VG Wiesbaden - 6 K 788/20.WI
From GDPRhub
| VG Wiesbaden - 6 K 788/20.WI | |
|---|---|
 | |
| Court: | VG Wiesbaden (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 15(1)(h) GDPR Article 22 GDPR |
| Decided: | 19.11.2025 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 6 K 788/20.WI |
| European Case Law Identifier: | ECLI:DE:VGWIESB:2025:1119.6K788.20.WI.00 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | German |
| Original Source: | Burgerservice Hessenrecht (in German) |
| Initial Contributor: | lde |
The court held that credit rating constitutes automated decision-making within the meaning of the GDPR. As a result, the credit information agency must provide the data subject with meaningful and understandable information about the logic involved in the scoring process and the consequences of the decision.
English Summary
Facts
The data subject requested information from a credit rating agency acting as controller regarding the calculation of his credit score. The score was used by third parties, such as lenders, to assess the data subject’s creditworthiness and had a significant impact on his ability to conclude contracts.
Relying on Article 15 GDPR, the data subject sought access not only to his personal data but also to information on how the score was generated. The controller provided general information but refused to disclose details about the functioning of the scoring system, arguing that the algorithm and weighting factors constituted trade secrets and that the score itself did not amount to automated decision-making.
The data subject lodged a complaint with the DPA, which was later rejected. The data subject brought an appeal before the Administrative Court, arguing that the credit score resulted from automated processing and had legal or similarly significant effects, thereby entitling him to the additional information required under Article 15(1)(h) GDPR.
Holding
The court upheld the data subject’s claim.
After hearing the parties, the court stayed the proceedings and referred the case to the CJEU (C-634/21 and C-203/22). The questions posed regarded the interpretation of Article 22, and whether credit scoring can amount to automated decision-making. The court then relied heavily on the CJEU's reasoning in assessing the case at hand.
It held that credit scoring qualifies as automated decision-making within the meaning of the GDPR, as the score is generated exclusively by automated means and is intended to be used as a decisive factor in contractual decisions affecting the data subject. The fact that third parties ultimately rely on the score does not negate the automated nature or significance of the processing.
Accordingly, the Court found that Article 15(1)(h) GDPR applies. The controller is therefore required to provide the data subject with meaningful and understandable information about the logic involved in the scoring process, as well as information about the significance and envisaged consequences of the processing for the data subject.
The Court clarified that this obligation does not require disclosure of the source code or full algorithm. However, the information provided must go beyond abstract descriptions and must enable the data subject to understand, in concrete terms, how relevant factors influence the score and how the score affects decision-making.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Right to Information from a Credit Reporting Agency in Cases of Automated Data Processing
Principle
1. Automated processing in an individual case within the meaning of Article 22(1) GDPR exists if a credit reporting agency automatically generates a probability score based on personal data relating to a person regarding their ability to meet future payment obligations, provided that this probability score is a decisive factor in whether a third party, to whom this probability score is transmitted, enters into, performs, or terminates a contractual relationship with that person.
2. The right to obtain "meaningful information about the logic involved" within the meaning of Article 15(1)(h) GDPR requires that, based on the relevant information, the procedures and principles specifically applied in the automated processing of personal data to obtain a specific result—for example, a credit profile—be explained in a precise, transparent, and easily accessible form. A case-specific justification is required.
Judgment
The defendant is ordered, with the annulment of the decision of June 3, 2020, to take supervisory measures, in accordance with the court's legal opinion, to fulfill the plaintiff's right to information under Article 15(1)(h) GDPR against the intervener. The remainder of the action is dismissed.
The court costs of the proceedings and the plaintiff's extrajudicial costs shall be borne equally by the defendant and the intervener. The defendant and the intervener shall each bear their own extrajudicial costs.
This judgment is provisionally enforceable with respect to costs. The respective party liable for costs may avert enforcement by providing security in the amount of 110% of the amount enforceable under this judgment, unless the plaintiff provides security in the amount of 110% of the amount to be enforced before enforcement is carried out.
Leave to appeal to the Federal Court of Justice is granted.
Leave to appeal directly to the Federal Court of Justice is granted.
The defendant and the intervener shall bear their own extrajudicial costs. Facts of the Case
The plaintiff seeks supervisory intervention by the defendant to compel the intervenor to provide information.
The intervenor is a private German credit reporting agency that provides its contractual partners with information on the creditworthiness of third parties, particularly consumers. For this purpose, the intervenor's contractual partners transmit relevant data from their business relationships with customers. In addition, the intervenor also receives data from public registers such as the debtors' register and the insolvency register, or from private individuals themselves. The intervenor stores the transmitted data in order to provide its contractual partners with information. Before concluding a credit-relevant transaction, the intervenor's contractual partners can use the information and other information available to them to assess the risks associated with the contemplated transaction. The intervenor generates a so-called score for this purpose. The score is intended to inform the intervenor's contractual partner about the risk of payment default by the individual in question if the planned credit-relevant transaction is concluded. To determine the score, the intervener uses mathematical-statistical methods to predict the probability of future behavior, such as loan repayment, based on certain characteristics of an individual. The intervener does not disclose either the specific characteristics used or the mathematical-statistical method employed. The creation of scores is based on the assumption that by assigning an individual to a group of other individuals with certain comparable characteristics who have behaved in a particular way, similar behavior can be predicted. If the individual exhibits a specific profile, the intervener assigns them the calculated score. According to the intervener, in addition to a general score, it also creates individual scoring models for specific contractual partners, which are intended to take into account the specific requirements of these companies and their individual risk policies. The intervener is the largest German credit reporting agency, which, according to its own statements (as of December 20, 2023), issues an average of 320,000 credit reports per day (https://www.schufa.de/newsroom/schufa/schufa-eintrag-loeschen-geht/#:~:text=Die%20SCHUFA%20erteilt%20im%20Schnitt,die%20bei%20uns%20gespeicherten%20Daten, last accessed November 19, 2025).
In July 2018, the plaintiff intended to take out a loan of €5,000.00 from G. EasyCredit (hereinafter: TeamBank). In this context, TeamBank obtained a credit report on the plaintiff from the intervener. In July 2018, the intervener transmitted a credit score of 85.96% to TeamBank regarding the plaintiff. The plaintiff states that she subsequently received information from TeamBank that she had been assigned a score of 85.96% by the intervener, even though no so-called "hard negative indicators" existed on her record. TeamBank subsequently refused to grant her a loan.
The plaintiff then requested information from the intervener regarding which elements influenced the score calculation, which criteria formed the basis of the score evaluation, and how the score was specifically calculated.
The intervener initially informed the plaintiff by letter dated July 10, 2018, of the following:
"Pursuant to Article 15 of the General Data Protection Regulation (GDPR), you [will receive] a copy of the personal data stored about you at SCHUFA as of July 10, 2018.
SCHUFA record number: AAC9CV6CAS
Last name: A.
First name: Emmi
Date of birth: February 17, 1957
Place of birth: City A
Current address: Birkenstr. 39, City A, registered by Commerzbank AG, City A branch, on February 15, 2007
You were first informed about the SCHUFA procedure on March 11, 2010, in accordance with the provisions of the Federal Data Protection Act (BDSG), which was in effect until May 24, 2018.
You were informed on May 26, 2018." For the first time, information regarding the SCHUFA procedure was provided in accordance with the provisions of the General Data Protection Regulation (GDPR), which has been in effect since May 25, 2018 [...].
SCHUFA uses data from CS Connect GmbH & Co. KG, which stores information about companies and their business partners (e.g., shareholders, owners, managing directors), as part of the business information it provides about companies. If you would like to receive information about what data concerning you is stored at CS Connect GmbH & Co. KG, please submit a corresponding request there [...]. (pp. 453 ff. of the paper court file [GA]).
The letter included as an attachment a two-page list of the information provided by the interveners' contractual partners with regard to the plaintiff, as well as the inquiries made by the interveners' contractual partners with regard to the plaintiff. Reference is made to the contents of the attachment (pp. 455 f. of the paper court file).
The letter was accompanied by a two-page list of the information provided by the interveners' contractual partners with regard to the plaintiff, as well as the inquiries made by the interveners' contractual partners with regard to the plaintiff. A further document was attached, containing the following information:
"On July 2, 2018, your basic score was 97.35% of a theoretically possible 100%. The basic score provides you with an industry-independent assessment of your creditworthiness. It is presented as a percentage value indicating the probability of repayment. The calculation is performed quarterly based on the data stored about you at SCHUFA." (p. 7 of the administrative file [VV]; pp. 9 and 458 of the paper court file).
Furthermore, the letter included a table summarizing the probability values transmitted to the plaintiff over the past twelve months. The table contains six entries sorted by date for the years 2017 and 2018, along with further information in the corresponding columns: "Transmitted to," "Description," "Score Value," "Rating Level," "Probability of Fulfillment," "Previous Payment Defaults," "Credit Activity Last Year," "Credit Usage," "Length of Credit History," "General Data," "Address Data," and "Overall Significance." The last entry, dated July 10, 2018, concerned the transmission of an "individual SCHUFA Scorecard Teambank III" to "G. easy credit," for which a "Probability of Fulfillment" value of 85.96% was entered, and the "Overall Significance" field classified it as "significantly elevated to high risk." Further details are provided on pages 10 and 457 of the paper file.
Finally, an information sheet entitled "SCHUFA Information" was enclosed with the letter.
The information sheet "SCHUFA Information" states the following regarding profiling (scoring) under point 4:
"Before entering into transactions with a financial risk of default, business partners want to be able to assess as accurately as possible whether the agreed payment obligations can be met. Through the SCHUFA credit report and profiling using so-called score values, SCHUFA supports lending companies in their decision-making and helps to process everyday credit transactions quickly. Scoring uses collected information and past experience to create a forecast of future events. At SCHUFA, the calculation of all probability values is based on the information stored about a data subject at SCHUFA, which is also disclosed in the information provided pursuant to Article 15 of the GDPR. Furthermore, SCHUFA takes the provisions of Section 31 of the German Federal Data Protection Act (BDSG) into account when calculating scores."Based on the entries stored for an individual, they are assigned to statistical groups of people who have had similar entries in the past. The score calculations are performed using mathematically and statistically recognized and proven methods. The following types of data are used by SCHUFA for score calculation, although not every data type is included in every single score calculation: general data (e.g., date of birth, gender, or number of addresses used in business transactions), previous payment defaults, credit activity last year, credit usage, length of credit history, and address data (only if little personal credit-relevant information is available). Certain information is neither stored nor considered in the calculation of score values, e.g., information on nationality or particularly sensitive data according to Article 9 GDPR (e.g., ethnic origin or information on political or religious beliefs). Exercising rights under the GDPR, such as access to information stored at SCHUFA according to Article 15 GDPR, also has no influence on the score values. The likelihood of a person repaying a mortgage loan is not necessarily the same as the likelihood of paying a mail-order bill on time. For this reason, SCHUFA offers its partners various industry-specific scoring models, known as SCHUFA industry scores. These generally represent the probability of a payment default within 15 months. The timeframe may vary for individual sectors to better reflect the specific characteristics of their business models (e.g., telecommunications, mortgage lending). Scores are constantly changing because the information SCHUFA holds about a person also changes. New information is added, while other information is deleted due to retention periods. Furthermore, the information itself changes over time (such as the duration of a business relationship), so changes can occur even without new information. It's important to understand that SCHUFA itself does not make decisions; it merely supports its affiliated partners with its information to aid in their decision-making. The risk assessment and evaluation of creditworthiness are carried out solely by the direct business partner, as only they possess numerous additional pieces of information – such as those contained in a loan application. This applies even if they rely solely on the information and scores provided by SCHUFA. Further information on credit scoring or the identification of conspicuous circumstances is available at www.scoring-wissen.de." (pp. 459 f. of the paper court file).
At the URL "www.scoring-wissen.de", to which the "SCHUFA information" refers, the intervener provides further information on the data basis and functionality of the scoring. In addition to textual explanations and a score simulator, several explanatory videos and a video chatbot can be found there.
In a further letter dated August 8, 2018, the intervener informed the plaintiff, among other things, of the following:
"The basis for calculating the SCHUFA scores is the data stored in the SCHUFA database concerning your client." This data will be shown to you in the copy of your personal data (Art. 15 GDPR). This access allows you to identify any discrepancies in the calculation basis and to initiate any necessary corrections and updates to the data. SCHUFA industry scores are derived from the statistical evaluation of identical or similar datasets. For this purpose, we use millions of anonymized loan agreements. We analyze the resulting data and calculate probabilities. The result is a prediction of how the risk of payment defaults should be assessed for different types of transactions. For example, it can be determined that payment defaults occur more frequently with a specific combination of characteristics than with others.
Regarding the score you mentioned for G. easyCredit, we would like to inform you that SCHUFA partners use individual scorecards and rules, resulting in scores that differ from the standard scorecards.
Our score calculations are probability values calculated using mathematical-statistical methods. These values predict the likelihood that the individual in question will meet their payment obligations.
Unfortunately, we cannot disclose which data or specific pieces of information are included in this calculation and their weighting, as this would reveal our experience and knowledge to our competitors.
These values predict the likelihood that the individual in question will meet their payment obligations.
... We are not obligated to disclose our calculation methods because they fall under trade and business secrets (see Federal Court of Justice, judgment of January 28, 2014 (Case No. VI ZR 156/13) [...]).
Furthermore, the SCHUFA score is not used to reject loan applications. On the contrary, it is intended to facilitate a positive decision for the lender. Rejecting a loan application involves more than just our score, as the lender considers many other criteria when reviewing such an application, such as the applicant's income and assets.
We provide our partners with objective information and carefully calculated forecasts. In doing so, we merely support the decisions of the respective companies. However, contractual decisions are made solely by our partners.
