OLG München - 19 U 1468/25 e
From GDPRhub
| OLG München - 19 U 1468/25 e | |
|---|---|
 | |
| Court: | OLG München (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 15(1)(h) GDPR Article 22 GDPR Article 82 GDPR |
| Decided: | 23.10.2025 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 19 U 1468/25 e |
| European Case Law Identifier: | |
| Appeal from: | LG München (Germany) 11 O 4205/23 |
| Appeal to: | Not appealed |
| Original Language(s): | German |
| Original Source: | openjur (in German) |
| Initial Contributor: | lde |
A court intends to find that a credit information agency’s credit scoring does not amount to automated decision-making in case no third parties draw strongly on the agency’s assessment when making a contractual decision concerning the data subject.
English Summary
Facts
The data subject filed a lawsuit with the Munich Regional Court against the controller, a credit information agency. The data subject claimed to have suffered damages due to automated decision-making carried out by the controller, more specifically receiving rejections due to his credit score when renting an apartment and applying for car financing.
The Court dismissed the case on the grounds that no violation of Article 22 GDPR was found, and did not award damages because a GDPR breach is a pre-requisite for awarding damages under Article 82.
The data subject then filed for an appeal with the Munich Higher Regional Court, asking, among other things, for a declaration of illegality of credit scoring based on automated processing, compensation for immaterial damages, and specific information on score calculation under Article 15(1)(h).
Holding
The court noticed the parties that it intends to dismiss the data subject’s appeal in full.
The court could not produce a declaration of illegality of credit scoring based on automated processing. It reasoned that the mere creation of a score does not constitute a legal decision under Article 22. Also, the rejections faced by the data subject were not exclusively, if at all, based on the credit scoring, but on other factors. Thus, there is no demonstrable link between the scoring and the rejections. For Article 22 to apply, three cumulative conditions have to apply:
a) the presence of a decision
b) the decision must be solely based on automated processing including profiling
c) the decision produces legal effects or similar impact on the data subject
According to the court, the creation of a score cannot amount to a legal effect or similarly impactful effect concerning the data subject. Moreover, the data subject could not sufficiently prove that the data processing resulting in the credit assessment had a meaningful weight on the decisions of third parties. Thus, Article 22 GDPR cannot be applicable.
The data subject, in addition, was not awarded compensation for immaterial damages. Article 82 requires:
a) a GDPR breach
b) a damage
c) a causal link between the breach and the damage
In the present case, the court has ascertained the lack of a breach of Article 22, thus the requirements cannot be fulfilled.
As for the request for specific information on how the score was calculated, the court also found it inadmissible. The extended information obligations under Article 15(1)(h) GDPR only apply in the presence of automated decision-making under Article 22, which the court did not find in the present case.
It must be pointed out that this judgement is not binding yet.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Judgment I. Pursuant to Section 522 Paragraph 2 Sentence 2 of the German Code of Civil Procedure (ZPO), the Senate hereby informs the plaintiff that it intends to dismiss the plaintiff's appeal against the final judgment of the Munich II Regional Court of April 4, 2025, Case No. 11 O 4205/23, pursuant to Section 522 Paragraph 2 Sentence 1 of the ZPO. II. The plaintiff has three weeks from the date of service of this decision to submit a statement on this matter. Reasons I. The plaintiff asserts various claims based on alleged violations of data protection law in connection with so-called "scoring." The plaintiff considers his rights to be infringed by the scoring procedure of the defendant, a joint institution of the lending industry in Germany. The plaintiff is asserting claims for a declaratory judgment that the automated processing of the credit score, i.e., the "basic score values," the "industry score values," and the "reference values," is unlawful (claim I); for an order compelling the defendant not to rely solely on automated processing for the credit score and to disclose the results (claims II and III); for compensation for non-pecuniary damages in the amount of at least €5,000 (claim IV); for disclosure of the specific methods used to calculate the plaintiff's credit score (claim V); for an injunction against the inclusion of certain data categories in the credit score calculation (claim VI); and for reimbursement of extrajudicial legal fees (claim VII). The Regional Court, in its contested judgment (pp. 293 et seq. of the Regional Court's electronic file), based on its factual findings (§ 522 para. 2 sentence 4 of the German Code of Civil Procedure), The grounds for the decision are hereby set forth below, and the action is dismissed. With his appeal of May 