BGH on the SCHUFA score: an explanation only after a refusal – but proof is made easy
Your contact person
Anyone who wants to know how their SCHUFA score is calculated needs a specific reason to ask under Art. 15 GDPR. On 21 October 2026, the German Federal Court of Justice ruled in four cases that the right to an explanation of the scoring logic requires the score to have decisively shaped an adverse decision by a company. However, the court makes this easy for consumers to show.
SCHUFA, Germany’s largest consumer credit reference agency, won all four appeals on points of law. The dispute is not over, though: the First Civil Senate of the German Federal Court of Justice (Bundesgerichtshof, BGH) set aside the judgments of the Higher Regional Court of Dresden (Oberlandesgericht Dresden) and referred the cases back for a new hearing (BGH, judgments of 21 October 2026, I ZR 227/25, I ZR 228/25, I ZR 229/25 and I ZR 230/25; press release No. 198/2026). For anyone who has been refused a loan, a lease or a mobile phone contract, the ruling still contains good news.
The key points at a glance:
- A right to “meaningful information about the logic involved” under Art. 15(1)(h) GDPR exists in the case of credit scoring only if all requirements of Art. 22(1) GDPR are met.
- The decisive question is whether a company made its decision to conclude, perform or terminate a contract depend to a significant extent on the score it received, and whether the data subject was significantly affected as a result.
- To prove this, it is sufficient to show that a score was transmitted and that an adverse decision followed. It is then presumed that the decision was based to a significant extent on the score.
- If the right exists, the disclosure letters SCHUFA sent in 2023 are not sufficient.
- From 20 November 2026, a new scoring provision, Section 37a of the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG), applies and grants its own information rights.
Overview
- What were the four cases about?
- When does the right to an explanation of the score exist?
- What easing of the burden of proof does the BGH grant?
- Are SCHUFA’s standard disclosures sufficient?
- What will Section 37a BDSG change from 20 November 2026?
- What does this mean for consumers, the self-employed and businesses?
- Frequently asked questions about access to your SCHUFA score
- Further information
What were the four cases about?
Four private individuals had sued SCHUFA for an explanation of how their scores are calculated. SCHUFA produces these scores using a mathematical and statistical method. Its business customers, such as banks, online retailers and telecommunications companies, use them as a forecast of how reliably a prospective customer will pay.
SCHUFA had already provided the claimants with information in 2023. It had disclosed the stored data and the scores previously transmitted to third parties in table form. The claimants considered this insufficient. They demanded an explanation of how their score was calculated and reimbursement of their pre-trial legal fees.
The Regional Courts (Landgerichte) of Chemnitz, Leipzig and Görlitz dismissed the claims. The Higher Regional Court of Dresden partially upheld them in judgments of 7 October 2025 (4 U 144/25, 4 U 883/24, 4 U 1492/24 and 4 U 615/25). Among other things, it ordered SCHUFA to disclose the weighting of the most influential criteria, the informative value of the score and the data used for the base scores. The BGH has now set these orders aside.
When does the right to an explanation of the score exist?
Only if the score has actually become the basis of a decision with significant effects on the person concerned. Art. 15(1)(h) GDPR does not grant a right to information about the logic involved for every kind of data processing, but for automated decisions within the meaning of Art. 22 GDPR. Under Art. 22(1) GDPR, nobody has to accept a decision based solely on automated processing which produces legal effects concerning them or similarly significantly affects them.
The BGH considered two requirements to be met. Calculating the score is profiling within the meaning of Art. 4(4) GDPR, and it can be a “decision”. This follows from the SCHUFA judgment of the Court of Justice of the European Union (CJEU) of 7 December 2023 (C-634/21): the calculation of a probability value by a credit reference agency is itself an automated decision if a third party draws strongly on that value in deciding whether to conclude, perform or terminate a contract with the person concerned.
The third requirement, a significant effect on the person, remained open. The Higher Regional Court had not established whether a company had made its contract decision depend to a significant extent on the score and whether the claimants were significantly affected as a result. Without that finding, it should not have ruled against SCHUFA. Art. 15(1)(h) GDPR therefore does not provide an unconditional right to an explanation of the score.
An important point for context: the general right of access under Art. 15(1) GDPR remains unaffected. Data subjects can still ask at any time, even without a refusal, which data SCHUFA stores about them, where the data comes from and to whom scores have been transmitted. The ruling only concerns the more detailed explanation of the scoring logic.
What easing of the burden of proof does the BGH grant?
Data subjects only need to show two things: that a score was transmitted to a company and that an adverse decision was then taken against them. A factual presumption then applies that the decision was based to a significant extent on the score.
The burden of presentation and proof rests with the claimants. However, the BGH stresses that, in view of the EU law principle of effectiveness, the requirements must not be set too high. With this, the Senate corrects approaches that required data subjects to fully prove that it was precisely the score that tipped the balance.
