Decoding Responsibility in the Era of Automated Decisions: Understanding the Implications of the CJEU’s SCHUFA Judgment

On December 7th, 2023, the Court of Justice of the European Union (CJEU) ruled that SCHUFA, a credit rating agency, played a “determining role” in a lender’s decision to deny a loan application. The CJEU found that SCHUFA’s role, i.e. providing credit scores, qualified as a “decision” under Article 22 of the GDPR. The court also determined that SCHUFA was better positioned to provide “meaningful information,” including the logic behind the automated decision-making process, to fulfill the data subject’s access rights under Article 15 of the GDPR.

This paper offers an overview of the judgment, and examines its potential implications and practical consequences for the financial services industry. It concludes that the SCHUFA ruling should be interpreted narrowly, focusing on the specifics of the case to avoid untenable and inconsistent outcomes. Finally, it provides guiding questions for organizations using automated decision-making to help assess how their processes and business models differ.

Download the Paper

Download Now