Decision of the Administrative Court of Wiesbaden on Supervisory Action Against Schufa
The administrative courts have repeatedly dealt with the extent of disclosure obligations of credit agencies towards affected individuals. Most recently, the Administrative Court Wiesbaden, in its order of December 29, 2023 (Ref. 6 K 788/20.WI), addressed the question of whether data protection law requires Schufa Holding AG, in the context of score disclosures, to state which factors are used for calculation, but not to reveal the exact weightings.
Background to the Proceedings
The initiation of the proceedings was triggered by the intervention of the data protection supervisory authority, which criticized that the way Schufa provided information to affected individuals did not sufficiently safeguard their right of access under Article 15 GDPR. Specifically, the authority objected that Schufa’s disclosures regarding score values only presented the bases for calculation in a general manner, preventing affected individuals from understanding individual decision-making.
Operator Obligations under the GDPR
Scope of the Right of Access
The proceedings primarily centered on the correct extent of the disclosure obligation arising from Article 15(1) and (2) GDPR. According to this, affected individuals have the right to comprehensive information about the personal data processed, including “meaningful information about the logic involved” in automated decision-making processes.
Disclosure of Weighting Factors
Within its score disclosures, Schufa indicated to affected individuals which types of data were considered to determine their score value and explained the general calculation factors. However, the precise weighting of individual data points remained unnamed – citing business secrets. The data protection authority further demanded that such information must also be specified.
Assessment by the Administrative Court
Balancing Transparency Obligation and Protection of Trade Secrets
The Administrative Court of Wiesbaden concluded that Schufa’s chosen practice generally meets data protection requirements. Specifically, the court held that the goal of transparency can be achieved by communicating the relevant types of data and general functioning, without disproportionately restricting the company’s legitimate interest in the protection of its business secrets.
No Further Right of Access Regarding Details of Weightings
Ultimately, the court found no obligation to provide more detailed insight into individual weighting factors or mathematical models beyond the information already disclosed. Providing such detail would harm the credit agency’s competitiveness without significantly increasing the informational gain for the affected individual.
Impact for Affected Companies and Controllers
The decision of the Administrative Court of Wiesbaden is highly relevant for how credit agencies and other data-processing entities manage access requests under the GDPR. The reasoning emphasizes that the protection of trade secrets continues to be taken into account in structuring disclosure obligations. Nevertheless, the companies concerned must ensure that they provide meaningful information about how their automated decision-making processes function.
It should be noted that appeals to review this decision are currently possible (as per VG Wiesbaden, 6 K 788/20.WI), so the legal situation may still be subject to further judicial clarification. The presumption of innocence applies to all parties involved.
Need for Discussion and Legal Classification
For responsible companies, this decision still allows some discretion in complying with Article 15 GDPR in the context of automated decision-making processes. Nevertheless, the concrete implementation remains a complex and dynamically developing legal area, which should be continuously reviewed in light of further court decisions.
Anyone who, in view of the complexity of data protection law, wishes to undertake a thorough analysis of their processes regarding access and information rights under the General Data Protection Regulation will find further information and customized legal advice on data protection at MTR Legal.
