The full written judgments in four SCHUFA cases decided on October 21, 2026 by Germany's Federal Court of Justice set out what the court's press release left open. SCHUFA Holding AG won all four appeals and the cases return to the Higher Regional Court of Dresden, but the reasons reject the credit bureau's general claim that explaining how it weighs data would reveal a protected algorithm, name six higher regional courts that had asked too much of consumers, and question whether the "base score" SCHUFA computes only for consumers themselves is covered by the GDPR's explanation right at all.

In Short

Germany's top civil court has now published its full reasons in four cases where people asked SCHUFA to explain how their credit scores were worked out. The reasons say that, if a score really decided whether a bank or shop would deal with someone, SCHUFA has to explain how it rated each type of data and how those ratings were weighed against each other, and it cannot refuse just by saying the method is a business secret. Dresden must now check each score, case by case, and the claimants have to rewrite two parts of their requests that the court found too vague.

What the written judgments are

The four rulings, I ZR 227/25, I ZR 228/25, I ZR 229/25 and I ZR 230/25, run to between 30 and 33 pages each. All carry the date October 21, 2026 and follow an oral hearing held on June 18, 2026 before the I. Civil Senate of the Bundesgerichtshof (BGH), composed of judges Feddersen, Löffler, Schwonke, Pohl and Odörfer. PPC Land reported the outcome on October 21 from the court's press release, at a time when the reasons had not been printed.

The legal reasoning is almost word for word identical across the four texts. What differs is the facts: the date of each SCHUFA letter, each claimant's base score, the banks that requested scores, and how the Dresden court had described them. Only I ZR 227/25 carries the official headnotes, under the title "Auskunftspflicht der SCHUFA" ("SCHUFA's duty to provide information", PPC Land's translation), and is marked for inclusion in the court's reference collection. Quotations below are from the German originals; the English renderings are PPC Land's translations.

The operative order in each case is the same. On SCHUFA's appeal, the Dresden judgment of October 7, 2025, in the version of a correction order issued in November 2025, is set aside on costs and "insoweit aufgehoben, als zum Nachteil der Beklagten erkannt worden ist" - "set aside insofar as it was decided against the defendant". The cases go back to Dresden "zur erneuten Verhandlung und Entscheidung, auch über die Kosten der Revision" - "for a new hearing and decision, including on the costs of the appeal on points of law".

Four claimants, four letters

The judgments describe SCHUFA's business in neutral terms. Its credit information system is built on collecting, storing, processing and passing on financial data on individuals and companies, data which, according to the court, are meant "insbesondere Kreditgeber vor Verlusten im Kreditgeschäft mit potentiellen Kreditnehmern schützen" - "in particular to protect lenders against losses in lending to potential borrowers". SCHUFA forms purpose-specific probability values using a mathematical-statistical procedure, by matching the data held on a person against statistical groups of people who had a similar data profile in the past.

The data are grouped into "data types": general data such as date of birth, gender and the number of addresses used in business dealings; past payment defaults, such as balance reports from a bank; credit activity in the previous year, such as credit card applications; credit use, such as the volume of credit; length of credit history; and, in some circumstances, address data. How far each type feeds into the scores is disputed between the parties, according to the judgments.

Each claimant received a SCHUFA letter in 2023 listing stored data and a table of the probability values transmitted to SCHUFA customers over the previous twelve months, with date, score name, score value, rating level, probability of fulfilment and risk ratings for each data type. Each letter also stated the claimant's base score, expressed as a percentage "von theoretisch möglichen 100 %" - "out of a theoretically possible 100%".

  • I ZR 227/25 (Regional Court of Chemnitz, then Dresden 4 U 144/25): letter of October 4, 2023; base score of 20.22% as of July 1, 2023. The table showed several enquiries from a bank identified as "S." between November 14, 2022 and January 8, 2023, scored with both a "Schufa-Score für Banken, Version 3.0" and a "Schufa-Bestandsscore für Banken, Version 3.0", with probabilities of fulfilment between 2.13% and 22.43%.
  • I ZR 228/25 (Regional Court of Leipzig, then Dresden 4 U 883/24): letter of May 19, 2023; base score of 93.92% as of April 1, 2023. According to the BGH, SCHUFA transmitted a score to one customer, once, labelled "sehr hohes Risiko" ("very high risk"). This claimant had also put before Dresden a bank's letter rejecting a financing request.
  • I ZR 229/25 (Regional Court of Görlitz, then Dresden 4 U 1492/24): letter of October 18, 2023; base score of 9.91% as of October 6, 2023. One score went to one customer, once: a request from "A. Bank" on February 7, 2023, producing a score value of 448 and a probability of fulfilment of 3.92%, labelled "sehr kritisches Risiko" ("very critical risk").
  • I ZR 230/25 (Regional Court of Görlitz, then Dresden 4 U 615/25): letter of December 19, 2023; base score of 95.01% as of October 6, 2023. A single enquiry from "S. Bank" on January 24, 2023 produced two different scores with different ratings, and the overall labels in the letter ranged from "very critical risk" and "very high risk" to "zufriedenstellendes bis erhöhtes Risiko" ("satisfactory to increased risk").

Three of the claimants sought 1,751.80 euros in pre-trial lawyers' fees; the claimant in I ZR 229/25 sought 1,295.43 euros. Dresden awarded 90.96 euros in each case. Those awards fall with the rest of the Dresden orders.

The figures illustrate the gap the claimants complained about. In I ZR 229/25, for example, the Dresden court had found that the base score of 9.91% lay "deutlich über" - "well above" - the value shown in the table for the bank enquiry, which carried a "very critical" label, without the letter explaining why.

Why SCHUFA won: the third condition

The BGH's headnotes restate the test set by the Court of Justice of the European Union in Case C-634/21, SCHUFA Holding (Scoring), of December 7, 2023. The access right in Article 15(1)(h) of the GDPR requires automated decision-making within the meaning of Article 22(1), and Article 22(1) applies only when three cumulative conditions are met: there must be a decision; it must be based solely on automated processing, including profiling; and it must produce legal effects for the person or similarly significantly affect them.

On the first two conditions SCHUFA's arguments failed. "Berechnet eine Wirtschaftsauskunftei automatisiert in Form eines Wahrscheinlichkeitswerts die Fähigkeit einer Person zur Erfüllung künftiger Zahlungsverpflichtungen, stellt dies eine auf einer automatisierten Verarbeitung - nämlich Profiling im Sinn von Art. 4 Nr. 4 DSGVO - beruhende Entscheidung dar," the headnote reads. ("If a credit bureau calculates, in automated form, a person's ability to meet future payment obligations as a probability value, this constitutes a decision based on automated processing - namely profiling within the meaning of Art. 4(4) GDPR.")

The court went a step further than the press release suggested. SCHUFA argued that the base score is never passed to third parties and, as a purely internal figure, has no effect on anyone. That argument, the BGH held, does not affect whether there is a decision: "Bereits die Berechnung eines Wahrscheinlichkeitswerts über eine Person und nicht erst die Übermittlung dieses Wahrscheinlichkeitswerts stellt danach eine Entscheidung im Sinn des Art. 22 Abs. 1 DSGVO dar." ("It is the calculation of a probability value about a person, and not only its transmission, that constitutes a decision within the meaning of Art. 22(1) GDPR.")

The third condition is where the Dresden judgments failed. Dresden had treated it as irrelevant whether the claimants had shown that SCHUFA subjected them to a decision with legal or similarly significant effects. The BGH disagreed. The access right "setzt voraus, dass sämtliche Merkmale des Art. 22 Abs. 1 DSGVO erfüllt sind" - "requires that all the characteristics of Art. 22(1) GDPR are met".

Dresden had leaned on recital 63 of the GDPR, which says every data subject should be able to know the logic of automated processing "at least when based on profiling". The BGH acknowledged that this "kann so verstanden werden" - "can be understood" - to mean that profiling alone triggers the right. It rejected that reading by turning to the Court of Justice's judgment of February 27, 2025 in C-203/22, Dun & Bradstreet Austria, which tied the right to an explanation to a decision based solely on automated processing that significantly affects the person, read with recital 71. The BGH found "kein Anhalt" - "no indication" - in the Luxembourg case law that the words "at least in those cases" in Article 15(1)(h) extend the right to cases where Article 22(1) is not fully met.

Two consequences follow. First, it does not matter for the access right whether the automated decision was lawful or unlawful under Article 22(2) to (4); the right exists either way. Second, Dresden must make findings, score by score, on whether a third party's contract decision depended "maßgeblich" - decisively - on each value SCHUFA produced.

