Court case 6 K 788/20.WI – Court Ruling (Germany, 2025)

The data subject requested information from a credit rating agency acting as controller regarding the calculation of his credit score. The score was used by third parties, such as lenders, to assess the data subject’s creditworthiness and had a significant impact on his ability to conclude contracts. Relying on Article 15 GDPR, the data subject sought access not only to his personal data but also to information on how the score was generated. The controller provided general information but refused to disclose details about the functioning of the scoring system, arguing that the algorithm and weighting factors constituted trade secrets and that the score itself did not amount to automated decision-making. The data subject lodged a complaint with the DPA, which was later rejected. The data subject brought an appeal before the Administrative Court, arguing that the credit score resulted from automated processing and had legal or similarly significant effects, thereby entitling him to the additional information required under Article 15(1)(h) GDPR. The court upheld the data subject’s claim. After hearing the parties, the court stayed the proceedings and referred the case to the CJEU (C-634/21 and C-203/22). The questions posed regarded the interpretation of Article 22, and whether credit scoring can amount to automated decision-making. The court then relied heavily on the CJEU's reasoning in assessing the case at hand. It held that credit scoring qualifies as automated decision-making within the meaning of the GDPR, as the score is generated exclusively by automated means and is intended to be used as a decisive factor in contractual decisions affecting the data subject. The fact that third parties ultimately rely on the score does not negate the automated nature or significance of the processing. Accordingly, the Court found that Article 15(1)(h) GDPR applies. The controller is therefore required to provide the data subject with meaningful and understandable information about the logic involved in the scoring process, as well as information about the significance and envisaged consequences of the processing for the data subject. The Court clarified that this obligation does not require disclosure of the source code or full algorithm. However, the information provided must go beyond abstract descriptions and must enable the data subject to understand, in concrete terms, how relevant factors influence the score and how the score affects decision-making.