Judgment;Abstract — ECLI:EU:C:2023:957
Date: 2023-12-07
Language of the case: German
Court formation: First Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

Anonymised version 
Translation C-634/21 – 1 
Case C-634/21 
Request for a preliminary ruling 
Date lodged: 
15 October 2021 
Referring court: 
Verwaltungsgericht Wiesbaden (Germany) 
Date of the decision to refer: 
1 October 2021 
Applicant: 
OQ 
Defendant: 
Land Hesse 
  
6 K 788/20.WI 
VERWALTUNGSGERICHT WIESBADEN (ADMINISTRATIVE COURT, 
WIESBADEN) 
ORDER 
In the administrative proceedings 
OQ, 
[…] Applicant 
[…] v 
Land Hesse, represented by the Hesse Commissioner 
for Data Protection and Freedom of Information, 
EN 
REQUEST FOR A PRELIMINARY RULING OF 1. 10. 2021 – CASE C-634/21 
 
2  
Anonymised version 
[…] Defendant 
Joined party: 
SCHUFA Holding AG […] concerning data protection law 
the Administrative Court, Wiesbaden – 6th Chamber – 
made the following order via […] on 1 October 2021: 
I. The proceedings are stayed. 
II. The proceedings are referred to the Court of Justice of the 
European Union for a preliminary ruling pursuant to Article 267 TFEU 
with regard to the following questions: 
1. Is Article 22(1) of Regulation (EU) 2016/679 of the European 
Parliament and of the Council of 27 April 2016 on the protection 
of natural persons with regard to the processing of personal data 
and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation – OJ 2016 L 119, 
p. 1) to be interpreted as meaning that the automated 
establishment of a probability value concerning the ability of a 
data subject to service a loan in the future already constitutes a 
decision based solely on automated processing, including profiling, 
which produces legal effects concerning the data subject or 
similarly significantly affects him or her, where that value, 
determined by means of personal data of the data subject, is 
transmitted by the controller to a third-party controller and the 
latter draws strongly on that value for its decision on the 
establishment, implementation or termination of a contractual 
relationship with the data subject? 
2. If Question 1 is answered in the negative, are Articles 6(1) and 22 
of Regulation (EU) 2016/679 (General Data Protection Regulation) 
to be interpreted as precluding national legislation under which 
the use of a probability value – in casu, in relation to a natural 
person’s ability and willingness to pay, in the case where 
information about claims against that person is taken into 
account – regarding specific future behaviour of a natural person 
for the purpose of deciding on the establishment, implementation 
or termination of a contractual relationship with that person 
(scoring) is permissible only if certain further conditions, which 
are set out in more detail in the grounds of the request for a 
preliminary ruling, are met? 
Grounds 
SCHUFA HOLDING 
 
3 
Anonymised version 
I. 
1 The subject matter of the proceedings is an action against the score calculated by 
the joined party, SCHUFA Holding AG, in respect of the applicant. The joined 
party is a private German credit information agency that provides its contractual 
partners with information on the creditworthiness of third parties, including, in 
particular, consumers. For that purpose, the joined party establishes ‘scores’. In 
order to do so, the probability of a person’s future behaviour, such as the 
repayment of a loan, is predicted from certain characteristics of that person on the 
basis of mathematical statistical methods, whereby neither the individual 
characteristics taken as the basis nor the mathematical statistical method are 
disclosed. The establishment of scores is then based on the assumption that, by 
assigning a person to a group of other persons with certain comparable 
characteristics who have behaved in a certain way, similar behaviour can be 
predicted. If the person has a certain profile, the score determined is attributed to 
him or her by the joined party and is taken into account in the decision-making 
process of the party which may ultimately enter into a contract with the data 
subject, for example a credit institution, in the context of granting a loan, with all 
the ensuing consequences. 
2 The applicant was refused credit by a third party after the joined party had 
provided negative information. As a result, the applicant requested that the joined 
party provide her with information regarding the data stored and, moreover, erase 
what she considered to be incorrect entries. On 10 July 2018, the joined party 
provided the applicant with information stating that it had given her a score of 
85.96%. By letters of 8 August 2018 and 23 August 2018, the joined party further 
informed the applicant, in broad outline, of the basic functioning of its score 
calculation process, but not of what individual pieces of information are included 
in the calculation and with what weighting. The joined party stated that it is not 
obliged to disclose the calculation methods, as they are covered by commercial 
and industrial secrecy. The joined party also informed the applicant that it merely 
provides its contractual partners with information, but it is the latter that make the 
actual decisions on contracts; in that respect, the joined party does not provide 
them with a recommendation as to whether or not they should enter into a contract 
with a person in respect of whom information has been provided. On 18 October 
2018, the applicant lodged a complaint with the defendant against the information 
provided, requesting that the defendant order the joined party to comply with the 
applicant’s request for information and erasure. She stated that the joined party is 
obliged to provide information about the logic involved, as well as the 
significance and consequences of the processing. 
3 By administrative decision of 3 June 2020 addressed to the applicant, the 
defendant refused to take further action in respect of the joined party. By way of 
grounds for its decision, it stated, inter alia, that it is true that the joined party’s 
calculation of creditworthiness must meet the requirements regulated in detail in 
Paragraph 31 of the Bundesdatenschutzgesetz (Federal Law on data protection; 
‘the BDSG’) of 30 June 2018, BGBl. I, p. 2 097 (Article 1 of the Gesetz zur 
REQUEST FOR A PRELIMINARY RULING OF 1. 10. 2021 – CASE C-634/21 
 
