The European Court of Justice (ECJ) has pleased consumer advocates with legal limits on the use of the Schufa score. Although the credit bureau Schufa itself remains outwardly calm, the verdict is likely to have consequences for banks and merchants. Here are the key questions and answers:

Why is the ECJ dealing with the Schufa score?

Schufa provides banks and merchants with information on the creditworthiness of individuals. The exact methodology behind this score is not disclosed by Schufa. A person, seeking details on the stored data and the methodology from Schufa with the help of the Hessian Data Protection Commissioner, was unsuccessful. Subsequently, she sued before the Administrative Court in Wiesbaden. The Wiesbaden judges want to know from the ECJ whether the use of the score is in line with the General Data Protection Regulation (GDPR).

Wherein lies the problem?

The issue revolves around the protection of personal data and whether a creditworthiness check is achieved purely through technical means or with human involvement. Fully automated decisions should generally not impact the individuals. The GDPR prohibits this, except when such a process is necessary for the conclusion and performance of a contract, and the individual has consented.

How did the ECJ rule?

The Luxembourg judges have ruled that Schufa scores are decisions resulting from automated data processing. Therefore, the score must not be "substantial" for whether a customer can obtain a loan or enter into a purchase contract (Case C-634/21). It is only permissible under certain conditions. Otherwise, it constitutes a violation of the GDPR.

The specific case now goes back to the Administrative Court in Wiesbaden, which also needs to consider the Federal Data Protection Act. In essence, it is clear that Schufa's contract partners cannot rely solely on the Schufa score. They must obtain additional information and consider it in their decision-making. The score alone should not lead to the termination of a creditworthiness check.

How does Schufa respond?

"We welcome the verdict," said the company in an initial statement. "It provides clarity on how payment predictions (scores) may be used in companies' decision-making processes in line with the GDPR." According to Schufa's initial assessment, the court classifies the use of scores only in specific cases as an "automated decision in an individual case."

Schufa has surveyed its customers on how they use the score. As per the details shared by the credit reporting agency, most clients expressed that the score does not play a "substantial" role in their business decisions. The "overwhelming majority" of the banks confirmed this notion. Therefore, the bulk of customers will continue to use Schufa scores without adjusting their processes. Nevertheless, the score often "substantially" determines in online retail whether a transaction takes place or not.

What should banks and merchants now consider?

They must provide Schufa with a written assurance that the score is not "substantial" for their decisions. Most banks have given clear signals of reassurance in this regard. The rest, as per Schufa's statement, could make straightforward modifications to their processes. However, many online retailers may face problems: for them, the verdict means significantly more effort if they want to continue offering installment purchases.

What do experts and politicians say?

Christoph Ritzer, data protection expert at the law firm Norton Rose Fulbright, sees "a significant dilemma" for the credit industry. "A return to submitting proof of income, energy supply contracts, and other data, as is customary in many countries, is likely to significantly delay decisions on credit or lease agreements." It is therefore to be expected that providers will either have to more thoroughly check the creditworthiness of their customers or ask customers to register with Schufa and agree to scoring.

Federal Consumer Protection Minister Steffi Lemke refers to the coalition agreement: It was agreed therein that transparency in scoring needed to be improved. "We will now promptly examine appropriate regulations," Lemke announced.

What does the verdict mean for consumers?

"The verdict is good news for all consumers – and a heavy blow for Schufa," states Michael Möller, consumer protection expert at the Bürgerbewegung Finanzwende association. The verdict forces Schufa to handle its quasi-monopoly position more responsibly than before. "The power of Schufa is crumbling – and it's about time."

For Wolfgang Schuldzinski of the Consumer Center NRW, the verdict strengthens consumer rights. Schufa rejects detailed explanations of the score calculation, citing business secrecy and referring to the providers. "The ECJ now puts an end to this ping-pong in the request for information and ensures more transparency in credit scoring."

However, data protection expert Ritzer sees a typical Pyrrhic victory for consumers: "In the end, only those who allow Schufa to process and disclose their data will benefit from the verdict. It's hard to envision anything different in the mass business sector."

Is Schufa's business model at stake?

Based on the credit bureau's explanation: no. The verdict is not a "Lex Schufa", it applies to all credit bureaus in the EU. The way Schufa calculates scores is not the subject of the proceedings. Rather, it is about how contract partners legally use the score. Furthermore, the creditworthiness score accounts for only 13% of the total revenue. Schufa's importance has grown in recent years. Not all information concerns the score.

And what about the ECJ ruling on residual debt relief?

When a person completes the process of personal insolvency with debt relief, credit bureaus have traditionally stored this information for up to three years. In the future, credit bureaus must delete the information after six months, which is as soon as the data disappears from public registers, as clarified by the ECJ. Schufa has anticipated this ruling and shortened the regular storage period to six months in March. In April, it then deleted entries for around 250,000 individuals (Cases C-26/22 and C-64/22).