The base score problem

That second point carries a specific risk for the claimants. Dresden's orders had covered both the scores sent to SCHUFA customers and the base score, and had gone further on the base score, ordering SCHUFA to disclose which personal data and criteria it used to create it.

SCHUFA's position before the BGH was that the base score is not given to third parties and is calculated only to inform the data subject. "Dann wäre das dritte Merkmal des Art. 22 Abs. 1 DSGVO insoweit nicht erfüllt," the court wrote. ("In that case the third characteristic of Art. 22(1) GDPR would not be met in that respect.") The BGH noted that Dresden had itself said elsewhere in its judgments that the base score was intended only for the claimant, and instructed it to make further findings if needed. Dresden must examine this question "vorrangig" - "as a priority" - before deciding whether the claimants can demand an explanation of the base score.

The calculation of the base score is a decision; but a decision that never leaves SCHUFA and influences no contract cannot significantly affect anyone. The BGH cited higher regional courts in Brandenburg, Munich, Nuremberg and Stuttgart that had reached the same view.

How the presumption works

The written reasons fill in the rule on proof that the press release summarised. The burden lies with the claimant, according to the court, but under the EU principle of effectiveness, "sind daran jedoch keine zu hohen Anforderungen zu stellen" - "the requirements must not be set too high". Without that, the BGH wrote, the claim would risk becoming meaningless in a setting with three parties: the person, the credit bureau and the company that receives the score. It cited the Court of Justice's rulings in C-655/23, Quirin Privatbank, of September 4, 2025, and C-748/24, Kotaňák, of April 30, 2026.

The consumer must show that SCHUFA transmitted a score to a company and that, in a temporal connection, a decision disadvantageous to the consumer followed in starting or carrying out a contract with that company or an affiliated one. Once that is set out and, if disputed, proven, a factual presumption arises that the company's decision is decisively attributable to SCHUFA's decision. "Es obliegt dann der Beklagten, die tatsächliche Vermutung gegebenenfalls zu erschüttern," the court wrote. ("It is then for the defendant to rebut the factual presumption, where applicable.") The judgments do not say how SCHUFA could do that, and they do not define how close in time the disadvantageous decision must be.

The press release said the BGH departed from "some other" higher regional courts. The judgments name them, describing the requirements they set as going too far: the Kammergericht in Berlin (January 19, 2026), and the higher regional courts of Brandenburg, Hamm (September 30, 2025), Munich (October 23, 2025), Nuremberg (June 24, 2025) and Stuttgart (March 18, 2025).

SCHUFA also argued that its customers are bound by separate agreements and that banks must carry out their own creditworthiness check under Section 18a of the German Banking Act (KWG) before granting consumer loans. Several courts and commentators, cited by the BGH, had treated that duty as a reason why a SCHUFA score cannot be decisive. The BGH rejected it in one sentence: "Das Bestehen einer Pflicht zur eigenständigen Prüfung sagt über den faktischen Stellenwert solcher Bonitätsprofile nichts aus." ("The existence of a duty to carry out an independent check says nothing about the actual weight of such credit profiles.")

In the I ZR 228/25 file, there is already a piece of evidence of the kind the presumption needs. According to the judgment, Dresden had referred to a bank's letter rejecting the claimant's financing request, filed as exhibit K 12a, but made no finding on whether a SCHUFA score was behind it. The other three judgments mention only the claimants' disputed submissions about lost contracts.

Two phrases too vague to enforce

The written reasons also explain the procedural defect the press release mentioned without detail. German civil procedure requires that a judgment be specific enough for an enforcement body to know what the defendant must do. The BGH found two phrases in Dresden's orders too vague.

The first was the duty to disclose the categories and criteria "die den Scorewert des Klägers am stärksten beeinflussen" - "that most strongly influence the claimant's score". The superlative, according to the court, "enthält ein Element der Wertung" - "contains an element of evaluation" - and neither SCHUFA nor an enforcement officer could tell where the line between criteria that must be named and those that need not be named would run. The court noted that the German legislature has created a similar claim in Section 37a(4) sentence 1 no. 2 of the Federal Data Protection Act (BDSG), taking effect on November 20, 2026, through a law of May 18, 2026 implementing the EU Consumer Credit Directive 2023/2225. That does not cure the vagueness, the BGH wrote, because Dresden's order rests on Article 15(1)(h) GDPR.

The second was the duty to explain "die Aussagekraft des für den Kläger konkret ermittelten Scorewerts" - "the meaningfulness of the score specifically determined for the claimant". That term, too, was held to contain an evaluative element and not to describe clearly enough what explanation the claimants wanted.

