Germanys federal court justice schufa credit rulings have reshaped how credit bureaux, lenders and any business relying on automated scoring must answer access requests under the General Data Protection Regulation. In parallel decisions before the Bundesgerichtshof (BGH), Germany’s Federal Court of Justice, the court has addressed whether the creation of a credit score can amount to an “automated individual decision” triggering the data subject’s right to meaningful information under Article 15(1)(h) GDPR, and when that right is engaged where a third party’s contractual decision depends decisively on the score. This article explains the holdings, the legal framework, the interplay with EU case law, and the concrete compliance steps that score users should now take.
For lawyers, compliance officers and affected consumers: this analysis summarises the BGH’s rulings on SCHUFA credit scores, explains when Article 15(1)(h) GDPR disclosure is owed, outlines the practical burden of proof and sets out compliance steps. It is informational and not legal advice. Readers should verify the specific case numbers and dates of the latest BGH decisions on the court’s official site before relying on them.
The BGH has ruled that generating a credit score may constitute, or form part of, an automated individual decision under the GDPR where a third party’s decision to enter into, perform or terminate a contract depends decisively (maΓgeblich) on the score passed to it. Where that is the case, the data subject can demand meaningful information about the logic involved under Article 15(1)(h) GDPR, and the court has addressed how heavily the claimant must plead and prove the score’s decisive effect, recognising the information asymmetry claimants face.
The practical takeaway: businesses that supply or use scores for contractual decisions must document their scoring logic and be ready to explain it meaningfully on request. Purely internal, advisory or non-decisive scores are less likely to fall within the scope of this disclosure right.
The right at the heart of the germanys federal court justice schufa credit decisions is contained in Article 15 GDPR, the data subject’s right of access. Article 15 lets individuals confirm whether their personal data is being processed and obtain a copy, together with specific categories of supplementary information. Among those categories is the right under Article 15(1)(h) to be told about the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4), and, in such cases, to receive meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Article 15(1)(h) does not operate in isolation. It is expressly tied to the automated decision-making regime in Article 22 GDPR. The provision requires disclosure of “meaningful information about the logic involved” wherever automated decision-making within the meaning of Article 22(1) and (4) is taking place. The word “meaningful” matters: the controller is not obliged to surrender the full source code or a complete mathematical model, but it must provide enough for the data subject to understand how the decision was reached and, where appropriate, to contest it. The scope of the right therefore turns on whether there is automated decision-making at all, which is precisely the question the BGH had to resolve in the SCHUFA scoring context.
Article 22(1) GDPR gives data subjects the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. Article 15(1)(h) then provides the transparency counterpart: where Article 22 decision-making exists, the individual can ask for an explanation of the logic. The difficult issue with credit scoring is that the bureau generating the score does not itself refuse credit; it hands a probability figure to a lender, who makes the contractual decision.
The germanys federal court justice schufa credit judgments confront this two-step structure head-on, asking whether the act of producing the score, detached from the downstream contractual act, can itself qualify as automated decision-making that engages the access right.
The BGH’s SCHUFA-related decisions form a coherent set, allowing the court to articulate a general approach rather than a purely fact-bound rule. The judgments address the recurring problem of a credit bureau producing a numerical or categorical score that is then relied upon by banks, telecommunications providers and other businesses when deciding whether to contract with a consumer.
In each case, a data subject had sought information from a credit reference agency about the score calculated in relation to them and about the logic underlying that score. The agency had, in substance, declined to provide a full explanation of the logic, relying on the position that the score itself was not a “decision” but merely a probability estimate supplied to third parties. The data subjects argued that the score effectively determined whether they could obtain a contract, a loan, a mobile contract or similar, and that they were therefore entitled under Article 15(1)(h) GDPR to meaningful information about how the score was generated.
The cases thus squarely raised the question of whether score creation falls within the automated decision-making framework.
The BGH held that the creation of a credit score can itself amount to, or form part of, an automated individual decision for the purposes of Article 22, and therefore trigger the Article 15(1)(h) access right, but it conditioned that conclusion carefully. The decisive factor is the relationship between the score and the subsequent contractual decision made by the third party. Where the third party’s decision to enter into, perform or terminate a contract depends maΓgeblich (decisively) on the score transmitted to it, the score ceases to be a neutral informational input and becomes the effective determinant of the outcome.
In that situation, producing the score is functionally part of the automated decision-making process affecting the data subject, and the bureau cannot shelter behind the formal separation between scoring and contracting. Conversely, where the score is one factor among several that a third party genuinely weighs, or where it does not drive the outcome, the automated-decision threshold is less likely to be met. This reasoning is the core of the germanys federal court justice schufa credit holding and the pivot on which disclosure obligations now turn.
