TEU: Credit bureaus break GDPR

The Court of Justice of the EU (TEU) announced on Thursday that credit rating can only be utilized under strict conditions. In another provision, the Court found that the retention of information on the exemption from the remaining part of the debt for a long period of time was incompatible with the general data protection regulation (GDPR).

The administrative court in Wiesbaden, Germany, has dealt with complaints concerning the refusal of action by the Data Protection Commissioner on the private credit information office of SCHUFA, which serves banks, among others. The complainants objected to practices known as ‘scoring’ and to the retention of information on the exemption from the remainder of the debt which had been taken over from public registers.

Scoring, i.e. a mathematical method statistically assessing the future behaviour of the borrower on the basis of probability, is utilized to find the chance to repay the debt in subsequent months. The Court of Justice considered that the scoring constitutes ‘automated decision-making in individual cases’, which is fundamentally prohibited by the GDPR, unless customers, like banks, delegate it a decisive function in granting credit.

As regards the retention of information on the waiver from the remainder of the debt, The Court found that it is contrary to the GDPR erstwhile private offices store this data longer than the public bankruptcy register. Exemption from the remaining part of the debt is crucial for the anticipation of re-engaging a individual into the economical life, so keeping this information for a long time is considered incompatible with the GDPR principles.

The Court noted that German law provides for the retention of these data for six months and that, after that period, the rights and interests of the individual prevail over the law and interest of the general public in having that information. In the event of unlawful retention after six months, the data subject shall have the right to request their deletion and the office shall be obliged to immediately comply with that request.

– As regards the simultaneous retention of specified information by SCHUFA for the six months, it is for the administrative court to balance the interests active in order to measure their legality. If a court concludes that parallel retention of data for six months is lawful, the data subject will, however, have the right to object to the processing of data and the right to erasure, unless SCHUFA demonstrates the existence of overriding legitimate grounds – indicated the TEU.

The Court besides stressed that national courts should be able to exercise full control over any legally binding decision of the data protection supervisory authority.

Legal basis: judgement of the Court of Justice: Case C-634/21, C-26/22 and C-64/22

Dear reader, we remind you that all legal matters in this substance we compose about can be complicated and frequently require the aid of a lawyer. It's worth discussing it with a lawyer before taking legal action.

Contact us now. We'll review your case and see precisely what we can do about you. Our experts have already helped a number of clients who thought they were already in an impossible situation.

Write us or call us now.

579-636-527
[email protected]

Daniel Głogowski

Publicist, author and social activist. The first articles were published in 1999 for global publishers. For more than 30 years, he has gained his experience through cooperation with the largest editorial offices. In his articles, he sought to address controversial themes and present first viewpoints that allowed for a deeper knowing of the issues discussed. Over the years, he gained a reputation as a reliable journalist. Contact: [email protected]