Court decision · 7 December 2023
OQ v Land Hessen (SCHUFA Holding)
Case C-634/21, ECLI:EU:C:2023:957 · Court of Justice of the European Union
What it means for your code
If customers rely on your model's score to accept or reject people, Article 22 safeguards (human review, explanation, contestation) apply to your product.
What happened
A credit agency computed probability scores about individuals that banks relied upon heavily to refuse loans.
What was decided
The automated generation of a probability score constitutes an 'automated individual decision' under Article 22 GDPR where a third party draws strongly on it to establish, implement or terminate a contract.
The legal test applied
- Automatically generating a probability value about a person is a 'decision' under Art. 22 when a third party draws strongly on it to enter, perform or end a contract
- Such decisions are prohibited unless an Art. 22(2) exception applies, with safeguards: human intervention, the right to express a view and to contest
What would have changed the outcome
- The score is one of several factors and a human meaningfully reviews the decision
- The output is not used to decide on a contract with the person
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.