On December 7, 2023, the Court of Justice of the European Union (CJEU) announced that it had adopted its ruling in case C-634/21 OQ v Land Hessen and joint cases C-26/22 and C-64/22 UF/AB v Land Hessen, following requests for a preliminary ruling by the Administrative Court of Wiesbaden in regards to practices of SCHUFA Holding (SCHUFA), a private agency providing credit information.

Automated credit scoring

In its first ruling on the right not to be subject to automated decision-making, the CJEU took the view that 'scoring' must be regarded as an 'automated individual decision,' and in so far as SCHUFA's clients (e.g., banks) attribute to it a determining role in the granting of credit, it would be prohibited in principle by Article 22 of the General Data Protection Regulation (GDPR). The CJEU also noted that it is the Administrative Court's responsibility to assess whether in the case at hand the Federal Data Protection Act of June 30, 2017 (implementing the GDPR) contains a valid exception to that prohibition, noting however that, if this is the case, the Administrative Court would still have to check whether the general conditions laid down by the GDPR for data processing have been met.

Prolonged retention of information on debt discharge 

In addition, the CJEU held that it is contrary to the GDPR for private agencies to keep data relating to the granting of a discharge from remaining debts for longer than the period mandated by German law for public insolvency register, which is six months. The discharge from remaining debts is intended to allow a data subject to re-enter economic life and, as such, the CJEU posited that, once the six-month period has elapsed, the rights and interests of the data subject take precedence over those of the public to have access to that information. Since the prolonged retention of such data is unlawful, the CJEU held that the data subject has the right to have the data deleted and the relevant private agency is obliged to delete the data as soon as possible. 

Full review of decisions by courts

Lastly, the CJEU reminded that national courts must be able to exercise full review over any legally binding decision of a national supervisory authority.

You can read the press release here, the C-634/21 case judgment here, and the C-26/22 and C-64/22 joint cases judgment here, both only available in German.