The European Court of Justice is deciding today whether Schufa’s scoring system is compatible with data protection standards. This could have far-reaching consequences for the business practices of credit agencies across Europe.
Everyone comes into contact with it sooner or later – Schufa, Germany’s largest private credit agency. It evaluates people’s creditworthiness every day and summarizes it in a score. The higher the score, the better for that person. Schufa then estimates the probability that it will meet its financial obligations to be correspondingly high.
Conversely, a low score indicates that the person is less likely to pay their bill in the future. At least that is the assessment of Schufa, which relies on data collected millions of times. If companies rely on this assessment, it may result in them not entering into a contract with the person concerned.
Administrative Court has doubts
This is exactly what happened in a case that the Wiesbaden Administrative Court has to decide on. The plaintiff did not get a loan because of a low Schufa score. She then asked Schufa to delete incorrect entries and give her access to the calculation data.
However, Schufa only provided the plaintiff with very limited information, citing trade secrets. A subsequent complaint by the woman to the Hessian data protection officer was also unsuccessful.
The plaintiff therefore appealed to the administrative court. Since it had doubts as to whether Schufa’s business practices were compatible with European data protection standards, it submitted the procedure to the European Court of Justice (ECJ).
What the ECJ must now decide on
The EU’s highest court is examining in particular whether data collection, i.e. the automated creation and transmission of probability values about a person’s ability to service a loan in the future, violates the European General Data Protection Regulation (GDPR). This actually prohibits important decisions from being made solely on the basis of automatically processed data.
The advocate general – a kind of expert who gives his opinion in advance – stated that the score should not be the decisive reason for a company to enter into a contract with a customer. The judges at the ECJ are not bound by the opinion of the Advocate General – whether they share his assessment is eagerly awaited.
What the company says
Schufa itself stated before the decision that its scores were important, but generally not decisive for companies’ contract decisions. Research by NDR and SZ However, many companies use Schufa’s credit rating when making contract decisions. For example, several large energy suppliers confirmed that they use the Schufa score to assess new customers.
If the assessment is positive, the people concerned will receive an attractive special contract with more favorable conditions. However, those who are judged less well only receive expensive basic care.
A second submission procedure concerns data storage after consumer bankruptcy. Through consumer bankruptcy, individuals can free themselves from their debts, even if they cannot pay everything back. At the end there is the so-called residual debt discharge. The information about this will be published on an official internet portal for six months.
Schufa collected these notices and stored them for three years. It has now voluntarily shortened the storage period to six months. However, the ECJ is still fundamentally deciding today whether data from public registers may be stored in privately managed collections.
Binding principles
Today’s ruling by the ECJ could have far-reaching consequences for Schufa’s current business practices. The main question is whether the company can continue to collect data on a large scale without the consent of the consumers concerned. If the ECJ agrees with the Advocate General’s opinion, companies will no longer be able to base their contractual decisions solely on a low Schufa score.
But consumers and credit agencies in other EU countries are also looking forward to the decision from Luxembourg. No matter how it turns out, the principles developed are binding for all EU member states.