We do not make any recommendations as to whether or not a contract should be concluded.
How the lender evaluates the information we provide is beyond our control. We cannot influence the lending process itself or the lenders' internal operating procedures. "influence." (pp. 8-9 of the case file).
In a letter dated August 21, 2018, from her legal representative to the intervener, the plaintiff complained that the intervener's letter of August 8, 2018, lacked specific information regarding the disputed score of 85.96% from July 10, 2018. The communicated probability values contained no concrete details whatsoever regarding the calculation of the score. Reference was made only to risks, which were further characterized by the words "(significantly) above average, average, below average." Why these assessments were made in this way was not explained in any detail. Since the formation of the comparison group was also not explained in any detail, it was completely unclear whether the plaintiff's assessment was not entirely arbitrary. The information provided on July 10, 2018, indicated that the categories "credit activity last year" and "length of credit history" were applied to the plaintiff's detriment. The plaintiff argues that the scoring was negative without the intervener having explained what these categories actually meant and why they resulted in such negative scores. The intervener cannot claim a trade secret, as the plaintiff is not concerned with the specific weighting of individual categories used in the intervener's scoring process. Rather, the sole concern is why some of these categories were rated so negatively. There are no comprehensible reasons for this (pp. 10 et seq. of the file).
In a letter dated August 23, 2018, the intervener informed the plaintiff that the elements influencing the score calculation were fully contained in the copy of personal data provided to the plaintiff (pursuant to Article 15 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC). [GDPR]) dated July 10, 2018. The scores are derived from a statistical analysis of identical or similar datasets. They are calculated using modern mathematical-statistical methods. Information from millions of anonymized loan agreements is incorporated into the probability calculation when determining the scores, with the information stored by the intervener for each individual serving as the basis for the calculation. The risk assessment for the data types contained in the annex to the copy of personal data (pursuant to Article 15 GDPR) is intended merely to illustrate whether, in the present situation and when comparing identical and similar scenarios, the risks are average or deviating from the average. The intervener is not obligated to disclose its calculation methods because these fall under trade and business secrets (pp. 12 et seq. of the file).
By letter from her legal representative dated October 18, 2018, the plaintiff filed a complaint with the The defendant, in which she asserted the following: The plaintiff seeks information from the intervener regarding the scoring values used for her rating, as well as the deletion of incorrect entries. There are no facts whatsoever that could justify a rating with a score of 85.96%. The plaintiff has no debts and enjoys good credit. The intervener's procedures, in particular the apparent use of purely automated processes to generate ratings, violate Article 22 GDPR. Therefore, the plaintiff is entitled, firstly, to have all data stored about her by the intervener deleted, including all scoring values, and not to have this data transmitted. Furthermore, she has rights to information and access regarding the logic of the automated processing pursuant to Articles 13(2)(f), 14(2)(g), and 15(1)(h) GDPR. The intervener has so far only provided the plaintiff with copies of the personal data. The data controller is obligated to provide information on the "how" of the processing, i.e., the logic involved, as well as the scope and impact of the processing. All information must be provided in a precise, transparent, intelligible, and easily accessible form, using clear and simple language, and free of charge. The data controller has thus far unlawfully refused to do so. The massive impact on the lives of those affected all the more justifies the data controller providing detailed information, in particular regarding which data or individual pieces of information are included in these calculations and their respective weightings. The data controller cannot invoke trade secrets worthy of protection; these are superseded by the protection of the data controller's personal rights. Moreover, Article 22 of the GDPR specifically addresses the scoring methods used by the data controller. The defendant is requested to order the data controller to comply with the data controller's requests for access and erasure (pp. 1 et seq. of the case file).
By letter dated November 22, 2018, the defendant confirmed receipt of the plaintiff's complaint (p. 15 of the case file).
By "order" dated June 3, 2020, the defendant informed the plaintiff that the use of creditworthiness or score values for the purpose of deciding on the establishment, execution, or termination of a contractual relationship is generally permissible. This follows from Article 6(1)(b) and (f) of the GDPR and from Section 31 of the German Federal Data Protection Act (BDSG). The intervener generally fulfills the requirements for calculating the creditworthiness value according to Section 31 BDSG. In the present case, there is no indication that these requirements are not met. When determining creditworthiness, it is permissible to derive probabilities for the behavior of other persons who also belong to this group from the behavior of a subset of a group, provided that statistical significance exists. Credit agencies such as the intervener calculate these values independently. The supervisory authorities have only limited influence over this type of calculation or the method used. They can only verify whether the calculation of the credit rating or score complies with legal requirements and whether the values actually have any significance. However, the legislator assumes that a credit rating calculated in accordance with legal provisions has at least some statistical significance. Credit ratings or scores do not precisely assess the creditworthiness of individual data subjects. Rather, they merely assess the creditworthiness of a group of people with the same or similar characteristics and, based on this, include a probability that an individual data subject poses a largely similar risk. Individual variations are not taken into account. Therefore, it is also not permissible to make important decisions automatically based on the calculation of credit ratings. Any contractual partners of the plaintiff should therefore be able to consider individual variations. The credit rating is calculated by the intervener based on the data stored by the intervener about the data subject. Information on this data can be obtained from the intervener as well as from other credit agencies on the basis of Article 15 GDPR. Changes to the stored data generally affect the credit score. However, the correction or deletion of data does not always have a positive effect on the credit rating calculation. According to the defendant, the intervener answers questions regarding the calculation of the score values sufficiently and in accordance with the legal regulations. In particular, it specifies which types of data were used to calculate the respective score value and which risks are contained in the individual data types according to the intervener's scoring model. The intervener is not required to disclose further information on the score in order to protect its trade secrets. Pursuant to Article 15(1)(h) GDPR, the intervener is only required to provide meaningful information about the logic involved. The details of the score calculation, however, do not need to be disclosed. The intervener's scoring model does not involve a simple formula that could be disclosed. Instead, the failure rates of a comparison group are considered for each characteristic and then cumulated to determine an overall probability of failure. The scoring procedure of the intervener therefore operates without subjective elements, solely based on actual failures. The defendant is not currently challenging the intervener's scoring model. Consequently, the intervener's procedure in this case is not objectionable from a data protection perspective, and there is no reason for supervisory action against the intervener. Reference is made to the further content of the decision (pp. 18 et seq. of the administrative file).
By letter from her legal representative dated July 7, 2020, received by the Wiesbaden Administrative Court on the same day, the plaintiff filed a lawsuit.
The plaintiff argues that she has a right against the defendant to further consideration and review of her complaint pursuant to Article 78(2) in conjunction with Article 57 GDPR, as well as a right to supervisory intervention against the intervener pursuant to Article 58 GDPR.
She maintains that she has a right to information from the intervener pursuant to Articles 15(1)(h) and 22(1) GDPR, which has not been fulfilled. The intervener must disclose to the plaintiff in detail which data is used to determine the specific credit score for the plaintiff. The intervener must provide information on whether it possesses "hard negative characteristics" or "soft negative characteristics" concerning the individual affected by the assessment and disclosure.
The plaintiff had previously requested this information from TeamBank. She was informed that there were no "hard negative indicators" on her record and that the rejection of her loan application was based solely on the "negative credit score" determined by the interveners. If this score is negative, a loan application is automatically rejected. This practice, common for years, continues unchanged by TeamBank and the vast majority of other credit institutions.
The interveners, or rather the "system" they control, make the loan decision, as TeamBank has no independent knowledge of the matter. The fact that the interveners' market power extends even further is demonstrated, for example, by the plaintiff's request for terms and conditions for a €10,000 loan via the "check24" portal on June 23, 2024. Inquiries were made to 22 credit institutions. Targobank submitted three offers. The other credit institutions did not provide any offers. The request was apparently not forwarded to the next step because a positive signal from the intervenor was required. This demonstrates that without information from the intervenor and/or a positive credit score report, no loan application can be processed, let alone a loan granted. A connection to the CreditPlus branch in Dortmund was established via "check24." The data was communicated to the processing officer, Mr. Gützel, by telephone. The data could be entered up to the point of the Schufa credit check; further processing was not possible after that. Also facilitated by "check24," personal contact was made with a loan officer at Targobank. Again, the application could only be processed up to the point of the Schufa credit check. The processing officer received the following information from the "SCHUFA Private Customer Service Center" – Mr. Grewe – via email on June 27, 2024: "[I]f electronic Schufa, as you know, no credit decision is possible."
Therefore, an automated decision was made on a case-by-case basis. The intervener obtains the scoring results in an opaque and unlawful manner. For example, the intervener uses 250 different comparison criteria in its software to determine the score, criteria which are never disclosed to the individuals concerned. Since the score itself is legally considered personal data, the intervener has been processing data unlawfully for years, now in deliberate violation of the GDPR, and has thus caused the plaintiff considerable damage. The fact that a bank loan officer makes the decision does not negate the fact that it is not an automated decision. The "loan officer" at TeamBank is not a human being, but rather software—namely, the "fully automated loan decision system" of ACTICO GmbH, a client of TeamBank. The "Schufa credit rating" is implemented via an interface. The implemented scoring model originates from the intervener and is therefore decisive for the loan decision. Since interfaces would have to be created to implement the "Schufa score," TeamBank could only use this software with the knowledge and cooperation of the interveners (at least as a data processor within the meaning of the GDPR). Due to the lack of any possibility of human intervention, the "decision"—regardless of who makes it—is determined 100% automatically and is not GDPR-compliant. Because the plaintiff's income and assets were not requested before the loan decision, they could not have been verified. Only the interveners' "credit report" was available. Therefore, this constitutes a (prohibited) automated decision.
The interveners' assertion that their contractual partners are not permitted to refuse to enter into a contract solely based on a transmitted credit score does not alter this. The plaintiff disputes this assertion.
In the plaintiff's case, there were no "negative characteristics" or factors that could have led to a downgrade, neither in a "bank score" nor in an "individual score."
The intervener cannot invoke trade secrets in the context of the right of access under Article 15(1) GDPR. Furthermore, according to the case law of the Court of Justice of the European Union (CJEU), information that may have been trade secrets at a particular point in time is generally considered outdated and therefore no longer confidential due to the passage of time if it is at least five years old (CJEU, 19 June 2018 – C-15/16 –).
The intervener processes data without legal basis. Section 31 of the German Federal Data Protection Act (BDSG) is not applicable, as this provision predetermines the outcome of a balancing of interests and therefore violates EU law (CJEU C-634/21 and C-203/22). The requirements of Article 6(1)(f) GDPR are not met and the defendant has obviously not examined these requirements.
The plaintiff ultimately requests that
the final notification of June 3, 2020, served on June 8, 2020, be set aside and that the defendant be ordered to take remedial action against the intervener pursuant to Article 58(2)(c) and (d) GDPR,
in the alternative,
that the defendant's final notification of June 3, 2020, be set aside and that the defendant be ordered to substantively assess the intervener's objectionable information of July 10, 2018, with regard to completeness and transparency, to apply supervisory measures to remedy any deficiencies identified in the information, and, if necessary, to provide a substantive justification for the audit findings that contradict the plaintiff's objections,
further alternatively,
that the final notification be set aside and that the defendant be ordered to apply supervisory measures to address the deficiencies in the intervener's objectionable information of July 10, 2018.
The defendant requests that
the action be dismissed.
The defendant argues that there is no basis for the plaintiff's claim to further review of the matter and the plaintiff's complaint, nor for the defendant to take supervisory action. The defendant essentially reiterates the arguments from the contested decision and further submits the following: The intervenor's disclosure practices are unobjectionable. The intervenor is not obligated to disclose further information on the scoring. It is sufficient, pursuant to Article 15(1)(h) GDPR, to provide the plaintiff with meaningful information about the logic involved. The plaintiff has received all the necessary information, and further details are freely available at https://www.schufa.de/daten-scoring/scoring. This transparency satisfies the requirements of Article 15(1)(h) GDPR.
The defendant does not review the scores substantively. The defendant is examining the permissibility and accuracy of processing the data included in the credit scores. The defendant obtained an expert opinion from the intervenor on this matter. This opinion, along with investigations conducted by the defendant, confirmed compliance with the requirements of Section 31 Paragraph 1 of the German Federal Data Protection Act (BDSG). However, the defendant cannot submit the expert opinion for legal reasons, as it contains the intervenor's explicit reference to its trade secrets. Furthermore, the expert opinion does not pertain to these administrative proceedings but serves general supervisory purposes.
The intervenor specifically developed a model based on TeamBank's portfolio, as the "easyCredit" loan product is regularly used by individuals with a higher default risk. The credit decision is based on a series of rules and criteria that must be met.
``` Regarding the question of whether an automated decision exists, the defendant argues that if a score does not lead to the termination of the review and merely represents one of several factors in the recipient's decision-making process—meaning it can be relativized or overridden by other criteria—then it is not considered authoritative. A legal or contractual obligation on the part of the recipient to conduct their own independent review could be an indication of such a situation. In particular, Sections 505a and 505b of the German Civil Code (BGB) and Section 18a of the German Banking Act (KWG) stipulate the obligation of banks to conduct a creditworthiness assessment for consumer loan agreements. After completion of this assessment, no significant doubts should remain regarding the borrower's creditworthiness. To assess creditworthiness, credit institutions may also use external information, such as reports from third parties like credit bureaus. They are obligated to adequately verify this information. This suggests that banks do not base their lending decisions solely on a credit score from a credit bureau. However, the decisive factor is always the actual, individual implementation of this obligation. If the score is included in the assessment within an algorithm with a fixed weight, this would tend to indicate its relevance. In the case of TeamBank, the score of the party joined to the proceedings is not incorporated into the credit assessment with a fixed weight within an algorithm. Rather, there is some leeway in the weighting, so its relevance cannot be assumed. For the creditworthiness assessment of consumer loan agreements, the respective credit institution is subject to the requirements of Sections 505a and 505b of the German Civil Code (BGB) and Section 18a of the German Banking Act (KWG). This means that for the final decision on granting credit, the respective credit institution may not rely solely on the statements of a third party (such as the party joined to the proceedings), but must itself create a comprehensive information base. The bank conducts its own assessment according to internal rules, using some of its own data, which ultimately leads to the granting or denial of loans. According to TeamBank's decision-making rules, the intervener does not, in fact, make the final decision for TeamBank, as the probability score represents only one partial criterion at various stages of the credit decision process. According to the bank's internal rules, there is no binding decision-making obligation, but rather a clear degree of discretion.
Only in the future will the as-yet-unenacted amendment to Section 37a Paragraph 4 of the German Federal Data Protection Act (BDSG) stipulate that score providers, upon request of the data subject, must disclose, for example, the personal data of the data subject used for the calculation, the criteria, the weighting of the categories of criteria, the weighting of the individual criteria that most strongly influence the probability score, and the significance of the specific probability score.
The defendant was unable to find any evidence that the decision-making process at TeamBank was structured in such a way as to indicate—as the plaintiff claims—that the credit decision at TeamBank was not made by a human being, since TeamBank uses the fully automated credit decision system of ACTICO GmbH. Credit decisions at TeamBank are by no means fully automated; rather, in addition to the rule checks supported by ACTICO GmbH, there are further process steps in which human intervention, action, or override is required. In this regard, the defendant submits his communication with TeamBank dated October 15, 2025. Reference is made to this (pp. 401 et seq. of the electronic court file).
The intervener requests that
the action be dismissed.
The intervener submits that it created a data copy for the plaintiff on July 10, 2018, pursuant to Article 15 of the GDPR. Data copies from the intervener always contain the so-called SCHUFA information at the end of the document. The scoring procedure is explained there under point 4. Information is also available on the website of the intervener (www.scoring-wissen.de; now https://www.schufa.de/faq/privatpersonen/scoring/). The plaintiff can therefore obtain information about the intervener's credit score at any time.
The score was calculated using a scoring method specifically developed for TeamBank, the "Individual SCHUFA Scorecard TeamBank III." This scorecard is also based on TeamBank's specific risk experience with the granting of unsecured "easyCredit" loans. It therefore indicates a higher risk than other scorecards. This is due to the nature of TeamBank's "easyCredit" loan product. "easyCredit" is regularly used by individuals with lower creditworthiness, resulting in a higher default risk for TeamBank. The score provided by the intervener reflects the average risk of future payment defaults when granting such an unsecured loan.
The intervener argues that the plaintiff is not entitled to the asserted right of access under Article 15(1)(h) GDPR against the intervener, a right which the intervener seeks to enforce through supervisory measures against the defendant.
According to the intervener, only the controller (in the plaintiff's logic, TeamBank) is obligated to provide access under Article 15(1) GDPR, not the processor.
Article 15(1)(h) GDPR is not applicable. The right of access under Article 15(1)(h) GDPR requires the existence of automated decision-making as defined in Article 22 GDPR. However, no automated decision-making exists in the present case. The intervener disputes the plaintiff's claim that credit was denied because of the score in question. It has not been proven that the negative credit decision was "significantly" dependent on the disputed credit score of the intervener and that the conditions established by the CJEU for an automated individual decision were met.
TeamBank decided on the loan terms request based on the information submitted by the plaintiff in the loan application and the information provided by the intervener. The intervener's information did not consist solely of the credit score. It also confirmed the plaintiff's address to TeamBank AG and informed them of the existence of credit-relevant contracts (in particular, a current account and several paid-off mortgages). The requirement that the credit score determined for TeamBank was used decisively for the decision regarding the contractual relationship is therefore not met. It has also not been argued that TeamBank made the decision automatically. Article 22(1) GDPR is not applicable to the disputed credit score. Due to the lack of automated individual case decision-making, Article 15(1)(h) GDPR is therefore not applicable.
The rejection of the loan alone does not constitute a "significant impairment" within the meaning of Article 22(1) GDPR. Rather, the decisive factor is what negative consequences the plaintiff suffered as a result of the lost temporary access to the loan amount and whether this "significantly impaired" her within the meaning of Article 22(1) GDPR. No evidence has been presented to this effect.
Credit institutions, including TeamBank, must, in fulfillment of their legal obligations (including those under Section 25a of the German Banking Act [KWG], the requirements of the Minimum Requirements for Risk Management [MaRisk], and the provisions of the Consumer Credit Directive or Sections 419 et seq. of the German Civil Code [BGB]), generally make decisions regarding the granting of consumer loans themselves. Credit institutions cannot outsource this responsibility to third parties. The intervener merely assists credit institutions in fulfilling their obligations to responsibly assess creditworthiness pursuant to Article 8(1) in conjunction with Recital 26 of Directive 2008/48/EC of the European Parliament and of the Council of 23 April 2008 on consumer credit agreements and repealing Directive 87/102/EEC (Consumer Credit Directive). Furthermore, the intervener's contractual partners are contractually obligated not to base their decisions regarding the conclusion of credit-related contracts primarily on the credit scores transmitted by the intervener. In particular, the intervener's contractual partners are not permitted to refuse to conclude a contract solely on the basis of a transmitted credit score. The intervener is generally entitled to rely on its contractual partners acting lawfully.
It is more likely that circumstances relating to the plaintiff than the credit score in dispute were decisive for TeamBank's rejection. The plaintiff's potential contractual partners typically decide on an inquiry based on the information provided by the plaintiff, the information from the intervener, and, where applicable, other information. Information from the intervener generally includes not only a credit score but also other credit-relevant information known to it, such as the presence or absence of payment defaults or the existence of existing credit-related contracts.
TeamBank conducts its own credit checks and is obligated to do so. It would be unrealistic and incompatible with the applicable legal requirements for granting consumer loans if TeamBank were to grant loans without, for example, inquiring about the income and assets of the person concerned. However, the intervener does not store any such information and therefore does not disclose it.
There is no established principle that the credit scores provided by the intervener are always decisive in the decision to enter into a contract. Information regarding income and assets is generally by far the most relevant information when assessing whether to enter into a contract with an individual. This information is available to potential contracting parties, who request it from their clients before concluding any credit-related contract. The intervener does not possess this information, nor do its contracting parties request it from the intervener. Likewise, the intervener does not request this information from its contracting parties.
Furthermore, there is no "legal protection gap" because the intervener's contracting party (TeamBank) could have provided information about the loan approval process and the logic of the scoring procedure. In principle, TeamBank itself must be able to explain the creditworthiness assessment on which it relies to the individual concerned. The intervener would have provided TeamBank with the necessary information if the plaintiff had requested this information from TeamBank. Furthermore, the score was calculated using a scoring method specifically developed for TeamBank ("Individual SCHUFA Scorecard TeamBank III"), which is based on the credit institution's specific risk experience in granting "easyCredit" loans.
Even if the plaintiff were to have a claim against the intervener under Article 15(1)(h) GDPR, this claim has in any case been fully satisfied and extinguished. The intervener provided the plaintiff with the requested information transparently and completely. The criteria and their weighting are set out in the table on page 5 of the information dated July 10, 2018. They are also explained in section 4 of the SCHUFA information that was attached to the data copy. Furthermore, the plaintiff already received an explanation of the terms "credit activity last year," "credit usage," "length of credit history," and "general data" used in the overview of the score history in the intervenor's letter of September 15, 2020.
The data copy provided by the intervenor shows, in particular, which data the intervenor has stored about the plaintiff and to whom it has transmitted which data in recent months. The table of requesting contractual partners also shows in which cases a specific score was calculated and transmitted.
The information provided on July 10, 2018, indicates that the plaintiff's credit activity was assessed as a significantly above-average risk (- -), credit usage as a below-average risk (+), and the length of the credit history as an above-average risk (-). The plaintiff's general data was assessed as a significantly below-average risk (+ +). The enclosed "SCHUFA Information" (section 4) also explains that the "logic" of the intervenor is based on deriving predictions about the future credit-related behavior of individuals from the stored data and the experience gained from the data it possesses. The intervenor also makes the scope and intended effects of the scoring publicly available online. This is sufficient to inform an affected party – such as the plaintiff – about what information the intervenor possesses, whether it has considered this information in individual inquiries, and how this has been done (neutral, positive, strongly positive, negative, or strongly negative).
The plaintiff is not entitled to any further information. In particular, she has no right to information about the "algorithm" used by the intervenor or about the specific method used to calculate her credit scores. The obligation to provide information about the logic involved relates only to methods and criteria, i.e., abstract information about the operation and relevance of the decision-making or profiling system it uses. Further details regarding the specific calculation are not required. With regard to the "logic involved," only the principle on which the calculation is based must be presented, not the specific formula, as is clear from both the English and French versions of the GDPR and from Recital 63, which states that the right of access must not infringe trade secrets. The respondent did not "absolutely" refuse to provide the information, but rather explained the data basis and the "logic" of the score calculation in an understandable way.
In any case, providing any further information (such as the score calculation formula or algorithm) beyond what has already been provided would be precluded by the respondent's trade secrets and intellectual property rights.
The plaintiff's claim for supervisory intervention is only valid if the defendant's discretion to intervene under Article 58 GDPR is reduced to "zero." This is not the case.
The intervener is unaware whether and with which software TeamBank made the disputed credit decision in 2018. Even if the software of ACTICO GmbH was used in 2018, the plaintiff has neither substantiated this claim nor is it otherwise apparent that the score in question was set as the decisive decision criterion in the software.
It is disputed that the plaintiff's income and assets were not checked by TeamBank before the loan decision and that only the intervener's "credit report" was available. The plaintiff applied for an instant loan (easyCredit) from TeamBank. In this respect, an online account check is mandatory. The applicant must grant TeamBank access to their salary checking account to verify their income and expenses. TeamBank uses this account check to verify the financial data provided in the loan application in order to make a credit decision. It is therefore implausible that TeamBank would not have examined the plaintiff's financial situation before making the credit decision.
Insofar as the plaintiff objects to the lack of a legal basis for calculating the score in question, the legality of the score is irrelevant to the decision. Moreover, a legal basis exists under Article 6(1)(f) of the GDPR.
In the court proceedings, the defendant submitted to the court, in a written submission dated September 12, 2025, the correspondence between him and TeamBank from 2024. The following emerges from this: By letter dated April 26, 2024, the defendant requested G. to explain whether the credit score for the plaintiff, provided by the intervener, had been decisive in TeamBank's rejection of the loan application in July 2018. The defendant also requested an explanation of the role played by the probability value transmitted by the intervener in the loan denial. Furthermore, the defendant was asked to answer the question of whether TeamBank had been significantly influenced by the credit score in its loan decision (pp. 335 ff. of the electronic court file). In response, TeamBank informed the defendant by letter dated May 13, 2024, that it had already deleted the plaintiff's application data due to internal data deletion policies. Since the plaintiff, after conducting research, had not initiated a review of the automated credit decision by TeamBank pursuant to Article 22(3) GDPR, TeamBank also had no data on the request in its own complaint database (p. 338 of the electronic court file). By email dated May 15, 2025, the defendant asked TeamBank, regardless of the plaintiff's identity, to explain the underlying process for rejecting a loan application using the Schufa credit score. Furthermore, TeamBank requested an explanation of what was meant by the term "individual score" (pp. 343-344 of the electronic court file). By email dated May 22, 2024, TeamBank responded to the defendant as follows:
"1. Credit Decision Process
Our credit decision incorporates a number of rules and criteria, all of which must be met. Violation of any one of these rules can lead to the rejection of the loan application."
For each person submitting an inquiry, TeamBank receives the Schufa-TeamBank Score. This score is factored into the credit decision in two ways:
• as an input in a comprehensive sales score, which includes other internal characteristics and together forms a common credit rating, and
• as a sub-criterion in a decision rule; the other sub-criterion is, among other things, TeamBank's internal credit rating.
The final credit decision can be red or green. The decision logic is regularly validated.
2. Term "Individual Score"
In your inquiry, you refer to the term "individual score," which originates from a request for information from the complainant pursuant to Article 15 of the GDPR. This information pursuant to Article 15 of the GDPR was not provided by TeamBank, which is why we are unaware of the context in which the term was used. Regardless, we would like to explain our TeamBank Score to you below:
The score used by TeamBank was developed by Schufa specifically for TeamBank. The Schufa score is checked by TeamBank with every loan application.
Unlike the Schufa Bank Score, the Schufa-TeamBank Score was developed specifically for TeamBank's portfolio. This means a statistical model was created that compares the characteristics of TeamBank customers at the time of application to a potential future default. In contrast, the Schufa Bank Score uses data from all customers known to Schufa, not just TeamBank. The advantage of using a proprietary score is that individuals who are not part of TeamBank's customer base do not distort the accuracy of the predictive model, leading to better default forecasting and thus improved protection against over-indebtedness for the customer.
TeamBank does not know the characteristics and their weighting used in the Bank Score. However, it can be assumed that neither the characteristics nor their weightings are the same for the Bank Score and the TeamBank Score. In other words, it would be statistically highly improbable if the model developments based on two different data sets would lead to the same results.
Since TeamBank does not have access to the bank score, we are unable to explain the discrepancies in the probability forecasts of the two scores.
However, discrepancies between two models with different data sets are generally not unusual: If TeamBank customers are used as a reference, a certain probability of a future default emerges. If customers of building societies or customers without a need for credit are also included, the probability of a subsequent negative event is assessed as lower.