In practice, this is the most important part of the ruling. Banks and other companies rarely give reasons for a refusal. If data subjects had to prove that the score, and not their income, the term of the loan or an internal policy, was decisive, the right to an explanation would largely be meaningless. How SCHUFA can rebut the presumption in an individual case, for example by showing that the business customer did not use the score at all, will only become clear from the written reasons for the judgment.
Proof that a score was transmitted usually comes from the data subject access request: under Art. 15(1)(c) GDPR, SCHUFA must disclose the recipients to whom it has transmitted data. The refusal can be evidenced by the rejection letter, an e-mail or a note of a conversation. What matters is how close in time the two events are.
Are SCHUFA’s standard disclosures sufficient?
No, at least not for the claim under Art. 15(1)(h) GDPR. If the claim exists, SCHUFA did not satisfy it with its 2023 letters, according to the BGH. A table of scores does not explain how a score came about.
The BGH has not finally decided how far the explanation must go. The Higher Regional Court must determine the scope of the information again; according to the press release, it had not defined the scope correctly in every respect. The claimants will have the opportunity to make their requests more specific.
The CJEU provides guidance. In Dun & Bradstreet Austria (judgment of 27 February 2025, C-203/22), it held that the controller must explain the procedure and principles actually applied in such a way that the data subject can understand which of their personal data were used and how they influenced the result. Simply handing over a complex mathematical formula is not enough. If the controller relies on trade secrets, it must submit the information to the court or the supervisory authority, which then weighs up the interests involved. A blanket reference to trade secrets therefore does not exclude the claim.
What will Section 37a BDSG change from 20 November 2026?
From 20 November 2026, the new Section 37a BDSG governs credit scoring. It replaces the previous Section 31 BDSG and was introduced by the German act implementing the Consumer Credit Directive (EU) 2023/2225 (Federal Law Gazette, BGBl. 2026 I No. 139).
Under Section 37a(4) BDSG, entities that produce probability values must, on request, inform the data subject in a precise, transparent, intelligible and easily accessible form about:
- which personal data and criteria were used for the value,
- how the criteria and categories that have the strongest influence on the value are weighted,
- what the specific probability value means, and
- which values were produced and to whom they were transmitted.
The information required for this must be stored for one year. Under Section 37a(5) BDSG, data subjects can contest a decision based on such a value, express their point of view and request a decision by a human being. Certain data may no longer be used for scoring at all, including data from social networks, information about incoming and outgoing payments on bank accounts and special categories of personal data within the meaning of Art. 9 GDPR.
The difference from the BGH ruling is obvious: according to its wording, Section 37a(4) BDSG does not make the request for information conditional on a prior refusal. Whether and how the new provision will affect the cases referred back is an open question. Anyone who cannot point to an adverse decision today should renew their request after 20 November 2026 and base it expressly on Section 37a(4) BDSG.
What does this mean for consumers, the self-employed and businesses?
Anyone who has been refused a contract and suspects the score is to blame now has a good chance of obtaining a genuine explanation. Careful preparation is essential:
- Document the refusal: Keep rejection letters, e-mails and chat logs. If you are turned down orally, note the date, the company and the person you spoke to.
- Request a data subject access report: The copy of your data under Art. 15 GDPR is free of charge. It shows which data is stored and when which score was transmitted to whom.
- Establish the timing: If the transmission and the refusal are close together, the BGH’s presumption works in your favour.
- Be specific in your request: State precisely what you want to know, such as the relevant criteria, their weighting and the influence of your own data. Imprecise requests were a problem in the BGH cases, too.
- Have errors corrected: A poor score is often caused by an incorrect or outdated entry. Rectification and erasure under Art. 16 and 17 GDPR then help faster than any explanation.
Companies that use scores for contract decisions should review their processes. Anyone who rejects credit, leasing or instalment applications largely on the basis of a score must expect data subjects to demand explanations and to rely on the BGH’s presumption. By 20 November 2026, it should also be clear how a review by a human being under Section 37a(5) BDSG will be organised.
Status of the proceedings: the four cases go back to the Higher Regional Court of Dresden, which must make the missing findings and determine the scope of the information again. The written reasons for the judgments were not yet available at the time of writing; this article is based on the BGH’s press release.
Frequently asked questions about access to your SCHUFA score
Does SCHUFA have to explain how my score is calculated?+
What do I have to prove when I ask for an explanation?+
Can I still request a free access report at any time?+
What changes from 20 November 2026?+
Can SCHUFA rely on its trade secrets?+
Refused a loan or contract and suspect your SCHUFA score?
We review your SCHUFA report, assert your right to an explanation of the score and take action against incorrect entries. You will usually receive an initial assessment within 24 hours.
Further information
- CJEU ruling on the SCHUFA score: what debtors can do now (in German)
- CJEU ruling: SCHUFA & Creditreform – your rights and how to enforce them (in German)
- New SCHUFA score: more transparency and new legal questions (in German)
- BGH on SCHUFA entries: a disputed claim is not reliable credit information (in German)
- Requesting a Creditreform self-disclosure: how it works (in German)
- Our fields of activity
- Our successes
Related posts
Multiple awards.
