Court case 10 U 61/25 e – Court Ruling (Germany, 2026)

The data subject brought multiple claims against a credit information agency, arguing that its automated generation of various score values was unlawful under the GDPR. He sought declaratory relief, injunctive relief against exclusively automated scoring, disclosure of non-automated scores, damages, expanded access rights, and restrictions on the factors used in future scoring. The court of first instance dismissed the claims. The data subject appealed, relying in particular on Article 22 GDPR and arguing that negative scores could affect third-party decisions such as the conclusion of a rental agreement. The court has not yet published a final decision, but it has shared a notice of intention. The court intends to dismiss the appeal as unfounded. It agreed with the lower court that Article 22(1) GDPR was not applicable, because the automated generation of a score value, by itself, does not constitute a decision producing legal or similarly significant effects on the data subject. The court emphasised that Article 22 GDPR requires that the automated processing itself directly determines the outcome for the data subject, without independent decision-making by a third party. Where third parties, such as landlords or banks, merely take a score into account alongside other factors, the necessary causal link is missing. Referring to the CJEU’s judgment in C-634/21 (SCHUFA), the court stressed that Article 22 GDPR applies only where the automated result plays a decisive role in the final decision, which must be assessed on a case-by-case basis. Because the data subject failed to show that any automated score had directly caused a concrete adverse decision, all related claims, including injunctive relief, damages under Article 82 GDPR, and expanded access rights, were dismissed. It must be pointed out that this judgement is not binding yet.