After hearing the parties involved, the Chamber, by decision of October 1, 2021, stayed the proceedings and referred them to the Court of Justice of the European Union (CJEU) for a preliminary ruling pursuant to Article 267 of the Treaty on the Functioning of the European Union (TFEU) on the following questions:
"Is Article 22(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR, OJ EU L 119 of 4.5.2016, p. 1) to be interpreted as meaning that the automated generation of a probability score on a data subject's ability to service a loan in the future, A decision based solely on automated processing – including profiling – which produces legal effects concerning the data subject or similarly significantly affects him or her, where the value determined using the data subject's personal data is transmitted by the controller to a third-party controller and that third party relies heavily on this value for its decision on entering into, performing, or terminating a contractual relationship with the data subject?
If the first question referred to the Court is to be answered in the negative: Are Articles 6(1) and 22 of Regulation (EU) 2016/679 – GDPR – to be interpreted as precluding a national provision under which the use of a probability score – in this case concerning a natural person’s ability and willingness to pay when incorporating information on receivables – relating to a certain future behavior of a natural person for the purpose of deciding on the establishment, performance, or termination of a contractual relationship with that person (scoring) is only permissible if certain further conditions, which are set out in more detail in the grounds for the referral, are met?
In its judgment of 7 December 2023 – C-634/21 – the CJEU ruled that Article 22(1) GDPR must be interpreted as meaning that,
“an ‘automated individual decision’ within the meaning of that provision exists where a probability score based on personal data relating to a person is used to determine that person’s ability to pay is determined in a manner that allows for the processing of personal data relating to that person’s ability to pay.” "The probability score is automatically generated by a credit reporting agency for the purpose of fulfilling future payment obligations, provided that whether a third party, to whom this probability score is transmitted, enters into, performs, or terminates a contractual relationship with that person depends significantly on this probability score."
For further details, reference is made to the judgment of the CJEU of 7 December 2023, C-634/21, ECLI:EU:C:2023:958.
By letter dated 4 June 2025, the Court requested TeamBank to answer the following questions in writing:
"1. Why was the plaintiff's loan application rejected by G. in 2018?
2. What criteria were used by G. in its negative decision regarding the plaintiff's loan application?"
" 3. Was G.'s negative credit decision regarding the plaintiff's loan application based primarily or exclusively on the credit score transmitted to G. by C., or were other criteria also considered in G.'s (negative) decision to grant the loan? If so, what were these criteria?
4. Did G. use individual scorecards and rules, and is it therefore possible to obtain a result regarding a loan applicant's creditworthiness that deviates from the standard scorecards?
(pp. 98 ff. of the electronic court file).
In a letter dated June 20, 2025, TeamBank informed the court of the following:
"[A]f due to our internal deletion policies, we have already deleted the complainant's application data. Therefore, we cannot answer your questions 1 to 3.
The score used by TeamBank was developed specifically for TeamBank by Schufa." For every loan application submitted to TeamBank, the Schufa credit report is checked by TeamBank. Unlike the standard Schufa bank score, the Schufa-TeamBank score was specifically developed for TeamBank's portfolio. This means a statistical model was created that compares the characteristics of TeamBank customers at the time of application with any subsequent potential default. Against this background, the score used by TeamBank and other characteristics may lead to a different result compared to standard scorecards.” (p. 113 of the electronic court file).
On November 19, 2025, the Chamber held an oral hearing on the matter. For details, reference is made to the minutes of the hearing.
For further details of the facts and the legal arguments, reference is made to the contents of the court file (available in paper form and maintained electronically) and the submitted administrative file, all of which were the subject of the oral hearing.
Reasons for the Decision
The “amendment” of the claims declared by the plaintiff’s attorney during the oral hearing does not constitute an amendment or withdrawal of the claim within the meaning of Sections 91 and 92 of the Code of Administrative Court Procedure (VwGO), but merely a clarification of the application announced in writing. In particular, the cause of action—the requested supervisory intervention by the The defendant's actions against the intervener remain unchanged, and no new issues have been introduced, pursuant to Section 173 Sentence 1 of the Administrative Court Procedure Act (VwGO) in conjunction with Section 264 No. 2 of the Code of Civil Procedure (ZPO).
The action is successful with regard to the (first) alternative claim. Based on the plaintiff's request (Section 88 VwGO), this claim is to be interpreted as seeking to overturn the defendant's rejection notice – here, the "order" of June 3, 2020 – and to compel the defendant to take supervisory measures against the intervener to fulfill the plaintiff's right to information under Article 15 Paragraph 1 Letter h of the GDPR, taking into account the court's legal opinion, pursuant to Section 113 Paragraph 5 Sentence 2 VwGO. The claim, as thus understood, is admissible and well-founded.
The main claim, however, is unsuccessful. The defendant is not required to take remedial measures pursuant to Article 58 The defendant is not obligated under Article 2(c) and (d) of the GDPR to comply with the requirements of the GDPR, because the defendant's discretionary power to choose supervisory measures is not reduced to zero. The court may not prejudge the discretionary decision regarding the selection of supervisory measures that the defendant must make. Therefore, with respect to the main claim, the action was to be dismissed as unfounded for lack of a final decision, pursuant to Section 113(5), sentence 1 of the German Code of Administrative Procedure (VwGO).
I. The Wiesbaden Administrative Court has jurisdiction to decide this legal dispute.
Administrative legal recourse is available. The plaintiff is challenging a final notification issued by the defendant, designated as an "order," in response to a complaint she lodged pursuant to Article 77 of the GDPR. Such a final notification constitutes a "legally binding decision" within the meaning of Article 78 of the GDPR (see, in this regard, CJEU, Judgment of 7 December 2023 – C-26/22, C-64/22 –, juris para. 50). With this action, the plaintiff asserts her right under Article 78(1) of the GDPR to an "effective judicial remedy" against this decision.
The Wiesbaden Administrative Court has subject-matter jurisdiction pursuant to Section 45 of the Code of Administrative Court Procedure (VwGO). Pursuant to Section 20(3) of the Federal Data Protection Act (BDSG), the court with territorial jurisdiction is the court in whose district the supervisory authority is located. The defendant is domiciled in C-City, so local jurisdiction is established pursuant to Section 1 Paragraph 2 No. 5 of the Hessian Law Implementing the Code of Administrative Court Procedure (HessAGVwGO).
II. The action is admissible.
The action, seeking a court order compelling the defendant to take supervisory measures against the intervener pursuant to Article 58 Paragraph 2 GDPR (and setting aside the defendant's "order" of June 3, 2020), is admissible as an action for performance pursuant to Section 42 Paragraph 1 Alternative 2 of the Code of Administrative Court Procedure (VwGO), aimed at supervisory intervention.
The action is also admissible in all other respects.
The plaintiff has standing to sue pursuant to Section 42 Paragraph 2 of the Code of Administrative Court Procedure (VwGO). The plaintiff's standing to sue derives from her ability to assert that the defendant's "order" of June 3, 2020, by which the defendant refused further supervisory action against the intervener, infringes her own subjective public rights (Section 42, Paragraph 2, Alternative 2 of the German Administrative Court Procedure Act).
The right of a data subject to lodge a complaint with a supervisory authority is not merely a non-formal remedy similar to a petition. Rather, as is evident from the regulatory context of Articles 57(1)(f), 77(1), and 78(1) of the GDPR, the data subject has a right to have the supervisory authority—in this case, the defendant—examine (to a reasonable extent) whether a violation of the General Data Protection Regulation has occurred and, furthermore, if a violation is established, a right to a discretionary decision by the defendant regarding supervisory action that is free from errors of discretion. According to Article 57(1)(f) GDPR, the supervisory authority is obliged to address complaints from data subjects, to investigate the subject matter of the complaint to a reasonable extent, and to inform the complainant of the progress and outcome of the investigation within a reasonable timeframe. Articles 77 and 78 GDPR, which govern the right of data subjects to lodge a complaint and their legal remedies, build upon this objective legal obligation of the supervisory authority. According to Article 77(1) GDPR, without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement, if the data subject considers that the processing of personal data relating to them infringes the General Data Protection Regulation. Article 77(2) GDPR stipulates that the supervisory authority with which the complaint was lodged must inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR. Furthermore, Article 78(1) GDPR provides that, without prejudice to any other administrative or extrajudicial remedy, every natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. Article 78(2) GDPR further stipulates that, without prejudice to any other administrative or extrajudicial remedy, every data subject has the right to an effective judicial remedy if the supervisory authority responsible under Articles 55 and 56 GDPR fails to address a complaint or informs the data subject within three months of the progress or outcome of the complaint lodged pursuant to Article 77 GDPR. A person who, in the context of a complaint pursuant to Articles 57(1)(f) and 77(1) GDPR, asserts that the processing of their personal data violates the General Data Protection Regulation, has a right to a decision free from errors of discretion.
Against this background, an infringement of the plaintiff's own subjective rights appears possible. This is because it cannot be ruled out from the outset that the intervener violated its duty to provide information to the plaintiff pursuant to Article 15 GDPR, and that the defendant is therefore obligated to take supervisory measures against the intervener pursuant to Article 58 GDPR.
Preliminary proceedings are not required pursuant to Section 20(6) of the Federal Data Protection Act (BDSG) in conjunction with Section 68(1), sentence 1, no. 1 of the Code of Administrative Court Procedure (VwGO).
The time limit for filing an action pursuant to Section 74(1), sentence 2 of the Code of Administrative Court Procedure (VwGO) has been observed.
III. The action is also well-founded with regard to the (first) alternative claim.
The defendant, the Hessian Commissioner for Data Protection and Freedom of Information, is itself a proper defendant. Pursuant to Section 20 Paragraph 5 Sentence 1 No. 2 of the German Federal Data Protection Act (BDSG), the supervisory authority is directly involved as a defendant. This constitutes a special federal legal provision, necessitated by EU law and based on the independence of the supervisory authority, which takes precedence over Section 78 of the German Code of Administrative Procedure (VwGO).
The defendant's decision of June 3, 2020, is unlawful and infringes the plaintiff's rights. At the relevant time of the court's decision, the plaintiff has a right to demand that the defendant take action against the intervener to fulfill the right of access under Article 15 Paragraph 1 of the GDPR. The specific remedial measure to be taken pursuant to Article 58 Paragraph 2 of the GDPR is at the defendant's discretion.
1. According to the case law of the CJEU, which this Chamber follows, the following applies to the standard of judicial review:
The supervisory authority's decision is subject to full substantive review by the court (see CJEU, Judgment of 7 December 2023 – C-26/22, C-64/22 –, ECLI: EU:C:2023:958, juris para. 70).
First, it must be examined whether the supervisory authority has adequately investigated whether an infringement of the GDPR has occurred. In order to assess whether data processing is unlawful and whether supervisory measures are required, the supervisory authority must establish the facts and clarify all circumstances necessary for identifying and verifying the infringement.
Article 58(1) GDPR grants the supervisory authority extensive investigative powers. The scope of investigation to be considered "adequate" within the framework of the principle of official investigation is not defined. Recital 141, second sentence, of the GDPR stipulates that, subject to judicial review, the investigation should go as far as is appropriate in each individual case. The scope of the investigation is determined, in particular, by the individual significance of the matter and the seriousness of the alleged infringement. The investigation must be conducted to a reasonable extent and with all due diligence. It must be borne in mind that the supervisory authority is obligated under Article 57(1)(a) GDPR to enforce the GDPR (see CJEU, Judgment of 16 July 2020 ["Facebook Ireland and Schrems"] - C-311/18, ECLI: EU:C:2020:559, para. 111 and CJEU, Judgment of 7 December 2023 ["SCHUFA Holding"] - C-26/22, ECLI: EU:C:2023:958, para. 56).
... If, at the end of its investigation, the supervisory authority identifies a violation of the GDPR, it is generally required to take remedial measures aimed at remedying the violation. Article 58(2) GDPR provides a list of possible measures. The supervisory authority must decide, at its discretion, whether exercising a less intrusive remedy is sufficient to ensure the application and enforcement of the GDPR, or whether a more intrusive measure is necessary. It is not obligated to always proceed in the exact order of the remedies listed in Article 58(2) GDPR, but may, in the interest of the effective enforcement of European data protection law, also immediately exercise a more stringent remedy if this appears objectively necessary and proportionate (see Selmayr, in: Ehmann/Selmayr, GDPR, 3rd edition 2024, Article 58, para. 18).
[The text abruptly ends here, so the supervisory authority's decision is not required.] With regard to the remedial powers mentioned in Article 58(2) GDPR, the supervisory authority thus has discretion concerning the appropriate and necessary means, which the court reviews only to determine whether the supervisory authority has remained within the limits of its discretion (see, in general, CJEU, Judgment of 7 December 2023 – C-26/22 –, ECLI: EU:C:2023:958, juris paras. 47 et seq., in particular paras. 68 et seq.; Hamburg Higher Administrative Court, Judgment of 7 October 2019 – 5 Bf 291/17 –, juris paras. 69 et seq.).
The judicial review is governed by Section 114(1) of the German Code of Administrative Procedure (VwGO). The court then examines whether the administrative act, or the refusal or omission of the administrative act, is unlawful because the legal limits of discretion have been exceeded or the discretion has been exercised in a manner inconsistent with the purpose of the authorization. The administrative authority may also supplement its discretionary considerations regarding the administrative act during the administrative court proceedings (see also Federal Administrative Court, judgment of May 11, 2016 - 10 C 8/15 -, juris para. 13 with further references).
2. The plaintiff's right of access under Article 15(1) GDPR against the intervener has not been (fully) fulfilled by the intervener with regard to the right to obtain the information specified in Article 15(1)(h) GDPR. The information provided to the plaintiff by the intervener is deficient in accordance with Article 15(1)(h) GDPR.
Therefore, the defendant wrongly refused (further) supervisory action against the intervener to fulfill the right of access under Article 15(1) GDPR in response to the plaintiff's complaint of October 18, 2018.