4  
Anonymised version 
Anpassung des Datenschutzrechts an die Verordnung (EU) 2016/679 und zur 
Umsetzung der Richtlinie (EU) 2016/680 [Law adapting data protection law to 
Regulation (EU) 2016/679 and implementing Directive (EU) 2016/680; ‘the 
DSAnpUG-EU’]). However, according to the defendant, those requirements are 
usually met by the joined party and there is nothing to suggest that it has not done 
so in the present case. 
4 Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (OJ 2016 L 119, p. 1; ‘the General Data Protection Regulation’ or 
‘GDPR’) entered into force on 25 May 2018. The General Data Protection 
Regulation provides for a general prohibition of data processing, subject to 
authorisation; the essential criteria for authorisation to process data can be found 
in Article 6 of the GDPR. In addition, the GDPR contains a multi-instrument 
protection scheme, which includes provisions on, in particular, the rights of data 
subjects to information, access and erasure, and to lodge a complaint with the 
competent supervisory authority seeking its intervention, as well as to bring an 
action against decisions of public authorities before national courts. Amongst 
other things, the General Data Protection Regulation also specifically addresses 
‘profiling’, which is legally defined in point 4 of Article 4 of the GDPR and 
covers the joined party’s activities at issue by virtue of the fact that they constitute 
‘scoring’. Profiling is part of the regulatory subject matter of various provisions, 
including in connection with data subjects’ right of access under Article 15(1)(h) 
of the GDPR, data subjects’ right to object in the final clause of the first sentence 
of Article 21(1) of the GDPR and – in essence – in Article 22 of the GDPR as a 
general prohibition (Article 22(1) of the GDPR) subject to exceptions 
(Article 22(2) of the GDPR), where decisions are based solely on profiling. 
5 As a regulation under EU law within the meaning of the second paragraph of 
Article 288 TFEU, the General Data Protection Regulation has general 
application, is binding in its entirety and directly applicable in all Member States. 
Despite those principles, the General Data Protection Regulation contains various 
‘saving clauses’, which give the Member States a certain amount of leeway for 
national legislation. Against the background of those delegated normative powers, 
the new Federal Law on data protection entered into force on 25 May 2018. 
Paragraph 31 of the BDSG contains detailed provisions on scoring and credit 
reports. 
II. 
1. The Charter of Fundamental Rights of the European Union – ‘the 
Charter’ – (OJ 2016 C 202, p. 389) provides as follows: 
6 Article 7 of the Charter – Respect for private and family life 
SCHUFA HOLDING 
 
5 
Anonymised version 
Everyone has the right to respect for his or her private and family life, home and 
communications. 
7 Article 8 of the Charter – Protection of personal data 
1. Everyone has the right to the protection of personal data concerning him or 
her. 
2. Such data must be processed fairly for specified purposes and on the basis 
of the consent of the person concerned or some other legitimate basis laid down 
by law. Everyone has the right of access to data which has been collected 
concerning him or her, and the right to have it rectified. 
3. Compliance with these rules shall be subject to control by an independent 
authority. 
8 Article 52 of the Charter – Scope and interpretation of rights and principles 
1. Any limitation on the exercise of the rights and freedoms recognised by this 
Charter must be provided for by law and respect the essence of those rights and 
freedoms. Subject to the principle of proportionality, limitations may be made 
only if they are necessary and genuinely meet objectives of general interest 
recognised by the Union or the need to protect the rights and freedoms of others. 
[…] 
2. The Treaty on the Functioning of the European Union (TFEU) provides 
(in the consolidated version of 7 June 2016, OJ C 202, p. 1, 47) as follows: 
9 Article 288 TFEU 
[…] 
2. A regulation shall have general application. It shall be binding in its entirety 
and directly applicable in all Member States. 
3. The General Data Protection Regulation (Regulation (EU) 2016/679 of 
the European Parliament and of the Council of 27 April 2016 on the protection of 
natural persons with regard to the processing of personal data and on the free 
movement of such data, and repealing Directive 95/46/EC (General Data 
Protection Regulation; ‘the GDPR’; OJ 2016 L 119, p. 1) provides as follows: 
10 Article 4 of the GDPR – Definitions 
For the purposes of this Regulation: 
[…] 
REQUEST FOR A PRELIMINARY RULING OF 1. 10. 2021 – CASE C-634/21 
 