A central practical contribution of these judgments is the treatment of the burden of proof. In principle, a data subject who claims that a score was decisive for a third party’s contractual decision must plead that decisive effect. The difficulty is obvious: the individual rarely has visibility into the internal decision logic of the lender, let alone of the bureau. Recognising this asymmetry of information, the BGH addressed the practical standard, indicating that claimants may rely on circumstantial evidence to show the decisive role of the score, and that controllers are expected to make reasonable disclosure in response rather than hiding behind the claimant’s evidential gap.
The effect is to shift a meaningful part of the practical burden back onto those who hold the information. Businesses should read this as a signal that bare denials and formalistic objections will not necessarily defeat a well-founded request where the surrounding facts point to the score having driven the outcome.
The germanys federal court justice schufa credit rulings do not arise in a vacuum. They build on and sit alongside a developing body of Court of Justice of the European Union (CJEU) jurisprudence on scoring and automated decision-making, and they must be read together with supervisory guidance from the European Data Protection Board (EDPB) and national data-protection authorities.
The CJEU has already engaged directly with credit scoring in SCHUFA-related references. In its judgment in Case Cβ634/21 (SCHUFA Holding), delivered on 7 December 2023, the Court held that the automated establishment of a probability value concerning a person’s ability to meet future payment obligations constitutes “automated individual decision-making” within the meaning of Article 22(1) GDPR, where a third party to which that value is transmitted draws strongly upon it to establish, implement or terminate a contractual relationship. That jurisprudence treated the generation of such a probability score as capable of falling within the automated decision-making regime rather than being merely a preparatory act.
The BGH’s test, focusing on whether the third party’s decision depends decisively on the score, is consistent with this European direction of travel. It operationalises the CJEU’s reasoning for German litigation by giving lower courts a workable criterion and by addressing the evidential realities that claimants face. Practitioners should continue to track CURIA case pages for the specific case numbers to align national argument with EU holdings.
EDPB guidance on access rights and automated decision-making has consistently emphasised that “meaningful information about the logic involved” requires a genuine, intelligible explanation, not a token statement. National supervisory practice in Germany, reflected in the positions of the Federal Commissioner for Data Protection and Freedom of Information (BfDI) and the regional (LΓ€nder) supervisory authorities, has similarly scrutinised credit scoring transparency. The combined effect of the BGH judgments and this supervisory posture is that controllers should expect both litigation and regulatory attention where scoring explanations are thin. Alignment between the courts and the supervisors narrows the room for controllers to argue that scoring logic is categorically exempt from disclosure.
The operational consequences of the germanys federal court justice schufa credit decisions fall on two groups: the bureaux that create scores and the lenders, insurers, telecoms providers and other businesses that use them. Both must be able to identify when a score has become decisive and must be ready to explain the underlying logic in a meaningful way. The following steps provide a structured response.
Begin by mapping every process in which a score is created, transmitted or relied upon. For each flow, record the source of the score, the third party receiving it, and the contractual decision that follows, whether entering, performing or terminating a contract. The critical question is whether the receiving party’s decision depends decisively on the score. Document any thresholds, cut-offs or automatic rejections keyed to the score value, because these are strong indicators of decisive effect. Where a human reviewer is nominally involved, record whether that reviewer can and does genuinely override the score, or whether the score effectively dictates the result.
This mapping exercise is both a compliance tool and evidence: it allows a controller to show, case by case, whether a score fell inside or outside the Article 15(1)(h) trigger.
For scoring that may be decisive, prepare standardised but genuinely informative explanations of the logic involved. The explanation should describe, in accessible terms, the principal categories of data used, the general weight or influence of those categories, and the way the inputs translate into a score and an outcome. It must enable the data subject to understand why they received the result and to identify grounds on which to contest it. Trade-secret and proprietary-model interests can be protected: those legitimate interests are recognised, but the disclosure must still be meaningful, which means a balance rather than a blanket refusal. A short sample framing might read:
“Your score of [X] was calculated using an automated model drawing primarily on [categories of data]. The factors that most strongly influenced your score in this instance were [factors]. This score was transmitted to [third party], whose decision to [enter/perform/terminate the contract] depended significantly on it. You may ask us to review the data used and to explain how specific factors affected the result.”
Revise data subject access request (DSAR) workflows so that scoring requests are routed to staff trained to apply the decisive-dependency test and to deploy the prepared explanation templates. Build in a triage step that asks: was the score created by us or received from a bureau; was it supplied to a third party; and did that party’s contractual decision depend decisively on it? Ensure response timescales under the GDPR are met, in principle the controller must respond without undue delay and within one month of receipt, extendable by up to two further months for complex or numerous requests.
Reflect the court’s approach to the burden of proof in internal policy, responses should engage substantively with circumstantial indications that a score was decisive, rather than demanding that the requester first prove decisiveness. Keep records of what was disclosed and why certain proprietary elements were withheld, so the balance struck can be defended in litigation or before a supervisory authority.
