BGH Sets Aside SCHUFA Score Disclosure Orders but Lowers the Proof Bar for Claimants (I ZR 227/25)

Germany's Federal Court of Justice set aside four orders requiring SCHUFA to explain how it calculates credit scores, ruling on 21 October 2026 that the appeal court had not established the fact the claim principally turns on. It also made that fact considerably easier to prove.

Information last verified on October 22, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: Germany, and specifically the right to information about the logic of automated decision-making under Art. 15 Abs. 1 Buchst. h DSGVO as applied to a Wirtschaftsauskunftei. It does not address how long a negative SCHUFA entry may be stored, which is a separate line of case law, and it does not address credit scoring outside Germany. For the storage and deletion side, see our guide to what SCHUFA actually has to delete.

What Happened

On 21 October 2026 the I. Zivilsenat of the Bundesgerichtshof, the senate responsible among other things for claims under the EU General Data Protection Regulation, decided four appeals brought by SCHUFA against private individuals who had sued the bureau for information about how their credit scores were calculated.

SCHUFA operates a Wirtschaftsauskunftei. According to the court's account of the facts, its credit-information system rests on collecting, storing, processing and passing on economic data about natural and legal persons, primarily so that lenders are protected against losses. When it reports on a customer's prospective contracting partner, it uses a mathematical and statistical procedure to form probability values differentiated by purpose, the Scorewerte, which are meant to let its customers assess that person's expected payment behaviour.

In 2023 SCHUFA wrote to each of the claimants with the personal data it held on them and the scores it had transmitted in response to credit enquiries over the preceding twelve months. The tables it sent listed, among other things, score values, rating levels, fulfilment probabilities and the categories of data it said it was then using, together with the associated risk of default. Values, percentages and further entries appeared against each heading, some of them explained at the foot of the table, and the letters pointed to additional scoring information available online.

The claimants, all private individuals, took the position that this did not explain the calculation. They sued for information about how the scores were computed and for reimbursement of their out-of-court legal costs, relying on the DSGVO.

How the four cases reached Karlsruhe

The Landgerichte dismissed the information claims outright. On appeal the Oberlandesgericht Dresden partly reversed, ordering SCHUFA in each case to disclose the weighting of the criteria that most strongly influenced that claimant's score, the significance of the score actually calculated for them, and the personal data and criteria used to build their Basisscorewerte. It also ordered reimbursement of out-of-court legal costs, and dismissed the claimants' further appeals.

The appeal court granted leave to appeal to the Bundesgerichtshof, and SCHUFA pursued its application for the claims to be dismissed in full. The procedural history runs as follows:

• I ZR 227/25: Landgericht Chemnitz, judgment of 8 January 2025, 1 O 1454/23; Oberlandesgericht Dresden, judgment of 7 October 2025, 4 U 144/25.
• I ZR 228/25: Landgericht Leipzig, judgment of 29 May 2024, 07 O 2599/23; Oberlandesgericht Dresden, judgment of 7 October 2025, 4 U 883/24.
• I ZR 229/25: Landgericht Görlitz, judgment of 25 September 2024, 1 O 100/24; Oberlandesgericht Dresden, judgment of 7 October 2025, 4 U 1492/24.
• I ZR 230/25: Landgericht Görlitz, judgment of 11 April 2025, 1 O 261/24; Oberlandesgericht Dresden, judgment of 7 October 2025, 4 U 615/25.

The outcome, and the reason for it

SCHUFA's appeals succeeded. The Bundesgerichtshof set aside the appeal judgments insofar as the claims for information and for reimbursement of out-of-court lawyers' fees had been granted, and remitted the cases to the Oberlandesgericht Dresden for fresh hearing and decision.

The reason was not that credit scoring falls outside Art. 22 DSGVO. On the contrary, the court held that SCHUFA's activity satisfies the characteristics of Profiling within the meaning of Art. 4 Nr. 4 DSGVO and of a decision within the meaning of Art. 22 Abs. 1 DSGVO. What the appeal court's findings did not allow the BGH to assess was whether the claimants had been significantly affected by the decision in their own case. To answer that, the appeal court would have had to establish something its findings do not cover: whether a third party receiving the score materially depended on it in deciding to begin, perform or end a contractual relationship with that claimant.

