Unraveling Schufa's Power: ECJ's Decision on Credit Ratings in Germany
What's the scoop on Schufa? This German credit bureau gathers and interprets mountains of data to assess individual consumers' creditworthiness. Financial institutions, retailers, telecom providers, car dealerships, and energy suppliers all rely on Schufa to gauge their clients' payment behavior before entering into contracts or dispensing goods. But is Schufa's credit rating really the be-all and end-all, or just a significant part of a broader analysis process? This fundamental question is the root of a legal spat that the European Court of Justice (ECJ) will settle at 9:30 am on Thursday.
Speaking of Schufa
The Schutzgemeinschaft für allgemeine Kreditsicherung (SAK), established in 1927, is the backbone of Schufa's operation. The SAK collects data to generate assessments, which enable its 10,000 partner organizations, including banks, savings banks, mail-order companies, and energy suppliers, to target creditworthy consumers. Schufa boasts having data on 68 million individuals in Germany, with well over 90% of that data being "all-positive." The agency churns out an average of 320,000 reports daily. Alongside Schufa, Creditreform and Crif are other credit reporting agencies.
What data does Schufa accumulate?
Schufa collects account opening information, credit card issuance data, lease contract details, and loan information from its partner organizations. Additionally, the agency stores personal information such as names, birth dates, and addresses. However, it does not delve into income details.
What does Schufa actually do with the gathered data?
The amassed information is used to calculate a fundamental score, which is updated every three months. This score represents the likelihood of a consumer honoring their financial obligations within the range of 0 to 100%. A higher score represents higher creditworthiness, while poor payment history and frequent reminders lead to a lower score. Schufa maintains discretion about its scoring method, arguing that full disclosure would render the score ineffective due to potential manipulation. Nevertheless, the responsible data protection authority is aware of the scoring method, and it is regularly scrutinized by both the authority and independent analysts.
ECJ's legal tussle
At the heart of this legal dispute is whether Schufa's credit ratings in specific cases can be classified as an automated decision in accordance with Article 22 of the General Data Protection Regulation (GDPR). The European Court will also weigh in on the relevance of Schufa scores in businesses' decision-making process regarding loan approvals or contract acquisitions.
The controversy boils down to numerous German court cases. For example, a borrower who failed to secure a loan took issue with Schufa for refusing to disclose its scoring method and deleting a specific entry. More significantly, the Administrative Court in Wiesbaden referred the case to the ECJ to determine the relationship between Schufa's credit ratings and GDPR regulations.
The progress of the ECJ proceedings
In a mid-March opinion, Advocate General Priit Pikamäe argued that the calculated creditworthiness probability is, in fact, akin to a prohibited automated decision under Article 22 of the GDPR, regardless of whether a business makes a final decision about a consumer's creditworthiness based on Schufa's score. It's important to note that the advocate general's view is not binding; instead, judicial decisions often rely on his advice.
Schufa's stance
Schufa maintains that it does not dictate lending decisions or contract settlements. Instead, it merely provides businesses with the information required to make purposeful decisions. Schufa's CEO, Tanja Birkholz, contends that the ultimate authority for such decisions lies with the contracting companies. To illustrate, banks frequently take other factors like income and expenditures into consideration when approving loans, while telecoms sometimes approve contracts despite negative Schufa entries due to competition-related incentives.
Key Takeaways
- The impending ECJ decision might have far-reaching implications for businesses and consumers in the European Union, with a particular focus on data protection and credit scoring practices.
- If the ECJ upholds the advocate general's opinion, credit scoring systems would be required to significantly adapt to comply with Article 22 of the GDPR.