On 16 March 2023, the Advocate General (AG) issued his opinion in Case C-634/21 (SCHUFA Holding e a.) concerning the interpretation of Article 22 GDPR, with reference to the economic activity of reporting agencies in the financial sector. According to the AG, the automated establishment of a probability value concerning a person's ability to service a loan constitutes profiling, which produces legal (or similar) effects concerning him or her, where that value is transmitted by the controller to a third-party controller and the latter draws strongly on that value for its decision on the contractual relationship with that person. On the same date, the AG also issued his opinion in Joint Cases C-26/22 and C-64/22 (SCHUFA Holding e a.). Firstly, the AG took the view that, under Article 78 GDPR, a legally binding decision of a GDPR supervisory authority is subject to a full substantive judicial review. Secondly, the storage of data by a private credit information agency cannot be lawful, under Article 6 GDPR, once the personal data concerning insolvency has been erased from public registers.
Originally published by April, 2023
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.