The germanys federal court justice schufa credit judgments affect the litigation calculus for both bureaux and score users. By clarifying when the access right is engaged and by addressing the claimant’s practical burden, the decisions make well-founded claims easier to bring and harder to defeat on procedural grounds alone.
Beyond the access right itself, data subjects may pursue remedies where their data has been processed unlawfully or where a legitimate request has been improperly refused. Article 82 GDPR provides for compensation for both material and non-material damage resulting from an infringement, and German courts, following CJEU guidance, have engaged extensively with claims for non-material loss, recognising that a mere infringement is not in itself sufficient and that the claimant must show actual damage. The quality of a controller’s response affects this landscape indirectly: where a controller fails to provide meaningful information that was owed, the resulting lack of transparency can underpin or strengthen a claim.
Controllers should therefore treat the quality of their Article 15(1)(h) responses not merely as a compliance box to tick but as a factor that can mitigate or aggravate downstream liability. The interaction between the GDPR and national implementing rules in the Bundesdatenschutzgesetz (BDSG) remains relevant to how such claims are framed and quantified in Germany.
Alongside private claims, supervisory authorities retain the power to investigate and sanction infringements. Persistent or systemic failures to provide meaningful information about scoring logic, or to recognise decisive scoring as automated decision-making, could attract regulatory scrutiny and administrative fines under the GDPR’s enforcement regime. The convergence of the BGH’s reasoning with EDPB and national supervisory expectations means that controllers cannot assume that a defensible litigation position is also a defensible regulatory one. A coherent, documented approach to scoring transparency serves both audiences.
Data subjects seeking to benefit from the germanys federal court justice schufa credit rulings should frame their requests precisely. A well-targeted request increases the likelihood of a substantive response and, if necessary, builds the evidential record for later proceedings. The goal is to ask not only for the score itself but for meaningful information about the logic behind it and its effect on a contractual decision.
A short request template might read:
“Under Article 15(1)(h) GDPR, I request confirmation of whether a credit score concerning me has been generated and transmitted to any third party. For any such score, please provide meaningful information about the logic involved, including the categories of data used and the factors that most influenced the result. Please also identify the third party or parties to whom the score was transmitted, and describe the significance and envisaged consequences of the scoring for me, including whether any contractual decision depended on the score.”
Dos and don’ts for requesters: do identify the specific contract or decision affected, because this helps establish decisive effect; do keep copies of any contract refusals or terminations as circumstantial evidence; do set a clear deadline consistent with the GDPR. Do not frame the request as demanding the full source code or model, which invites a trade-secret refusal; instead ask for meaningful, intelligible logic. Do not conflate a non-decisive advisory score with a decisive one, as the right is narrower in the former case.
| Scenario | Is Article 15(1)(h) disclosure likely owed? | Rationale / practical test |
|---|---|---|
| Score created for internal analytics only; not supplied to third parties | No (unlikely) | No downstream decisive action by a third party, unlikely to be an automated individual decision under the BGH test |
| Score supplied to a third party but not determinant of the decision | Probably not | The BGH test focuses on whether the third-party decision depends decisively (maΓgeblich) on the score |
| Score supplied and decisive for a contract refusal or termination | Yes | Likely to trigger the Article 15(1)(h) disclosure right under the BGH approach |
| Score used in a manual review where humans can override | Depends | If the score nonetheless decisively steers the outcome, disclosure may be owed; genuine human oversight is a relevant factor |
| Post-contract retrospective scoring not used for decisions | No | No decisive effect on entering, performing or ending a contract |
| Purely aggregated statistical score for marketing | No | Not an automated individual decision affecting contractual status |
The germanys federal court justice schufa credit judgments give both claimants and controllers a clearer framework: scoring becomes an automated individual decision, and the access right under Article 15(1)(h) GDPR is engaged, where a third party’s contractual decision depends decisively on the score, and claimants face a lighter practical burden to establish that dependency. Credit bureaux, lenders, insurers and other score users should respond by mapping decision flows, documenting and preparing meaningful explanations of scoring logic, and updating DSAR processes so that requests are handled substantively rather than deflected. Businesses needing a jurisdiction-specific assessment of their scoring practices, disclosure templates or litigation exposure should seek tailored advice from a qualified data-protection practitioner.
This article is informational and does not constitute legal advice.
postedΒ 18 minutesΒ ago
postedΒ 27 minutesΒ ago
postedΒ 30 minutesΒ ago
postedΒ 33 minutesΒ ago
postedΒ 45 minutesΒ ago
postedΒ 1 hourΒ ago
postedΒ 2 hoursΒ ago
postedΒ 2 hoursΒ ago
postedΒ 2 hoursΒ ago
postedΒ 2 hoursΒ ago
postedΒ 2 hoursΒ ago
postedΒ 2 hoursΒ ago
Find the right Legal Expert for your business
Send welcome message