Germany's Federal Court of Justice today set aside four appeal judgments that had ordered SCHUFA Holding AG, the country's largest credit bureau, to tell consumers how their credit scores were calculated, and sent the cases back to the Higher Regional Court of Dresden. The ruling is not a clean win for the credit bureau. The court held that producing a score can itself be an automated decision under the GDPR, and it lowered the bar consumers must clear to prove that a score decided whether a bank, retailer or other company would deal with them.

In Short

Germany's highest civil court looked at four cases where people asked SCHUFA to explain how it worked out their credit scores, and it cancelled the lower court's orders because that court never checked whether the scores actually decided anything for those people. It matters for anyone refused a loan, a phone contract or a pay-later option after a credit check, because the court said such a person only has to show that a score was sent and a refusal followed around the same time. The cases now go back to Dresden, which must decide whether SCHUFA owes an explanation and, if so, how detailed it has to be.

What the court decided

The I. Civil Senate of the Bundesgerichtshof (BGH), the panel which, according to the court, is responsible among other things for claims under the EU General Data Protection Regulation, delivered judgments today in four parallel cases: I ZR 227/25, I ZR 228/25, I ZR 229/25 and I ZR 230/25. The court published press release No. 198/2026 on the same date, October 21, 2026, in Karlsruhe.

The full written reasons are not yet available. A notice on the court's decision dispatch service, attached to the case file I ZR 227/25, states that the decision "is not yet available in printed form" at the court and that, apart from the press release, there is no further information about the decision, "not even at the press office". The court did not say when the reasons would be finished. Everything below therefore rests on the press release. Quotations from the court are translated from German by PPC Land.

The outcome for SCHUFA, the defendant, is set out in one line: "The defendant's appeals were successful." The BGH set aside the Dresden judgments to the extent that they had granted the claims for information and for reimbursement of pre-trial lawyers' fees, and referred the cases back "for a new hearing and decision".

The headline principle sits in the court's summary. "The creation of a score value can be automated decision-making and can give rise to an obligation to provide information under Art. 15(1)(h) GDPR if the decision of a third party as to whether it enters into, performs or terminates a contractual relationship with the data subject depends decisively on the score value transmitted to it," according to the court. "In principle, the claimants must set this out and prove it, although they are granted considerable relief in pleading and proof."

The four cases and how they reached Karlsruhe

The claimants are private individuals. In letters sent in 2023, SCHUFA gave each of them a statement of the personal data it held about them, together with the score values it had transmitted over the previous twelve months in response to credit enquiries. According to the court, the tables SCHUFA sent listed, among other things, score values, rating levels, probabilities of fulfilment and the data types SCHUFA said it used at the time, together with the risk attached to each that claims would go unpaid. Each heading carried values, percentages and other figures, some explained at the bottom of the table, and the letters pointed to further information about scoring published online.

The claimants wanted more. They sued for information on how the score values were calculated, plus reimbursement of their pre-trial legal costs, relying on the GDPR.

Each case started in a different regional court in Saxony and ended up before the same Dresden senate:

  • I ZR 227/25 - Regional Court of Chemnitz, judgment of January 8, 2025 (1 O 1454/23); Higher Regional Court of Dresden, judgment of October 7, 2025 (4 U 144/25)
  • I ZR 228/25 - Regional Court of Leipzig, judgment of May 29, 2024 (07 O 2599/23); Higher Regional Court of Dresden, judgment of October 7, 2025 (4 U 883/24)
  • I ZR 229/25 - Regional Court of Görlitz, judgment of September 25, 2024 (1 O 100/24); Higher Regional Court of Dresden, judgment of October 7, 2025 (4 U 1492/24)
  • I ZR 230/25 - Regional Court of Görlitz, judgment of April 11, 2025 (1 O 261/24); Higher Regional Court of Dresden, judgment of October 7, 2025 (4 U 615/25)

All four regional courts rejected the requests for information. The Dresden court, ruling on all four appeals on the same day, partly reversed them. It ordered SCHUFA to provide information on the weighting of the criteria that most strongly influenced each claimant's score, on the meaningfulness of the score calculated for that individual, and on the personal data and criteria used to build their base score values. It also ordered SCHUFA to reimburse pre-trial legal costs. The claimants' further appeals were dismissed, so Dresden had already refused part of what they asked for.

Dresden allowed an appeal on points of law, known in German procedure as a Revision. SCHUFA used it to seek dismissal of the claims in full. It did not get that either: the BGH did not dismiss the claims, it sent them back.

Profiling and decision: yes. Significant effect: unproven

The legal route runs through two GDPR provisions read together. Article 15(1)(h) gives a data subject the right of access to information about "the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing". Article 22(1) gives the right "not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her."

The BGH anchored its reading in the Court of Justice of the European Union's judgment of December 7, 2023 in Case C-634/21, SCHUFA Holding (Scoring). Under that case law, according to the BGH, an information claim of this kind exists "only if all the characteristics of Art. 22(1) GDPR are met." The data subject must have been subject to a decision based solely on automated processing, including profiling, that produces legal effects for them or similarly significantly affects them.

