Background
The defendant operates a credit-reporting agency that uses stored personal and financial data in mathematical-statistical scoring procedures. It assigns individuals to statistical groups and produces probability values intended to help customers assess prospective counterparties’ likely payment behavior. In May 2023, the agency gave the plaintiff, a private individual, information about his stored data, scores disclosed to customers during the preceding twelve months, and a base score of 93.92%.
The plaintiff sought further information explaining how his base score, sector-specific scores, and guidance score had been calculated, including the personal characteristics used, the relative weighting of criteria, and the meaning of the resulting values. The Leipzig Regional Court rejected those claims. On appeal, the Dresden Higher Regional Court ordered the agency to provide specified information about influential criteria, their weighting, the meaning of the scores, and the data and criteria used for the base score, and awarded limited pre-litigation legal fees. The agency appealed to the Federal Court of Justice.
The Court’s Holding
The Federal Court of Justice vacated the appellate judgment insofar as it ruled against the agency and remanded the case. It held that a claim for meaningful information under Article 15(1)(h), read with Article 22(1), of the GDPR requires all three elements of Article 22(1): a decision, based exclusively on automated processing, that produces legal effects for the data subject or similarly significantly affects that person. Producing a credit score qualifies as a decision and constitutes automated profiling, but the appellate court failed to determine whether each disputed score materially influenced a third party’s decision to enter into, perform, or terminate a contractual relationship with the plaintiff.
The plaintiff bears the burden of establishing those elements, although the court cautioned against imposing excessive evidentiary demands. Evidence that the agency transmitted a score to a company and that the plaintiff suffered an adverse contractual decision in temporal proximity creates a factual presumption that the score materially influenced that decision; the agency may rebut that presumption. A base score calculated only for the individual and not disclosed to third parties would ordinarily fail the significant-effect requirement.
The court also held that parts of the appellate decree were too indefinite, particularly its references to criteria influencing a score “most strongly” and to the score’s “informative value.” If Article 15(1)(h) applies, however, the agency’s existing disclosure was insufficient: it must intelligibly explain how it evaluated the data categories and weighted them relative to one another, including apparent discrepancies among scores. It need not disclose its algorithm, enable mathematical reconstruction of the scores, or provide scientific validation of them.
Key Takeaways
- A GDPR scoring-explanation claim requires proof that the automated score produced legal effects or similarly significantly affected the claimant; automated profiling alone is insufficient.
- A transmitted score followed closely by an adverse contractual decision gives rise to a rebuttable factual presumption that the score materially influenced the decision.
- Required explanations must make the applied data, evaluation criteria, and relative weighting understandable, but need not reveal the algorithm or permit mathematical reproduction of the score.
Why It Matters
The decision defines both the threshold and the practical evidentiary framework for GDPR access claims against credit-reporting agencies. It prevents Article 15(1)(h) from applying to every internally generated profile while making it feasible for individuals to prove significant effects when the decisive information lies largely with the agency and its customer.
For credit scorers, the ruling confirms that generic descriptions of data categories and risk symbols may not suffice. Where Article 22(1) applies, explanations must connect the individual’s data to the evaluations and weighting that produced the score, subject to balancing any genuine trade-secret interests against the data subject’s access rights.