Whether a right of access is fulfilled depends first and foremost on the request of the person seeking information and the (yet to be determined) scope of the obligation to provide information.
The subject of the claim asserted in the lawsuit, which seeks to compel the defendant to take action against the intervener—specifically, to fulfill the right of access under Article 15 GDPR—is solely the set of facts that formed the basis of the plaintiff's complaint under Article 77 GDPR and which underlie the defendant's decision of June 3, 2020. This is because a valid complaint requires that a specific set of facts be presented, based on which the complainant assumes a violation of the GDPR.
The complaint must contain at least all the information necessary for the supervisory authority to understand the facts, investigate them further if necessary, and examine any potential data protection violations. The complaint must therefore contain information about the data subject and the controller and at least outline the alleged violation of data protection regulations (see Mainz Administrative Court, judgment of July 22, 2020 – 1 K 473/19.MZ –, juris para. 23 with further references). This information, as presented in the complaint, thus defines and limits the scope of the supervisory authority's review and, consequently, the subject matter of the court proceedings initiated pursuant to Article 78(1) GDPR.
In the present case, as evidenced by the letter from her legal representative to the intervener dated October 18, 2018, the plaintiff requested "information about the scoring values used as the basis for her assessment." Specifically, the appellant asserted "rights to information and access regarding the existence and logic of automated processing pursuant to Article 13(2)(f), Article 14(2)(g), and Article 15(1)(h) GDPR." The respondent was obligated to provide information "about the 'how' of the processing, i.e., the logic involved and the scope and impact of the processing." Furthermore, "all information must be provided in a precise, transparent, intelligible, and easily accessible form, using clear and plain language." The respondent was required to provide "detailed information, in particular regarding which data or individual pieces of information are included in these calculations and their respective weightings" (pp. 1 ff. of the administrative file). In a letter dated August 21, 2018, from her authorized representative to the intervener, the plaintiff further complained that the intervener's letter of August 8, 2018, lacked specific information regarding the disputed scoring value of 85.96% from July 10, 2018. The communicated probability values contained no concrete details whatsoever regarding the calculation of the score. Reference was made only to risks, which were further characterized by the words "(significantly) above average, average, below average." Why these assessments were made in this way was not explained in any detail. Since the formation of the comparison group was also not explained in any detail, it was entirely unclear whether the plaintiff's assessment was not completely arbitrary. The information provided on July 10, 2018, indicates that the categories "Credit Activity Last Year" and "Length of Credit History" were negatively impacted by the plaintiff, without the intervener having yet explained what these categories actually mean or why they resulted in such negative assessments. The plaintiff is not concerned with the specific weighting of individual categories used in the intervener's scoring process. Rather, the sole concern is why some of these categories were rated so negatively. There are no comprehensible reasons for this (pp. 10 et seq. of the case file).
In its letter of complaint to the defendant dated October 18, 2018, the plaintiff essentially reiterated its demand for information about the "how" of the processing, i.e., the logic involved, the scope, and the effects of the processing, in a precise, transparent, understandable, and easily accessible form, using clear and simple language. She added that the massive impact on the lives of those affected made it all the more justifiable for the intervener to provide detailed information, particularly regarding which data or individual pieces of information, and with what weighting, were included in these calculations (pp. 1 et seq. of the case file).
During the oral proceedings, the plaintiff's attorney stated that, in light of the intervener's procedural conduct, the plaintiff now also wished to have access to the formula.
This qualitative improvement, presented during the pre-trial and court proceedings, regarding the content of the information requested by the plaintiff, is irrelevant to the review mandate imposed on the defendant by the complaint, and thus also to the matter at hand within the framework of the court proceedings initiated pursuant to Article 78(1) GDPR, because the defendant, as the supervisory authority, is obligated to independently assess the data protection aspects of the matter presented to it – in this case, the provision of information regarding the score of 85.96%. Furthermore, the plaintiff's enhanced arguments pertain solely to the modalities of fulfilling the obligation to provide information or the corresponding right of access under Article 15(1) GDPR, which the defendant is to compel the intervener to fulfill using supervisory means, according to the plaintiff's request. The defendant may take note of the plaintiff's subjective view expressed regarding the scope of the duty to provide information; however, this view cannot determine the actual subject of the complaint, namely the violation of the General Data Protection Regulation (GDPR) that the defendant is required to examine.
Ultimately, the court, within the framework of the legal proceedings before it, must determine the scope of the right to information—and thus what is necessary and sufficient to fulfill it in the specific case—as a legal question with binding effect for the parties. As will be discussed below, the interpretation of the indeterminate legal terms of "meaningful information about the logic involved [of automated data processing]" pursuant to Article 15(1)(h) GDPR is crucial. The administration—and thus also the defendant—has no discretion in interpreting these indeterminate legal terms, meaning that the defendant's decision in this respect is subject to full judicial review, not limited to errors of assessment.
3. The plaintiff's right to information, which, as described above, is limited to the plaintiff's request to the intervener for information regarding the score of 85.96% calculated by the intervener concerning the plaintiff, the modalities of which are in dispute between the parties, and for which only Article 15(1) GDPR is a possible legal basis, has been denied by the intervener with regard to the information owed pursuant to Article 15(1)(h) GDPR. The requirements have not been met. The defendant's decision of June 3, 2020, in which he refused to take supervisory action against the intervener, is therefore unlawful. At the relevant time of the court's decision, the defendant failed to comply with his obligation to take supervisory measures pursuant to Article 58(2) GDPR in order to compel the intervener to fulfill the plaintiff's right of access under Article 15(1)(h) GDPR.
Pursuant to Article 15(1) GDPR, a data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the information specified in points (a) to (h) of Article 15(1) GDPR, in particular the purposes of the processing (point (a)); the categories of personal data concerned (point (b)); and the recipients or categories of recipients to whom the personal data have been or will be disclosed. have been or will be disclosed (point c), where possible the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period (point d); the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing (point e); the right to lodge a complaint with a supervisory authority (point f); where the personal data are not collected from the data subject, any available information as to their source (point g); the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject (point h).
a) First, the scope of application of the right of access under Article 15(1) GDPR is established.
The intervener, as the controller within the meaning of Article 4(7) GDPR, processed the plaintiff's personal data (the so-called scoring) within the meaning of Article 4(1) GDPR by creating the credit score and assigning it to the plaintiff.
According to the defendant's undisputed account (see the intervener's letters to the plaintiff dated August 8, 2018, and August 23, 2018), credit scores are calculated based on the data stored about a person, which is then used to assign them to statistical groups of people who have had similar data in the past. For the purpose of calculating credit scores, the intervener categorizes the stored data into so-called data types. According to the undisputed statements of the interveners, this includes, among other things:
• Credit activity last year (whether and how many transactions the person requested and actually concluded with a financial default risk in the last twelve months)
• Credit usage (number, type, duration, and scope of transactions with a financial default risk concluded by the person)
• Length of credit history (length of credit relationships, e.g., current accounts or credit cards)
• General data (e.g., date of birth, gender, or the number and date of the last update of addresses used in business transactions, including data from an identity verification underlying the transaction (see the interveners' brief of September 15, 2020, and the information sheet "SCHUFA Information," pp. 459 et seq. of the paper court file)).
This data constitutes personal data within the meaning of Article 15(1) in conjunction with Article 4(1) GDPR, as it all contains information relating to an identified or identifiable natural person. natural person – in this case, the plaintiff.
Since the intervener uses this data for scoring, employing a mathematical-statistical procedure, the intervener is an entity that, alone or jointly with others, decides on the purposes and means of processing personal data and is therefore a controller within the meaning of Article 15(1) in conjunction with Article 4(7) GDPR.
b) Furthermore, the conditions for the right of access under Article 15(1)(h) GDPR are also met.
In the Chamber's opinion, the intervener's activity – the creation of the score in dispute – fulfills the requirements of Article 22(1) GDPR.
The scope of Article 15(1)(h) GDPR, with its concept of "automated decision-making," is linked to the scope of Article 22 GDPR, which is officially titled "Automated individual decision-making, including profiling." The meaning of this is set out in Article 22(1) GDPR. According to Article 22(1) GDPR, the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
In response to the preliminary ruling requested by the Chamber in the present proceedings, the CJEU ruled that
"Article 22(1) GDPR must be interpreted as meaning that an 'automated individual decision' within the meaning of that provision exists where a credit reference agency automatically generates a probability score based on personal data relating to a person regarding that person's ability to meet future payment obligations, insofar as that probability score is a key factor in whether a third party, to whom that probability score is disclosed, enters into, performs, or terminates a contractual relationship with that person" (CJEU, Judgment of 7 December 2023 - C-634/21 - paragraph 73).
The referring court is bound by this. According to its settled case law, a judgment of the Court of Justice of the European Union (CJEU) in preliminary ruling proceedings binds the national court with regard to the interpretation or validity of the acts in question of the EU institutions when deciding the main proceedings (see CJEU, Judgment of 16 June 2015 – C-62/14 –, juris, para. 16). The referring court is not empowered to review, disregard, or modify the content of the preliminary ruling (see Wegener in: Calliess/Ruffert, EUV/AEUV, 6th ed. 2022, TFEU Art. 267 para. 50 with further references).
These conditions established by the CJEU are met with regard to the creation of the score by the intervener. The creation of the score value determined with respect to the plaintiff by the intervener constitutes, in the present case, a decision based on "automated processing – including profiling" within the meaning of Article 22(1) GDPR.
With regard to the interpretation of the term "decision" within the meaning of Article 22(1) GDPR, which is not further defined in the GDPR, the case law of the CJEU – which this Chamber follows – requires a broad understanding of the term.
The CJEU assumes,
"that it is already clear from the wording of this provision that this term refers not only to actions that have legal effect on the data subject, but also to actions that similarly significantly affect that person." The broad meaning of the term ‘decision’ is confirmed by Recital 71 of the GDPR, which states that a decision assessing personal aspects concerning a person ‘may include a measure’ that either ‘produces legal effects on the data subject’ or ‘similarly significantly affects the data subject’, and that the data subject should have the right not to be subject to such a decision. According to this recital, the term ‘decision’ includes, for example, the automatic rejection of an online loan application or online recruitment process without any human intervention. Since the term ‘decision’ within the meaning of Article 22(1) GDPR can thus encompass several actions that may affect the data subject in many ways, this term is broad enough to include the result of calculating a person’s ability to meet future payment obligations in the form of a probability value (ECJ, Judgment of 7 December 2023 – C-634/21 –, paragraphs 44-46).
Such a broad understanding of Article 22(1) GDPR is also appropriate in order to avoid gaps in legal protection with regard to the right of access. If, on the other hand, Article 22(1) GDPR were to be interpreted as meaning that the characteristic of an ‘automated decision in an individual case’ could, in a situation such as that at issue in the main proceedings, only be attributed to the decision of a third party vis-à-vis the data subject, this would result in a gap in legal protection. For one thing, a company like the intervener would not be obliged to provide information about the additional information to which the The data subject has a right under Article 15(1)(h) GDPR, since they are not the one making an "automated decision" within the meaning of that provision and consequently within the meaning of Article 22(1) GDPR. Furthermore, the third party to whom the probability score is disclosed cannot provide this additional information, as they do not possess it. In this respect, the CJEU has also emphasized that the broad meaning of the term "decision" within the meaning of Article 22(1) GDPR strengthens the effective protection that this provision aims to provide (CJEU, Judgment of 7 December 2023 – C-634/21 –, paragraph 60). Thus, the data subject could not, firstly, assert their right to access the specific information referred to in Article 15(1)(h) GDPR from the credit agency that determines the probability score concerning them if that agency does not engage in automated decision-making. Secondly, the third party – assuming that the information they provide is automated – would not be able to access the information provided by the credit agency. The action taken would fall under Article 22(1) GDPR, as it fulfilled the conditions for the application of that provision – the data subject was unable to provide this specific information because he generally does not possess it (ECJ, Judgment of 7 December 2023 – C-634/21 –, para. 63).
In the present case, the intervener, a credit reporting agency, calculated a score of 85.96% specifically for use by TeamBank as its contractual partner. This score represents a probability value based on the plaintiff's personal data regarding the plaintiff's ability to meet future payment obligations. The intervener thus provides its contractual partners – here TeamBank – with information on the creditworthiness of third parties, particularly consumers. To this end, it uses mathematical-statistical methods to predict the probability of future behavior ("score value") based on certain characteristics of a person, such as, in particular, the repayment of a loan. The creation of score values (“Scoring”) is based on the assumption that by assigning a person to a group of other persons with comparable characteristics who have behaved in a certain way, similar behavior can be predicted.
The scoring by the intervener thus constitutes profiling within the meaning of Article 4(4) GDPR, which is a subset of an activity based solely on “automated processing” within the meaning of Article 22(1) GDPR (see also CJEU, Judgment of 7 December 2023 – C-634/21 –, paragraph 47).
According to Article 4(4) GDPR, profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
By collecting and compiling personal data for the purpose of profiling and subsequently determining a final score, the intervener is engaging in profiling within the meaning described above (see also Higher Regional Court of Dresden, judgment of October 7, 2025 – 4 U 884/24 –, juris para. 30). This processing, as is clear from Recital 71 of the GDPR, requires the evaluation of personal aspects relating to the natural person affected by this processing, in particular for the analysis or prediction of aspects concerning their performance at work, economic situation, health, preferences or interests, reliability or behavior, location or movements (ECJ, Judgment of 7 December 2023 – C-634/21 –, paragraph 58).
The intervener's procedure uses personal data to evaluate certain aspects relating to natural persons in order to analyze or predict aspects concerning their economic situation, reliability, and likely behavior. As the intervener itself explains, the method it uses, based on certain criteria, provides a "score," i.e., a result that allows conclusions to be drawn about the creditworthiness of the data subject.
