Information
about the
SCHUFA score.
Information
about the
SCHUFA score.
by
Does a credit bureau have to explain how it calculated a credit score? And who has to prove that this score was the deciding factor in granting a loan or entering into a contract? The Federal Court of Justice (BGH) has clarified the requirements for obtaining information about a SCHUFA score and has made it significantly easier for those affected to provide evidence.
Tables full of percentages
On October 4, 2023, a private individual received a report from SCHUFA detailing the data stored about him. The letter contained a table listing all the credit scores that the credit bureau had provided in response to customer inquiries over the previous twelve months. For each score, the letter listed the rating level, probability of fulfillment, and risk assessments for individual data categories. These categories refer to groups of data such as past payment defaults, credit activity, or the length of the credit history. In addition, there was a so-called base score of 20.22 percent.
What lay behind these figures remained unclear to the private citizen. According to the findings of the appellate court, the probabilities of fulfillment for inquiries made to the same bank ranged from 2.13 percent to 22.43 percent. The letter did not provide an explanation for these differences.
He therefore requested information on how his credit scores were calculated. The Chemnitz Regional Court dismissed the claim on this point. The Dresden Higher Regional Court ruled partially in favor of the plaintiff. Among other things, it was ordered to disclose the weighting of the criteria that most strongly influence the score and to explain the significance of the specific score. In the opinion of the Higher Regional Court, it was not required to disclose the algorithm itself. SCHUFA filed an appeal against the ruling.
The Federal Court of Justice (BGH) overturned the ruling and remanded the case
In its ruling of October 21, 2026—Case No. I ZR 227/25— the Federal Court of Justice ( BGH ) overturned the appellate court’s decision to the extent that it had found against SCHUFA. It remanded the case to the Dresden Higher Regional Court for a new hearing. On the same day, three judgments were handed down in similar parallel proceedings.
Formally, the credit bureau’s appeal was thus successful. However, a final decision on the right to access information has not yet been made. The individual concerned will be given the opportunity to amend his or her requests. The Federal Court of Justice (BGH) considered two phrases in the appellate ruling to be too vague: namely, the criteria that “most strongly” influence the score and the “informative value” of the score.
When are you entitled to receive information about your SCHUFA score?
A right to an explanation of the calculation exists only if an automated individual decision within the meaning of the General Data Protection Regulation has been made. The Federal Court of Justice (BGH) bases this on the judgment of the ECJ dated December 7, 2023—Case No. C-634/21 (SCHUFA Holding). According to that judgment, three conditions must be met simultaneously. There must be a decision. It must be based exclusively on automated processing. And it must significantly affect the data subject legally or in a similar manner.
The Federal Court of Justice (BGH) found that the first two criteria were met. It held that the calculation of the credit score itself constitutes a decision, not merely its transmission to a bank. Furthermore, SCHUFA’s statistical method constitutes profiling—that is, an automated assessment of personal factors such as financial situation and reliability.
The appellate ruling failed on the third criterion. The Higher Regional Court had considered it irrelevant whether the individual in question was actually adversely affected by the score. The Federal Court of Justice (BGH) takes a different view. The individual is considered to have been significantly affected only if a third party relies substantially on the transmitted score when deciding whether to enter into, perform, or terminate a contract. Whether the automated decision itself was permissible, however, is irrelevant to the right to information.
This has practical significance for the base score. According to SCHUFA’s presentation, it is not disclosed to third parties but is calculated solely to inform the individual concerned. If that is the case, the Federal Court of Justice (BGH) holds that the third criterion is not met in this respect. The Higher Regional Court must now clarify this.
Who must prove that the score was decisive?
The burden of proof generally lies with the affected party. However, that party has little insight into the internal processes of a bank or a merchant. The Federal Court of Justice (BGH) therefore relies on the EU legal principle of effectiveness—that is, the requirement that rights under EU law must be practically enforceable. Otherwise, the claim risks becoming meaningless because three parties are involved and no single party has access to all the information.
It is therefore sufficient for the affected party to allege that the credit reporting agency transmitted a credit score to a company. In addition, there must have been an adverse decision regarding the initiation or performance of a contract that occurred in temporal connection with this transmission. This decision may also have been made by an affiliated company. In that case, a presumption in favor of the affected individual applies.
