On 7. December 2023 in the case C-634/21 (curia.europa.eu/juris/liste.jsf?language=de&td=ALL&num=C-634/21), the Court holds as regards ‘scoring’, that it must be regarded as an ‘automated individual decision’ prohibited in principle by the GDPR, in so far as SCHUFA’s clients, such as banks, attribute to it a determining role in the granting of credit. According to the Administrative Court of Wiesbaden, this is the case. It is for that court to assess whether the German Federal Law on data protection contains a valid exception to that prohibition in accordance with the GDPR. If this is the case, it will still have to check whether the general conditions laid down by the GDPR for data processing (such as Article 5 and 6) have been met.
As regards information relating to the granting of a discharge from remaining debts, the Court considers in the joined cases C-26/22 und C-64/22 (curia.europa.eu/juris/liste.jsf?language=de&td=ALL&num=C-26/22), that it is contrary to the GDPR for private agencies to keep such data for longer than the public insolvency register. (Extract from the ECJ’s press release).