The BGH framed the claim as resting on the Court of Justice of the European Union's judgment of 7 December 2023 in Case C-634/21, SCHUFA Holding (Scoring), under which a claim of this kind exists only where every element of Art. 22 Abs. 1 DSGVO is satisfied. That means the data subject must be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

The Two-Step Test the BGH Set for Claimants

On who has to prove that, the court was clear that the burden of pleading and proof lies with the claimants. It was equally clear that the bar must not be set too high:

"Mit Blick auf den unionsrechtlichen Effektivitätsgrundsatz sind daran jedoch keine zu hohen Anforderungen zu stellen." Bundesgerichtshof, Pressemitteilung Nr. 198/2026, 21 October 2026, Entscheidung des Bundesgerichtshofs

In concrete terms, the court said it is enough for a claimant to plead two things. First, that SCHUFA transmitted a score to a company. Second, that in temporal connection with that transmission there was a decision adverse to the claimant in the initiation or performance of a contractual relationship with that company or an affiliated company. The reference to an affiliated company matters, because it covers group structures where the entity that pulled the score and the entity that made the decision are not the same.

Once those two elements are pleaded and, where necessary, proved, a presumption arises:

"Ist dies dargelegt und gegebenenfalls bewiesen, besteht eine tatsächliche Vermutung dafür, dass die Entscheidung des Unternehmens maßgeblich auf die von der Beklagten gebildeten Scorewerte zurückzuführen ist." Bundesgerichtshof, Pressemitteilung Nr. 198/2026, 21 October 2026, Entscheidung des Bundesgerichtshofs

The release calls this a tatsächliche Vermutung, a factual presumption. It does not set out what a bureau would have to show to displace it, and the reasoning that would answer that question is not yet published.

The court also noted that in taking this approach it was diverging from the view of some other Oberlandesgerichte. That is a significant part of the ruling even though it occupies one clause: it means claimants in Germany had been facing materially different evidential demands depending on which appeal court heard them, and a decision from the Bundesgerichtshof is the mechanism that narrows that spread.

Why the 2023 SCHUFA Letters Were Not Enough

The BGH added a holding that reaches well beyond these four claimants, and it is conditional in form:

"Ist die Beklagte dem Grunde nach zu einer Auskunft nach Art. 15 Abs. 1 Buchst. h DSGVO gegenüber den Klägern verpflichtet, hat sie diese Verpflichtung mit ihren Schreiben aus dem Jahr 2023 nicht erfüllt." Bundesgerichtshof, Pressemitteilung Nr. 198/2026, 21 October 2026, Entscheidung des Bundesgerichtshofs

Read carefully, that says two things at once. Whether the duty exists at all is still open and goes back to Dresden. But if it does exist, the 2023 correspondence, with its tables of score values, rating levels, fulfilment probabilities and data categories plus a pointer to a web page, did not discharge it.

That conclusion sits naturally alongside Art. 12 Abs. 1 DSGVO, which the court reproduced among the governing provisions and which requires communications under Articles 15 to 22 to be provided in a precise, transparent, intelligible and easily accessible form using clear and plain language. The federal data protection commissioner, the BfDI, makes a parallel point about the data copy under Art. 15: a purely general description of the data, or a reference to categories of personal data, is not sufficient.

What the Law Actually Says

The provision at the centre of the case is Art. 15 Abs. 1 Buchst. h DSGVO. It gives a data subject the right to be told whether automated decision-making, including profiling, under Art. 22 Abs. 1 and Abs. 4 DSGVO exists, and, at least in those cases, to receive what the German text calls "aussagekräftige Informationen über die involvierte Logik sowie die Tragweite und die angestrebten Auswirkungen einer derartigen Verarbeitung für die betroffene Person".

Two features of that wording drive the whole dispute. The entitlement is to meaningful information about the logic involved, not to the source code or the model itself. And it is gated on Art. 22 Abs. 1, which is why a case about transparency turns into a case about whether a lender's decision was really made by the score.

The general right of access sits underneath all of this and is far easier to invoke, because it does not depend on Art. 22 at all. Our explainer on how the Art. 15 DSGVO right of access works in Germany covers those mechanics.

The right is not unlimited. Art. 15 Abs. 4 DSGVO requires the rights and freedoms of others to be respected, which the BfDI describes as protecting in the first instance third parties' personal data and trade and business secrets. That, together with the German secrecy carve-out set out below, is the counterweight any scoring-logic claim eventually runs into, and the press release does not reveal how the BGH balanced it; it says only that the appeal court had not determined the scope of the claim free of legal error in all respects and that the senate gave guidance for the further proceedings.

