Ditching Sole Reliance on Schufa Scores for Creditworthiness Assessments
The European Court of Justice has delivered a blow to the reliance on Schufa scores for creditworthiness assessments. Companies in Europe, including banks and telecoms providers, should steer clear of using the Schufa score as their sole deciding factor in granting credit. According to the Court, relying solely on automated Schufa decisions amounts to a prohibited "automated decision in individual cases."
The ECJ's ruling in case C-634/21 clarifies that Schufa scoring falls under the General Data Protection Regulation (GDPR) prohibition of automated decisions based solely on data processing. The ban applies unless certain conditions are met. Schufa's customers cannot assign a decisive role to the Schufa score in credit approval processes.
Credit agencies like Schufa provide clients with a score value, which reflects a person's payment behavior. Companies such as banks, telecoms services, landlords, and energy suppliers frequently request assessments from such agencies to evaluate creditworthiness.
The ruling was prompted by legal issues surfacing in a German case involving a loan applicant and Schufa. The loan refusal prompted the applicant to request Schufa to remove an entry and disclose the exact calculation method for their score, since GDPR stipulates that decisions with legal effects cannot be based solely on automated data processing.
The Wiesbaden Administrative Court referred the case to the ECJ to clarify its relationship with GDPR. Schufa applauded the judgment as it provides clarity on how scores can be utilized in line with GDPR accepted practice. Customers most often find payment forecasts useful but don't rely solely on Schufa scores when contemplating contract agreements.
Bank on Insights
- The European Court of Justice's ruling bans companies from solely relying on Schufa scores in creditworthiness assessments, per the prohibited "automated decision in individual cases" stipulation.
- Schufa scoring falls under GDPR's ban on decisions made solely through automated data processing, with exceptions.
- Banks, telecoms firms, landlords, and energy suppliers often rely on credit agencies like Schufa for assessing loan applicants' creditworthiness and receiving scores.
- Legal issues emerged in a German case where a loan applicant requested Schufa to rectify an entry and reveal the precise calculation method for their score. GDPR prohibits basing decisions on automated data processing.
- Schufa's customers should not assign Schufa scores a decisive role in approving credit, according to the ruling. The Wiesbaden Administrative Court is currently considering an exception to this prohibition aligning with GDPR.
The enrichment data adds some background and implications of the ECJ's judgment, emphasizing new requirements for transparent, justified, and proportionate use of Schufa scores in creditworthiness assessments. Companies must also provide a clear reasoning for their decisions, adhering to the rights of those affected to access and challenge the decisions. Furthermore, the use of Schufa scores must comply with GDPR principles and the requirements of the AI Act for high-risk AI systems like credit scoring.