Finally, the third criterion of Article 22(1) GDPR, namely a significant impairment "in a similar manner," is also met in the present case. While the creation of the score as an automated decision by the intervener does not have direct legal effect on the plaintiff as the data subject—such effect only occurs through a decision by a third party, for example, regarding the granting of credit to the plaintiff—even if a decision-making process does not directly affect a person's rights, it can still fall within the scope of Article 22(1) GDPR if it has a corresponding effect or significantly affects the person in a similar manner.
In the Chamber's view, this is the case if it is capable of having a prejudicial effect on the establishment, modification, or termination of a legal position of the data subject. For data processing to significantly affect a person, its effects must therefore be equivalent to a "legal effect" on the data subject. This must be assessed according to the circumstances of the specific case.
When it comes to establishing a private contractual relationship – such as here concerning the granting of a loan – it must also be taken into account that even the automated creation of a credit score can affect the financial situation of the person concerned, because this involves an assessment of their creditworthiness (contra: Higher Regional Court of Munich, preliminary ruling of February 3, 2025 – 24 U 3326/24 e, GRUR-RS 2025, 15992 para. 28, beck-online; Higher Regional Court of Düsseldorf, preliminary ruling of March 18, 2025 – 9 U 20/25, GRUR-RS 2015, 7249 para. 25, beck-online; Higher Regional Court of Brandenburg, decision of July 7, 2025 – 1 U 68/24 –, paras. 47-49, juris, a legal or similar effect as a "mere internal matter"). (rejecting). In any case, the score value generated by the intervener with regard to the plaintiff was indeed passed on to TeamBank and thus made available to a user. Subsequently, TeamBank, aware of this score value, made a negative credit decision with regard to the plaintiff.
The creation of the score value and its transfer to TeamBank already constitutes a "similarly significant" adverse effect on the plaintiff within the meaning of Article 22(1) GDPR.
In the Chamber's view, whether the profiling carried out by the intervener constitutes a "similarly significant adverse effect" on the plaintiff (which is equivalent to a legal effect) does not require that the profiling (i.e., the creation of the score value) influences the decision of a third party, namely a contractual partner of the intervener, who, after receiving the score value from the intervener, actually uses it as the sole or exclusive criterion to decide whether to enter into a contractual relationship with the plaintiff.
The case law of the Federal Court of Justice (BGH, judgment of January 28, 2014 – VI ZR 156/13 – para. ... : "In the case of scoring, an automated individual decision can only be assumed if the body responsible for the decision makes a decision that has legal consequences for the data subject or significantly impairs them solely on the basis of a score result without further substantive examination, but not if the information obtained by means of automated data processing merely forms the basis for a final decision still to be made by a human being") has been superseded by the entry into force of the GDPR.
"An automated individual decision can only be assumed in the case of scoring if the body responsible for the decision makes a decision that has legal consequences for the data subject or significantly impairs them solely on the basis of a score result without further substantive examination, but not if the information obtained by means of automated data processing merely forms the basis for a final decision still to be made by a human being." Within the framework of the right of access pursuant to Article 15(1)(h) GDPR, it is irrelevant whether the plaintiff has sufficiently presented and proven that the controller – the intervener – subjected her (only) to an unlawful automated decision with legal effects or significant impairment pursuant to Article 22(2) to (4) GDPR in conjunction with national data protection regulations by transmitting this credit score to third parties. This is because the purpose of Article 22 GDPR is to protect individuals from the specific risks to their rights and freedoms associated with the automated processing of personal data – including profiling – as highlighted in Recital 71. These risks arise in particular from the assessment of personal aspects and data such as those used in determining the probability of a payment default. The scope of the right of access under Article 15(1)(h) GDPR cannot therefore depend decisively on whether and to what extent the defendant's credit report based on profiling demonstrably violates Article 22(1) and (4) GDPR in each specific instance. Rather, in view of the purpose and intent of the provision, data subjects have rights of access at least in cases where the processing of personal data leads to automated decision-making in the form of credit scoring and is based, in particular, on profiling, as is also evident from the wording of the provision itself. This is confirmed by Recital 63, third sentence, GDPR, which likewise provides for special rights of access for data subjects in cases of profiling (Higher Regional Court of Dresden, Judgment of October 7, 2025 – 4 U 884/24 –, juris para. 31).
It cannot be denied that scoring is generally considered sensible, even from an economic perspective. Information about the creditworthiness of (potential) customers is important not only for credit institutions as lenders, but for all companies that assume credit risks in their business dealings. Creditworthiness assessments are generally based on (credit) scoring (see Taeger, External Scoring as "Automated Decision in Individual Cases" Regarding Loan Approval, BKR 2024, 41 (42)). A credit institution is obligated under Section 18a Paragraph 1 of the German Banking Act (KWG), and every lender under Sections 505a and 505b of the German Civil Code (BGB), to assess the creditworthiness of a consumer before concluding a consumer loan agreement.
Credit assessments are generally based on (credit) scoring (see Taeger, External Scoring as "Automated Decision in Individual Cases" Regarding Loan Approval, BKR 2024, 41 (42)). In practice, credit institutions fulfill their obligation to minimize risks through internal credit scoring, which typically incorporates credit scores on the probability of default of a potential borrower provided by a credit reporting agency, such as the intervenor, to enhance the reliability of the internal rating (see Thiele/v. Keitz/Brücks, Internationales Bilanzrecht [International Accounting Law], 2023, p. 342).
The German Federal Court of Justice (BGH) has also noted that the provision of accurate credit information is of considerable importance for the functioning of the economy and that information from a credit reporting agency, suitable for prompting potential lenders to conduct a thorough credit check, is essential for the lending industry (BGH, Judgment of February 22, 2011 – VI ZR 120/10 –, juris para. 21).
The German Federal Court of Justice (BGH) has also noted that the provision of accurate credit information is of considerable importance for the functioning of the economy and that information from a credit reporting agency, suitable for prompting potential lenders to conduct a thorough credit assessment, is necessary for the lending industry. The German Federal Government's draft bill on the adaptation of data protection law to Regulation (EU) 2016/679 and the implementation of Directive (EU) 2016/680 (Data Protection Adaptation and Implementation Act EU – DSAnpUG-EU) states the following regarding Section 31 (Protection of Commercial Transactions in Scoring and Credit Reports): "The determination of creditworthiness and the provision of credit reports form the foundation of the German banking system and thus also of the functioning of the economy. ... The use of the score value is based on the criteria of the current Sections 28a paragraph 1 and 28b, which fundamentally permit the economically significant activities of credit reporting agencies and the determination of score values. ... In this respect, security is created for all parties involved in such a way that scoring procedures and credit information systems, with the reporting of positive and negative data, which is provided, for example, by credit institutions, financial service providers, payment institutions, telecommunications companies, retailers, Energy supply and insurance companies or leasing companies, in principle, will continue to be permitted. They are still considered important prerequisites for economic life” (BT-Drs. 18/11325, 24.02.2017, available at: https://dserver.bundestag.de/btd/18/113/1811325.pdf, there pp. 101 f.).
Both in recital 56 of Directive (EU) 2023/2225 of the European Parliament and of the Council of 18 October 2023 on credit agreements for consumers and repealing Directive 2008/48/EC (Consumer Credit Directive [OJ L 2023/2225 of 30.10.2023]) and in recital 58 of Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and the Directives Regulations 2014/90/EU, 2016/797, and 2020/1828 (Regulation on Artificial Intelligence [OJ L 2024/1689 of 12.07.2024]) state that AI systems used to assess the creditworthiness of natural persons are (or should be) classified as high-risk AI systems, as they determine these persons' access to finance or essential services such as housing, electricity, and telecommunications.
The fact that numerous banks and credit institutions rely on "external scoring" when deciding whether and how much credit to grant is already evident from publicly available information, such as on their websites. For example, the Sparkassen-Finanzgruppe (Savings Banks Finance Group) provides information on its website regarding the importance of the information provided by the interveners with regard to loan applications (https://www.sparkasse.de/pk/ratgeber/finanzplanung/traeume-finanzieren/bonitaet.html; last accessed 4.11.2025). The website states, among other things: "Creditworthiness means whether you can be expected to repay a loan as agreed. ... You can find out how your creditworthiness is currently assessed, for example, with the SCHUFA Credit Check online. ... SCHUFA records, for example, existing financing. It provides credit institutions with information on whether customers are servicing existing loans, credit agreements, and leasing contracts on time, or whether there are difficulties with repayment. The latter has a negative impact on creditworthiness. ..." Furthermore, the website (https://www.sparkasse.de/pk/ratgeber/finanzplanung/traeumefinanzieren/kredit-ohne-schufa.html; last accessed November 4, 2025) provides information under the heading "Loans despite or without SCHUFA – how to avoid dubious offers," including the following: "Savings banks, banks, and other lenders may have different criteria for approving loans. One of the factors can be the Credit rating with SCHUFA. ... A negative SCHUFA entry or a poor SCHUFA score can signal an increased risk to the lender and lead to the loan application being rejected. ... 'Loan without SCHUFA': Often, this refers to a loan despite a negative SCHUFA rating. ... Various providers of so-called 'loans without SCHUFA' can be found online. However, such supposedly SCHUFA-free loans are often not actually granted without access to the customer's SCHUFA data. Instead, it means that loan approval is not excluded even with a lower SCHUFA score. 'Loan without SCHUFA' therefore often actually means 'loan despite a negative SCHUFA rating'. This is because credit institutions are legally obligated to conduct credit checks. ... For loans despite a negative SCHUFA rating, the following applies: A lower credit rating generally leads to a higher interest rate, as processing the application is more complex and the risk of loan default is higher. The TeamBank website (https://www.easycredit.de/blog/die-schufa-was-istdas-eigentlich, published on January 14, 2019 by easyCredit; last accessed November 4, 2025) also provides detailed information about the intervener under the entry "The SCHUFA - What is it actually?" It points out that the SCHUFA is not the only credit agency of its kind. Other companies offering similar services include, for example, Arvato, Bisnode, CRIF Bürgel, and Creditreform. However, it is also added: "Due to its close ties to numerous financial service providers in Germany, the SCHUFA is the most significant." The website also contains the following statement: "Especially when applying for loans, customers should ensure that the lender requires a SCHUFA credit report. Loan providers who advertise loans without a SCHUFA report or inquiry in newspaper ads or online are considered highly disreputable. In most cases, their costs exceed those of loans from reputable providers. These providers often lure customers with low interest rates but then charge substantial processing fees and additional costs." At https://www.easycredit.de/wissen/kredit-ohne-schufa (last accessed on November 4, 2025), it states: "SCHUFA inquiry at easyCredit... People with a negative SCHUFA rating often have difficulty obtaining a conventional loan..." and "Loan despite a negative SCHUFA rating? Those who already have negative SCHUFA entries and thus a poor SCHUFA score have a significantly harder time finding a bank that will grant them a loan." The website https://www.easycredit.de/wissen/schufa (last accessed November 4, 2025) states: "What does Schufa do? The most important information at a glance... Schufa has a strong influence on lending in Germany. It is possible to get a loan without a Schufa inquiry – but not without a credit report. You can improve your Schufa score in various ways. [...] Special case: Schufa and loans... When you apply for a loan in Germany, the bank will conduct a credit check. It is legally obligated to do so. While Schufa is not required to be used for this purpose, it is usually contacted since it is the largest credit bureau in Germany. A loan without a Schufa check is therefore possible, but a credit check always takes place." The website also contains "6 tips on how to improve your Schufa score."
``` A loan may be denied despite a generally sufficient credit score (for other reasons, such as a lack of collateral or doubts about the success of the investment to be financed). Conversely, an insufficient credit score will frequently lead to loan denial, especially in the area of consumer loans, even if the investment otherwise appears worthwhile. The significant role credit scores play in loan approvals and the design of loan terms is also demonstrated by experience from data protection authorities (see LfDI BW, New brochure: Scoring – Solid Forecast or Bad Stuff?, https://www.badenwuerttemberg.datenschutz.de/wp-content/uploads/2021/06/20210629_Scoring_web.pdf (accessed September 30, 2021)). While the lender is not obligated to base their loan decision solely on the credit score, they generally do so as a major factor.
The significant role credit scores play in loan approvals and the design of loan terms is also demonstrated by the experiences of data protection authorities (see LfDI BW, New brochure: Scoring – Solid Forecast or Bad Stuff?, https://www.badenwuerttemberg.datenschutz.de/wp-content/uploads/2021/06/20210629_Scoring_web.pdf (accessed September 30, 2021)). While the lender is not required to base their lending decision solely on the credit score, they typically do so as a major consideration.
... Since it can already be assumed that a probability score prepared by the intervener regarding a person's ability to service a loan in the future is inherently capable of at least significantly impairing that person (see ECJ, Judgment of 7 December 2023 – C-634/21 –, paragraph 49), the Chamber is of the opinion that this is all the more true in the present case with regard to the intervener's preparation of a score specifically calculated for TeamBank. Therefore, the assessment of the score calculated by the intervener for the plaintiff and forwarded to TeamBank must be considered relevant.
The court is convinced that, in the present case as well, the score calculated by the intervener for the plaintiff was so decisive for TeamBank's credit decision that the very creation of this score constitutes a decision based on automated processing – including profiling – which has legal effects on the plaintiff or similarly impairs her. Against this background, no further taking of evidence was necessary.