On two of those elements, SCHUFA lost. "The defendant's conduct meets the characteristics of 'profiling' within the meaning of Art. 4 No. 4 GDPR and of a 'decision' within the meaning of Art. 22(1) GDPR," according to the court. That is a significant statement from Germany's highest civil court. A credit bureau's score is a decision, in the GDPR sense, even though the bank or retailer that receives it makes the final call on the contract.

The third element is where Dresden fell short. Its findings, the BGH said, "do not allow an assessment of whether the claimants were significantly affected by the defendant's respective decision." Dresden was required to establish whether it "depends decisively" on the score SCHUFA produced that a third party receiving the score enters into, performs or terminates a contract with the claimant. The German word the BGH uses, "maßgeblich", can be rendered as "decisively" or "to a significant degree"; the official English version of the CJEU's 2023 judgment speaks of a third party that "draws strongly" on the score.

In other words, Dresden granted the information claims without establishing that any of the four claimants had suffered a contract refusal, termination or comparable consequence driven by a SCHUFA score. The press release does not describe what, if anything, happened to the claimants after their scores were transmitted.

A lower bar of proof for consumers

The part of the ruling with the widest practical reach concerns who has to prove what. The burden of setting out and proving that a score was decisive "lies with the claimants," according to the court. But the BGH then limited what that burden means in practice, citing the principle of effectiveness, the EU law rule that national procedure must not make rights granted by EU law practically impossible or excessively difficult to exercise.

"In view of the principle of effectiveness under EU law, the requirements must not be set too high," according to the court. "Departing from the view of some other higher regional courts, it is sufficient if the respective claimant submits that the defendant transmitted a score value to a company and that, in temporal connection with this, a decision disadvantageous to the claimant occurred in the initiation or performance of a contractual relationship with that company or an affiliated company. If this has been set out and, where necessary, proven, there is a factual presumption that the company's decision is decisively attributable to the score values formed by the defendant."

Three things follow from that passage. A consumer does not have to prove how the bank, telecoms provider or retailer weighed the score against its own data. It is enough to show a transmission and a disadvantageous decision close in time. The decision can come from the company that received the score or from an affiliated company, which matters for groups where one entity runs the credit check and another sells the product. And the BGH explicitly departed from "some other higher regional courts", which it did not name in the press release, that had demanded more from claimants.

The press release does not say what SCHUFA would have to show to rebut the presumption, nor how close in time the refusal must be.

What Dresden has to do next

The cases now return to the Higher Regional Court of Dresden. The BGH set out the sequence. First, the claimants get the chance to fix defects that the BGH found in how precisely their claims were worded. German civil procedure requires a claim to be specific enough that a judgment can be enforced, and the BGH found the claimants' requests lacking on that point, without the press release saying how. Dresden must then make the missing findings on whether the claims exist at all.

If Dresden finds that SCHUFA is in principle obliged to provide information under Article 15(1)(h), the BGH has already answered one question for it: "it did not fulfil this obligation with its letters from 2023." The tables of score values, rating levels and data types, plus a pointer to material online, were not enough.

Dresden would then have to decide again on how far the information claims reach. Its earlier answer, the order covering the weighting of the most influential criteria, the meaningfulness of the individual score and the data and criteria behind the base scores, was not right in every respect. The court of appeal "did not determine this scope without legal error in all respects," according to the BGH, which added that it had "also given guidance for the further proceedings in this respect." That guidance is in the written reasons, which have not been published.

What the ruling leaves open

The gap between the press release and the full judgment is large. Until the reasons are published, it is not known which parts of Dresden's disclosure order the BGH considered wrong: whether it was the weighting of criteria, the meaningfulness of the individual score, the base-score inputs, or the way they were framed. The question of how much of a scoring model a credit bureau must reveal, and where protection of a trade secret begins, is the one that matters most to SCHUFA's business model, and the press release does not touch it.

Nor does the press release mention the Court of Justice's second major ruling on the subject. In Case C-203/22, Dun & Bradstreet Austria, decided on February 27, 2025, the Court of Justice held that a complex algorithm or a description of every step it follows is not, on its own, a concise and comprehensible explanation, as PPC Land reported in its coverage of the Dutch data protection authority's April 2026 consultation. How the BGH applied that judgment to SCHUFA, if at all, will only be visible in the reasons. The press release reproduces Article 12(1) of the GDPR, which requires communications under Articles 15 to 22 to be "precise, transparent, intelligible and easily accessible" and in "clear and plain language", which suggests the form of the explanation featured in the court's guidance to Dresden.

The costs question is open as well. The orders to reimburse pre-trial lawyers' fees fell with the information claims, and will be decided afresh.