7, 2025 (pp. 1 et seq. of the Higher Regional Court's electronic file), substantiated by his brief of May 30, 2025 (pp. 8 et seq. of the Higher Regional Court's electronic file), the plaintiff continues to pursue his claims from the first instance. II. The Senate unanimously holds that the plaintiff's appeal is manifestly without merit, that the case is not of fundamental importance, that neither the development of the law nor the safeguarding of uniform jurisprudence requires a decision by the appellate court, and that holding an oral hearing on the appeal is not warranted. The challenged decision of the Regional Court is correct. Its judgment is not based on an error of law (Sections 513 para. 1, 546 of the German Code of Civil Procedure). Rather, the facts that the Senate must consider within the scope of review defined by Section 529 of the German Code of Civil Procedure (ZPO) do not justify a different decision. The plaintiff's arguments in the appellate proceedings are insufficient to secure the appeal, as they do not undermine the initial judgment, to which reference is made. The Regional Court rightly dismissed the action (see also Higher Regional Court of Munich, preliminary ruling of February 3, 2025, Case No. 24 U 3326/24 [GRUR-RS 2025, 15992]; preliminary ruling of February 25, 2025, Case No. 37 U 3586/24 [GRUR-RS 2025, 15977]). To avoid repetition, the Senate refers to the grounds for the decision in the initial judgment. The plaintiff's grounds of appeal are without merit. In detail: 1. The appeal does not demonstrate any procedural error material to the decision within the meaning of Section 520 Paragraph 3 No. 2 of the German Code of Civil Procedure (ZPO). The plaintiff's argument that the Regional Court insufficiently considered the economic significance of the credit score and the defendant's alleged dominant market position is unfounded. There is a lack of sufficient explanation as to how and from what perspective the plaintiff believes this should have been given greater weight and why this could have led to a different decision by the Regional Court. The plaintiff's assertion that he "cited examples [of rejected contracts] in writing and during negotiations" (grounds of appeal, p. 14) is incorrect. No specific individual cases were presented in writing, and at the oral hearing on August 2, 2024, the plaintiff initially stated during his informal testimony that he had been rejected for an apartment rental in 2021 or 2022 and for car financing due to his negative credit score. However, regarding the apartment rental, the plaintiff stated upon questioning that he could no longer recall whether he had provided his potential landlords with the portion of the Schufa credit report that included his score. With respect to the car financing, the plaintiff also did not claim that the contract was rejected because of the negative credit score. Rather, he stated upon questioning that the bank had merely made the financing contingent on a higher down payment. The reason for this, he explained, was not a specific credit score, but a specific negative entry in his Schufa record. ] ' ' ... 2. The declaratory judgment action seeking a declaration that the defendant's automated processing of the plaintiff's credit score—specifically, the so-called "basic score values," "industry score values," and "reference values"—is unlawful, has no prospect of success. a) The action lacks the required specificity as defined in Section 253 Paragraph 2 No. 2 of the German Code of Civil Procedure (ZPO). It is unclear whether the plaintiff's action seeks a declaration of the unlawfulness of score values generated in the past or whether the unlawfulness is to be established abstractly and independently of any corresponding inquiry from a contractual partner of the defendant. Furthermore, a declaratory judgment action under Section 256 of the ZPO is not possible because a legal relationship capable of being established is lacking. Mere preliminary questions or individual elements of a legal relationship, as well as abstract legal questions, cannot be considered a legal relationship. According to the defendant's undisputed statement, scoring does not occur without cause; rather, a score is generated daily in response to a corresponding request from a contractual partner. These scores can vary depending on the industry of both the requesting party and the contractual partner. Therefore, the question of whether the creation of a credit score is unlawful is, due to the lack of specific details regarding particular processes, an abstract legal question that cannot be determined by a court of law. Insofar as the plaintiff argues that the legally relevant relationship arises from the "legally regulated, undisputed relationship of rights and obligations" between the parties (brief dated June 21, 2024, p. 37), this essentially confirms that the issue concerns general questions regarding statutory obligations and not a specific legal relationship. Furthermore, according to Section 256 of the German Code of Civil Procedure (ZPO) – apart from the special case of a declaratory judgment action – an action can only be brought to establish the existence or non-existence of a present legal relationship, and even then only if the plaintiff demonstrates