April 05, 2023 /
According to an Advocate General of the European Court of Justice in Luxembourg, the calculation of the so-called “Schufa score” is not compatible with the GDPR pursuant to Art. 22 para. 1. The assessment is based on an inquiry by the Wiesbaden Administrative Court. The ECJ’s ruling is expected in a few months.
As a private credit agency, Schufa is a relevant tool in day-to-day business to check the payment behavior of the contracting party in order to decide, for example, whether a loan can be granted or not. Creditworthiness is expressed by a point value, the Schufa score. In addition to factors such as the number of moves in the past or the number of credit cards, past payment behavior is collected and stored to calculate the score.
The starting point of the complaint was a denied credit agreement due to a negative Schufa scoring. The lady concerned then demanded both the deletion of the incorrect data and access to the documents. After Schufa’s response only provided the general value of the scoring, a complaint was lodged with the Hessian Data Protection Commissioner. Schufa likes to refer to trade secrets when answering questions about the specific calculation of creditworthiness and only provides general information about the method of calculation. According to the BGH, this is also permissible in principle.
In this case, the data protection officer rejected the plaintiff’s claim, as a result of which the case is now before the Wiesbaden Administrative Court. The judges then turned to the ECJ for help.
At the European Court of Justice, Advocate General Priit Pikamäe wrote an opinion to examine the extent to which storing and collecting data is compatible with the European General Data Protection Regulation. In his opinion, Pikamäe states that the automated creation of a probability value for scoring alone constitutes an automated decision, which is prohibited under Art. 22 para. 1 GDPR.
The opinion is not binding, the judges of the ECJ only
“The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.”
The biggest criticism of Schufa is its lack of transparency. The company is repeatedly accused of not dealing openly with the collection of its Schufa score, which according to some critics should not be allowed, considering the fact that negative Schufa entries are sometimes associated with serious consequences for the end consumer, as they can no longer obtain a mobile phone contract, for example.
Schufa has already made improvements here in the past by publishing some test questions with the Schufa Score Simulator, which should better show which factors are included in the calculation of the score. Nevertheless, Schufa is still a “black box” for many people, according to consumer protection minister Steffi Lemke.
The length of time that Schufa collects and stores data is also criticized. This is shown by the second case before the ECJ. Specifically, it concerns two claimants who were granted residual debt discharge following insolvency proceedings. Residual debt discharge is granted at the end of successful insolvency proceedings. The insolvency courts provide public information about this, but delete the information again after six months to make it easier for debtors to get back on their feet. Unlike Schufa, which stores this data for up to three years. Wrongly, as the ECJ ruled. Those affected can demand that Schufa deletes the data. In response to this, Schufa recently announced that it would also not store information on residual debt discharge for longer than six months in future.
Sources:
Schufa scoring violates GDPR (lto.de; last accessed on 03.04.2023)
Schufa scoring violates GDPR (rsw.beck.de; last accessed on 03.04.2023)
Schufa scoring violates EU law – according to expert opinion (t3n.de; last accessed on 03.04.2023)
Consumer minister criticizes Schufa (stuttgarter-nachrichten.de; last accessed on 03.04.2023)
Art. 22 GDPR (dsgvo-gesetz.de; last accessed on 05.04.2023)
Image source: AdobeStock 419676534 by nmann77