Data protection case law Court of Justice

Automated individual decision-making, including profiling

1 pending referral

Referral C-203/22 (Dun & Bradstreet Austria, 16 Mar 2022)

1 preliminary ruling

of 7 Dec 2023, C-634/21 (SCHUFA Holding and Others)

Article 22(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that the automated establishment, by a credit information agency, of a probability value based on personal data relating to a person and concerning his or her ability to meet payment commitments in the future constitutes ‘automated individual decision-making’ within the meaning of that provision, where a third party, to which that probability value is transmitted, draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person.