6  
Anonymised version 
4. ‘profiling’ means any form of automated processing of personal data 
consisting of the use of personal data to evaluate certain personal aspects relating 
to a natural person, in particular to analyse or predict aspects concerning that 
natural person's performance at work, economic situation, health, personal 
preferences, interests, reliability, behaviour, location or movements; 
11 Article 6 of the GDPR – Lawfulness of processing 
1. Processing shall be lawful only if and to the extent that at least one of the 
following applies: 
(a) the data subject has given consent to the processing of his or her personal 
data for one or more specific purposes; 
(b) processing is necessary for the performance of a contract to which the data 
subject is party or in order to take steps at the request of the data subject 
prior to entering into a contract; 
(c) processing is necessary for compliance with a legal obligation to which the 
controller is subject; 
(d) processing is necessary in order to protect the vital interests of the data 
subject or of another natural person; 
(e) processing is necessary for the performance of a task carried out in the 
public interest or in the exercise of official authority vested in the controller; 
(f) processing is necessary for the purposes of the legitimate interests pursued 
by the controller or by a third party, except where such interests are 
overridden by the interests or fundamental rights and freedoms of the data 
subject which require protection of personal data, in particular where the 
data subject is a child. 
Point (f) of the first subparagraph shall not apply to processing carried out by 
public authorities in the performance of their tasks. 
2. Member States may maintain or introduce more specific provisions to adapt 
the application of the rules of this Regulation with regard to processing for 
compliance with points (c) and (e) of paragraph 1 by determining more precisely 
specific requirements for the processing and other measures to ensure lawful and 
fair processing including for other specific processing situations as provided for 
in Chapter IX. 
3. The basis for the processing referred to in point (c) and (e) of paragraph 1 
shall be laid down by: 
(a) Union law; or 
(b) Member State law to which the controller is subject. 
SCHUFA HOLDING 
 
7 
Anonymised version 
The purpose of the processing shall be determined in that legal basis or, as 
regards the processing referred to in point (e) of paragraph 1, shall be necessary 
for the performance of a task carried out in the public interest or in the exercise of 
official authority vested in the controller. That legal basis may contain specific 
provisions to adapt the application of rules of this Regulation, inter alia: the 
general conditions governing the lawfulness of processing by the controller; the 
types of data which are subject to the processing; the data subjects concerned; the 
entities to, and the purposes for which, the personal data may be disclosed; the 
purpose limitation; storage periods; and processing operations and processing 
procedures, including measures to ensure lawful and fair processing such as 
those for other specific processing situations as provided for in Chapter IX. The 
Union or the Member State law shall meet an objective of public interest and be 
proportionate to the legitimate aim pursued. 
4. Where the processing for a purpose other than that for which the personal data 
have been collected is not based on the data subject's consent or on a Union or 
Member State law which constitutes a necessary and proportionate measure in a 
democratic society to safeguard the objectives referred to in Article 23(1), the 
controller shall, in order to ascertain whether processing for another purpose is 
compatible with the purpose for which the personal data are initially collected, 
take into account, inter alia: 
(a) any link between the purposes for which the personal data have been 
collected and the purposes of the intended further processing; 
(b) the context in which the personal data have been collected, in particular 
regarding the relationship between data subjects and the controller; 
(c) the nature of the personal data, in particular whether special categories of 
personal data are processed, pursuant to Article 9, or whether personal data 
related to criminal convictions and offences are processed, pursuant to 
Article 10; 
(d) the possible consequences of the intended further processing for data 
subjects; 
(e) the existence of appropriate safeguards, which may include encryption or 
pseudonymisation. 
12 Article 15 of the GDPR – Right of access by the data subject 
1. The data subject shall have the right to obtain from the controller 
confirmation as to whether or not personal data concerning him or her are being 
processed, and, where that is the case, access to the personal data and the 
following information: […] 
(h) the existence of automated decision-making, including profiling, referred to in 
Article 22(1) and (4) and, at least in those cases, meaningful information about 
REQUEST FOR A PRELIMINARY RULING OF 1. 10. 2021 – CASE C-634/21 
 
8  
Anonymised version 
the logic involved, as well as the significance and the envisaged consequences of 
such processing for the data subject. 
13 Article 21 of the GDPR – Right to object 
1. The data subject shall have the right to object, on grounds relating to his or 
her particular situation, at any time to processing of personal data concerning 
him or her which is based on point (e) or (f) of Article 6(1), including profiling 
based on those provisions. 
[…] 
14 Article 22 of the GDPR – Automated individual decision-making, including 
profiling 
1. The data subject shall have the right not to be subject to a decision based 
solely on automated processing, including profiling, which produces legal effects 
concerning him or her or similarly significantly affects him or her. 
2. Paragraph 1 shall not apply if the decision: 
(a) is necessary for entering into, or performance of, a contract between the 
data subject and a data controller; 
(b) is authorised by Union or Member State law to which the controller is 
subject and which also lays down suitable measures to safeguard the data 
subject's rights and freedoms and legitimate interests; or 
(c) is based on the data subject’s explicit consent. 
3. In the cases referred to in points (a) and (c) of paragraph 2, the data 
controller shall implement suitable measures to safeguard the data subject's rights 
and freedoms and legitimate interests, at least the right to obtain human 
intervention on the part of the controller, to express his or her point of view and to 
contest the decision. 
4. Decisions referred to in paragraph 2 shall not be based on special 
categories of personal data referred to in Article 9(1), unless point (a) or (g) of 
Article 9(2) applies and suitable measures to safeguard the data subject’s rights 
and freedoms and legitimate interests are in place. 
4. The Bundesdatenschutzgesetz (Federal Law on data protection) of 30 June 
2017 (BGBl. I. p. 2 097, as amended by Article 12 of the Law of 20 November 
2019, BGBl. I., p. 1 626) provides as follows: 
15 Paragraph 31 of the BDSG – Protection of trade and commerce in the context 
of scoring and credit reports 
SCHUFA HOLDING 
 
