Hi, I'm Megan Ward and I'm joined by Flick Fisher for today's bite-size legal update.

We're going to talk through two of the judgments of the Court of Justice of the European Union

handed down last week in the Schufer case and why they're important for you.

Schufor is one of the leading private credit agencies in Germany, and there were two cases brought against it.

Schufer 1 is somewhat a landmark judgment.

It's one of the first European court decisions which looks into what would amount to automated decision-making under Article 22 of the GDPR.

Schufer 2 is important because it challenges the law for retaining public registry data for commercial purposes.

We've split the reading on the cases this week and I'm going to let Flick take us through at Schufer 1.

So Flick,

here is Schufer and what was the case about? Yeah, thanks, Megan. As you mentioned in the intro, Schufer is a German credit reference agency that assigns scores to people, credit scores,

based on the probability that they will pay back alone in this case. So they calculate a person's score by

analyzing their supposed characteristics and behaviour using mathematical and statistical procedures.

So we can probably assume that that involves some form of machine learning models in the

background. And then the Schuper's customers who are typically banks would then use that score to decide whether or not to offer a person that loan.

And if so, in what conditions?

So in this case, the case arose off the back of a complaint from a data subject who was refused a alone and that lender had based its refusal on

the individual's credit score. Of course, the individual went to Schufer and submitted a subject

access request. They also requested that Schufer delete certain allegedly inaccurate

personal data about them.

And Schufe had attempted to give certain information to this individual.

They broadly told them what the score was with some broad information about how the

score had been calculated, but not much more than that.

...