ECJ sets guidelines for SCHUFA scoring

According to the European Court of Justice (ECJ), the SCHUFA scoring system is prohibited if companies rely on it significantly when deciding whether to conclude a contract. However, exceptions to this ban are possible.

Everyone comes into contact with it sooner or later: SCHUFA, Germany’s largest private credit agency. It evaluates people’s creditworthiness every day and summarizes it in a score. The higher the score, the better for that person. Because then SCHUFA estimates the probability that it will meet its financial obligations to be correspondingly high.

Conversely, a low score means that the person is unlikely to pay their bill in the future – at least according to SCHUFA, which relies on data collected millions of times. If companies rely on this assessment, it may result in them not entering into a contract with the person concerned.

Administrative Court Wiesbaden had doubts

This is exactly what happened in a case that the Wiesbaden Administrative Court has to decide on. The plaintiff did not get a loan because of a low SCHUFA score. She then asked SCHUFA to delete incorrect entries and to grant her access to the calculation data.

However, SCHUFA only provided the plaintiff with very limited information, citing trade secrets. A subsequent complaint by the woman to the Hessian data protection officer was also unsuccessful. The plaintiff therefore appealed to the administrative court. Since it had doubts as to whether SCHUFA’s business practices were compatible with European data protection standards, it submitted the procedure to the European Court of Justice (ECJ).

What the ECJ decided

The EU’s highest court initially determined today that SCHUFA’s scoring violates the European General Data Protection Regulation (GDPR) if SCHUFA’s customers – for example banks – attribute it a “significant” role in their contractual decision. According to the GDPR, important decisions may not be made solely on the basis of automatically processed data – i.e. without human involvement.

However, the ECJ also made it clear that this practice can be permitted in exceptional cases. For example, when the national legislature issues an exception. In Germany there is such a regulation in the Federal Data Protection Act.

This is how it continues now

The proceedings are not concluded with the ECJ ruling, but are now back before the Wiesbaden Administrative Court. The administrative court must now deal in particular with the question of whether the exception provision in the Federal Data Protection Act itself is even legal. It had already expressed doubts about this in the underlying proceedings.

If the administrative court finally comes to the decision that the regulation violates European data protection law, SCHUFA scoring in its current form would not be covered by any exception regulation and would therefore be inadmissible if companies base their contractual decisions solely on it.

SCHUFA stated in a statement immediately after the verdict was announced that the majority of its customers could continue to use the SCHUFA scores for their processes without any adjustments. According to their own statements, the overwhelming feedback from their customers is that payment forecasts in the form of the SCHUFA score are important for them, but are generally not the only decisive factor in concluding a contract.

ECJ also rules Data storage

In a second referral procedure, the ECJ today decided on the storage of data from public directories such as the insolvency register. Through consumer bankruptcy, individuals can free themselves from their debts, even if they cannot pay everything back. At the end there is the so-called residual debt discharge. The information about this will be published on an official internet portal for six months.

SCHUFA collected these announcements and stored them for three years. The ECJ ruled today that private credit agencies may not store such data longer than the public insolvency register itself.

SCHUFA has now voluntarily shortened the storage period to six months, which is why there are no immediate consequences for them from the ruling. However, the ECJ expressly left open whether parallel storage during the six months might also be inadmissible. The Wiesbaden Administrative Court must now also make this decision. The ECJ has drawn up guidelines in this regard that the administrative court must take into account when weighing up its interests.

Concrete consequences of the verdict?

After the ECJ ruling, SCHUFA’s business practices will probably not change for the time being. The ball is now back in the Wiesbaden Administrative Court, which now has to make important and fundamental decisions in both proceedings.

Since legal remedies are possible against these decisions, it could be several years before a final, highest court decision is made by the Federal Administrative Court.