GDPR Article 22 · Case law

The SCHUFA ruling: when a score becomes a decision

Hael · Updated 6 July 2026 · 6 min read

Key takeaway

In December 2023 the CJEU ruled that a credit reference agency calculating a probability score is itself making an automated decision under Article 22, when lenders draw strongly on that score, even though the agency does not make the final lending call. The ruling pulls scoring and rating providers directly into Article 22.

Case C-634/21 was decided by the CJEU on 7 December 2023.
Generating a score is itself Article 22 decision-making where a third party relies on it decisively.
The Court rejected the argument that the score was mere preparation for another party's decision.
The logic reaches fraud, insurance, tenant-screening and hiring scores, not only credit bureaus.
General information, not legal advice. Current as of July 2026.

The case

In Case C-634/21, decided on 7 December 2023, an individual was refused credit by a bank that relied on a score supplied by the German credit reference agency SCHUFA. SCHUFA argued Article 22 did not apply to it, because the bank, not SCHUFA, made the decision; its score was merely a preparatory act. The Court of Justice of the EU rejected that argument.

What the Court held

The CJEU held that generating the score is itself automated individual decision-making within Article 22, where a third party draws strongly on that score to establish, implement or terminate a contract, because in practice the score determines the outcome. To treat the score as mere preparation, the Court reasoned, would leave a gap in protection, since the agency that built the score is the party best placed to explain it, and the individual would otherwise have no one to hold to the transparency duties.

Why it matters beyond credit

The logic is not confined to credit bureaus. Any provider whose scores, ratings, or risk classifications are relied upon decisively by downstream decision-makers may itself be caught by Article 22, along with the organisation that acts on the score. Fraud scores, insurance risk ratings, tenant screening, and hiring rankings all sit in the ruling's shadow. The case was returned to the German court to consider a national-law question, so the story is not fully closed, which is exactly why anyone relying on it should track the position.

Key terms

Probability value: The score SCHUFA calculated to indicate a person's likelihood of meeting future payment obligations.
Determining role: The CJEU's test: whether a third party draws strongly on the score in reaching its own decision.
Preparatory act: SCHUFA's rejected argument that scoring was only a prelude to another party's decision.
Downstream reliance: Decisive use of a supplier's score by the party that formally takes the decision.
C-634/21: The CJEU case reference for the SCHUFA judgment of 7 December 2023.

References

Related guides