 22 GDPR. This states that a person “may not be subjected to a decision based solely on automated processing – including profiling” if the latter “have legal effects concerning them or similarly significantly affect them”.
disclosure required
The competent Advocate General now underlines that according to another provision of the GDPR, the data subject has the right to obtain other meaningful information from the controller, including the existence of automated decision-making including profiling, the logic involved and the scope and intended Effects of such data processing. It should include sufficiently detailed explanations of the method used to calculate the score and the reasons that led to a particular result.
The Schufa would therefore have to provide those affected with general information, above all on the factors that they take into account in the decision-making process and their weighting at an aggregated level. According to the Advocate General, these are crucial so that data subjects can also exercise their right within the meaning of the GDPR to contest automated decisions based on profiling.
Personal bankruptcy – when to delete
In the other two cases C-26/22 and C-64/22, which the VG Wiesbaden has also submitted to the ECJ, is about the discharge of residual debt after insolvency. Private individuals are thus able to free themselves from their payment obligations within a limited period of time in the context of consumer insolvency, even if they cannot meet all financial claims.
The bankruptcy courts make such information public but delete it after six months. However, Schufa keeps such entries in its register for three years. This is also unlawful, according to the Advocate General. There is a right to erasure. The aim of the discharge of residual debt is that those affected could participate in economic life again. The storage by a credit agency undermines that. The Federal Court of Justice is currently examining a similar case.
The Este Pikamäe sees the Wiesbaden judges being called upon to weigh up the interests and effects on the data subject against each other as far as the half-year period is concerned, in which the personal data is also available in public registers. They would have to determine whether the parallel storage of this information by private credit reporting agencies was lawful on this basis. The Opinion is not binding on the Court. However, the Luxembourg judges often follow the Advocate General’s recommendation. The ECJ decisions can be expected in a few months.
(ds)
