Germany's BGH sets the proof test for access to credit-score logic under GDPR Art. 15(1)(h)

Key takeaways

• The BGH set aside the appeal judgments insofar as they granted information and out-of-court legal cost claims, and remitted the cases.
• The right under Art. 15(1)(h) GDPR depends on all features of Art. 22(1) GDPR, following the CJEU's SCHUFA Holding (Scoring) judgment of 7 December 2023, C-634/21.
• The BGH found that SCHUFA's conduct meets the features of profiling and of a decision. What it said the appeal court had not established is whether claimants were significantly affected.
• Claimants carry the burden of pleading and proof, but the bar is not to be set too high.

What did the BGH decide on 21 October 2026?

The I. Civil Senate, which handles claims under the GDPR among other matters, ruled on four cases brought by private individuals who sued SCHUFA, a German credit bureau, for information on how their scores were calculated and for out-of-court legal costs. The regional courts dismissed the information claims. The appeal court partly changed those judgments and ordered SCHUFA to give information on the weighting of the criteria that most influenced each claimant's score, on the meaning of the specific score, and on the personal data and criteria used for the base scores, the release states.

SCHUFA's appeals on points of law succeeded. The BGH set aside the appeal judgments to the extent they granted the information and legal cost claims, and remitted the cases for a new hearing. In its words, the appeal court's findings so far do not support the order to give information under Art. 15(1)(h) and Art. 22(1) GDPR. The press release names the Dresden Higher Regional Court judgments of 7 October 2025 as the lower rulings in all four cases.

What must a claimant show to get the Art. 15(1)(h) information right?

The BGH applied the CJEU's 2023 SCHUFA Scoring judgment. Under it, the information claim exists only if every feature of Art. 22(1) GDPR is met: a decision based solely on automated processing, including profiling, that has legal effect or similarly significantly affects the person. The BGH held that SCHUFA's conduct meets the features of "profiling" under Art. 4 No. 4 GDPR and of a "decision" under Art. 22(1). The open point was whether the claimants were significantly affected, which turns on whether a third party's decision to enter into, perform or end a contract with the claimant depends decisively on the score sent to it.

The release puts the headline this way: "Die Erstellung eines Scorewerts kann eine automatisierte Entscheidungsfindung sein und nach Art. 15 Abs. 1 Buchst. h DSGVO zur Auskunft verpflichten" (BGH press release 198/2026, 21 October 2026, opening paragraph). It adds that the claimants must plead and prove this, with considerable relief, and says the bar is not to be set too high given the EU law principle of effectiveness.

The practical test is in the release: it is enough if a claimant states that SCHUFA sent a score to a company and that an adverse decision on starting or performing a contract with that company or an affiliate followed in close time. The BGH said this departs from the view of some other higher regional courts. Once that is shown, "besteht eine tatsächliche Vermutung dafür, dass die Entscheidung des Unternehmens maßgeblich auf die von der Beklagten gebildeten Scorewerte zurückzuführen ist".

What does it mean for lenders, scoring firms and their lawyers?

For a score provider, the ruling narrows the exposure in one respect and widens it in another. It confirms that an information duty is not automatic for every score; it depends on decisive reliance by a third party. It also makes that reliance easier to plead. A claimant who pleads, and where necessary proves, a transmitted score and a temporally connected adverse contract decision has a factual presumption in the claimant's favour, and the release does not say how the presumption can be rebutted. We do not infer a rebuttal standard.

For a lender or other score user, the question is whether your decisions depend decisively on a vendor's score. The release says that is the fact the courts will look for. For consumer and data-protection counsel, the remitted cases will decide the scope of the information owed if the right is established. The BGH said SCHUFA's 2023 letters did not satisfy it if the duty exists in principle, and that the appeal court had not determined its reach correctly in every point. Earlier coverage of the CJEU ruling is in our article on the CJEU SCHUFA decision.

What should lenders and scoring firms do now?

• List each vendor score used in credit, pricing or onboarding decisions and note whether a person reviews the score before a refusal.
• Record how each decision depends on the score, since a factual presumption of decisive reliance can arise once a claimant shows a transmitted score and a temporally connected adverse contract decision.
• Review how access requests citing Art. 15(1)(h) are triaged, and keep a dated log of what was disclosed.
• Read the four full judgments, which the press release links as PDFs and which we have not reviewed, and check the reasoning on rebuttal and on the scope of the information owed.

What are the key dates and parties?

What we did not verify

What we opened: the BGH press release 198/2026 on the court's own website, in German, on 25 October 2026 (UTC).

What we did not open: the four full judgments, which the press release links as PDFs, and so their reasoning, the CJEU judgment C-634/21 itself, the lower court decisions, and any statement by SCHUFA or the claimants. Where the court's reasoning goes beyond the release, including how the presumption may be rebutted and what the appeal court must now decide on the scope of information, we do not know.

What we refuse to claim: that SCHUFA must disclose its formula, that the ruling binds beyond these cases, or any effect on lenders that the release does not state.

Related briefings

• AI Regulation News hub
• Europe AI regulation tracker
• Attorneys and AI regulation
• CJEU SCHUFA decision on Article 22 automated decisions
• EBA on AI Act credit scoring as high risk
• Dutch court on Article 15 access to automated moderation
• Austria amendment on fully automated decisions