Genicot, Nathan

English

<intR>²Dok

To Score Is to DecideNathan Genicot 2023-12-14T14:06:24Can the act of assigning a score to someone constitute a decision? This, in essence,is the question the Court of Justice of the European Union (CJEU) had to answerin Case C-634/21. And the Court’s answer is yes, following in the footsteps of theAdvocate General’s opinion on the case. Rendered on 7 December, this ruling waseagerly awaited as it was the first time the Court had the opportunity to interpret thenotorious Article 22 of the General Data Protection Regulation (GDPR) prohibitingdecisions “based solely on automated processing“.The CJEU has been asked to give a preliminary ruling by a German court (theWiesbaden Administrative Court, or Verwaltungsgericht Wiesbaden) in a caseinvolving three parties: a German consumer (the applicant), SCHUFA – a privateGerman company specializing in credit information and credit scoring –, and theData Protection Commissioner of the Land of Hesse whose decision in the firstinstance had been challenged by the applicant.The dispute arose from a credit score produced by SCHUFA, which led a thirdparty (a bank or other type of credit institution) to refuse a loan to the applicant.After being refused the loan, the applicant asked SCHUFA to disclose informationabout the data stored and to erase incorrect data. In response, SCHUFA informedher that her score was 85.96%, and provided some general information about themethodology used, but refused to say more, claiming business confidentiality. Theapplicant then sued SCHUFA, relying on various provisions of the GDPR. After beingdismissed at first instance, the applicant appealed against this decision before theVerwaltungsgericht Wiesbaden, which referred the matter to the CJEU.At the heart of the dispute lies the question of the applicability of Article 22 the GDPRto SCHUFA scores. But the CJEU’s ruling will have a wider impact, notably onall situations where a score or profile produced by one entity (whether private orpublic) is used by another. The path chosen by the Court is very welcome because itrecognises that, very often, the simple act of scoring is in itself a decision, but it alsoraises important questions that will no doubt give rise to much discussion.Scoring and consumer credit agenciesWhen banks and credit institutions decide whether or not to grant credit to aconsumer, they have two options: either they use only their own data, or they relyon information and data analysis provided by a third party, i.e. a consumer creditagency. In some countries, such credit agencies do not exist, notably in Belgium andFrance, where banks do not share customer data with each other. But in many othercountries, these companies play a crucial role in the credit market as they enable thecirculation of information.- 1 -Consumer credit agencies have a long history, dating back to the 1800s. In thecourse to the second half of the 20th century, they began to use statistical analysisin order to score individuals. In the United States, the main credit agencies anda company named FICO started producing the famous “FICO scores” which areattributed to the vast majority of Americans. In Germany, SCHUFA does thesame job: it collects consumer data from a wide range of financial players anduses algorithmic methods to produce a score that is supposed to describe thecreditworthiness of each individual.SCHUFA itself does not grant any loans nor provide any services to individuals, itmerely offers information to commercial actors. Strictly speaking, SCHUFA doesnot take any decisions concerning anyone as it has no contractual relationship withconsumers.However, depending on how credit institutions interpret a score, its influencevaries. A score may be one of many factors considered or, conversely, it may bethe only criterion taken into account by the lending institution. In many cases, alending institution will not base its decision solely on the credit bureau’s score butwill automatically refuse to grant credit to applicants with a score below a certainthreshold. In such a case, it is difficult to determine where exactly the decision istaken. Is the decision taken solely by the credit institution, or is the credit agency’sscore itself a decision?Credit scores and Article 22 of the GDPRIf this question matter, it’s because of the famous Article 22 of the GDPR whichprohibits automated decision. Should this provision apply, would this mean thatsuch use of a SCHUFA score is necessarily contrary to the GDPR? No, becausethe second paragraph provides for three exceptions to this general prohibition ofautomated decision-making: automated decisions may be authorised 1) if necessaryfor a contractual relationship, 2) if there is a legal basis authorising these decisions,3) if it is based on the data subject’s explicit consent. And the scores produced bycredit agencies could possibly fall within one of these exceptions1). But even if thescore fell within one of these exceptions and was therefore lawful, this would haveserious consequences for SCHUFA because additional requirements are imposedby the GDPR regarding automated decisions.The CJEU identifies two arguments – put forward by the German referring court andendorsed by the Advocate General – in favour of the applicability of Article 22.The first argument relates to the conditions set out in paragraph 1 of Article 22,which reads as follows:“The data subject shall have the right not to be subject to a decision basedsolely on automated processing, including profiling, which produces legaleffects concerning him or her or similarly significantly affects him or her.”