Court case Az: 4 U 884/24 – Court Ruling (Germany, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A data subject sought detailed information from a credit information agency (the controller) about how their credit scores were generated. The controller produced scores using statistical models based on various categories of personal and financial data, while denying the use of sensitive data. In July 2023, the controller gave the data subject their stored data and their scores transmitted to third parties. In August 2024, the data subject demanded damages, recognition that the scoring was unlawful, adjustment of their scores, omission of disclosures, reimbursement of legal fees, and detailed information about the calculation methods. They argued that the scoring system is opaque and that lenders rely so heavily on the score that it effectively dictates whether a consumer can obtain credit, discouraging them from even applying. The Regional Court dismissed the claims. On appeal, the data subject argued that the court had ignored relevant CJEU judgments and that the controller had used characteristics such as age, gender, and residence history. They pointed to large fluctuations in transmitted probability values as evidence of arbitrariness. After withdrawing most of their original claims, they sought only detailed information on how their various scores had been computed on the basis of Article 15(1)(h) GDPR in conjunction with Article 22 GDPR. Specifically, they asked for which personal data and criteria were used, how the criteria were weighted, and what the significance of the resulting scores was, arguing that the information previously disclosed was insufficient because it did not allow them to understand how their scores were determined in detail. The court held that the data subject was entitled to additional, but not complete, information about how his credit scores had been generated. It reasoned that Article 15(1)(h) GDPR, read together with Article 22 GDPR, grants data subjects a right to individualized, comprehensible explanations of the logic, sign
GDPR Articles Cited
A data subject sought detailed information from a credit information agency (the controller) about how their credit scores were generated. The controller produced scores using statistical models based on various categories of personal and financial data, while denying the use of sensitive data. In July 2023, the controller gave the data subject their stored data and their scores transmitted to third parties. In August 2024, the data subject demanded damages, recognition that the scoring was unlawful, adjustment of their scores, omission of disclosures, reimbursement of legal fees, and detailed information about the calculation methods. They argued that the scoring system is opaque and that lenders rely so heavily on the score that it effectively dictates whether a consumer can obtain credit, discouraging them from even applying. The Regional Court dismissed the claims. On appeal, the data subject argued that the court had ignored relevant CJEU judgments and that the controller had used characteristics such as age, gender, and residence history. They pointed to large fluctuations in transmitted probability values as evidence of arbitrariness. After withdrawing most of their original claims, they sought only detailed information on how their various scores had been computed on the basis of Article 15(1)(h) GDPR in conjunction with Article 22 GDPR. Specifically, they asked for which personal data and criteria were used, how the criteria were weighted, and what the significance of the resulting scores was, arguing that the information previously disclosed was insufficient because it did not allow them to understand how their scores were determined in detail. The court held that the data subject was entitled to additional, but not complete, information about how his credit scores had been generated. It reasoned that Article 15(1)(h) GDPR, read together with Article 22 GDPR, grants data subjects a right to individualized, comprehensible explanations of the logic, sign
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case Az: 4 U 884/24 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case Az: 4 U 884/24 - Germany (2025). Retrieved from cookiefines.eu
Last updated: