ECJ: General Data Protection Regulation opposes data processing practices

In two decisions the European Court of Justice (ECJ) held that the General Data Protection Regulation (GDPR) opposes two data processing practices by credit information agencies. While ‘scoring’ is permitted only under certain conditions, the prolonged retention of information relating to the granting of a discharge from remaining debts is contrary to the GDPR.

Background

Several members of the public are challenging the refusal of the competent data protection commissioner to take action against certain activities of SCHUFA, a private company providing credit information for clients including banks, before the Administrative Court of Wiesbaden (Germany). Specifically, they are opposed to ‘scoring’ and to the storage of information relating to the granting of a discharge from remaining debts taken from public registers.

‘Scoring’ is a mathematical statistical method used to predict the probability of future behavior, such as the repayment of a loan. Information relating to the granting of a discharge from remaining debts is kept in the German public insolvency register for six months, while a code of conduct for German credit information agencies stipulates a retention period of three years for their own databases.

ECJ decision

As regards ‘scoring’, the Court holds that it must be regarded as an ‘automated individual decision’ prohibited in principle by the GDPR, insofar as SCHUFA’s clients, such as banks, attribute to it a determining role in the granting of credit. According to the Administrative Court of Wiesbaden, this is the case. It is for that court to assess whether the German Federal Law on data protection contains a valid exception to that prohibition in accordance with the GDPR.

As regards information relating to the granting of a discharge from remaining debts, the Court considers that it is contrary to the GDPR for private agencies to keep such data for longer than the public insolvency register. The discharge from remaining debts is intended to allow the data subject to re-enter economic life and is therefore of existential importance to that person. Insofar as the retention of data is unlawful, as is the case beyond six months, the data subject has the right to have the data deleted and the agency is obliged to delete the data as soon as possible.

Source:

ECJ, judgments in case C-634/21|SCHUFA Holding (Scoring) and in joint cases C-26/22 and C-64/22 SCHUFA Holding (Discharge from remaining debts)

More details to be found in the ECJ PRESS RELEASE No 186/23 of 7 December 2023.