a legitimate interest in obtaining such a declaration. b) Even if the application were interpreted as seeking a declaration in principle that there are grounds for claims for damages due to scoring carried out in the past, the declaratory judgment action would be inadmissible for lack of a legitimate interest. A declaratory judgment action is only admissible if the event giving rise to the claim is still developing, i.e., if it is established that damage has already occurred, but the plaintiff cannot yet fully quantify the damage because further damage is still to be expected (see Federal Court of Justice (BGH), Decision of March 6, 2012, Case No. VI ZR 167/11, para. 3). However, such a situation does not exist here. The plaintiff has not convincingly asserted that damage is still developing. Any damage that may have already occurred—which the Senate does not consider proven here (see below)—would already be concluded. c) If, on the other hand, his application is to be interpreted as seeking a declaration that future credit reports concerning him are unlawful, then not only is there no legal relationship, but also no current one. A declaration of unlawfulness would not achieve the plaintiff any more than the appeals for an injunction against future scoring or the future disclosure of scores based on automated processing. d) The declaratory judgment action is also unfounded. Reference is made to the Regional Court's accurate reasoning and to the explanations below under points 3 and 4 to avoid repetition. 3. The appeals in points II and III aim to prevent the defendant from determining scores for the plaintiff "exclusively based on automated processing" and from disclosing such scores to the defendant's contractual partners "with each query." These requests are not, in substance, requests for performance but rather for an injunction. As such, they are admissible, but in this general form, unfounded. a) According to Article 22(1) GDPR, a data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. However, whether there has been a violation of this provision must be examined in each individual case. The CJEU ruled in its judgment of... In its judgment of 07.12.2023 (C-634/21, NZA 2024, 45), the Court stated that three conditions must be met cumulatively for this provision to apply: First, there must be a "decision"; second, this decision must be "based solely on automated processing, including profiling"; and third, it must "produce legal effects concerning the data subject or similarly significantly affect him or her". b) On this basis, the plaintiff's claims are unfounded. Article 22(1) GDPR cannot provide a basis for a claim to an injunction against the creation of a score based on automated processing, as the plaintiff demands in point II of his appeal. The mere creation of a score—without the defendant disclosing the result to a user—cannot have any legal or other adverse effect on the plaintiff. It is a purely internal matter without external effect. c) However, the disclosure of automatically generated scores to the defendant's contractual partners is not generally inadmissible, which is the aim of point III of the appeal. aa) While the CJEU has found that the term "decision" is broad enough to include the result of calculating a person's ability to meet future payment obligations in the form of a probability value, this does not apply in this case. The defendant's activities meet the definition of "profiling" in Article 4(4) GDPR, so the aforementioned requirements may be fulfilled. According to the CJEU's ruling, the calculation of the score itself can fall under Article 22(1) GDPR, provided, however, that the decision of the defendant's contractual partner requesting the score is "significantly" dependent on the transmitted score. The significant dependence of a decision by the defendant's contractual partner on a transmitted probability value must be examined specifically for each individual case and is not generally considered to be fulfilled by the CJEU's ruling (see CJEU, loc. cit., paras. 48/50 and Marsch/Kratz, NJW 2024, 392, para. 18). bb) Article 22(1) GDPR does not focus solely on the calculation of the score; rather, it requires a significant dependence in relation to a specific (contractual) decision. The plaintiff cannot demand a general injunction against the defendant prohibiting the creation of credit scores based on automated processing and their disclosure to the defendant's contractual partners upon request, especially since the nature of the transactions differs. While credit information generally has high priority in the context of loan approvals, the situation is different in mail-order retail. It is undisputed that the defendant uses different score values in this respect. d) Even if, according to Article 22(1) GDPR, unlawful data transfers are possible in individual cases, the plaintiff's requests cannot be granted, even partially, because the plaintiff has neither identified specific unlawful processing or transfers in which disclosed score values significantly influenced a (contractual) decision, nor included any exceptions in its request where the transfer of automated score values is permissible. d) 4. The plaintiff has no claim against the defendant for (non-material) damages