In 2023 the Court of Justice of European Union in his SCHUFA judgement clarified that producing and transmitting a credit score can itself amount to an automated decision under article 22 of the GDPR, where the score is determinative for contract outcomes. Today this decision of the Austrian data protection authority has translated into concrete enforcement.
The Austrian data protection authority has found the KSV1870 credit scoring information unlawful. The regulator also reprimanded the company for its lack of transparency especially with regard to the automated ratings by credit information agencies such as KSV1870., the regulator has clarified that KSV 1870 such practice is unlawful.
Further, this credit rating is considered a prohibited decision under article 22 of the GDPR, only if special conditions are met; such as the explicit consent of the data subject. The Austrian data protection authority has concluded that KSV1870 actions clearly violate the prohibition of automated individual decision making and that the credit information agency has not complied with the respective transparency obligations.
Add a Comment