German statutory law adds carve-outs on top of the DSGVO ones. § 34 Abs. 1 BDSG withdraws the Art. 15 right where the data subject is not to be informed under the cases § 33 BDSG lists, or where the data are stored only because a statutory or charter retention rule forbids deleting them, or serve exclusively data-security or data-protection-monitoring purposes, and in that second case only if disclosure would require disproportionate effort and processing for other purposes is ruled out by appropriate technical and organisational measures. The provision operates expressly in addition to the exceptions in § 27 Abs. 2, § 28 Abs. 2 and § 29 Abs. 1 Satz 2 BDSG. Any refusal must be documented, and must as a rule be explained to the data subject unless giving the reasons would defeat the purpose of withholding the answer (§ 34 Abs. 2 BDSG).

The exception most likely to be argued in a scoring case is § 29 Abs. 1 Satz 2 BDSG. Under it the Art. 15 right does not exist insofar as the answer would reveal information that has to be kept secret under a legal provision or by its nature, in particular because of the overriding legitimate interests of a third party. That is where a bureau's trade-secret objection to explaining its model lands in German law. The press release does not say whether the provision featured in these appeals.

A separate German provision governs the other end of the chain. § 31 BDSG regulates the use of a probability value about a person's future behaviour for the purpose of deciding on the beginning, performance or end of a contractual relationship with that person. It permits scoring only where data protection law has been complied with, where the data used are demonstrably relevant on the basis of a scientifically recognised mathematical and statistical procedure, where address data alone were not used, and where the person was informed in advance if address data were used. Its second subsection then restricts which unpaid claims may be factored in at all, through conditions that track collection practice closely enough to overlap with the rules on how German debt collectors have to operate.

The distinction is worth holding onto. § 31 BDSG constrains the party that uses a score to make a decision. Art. 15 Abs. 1 Buchst. h DSGVO constrains the bureau that built the score and asks it to explain the logic. These four appeals were about the second duty, not the first.

What Happens Next on Remand

The press release sets out the sequence the Oberlandesgericht Dresden must now follow. The claimants first get the opportunity to cure the defects in the specificity of their respective claim applications that the Bundesgerichtshof identified. The appeal court must then make the missing findings on the basis of the claim. If SCHUFA is in principle obliged to provide information under Art. 15 Abs. 1 Buchst. h DSGVO, the court will then have to decide again on the scope of each claimant's entitlement, with the benefit of the guidance the senate gave.

We are not going to predict how any of that comes out, and the material to reason from is thin: as of 22 October 2026 the Bundesgerichtshof has published the press release only. The four decision files linked from it are Entscheidungsversand notices confirming that the judgments are not yet available in print and that no further information is available beyond the press release.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The headline and the doctrine point in opposite directions here, and any account that gives only one of them is misleading. SCHUFA won four appeals and four disclosure orders were set aside. In the same decision the court confirmed that scoring can be profiling and can be a decision within Art. 22 Abs. 1 DSGVO, and then lowered the evidential threshold that had been the main practical obstacle to these claims. Both halves are real.

The centre of gravity in this litigation has shifted. The question of whether a credit score can ever engage Art. 22 DSGVO was largely answered by the Court of Justice in C-634/21 and is narrowed further by the BGH's findings on profiling and on the existence of a decision. What is left is a question of fact about the individual claimant: was this person significantly affected, which in practice means did a third party's contract decision really turn on the score.

That is exactly where the presumption bites. Proving that a lender's internal decision rested materially on a transmitted score requires visibility into a process the claimant has no access to, which is why the burden was so hard to discharge. Reframing it as transmission plus a temporally close adverse decision moves the explaining to the side that holds the information. The press release does not say what displaces the presumption, so how much it is worth in practice depends on reasoning that has not been published.

The divergence from other Oberlandesgerichte deserves more attention than its single clause suggests. Inconsistent appellate thresholds for the same GDPR right produce outcomes that depend on geography rather than facts, and a ruling from the Bundesgerichtshof is the ordinary corrective for that.

Two cautions cut the other way. The specificity objection to the claim applications is a reminder that a GDPR information claim can fail on how it is worded even where the underlying right exists, which is a procedural trap rather than a substantive answer. And the scope of the duty, the part that decides whether a claimant learns anything useful about their own score, is both the part the BGH said the appeal court had not got right in all respects and the part we know least about.

Set against that, the conditional holding on the 2023 letters may have the widest reach of anything in the decision. The court describes the 2023 correspondence once, in the same terms for all four claimants, which suggests materially identical output rather than bespoke responses, though the release does not say so. If that reading holds, a finding that correspondence of that kind would not discharge an Art. 15 Abs. 1 Buchst. h duty speaks to a template rather than to four individuals. The condition attached to it has not been resolved.