Other parts of the orders survived scrutiny. Dresden's requirement that SCHUFA communicate "in präziser, transparenter, verständlicher und leicht zugänglicher Form in einer klaren und einfachen Sprache" - "in a concise, transparent, intelligible and easily accessible form, using clear and plain language" - copies Article 12(1) GDPR word for word. The BGH accepted it, reasoning that a claimant seeking what the Court of Justice called a "genuine right to an explanation" cannot reasonably be expected to specify its form and language in more detail. The duty to disclose "the weighting of categories of criteria and of the individual criteria relative to each other", and to state which personal data and criteria were used for the base score, was also found sufficiently specific. A separate SCHUFA complaint, that Dresden had awarded something the claimants never asked for, failed.

Because these defects were identified for the first time at the highest instance, the claimants must be allowed to amend their requests in Dresden rather than having the claims dismissed as inadmissible, according to the court, which cited the principles of legitimate expectations and a fair trial.

What SCHUFA would have to explain

The section of the judgments with the most practical weight is the guidance to Dresden. The BGH stated that, if SCHUFA is obliged in principle to provide information under Article 15(1)(h), "hat sie diese Verpflichtung mit ihrem Schreiben vom 4. Oktober 2023 nicht erfüllt" - "it did not fulfil this obligation with its letter of October 4, 2023" (with the corresponding date in each of the other three cases). The court said its view is in line with the Wiesbaden Administrative Court in a judgment reported in the journal ZD in 2026, and partly contrary to a Stuttgart Higher Regional Court decision of February 3, 2026.

Relying on the Dun & Bradstreet judgment, the BGH described the right of access as a right to an explanation of the procedure and principles actually applied to reach a result such as a credit profile. "Weder die bloße Übermittlung einer komplexen mathematischen Formel (etwa eines Algorithmus) noch die detaillierte Beschreibung jedes Schritts einer automatisierten Entscheidungsfindung genügen diesen Anforderungen." ("Neither the mere transmission of a complex mathematical formula, such as an algorithm, nor the detailed description of every step of an automated decision-making process meets these requirements.") The person must be able to understand which of their data were used and in what way. A court could treat it as sufficiently transparent to tell the person how far a difference in the data would have changed the result, and the right covers the credit profiles actually created about the person.

The SCHUFA letters used a five-step scale for each data type, from "++" ("significantly below-average risk") to "--" ("significantly above-average risk"), plus "n/v" for data not used. That, the BGH held, was not enough. SCHUFA had told the claimants only which data types it used for each score and which ratings went into it. "Zusätzlich bedarf es einer nachvollziehbaren Erläuterung, nach welchen Kriterien sie für die einzelnen Datenarten, die sie für den jeweiligen Score verwendet, zur Bewertung zwischen '++' und '--' gelangt ist und in welchem Verhältnis die Bewertungen für die einzelnen Datenarten zueinander gewichtet worden sind." ("In addition, an intelligible explanation is required of the criteria by which it reached a rating between '++' and '--' for the individual data types it uses for each score, and of how the ratings for the individual data types were weighted relative to each other.")

SCHUFA must also address "sich aufdrängende Unklarheiten" - "obvious inconsistencies" - such as large differences between individual scores and between those scores and the base score. In two of the four cases, the same bank was sent values from two different SCHUFA models with differing results; in another, a "very critical" rating sat beside a base score that Dresden found to be well above the value shown in the table.

The trade secret objection

SCHUFA argued that explanations at that level would amount to disclosing its algorithm, which it says is protected as a trade secret. The BGH dismissed the argument as it stood. "Der bislang pauschal gebliebene Einwand der Revision, diese Erläuterungen kämen bereits einer Offenbarung des als Geschäftsgeheimnis geschützten Algorithmus gleich, vermag eine Einschränkung des Auskunftsanspruchs des Klägers nicht zu rechtfertigen." ("The objection in the appeal, which has so far remained a blanket one, that these explanations would already amount to disclosure of the algorithm protected as a trade secret, cannot justify a restriction of the claimant's right of access.")

Even where a trade secret exists, the court wrote, it enjoys "kein absoluter Schutz" - "no absolute protection" - and a balancing of the competing rights and interests is required, referring to the Dun & Bradstreet judgment, Article 15(4) and recital 63 of the GDPR. Where a controller believes the information contains protected third-party data or trade secrets, the supervisory authority or court must weigh them to set the scope of the access right.