This is evident from the communication between the defendant and TeamBank. For example, TeamBank informed the defendant by email on May 22, 2024, that TeamBank receives the Schufa-TeamBank score for every person inquiring about a credit. This value is incorporated into the credit decision at two points: as an input parameter in a comprehensive sales score, which includes further internal characteristics and together with these forms a common credit rating, and as a sub-criterion in a decision rule. The other sub-criterion is, among other things, TeamBank's internal credit rating. It is further stated that the score used by TeamBank was developed specifically for TeamBank by Schufa. TeamBank requests this score from Schufa for every loan application. Unlike the Schufa bank score, the Schufa-TeamBank score was developed specifically for TeamBank's portfolio. This means that a statistical model was created that compares the characteristics of TeamBank customers at the time of application with a potential subsequent default. The advantage of using a proprietary score is that individuals who are not part of TeamBank's customer base do not distort the accuracy of the predictive model, which in turn leads to a better default forecast and thus better protection against over-indebtedness for the customer (pp. 340 ff. of the court file).
This is because the Schufa-TeamBank score is specifically designed for TeamBank customers. Against this backdrop, the assertion that the score developed specifically for TeamBank by the intervenor is of no significant importance to TeamBank appears unrealistic. In response to the court's inquiry, TeamBank stated in a letter dated June 20, 2025, that the score used by TeamBank was developed by Schufa specifically for TeamBank. TeamBank requests this score from Schufa for every loan application. Unlike the Schufa bank score, the Schufa-TeamBank score is specifically designed for TeamBank's portfolio. This means that a statistical model was created that compares the characteristics of TeamBank customers at the time of application with any subsequent insolvency. Therefore, the score used by TeamBank, along with other factors, could lead to a different result compared to standard scorecards. The court's further questions regarding the reason for the rejection of the plaintiff's loan application in 2018 and the criteria used by TeamBank could not be answered because the plaintiff's application data had been deleted. This does not, however, refute the presumption that the credit score developed specifically for TeamBank was fundamentally relevant to TeamBank's loan decision concerning the plaintiff in 2018.
The question raised by the plaintiff's representative as to whether TeamBank itself automated the credit decision using software or whether the decision was made by a human being with the aid of software is irrelevant. This is because the automated decision within the meaning of Article 15(1)(h) in conjunction with Article 22(1) GDPR was made by the intervener; this fulfills the criterion of relevance established by the CJEU, regardless of whether TeamBank itself uses software in its credit decision.
c) If the conditions for the right of access under Article 15(1)(h) are therefore met, this results in a right to information about the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) and – at least in these cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
c) If the conditions for the right of access under Article 15(1)(h) are therefore met, this gives rise to a right to information about the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) and – at least in these cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
``` The scope of the right of access under Article 15(1)(h) GDPR was clarified by the CJEU in its judgment of 27 February 2025 (C-203/22, paragraphs 43 et seq.) as follows:
"The wording of Article 15(1)(h) GDPR therefore encompasses all information relevant to the process and principles of the automated processing of personal data for achieving a specific result based on that data. Regarding the context in which the phrase 'meaningful information about the logic involved' in Article 15(1)(h) GDPR is situated, it should first be noted that this information constitutes only a part of the information covered by the right of access provided for in that provision, as this also includes information on the scope and intended effects of the processing in question for the data subject. While this information is required under the guidelines on automated individual decision-making, it is not sufficient to establish the nature, characteristics, and functioning of the data subject." including profiling for the purposes of Regulation 2016/679, adopted on 3 October 2017 by the Working Party established by Article 29 of Directive 95/46, as revised and adopted on 6 February 2018, ‘real, tangible examples’ must be provided to make them meaningful and understandable [...] to be taken into account as part of the context to which the expression ‘meaningful information about the logic involved’ belongs. [...] Secondly, the Court has already held, with regard to the fact that the expression ‘meaningful information about the logic involved’ also appears in Article 13(2)(f) and Article 14(2)(g) GDPR, that in the case of automated decision-making within the meaning of Article 22(1) GDPR, the right of access to this information enshrined in Article 15(1)(h) GDPR and the additional information obligations of the controller pursuant to Article 13(2)(f) and Article 14(2)(g) GDPR form a single unit (see, to that effect, judgment of 7 December 2023, SCHUFA Holding and Others [Scoring], C-634/21, EU:C:2023:957, paragraph 56). Thirdly, [...] within the contextual interpretation of the rights of access provided for in the case of automated decision-making, the case law of the Court of Justice on the requirements that the controller must fulfill pursuant to Article 15(3) GDPR must be taken into account. In particular, consideration must be given to the fact that the requirement of transparency of the information provided for in Article 12(1) GDPR applies to all data and information pursuant to Article 15, including that relating to automated decision-making. To ensure that the data subject is able to fully understand the information provided to him or her by the controller, Article 12(1) GDPR requires the controller to take appropriate measures to provide the data subject with such information in a precise, transparent, intelligible and easily accessible form, using clear and plain language (see, to that effect, judgment of 4 May 2023, Austrian Data Protection Authority and CRIF, C-487/21, EU:C:2023:369, paragraph 38). The examination of the context of Article 15(1)(h) GDPR thus confirms the interpretation resulting from the analysis of the expressions used in this provision, according to which ‘meaningful information on the logic involved’ of automated decision-making within the meaning of this provision includes all relevant information on the procedure and principles of the automated processing of personal data for the purpose of achieving a specific result, and, due to the transparency requirement, this information must also be provided in a precise, transparent, intelligible and easily accessible form. Finally, with regard to the purpose of the GDPR, it should be noted that its objective is, in particular, to guarantee a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data guaranteed in Article 16 TFEU, enshrined as a fundamental right in Article 8 of the Charter and complementing the right to a private life enshrined in Article 7 of the Charter (see, to that effect, judgment of 4 October 2024, Schrems [Disclosure of data to the general public], C-446/21, EU:C:2024:834, paragraph 45 and the case-law cited therein). As is clear from its eleventh recital, the GDPR aims to strengthen and precisely define the rights of data subjects (Judgment of 4 May 2023, Österreichische Datenschutzbehörde and CRIF, C-487/21, EU:C:2023:369, paragraph 33 and the case law cited therein). With regard specifically to the right of access provided for in Article 15 GDPR, the Court of Justice has ruled that it must enable data subjects to verify whether data concerning them is correct and whether it is being processed lawfully (Judgments of 4 May 2023, Österreichische Datenschutzbehörde and CRIF, C-487/21, EU:C:2023:369, paragraph 34, and of 26 October 2023, FT [Copies of the Patient Record], C-307/22, EU:C:2023:811, paragraph 73). [...]
In particular, in the specific context of a decision based solely on automated processing, the data subject's right to obtain the information referred to in Article 15(1)(h) GDPR is primarily intended to enable them to effectively exercise their rights under Article 22(3) GDPR, namely the right to express their point of view and the right to contest the decision. If individuals affected by an automated decision – including profiling – were unable to understand the reasons for that decision before expressing their point of view or contesting it, these rights would not fully achieve their purpose of protecting them against the specific risks to their rights and freedoms associated with the automated processing of personal data (see, to that effect, judgment of 7 December 2023, SCHUFA Holding and Others [Scoring], C-634/21, EU:C:2023:957, paragraph 57). According to Recital 71 of the GDPR, where a data subject is subject to a decision based solely on automated processing which significantly affects them, they must have the right to have that decision explained. [...] Article 15(1)(h) GDPR thus provides the data subject with a genuine right to have the workings of the automated decision-making mechanism to which they have been subjected explained and the result of that decision. An examination of the objectives of the GDPR, and in particular of Article 15(1)(h) GDPR, reveals that the right to ‘meaningful information about the logic involved’ in automated decision-making, within the meaning of that provision, is to be understood as a right to have the procedures and principles applied to the automated processing of the data subject’s personal data in order to arrive at a specific result – such as a credit profile – on the basis of that data. In order for the data subject to effectively exercise the rights granted to them by the GDPR, and in particular by Article 22(3), the relevant information must be provided in a precise, transparent, intelligible, and easily accessible form as part of this explanation. Neither the mere provision of a complex mathematical formula (such as an algorithm) nor a detailed description of each step of an automated decision-making process meets these requirements, as neither constitutes a sufficiently precise and intelligible explanation.
As is evident from the Guidelines on automated individual decision-making, including profiling, for the purposes of Regulation 2016/679, the controller should, firstly, find simple ways to inform the data subject about the considerations or criteria underlying the decision-making process. Secondly, the GDPR requires the controller to provide meaningful information about the logic involved, 'not necessarily a detailed explanation of the algorithms used or disclosure of the entire algorithm'. The “meaningful information about the logic involved” of automated decision-making within the meaning of Article 15(1)(h) GDPR must therefore describe the process and the principles that are specifically applied in such a way that the data subject can understand which of their personal data were used in the context of the automated decision-making in question and how, without the complexity of the steps to be taken in automated decision-making being able to relieve the controller of their obligation to provide explanation.
The Chamber concurs.
d) The information provided to the plaintiff by the intervener regarding the plaintiff's credit rating of 85.96% does not meet these requirements, taking into account the pre-litigation communication (letters from the intervener to the plaintiff dated July 10, 2018, August 8, 2018, and August 23, 2018), the reference to section 4 of the Schufa information, the further reference to information available online, and the explanations in the pleadings (in particular, the explanation of the data categories in the intervener's pleading of September 15, 2020, and the pleading of its legal representative dated March 28, 2024, concerning the "TeamBank score"), including the supplementary explanations provided by the intervener during the oral hearing. Therefore, the information provided to the plaintiff does not satisfy the requirement under Article 15(1)(h) GDPR.
While the defendant provides publicly accessible information on the implications of the scoring system on its website, and the intended effects of the automatically generated scores are also disclosed given the defendant's business purpose—which is known to the plaintiff—of providing its customers with guidance for decisions regarding transactions with individuals affected by the scoring system and involving credit-relevant information, general information, such as that provided on the defendant's website, is insufficient to adequately fulfill the information obligations regarding data processing in light of the transparency requirement. The purpose of the right of access is to enable data subjects to easily and at reasonable intervals become aware of the processing of their personal data and to verify the lawfulness of this processing. Therefore, the information must be addressed directly to the data subject, allowing them to individually review the data stored by the defendant.
... Regarding the credit score communicated to TeamBank in the information letter of July 10, 2018, including attachments, according to the "individual SCHUFA scorecard TeamBank III," the plaintiff is informed about the percentage of the probability of fulfillment relating to her personally (85.96%) and about which personal data concerning the plaintiff is stored by the intervener. The attached table of probability values transmitted by the intervener to its contractual partners with regard to the plaintiff shows that the plaintiff's credit activity was assessed as a significantly above-average risk (- -), credit utilization as a below-average risk (+), and the length of the credit history as an above-average risk (-). The general data concerning the plaintiff was assessed as a significantly below-average risk (+ +). While there is no objection to the fact that the relevant explanations are only found in the table's legend, as this is easily accessible and sufficiently clear, thus ensuring the required transparency for verifying the data's accuracy, the table shows, for example, that the criterion "length of credit history" was included in all reported scores, although not always with the same weighting, and that the criterion "address data" was consistently not used (here abbreviated "n/a").
The respondent only provides general information about the types of data it uses for score calculations, namely general data (e.g., date of birth, gender, or number of addresses used in business transactions), previous payment defaults, credit activity last year, credit usage, length of credit history, and address data (only if little personal credit-relevant information is available). According to the respondent, however, not every type of data is included in every single score calculation. The respondent is obligated to clarify this point. However, information is lacking as to whether, and if so, which of the plaintiff's personal data listed at the beginning of the letter was used (all data or only some?). In particular, the table column "General Data" contains no further details about which data was used in the plaintiff's case for calculating the Team Bank score, and with what individual weighting. This information is also not obvious or gleanable from the overall context of the other information provided by the intervener, such as general or online information, as it is not explained what the score is based on specifically for the plaintiff or how her specific personal data used here was weighted. The intervener's response consists solely of abstract explanations and general statements without any individual reference to the plaintiff. Furthermore, there is no easily understandable and comprehensible description of why the individual data categories compiled by the intervener, such as credit activity, credit history, and general data like age and place of residence, are relevant for profiling.
This information is not readily understandable or comprehensible. This duty to provide information exists particularly because neither the two-page list of information provided by the intervener's contractual partners regarding the plaintiff, which was submitted to the plaintiff by the intervener on July 10, 2018, nor the inquiries made by the intervener's contractual partners regarding the plaintiff, indicate that the plaintiff had previously experienced payment difficulties or provide any other evidence as to why the intervener assumed a "significantly elevated to high risk" with regard to the plaintiff (pp. 455, 457 of the court file). Therefore, clarification is needed as to the basis for this classification of 85.96% and a significantly elevated to high risk. Given the information the intervener holds about the plaintiff's financial activities, a score of 85.96% is unusual for the plaintiff.
If the intervener merely lists the individual categories that abstractly determine the score, this must be specified in detail and applied to the plaintiff. This is lacking here. The intervener does not explain what percentage of the score in each category applies to the plaintiff in each individual case, i.e., to what extent the plaintiff, for example, in the category "Credit Activity Last Year," fully achieves the score calculated by the intervener, or whether the intervener applies a discount, and if so, why.