How This Affects You

If you are in Germany and dealing with a SCHUFA score, the most useful thing to understand is what this ruling did not do. It did not decide that any particular person is entitled to an explanation of their score, it did not fix how much a bureau must reveal, and it did not change anything about how long entries stay on file.

What remains unaffected and immediately available is the ordinary right of access. A request under Art. 15 DSGVO needs no justification and is in principle free of charge, with the first copy of the processed data provided at no cost, according to the BfDI. That is a different and much lower hurdle than the Art. 15 Abs. 1 Buchst. h question these appeals turned on, and our page on what SCHUFA actually has to delete explains how the data copy fits into the wider picture of entries, corrections and deletion timelines.

Precision appears to matter at both ends of the process. The BfDI advises describing as exactly as possible what information a request covers, and notes that where large volumes of data are processed a controller may ask the data subject to specify which information or processing operations the request concerns. The Bundesgerichtshof, at the other end, faulted the wording of the claim applications in these four cases for insufficient specificity.

If a controller refuses access, or if you doubt that the answer you received was complete, the BfDI points data subjects to the competent data protection supervisory authority and provides a contact finder for identifying which authority that is. Whether an individual situation supports a claim under Art. 15 Abs. 1 Buchst. h DSGVO is a legal assessment that depends on facts this article cannot know.

This is general legal information, not legal advice. It covers Germany and EU data protection law as applied by the Bundesgerichtshof, and reflects sources verified on October 22, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• What SCHUFA actually has to delete, and what it does not
• How the Art. 15 DSGVO right of access works in Germany
• The rules German debt collectors have to follow
• Our Germany data privacy section
• Germany's data protection framework in our world privacy series
• Our earlier coverage of the BGH on subscription price adjustment clauses

---

Last updated: 2026-10-22. This is a developing story; details verified as of 2026-10-22.

Frequently Asked Questions

Did SCHUFA win or lose the BGH ruling of 21 October 2026?

Both, in different senses. SCHUFA's four appeals succeeded and the Oberlandesgericht Dresden orders requiring it to disclose score-calculation details were set aside and remitted. In the same decision the Bundesgerichtshof confirmed that scoring can engage Art. 22 Abs. 1 DSGVO and substantially lowered what a claimant must plead and prove (BGH, Pressemitteilung Nr. 198/2026).

Does the ruling mean SCHUFA now has to explain how my score is calculated?

No. Whether the duty under Art. 15 Abs. 1 Buchst. h DSGVO arises at all in these four Germany cases goes back to the Oberlandesgericht Dresden, which must first establish whether each claimant was significantly affected and then decide the scope of any duty (BGH, Pressemitteilung Nr. 198/2026).

What does a claimant in Germany now have to show?

According to the press release it is enough to plead that SCHUFA transmitted a score to a company and that, in temporal connection, an adverse decision followed in the initiation or performance of a contract with that company or an affiliated company. A factual presumption then applies that the decision was materially based on the score.

Is a credit score an automated decision under Art. 22 DSGVO?

It can be. The Bundesgerichtshof held that SCHUFA's activity meets the definition of Profiling in Art. 4 Nr. 4 DSGVO and of a decision in Art. 22 Abs. 1 DSGVO, and that disclosure is owed where a third party's decision to begin, perform or end a contract depends materially on the score transmitted to it. The court applied the Court of Justice's judgment of 7 December 2023 in C-634/21, SCHUFA Holding (Scoring).

Can I read the full judgments in I ZR 227/25 to I ZR 230/25?

Not as of 22 October 2026. The four decision files published on the Bundesgerichtshof website are Entscheidungsversand notices stating that the judgments are not yet available in print and that no further information exists beyond the press release.

Does this affect how long a negative SCHUFA entry stays on file?

No. These appeals concern the right to information about the logic behind a score under Art. 15 Abs. 1 Buchst. h DSGVO. Retention and deletion of entries run on a separate line of German case law and on separate rules.

Can a decision about me be based on a score built only from my address data?

Not under § 31 Abs. 1 BDSG as enacted. That provision allows a probability value to be used for deciding on the beginning, performance or end of a contract with a person only if, among other conditions, address data were not used exclusively to calculate it, and where address data were used the person must have been informed in advance and that notice documented. § 31 BDSG binds the party using the score, which is a separate duty from the bureau's duty to explain its logic.