DATA PROTECTION – The ECJ on values established by credit information agencies

On 7 December 2023, the European Court of Justice (ECJ) issued its judgment in case C‑634/21 (OQ v Land Hessen and SCHUFA Holding AG) holding that when a probability value established by a credit information agency and communicated to a bank plays a determining role in the granting of credit, the establishment of that value must be qualified in itself as a decision producing legal effects concerning the data subject or similarly significantly affecting him or her, within the meaning of Article 22(1) of the GDPR. Based on this consideration, processing is authorised only in the cases referred to in Article 22(2), namely where the decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, where it is authorised by EU or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, or where it is based on the data subject’s explicit consent. The ECJ also clarified that in all cases, processing remains subject to Articles 5 and 6 of the GDPR.

Newsletter n. 92 – January 2024