9 
Anonymised version 
(1) The use of a probability value regarding specific future behaviour of a natural 
person for the purpose of deciding on the establishment, implementation or 
termination of a contractual relationship with that person (scoring) shall be 
permissible only if 
1. the provisions of data protection law have been complied with, 
2. the data used to calculate the probability value are demonstrably 
relevant to the calculation of the probability of the specific behaviour, 
on the basis of a scientifically recognised mathematical statistical 
method, 
3. the data used for the calculation of the probability value were not 
exclusively address data, and 
4. where address data are used, the data subject has been notified of the 
intended use of such data before the calculation of the probability 
value; the notification must be documented. 
(2) The use of a probability value determined by credit information agencies 
in relation to a natural person’s ability and willingness to pay shall, in the 
case where information about claims against that person is taken into 
account, be permissible only if the conditions under subparagraph 1 are met 
and claims relating to a performance owed but not rendered despite falling 
due are taken into account only if they are claims 
1. which have been established by a judgment which has become final or 
has been declared provisionally enforceable or for which there is a 
debt instrument pursuant to Paragraph 794 of the Zivilprozessordnung 
[Code of Civil Procedure]; 
2. which have been established in accordance with Paragraph 178 of the 
Insolvenzordnung [Insolvency Code] and not contested by the debtor 
at the meeting for verification of claims; 
3. which the debtor has expressly acknowledged; 
4. in respect of which 
a) the debtor has been given formal notice in writing at least twice 
after the claim fell due; 
b) the first formal notice was given at least four weeks previously; 
c) the debtor has been informed in advance, but at the earliest at 
the time of the first formal notice, of the possibility that the claim 
might be taken into account by a credit information agency and 
d) the debtor has not contested the claim or 
REQUEST FOR A PRELIMINARY RULING OF 1. 10. 2021 – CASE C-634/21 
 
10  
Anonymised version 
5. whose underlying contractual relationship may be terminated without 
notice on the ground of arrears in payment and in respect of which the 
debtor has been informed in advance of the possibility that account 
might be taken of them by a credit information agency. 
The permissibility of the processing – including the determination of 
probability values – of other data relevant to creditworthiness under general 
data protection law remains unaffected. 
III. 
16 In the present case, the question relevant to the resolution of the dispute is whether 
the activity of credit information agencies, such as the joined party, of establishing 
scores in relation to data subjects and transmitting them, without making any 
further recommendation or comment, to third parties who, taking those scores into 
account to a significant extent, enter into a contract with the data subject or refrain 
from doing so falls within the scope of Article 22(1) of the GDPR. This is 
because, in that case, the permissibility of the establishment of a final score by a 
credit information agency, such as the joined party, in order to be transmitted to 
another party can be determined only on the basis Article 22(2)(b) of the GDPR, 
read in conjunction with Paragraph 31 of the BDSG, whereby – if the data subject 
lodges a complaint with the competent supervisory authority, as has been done in 
the present case – the provisions will then at the same time constitute the standard 
against which the credit information agency’s activity is reviewed by the 
supervisory authority. In turn, the decisive question in that regard is whether a 
provision with the content of Paragraph 31 of the BDSG is compatible with 
Article 22(2)(b) of the GDPR. This is because, if it is not, the legal standard of 
review taken as the basis by the defendant vis-à-vis the joined party in the present 
case would not in fact exist. 
Question 1: 
Applicability of Article 22(1) of the GDPR to credit information agencies 
17 According to Article 22(1) of the GDPR, the data subject has the right not to be 
subject to a decision based solely on automated processing, including profiling, 
which produces legal effects concerning him or her or similarly significantly 
affects him or her. The provision is modelled on the predecessor provision, 
Article 15 of Directive 95/46/EC. According to its wording, it appears to establish 
a right of the data subject that must be exercised in order to exist. By contrast, the 
referring court takes the view that the provision establishes a general prohibition, 
the infringement of which does not require that it be invoked on an individual 
basis. 
18 Activities such as the contested automated compilation of personal data – as 
carried out by the joined party – in order to determine a probability value 
regarding specific future behaviour of a natural person for the purpose of deciding 
on the establishment, implementation or termination of a contractual relationship 
SCHUFA HOLDING 
 
11 
Anonymised version 
with that person fall within the scope of the regulatory regime of Article 22(1) of 
the GDPR, depending, in any event, on the content of the activity concerned. 
According to its clear wording, the provision covers not only, but also, decisions 
taken on the basis of profiling (see also the second sentence of recital 71). 
Profiling is legally defined in point 4 of Article 4 of the GDPR as any form of 
automated processing of personal data consisting of the use of those personal data 
to evaluate certain personal aspects relating to an individual, in particular to 
analyse or predict aspects concerning that individual’s performance at work, 
economic situation, health, personal preferences, interests, reliability, behaviour, 
location or movements. 
19 The establishment of scores meets the criteria of that definition. That conclusion is 
also supported by the second sentence of recital 71, according to which profiling 
is to be understood as including, in particular, the analysis or prediction of aspects 
relating to a person’s economic situation, reliability or behaviour. Moreover, the 
first sentence of recital 71 cites the automatic refusal of an online credit 
application as an example of decisions within the meaning of Article 22(1) of the 
GDPR. In that respect, Article 22(1) of the GDPR is in principle applicable to 
cases such as the present one, in any event in light of the fact that, in accordance 
with the intention of the legislature, the establishment of a score is a sub-category 
of profiling within the meaning of point 4 of Article 4 of the GDPR. 
20 The referring court considers, in essence, that it is evident that, furthermore, the 
constituent element required by Article 22(1) of the GDPR – a decision based 
solely on automated processing – is also present in cases such as the present one. 
This is not precluded by the fact that, in accordance with the recitals, the 
determination of scores, which, according to the above statements, is the main 
activity of credit information agencies – such as the joined party – is intended to 
be a sub-category of profiling. It is true that the legislature clearly intended not to 
regulate the permissibility of profiling under data protection law independently via 
Article 22(1) of the GDPR, but only to address it in that respect in conjunction 
with another element, so to speak, in so far as it forms part of a decision based on 
an automated decision. This follows from the very wording of the provision, 
which, for the purposes of the prohibition laid down therein, largely focuses on 
decisions based on profiling – or other form of automated data processing – but 
not on profiling itself. 
21 However, the referring court proceeds on the assumption that the establishment of 
a score by a credit information agency is not merely profiling that serves to 
prepare the decision of the third-party controller, but constitutes an independent 
‘decision’ within the meaning of Article 22(1) of the GDPR. 
22 In view of the wording of Article 22(1) of the GDPR, the referring court is aware 
in that respect that, interpreted restrictively, the provision can be understood, and 
is also widely understood, in such a way that it does not apply directly to the 
activities of credit information agencies such as the joined party. However, the 
referring court takes the view that such an assumption is based on an incorrect 
REQUEST FOR A PRELIMINARY RULING OF 1. 10. 2021 – CASE C-634/21 
 
12  
Anonymised version 
understanding of the activity of credit information agencies and the influence of 
the scores that they establish. This is because the assumption is based on the idea 
that credit information agencies do not make the decision relevant for the purposes 
of Article 22(1) of the GDPR themselves, because, in obtaining and compiling 
personal data for the purpose of building a profile and determining a final score on 
that basis, they merely prepare, so to speak, the final decision of the data 
controller, but, when they transmit the score, they typically do not also accompany 
it with a recommendation to the third-party controller as to whether or not the 
latter should enter into a contract with the data subject. 
23 In its provisions and recitals, the GDPR makes a conceptual distinction between 
processing on the one hand and a decision based on the processing on the other 
hand, and precisely does not seek to establish any independent substantive 
provisions on profiling. Accordingly, point 4 of Article 4 of the GDPR provides 
that profiling within the meaning of the GDPR is ‘any form of automated 
processing of personal data … to evaluate certain personal aspects relating to a 
natural person’. The wording of the legal definition might therefore be understood 
to mean that profiling does not only determine the parameters for the result of the 
evaluation, but also includes that result. With regard to the present case, this might 
also be understood to encompass the automated compilation of individual 
characteristics with the aim of enabling a credit information agency to derive and 
actually determine an overall score. Such an understanding of the concept of 
profiling might also be in line with the first sentence of Article 21(1) of the 
GDPR, in accordance with which the data subject’s right to object relates to any 
processing and, in accordance with the final clause of that sentence, in particular 
also to profiling based on the provisions of the GDPR. The differentiation 
between automated processing by means of profiling on the one hand and 
decisions on the other hand is ultimately apparent above all from Article 22(1) of 
the GDPR. In providing that a data subject has the right ‘not to be subject to a 
decision based solely on automated processing, including profiling’, Article 22(1) 
of the GDPR expressly establishes a causal link and a chronologically fixed 
sequence between automated processing (including profiling) and then the 
decision based on it. The legislature’s intention to draw a distinction between the 
two notions is further supported by the first and second sentences of recital 71. 
While the first sentence of recital 71 states that the data subject is to have the right 
not to be subject to a decision evaluating personal details relating to him or her 
which is based solely on automated processing, the second sentence of recital 71 
supplements that presumption by stating that ‘such processing’ – and thus not 
‘decisions’ – includes profiling. By contrast, the first sentence of recital 71 cites 
the automatic rejection of a credit application as an example of a ‘decision’, 
thereby addressing, in general terms, the situation in the present case in so far as 
the credit institution’s rejection decision vis-à-vis the applicant is the relevant 
‘decision’, not the establishment of the score by the joined party. Therefore, the 
wording of the first sentence of Article 21(1), Article 22(1), point 4 of Article 4, 
and the first and second sentences of recital 71 and recital 72 of the GDPR might 
in any event be interpreted as meaning that situations such as that underlying the 
main proceedings, in which a credit information agency determines a score, 
SCHUFA HOLDING 
 
13 
Anonymised version 
involve ‘processing’, but not a ‘decision’ within the meaning of Article 22(1) of 
the GDPR. 
24 However, the referring court has considerable doubts about such a restrictive 
interpretation of Article 22(1) of the GDPR. It considers that there are strong 
indications suggesting that the automated establishment of a score by credit 
information agencies for the prognostic evaluation of a data subject’s financial 
capacity is an independent decision based on automated processing within the 
meaning of Article 22(1) of the GDPR. The referring court bases its doubts, from 
a factual point of view, on the importance that the score established by credit 
information agencies has for the decision-making practice of third-party 
controllers and, from a legal point of view, largely on the purposes pursued by 
Article 22(1) of the GDPR and the legal protection guaranteed by Article 87 et 
seq. of the GDPR: 
25 From a factual point of view, the referring court has serious concerns about the 
assumption that, in the case where there is a score relating to a data subject, third-
party controllers make the individual decision based solely on automation, as 
required by Article 22(1) of the GDPR. Even though, at least from a purely 
hypothetical point of view, third-party controllers can make their own decision as 
to whether and how to enter into a contractual relationship with the data subject, 
because an individual decision taken with the involvement of human beings is in 
principle still possible at that stage of the decision-making process, that decision is 
in practice determined by the score transmitted by credit agencies to such a 
considerable extent that the score penetrates through the decision of the third-
party controller, so to speak. In other words: it is ultimately the score established 
by the credit information agency on the basis of automated processing that 
actually decides whether and how the third-party controller enters into a contract 
with the data subject. Although the third-party controller does not have to make 
his or her decision dependent solely on the score, he or she usually does so to a 
significant extent. While it is true that, even where a score is in principle 
sufficient, a loan may be refused (for other reasons, such as a lack of collateral or 
doubts as to the success of an investment to be financed), an insufficient score will 
lead to the refusal of a loan, at least in the context of consumer loans, in almost 
every case and even if, for instance, an investment otherwise appears to be 
worthwhile. Experience from the data protection supervision carried out by the 
authorities shows that the score plays the decisive role in the granting of loans and 
in determining the conditions under which they are granted […] [reference]. 
26 However, Article 22(1) of the GDPR – subject to the exceptions in Article 22(2) 
of the GDPR – is intended precisely to protect the data subject from the dangers of 
that form of decision-making based purely on automation. The aim of the 
legislature is to prevent decision-making from taking place without individual 
assessment and evaluation by a human being. The data subject should not be at the 
mercy of an exclusively technical and non-transparent process without being able 
to understand the underlying assumptions and evaluation standards and to 
intervene, if necessary, by exercising his or her rights. In addition to affording 
REQUEST FOR A PRELIMINARY RULING OF 1. 10. 2021 – CASE C-634/21 
 
14  
Anonymised version 
protection against discriminatory decisions based on supposedly objective data 
processing programmes, the regulatory aim is to create transparency and fairness 
in the decision-making process. Decisions on the exercise of individual freedoms 
should not be left, unchecked, to the logic of algorithms. This is because 
algorithms work with correlations and probabilities that do not necessarily follow 
a causal link or lead to results that are ‘correct’ when judged with human insight. 
On the contrary, incorrect, unfair or discriminatory conclusions can be drawn 
from the systematisation of accurate individual data, which – if they become the 
basis of a decision-making process – significantly affect the freedoms afforded to 
the data subject and reduce him or her from being the subject to being the object 
of a depersonalised decision. This is particularly true where the data subject is not 
aware of the use of algorithms or – even if he or she is aware of it – is not able to 
have a clear view of which data are included in the decision, with what weighting 
and by means of which analytical methods. However, it is precisely that aim of the 
legislature to make a human corrective for automated data processing mandatory 
in principle and to allow derogations only in limited exceptional cases 
(Article 22(2) of the GDPR) that is thwarted, because, as a general rule, the 
automatically established score plays a dominant role in the decision-making 
process of the third-party controller. 
27 By means of the prohibition contained in Article 22(1) of the GDPR, the 
legislature sought to resolve that basic conflict ‘at the expense’ of third-party 
controllers, so to speak, by taking the (final) decision addressed to the data subject 
as the basis. In that respect, procedural requirements for profiling are formulated 
only in the sixth sentence of recital 71, which is relevant to profiling. Aside from 
that, however, the permissibility of data processing for the purpose of profiling 
arises at best from the general criteria for lawful processing in Article 6(1) of the 
GDPR. This follows both from the final clause of the first sentence of 
Article 21(1) of the GDPR, which refers to points (e) and (f) of Article 6(1) of the 
GDPR as a possible legal basis for profiling, and from the first sentence of 
recital 72, according to which profiling is subject to the rules of the GDPR 
governing the processing of personal data, and thus also to the legal grounds for 
processing or data protection principles. 
28 These merely ‘skeletal’ requirements of the GDPR for profiling on the one hand 
and the fundamental premiss arising from Article 22(1) of the GDPR on the other 
hand give rise, in particular, to the problem of effective enforcement of rights by 
data subjects. It is – alongside the supervisory control mechanism – the GDPR’s 
key mechanism for the enforcement of rights. This is shown not only by the well-
balanced and comprehensively regulated rights to object and to bring an action 
under Article 87 et seq. of the GDPR, but also by the data subject’s rights 
underpinning them under Article 12 et seq. of the GDPR. The aim of the GDPR is 
to enable and mobilise the responsible EU citizen to enforce his or her rights by 
means of appropriate provisions, in particular on rights of access and transparency 
requirements. 
SCHUFA HOLDING 
 