pursuant to Article 82(1) GDPR (Appeal Point IV). a) According to the case law of the CJEU, a claim under the aforementioned provision requires an infringement of the GDPR, the existence of material or non-material damage, and a causal link between the damage and the infringement, whereby the requirements must be met cumulatively. The burden of proof for the existence of these requirements lies with the person asserting a claim for damages based on Article 82 GDPR (see German Federal Court of Justice (BGH), Judgment of November 18, 2024, Case No. VI ZR 10/24, para. 21). b) As explained above, no infringement of Article 22(1) GDPR by the defendant with respect to the plaintiff can be established. The plaintiff fails to identify, either in the first instance or in the grounds of appeal, any specific rejections by potential contractual partners in which the credit score determined by the defendant was a significant factor. Without a more precise description of the time, place, specific contractual partner, and the content of the contract to be concluded, it cannot be determined whether the scoring alone constitutes a "decision" within the meaning of Article 22(1) GDPR. Furthermore, the plaintiff has failed to present any arguments or evidence regarding a specific contract sought by the plaintiff that was rejected and whose rejection was primarily based on a credit score provided by the defendant, or regarding any other decision that significantly affected the plaintiff and was based on a calculated credit score. 5. The appeal is also unsuccessful with respect to the request under point V for information on the specific method used to calculate the plaintiff's credit scores. a) The disclosure of the logic involved pursuant to Article 15(1)(h) GDPR does not require details of the defendant's specific algorithm, nor of individual data fields and their precise weighting in calculating the score (see also the Advocate General's Opinion of 16 March 2023 in Case C-634/21, BeckRS 2023, 4643, paragraph 56). b) Furthermore, the extended disclosure obligations under Article 15(1)(h) GDPR, according to the wording of that provision, only apply if a case of automated decision-making within the meaning of Article 22(1) and (4) GDPR has actually taken place. However, as explained above, the plaintiff has not sufficiently demonstrated this. 6. The appeal in point VI (an injunction against including certain characteristics in the calculation of the plaintiff's scores) is also unfounded. Even a single initial violation indicating a risk of repetition has not been sufficiently demonstrated. The Senate refers to the corresponding statements of the Regional Court in its initial judgment. 7. The plaintiff's claims based on management of affairs without mandate pursuant to Sections 677 et seq. of the German Civil Code (BGB) are not apparent. 8. To the extent that the grounds of appeal state that the implementation of a "score block" constitutes immoral conduct on the part of the defendant, this is not readily apparent to the Senate. In any case, this is not a suitable basis for the grounds of appeal. The plaintiff did not, at least not in the appeal proceedings, file a motion to lift the score block and resume scoring. Such a motion would also be contradictory, given his assertion that the defendant's scoring procedure is unlawful. 9. Since the action is unsuccessful on the merits, there is also no entitlement to reimbursement of pre-litigation legal fees (Appeal Motion No. VII). III. The case is not of fundamental importance (Section 522 Paragraph 2 Sentence 1 No. 2, Section 543 Paragraph 2 Sentence 1 No. 1 of the German Code of Civil Procedure). Neither the development of the law nor the safeguarding of uniform jurisprudence requires a decision by the Senate as the court of appeal or the granting of leave to appeal on points of law (Section 522 Paragraph 2 Sentence 1 No. 3, Section 543 Paragraph 2 Sentence 1 No. 2 of the German Code of Civil Procedure). As explained above, the guidelines developed by the highest courts are based on these considerations. Therefore, an oral hearing is not required (Section 522 Paragraph 2 Sentence 1 No. 4 of the German Code of Civil Procedure), as no special reasons have been presented or are otherwise apparent that would necessitate an oral hearing to ensure procedural fairness. IV. Given these circumstances, it is recommended, for cost reasons alone, that the appeal be withdrawn, which would reduce the fees for the "proceedings in general" from 4.0 (No. 1220 of the Court Fees Act) to 2.0 (No. 1222 of the Court Fees Act). You have the opportunity to comment on these points within three weeks of service of this decision. According to the statutory provisions, the Senate is to dismiss the appeal by decision without delay if no changes occur. Therefore, a one-time extension of this deadline by a maximum of three further weeks can only be expected if specific, compelling reasons are demonstrated (see Higher Regional Court of Rostock, decision of May 27, 2003, Case No. 6 U 43/03, juris para. 7 et seq.). Furthermore, an extension of the deadline by a total of more than one month is only possible with the consent of the opposing party, pursuant to Section 520 Paragraph 2 Sentence 3 of the Code of Civil Procedure.