A third party's reading on LinkedIn

The ruling circulated on LinkedIn within hours of publication. Luis Alberto Montezuma, whose profile headline describes his work as "Data and Privacy Policy | Personal Opinion", posted the English text of the press release's opening paragraph and attached a seven-page document labelled "ADM". That document is an English rendering of the BGH press release page, captured from the court's German-language URL. Its wording ("The previous findings of the Court of Appeal do not support the conviction of the defendant") reads as a machine translation rather than an official English release; a civil judgment does not convict anyone. The post adds no analysis of its own beyond the court's summary. This article relies on the German original.

Why this matters for marketers and platforms

Credit scores sit inside a growing share of digital commerce. They decide whether a shopper is offered invoice payment or instalments at checkout, whether a mobile contract is approved online, and whether an energy supplier accepts a new customer. The BGH's finding that a score can be the automated "decision" for GDPR purposes, even when a merchant technically makes the final choice, extends the reach of automated decision-making rules to the data providers behind those flows.

The question of who bears the risk in pay-later decisions is already before the Court of Justice. On October 15, an Advocate General told the court that an online retailer's fully automated credit check that withholds invoice and instalment payment can fall under Article 22, in Case C-568/25 involving the Austrian mail-order company Universal Versand. Read together, the two texts point at both sides of the same checkout: the merchant running the check and the bureau supplying the score.

German courts have been pulling in different directions. On November 19, 2025, the Administrative Court of Wiesbaden ordered the Hessian data protection commissioner to act against SCHUFA, finding that SCHUFA had to rank the data factors behind a consumer's score by influence and explain why a rating of 85.96% counted as "significantly increased to high risk" for a loan of 5,000 euros, while not revealing formulas or coefficients. That consumer had a documented refusal from TeamBank. The four Dresden claimants, on the facts in the press release, did not have a refusal established in the record, which is exactly what the BGH found missing.

Elsewhere in the German system, the BGH's VI Civil Senate ruled on October 14, 2025 that a telecoms company could share customer master data with SCHUFA for fraud prevention under legitimate interests. In May 2026, a Berlin administrative court found that a solar company's SCHUFA checks run before site visits lacked a legal basis. And in Austria, the Supreme Administrative Court held on June 11, 2026 that macroeconomic statistical parameters used in a scoring algorithm are not personal data on their own, while leaving open whether such parameters must be disclosed under Article 15(1)(h).

The scale explains why every ruling is fought. According to figures cited in PPC Land's coverage of the Wiesbaden case, SCHUFA holds 943 million records on 67.9 million individuals and 6 million businesses and handles around 320,000 credit enquiries a day. The bureau is also under pressure on a separate front. In August 2026, the privacy group noyb sent SCHUFA a cease-and-desist letter over an archive of historical consumer records, and after SCHUFA refused to sign, noyb said it would seek a court injunction. SCHUFA said at the time that it would defend the archive up to the Federal Court of Justice if necessary.

National law is about to change too. According to PPC Land's September 11 report, Section 37a of the German Federal Data Protection Act takes effect on November 20, 2026, requiring score values from the preceding twelve months to appear in the copy of data provided to consumers. SCHUFA's 2023 letters already listed twelve months of transmitted scores; today's ruling says that listing, on its own, does not answer the Article 15(1)(h) question where a score was decisive.

The legal framework itself may shift. The European Commission's Digital Omnibus proposal would rewrite Article 22, and the Advocate General in the Universal Versand case declined to take it into account because it has not been adopted. Any ruling Dresden issues will apply the GDPR as it stands.

For the four claimants, the practical result is a second hearing in Dresden, nearly three years after SCHUFA's letters. For SCHUFA, the result is the removal of four disclosure orders, paired with a principle that will make it easier for the next claimant with a documented refusal to win one.

Timeline

Summary

Who: Germany's Federal Court of Justice (Bundesgerichtshof), I. Civil Senate; SCHUFA Holding AG as defendant; four private individuals as claimants; the Higher Regional Court of Dresden as the court of appeal.

What: The court set aside four Dresden judgments that had ordered SCHUFA to disclose how the claimants' credit scores were calculated, because Dresden never established that the scores decisively drove a third party's contract decision. It confirmed that SCHUFA's scoring is profiling and a "decision" under Article 22 GDPR, and eased the claimants' burden of proof: showing a score transmission and a disadvantageous decision close in time creates a factual presumption that the score was decisive.

When: The judgments and press release No. 198/2026 are dated today, October 21, 2026. The Dresden judgments under review were issued on October 7, 2025. The written reasons have not yet been published.

Where: Karlsruhe, Germany, in cases that began before regional courts in Chemnitz, Leipzig and Görlitz, applying the EU General Data Protection Regulation as interpreted by the Court of Justice in C-634/21.

Why: The ruling sets the conditions under which a credit bureau must explain the logic of its scores to consumers, a question that affects every lender, retailer, telecoms provider and payment service that relies on bureau scores at the point of sale. How much SCHUFA must reveal, if Dresden finds the claims well founded, remains open until the full reasons appear.