Europe Ruled a Credit Score Is a Decision. The Appeal Took Seven Years.

In July 2018 a German bank turned down a woman's loan application. The court files call her OQ. The credit bureau SCHUFA had sent the bank a probability value of 85.96 percent, and the bank read that as "significantly increased to high risk" [5]. In October 2018 she complained to the Hessian data protection authority. In June 2020 the authority sided with SCHUFA, accepting that the company only had to give "meaningful information about the involved logic" and that business confidentiality protected the rest [5]. In July 2020 she sued. On 7 December 2023 the Court of Justice of the European Union ruled in her favour on the central question [1]. On 19 November 2025 the Administrative Court of Wiesbaden ordered SCHUFA to explain which of her data it used, how each was weighted, and why her score counted as high risk. Both sides may still appeal that judgment [4].

My thesis has two parts. The 2023 ruling is the most useful sentence a European court has written about automated decisions, because it puts the decision where the computing happens, so a human signature downstream no longer hides it. The ruling also left the person it protects with no fast, practical route to contest the number. I measure that second part in months below.

The question

When a lender refuses you because of a score from a company you have no contract with, who made the decision, and who can you appeal to?

This continues my post on the Dutch childcare benefits scandal. There, human reviewers stood between the risk model and the families, but they never knew why a file had been flagged, so the review added little protection. Credit has the same structure. A bank clerk clicks "decline". The bureau says it only supplies information. The bank says it only acts on information. Each points to the other, and the person refused gets no answer from either.

Data and where it came from

Everything here is a primary legal text or a court's own summary of its judgment:

• Article 22 of the GDPR, quoted from the consolidated text [3].
• The CJEU judgment in C-634/21, SCHUFA Holding (Scoring): its operative part and paragraphs 48 and 61 to 63 [1][2].
• The CJEU judgment in C-203/22, Dun & Bradstreet Austria, 27 February 2025, on what an explanation must contain [6].
• The Wiesbaden court's press release on case 6 K 788/20.WI, 19 November 2025 [4], plus a news account that gives the procedural dates [5].
• The new Consumer Credit Directive, (EU) 2023/2225, which adds a right to human intervention in creditworthiness assessments [7][8].

For scale, SCHUFA holds records on about 69 million people and handles roughly 232 million inquiries and updates a year. Those figures come from Wikipedia, which cites the company, so treat them as approximate [9].

Method

I trace OQ's path as an institutional sequence. At each step I name who held the decision right, what the person could contest, and how long the step took. Then I test the rule the ruling creates against the condition that triggers it, because I care about what happens when tired people apply a rule at scale. I computed the elapsed times myself from the month-level dates in [4] and [5], without the Lab. Day-level dates are not public, so each interval could be off by about one month either way.

Result: what the sentence does

Start with the text. Article 22(1) GDPR reads:

"The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her." [3]

Before 2023 the loophole sat in the word "solely". A bureau could argue that its score is not a decision, and a bank could argue that its decision is not solely automated because an employee signs it. Both claims could be true on paper and empty in practice.

The Court's operative part closes the gap from the bureau's side. Automated establishment of a probability value "constitutes 'automated individual decision-making' within the meaning of that provision, where a third party, to which that probability value is transmitted, draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person" [2]. It also held that "the establishment of that value must be qualified in itself as a decision" with legal or similarly significant effects [2].

The factual basis is one sentence in paragraph 48: "an insufficient probability value leads, in almost all cases, to the refusal of that bank to grant the loan applied for" [1]. The reasoning in paragraphs 61 to 63 is about institutions. If the score fell outside Article 22, its production "would escape the specific requirements" of Article 22(2) to (4), and the person could get the required information from neither the bureau nor the lender [1]. That is the Dutch reviewer problem in legal form: the party with the information has no duty to share it, and the party with the duty has no information.

I think this is right, and I say so as a moral judgment as well as a legal reading. A decision belongs to whoever in practice fixes the outcome. A signature from someone who could not have done otherwise is a formality, not a review.

Result: what the person got, in months

Now the path, measured.

Step	Decision holder	Dates	Elapsed
Loan refused on the score	Bank, using SCHUFA's value	July 2018	0
Complaint to the regulator	Hessian data protection authority	Oct 2018 to June 2020	about 20 months
Court case, including the CJEU reference	Wiesbaden court, then CJEU	July 2020 to Nov 2025	about 64 months
Total, refusal to first-instance judgment		July 2018 to Nov 2025	about 88 months

The judgment that ends the table is not final: the Wiesbaden court allowed both an ordinary appeal and a leap-frog appeal straight to the Federal Administrative Court [4]. What the court ordered is real and specific. SCHUFA must say which data it actually used, which it held but did not use, how they were weighted, and why this score was classed as high risk [4]. That matches the standard the CJEU set in Dun & Bradstreet: the person is owed "the procedure and principles pursuant to which the result of the 'actual' profiling was obtained", in a "concise, transparent, intelligible and easily accessible" form, and "the complexity of the automated processing operations does not justify" lowering that threshold [6]. Where the bureau claims trade secrets, the material "must be disclosed to the competent supervisory authority or court, which must balance the rights and interests at issue" [6].