- 2 -Three conditions are set out: first, there must be a decision taken about anindividual; second, the decision must be solely based on a automated processing;third, the decision must produce legal effects or significantly affect the data subject.Although the Court formulates the matter less clearly than the Advocate Generaldid2), we can say that two elements were not under debate: first, the grantingor refusal of credit is part of the type of decision covered by Article 22 (asdemonstrated by Recital 71 of the regulation); Second, SCHUFA scores areproduced automatically. However, as explained above, it is less clear that aSCHUFA score can be considered a decision. To decide this issue, the CJEU relieson the description given by the referring court, according to which the third partydraws “strongly” on credit scores so that an insufficient SCHUFA score leads “inalmost all cases, to the refusal of that bank to grant the loan applied for” (paragraph48). It is therefore a factual finding that demonstrates the score itself is a decision.The second argument relates to the lack of protection of the rights of the datasubjects that would result from the non-applicability of Article 22. Indeed, underArticle 13(2)(f), Article 14(2)(g) and Article 15(1)(h) of the GDPR, data subjectswho are the target of an automated decision within the meaning of Article 22 areentitled to receive “meaningful information about the logic involved [in the automateddecision], as well as the significance and the envisaged consequences of suchprocessing for the data subject”.However, if we were to consider that the credit agency score itself is not a decision,the people being assessed would not be able to ask the credit agencies to explainthe underlying logic, since article 22 would not apply. If they were to turn to thecredit institution, the latter would not be able to respond, since it would not have setthe score itself. Consequently, for the right to obtain meaningful information to beeffective and to avoid a “lacuna in legal protection” (paragraph 61), a score must bequalified as a decision within the meaning of Article 22, states the Court.The decisional nature of scores depending on theirfuture use?A notable aspect of the Court’s reasoning is that the decisional nature of the creditagency score appears to depend on the way in which the score is used by thepurchaser. The same score could, in one case, be classified as a decision on theground that it is the only criterion used by a bank; and in another case be regardedas not constituting a decision on the ground that it is only one element amongothers taken into account by another credit institution. This seems difficult to applyin practice, notably because the information rights set out in Article 13 and 14 mustbe implemented before the data is processed by the data controller, i.e. the creditagency3), which requires knowing in advance whether the score will qualify as adecision.The whole problem with scores is that we cannot anticipate their future uses. Creditbureau scores are often used not only by lending institutions, but also by tenants,- 3 -employers or insurance companies. How should a score be qualified in thesedifferent contexts? One possible solution would be to consider that credit agencyscores are in all cases decisions within the meaning of Article 22. In this sense, theUS Fair Credit Reporting Act will perhaps be seen as a source of inspiration for EUregulators. Indeed, the Act requires “consumer reporting agencies” to disclose creditscores – for a fair and reasonable fee and independently of their future uses – toconsumers, and to describe the “key factors that adversely affected the credit scoreof the consumer in the model used” (see section §609(f) of the Act).However, the issue does not only concern credit agencies, but more broadly allsituations where a score or profile produced by one entity (whether private or public)is used by another. The CJEU’s ruling is thus very welcome, in particular becauseit gives effective scope to Article 22, but, as we can see, it also opens up importantquestions that will continue to be debated.References• One aspect of the dispute is precisely that German law allows the use ofprobability values to assess creditworthiness, which could constitute a legalbasis. But I leave that question aside here.• Curiously, the Court seems to reverse the first and third conditions. The factthat it is in the field of credit is examined from the point of view of whetherit is a decision. And the question of whether the score itself determines theconsumer’s fate is examined from the point of view of the production of „legaleffects“.• As Binns and Veale point out.- 4 -

To Score Is to Decide

https://intr2dok.vifa-recht.de/servlets/MCRFileNodeServlet/mir_derivate_00016222/To_Score_Is_to_Decide.pdf

To Score Is to Decide

Abstract

Similar works

Full text

Available Versions

<intR>²Dok