News

12.01.2024

CJEU Ruling on Data Processing of Credit Information Agencies and Automated Decision Making

The Court of Justice of the European Union (CJEU), in its ruling on a banks rejection of a loan application based on the credit score of a private credit information agency called SCHUFA, stated that the scoring of credit rating agencies could be regarded as automatic decision-making and may be lawful under certain conditions. According to the Court the prolonged storage of information on the discharge of people's remaining debts by credit rating agencies is also contrary to the EU General Data Protection Regulation (GDPR). 

"Scoring" was defined in the judgment as a mathematical and statistical method used to predict the possibility of future behaviour, such as the repayment of a loan. The Court interpreted a “decision” in Art. 22 GDPR by considering not only its literal wording, but also its context, object and purpose. In Court’s view, if banks attribute to SCHUFA’s information a determining role in the granting of a loan, this is considered an automated decision within the meaning of Art. 22 of the GDPR. Therefore, credit rating agencies also have an obligation to provide explanations under the right of access by the data subject.

The Court emphasized that the discharge of remaining debts is intended to allow the data subject to re-enter economic life. Therefore, this information continues to be considered a negative factor when evaluating the financial stability of the individual. The Court stated that it is contrary to the GDPR for private entities to store information on the discharge of remaining debts for 3 years, while the German Public Insolvency Register retains this information for 6 months. The Court mentioned that after the expiry of the 6-month period envisaged by the German Legislature, the rights and interests of the data subject will take precedence over the public's right of access to this information.
In conclusion, the Court highlighted the importance of national courts having the authority to fully review over any binding decision of a supervisory authority. This matter has also gained attention in Turkey, notably with the Constitutional Court's recent decision (application number 2020/7518) which found a violation concerning the failure of a Criminal Court of Peace to adequately assess objections to penalties imposed by the Personal Data Protection Board.

Oğuzhan BAŞAK

Cenk KONUKPAY