The SCHUFA judgment: when a score becomes a decision

In short: in SCHUFA (2023) the EU’s highest court held that a credit score can itself be an automated decision under the GDPR when a lender relies on it decisively, which brings the score’s producer within Article 22. In Dun & Bradstreet Austria (2025) it added that people are owed an intelligible explanation of how such a decision was reached, not a formula. Together they set the standard for any AI that scores people.^1,2,3

On December 7, 2023 the Court of Justice of the European Union decided SCHUFA Holding (C-634/21). SCHUFA, a German credit agency, produces scores that lenders use when deciding whether to offer credit. The Court held that producing such a score can itself be an automated individual decision under Article 22 of the GDPR when a third party, such as a lender, draws strongly on it to decide.¹