The European Court of Justice (CJEU) holds that credit scoring can be an automated decision under GDPR

On 7 December 2023, the CJEU issued judgment in the case of C-634/21|SCHUFA Holding (Scoring). SCHUFA is a company which provides information on creditworthiness to third parties, including, in this case, a lender.

The court was tasked with answering the following question: [does] the automated establishment, by a credit information agency, of a probability value based on personal data relating to a person and concerning his or her ability to meet payment commitments in the future [(i.e. credit scoring]) [constitute] ‘automated individual decision-making’?

Rejecting the argument that the credit scoring does not constitute an automated decision because it is the third party, in this case a credit provider (to whom the score is transferred) who makes the decision in relation to extending credit, the Court held that credit scoring does constitute automated decision making in situations where a third party, to which the credit score is provided “draws strongly” on that score to “establish, implement or terminate a contractual relationship with that person.”

The judgment will raise questions in terms of what “drawing strongly” should mean whether such decisions can be brought within the exceptions to the rule prohibiting decisions based on automated processing.

The judgment can be found here.

If you would like to discuss the implications of this case for your organisation, please get in touch with your usual contact, or email


Don't just take our word for it