Legitimate Data Retention Duration

The ECJ ruled that the prolonged retention of data relating to approving a discharge from debt violates GDPR. It ruled that it is "contrary to the GDPR for private agencies to keep such data for longer than the public insolvency register [being six months]".

And after this point, credit agencies can only continue storing this data if they can prove legitimate interest as per Article 6 Paragraph 1 GDPR.

It stated that data subjects have the right to have their data deleted on request, and that SCHEFA is then obliged to act on this request and to delete this data as soon as possible.

The court also ruled that a credit agency is not allowed to process data from publicly available sources for longer than the data is still available from this source.

Right to Automatically Issue Credit Scores

The ECJ held that SCHUFA's credit rating system constitutes an "automated individual decision" which is, “prohibited in principle by the GDPR, in so far as SCHUFA's clients, such as banks, attribute to it a determining role in the granting of credit.”

Put another way, the court has ruled that any type of automated scoring is illegal if it significantly impacts the lives of data subjects - as is the case with credit scoring.

Other Rulings

The court also ruled that thee Wiesbaden Administrative Court (ACW) must now clarify whether German law provides a permissible exception for scoring. This court is part of the German judicial system and specializes in handling cases related to administrative law.

And if this was the case, the ECJ declared that the ACW had to check whether the requirements laid out by the GDPR had been met, for instance that individuals were made aware of their right to object to an automated decision and to get a human decision instead. It also stated that credit agency data subjects had the right to receive a justification for their credit rating on request.

Secondly, the ECJ also underlined that responsibility of national courts to conduct a "full review" of any legally binding decisions of their data protection authority.

This decision is the first ruling on on automated individual decision-making since GDPR arrived back in 2018, and it has far-reaching implications that go beyond SCHUFA and the wider credit scoring industry:

• The process of credit agency scoring is now illegal under GDPR, meaning companies must review and adapt their systems.
• The data used to build credit scores must be checked to see whether it's legitimate, regardless of whether automated decision-making is used.
• Any consent required to secure credit-based decisions must bee checked for legitimacy. And with automated decision-making, consent is only effective is the correct decision is covered by the consent, if applicable.
• Score values that are no longer up to date or where there is a risk that they were calculated illegally must be deleted.
• Companies can use credit scrores when reviewing the creditworthiness of applicants, but only if it is not the sole basis for their decision.