15 
Anonymised version 
29 Those rights are undermined by the interplay of, on the one hand, the activities 
and (lack of) obligations of credit information agencies and, on the other hand, the 
decision-making practices of third-party controllers. Although the data subject has 
a general right of access vis-à-vis credit information agencies under Article 15 of 
the GDPR, it does not do justice to the particularities of profiling, which the 
GDPR does indeed seek to address through Article 15(1)(h), the final clause of the 
first sentence of Article 21(1) and Article 22 of the GDPR. This is because, in the 
context of the general right of access, credit information agencies are not obliged 
to disclose the logic and composition of the parameters that are decisive for the 
establishment of the score; they also refrain from doing so for reasons pertaining 
to the protection of competition, invoking their commercial and industrial secrecy. 
30 The third-party controller is also unable to provide the data subject with 
information about how the score is established – even though it plays a decisive 
role in its decision – because it is not aware of the logic involved; it is not 
disclosed to it by the credit information agency. 
31 This gives rise to a lacuna in the legal protection: the party from whom the 
information required for the data subject could be obtained is not obliged to 
provide access to information under Article 15(1)(h) of the GDPR because it 
allegedly does not engage in its own ‘automated decision-making’ within the 
meaning of Article 15(1)(h) of the GDPR, and the party that bases its decision-
making on the score established by means of automation and is obliged to provide 
access to information under Article 15(1)(h) of the GDPR cannot provide the 
required information because it does not have it. 
32 If the establishment of the score by a credit information agency were to fall within 
the scope of Article 22(1) of the GDPR, that lacuna in the legal protection would 
be filled. Accordingly, the establishment of scores would not only fall within the 
scope of the prohibition under Article 22(1) of the GDPR, with the result that, 
being based solely on automated processing, it would be permissible only if it met 
the criteria for an exception under Article 22(2) of the GDPR, and it would 
therefore be in line with the EU legislature’s intention for such decisions to be at 
least covered by legislation. In the light of the saving clause in Article 22(2)(b) of 
the GDPR, such an approach would also enable the Member States to regulate 
such decision-making in detail, which they are not permitted to do under the 
existing provisions of the GDPR governing profiling and automated decision-
making (see Question 2). 
33 The lacuna in the legal protection is also not sufficiently filled by the data 
subject’s right to object under the final clause of the first sentence of Article 21(1) 
of the GDPR. It is true that, according to that provision, the data subject is to have 
the right ‘to object, on grounds relating to his or her particular situation, at any 
time to processing of personal data concerning him or her which is based on point 
(e) or (f) of Article 6(1), including profiling based on those provisions’. However, 
in the case of credit information agencies, the data subject typically does not know 
that he or she has become the subject of an automated scoring process. The data 
REQUEST FOR A PRELIMINARY RULING OF 1. 10. 2021 – CASE C-634/21 
 
16  
Anonymised version 
subject will typically not become aware of that circumstance until a third-party 
controller has already made a decision which is unfavourable to him or her, in 
which reference is made to the score. At that point, however, the right to object is 
no longer of any help to the data subject, at least with regard to a case which has 
been closed; in that respect, the data subject can exercise that right only with 
regard to data processing that the credit information agency carries out in the 
future. 
Question 2: 
Member State legislation on scoring 
34 Under Paragraph 31(1) of the BDSG, the permissibility of the use of a probability 
value regarding specific future behaviour of a natural person for the purpose of 
deciding on the establishment, implementation or termination of a contractual 
relationship with that person (scoring) is dependent on the fulfilment of further 
conditions. Under Paragraph 31(2) of the BDSG, the use of a probability value 
determined by credit agencies in relation to a natural person’s ability and 
willingness to pay is, in the case where information about claims against that 
person is taken into account, permissible only if the conditions under 
Paragraph 31(1) of the BDSG are met and claims relating to a performance owed 
but not rendered despite falling due are taken into account only if they meet 
further specific conditions, whereby the permissibility of the processing – 
including the determination of probability values – of other data relevant to 
creditworthiness under general data protection law remains unaffected. 
35 Therefore, in Paragraph 31 of the BDSG, the German legislature establishes, in 
essence, rules on scoring as a sub-category of profiling. The referring court has 
considerable doubts as to the compatibility of those rules with Article 22 of the 
GDPR, because the German legislature regulates only the ‘use’ of the ‘probability 
value’, but not the establishment of the probability value itself. 
36 Paragraph 31 of the BDSG is definitive in so far as it makes profiling part of its 
regulatory subject matter only to the extent that it forms the basis of a decision 
based on it. Accordingly, however, the reference point for the prohibition is only 
the decision, not the profiling preceding it. Neither Article 22 of the GDPR nor 
other provisions of the GDPR establish specific substantive requirements for the 
lawfulness of data processing for the purpose of profiling in the form of scoring 
itself. With regard to profiling, there are otherwise only provisions on information 
obligations in Article 14(2)(g) of the GDPR, on the right of access in 
Article 15(1)(h) of the GDPR – but in each case only in relation to the existence of 
automated decision-making, not to profiling itself – and on the data subject’s right 
to object in the final clause of the first sentence of Article 21(1) of the GDPR and 
in other provisions that are not relevant to the present case. 
37 Therefore, in the absence of specific provisions, the permissibility of profiling, in 
so far as it is not covered as scoring by Article 22 of the GDPR by virtue of the 
SCHUFA HOLDING 
 
