Court case 6 K 788/20.WI – Court Ruling (Germany, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The data subject requested information from a credit rating agency acting as controller regarding the calculation of his credit score. The score was used by third parties, such as lenders, to assess the data subject’s creditworthiness and had a significant impact on his ability to conclude contracts. Relying on Article 15 GDPR, the data subject sought access not only to his personal data but also to information on how the score was generated. The controller provided general information but refused to disclose details about the functioning of the scoring system, arguing that the algorithm and weighting factors constituted trade secrets and that the score itself did not amount to automated decision-making. The data subject lodged a complaint with the DPA, which was later rejected. The data subject brought an appeal before the Administrative Court, arguing that the credit score resulted from automated processing and had legal or similarly significant effects, thereby entitling him to the additional information required under Article 15(1)(h) GDPR. The court upheld the data subject’s claim. After hearing the parties, the court stayed the proceedings and referred the case to the CJEU (C-634/21 and C-203/22). The questions posed regarded the interpretation of Article 22, and whether credit scoring can amount to automated decision-making. The court then relied heavily on the CJEU's reasoning in assessing the case at hand. It held that credit scoring qualifies as automated decision-making within the meaning of the GDPR, as the score is generated exclusively by automated means and is intended to be used as a decisive factor in contractual decisions affecting the data subject. The fact that third parties ultimately rely on the score does not negate the automated nature or significance of the processing. Accordingly, the Court found that Article 15(1)(h) GDPR applies. The controller is therefore required to provide the data subject with meaningful and understandable informat
GDPR Articles Cited
The data subject requested information from a credit rating agency acting as controller regarding the calculation of his credit score. The score was used by third parties, such as lenders, to assess the data subject’s creditworthiness and had a significant impact on his ability to conclude contracts. Relying on Article 15 GDPR, the data subject sought access not only to his personal data but also to information on how the score was generated. The controller provided general information but refused to disclose details about the functioning of the scoring system, arguing that the algorithm and weighting factors constituted trade secrets and that the score itself did not amount to automated decision-making. The data subject lodged a complaint with the DPA, which was later rejected. The data subject brought an appeal before the Administrative Court, arguing that the credit score resulted from automated processing and had legal or similarly significant effects, thereby entitling him to the additional information required under Article 15(1)(h) GDPR. The court upheld the data subject’s claim. After hearing the parties, the court stayed the proceedings and referred the case to the CJEU (C-634/21 and C-203/22). The questions posed regarded the interpretation of Article 22, and whether credit scoring can amount to automated decision-making. The court then relied heavily on the CJEU's reasoning in assessing the case at hand. It held that credit scoring qualifies as automated decision-making within the meaning of the GDPR, as the score is generated exclusively by automated means and is intended to be used as a decisive factor in contractual decisions affecting the data subject. The fact that third parties ultimately rely on the score does not negate the automated nature or significance of the processing. Accordingly, the Court found that Article 15(1)(h) GDPR applies. The controller is therefore required to provide the data subject with meaningful and understandable informat
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 6 K 788/20.WI in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 6 K 788/20.WI - Germany (2025). Retrieved from cookiefines.eu
Last updated: