Loan refused: When must SCHUFA explain your credit score?

What did the BGH decide?

In 2023, a consumer received a data statement containing several credit scores. He wanted more detail about how his scores had been produced. Dresden Higher Regional Court awarded him some additional information. The BGH set that ruling aside: there were no findings establishing which specific contractual decisions depended to a determining extent on the individual scores. Parts of the court’s operative order were also insufficiently specific (paragraphs 4 to 11, 33 to 34 and 59 to 65).

That does not mean the consumer has definitively lost. The Higher Regional Court must examine the case again, and the claimant can amend his applications. Equally, the BGH has not finally awarded him the information sought. The judgment examines information provided in 2023 and does not give blanket approval to every SCHUFA disclosure made today.

A copy of your data and an explanation of the score are different questions

Article 15 GDPR generally provides access to your own personal data being processed and a copy of those data. You do not first have to prove that a loan application failed. The specific right to meaningful information about automated decision-making logic under Article 15(1)(h) GDPR has additional requirements.

According to the BGH, all the elements of Article 22(1) GDPR must be present: a decision, solely automated processing, and legal or similarly significant effects. In scoring cases, the question is whether the score transmitted to a third party plays a determining role in that party’s contractual decision. The mere storage of a low score is not enough. However, the information claim does not additionally require proof that the automated decision was unlawful (paragraphs 41 to 58).

What evidence helps after a loan refusal?

The BGH does not demand inaccessible insight into the bank’s software. The starting points are a provable transmission of a score to a company and a temporally connected disadvantageous decision during contract negotiations or performance involving that company or an associated company. If those circumstances are set out and proved where necessary, a determining influence is factually presumed. The presumption can be rebutted; it does not guarantee success in court (paragraphs 67 to 70).

Our own hypothetical example: a consumer finds a transmission of a score to the prospective lending bank in her data copy. Shortly afterwards, that bank refuses her loan application. Together, the two documents may support the presumption described by the BGH. A refusal by a different, unconnected bank or a low base score merely obtained by the consumer herself does not establish this link. A base score calculated solely to inform the individual may lack the required significant effect (paragraphs 62 and 81).

What must a meaningful score explanation provide?

If the specific right applies, the explanation must make clear which of your personal data were used and how. In the case decided, the listed data categories and risk assessments were insufficient. The criteria for those assessments, their relative weighting and conspicuous differences between individual scores also required explanation (paragraphs 71 to 74 and 82).

A general reference to trade secrets is insufficient; competing rights and interests must be balanced. That does not create a blanket right to disclosure of the entire algorithm. According to this judgment, Article 15(1)(h) GDPR does not cover scientific evidence of the scores’ validity (paragraphs 75 and 83 to 84).

Timing note as at 7 November 2026: the BGH also refers to a separate right under section 37a(4) of Germany’s Federal Data Protection Act, which will apply only from 20 November 2026. That future right must be distinguished from the GDPR ruling explained here (paragraph 85).

How to prepare your case for assessment

Our practical recommendation is to prepare a short chronology and keep the complete documents. The following are particularly useful when making a targeted information request or assessing an inadequate response:

• The SCHUFA data copy showing the score’s name, the date of transmission and the receiving company.
• The loan application, proposed contract or existing contract, together with the specific refusal or other disadvantageous decision.
• Any information from the company about the role the score played. Do not replace a missing explanation with assumptions.
• Your previous information requests, proof of sending them and complete responses.

How quickly must an information request receive a response?

Article 12(3) GDPR requires information about the action taken without undue delay and at the latest within one month of receipt of the request. Where the complexity or number of requests makes an extension necessary, two further months are possible; the individual must be informed of the extension and its reasons within the first month. Disclosure and any further dispute require separate assessment. The BGH judgment does not by itself produce loan approval, deletion of a score or a damages payment.