When the Score Is Already the Decision

Here the subject is the relationship between an automated output and the decision that follows it. The Court of Justice of the European Union’s SCHUFA judgment asks whether a score can be treated as mere information when another organization relies on it to decide a person’s future. That comparison gives us a sharper way to read Uber: not by pretending that credit scoring and driver deactivation are the same, but by asking where practical decision power sits and whether a formal label hides it.

The distinction matters whenever several actors, systems, or departments divide a decision. One component may collect information, another may calculate a result, and a third may communicate the consequence. If legal analysis looks only at the last visible act, a company may describe a decisive automated step as preliminary and leave the person affected without access to the logic behind it.

SCHUFA: the provider did not get to call the score “just information”

The SCHUFA case concerned a consumer identified in the judgment as OQ, the German state of Hesse, and SCHUFA Holding AG, a private credit-information company. SCHUFA provided its contractual partners, including banks, with information about the creditworthiness of consumers. It calculated a probability value—a score—about the likelihood that a person would meet future payment commitments. The score was produced from personal data through mathematical and statistical procedures.

The practical setting was a loan application. OQ had been refused a loan after negative information established by SCHUFA had been transmitted to a third party. When OQ asked SCHUFA for access to personal data and the deletion of allegedly incorrect information, SCHUFA provided the score and a broad description of its method. It did not disclose the individual factors and their weighting, referring to trade secrecy. SCHUFA also argued that it merely supplied information; its contractual partners made the actual decisions.

That argument created the legal boundary the CJEU had to resolve. If the bank alone made the Article 22 decision, SCHUFA could characterize its score as a preparatory input. But the referring German court found that the score normally determined whether and how a third party would contract with the person. In the court’s factual description, an insufficient score led in almost all cases to refusal of the loan.

The CJEU began with Article 22’s three cumulative conditions: there must be a decision; it must be based solely on automated processing, including profiling; and it must produce legal effects or similarly significantly affect the person. The Court’s reasoning about the first condition is deliberately broad. A “decision” is not limited to a final act signed by the organization that has the formal relationship with the person. The automated calculation of a probability value can itself be a decision when it plays the decisive practical role.

The Court then connected the score to the other conditions. The probability value was based on personal data and predicted the person’s future ability to repay, so the score-producing activity met the GDPR’s concept of profiling. The score also significantly affected the person because the bank drew strongly on it in deciding whether to grant credit. The Court did not require the score provider to be the organization that sent the final refusal notice. It followed the score to the point where it changed the person’s prospects.

The word “strongly” is not a decorative qualification. It distinguishes a signal that a person may consider among many factors from an output that effectively determines the result. In SCHUFA, the referring court’s finding that an insufficient value led to refusal in almost all cases supplied the factual basis for that conclusion.