Schufa credit ratings: Relevant or not?

ECJ ruling - Schufa credit ratings: Relevant or not?

How powerful is Schufa? The credit agency uses huge amounts of data to calculate how creditworthy it considers individual consumers to be. Banks, online retailers, mobile phone providers, car dealerships, energy suppliers - they all want to know how good their customers' payment behavior is before contracts are concluded and goods are handed over.

Are the credit ratings from Wiesbaden decisive for this or just a building block in a complex verification process? The European Court of Justice (ECJ) ruled on this on Thursday: companies may not decide whether to conclude contracts with customers solely on the basis of an automated assessment of creditworthiness by Schufa.

What is Schufa?

Part of the business model of the "Schutzgemeinschaft für allgemeine Kreditsicherung" (Protection Association for General Credit Protection), which was founded in 1927, is to collect data. On the basis of this data, Schufa provides its approximately 10,000 contractual partners - including banks and savings banks, mail order companies and energy suppliers - with an assessment of the creditworthiness of consumers with a legitimate interest. According to its own information, Schufa has information on 68 million people in Germany. More than 90 percent of this information is "exclusively positive". The credit agency issues an average of 320,000 reports to companies every day. In addition to Schufa, there are other credit agencies such as Creditreform and Crif.

What data does Schufa collect?

Schufa receives information from its contractual partners about the opening of current accounts, the issuing of credit cards, the conclusion of leasing contracts and loans. Schufa also stores personal data such as name, date of birth and address, but has no information about a person's income, for example.

What does Schufa do with this data?

The data is used to calculate the basic score, which is updated on a quarterly basis. On a scale of 0 to 100 percent, this describes the probability of a consumer being able to meet financial obligations. The higher the score, the higher the creditworthiness. Anyone who regularly pays bills late and often receives reminders is rated lower.

Schufa does not disclose exactly how the score is calculated. Their argument: "If the calculation model were completely open, the score could be manipulated and would no longer have any value." However, the formula is "known to the responsible data protection authority and is monitored by it and independent scientists". Companies and individuals such as landlords can obtain information from Schufa.

What were the proceedings before the ECJ about?

Essentially, it was about the question of whether scoring in certain cases is equivalent to an automated decision that affects the data subject - in accordance with Article 22 of the European General Data Protection Regulation (GDPR). And how relevant a Schufa score is for a company's decision to grant a loan or contract or not.

The background to the proceedings before the ECJ were several cases from Germany. In one of them, a plaintiff who was refused a loan asked Schufa to delete an entry and grant her access to the data. Schufa informed the woman of her score value and general information on the calculation, but not the exact calculation method. The Wiesbaden Administrative Court referred the case to the ECJ in order to clarify the relationship with the GDPR. The regulation stipulates that decisions that have legal effect for data subjects may not be made solely by automated processing of data.

What did the ECJ decide?

The Court ruled that "scoring" is to be regarded as an "automated decision in individual cases", which is generally prohibited by the GDPR, if Schufa's customers, such as banks, attribute a decisive role to it in the context of granting credit. "In the opinion of the Wiesbaden Administrative Court, this is the case. It is for this court to assess whether the German Federal Data Protection Act contains a valid exception to this prohibition in accordance with the GDPR," the ECJ stated.

What is Schufa's position?

The credit agency argues that it does not make any decisions itself, for example on the granting of loans or the conclusion of a cell phone contract. Schufa supports its partners with information when making decisions. "Just because a score is important does not mean it is decisive," said Tanja Birkholz, CEO of Schufa Holding AG, in the run-up to Thursday's decision. The decision for or against a transaction is made by the company with which a consumer wishes to conclude a contract. When banks and savings banks grant loans, for example, further data such as regular income and expenditure as well as assets are usually included.

Accordingly, Schufa welcomed the ECJ ruling in an initial statement: "It provides clarity as to how payment forecasts (scores) may be used in the decision-making processes of companies within the meaning of the General Data Protection Regulation." As the "vast majority" of customers have reported back to the credit agency "that payment forecasts in the form of the Schufa score are important to them, but are generally not the only decisive factor in concluding a contract", the majority of customers "will continue to be able to use Schufa scores without having to adapt their processes", Schufa stated.