... Furthermore, when the intervener states in the written submission of its authorized representative dated March 28, 2024, regarding the calculated score, that it was generated based on a scoring procedure specifically created for TeamBank, the "Individual SCHUFA Scorecard Teambank III", that the scorecard is also based on G.'s specific risk experiences with the granting of unsecured "easyCredit" loans, that it therefore exhibits a higher risk than the other scorecards because this is inherent in the nature of TeamBank's "easyCredit" loan offer, which is regularly used by less financially secure individuals, thus increasing the default risk for G., and that the score transmitted by the intervener indicated the average risk of future payment defaults when granting such an unsecured loan, it must be noted that this is not the issue at hand. This concerns the plaintiff's specifically calculated score, not that of TeamBank as the intervener's special contractual partner or the "individual SCHUFA scorecard." The intervener fails to adequately recognize this, as evidenced by its assertion that the default risk for TeamBank is higher. The connection between this and the plaintiff's score, which significantly impacts its creditworthiness, is neither sufficiently explained nor comprehensible.
e) According to the aforementioned case law of the CJEU, the information still to be provided to the plaintiff by the intervener must be guided by the transparency requirement under Article 12(1) GDPR and by the teleological interpretation of the scope and content of the right of access under Article 15(1)(h) GDPR in light of the data subject rights under Article 22(3) GDPR. Firstly, Article 12(1) GDPR obliges the controller to provide the data subject with the relevant information in a precise, transparent, intelligible and easily accessible form, using clear and plain language (ECJ, Judgment of 27 February 2025, C-203/22, para. 49). Secondly, the right of access is intended to enable the data subject to effectively assert their data protection rights. In the case of automated decision-making, the information provided should enable the data subject to effectively exercise their rights under Article 22(3) GDPR – in particular the right to express their point of view and to contest the decision (see ECJ, ibid., paras. 53-55). It follows that the data subject has a right to an explanation of the procedure and the principles specifically applied in the automated processing of their personal data to obtain a particular result – for example, a credit profile (see CJEU, loc. cit., para. 58). The GDPR does not necessarily require the controller to provide a detailed explanation of the algorithms used or to disclose the entire algorithm (see CJEU, loc. cit., para. 60). The "meaningful information on the logic involved" of automated decision-making within the meaning of Article 15(1)(h) GDPR must describe the process and the principles specifically applied in such a way that the data subject can understand which of their personal data were used in the automated decision-making process in question and how, without the complexity of the steps involved in automated decision-making being able to relieve the controller of their obligation to provide explanations (see CJEU, loc. cit., para. 61). Furthermore, the explanations should relate both to the functioning of the automated decision-making mechanism and to the specific outcome to which the decision led (CJEU, loc. cit., para. 57). Abstract information is therefore insufficient. What is required is an individualized explanation of the procedures and principles that were applied "concretely" (ECJ, loc. cit., paras. 61, 66) during the processing – for example, for creating a credit profile. This also requires addressing the risks to the data subject posed by automated decision-making – often even without their knowledge – in particular profiling within the meaning of Article 22(1) GDPR. Due to the effects of such profiling relevant to credit assessment, as described above, the data subject must be provided with information enabling them to adjust their behavior. This allows them, for example, to influence or change factors contributing to an unfavorable score through their own actions, such as changing their place of residence, opening accounts, submitting further credit applications, etc.
Based on this, the court finds that the intervener is obligated to inform the plaintiff, in a precise, transparent, understandable, and easily accessible manner, using clear and simple language, about the calculated TeamBank score of 85.96%:
• Which specific personal data of the plaintiff and criteria it used to calculate the score.
• Why each specific data point used is relevant and meaningful for profiling the plaintiff.
• Was any information included in the score calculation that is not directly derived from the information stored about the plaintiff, and if so, what information? (For example: Were data from the plaintiff's residential environment or neighborhood also used to calculate the scores?
• The data used for the calculation must be presented in descending order of their importance (ranking) for the calculated result, starting with the personal data that, in this case, had the greatest influence on the calculated score.
• The plaintiff must be informed to what extent a deviation in the personal data considered would have led to a different result: How do changes to the stored and used data in the individual data categories affect the calculated score? For example: How would the score be affected if the plaintiff had a longer or shorter credit history; how would the score be affected if the plaintiff moved, etc.).
• Why is the score of 85.96% assessed as "significantly elevated to high risk"?
f) However, the plaintiff cannot demand further information, including disclosure of the scoring formula or the algorithm used.
• The right to information is limited by the rights and freedoms of other persons, Art. 15 para. 4 GDPR. This includes trade secrets and intellectual property rights, and in particular copyright in software, which encompasses the algorithm used by the defendant as well as the anonymized data of the respective comparison groups (legacy cases) evaluated and weighted using mathematical-statistical methods, even within the individual data types (see Higher Regional Court of Dresden, Judgment of October 7, 2025 – 4 U 884/24 –, juris para. 40).
Trade secrets are protected as a general principle of EU law and as a fundamental right under Articles 16 and 17 of the Charter of Fundamental Rights. Recital 63 GDPR also expressly recognizes the protection of trade secrets. However, a general reference to a trade secret by the intervener is insufficient. According to the case law of the Court of Justice of the European Union (CJEU), in the event of a conflict between the exercise of the right to full and comprehensive information about personal data on the one hand and the rights or freedoms of other persons on the other, the rights in question must be balanced against each other (CJEU, Judgment of 27 February 2025 - C-203/22 -, para. 72 and Judgment of 4 May 2023, para. 44).
If trade secrets or other legitimate interests of third parties are affected, the intervener must explain the aspects that are included in the balancing process and the reasons for this balancing, so that these are subject to review by the defendant as the supervisory authority and ultimately also to judicial review.
If trade secrets or other legitimate interests of third parties are affected, the intervener must explain the aspects that are included in the balancing process and the reasons for this balancing, so that they are subject to review by the defendant as the supervisory authority and ultimately also to judicial review.
CJEU, Judgment of 27 February 2025 - C-203/22 -, para. 72 and Judgment of 4 May 2023, para. 44). There is no indication that the information owed by the interveners, as specified above, would be likely to infringe upon the rights and freedoms of other persons, particularly since it contains personal data of third parties protected by the GDPR or a trade secret within the meaning of Article 2(1) of Directive 2016/943. Firstly, the interveners can fulfill their obligation to provide information without disclosing personal data of third parties.
Secondly, contrary to the plaintiff's request, now expressed in the oral proceedings, to also receive the scoring formula, the plaintiff's right to information is limited to the extent that it enables them to review the credit scores for errors and implausibility. For this purpose alone, the intervener is only obligated to provide information understandable even to a layperson, enabling them to perform such a plausibility check. However, they are not obligated to provide information on the basis of which the data subject could mathematically understand and verify the respective score calculated using statistical methods, and whether "there is an objectively verifiable correspondence and an objectively verifiable causal link between the method used and the criteria applied, on the one hand, and the result of the automated decision, on the other" (see ECJ, loc. cit., C-203/22, para. 53). The intervener is not obligated here to disclose the algorithm underlying its score values or the statistical procedure used to calculate the score values. What is crucial is that the person concerned can ascertain from the information provided which specific factors were included in each individual score calculation and how these factors were weighted in relation to one another and in the overall assessment (see also Higher Regional Court of Dresden, Judgment of October 7, 2025 – 4 U 884/24 –, para. 40, juris).
(See ... In this context, the Chamber also takes note of the press release issued by the intervener on April 3, 2025, published on its website (https://www.schufa.de/newsroom/pressemitteilungen/neuer-schufa-score-voellige-transparenz/, last accessed on November 5, 2025) entitled "SCHUFA Focuses on Complete Transparency with New Score," which states, among other things:
"[...] World's first score that consumers can calculate themselves using points [...]. As the world's first credit agency, SCHUFA is focusing on complete transparency with its new credit score. Consumers can calculate the new score, which reflects a creditworthiness forecast, themselves using their own data – and all without any statistical expertise. To this end, SCHUFA has made its sometimes very complex scores simpler and more understandable. From more than 250 possible criteria, SCHUFA has selected the twelve most understandable and, at the same time, most meaningful for the accuracy of the forecast." The six industry-specific scores, which will be replaced in the future, currently use a total of around 100 criteria. Each criterion included in the new score receives points that can be easily added up. The number of points per criterion reflects its weighting in the score. Consumers will thus be able to easily understand how different criteria influence their personal score and how changes to their score affect it. With the new SCHUFA score, it will be possible to influence one's own score in the future. [...]. It is expected that by the fourth quarter of 2025, enough corporate clients will be using the new score and the digital applications will be available to consumers. At that point, the new SCHUFA score will replace the basic score, which has served as a cross-industry guide for consumers since 2006. The difference: While the basic score is not shared with companies, the new score is the same – for consumers, companies, and banks alike [...]. SCHUFA also consulted an expert report during the development of the new score. The new score is based on the "Consumer-Friendly Scoring" guidelines of the German Federal Government's Council of Experts on Consumer Affairs from 2018. A more recent ruling by the European Court of Justice (ECJ) on scoring from February 2025 confirms the path that SCHUFA has already taken with the development of the new score: It requires that the procedures and principles used to calculate a score be explained to people "in a precise, transparent, understandable, and easily accessible form." The new score, in combination with the SCHUFA account and the explanation tool, perfectly meets these new regulatory requirements. Companies that use the new score thus meet the highest standards of transparency and explainability [...]”.
Even in light of this announcement, the court cannot discern any plausible reason at the relevant time of the court's decision why the intervener did not provide the plaintiff with the information requested by the intervener that would enable the plaintiff to understand the score calculated by the intervener or – as stated in the press release – to “recalculate” it. Given this announcement, the court cannot see how the intervener could invoke a trade secret that overrides the plaintiff's interest in disclosure, analogous to Section 242 of the German Civil Code (BGB).
For the sole issue at issue here – the fulfillment of the obligation to provide information under Article 15(1)(h) GDPR – the court can leave open the question of whether the intervener's activity, i.e., the creation of a score value as such, complies with Article 22 GDPR, which contains in paragraph 1 a general prohibition on automated data processing – including profiling – which only does not apply if a legal basis for processing under paragraph 2 is met. This is because the scope of Article 15(1)(b) GDPR merely refers, by way of a factual reference, to the existence of automated decision-making, including profiling, as defined in Article 22(1) and (4) GDPR, without the existence of a right of access depending on the question of the lawfulness of such activity.
There is no indication of a (further) restriction of the right of access under Article 15(1) GDPR pursuant to Article 23 GDPR.
4. The present infringement of the applicant's subjective right under Article 15(1)(h) GDPR, in accordance with the assessment principles explained above, means that, even at the time of the court's decision, the defendant is obliged to take remedial measures within the meaning of Article 58(2) GDPR, exercising its discretion.
In exercising this discretion, the supervisory authority must be guided by the assessment criteria set out in Recital 148 of the GDPR. According to Recital 148, and in particular the third sentence, the supervisory authority should, when choosing the appropriate measure, give due consideration to the following: the nature, seriousness, and duration of the infringement; the intentional nature of the infringement; the measures taken to mitigate the damage; the degree of responsibility or any prior infringement; the manner in which the infringement became known to the supervisory authority; compliance with measures imposed on the controller; adherence to codes of conduct; and any other aggravating or mitigating circumstances. However, it remains the case that the court cannot substitute its own assessment of the choice of appropriate and necessary remedial measures for that of the defendant (see ECJ, Judgment of 7 December 2023 – C-26/22, C-64/22 – juris para. 69), as a reduction of discretion to zero in this respect is not apparent.
For this reason, because the present proceedings are not yet ready for a decision, it was necessary to order the defendant, by setting aside the decision of 3 June 2020, to take supervisory measures, in accordance with the court's legal opinion, to fulfill the plaintiff's right to information under Article 15(1)(h) GDPR against the intervener, pursuant to Section 113(5), sentence 2, of the Code of Administrative Court Procedure (VwGO).
5. The decision on costs is based on Section 154(1) and Section 155(1), sentence 3, of the Code of Administrative Court Procedure (VwGO). Pursuant to Section 155 Paragraph 1 Sentence 3 of the German Code of Administrative Procedure (VwGO), one party may be ordered to bear all costs if the other party has only been unsuccessful to a minor extent. This is the case here, as the plaintiff's claim to compel the defendant to ensure that the intervener provides the plaintiff with information that meets the requirements of Article 15 Paragraph 1 Letter d of the GDPR is fully successful, and the plaintiff's failure regarding the main claim is, in the overall context and considering the significance of the matter for the parties, to be assessed as minor.
The intervener's extrajudicial costs are to be imposed on the defendant for reasons of equity, because the intervener filed its own claim and is therefore generally required to share the risk of costs, pursuant to Section 154 Paragraph 3 VwGO.
The decision regarding provisional enforceability is based on Section 167 VwGO in conjunction with Sections 708 No. 11 and 711 of the German Code of Civil Procedure (ZPO).
` ... 6. The appeal and the direct appeal on points of law are granted.
Pursuant to Section 124, paragraphs 1 and 2, no. 3 of the Code of Administrative Court Procedure (VwGO), an appeal must be granted if the case is of fundamental importance. A case is of fundamental importance if it raises a cross-cutting, generalizable question of law or fact that has not yet been clarified in case law, that was decisive for the court's decision, and that is also decisive for the appellate court and thus capable of clarification, and that requires clarification in the appeal proceedings in the interest of legal certainty, the uniformity of the law, or the development of the law (Roth, in: BeckOK VwGO, 72nd ed., October 1, 2024, VwGO § 124, marginal note 53 with further references). This is the case here. The conditions and scope of the right of access under Article 15(1)(h) GDPR – following the relevant decisions of the CJEU, particularly in cases C-634/21 and C-203/22 – have not yet been further clarified in the case law of the higher and highest courts. In particular, the term "involved logic" of automated decision-making, mentioned but not defined in Article 15(1)(h) GDPR, requires clarification. The question also arises as to whether the principles developed by the German Federal Court of Justice (BGH) in its judgment of January 28, 2014 (VI ZR 156/13) for Section 34 of the former German Federal Data Protection Act (BDSG a.F.) can still be upheld under the GDPR, which must be interpreted autonomously under EU law and in light of the CJEU's case law, appears to require clarification. Clarifying these legal questions contributes to legal uniformity and the further development of the law. This is relevant for a wide range of requests for information against controllers who process personal data in situations involving automated decision-making, including profiling, as defined in Article 22 of the GDPR.
The appeal on points of law is granted because the case is of fundamental importance (Section 134(2), sentence 1, Section 132(2), no. 1). For the reasons given for the fundamental importance of the case, reference is made to the above explanations.
