Credit reference agencies under scrutiny by the ECJ, the Austrian Supreme Court and the Federal Court of Justice
Are credit reference agencies permitted to generate credit scores even without specific payment history? What data are they permitted to use for this purpose? And how far does the right to information regarding the calculation of a score extend? Recent rulings by the Austrian Supreme Court (OGH), the German Federal Court of Justice (BGH) and the European Court of Justice (ECJ) are clarifying the data protection boundaries of this business model.
Credit scoring is not unlawful per se
In three parallel rulings dated 12 August 2026, the OGH had to assess whether a credit reference agency is permitted to generate credit scores even where no specific payment history data is available for an individual.
The OGH ruled out a general prohibition. Credit reference agencies and their customers generally pursue legitimate interests within the meaning of Article 6(1)(f) of the GDPR: credit information is intended to reduce information asymmetries, default risks and fraud risks. If specific payment history were a mandatory requirement, credit reports could not be provided at all for a large proportion of consumers. Whether the interests of the data subject nevertheless prevail must, however, be assessed on the basis of the specific circumstances of the individual case.
The conclusion: a credit score without specific payment history data is not unlawful on those grounds alone. However, this does not provide carte blanche for the use of arbitrary data sources or calculation methods.
Marketing data must not be used as credit data
The Supreme Court drew the decisive line at the principle of purpose limitation. In the proceedings, the credit reference agency had obtained data such as name, address and date of birth from a directory publisher. This data had originally been collected on the basis of Section 151 of the Trade Regulation Act (GewO) for the purposes of the directory publisher and direct marketing. The credit reference agency subsequently used it to identify individuals in the context of creditworthiness enquiries.
In the Supreme Court’s view, this identity check alone is already part of the creditworthiness assessment. It is therefore irrelevant whether the purchased address data is directly incorporated into the mathematical calculation algorithm. The use of the data for creditworthiness purposes constitutes a change of purpose. Neither Section 151 nor Section 152 of the Austrian Trade Regulation Act (GewO) provides a sufficient legal basis for such further processing.
In the absence of consent, the compatibility test under Article 6(4) of the GDPR must therefore be carried out. In this case, the outcome was unfavourable to the credit reference agency:
- There is no sufficient factual link between direct marketing and creditworthiness assessment.
- There was no original connection between the data subjects and the credit reference agency at the time of collection.
- A negative score can have significant consequences, such as the refusal of a loan or the conclusion of a contract.
- No appropriate additional safeguards were identified.
- Data subjects cannot reasonably be expected to anticipate that data collected for marketing purposes will later be used for credit assessments.
The processing was therefore incompatible with the original purpose.
Right to injunctive relief in Austria?
The Supreme Court also affirmed a right to injunctive relief under Austrian law: the right to data protection is a personal right, the infringement of which, where there is a risk of repetition, may give rise to a claim under Section 20(1) of the Austrian Civil Code (ABGB).
When must the calculation of a score be disclosed?
A second recent development concerns the transparency of scoring. On 21 October 2026, the German Federal Court of Justice ruled in four parallel cases on claims for information against SCHUFA.
According to the judgment of the Court of Justice of the European Union in Case C-634/21, SCHUFA Holding (Scoring), the automated generation of a probability value may in itself constitute an automated decision under Article 22(1) of the GDPR. The prerequisite is that whether a third party enters into, performs or terminates a contract with the data subject depends significantly on this value.
The Federal Court of Justice confirmed that the generation of a score can be classified as profiling and as a ‘decision’ within the meaning of Article 22 of the GDPR. However, for the specific right of access under Article 15(1)(h) of the GDPR, it must also be established that the data subject has been legally or similarly significantly affected by the automated decision. The findings of the lower court to date were insufficient for this; the Federal Court of Justice therefore remanded the proceedings.
The burden of proof generally lies with the data subjects. However, the Federal Court of Justice grants them a significant relaxation of the burden of proof: if it is demonstrated that a score was transmitted to a company and, in temporal connection with this, an adverse contractual decision was taken, there is a factual presumption that the score was decisive for that decision.
Consequently, the right to information is neither automatically granted nor limited to exceptional cases. The decisive factor is the actual significance of the score for the contracting party’s subsequent decision.
Three GEISTWERT guidelines for practice
Three clear guidelines emerge from current case law:
Scoring remains possible in principle. Even without individual payment history, a credit score may be based on legitimate interests. However, necessity, data quality, transparency and the specific balancing of interests must still be documented.
The origin of the data is crucial. A lawful credit assessment does not remedy an unlawful change of purpose. Credit reference agencies must be able to demonstrate the purpose for which each category of data used was originally collected and why its further use is compatible with that purpose.
The greater the impact on decision-making, the greater the obligation to ensure transparency. If the conclusion of a contract depends significantly on the score, the processing falls within the scope of Article 22 of the GDPR. In such cases, the data subject must be provided with meaningful information about the logic involved, the scope and the intended effects of the processing.
GEISTWERT conclusion
The courts do not fundamentally question the business model of credit reference agencies. However, they require a clear distinction to be made between permissible creditworthiness assessments and impermissible misuse of data.
A credit score may be permissible even where there is no specific payment history. Data collected for marketing purposes must therefore not be used automatically for identification or creditworthiness assessment. Furthermore, if the score becomes decisive for a contractual decision, the requirements for transparency and traceability increase significantly.
Decisions and further links