SCHUFA had also relied on a BGH judgment of January 28, 2014 (VI ZR 156/13), which had protected the bureau's scoring formula from disclosure. The I. Civil Senate distinguished it: that ruling was decided under the old Section 34(4) of the pre-GDPR Federal Data Protection Act, not under Article 15(1)(h) GDPR.

The reasons leave room for SCHUFA. Dresden had already held that the bureau does not have to disclose its algorithm or statistical procedure, nor give information allowing the person to recompute a score mathematically, and the BGH accepted that Dresden could take that position while still ordering disclosure of individual items. The precise boundary between the weighting explanation and the protected model is left to Dresden and to a balancing that SCHUFA has not yet substantiated.

No right to "meaningfulness" under the GDPR

On one point the BGH sided clearly with SCHUFA. It saw no basis in Article 15(1)(h) for a claim to an explanation of the "meaningfulness" of the scores, independently of the vagueness problem. The overall labels in the letters, such as "very critical risk" and "very high risk", are according to the court "aus sich heraus verständlich" - "understandable in themselves". "Sollten mit 'Aussagekraft' etwa wissenschaftliche Erkenntnisse über die Validität der Scores gemeint sein, ginge dies über die Reichweite des Auskunftsanspruchs aus Art. 15 Abs. 1 Buchst. h DSGVO hinaus." ("If 'meaningfulness' were meant to refer, for instance, to scientific findings on the validity of the scores, this would go beyond the scope of the right of access under Art. 15(1)(h) GDPR.")

That does not end the question in Germany. The court pointed out that the new Section 37a(4) sentence 1 BDSG, applicable from November 20, 2026, gives data subjects a claim against the controller to be told the meaningfulness of a probability value. According to the legislative materials cited by the BGH, a committee report in Bundestag document 21/5381, that information could take the form of a Gini coefficient, a standard statistical measure of how well a score separates good and bad payers. The BGH described Section 37a as "einen eigenständigen Anspruch" - "a separate claim" - that will sit alongside the GDPR access right. Claims under it were not before the court.

No reference to Luxembourg

The BGH declined to refer any question to the Court of Justice. In its view, no question of EU law decisive for the outcome remained that had not already been answered by the Court of Justice or could not be answered without reasonable doubt. That position rests heavily on the two Luxembourg rulings, C-634/21 and C-203/22, which together supply almost every step of the reasoning.

What changes against the October 21 press release

The press release gave the outcome, the presumption and the conclusion that the 2023 letters were insufficient. The reasons add the parts that matter for anyone building or relying on scoring:

  • the calculation of a score, not its transmission, is the "decision"; but a base score that is never sent to anyone may still fall outside Article 15(1)(h) for lack of significant effect;
  • six named appeal courts had set the bar for consumers too high, and a bank's duty to run its own credit check under Section 18a KWG does not weaken the presumption;
  • the required explanation covers the criteria behind each data-type rating and the weighting between data types, not the formula;
  • a general trade secret objection is not enough, and a 2014 BGH precedent protecting SCHUFA's formula does not apply to GDPR claims;
  • there is no GDPR claim to an explanation of a score's "meaningfulness", though a statutory claim arrives on November 20, 2026.

Why this matters for marketers and platforms

Credit scores sit behind many decisions at digital checkouts: whether invoice payment or instalments are offered, whether an online mobile contract is approved, whether a utility accepts a new customer. The BGH's reasoning on the presumption is not limited to lending. It refers to any "Unternehmen" - company - that receives a score and makes a disadvantageous decision in starting or performing a contract, including affiliated companies.

The rejection of the Section 18a argument is notable for retailers and payment providers that frame credit checks as one input among several. The BGH said the existence of an independent-check duty says nothing about what weight a score actually carries. The same logic is under examination at EU level in the Universal Versand case, where an Advocate General told the Court of Justice on October 15 that a retailer's fully automated credit check withholding pay-later options can fall under Article 22.

The Dun & Bradstreet standard the BGH applied has been building for some time. Austria's courts were already applying it when PPC Land reported in August 2025 on a ruling that rejected a credit agency's unsupported trade secret claim. The Dutch data protection authority's April 2026 consultation on explaining automated decisions builds on the same two Luxembourg judgments. In Germany, the Wiesbaden Administrative Court ruled in November 2025 that SCHUFA had to rank the factors behind one consumer's score by influence, without revealing formulas or coefficients.