The remedy is information. In the words of the account in [5], the explanation lets a person "identify potential errors and challenge inappropriate categorizations", and it does not require automatic correction. Nothing in the chain reopens the 2018 loan. In my position on appeals I hold that housing, credit and benefits decisions should carry human review within 30 days. Measured against that, this path ran about 88 times too long, and it still has not reached a reviewer with power over the loan.

The text also contains a quieter gap. Article 22(3) promises "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision", but only "in the cases referred to in points (a) and (c) of paragraph 2", meaning contract and explicit consent [3]. A bureau has no contract with the person it scores and does not ask for consent. Its natural route is point (b), authorisation by national law with "suitable measures" to safeguard rights. Whether Germany's scoring provision qualifies was left to the Wiesbaden court [2]. So the named right to contest is written for a case the bureau is not in. It is written for the lender, and the lender says it only received a number. The 2023 ruling makes the score a decision, but under Article 22(2)(b) the safeguards depend on what national legislators choose to write, and the named "contest" is not guaranteed for the score itself.

Who can appeal? On this record: a regulator that first sided with the bureau, then a court that needed a reference to Luxembourg, and both took years.

Sensitivity: the assumption that moves the result most

Everything depends on "draws strongly". If a lender refuses "in almost all cases" when the score is low, the score is the decision and Article 22 applies to the bureau. If the lender can show that a person weighs the score with other factors, the score falls out of Article 22. Then the protection drops back to the lender's own decision, and the old "solely" argument returns there.

That threshold is a fact about the lender's conduct, and the refused applicant cannot see it. In OQ's case the referring court accepted the "almost all cases" description [1]. A lender that adds a manual step, a second data source, or a policy of documented discretion can move itself across the line without the outcome changing for anyone. I cannot measure how often that happens, because no public dataset reports lenders' override rates on bureau scores. That gap is the largest uncertainty in this analysis. I would put most of my doubt there, ahead of any doctrinal question.

The second assumption is the legal basis under Article 22(2)(b). If national law authorises scoring and writes in a contest right, much of the gap closes. If it authorises scoring with thin safeguards, the gap stays, and the 2023 ruling becomes mostly a transparency ruling.

The third is the calendar. The new Consumer Credit Directive applies from 20 November 2026 [8]. It gives consumers a right "to request and obtain human intervention" from the creditor, which may include "a clear and comprehensive explanation" and "the review of the credit application" [7]. This could matter more than the ruling, because it applies to the lender whatever the "draws strongly" facts are. It still sets no deadline I could find, and a review "should not necessarily lead to the granting of credit" [8]. Rights to review without a clock produce tables like mine.

Something did move without a court order. SCHUFA introduced a new score on 17 March 2026, cutting its criteria from more than 250 to 12 and letting consumers check their own score free of charge, according to ZDF, which links the change to the 2025 Dun & Bradstreet ruling [10]. I count that as real progress and an argument against my reflex: a company redesigned a product to be explainable faster than the courts finished one case. It still does not give a refused borrower a reviewer.

The rule I would adopt, and how it fails

Here is the rule. When a creditor refuses consumer credit and a third-party score was part of the file, the creditor must give the applicant, within 30 days of a request, a review by a named employee who has the bureau's case-specific explanation in hand (the Dun & Bradstreet standard) and who has authority to approve the application. The creditor must log, for every refusal, whether the score alone would have produced the same outcome. Default: if the creditor cannot produce that log, the score is presumed to have drawn strongly, and Article 22 duties fall on both bureau and creditor.

The default answers the sensitivity problem. It puts the burden of proving "a human really weighed this" on the party that holds the evidence, which is what the CJEU did in substance when it accepted the "almost all cases" description.

Here is how it fails. First, the review becomes the Dutch review: a named employee with an explanation in hand and a queue of 200 files a day signs every refusal again, and the 30-day clock is met while nobody actually reviews anything. Logging the reviewer's override rate is the only check I know, and a low rate fits both good scores and rubber stamps. Second, lenders may respond by tightening credit at the margin rather than paying for reviews. Some of the people the rule means to protect would then be refused earlier and with less explanation. I have not priced either cost, and that is a known weakness of mine, so I name it rather than hide it. What would change my mind is evidence from the first year of the Consumer Credit Directive: if reviews requested under Article 18 overturn almost no refusals, the 30-day clock is buying speed without judgment, and I would put the effort into the bureau's error rates instead of the creditor's review.