If this is established and, where applicable, proven, there is a factual presumption that the company’s decision was largely attributable to the decision made by the defendant.
It is then up to the credit bureau to rebut this presumption. In doing so, the Federal Court of Justice (BGH) expressly departs from the stricter standards applied by several Higher Regional Courts. These include the Kammergericht as well as the Higher Regional Courts of Brandenburg, Hamm, Munich, Nuremberg, and Stuttgart. Even the objection that banks are required under the German Banking Act to independently assess creditworthiness does not change this, in the Federal Court of Justice’s view. Such an obligation says nothing about the actual weight the credit score carries in practice.
What must the credit bureau explain?
In the case of an automated decision, the Federal Court of Justice (BGH) held that the information letter from 2023 was insufficient. It is not enough to list the types of data used and their ratings on a scale from “++” to “–.” The credit reporting agency must provide a clear explanation of the criteria it uses to arrive at these ratings. It must also explain how it weights the different types of data relative to one another. It must likewise address any obvious ambiguities, such as score values that differ significantly from one another.
The Federal Court of Justice (BGH) draws these boundaries in accordance with the ECJ ruling of February 27, 2025—Case No. C-203/22 (Dun & Bradstreet Austria). Neither a complex mathematical formula nor a description of every single step in the calculation is required. The data subject must be able to understand which of their personal data were used and in what manner. The Federal Court of Justice did not accept the blanket objection that such explanations would disclose a trade secret. Even a trade secret does not enjoy absolute protection. The court or supervisory authority must weigh the conflicting interests.
By contrast, the Federal Court of Justice (BGH) does not recognize any right under the General Data Protection Regulation to an explanation of the “informative value” of a score. Information regarding the scientific validity of a scoring model goes beyond the scope of the right to access data. This is where a new scoring provision in the Federal Data Protection Act comes into play, which will take effect on November 20, 2026. It grants an independent right to be informed of the significance of a probability value, which, in the Federal Court of Justice’s view, exists alongside the data subject rights under the General Data Protection Regulation.
What does this mean for businesses?
We view this decision as a significant shift in data protection law in favor of data subjects. It affects every credit reporting agency and, indirectly, all companies that use scores to make contractual decisions.
- Revise the information letter.
Providers of scoring systems should review their standard information letters. A table with rating symbols is not sufficient unless it explains how the ratings are determined and how they are weighted. - Provide specific grounds for trade secrets.
Anyone who wishes to withhold information must explain which secret is at issue and why. A general reference to the protection of the algorithm is not sufficient. - Document the role of the score.
Companies that access scores should document the actual weight the score carries in their decision-making. This information can be crucial in the event of a dispute, if the presumption of a significant influence is to be rebutted. - Process requests in a targeted manner.
Data protection departments should record requests for information regarding automated decisions separately. This also includes verifying whether a request was made in bad faith in a specific case. - Plan for the new legal landscape.
Starting November 20, 2026, the transparency requirements of the Federal Data Protection Act will take effect. Processes should address both sets of requirements.
Conclusion
The ruling was largely predictable in its general direction, as it consistently follows the two ECJ decisions. What is new is the relaxation of the burden of proof. It effectively shifts the risk that the impact of a credit score cannot be clarified to the credit reporting agency. This is unfavorable for providers of scoring systems but favorable for those affected.
It remains unclear how a credit reporting agency can rebut this presumption. As a rule, it knows little more about its clients’ decision-making processes than the individual concerned. In any case, according to the Federal Court of Justice, any deviating agreements with its clients do not preclude this presumption. Nor is it clear when an influence is “significant” or how close the temporal connection must be. The lower courts will have to answer these questions.
It is also worth noting that there is a conflict with the new Federal Data Protection Act. The terms “most severely” and “significance,” which the Federal Court of Justice (BGH) criticized in the operative part of its ruling as being too vague, appear there almost verbatim. How affected individuals are to enforce this legal claim in court in the future remains an open question.
We’d be happy to
advise you on
Data protection!