The BGH's guidance is close to that line. The weighting between data types is in; the algorithm is out; the space between them depends on a balancing exercise SCHUFA has so far argued only in general terms. For any business that buys or builds scores used in contract decisions, the reasoning applies to automated decision-making wherever a third party leans on the result, not only to SCHUFA.

The ruling also arrives as SCHUFA faces other pressure. In August 2026 the privacy group noyb sent the bureau a cease-and-desist letter over its historical archive, and after SCHUFA refused to sign, noyb said it would seek an injunction. In Austria, the Supreme Administrative Court held in June 2026 that statistical parameters used in a scoring model are not personal data on their own, a point the BGH's judgments do not address.

For the four claimants, the next step is a new hearing in Dresden, nearly three years after the letters that started the cases. Before then, they must reword two of their requests, and Dresden must examine whether any SCHUFA score decisively shaped a contract decision about them. Only the claimant in I ZR 228/25 is recorded as having produced a bank's rejection letter.

Timeline

  • January 28, 2014 - BGH VI Civil Senate protects SCHUFA's scoring formula under the old Federal Data Protection Act (VI ZR 156/13)
  • May 19, 2023 - SCHUFA letter to the claimant in I ZR 228/25; base score 93.92%
  • October 4, 2023 - SCHUFA letter to the claimant in I ZR 227/25; base score 20.22%
  • October 18, 2023 - SCHUFA letter to the claimant in I ZR 229/25; base score 9.91%
  • December 7, 2023 - Court of Justice rules in C-634/21, SCHUFA Holding (Scoring), on the three conditions of Article 22(1)
  • December 19, 2023 - SCHUFA letter to the claimant in I ZR 230/25; base score 95.01%
  • February 27, 2025 - Court of Justice rules in C-203/22, Dun & Bradstreet Austria, on the right to an explanation and trade secrets
  • March 18, 2025 to January 19, 2026 - Higher regional courts in Stuttgart, Nuremberg, Hamm, Munich, Brandenburg and Berlin set proof requirements the BGH later finds too strict
  • October 7, 2025 - Higher Regional Court of Dresden partly grants all four information claims
  • November 18-24, 2025 - Dresden issues correction orders to its four judgments
  • November 19, 2025 - Wiesbaden Administrative Court rules SCHUFA must explain one consumer's score factors
  • May 18, 2026 - German law implementing Consumer Credit Directive 2023/2225 creates Section 37a(4) BDSG
  • June 18, 2026 - Oral hearing before the BGH I. Civil Senate
  • October 15, 2026 - Advocate General opinion in C-568/25, Universal Versand
  • October 21, 2026 - BGH sets aside the four Dresden judgments and refers them back; full judgments dated the same day
  • November 20, 2026 - Section 37a(4) BDSG takes effect, including a claim to a score's meaningfulness

Summary

Who: Germany's Federal Court of Justice (Bundesgerichtshof), I. Civil Senate, judges Feddersen, Löffler, Schwonke, Pohl and Odörfer; SCHUFA Holding AG as defendant; four private individuals as claimants; the Higher Regional Court of Dresden, which must rehear the cases.

What: The full judgments in I ZR 227/25 to I ZR 230/25 explain why SCHUFA's appeals succeeded: Dresden never found whether any score decisively drove a third party's contract decision, and two of its orders were too vague to enforce. They also hold that the calculation of a score is itself a decision, that a base score never sent to third parties may fall outside the access right, that a factual presumption helps consumers who show a score transmission followed by a refusal, that a blanket trade secret objection cannot limit disclosure, and that the GDPR gives no claim to an explanation of a score's "meaningfulness".

When: The judgments are dated October 21, 2026, following a hearing on June 18, 2026. The Dresden judgments under review date from October 7, 2025. A new statutory disclosure claim takes effect on November 20, 2026.

Where: Karlsruhe, Germany, in cases that started before regional courts in Chemnitz, Leipzig and Görlitz, applying the EU General Data Protection Regulation as interpreted by the Court of Justice in C-634/21 and C-203/22.

Why: The reasons set out what a credit bureau would have to explain when its score decides a contract - the criteria behind each data-type rating and the weighting between them, but not the algorithm - and make it easier for consumers to show that a score was decisive. That affects lenders, retailers, telecoms providers and payment services that rely on bureau scores at the point of sale.