17 
Anonymised version 
decision based on such scoring, is otherwise governed by the general criteria for 
lawful processing in Article 6 of the GDPR. By attaching further-reaching 
substantive permissibility requirements to scoring, the German legislature 
specifies the regulatory subject matter in a manner that goes beyond the 
requirements of Articles 6 and 22 of the GDPR. However, it lacks the regulatory 
power to do so. 
38 In particular, such power cannot be derived from Article 22(2)(b) of the GDPR. 
The GDPR gives Member States normative powers in relation to profiling only 
where a decision is based solely on automated processing. By contrast, 
Paragraph 31 of the BDSG establishes, without any differentiation, provisions for 
non-automated decisions also, but, in those provisions, it regulates the 
permissibility of the use of data processing for scoring. However, according to the 
scheme of Article 22 of the GDPR and the general criteria for lawful processing in 
Article 6 of the GDPR, the permissibility of decisions that are not based on 
automated processing, including profiling, is governed by Article 6 of the GDPR. 
That regulatory subject matter is beyond the reach of the national legislatures – 
irrespective of whether that circumstance is to be regarded as a deliberate 
deprivation of regulatory power by the EU legislature. The latter clearly did not 
intend to establish more specific requirements for profiling either. Thus, the 
Member State legislature cannot simply do so itself – and can in any event do so 
within the framework of Article 22(2)(b) of the GDPR only if the provisions of 
the Member State lay down legal requirements only for decisions based solely on 
automated processing. 
39 This is true in particular against the background that the GDPR is a regulation 
within the meaning of the second paragraph of Article 288 TFEU. In accordance 
with settled case-law of the Court of Justice, the national legislature is already 
precluded from making legally definitive evaluations – in casu, Paragraph 31 of 
the BDSG – in relation to abstractly framed requirements of the EU legislature – 
in casu, Articles 6 and 22 of the GDPR – with regard to requirements laid down 
by directives (CJEU, judgment of 19 October 2016, Breyer v Germany, C-582/14, 
EU:C:2016:779, paragraphs 62 and 63). Accordingly, this must apply a fortiori to 
requirements laid down – as in the present case – in regulations. 
40 Significantly, the German legislature does not specify in its explanatory 
memorandum to Paragraph 31 of the BDSG what its regulatory competence is 
based on with regard to that provision. The explanatory memorandum to that law 
contains more or less general statements to the effect that the provision 
incorporates the predecessor provisions of Paragraphs 28a and 28b of the BDSG, 
old version, and the substantive provisions remain relevant. By contrast, the draft 
bill of the Federal Ministry of the Interior of 11 November 2016, pp. 93 and 94, 
also asserted that the Member States’ regulatory power arises from a ‘combined 
reading of Article 6(4) and Article 23(1)’ of the GDPR. However, that line of 
thinking – which is untenable per se – was clearly abandoned in the course of the 
legislative process. 
REQUEST FOR A PRELIMINARY RULING OF 1. 10. 2021 – CASE C-634/21 
 
18  
Anonymised version 
IV. 
41 In the light of the foregoing, it is necessary to request a preliminary ruling from 
the Court of Justice of the European Union. The outcome of the dispute depends 
on the questions referred. 
42 The proceedings depend on Question 1. If Article 22(1) of the GDPR were to be 
interpreted as meaning that the establishment of a score by a credit agency is an 
independent decision within the meaning of Article 22(1) of the GDPR, that 
activity – which is the main activity of such an agency – would be subject to the 
prohibition of automated individual decisions. Consequently, it would require a 
legal basis under Member State law within the meaning of Article 22(2)(b) of the 
GDPR, in respect of which only Paragraph 31 of the BDSG enters into 
consideration. However, there are serious concerns as to the compatibility of that 
provision with Article 22(1) of the GDPR. If it were not compatible, the joined 
party would not only act without a legal basis, but would also violate ipso iure the 
prohibition laid down in Article 22(1) of the GDPR. As a result, the applicant 
would at the same time have a claim against the defendant by which she could 
seek its (further) involvement in her case in a supervisory capacity. 
43 If Question 1 were to be answered in the negative, that is to say, profiling itself is 
not a decision within the meaning of Article 22(1) and (2) of the GDPR, the 
saving clause in Article 22(2)(b) of the GDPR would also not apply to national 
legislation on profiling. Due to the fact that the GDPR, which is designed to 
achieve full harmonisation, is in principle exhaustive in nature, a different 
regulatory power for national legislation must therefore be sought. Since, 
however, as stated above, such power is not apparent and does not arise, in 
particular, from the rudimentary provisions of the GDPR, the national legislation 
laid down in Paragraph 31 of the BDSG is not applicable, and this changes the 
scope of examination of the national supervisory authority, which would then 
have to assess the compatibility of the activities of credit information agencies 
against Article 6 of the GDPR. 
V. 
44 This order is not open to appeal. 
[…] 
Wiesbaden, 7 October 2021 
[…] [Signatures; official copies]